1 |
commit: 71e504d3855667b208f140088528957e52cd3289 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sat Mar 31 23:00:08 2018 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Sat Mar 31 23:00:08 2018 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=71e504d3 |
7 |
|
8 |
Linux patch 4.4.125 |
9 |
|
10 |
0000_README | 4 + |
11 |
1124_linux-4.4.125.patch | 1326 ++++++++++++++++++++++++++++++++++++++++++++++ |
12 |
2 files changed, 1330 insertions(+) |
13 |
|
14 |
diff --git a/0000_README b/0000_README |
15 |
index fd31be4..a22a4ac 100644 |
16 |
--- a/0000_README |
17 |
+++ b/0000_README |
18 |
@@ -539,6 +539,10 @@ Patch: 1123_linux-4.4.124.patch |
19 |
From: http://www.kernel.org |
20 |
Desc: Linux 4.4.124 |
21 |
|
22 |
+Patch: 1124_linux-4.4.125.patch |
23 |
+From: http://www.kernel.org |
24 |
+Desc: Linux 4.4.125 |
25 |
+ |
26 |
Patch: 1125_linux-4.4.125.patch |
27 |
From: http://www.kernel.org |
28 |
Desc: Linux 4.4.125 |
29 |
|
30 |
diff --git a/1124_linux-4.4.125.patch b/1124_linux-4.4.125.patch |
31 |
new file mode 100644 |
32 |
index 0000000..162b4b8 |
33 |
--- /dev/null |
34 |
+++ b/1124_linux-4.4.125.patch |
35 |
@@ -0,0 +1,1326 @@ |
36 |
+diff --git a/Makefile b/Makefile |
37 |
+index bbaf3fd0d1ef..7dcafa5dcd34 100644 |
38 |
+--- a/Makefile |
39 |
++++ b/Makefile |
40 |
+@@ -1,6 +1,6 @@ |
41 |
+ VERSION = 4 |
42 |
+ PATCHLEVEL = 4 |
43 |
+-SUBLEVEL = 124 |
44 |
++SUBLEVEL = 125 |
45 |
+ EXTRAVERSION = |
46 |
+ NAME = Blurry Fish Butt |
47 |
+ |
48 |
+@@ -784,6 +784,15 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign) |
49 |
+ # disable invalid "can't wrap" optimizations for signed / pointers |
50 |
+ KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow) |
51 |
+ |
52 |
++# clang sets -fmerge-all-constants by default as optimization, but this |
53 |
++# is non-conforming behavior for C and in fact breaks the kernel, so we |
54 |
++# need to disable it here generally. |
55 |
++KBUILD_CFLAGS += $(call cc-option,-fno-merge-all-constants) |
56 |
++ |
57 |
++# for gcc -fno-merge-all-constants disables everything, but it is fine |
58 |
++# to have actual conforming behavior enabled. |
59 |
++KBUILD_CFLAGS += $(call cc-option,-fmerge-constants) |
60 |
++ |
61 |
+ # Make sure -fstack-check isn't enabled (like gentoo apparently did) |
62 |
+ KBUILD_CFLAGS += $(call cc-option,-fno-stack-check,) |
63 |
+ |
64 |
+diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c |
65 |
+index 653735a8c58a..51ac84e0812d 100644 |
66 |
+--- a/arch/arm64/mm/mmu.c |
67 |
++++ b/arch/arm64/mm/mmu.c |
68 |
+@@ -697,3 +697,15 @@ void *__init fixmap_remap_fdt(phys_addr_t dt_phys) |
69 |
+ |
70 |
+ return dt_virt; |
71 |
+ } |
72 |
++ |
73 |
++#ifdef CONFIG_HAVE_ARCH_HUGE_VMAP |
74 |
++int pud_free_pmd_page(pud_t *pud) |
75 |
++{ |
76 |
++ return pud_none(*pud); |
77 |
++} |
78 |
++ |
79 |
++int pmd_free_pte_page(pmd_t *pmd) |
80 |
++{ |
81 |
++ return pmd_none(*pmd); |
82 |
++} |
83 |
++#endif |
84 |
+diff --git a/arch/mips/ralink/reset.c b/arch/mips/ralink/reset.c |
85 |
+index ee117c4bc4a3..8037a4bd84fd 100644 |
86 |
+--- a/arch/mips/ralink/reset.c |
87 |
++++ b/arch/mips/ralink/reset.c |
88 |
+@@ -96,16 +96,9 @@ static void ralink_restart(char *command) |
89 |
+ unreachable(); |
90 |
+ } |
91 |
+ |
92 |
+-static void ralink_halt(void) |
93 |
+-{ |
94 |
+- local_irq_disable(); |
95 |
+- unreachable(); |
96 |
+-} |
97 |
+- |
98 |
+ static int __init mips_reboot_setup(void) |
99 |
+ { |
100 |
+ _machine_restart = ralink_restart; |
101 |
+- _machine_halt = ralink_halt; |
102 |
+ |
103 |
+ return 0; |
104 |
+ } |
105 |
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile |
106 |
+index 1f9caa041bf7..d2c663aeccba 100644 |
107 |
+--- a/arch/x86/Makefile |
108 |
++++ b/arch/x86/Makefile |
109 |
+@@ -179,6 +179,15 @@ KBUILD_CFLAGS += $(cfi) $(cfi-sigframe) $(cfi-sections) $(asinstr) $(avx_instr) |
110 |
+ |
111 |
+ LDFLAGS := -m elf_$(UTS_MACHINE) |
112 |
+ |
113 |
++# |
114 |
++# The 64-bit kernel must be aligned to 2MB. Pass -z max-page-size=0x200000 to |
115 |
++# the linker to force 2MB page size regardless of the default page size used |
116 |
++# by the linker. |
117 |
++# |
118 |
++ifdef CONFIG_X86_64 |
119 |
++LDFLAGS += $(call ld-option, -z max-page-size=0x200000) |
120 |
++endif |
121 |
++ |
122 |
+ # Speed up the build |
123 |
+ KBUILD_CFLAGS += -pipe |
124 |
+ # Workaround for a gcc prelease that unfortunately was shipped in a suse release |
125 |
+diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c |
126 |
+index 79dac1758e7c..16df89c30c20 100644 |
127 |
+--- a/arch/x86/boot/compressed/misc.c |
128 |
++++ b/arch/x86/boot/compressed/misc.c |
129 |
+@@ -366,6 +366,10 @@ static void parse_elf(void *output) |
130 |
+ |
131 |
+ switch (phdr->p_type) { |
132 |
+ case PT_LOAD: |
133 |
++#ifdef CONFIG_X86_64 |
134 |
++ if ((phdr->p_align % 0x200000) != 0) |
135 |
++ error("Alignment of LOAD segment isn't multiple of 2MB"); |
136 |
++#endif |
137 |
+ #ifdef CONFIG_RELOCATABLE |
138 |
+ dest = output; |
139 |
+ dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR); |
140 |
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S |
141 |
+index 59a4e1604a36..92b840c94f17 100644 |
142 |
+--- a/arch/x86/entry/entry_64.S |
143 |
++++ b/arch/x86/entry/entry_64.S |
144 |
+@@ -1018,7 +1018,7 @@ apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \ |
145 |
+ #endif /* CONFIG_HYPERV */ |
146 |
+ |
147 |
+ idtentry debug do_debug has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK |
148 |
+-idtentry int3 do_int3 has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK |
149 |
++idtentry int3 do_int3 has_error_code=0 |
150 |
+ idtentry stack_segment do_stack_segment has_error_code=1 |
151 |
+ |
152 |
+ #ifdef CONFIG_XEN |
153 |
+diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h |
154 |
+index 6b6e16d813b9..dd11f5cb4149 100644 |
155 |
+--- a/arch/x86/include/asm/vmx.h |
156 |
++++ b/arch/x86/include/asm/vmx.h |
157 |
+@@ -310,6 +310,7 @@ enum vmcs_field { |
158 |
+ #define INTR_TYPE_NMI_INTR (2 << 8) /* NMI */ |
159 |
+ #define INTR_TYPE_HARD_EXCEPTION (3 << 8) /* processor exception */ |
160 |
+ #define INTR_TYPE_SOFT_INTR (4 << 8) /* software interrupt */ |
161 |
++#define INTR_TYPE_PRIV_SW_EXCEPTION (5 << 8) /* ICE breakpoint - undocumented */ |
162 |
+ #define INTR_TYPE_SOFT_EXCEPTION (6 << 8) /* software exception */ |
163 |
+ |
164 |
+ /* GUEST_INTERRUPTIBILITY_INFO flags. */ |
165 |
+diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c |
166 |
+index 5cc2242d77c6..7b79c80ce029 100644 |
167 |
+--- a/arch/x86/kernel/cpu/perf_event_intel.c |
168 |
++++ b/arch/x86/kernel/cpu/perf_event_intel.c |
169 |
+@@ -2716,7 +2716,7 @@ static unsigned bdw_limit_period(struct perf_event *event, unsigned left) |
170 |
+ X86_CONFIG(.event=0xc0, .umask=0x01)) { |
171 |
+ if (left < 128) |
172 |
+ left = 128; |
173 |
+- left &= ~0x3fu; |
174 |
++ left &= ~0x3fULL; |
175 |
+ } |
176 |
+ return left; |
177 |
+ } |
178 |
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c |
179 |
+index 22b81f35c500..1fbd2631be60 100644 |
180 |
+--- a/arch/x86/kernel/traps.c |
181 |
++++ b/arch/x86/kernel/traps.c |
182 |
+@@ -480,7 +480,6 @@ do_general_protection(struct pt_regs *regs, long error_code) |
183 |
+ } |
184 |
+ NOKPROBE_SYMBOL(do_general_protection); |
185 |
+ |
186 |
+-/* May run on IST stack. */ |
187 |
+ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) |
188 |
+ { |
189 |
+ #ifdef CONFIG_DYNAMIC_FTRACE |
190 |
+@@ -495,7 +494,15 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) |
191 |
+ if (poke_int3_handler(regs)) |
192 |
+ return; |
193 |
+ |
194 |
++ /* |
195 |
++ * Use ist_enter despite the fact that we don't use an IST stack. |
196 |
++ * We can be called from a kprobe in non-CONTEXT_KERNEL kernel |
197 |
++ * mode or even during context tracking state changes. |
198 |
++ * |
199 |
++ * This means that we can't schedule. That's okay. |
200 |
++ */ |
201 |
+ ist_enter(regs); |
202 |
++ |
203 |
+ RCU_LOCKDEP_WARN(!rcu_is_watching(), "entry code didn't wake RCU"); |
204 |
+ #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP |
205 |
+ if (kgdb_ll_trap(DIE_INT3, "int3", regs, error_code, X86_TRAP_BP, |
206 |
+@@ -512,15 +519,9 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) |
207 |
+ SIGTRAP) == NOTIFY_STOP) |
208 |
+ goto exit; |
209 |
+ |
210 |
+- /* |
211 |
+- * Let others (NMI) know that the debug stack is in use |
212 |
+- * as we may switch to the interrupt stack. |
213 |
+- */ |
214 |
+- debug_stack_usage_inc(); |
215 |
+ preempt_conditional_sti(regs); |
216 |
+ do_trap(X86_TRAP_BP, SIGTRAP, "int3", regs, error_code, NULL); |
217 |
+ preempt_conditional_cli(regs); |
218 |
+- debug_stack_usage_dec(); |
219 |
+ exit: |
220 |
+ ist_exit(regs); |
221 |
+ } |
222 |
+@@ -886,19 +887,16 @@ void __init trap_init(void) |
223 |
+ cpu_init(); |
224 |
+ |
225 |
+ /* |
226 |
+- * X86_TRAP_DB and X86_TRAP_BP have been set |
227 |
+- * in early_trap_init(). However, ITS works only after |
228 |
+- * cpu_init() loads TSS. See comments in early_trap_init(). |
229 |
++ * X86_TRAP_DB was installed in early_trap_init(). However, |
230 |
++ * IST works only after cpu_init() loads TSS. See comments |
231 |
++ * in early_trap_init(). |
232 |
+ */ |
233 |
+ set_intr_gate_ist(X86_TRAP_DB, &debug, DEBUG_STACK); |
234 |
+- /* int3 can be called from all */ |
235 |
+- set_system_intr_gate_ist(X86_TRAP_BP, &int3, DEBUG_STACK); |
236 |
+ |
237 |
+ x86_init.irqs.trap_init(); |
238 |
+ |
239 |
+ #ifdef CONFIG_X86_64 |
240 |
+ memcpy(&debug_idt_table, &idt_table, IDT_ENTRIES * 16); |
241 |
+ set_nmi_gate(X86_TRAP_DB, &debug); |
242 |
+- set_nmi_gate(X86_TRAP_BP, &int3); |
243 |
+ #endif |
244 |
+ } |
245 |
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c |
246 |
+index 849517805eef..46bbc69844bd 100644 |
247 |
+--- a/arch/x86/kvm/vmx.c |
248 |
++++ b/arch/x86/kvm/vmx.c |
249 |
+@@ -1011,6 +1011,13 @@ static inline bool is_machine_check(u32 intr_info) |
250 |
+ (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK); |
251 |
+ } |
252 |
+ |
253 |
++/* Undocumented: icebp/int1 */ |
254 |
++static inline bool is_icebp(u32 intr_info) |
255 |
++{ |
256 |
++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK)) |
257 |
++ == (INTR_TYPE_PRIV_SW_EXCEPTION | INTR_INFO_VALID_MASK); |
258 |
++} |
259 |
++ |
260 |
+ static inline bool cpu_has_vmx_msr_bitmap(void) |
261 |
+ { |
262 |
+ return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS; |
263 |
+@@ -5333,7 +5340,7 @@ static int handle_exception(struct kvm_vcpu *vcpu) |
264 |
+ (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) { |
265 |
+ vcpu->arch.dr6 &= ~15; |
266 |
+ vcpu->arch.dr6 |= dr6 | DR6_RTM; |
267 |
+- if (!(dr6 & ~DR6_RESERVED)) /* icebp */ |
268 |
++ if (is_icebp(intr_info)) |
269 |
+ skip_emulated_instruction(vcpu); |
270 |
+ |
271 |
+ kvm_queue_exception(vcpu, DB_VECTOR); |
272 |
+diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c |
273 |
+index dbc27a2b4ad5..c013326a0d7a 100644 |
274 |
+--- a/arch/x86/mm/pgtable.c |
275 |
++++ b/arch/x86/mm/pgtable.c |
276 |
+@@ -666,4 +666,52 @@ int pmd_clear_huge(pmd_t *pmd) |
277 |
+ |
278 |
+ return 0; |
279 |
+ } |
280 |
++ |
281 |
++/** |
282 |
++ * pud_free_pmd_page - Clear pud entry and free pmd page. |
283 |
++ * @pud: Pointer to a PUD. |
284 |
++ * |
285 |
++ * Context: The pud range has been unmaped and TLB purged. |
286 |
++ * Return: 1 if clearing the entry succeeded. 0 otherwise. |
287 |
++ */ |
288 |
++int pud_free_pmd_page(pud_t *pud) |
289 |
++{ |
290 |
++ pmd_t *pmd; |
291 |
++ int i; |
292 |
++ |
293 |
++ if (pud_none(*pud)) |
294 |
++ return 1; |
295 |
++ |
296 |
++ pmd = (pmd_t *)pud_page_vaddr(*pud); |
297 |
++ |
298 |
++ for (i = 0; i < PTRS_PER_PMD; i++) |
299 |
++ if (!pmd_free_pte_page(&pmd[i])) |
300 |
++ return 0; |
301 |
++ |
302 |
++ pud_clear(pud); |
303 |
++ free_page((unsigned long)pmd); |
304 |
++ |
305 |
++ return 1; |
306 |
++} |
307 |
++ |
308 |
++/** |
309 |
++ * pmd_free_pte_page - Clear pmd entry and free pte page. |
310 |
++ * @pmd: Pointer to a PMD. |
311 |
++ * |
312 |
++ * Context: The pmd range has been unmaped and TLB purged. |
313 |
++ * Return: 1 if clearing the entry succeeded. 0 otherwise. |
314 |
++ */ |
315 |
++int pmd_free_pte_page(pmd_t *pmd) |
316 |
++{ |
317 |
++ pte_t *pte; |
318 |
++ |
319 |
++ if (pmd_none(*pmd)) |
320 |
++ return 1; |
321 |
++ |
322 |
++ pte = (pte_t *)pmd_page_vaddr(*pmd); |
323 |
++ pmd_clear(pmd); |
324 |
++ free_page((unsigned long)pte); |
325 |
++ |
326 |
++ return 1; |
327 |
++} |
328 |
+ #endif /* CONFIG_HAVE_ARCH_HUGE_VMAP */ |
329 |
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c |
330 |
+index a889211e21c5..dd9a861fd526 100644 |
331 |
+--- a/arch/x86/net/bpf_jit_comp.c |
332 |
++++ b/arch/x86/net/bpf_jit_comp.c |
333 |
+@@ -1077,7 +1077,7 @@ void bpf_int_jit_compile(struct bpf_prog *prog) |
334 |
+ * may converge on the last pass. In such case do one more |
335 |
+ * pass to emit the final image |
336 |
+ */ |
337 |
+- for (pass = 0; pass < 10 || image; pass++) { |
338 |
++ for (pass = 0; pass < 20 || image; pass++) { |
339 |
+ proglen = do_jit(prog, addrs, image, oldproglen, &ctx); |
340 |
+ if (proglen <= 0) { |
341 |
+ image = NULL; |
342 |
+@@ -1100,6 +1100,7 @@ void bpf_int_jit_compile(struct bpf_prog *prog) |
343 |
+ goto out; |
344 |
+ } |
345 |
+ oldproglen = proglen; |
346 |
++ cond_resched(); |
347 |
+ } |
348 |
+ |
349 |
+ if (bpf_jit_enable > 1) |
350 |
+diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c |
351 |
+index d176e0ece470..2946e2846573 100644 |
352 |
+--- a/drivers/acpi/numa.c |
353 |
++++ b/drivers/acpi/numa.c |
354 |
+@@ -103,25 +103,27 @@ int acpi_map_pxm_to_node(int pxm) |
355 |
+ */ |
356 |
+ int acpi_map_pxm_to_online_node(int pxm) |
357 |
+ { |
358 |
+- int node, n, dist, min_dist; |
359 |
++ int node, min_node; |
360 |
+ |
361 |
+ node = acpi_map_pxm_to_node(pxm); |
362 |
+ |
363 |
+ if (node == NUMA_NO_NODE) |
364 |
+ node = 0; |
365 |
+ |
366 |
++ min_node = node; |
367 |
+ if (!node_online(node)) { |
368 |
+- min_dist = INT_MAX; |
369 |
++ int min_dist = INT_MAX, dist, n; |
370 |
++ |
371 |
+ for_each_online_node(n) { |
372 |
+ dist = node_distance(node, n); |
373 |
+ if (dist < min_dist) { |
374 |
+ min_dist = dist; |
375 |
+- node = n; |
376 |
++ min_node = n; |
377 |
+ } |
378 |
+ } |
379 |
+ } |
380 |
+ |
381 |
+- return node; |
382 |
++ return min_node; |
383 |
+ } |
384 |
+ EXPORT_SYMBOL(acpi_map_pxm_to_online_node); |
385 |
+ |
386 |
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c |
387 |
+index 8ddf5d5c94fd..5a6a01135470 100644 |
388 |
+--- a/drivers/ata/ahci.c |
389 |
++++ b/drivers/ata/ahci.c |
390 |
+@@ -538,7 +538,9 @@ static const struct pci_device_id ahci_pci_tbl[] = { |
391 |
+ .driver_data = board_ahci_yes_fbs }, |
392 |
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230), |
393 |
+ .driver_data = board_ahci_yes_fbs }, |
394 |
+- { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), |
395 |
++ { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), /* highpoint rocketraid 642L */ |
396 |
++ .driver_data = board_ahci_yes_fbs }, |
397 |
++ { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0645), /* highpoint rocketraid 644L */ |
398 |
+ .driver_data = board_ahci_yes_fbs }, |
399 |
+ |
400 |
+ /* Promise */ |
401 |
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c |
402 |
+index 69ec1c5d7152..2d677ba46d77 100644 |
403 |
+--- a/drivers/ata/libata-core.c |
404 |
++++ b/drivers/ata/libata-core.c |
405 |
+@@ -4224,6 +4224,25 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { |
406 |
+ { "PIONEER DVD-RW DVR-212D", NULL, ATA_HORKAGE_NOSETXFER }, |
407 |
+ { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, |
408 |
+ |
409 |
++ /* Crucial BX100 SSD 500GB has broken LPM support */ |
410 |
++ { "CT500BX100SSD1", NULL, ATA_HORKAGE_NOLPM }, |
411 |
++ |
412 |
++ /* 512GB MX100 with MU01 firmware has both queued TRIM and LPM issues */ |
413 |
++ { "Crucial_CT512MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | |
414 |
++ ATA_HORKAGE_ZERO_AFTER_TRIM | |
415 |
++ ATA_HORKAGE_NOLPM, }, |
416 |
++ /* 512GB MX100 with newer firmware has only LPM issues */ |
417 |
++ { "Crucial_CT512MX100*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM | |
418 |
++ ATA_HORKAGE_NOLPM, }, |
419 |
++ |
420 |
++ /* 480GB+ M500 SSDs have both queued TRIM and LPM issues */ |
421 |
++ { "Crucial_CT480M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | |
422 |
++ ATA_HORKAGE_ZERO_AFTER_TRIM | |
423 |
++ ATA_HORKAGE_NOLPM, }, |
424 |
++ { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | |
425 |
++ ATA_HORKAGE_ZERO_AFTER_TRIM | |
426 |
++ ATA_HORKAGE_NOLPM, }, |
427 |
++ |
428 |
+ /* devices that don't properly handle queued TRIM commands */ |
429 |
+ { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | |
430 |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, }, |
431 |
+@@ -4235,7 +4254,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { |
432 |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, }, |
433 |
+ { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | |
434 |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, }, |
435 |
+- { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | |
436 |
++ { "Samsung SSD 840*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | |
437 |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, |
438 |
++ { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | |
439 |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, }, |
440 |
+ { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | |
441 |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, }, |
442 |
+@@ -5077,8 +5098,7 @@ void ata_qc_issue(struct ata_queued_cmd *qc) |
443 |
+ * We guarantee to LLDs that they will have at least one |
444 |
+ * non-zero sg if the command is a data command. |
445 |
+ */ |
446 |
+- if (WARN_ON_ONCE(ata_is_data(prot) && |
447 |
+- (!qc->sg || !qc->n_elem || !qc->nbytes))) |
448 |
++ if (ata_is_data(prot) && (!qc->sg || !qc->n_elem || !qc->nbytes)) |
449 |
+ goto sys_err; |
450 |
+ |
451 |
+ if (ata_is_dma(prot) || (ata_is_pio(prot) && |
452 |
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c |
453 |
+index 5b2aee83d776..4a267347a6d9 100644 |
454 |
+--- a/drivers/ata/libata-scsi.c |
455 |
++++ b/drivers/ata/libata-scsi.c |
456 |
+@@ -3472,7 +3472,9 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, |
457 |
+ if (likely((scsi_op != ATA_16) || !atapi_passthru16)) { |
458 |
+ /* relay SCSI command to ATAPI device */ |
459 |
+ int len = COMMAND_SIZE(scsi_op); |
460 |
+- if (unlikely(len > scmd->cmd_len || len > dev->cdb_len)) |
461 |
++ if (unlikely(len > scmd->cmd_len || |
462 |
++ len > dev->cdb_len || |
463 |
++ scmd->cmd_len > ATAPI_CDB_LEN)) |
464 |
+ goto bad_cdb_len; |
465 |
+ |
466 |
+ xlat_func = atapi_xlat; |
467 |
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c |
468 |
+index 54cef3dc0beb..7fca7cfd5b09 100644 |
469 |
+--- a/drivers/bluetooth/btusb.c |
470 |
++++ b/drivers/bluetooth/btusb.c |
471 |
+@@ -216,7 +216,6 @@ static const struct usb_device_id blacklist_table[] = { |
472 |
+ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, |
473 |
+ { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, |
474 |
+ { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, |
475 |
+- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, |
476 |
+ { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, |
477 |
+ { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, |
478 |
+ { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, |
479 |
+@@ -247,6 +246,7 @@ static const struct usb_device_id blacklist_table[] = { |
480 |
+ { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, |
481 |
+ |
482 |
+ /* QCA ROME chipset */ |
483 |
++ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME }, |
484 |
+ { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME }, |
485 |
+ { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME }, |
486 |
+ { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME }, |
487 |
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c |
488 |
+index 35ab89fe9d7b..7c4b1ffe874f 100644 |
489 |
+--- a/drivers/clk/bcm/clk-bcm2835.c |
490 |
++++ b/drivers/clk/bcm/clk-bcm2835.c |
491 |
+@@ -912,8 +912,10 @@ static int bcm2835_pll_on(struct clk_hw *hw) |
492 |
+ ~A2W_PLL_CTRL_PWRDN); |
493 |
+ |
494 |
+ /* Take the PLL out of reset. */ |
495 |
++ spin_lock(&cprman->regs_lock); |
496 |
+ cprman_write(cprman, data->cm_ctrl_reg, |
497 |
+ cprman_read(cprman, data->cm_ctrl_reg) & ~CM_PLL_ANARST); |
498 |
++ spin_unlock(&cprman->regs_lock); |
499 |
+ |
500 |
+ /* Wait for the PLL to lock. */ |
501 |
+ timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS); |
502 |
+@@ -997,9 +999,11 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, |
503 |
+ } |
504 |
+ |
505 |
+ /* Unmask the reference clock from the oscillator. */ |
506 |
++ spin_lock(&cprman->regs_lock); |
507 |
+ cprman_write(cprman, A2W_XOSC_CTRL, |
508 |
+ cprman_read(cprman, A2W_XOSC_CTRL) | |
509 |
+ data->reference_enable_mask); |
510 |
++ spin_unlock(&cprman->regs_lock); |
511 |
+ |
512 |
+ if (do_ana_setup_first) |
513 |
+ bcm2835_pll_write_ana(cprman, data->ana_reg_base, ana); |
514 |
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c |
515 |
+index 3feaab94f358..1a2a7365d0b5 100644 |
516 |
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c |
517 |
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c |
518 |
+@@ -89,25 +89,18 @@ void radeon_connector_hotplug(struct drm_connector *connector) |
519 |
+ /* don't do anything if sink is not display port, i.e., |
520 |
+ * passive dp->(dvi|hdmi) adaptor |
521 |
+ */ |
522 |
+- if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) { |
523 |
+- int saved_dpms = connector->dpms; |
524 |
+- /* Only turn off the display if it's physically disconnected */ |
525 |
+- if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) { |
526 |
+- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); |
527 |
+- } else if (radeon_dp_needs_link_train(radeon_connector)) { |
528 |
+- /* Don't try to start link training before we |
529 |
+- * have the dpcd */ |
530 |
+- if (!radeon_dp_getdpcd(radeon_connector)) |
531 |
+- return; |
532 |
+- |
533 |
+- /* set it to OFF so that drm_helper_connector_dpms() |
534 |
+- * won't return immediately since the current state |
535 |
+- * is ON at this point. |
536 |
+- */ |
537 |
+- connector->dpms = DRM_MODE_DPMS_OFF; |
538 |
+- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); |
539 |
+- } |
540 |
+- connector->dpms = saved_dpms; |
541 |
++ if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT && |
542 |
++ radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) && |
543 |
++ radeon_dp_needs_link_train(radeon_connector)) { |
544 |
++ /* Don't start link training before we have the DPCD */ |
545 |
++ if (!radeon_dp_getdpcd(radeon_connector)) |
546 |
++ return; |
547 |
++ |
548 |
++ /* Turn the connector off and back on immediately, which |
549 |
++ * will trigger link training |
550 |
++ */ |
551 |
++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); |
552 |
++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); |
553 |
+ } |
554 |
+ } |
555 |
+ } |
556 |
+diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c |
557 |
+index 73e41a8613da..29bd801f5dad 100644 |
558 |
+--- a/drivers/gpu/drm/udl/udl_fb.c |
559 |
++++ b/drivers/gpu/drm/udl/udl_fb.c |
560 |
+@@ -256,10 +256,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma) |
561 |
+ { |
562 |
+ unsigned long start = vma->vm_start; |
563 |
+ unsigned long size = vma->vm_end - vma->vm_start; |
564 |
+- unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; |
565 |
++ unsigned long offset; |
566 |
+ unsigned long page, pos; |
567 |
+ |
568 |
+- if (offset + size > info->fix.smem_len) |
569 |
++ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) |
570 |
++ return -EINVAL; |
571 |
++ |
572 |
++ offset = vma->vm_pgoff << PAGE_SHIFT; |
573 |
++ |
574 |
++ if (offset > info->fix.smem_len || size > info->fix.smem_len - offset) |
575 |
+ return -EINVAL; |
576 |
+ |
577 |
+ pos = (unsigned long)info->fix.smem_start + offset; |
578 |
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c |
579 |
+index 060e5c6f4446..098e562bd579 100644 |
580 |
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c |
581 |
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c |
582 |
+@@ -27,7 +27,6 @@ |
583 |
+ |
584 |
+ #include "vmwgfx_kms.h" |
585 |
+ |
586 |
+- |
587 |
+ /* Might need a hrtimer here? */ |
588 |
+ #define VMWGFX_PRESENT_RATE ((HZ / 60 > 0) ? HZ / 60 : 1) |
589 |
+ |
590 |
+@@ -1910,9 +1909,12 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv, |
591 |
+ * Helper to be used if an error forces the caller to undo the actions of |
592 |
+ * vmw_kms_helper_resource_prepare. |
593 |
+ */ |
594 |
+-void vmw_kms_helper_resource_revert(struct vmw_resource *res) |
595 |
++void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx) |
596 |
+ { |
597 |
+- vmw_kms_helper_buffer_revert(res->backup); |
598 |
++ struct vmw_resource *res = ctx->res; |
599 |
++ |
600 |
++ vmw_kms_helper_buffer_revert(ctx->buf); |
601 |
++ vmw_dmabuf_unreference(&ctx->buf); |
602 |
+ vmw_resource_unreserve(res, false, NULL, 0); |
603 |
+ mutex_unlock(&res->dev_priv->cmdbuf_mutex); |
604 |
+ } |
605 |
+@@ -1929,10 +1931,14 @@ void vmw_kms_helper_resource_revert(struct vmw_resource *res) |
606 |
+ * interrupted by a signal. |
607 |
+ */ |
608 |
+ int vmw_kms_helper_resource_prepare(struct vmw_resource *res, |
609 |
+- bool interruptible) |
610 |
++ bool interruptible, |
611 |
++ struct vmw_validation_ctx *ctx) |
612 |
+ { |
613 |
+ int ret = 0; |
614 |
+ |
615 |
++ ctx->buf = NULL; |
616 |
++ ctx->res = res; |
617 |
++ |
618 |
+ if (interruptible) |
619 |
+ ret = mutex_lock_interruptible(&res->dev_priv->cmdbuf_mutex); |
620 |
+ else |
621 |
+@@ -1951,6 +1957,8 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res, |
622 |
+ res->dev_priv->has_mob); |
623 |
+ if (ret) |
624 |
+ goto out_unreserve; |
625 |
++ |
626 |
++ ctx->buf = vmw_dmabuf_reference(res->backup); |
627 |
+ } |
628 |
+ ret = vmw_resource_validate(res); |
629 |
+ if (ret) |
630 |
+@@ -1958,7 +1966,7 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res, |
631 |
+ return 0; |
632 |
+ |
633 |
+ out_revert: |
634 |
+- vmw_kms_helper_buffer_revert(res->backup); |
635 |
++ vmw_kms_helper_buffer_revert(ctx->buf); |
636 |
+ out_unreserve: |
637 |
+ vmw_resource_unreserve(res, false, NULL, 0); |
638 |
+ out_unlock: |
639 |
+@@ -1974,11 +1982,13 @@ out_unlock: |
640 |
+ * @out_fence: Optional pointer to a fence pointer. If non-NULL, a |
641 |
+ * ref-counted fence pointer is returned here. |
642 |
+ */ |
643 |
+-void vmw_kms_helper_resource_finish(struct vmw_resource *res, |
644 |
+- struct vmw_fence_obj **out_fence) |
645 |
++void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx, |
646 |
++ struct vmw_fence_obj **out_fence) |
647 |
+ { |
648 |
+- if (res->backup || out_fence) |
649 |
+- vmw_kms_helper_buffer_finish(res->dev_priv, NULL, res->backup, |
650 |
++ struct vmw_resource *res = ctx->res; |
651 |
++ |
652 |
++ if (ctx->buf || out_fence) |
653 |
++ vmw_kms_helper_buffer_finish(res->dev_priv, NULL, ctx->buf, |
654 |
+ out_fence, NULL); |
655 |
+ |
656 |
+ vmw_resource_unreserve(res, false, NULL, 0); |
657 |
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h |
658 |
+index edd81503516d..63b05d5ee50a 100644 |
659 |
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h |
660 |
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h |
661 |
+@@ -180,6 +180,11 @@ struct vmw_display_unit { |
662 |
+ bool is_implicit; |
663 |
+ }; |
664 |
+ |
665 |
++struct vmw_validation_ctx { |
666 |
++ struct vmw_resource *res; |
667 |
++ struct vmw_dma_buffer *buf; |
668 |
++}; |
669 |
++ |
670 |
+ #define vmw_crtc_to_du(x) \ |
671 |
+ container_of(x, struct vmw_display_unit, crtc) |
672 |
+ #define vmw_connector_to_du(x) \ |
673 |
+@@ -230,9 +235,10 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv, |
674 |
+ struct drm_vmw_fence_rep __user * |
675 |
+ user_fence_rep); |
676 |
+ int vmw_kms_helper_resource_prepare(struct vmw_resource *res, |
677 |
+- bool interruptible); |
678 |
+-void vmw_kms_helper_resource_revert(struct vmw_resource *res); |
679 |
+-void vmw_kms_helper_resource_finish(struct vmw_resource *res, |
680 |
++ bool interruptible, |
681 |
++ struct vmw_validation_ctx *ctx); |
682 |
++void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx); |
683 |
++void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx, |
684 |
+ struct vmw_fence_obj **out_fence); |
685 |
+ int vmw_kms_readback(struct vmw_private *dev_priv, |
686 |
+ struct drm_file *file_priv, |
687 |
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c |
688 |
+index 13926ff192e3..f50fcd213413 100644 |
689 |
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c |
690 |
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c |
691 |
+@@ -841,12 +841,13 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv, |
692 |
+ struct vmw_framebuffer_surface *vfbs = |
693 |
+ container_of(framebuffer, typeof(*vfbs), base); |
694 |
+ struct vmw_kms_sou_surface_dirty sdirty; |
695 |
++ struct vmw_validation_ctx ctx; |
696 |
+ int ret; |
697 |
+ |
698 |
+ if (!srf) |
699 |
+ srf = &vfbs->surface->res; |
700 |
+ |
701 |
+- ret = vmw_kms_helper_resource_prepare(srf, true); |
702 |
++ ret = vmw_kms_helper_resource_prepare(srf, true, &ctx); |
703 |
+ if (ret) |
704 |
+ return ret; |
705 |
+ |
706 |
+@@ -865,7 +866,7 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv, |
707 |
+ ret = vmw_kms_helper_dirty(dev_priv, framebuffer, clips, vclips, |
708 |
+ dest_x, dest_y, num_clips, inc, |
709 |
+ &sdirty.base); |
710 |
+- vmw_kms_helper_resource_finish(srf, out_fence); |
711 |
++ vmw_kms_helper_resource_finish(&ctx, out_fence); |
712 |
+ |
713 |
+ return ret; |
714 |
+ } |
715 |
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c |
716 |
+index f823fc3efed7..3184a9ae22c1 100644 |
717 |
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c |
718 |
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c |
719 |
+@@ -1003,12 +1003,13 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv, |
720 |
+ struct vmw_framebuffer_surface *vfbs = |
721 |
+ container_of(framebuffer, typeof(*vfbs), base); |
722 |
+ struct vmw_stdu_dirty sdirty; |
723 |
++ struct vmw_validation_ctx ctx; |
724 |
+ int ret; |
725 |
+ |
726 |
+ if (!srf) |
727 |
+ srf = &vfbs->surface->res; |
728 |
+ |
729 |
+- ret = vmw_kms_helper_resource_prepare(srf, true); |
730 |
++ ret = vmw_kms_helper_resource_prepare(srf, true, &ctx); |
731 |
+ if (ret) |
732 |
+ return ret; |
733 |
+ |
734 |
+@@ -1031,7 +1032,7 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv, |
735 |
+ dest_x, dest_y, num_clips, inc, |
736 |
+ &sdirty.base); |
737 |
+ out_finish: |
738 |
+- vmw_kms_helper_resource_finish(srf, out_fence); |
739 |
++ vmw_kms_helper_resource_finish(&ctx, out_fence); |
740 |
+ |
741 |
+ return ret; |
742 |
+ } |
743 |
+diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c |
744 |
+index 84ab20c6b389..b4136d3bf6b7 100644 |
745 |
+--- a/drivers/iio/accel/st_accel_core.c |
746 |
++++ b/drivers/iio/accel/st_accel_core.c |
747 |
+@@ -657,7 +657,7 @@ int st_accel_common_probe(struct iio_dev *indio_dev) |
748 |
+ if (!pdata) |
749 |
+ pdata = (struct st_sensors_platform_data *)&default_accel_pdata; |
750 |
+ |
751 |
+- err = st_sensors_init_sensor(indio_dev, adata->dev->platform_data); |
752 |
++ err = st_sensors_init_sensor(indio_dev, pdata); |
753 |
+ if (err < 0) |
754 |
+ return err; |
755 |
+ |
756 |
+diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c |
757 |
+index 270eeac928bc..ba282ff3892d 100644 |
758 |
+--- a/drivers/iio/pressure/st_pressure_core.c |
759 |
++++ b/drivers/iio/pressure/st_pressure_core.c |
760 |
+@@ -469,7 +469,7 @@ int st_press_common_probe(struct iio_dev *indio_dev) |
761 |
+ if (!pdata && press_data->sensor_settings->drdy_irq.addr) |
762 |
+ pdata = (struct st_sensors_platform_data *)&default_press_pdata; |
763 |
+ |
764 |
+- err = st_sensors_init_sensor(indio_dev, press_data->dev->platform_data); |
765 |
++ err = st_sensors_init_sensor(indio_dev, pdata); |
766 |
+ if (err < 0) |
767 |
+ return err; |
768 |
+ |
769 |
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c |
770 |
+index fb204ee6ff89..581f5d0271f4 100644 |
771 |
+--- a/drivers/mmc/host/dw_mmc.c |
772 |
++++ b/drivers/mmc/host/dw_mmc.c |
773 |
+@@ -619,6 +619,7 @@ static int dw_mci_idmac_init(struct dw_mci *host) |
774 |
+ (sizeof(struct idmac_desc_64addr) * |
775 |
+ (i + 1))) >> 32; |
776 |
+ /* Initialize reserved and buffer size fields to "0" */ |
777 |
++ p->des0 = 0; |
778 |
+ p->des1 = 0; |
779 |
+ p->des2 = 0; |
780 |
+ p->des3 = 0; |
781 |
+@@ -640,6 +641,7 @@ static int dw_mci_idmac_init(struct dw_mci *host) |
782 |
+ i++, p++) { |
783 |
+ p->des3 = cpu_to_le32(host->sg_dma + |
784 |
+ (sizeof(struct idmac_desc) * (i + 1))); |
785 |
++ p->des0 = 0; |
786 |
+ p->des1 = 0; |
787 |
+ } |
788 |
+ |
789 |
+@@ -2807,8 +2809,8 @@ static bool dw_mci_reset(struct dw_mci *host) |
790 |
+ } |
791 |
+ |
792 |
+ if (host->use_dma == TRANS_MODE_IDMAC) |
793 |
+- /* It is also recommended that we reset and reprogram idmac */ |
794 |
+- dw_mci_idmac_reset(host); |
795 |
++ /* It is also required that we reinit idmac */ |
796 |
++ dw_mci_idmac_init(host); |
797 |
+ |
798 |
+ ret = true; |
799 |
+ |
800 |
+diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c |
801 |
+index 7f4ac8c19001..5e3fa5861039 100644 |
802 |
+--- a/drivers/mtd/nand/fsl_ifc_nand.c |
803 |
++++ b/drivers/mtd/nand/fsl_ifc_nand.c |
804 |
+@@ -726,6 +726,7 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip) |
805 |
+ struct fsl_ifc_ctrl *ctrl = priv->ctrl; |
806 |
+ struct fsl_ifc_regs __iomem *ifc = ctrl->regs; |
807 |
+ u32 nand_fsr; |
808 |
++ int status; |
809 |
+ |
810 |
+ /* Use READ_STATUS command, but wait for the device to be ready */ |
811 |
+ ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) | |
812 |
+@@ -740,12 +741,12 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip) |
813 |
+ fsl_ifc_run_command(mtd); |
814 |
+ |
815 |
+ nand_fsr = ifc_in32(&ifc->ifc_nand.nand_fsr); |
816 |
+- |
817 |
++ status = nand_fsr >> 24; |
818 |
+ /* |
819 |
+ * The chip always seems to report that it is |
820 |
+ * write-protected, even when it is not. |
821 |
+ */ |
822 |
+- return nand_fsr | NAND_STATUS_WP; |
823 |
++ return status | NAND_STATUS_WP; |
824 |
+ } |
825 |
+ |
826 |
+ static int fsl_ifc_read_page(struct mtd_info *mtd, struct nand_chip *chip, |
827 |
+diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c |
828 |
+index 1e37313054f3..6da69af103e6 100644 |
829 |
+--- a/drivers/net/can/cc770/cc770.c |
830 |
++++ b/drivers/net/can/cc770/cc770.c |
831 |
+@@ -390,37 +390,23 @@ static int cc770_get_berr_counter(const struct net_device *dev, |
832 |
+ return 0; |
833 |
+ } |
834 |
+ |
835 |
+-static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev) |
836 |
++static void cc770_tx(struct net_device *dev, int mo) |
837 |
+ { |
838 |
+ struct cc770_priv *priv = netdev_priv(dev); |
839 |
+- struct net_device_stats *stats = &dev->stats; |
840 |
+- struct can_frame *cf = (struct can_frame *)skb->data; |
841 |
+- unsigned int mo = obj2msgobj(CC770_OBJ_TX); |
842 |
++ struct can_frame *cf = (struct can_frame *)priv->tx_skb->data; |
843 |
+ u8 dlc, rtr; |
844 |
+ u32 id; |
845 |
+ int i; |
846 |
+ |
847 |
+- if (can_dropped_invalid_skb(dev, skb)) |
848 |
+- return NETDEV_TX_OK; |
849 |
+- |
850 |
+- if ((cc770_read_reg(priv, |
851 |
+- msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) { |
852 |
+- netdev_err(dev, "TX register is still occupied!\n"); |
853 |
+- return NETDEV_TX_BUSY; |
854 |
+- } |
855 |
+- |
856 |
+- netif_stop_queue(dev); |
857 |
+- |
858 |
+ dlc = cf->can_dlc; |
859 |
+ id = cf->can_id; |
860 |
+- if (cf->can_id & CAN_RTR_FLAG) |
861 |
+- rtr = 0; |
862 |
+- else |
863 |
+- rtr = MSGCFG_DIR; |
864 |
++ rtr = cf->can_id & CAN_RTR_FLAG ? 0 : MSGCFG_DIR; |
865 |
++ |
866 |
++ cc770_write_reg(priv, msgobj[mo].ctrl0, |
867 |
++ MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES); |
868 |
+ cc770_write_reg(priv, msgobj[mo].ctrl1, |
869 |
+ RMTPND_RES | TXRQST_RES | CPUUPD_SET | NEWDAT_RES); |
870 |
+- cc770_write_reg(priv, msgobj[mo].ctrl0, |
871 |
+- MSGVAL_SET | TXIE_SET | RXIE_RES | INTPND_RES); |
872 |
++ |
873 |
+ if (id & CAN_EFF_FLAG) { |
874 |
+ id &= CAN_EFF_MASK; |
875 |
+ cc770_write_reg(priv, msgobj[mo].config, |
876 |
+@@ -439,22 +425,30 @@ static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev) |
877 |
+ for (i = 0; i < dlc; i++) |
878 |
+ cc770_write_reg(priv, msgobj[mo].data[i], cf->data[i]); |
879 |
+ |
880 |
+- /* Store echo skb before starting the transfer */ |
881 |
+- can_put_echo_skb(skb, dev, 0); |
882 |
+- |
883 |
+ cc770_write_reg(priv, msgobj[mo].ctrl1, |
884 |
+- RMTPND_RES | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC); |
885 |
++ RMTPND_UNC | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC); |
886 |
++ cc770_write_reg(priv, msgobj[mo].ctrl0, |
887 |
++ MSGVAL_SET | TXIE_SET | RXIE_SET | INTPND_UNC); |
888 |
++} |
889 |
+ |
890 |
+- stats->tx_bytes += dlc; |
891 |
++static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev) |
892 |
++{ |
893 |
++ struct cc770_priv *priv = netdev_priv(dev); |
894 |
++ unsigned int mo = obj2msgobj(CC770_OBJ_TX); |
895 |
+ |
896 |
++ if (can_dropped_invalid_skb(dev, skb)) |
897 |
++ return NETDEV_TX_OK; |
898 |
+ |
899 |
+- /* |
900 |
+- * HM: We had some cases of repeated IRQs so make sure the |
901 |
+- * INT is acknowledged I know it's already further up, but |
902 |
+- * doing again fixed the issue |
903 |
+- */ |
904 |
+- cc770_write_reg(priv, msgobj[mo].ctrl0, |
905 |
+- MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES); |
906 |
++ netif_stop_queue(dev); |
907 |
++ |
908 |
++ if ((cc770_read_reg(priv, |
909 |
++ msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) { |
910 |
++ netdev_err(dev, "TX register is still occupied!\n"); |
911 |
++ return NETDEV_TX_BUSY; |
912 |
++ } |
913 |
++ |
914 |
++ priv->tx_skb = skb; |
915 |
++ cc770_tx(dev, mo); |
916 |
+ |
917 |
+ return NETDEV_TX_OK; |
918 |
+ } |
919 |
+@@ -680,19 +674,46 @@ static void cc770_tx_interrupt(struct net_device *dev, unsigned int o) |
920 |
+ struct cc770_priv *priv = netdev_priv(dev); |
921 |
+ struct net_device_stats *stats = &dev->stats; |
922 |
+ unsigned int mo = obj2msgobj(o); |
923 |
++ struct can_frame *cf; |
924 |
++ u8 ctrl1; |
925 |
++ |
926 |
++ ctrl1 = cc770_read_reg(priv, msgobj[mo].ctrl1); |
927 |
+ |
928 |
+- /* Nothing more to send, switch off interrupts */ |
929 |
+ cc770_write_reg(priv, msgobj[mo].ctrl0, |
930 |
+ MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES); |
931 |
+- /* |
932 |
+- * We had some cases of repeated IRQ so make sure the |
933 |
+- * INT is acknowledged |
934 |
++ cc770_write_reg(priv, msgobj[mo].ctrl1, |
935 |
++ RMTPND_RES | TXRQST_RES | MSGLST_RES | NEWDAT_RES); |
936 |
++ |
937 |
++ if (unlikely(!priv->tx_skb)) { |
938 |
++ netdev_err(dev, "missing tx skb in tx interrupt\n"); |
939 |
++ return; |
940 |
++ } |
941 |
++ |
942 |
++ if (unlikely(ctrl1 & MSGLST_SET)) { |
943 |
++ stats->rx_over_errors++; |
944 |
++ stats->rx_errors++; |
945 |
++ } |
946 |
++ |
947 |
++ /* When the CC770 is sending an RTR message and it receives a regular |
948 |
++ * message that matches the id of the RTR message, it will overwrite the |
949 |
++ * outgoing message in the TX register. When this happens we must |
950 |
++ * process the received message and try to transmit the outgoing skb |
951 |
++ * again. |
952 |
+ */ |
953 |
+- cc770_write_reg(priv, msgobj[mo].ctrl0, |
954 |
+- MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES); |
955 |
++ if (unlikely(ctrl1 & NEWDAT_SET)) { |
956 |
++ cc770_rx(dev, mo, ctrl1); |
957 |
++ cc770_tx(dev, mo); |
958 |
++ return; |
959 |
++ } |
960 |
+ |
961 |
++ cf = (struct can_frame *)priv->tx_skb->data; |
962 |
++ stats->tx_bytes += cf->can_dlc; |
963 |
+ stats->tx_packets++; |
964 |
++ |
965 |
++ can_put_echo_skb(priv->tx_skb, dev, 0); |
966 |
+ can_get_echo_skb(dev, 0); |
967 |
++ priv->tx_skb = NULL; |
968 |
++ |
969 |
+ netif_wake_queue(dev); |
970 |
+ } |
971 |
+ |
972 |
+@@ -804,6 +825,7 @@ struct net_device *alloc_cc770dev(int sizeof_priv) |
973 |
+ priv->can.do_set_bittiming = cc770_set_bittiming; |
974 |
+ priv->can.do_set_mode = cc770_set_mode; |
975 |
+ priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES; |
976 |
++ priv->tx_skb = NULL; |
977 |
+ |
978 |
+ memcpy(priv->obj_flags, cc770_obj_flags, sizeof(cc770_obj_flags)); |
979 |
+ |
980 |
+diff --git a/drivers/net/can/cc770/cc770.h b/drivers/net/can/cc770/cc770.h |
981 |
+index a1739db98d91..95752e1d1283 100644 |
982 |
+--- a/drivers/net/can/cc770/cc770.h |
983 |
++++ b/drivers/net/can/cc770/cc770.h |
984 |
+@@ -193,6 +193,8 @@ struct cc770_priv { |
985 |
+ u8 cpu_interface; /* CPU interface register */ |
986 |
+ u8 clkout; /* Clock out register */ |
987 |
+ u8 bus_config; /* Bus conffiguration register */ |
988 |
++ |
989 |
++ struct sk_buff *tx_skb; |
990 |
+ }; |
991 |
+ |
992 |
+ struct net_device *alloc_cc770dev(int sizeof_priv); |
993 |
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c |
994 |
+index d224b3dd72ed..3196245ab820 100644 |
995 |
+--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c |
996 |
++++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c |
997 |
+@@ -461,25 +461,23 @@ static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac) |
998 |
+ * @dev_addr: optional device address. |
999 |
+ * |
1000 |
+ * P2P needs mac addresses for P2P device and interface. If no device |
1001 |
+- * address it specified, these are derived from the primary net device, ie. |
1002 |
+- * the permanent ethernet address of the device. |
1003 |
++ * address it specified, these are derived from a random ethernet |
1004 |
++ * address. |
1005 |
+ */ |
1006 |
+ static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr) |
1007 |
+ { |
1008 |
+- struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp; |
1009 |
+- bool local_admin = false; |
1010 |
++ bool random_addr = false; |
1011 |
+ |
1012 |
+- if (!dev_addr || is_zero_ether_addr(dev_addr)) { |
1013 |
+- dev_addr = pri_ifp->mac_addr; |
1014 |
+- local_admin = true; |
1015 |
+- } |
1016 |
++ if (!dev_addr || is_zero_ether_addr(dev_addr)) |
1017 |
++ random_addr = true; |
1018 |
+ |
1019 |
+- /* Generate the P2P Device Address. This consists of the device's |
1020 |
+- * primary MAC address with the locally administered bit set. |
1021 |
++ /* Generate the P2P Device Address obtaining a random ethernet |
1022 |
++ * address with the locally administered bit set. |
1023 |
+ */ |
1024 |
+- memcpy(p2p->dev_addr, dev_addr, ETH_ALEN); |
1025 |
+- if (local_admin) |
1026 |
+- p2p->dev_addr[0] |= 0x02; |
1027 |
++ if (random_addr) |
1028 |
++ eth_random_addr(p2p->dev_addr); |
1029 |
++ else |
1030 |
++ memcpy(p2p->dev_addr, dev_addr, ETH_ALEN); |
1031 |
+ |
1032 |
+ /* Generate the P2P Interface Address. If the discovery and connection |
1033 |
+ * BSSCFGs need to simultaneously co-exist, then this address must be |
1034 |
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c |
1035 |
+index 5a3df9198ddf..89515f02c353 100644 |
1036 |
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c |
1037 |
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c |
1038 |
+@@ -1123,7 +1123,8 @@ static void _rtl8723be_enable_aspm_back_door(struct ieee80211_hw *hw) |
1039 |
+ |
1040 |
+ /* Configuration Space offset 0x70f BIT7 is used to control L0S */ |
1041 |
+ tmp8 = _rtl8723be_dbi_read(rtlpriv, 0x70f); |
1042 |
+- _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7)); |
1043 |
++ _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7) | |
1044 |
++ ASPM_L1_LATENCY << 3); |
1045 |
+ |
1046 |
+ /* Configuration Space offset 0x719 Bit3 is for L1 |
1047 |
+ * BIT4 is for clock request |
1048 |
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c |
1049 |
+index 254192b5dad1..4eb1cf0ed00c 100644 |
1050 |
+--- a/drivers/pci/quirks.c |
1051 |
++++ b/drivers/pci/quirks.c |
1052 |
+@@ -3631,6 +3631,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230, |
1053 |
+ quirk_dma_func1_alias); |
1054 |
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0642, |
1055 |
+ quirk_dma_func1_alias); |
1056 |
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0645, |
1057 |
++ quirk_dma_func1_alias); |
1058 |
+ /* https://bugs.gentoo.org/show_bug.cgi?id=497630 */ |
1059 |
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_JMICRON, |
1060 |
+ PCI_DEVICE_ID_JMICRON_JMB388_ESD, |
1061 |
+diff --git a/drivers/staging/lustre/lustre/ptlrpc/sec.c b/drivers/staging/lustre/lustre/ptlrpc/sec.c |
1062 |
+index 39f5261c9854..5cf5b7334089 100644 |
1063 |
+--- a/drivers/staging/lustre/lustre/ptlrpc/sec.c |
1064 |
++++ b/drivers/staging/lustre/lustre/ptlrpc/sec.c |
1065 |
+@@ -824,7 +824,7 @@ void sptlrpc_request_out_callback(struct ptlrpc_request *req) |
1066 |
+ if (req->rq_pool || !req->rq_reqbuf) |
1067 |
+ return; |
1068 |
+ |
1069 |
+- kfree(req->rq_reqbuf); |
1070 |
++ kvfree(req->rq_reqbuf); |
1071 |
+ req->rq_reqbuf = NULL; |
1072 |
+ req->rq_reqbuf_len = 0; |
1073 |
+ } |
1074 |
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c |
1075 |
+index e4f69bddcfb1..251315c35747 100644 |
1076 |
+--- a/drivers/tty/vt/vt.c |
1077 |
++++ b/drivers/tty/vt/vt.c |
1078 |
+@@ -1725,7 +1725,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear) |
1079 |
+ default_attr(vc); |
1080 |
+ update_attr(vc); |
1081 |
+ |
1082 |
+- vc->vc_tab_stop[0] = 0x01010100; |
1083 |
++ vc->vc_tab_stop[0] = |
1084 |
+ vc->vc_tab_stop[1] = |
1085 |
+ vc->vc_tab_stop[2] = |
1086 |
+ vc->vc_tab_stop[3] = |
1087 |
+@@ -1769,7 +1769,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) |
1088 |
+ vc->vc_pos -= (vc->vc_x << 1); |
1089 |
+ while (vc->vc_x < vc->vc_cols - 1) { |
1090 |
+ vc->vc_x++; |
1091 |
+- if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31))) |
1092 |
++ if (vc->vc_tab_stop[7 & (vc->vc_x >> 5)] & (1 << (vc->vc_x & 31))) |
1093 |
+ break; |
1094 |
+ } |
1095 |
+ vc->vc_pos += (vc->vc_x << 1); |
1096 |
+@@ -1829,7 +1829,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) |
1097 |
+ lf(vc); |
1098 |
+ return; |
1099 |
+ case 'H': |
1100 |
+- vc->vc_tab_stop[vc->vc_x >> 5] |= (1 << (vc->vc_x & 31)); |
1101 |
++ vc->vc_tab_stop[7 & (vc->vc_x >> 5)] |= (1 << (vc->vc_x & 31)); |
1102 |
+ return; |
1103 |
+ case 'Z': |
1104 |
+ respond_ID(tty); |
1105 |
+@@ -2022,7 +2022,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) |
1106 |
+ return; |
1107 |
+ case 'g': |
1108 |
+ if (!vc->vc_par[0]) |
1109 |
+- vc->vc_tab_stop[vc->vc_x >> 5] &= ~(1 << (vc->vc_x & 31)); |
1110 |
++ vc->vc_tab_stop[7 & (vc->vc_x >> 5)] &= ~(1 << (vc->vc_x & 31)); |
1111 |
+ else if (vc->vc_par[0] == 3) { |
1112 |
+ vc->vc_tab_stop[0] = |
1113 |
+ vc->vc_tab_stop[1] = |
1114 |
+diff --git a/fs/ncpfs/ncplib_kernel.c b/fs/ncpfs/ncplib_kernel.c |
1115 |
+index 88dbbc9fcf4d..f571570a2e72 100644 |
1116 |
+--- a/fs/ncpfs/ncplib_kernel.c |
1117 |
++++ b/fs/ncpfs/ncplib_kernel.c |
1118 |
+@@ -980,6 +980,10 @@ ncp_read_kernel(struct ncp_server *server, const char *file_id, |
1119 |
+ goto out; |
1120 |
+ } |
1121 |
+ *bytes_read = ncp_reply_be16(server, 0); |
1122 |
++ if (*bytes_read > to_read) { |
1123 |
++ result = -EINVAL; |
1124 |
++ goto out; |
1125 |
++ } |
1126 |
+ source = ncp_reply_data(server, 2 + (offset & 1)); |
1127 |
+ |
1128 |
+ memcpy(target, source, *bytes_read); |
1129 |
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h |
1130 |
+index 14b0ff32fb9f..4814cf971048 100644 |
1131 |
+--- a/include/asm-generic/pgtable.h |
1132 |
++++ b/include/asm-generic/pgtable.h |
1133 |
+@@ -755,6 +755,8 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot); |
1134 |
+ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot); |
1135 |
+ int pud_clear_huge(pud_t *pud); |
1136 |
+ int pmd_clear_huge(pmd_t *pmd); |
1137 |
++int pud_free_pmd_page(pud_t *pud); |
1138 |
++int pmd_free_pte_page(pmd_t *pmd); |
1139 |
+ #else /* !CONFIG_HAVE_ARCH_HUGE_VMAP */ |
1140 |
+ static inline int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot) |
1141 |
+ { |
1142 |
+@@ -772,6 +774,14 @@ static inline int pmd_clear_huge(pmd_t *pmd) |
1143 |
+ { |
1144 |
+ return 0; |
1145 |
+ } |
1146 |
++static inline int pud_free_pmd_page(pud_t *pud) |
1147 |
++{ |
1148 |
++ return 0; |
1149 |
++} |
1150 |
++static inline int pmd_free_pte_page(pmd_t *pmd) |
1151 |
++{ |
1152 |
++ return 0; |
1153 |
++} |
1154 |
+ #endif /* CONFIG_HAVE_ARCH_HUGE_VMAP */ |
1155 |
+ |
1156 |
+ #endif /* !__ASSEMBLY__ */ |
1157 |
+diff --git a/include/uapi/linux/usb/audio.h b/include/uapi/linux/usb/audio.h |
1158 |
+index d2314be4f0c0..19f9dc2c06f6 100644 |
1159 |
+--- a/include/uapi/linux/usb/audio.h |
1160 |
++++ b/include/uapi/linux/usb/audio.h |
1161 |
+@@ -369,7 +369,7 @@ static inline __u8 uac_processing_unit_bControlSize(struct uac_processing_unit_d |
1162 |
+ { |
1163 |
+ return (protocol == UAC_VERSION_1) ? |
1164 |
+ desc->baSourceID[desc->bNrInPins + 4] : |
1165 |
+- desc->baSourceID[desc->bNrInPins + 6]; |
1166 |
++ 2; /* in UAC2, this value is constant */ |
1167 |
+ } |
1168 |
+ |
1169 |
+ static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_descriptor *desc, |
1170 |
+@@ -377,7 +377,7 @@ static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_de |
1171 |
+ { |
1172 |
+ return (protocol == UAC_VERSION_1) ? |
1173 |
+ &desc->baSourceID[desc->bNrInPins + 5] : |
1174 |
+- &desc->baSourceID[desc->bNrInPins + 7]; |
1175 |
++ &desc->baSourceID[desc->bNrInPins + 6]; |
1176 |
+ } |
1177 |
+ |
1178 |
+ static inline __u8 uac_processing_unit_iProcessing(struct uac_processing_unit_descriptor *desc, |
1179 |
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c |
1180 |
+index 424accd20c2d..dc19b6e210e6 100644 |
1181 |
+--- a/kernel/bpf/syscall.c |
1182 |
++++ b/kernel/bpf/syscall.c |
1183 |
+@@ -673,7 +673,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz |
1184 |
+ union bpf_attr attr = {}; |
1185 |
+ int err; |
1186 |
+ |
1187 |
+- if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled) |
1188 |
++ if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN)) |
1189 |
+ return -EPERM; |
1190 |
+ |
1191 |
+ if (!access_ok(VERIFY_READ, uattr, 1)) |
1192 |
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c |
1193 |
+index e9092a0247bf..f2682799c215 100644 |
1194 |
+--- a/kernel/trace/trace_kprobe.c |
1195 |
++++ b/kernel/trace/trace_kprobe.c |
1196 |
+@@ -599,7 +599,7 @@ static int create_trace_kprobe(int argc, char **argv) |
1197 |
+ bool is_return = false, is_delete = false; |
1198 |
+ char *symbol = NULL, *event = NULL, *group = NULL; |
1199 |
+ char *arg; |
1200 |
+- unsigned long offset = 0; |
1201 |
++ long offset = 0; |
1202 |
+ void *addr = NULL; |
1203 |
+ char buf[MAX_EVENT_NAME_LEN]; |
1204 |
+ |
1205 |
+@@ -667,7 +667,7 @@ static int create_trace_kprobe(int argc, char **argv) |
1206 |
+ symbol = argv[1]; |
1207 |
+ /* TODO: support .init module functions */ |
1208 |
+ ret = traceprobe_split_symbol_offset(symbol, &offset); |
1209 |
+- if (ret) { |
1210 |
++ if (ret || offset < 0 || offset > UINT_MAX) { |
1211 |
+ pr_info("Failed to parse either an address or a symbol.\n"); |
1212 |
+ return ret; |
1213 |
+ } |
1214 |
+diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c |
1215 |
+index 1769a81da8a7..741c00b90fdc 100644 |
1216 |
+--- a/kernel/trace/trace_probe.c |
1217 |
++++ b/kernel/trace/trace_probe.c |
1218 |
+@@ -293,7 +293,7 @@ static fetch_func_t get_fetch_size_function(const struct fetch_type *type, |
1219 |
+ } |
1220 |
+ |
1221 |
+ /* Split symbol and offset. */ |
1222 |
+-int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset) |
1223 |
++int traceprobe_split_symbol_offset(char *symbol, long *offset) |
1224 |
+ { |
1225 |
+ char *tmp; |
1226 |
+ int ret; |
1227 |
+@@ -301,13 +301,11 @@ int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset) |
1228 |
+ if (!offset) |
1229 |
+ return -EINVAL; |
1230 |
+ |
1231 |
+- tmp = strchr(symbol, '+'); |
1232 |
++ tmp = strpbrk(symbol, "+-"); |
1233 |
+ if (tmp) { |
1234 |
+- /* skip sign because kstrtoul doesn't accept '+' */ |
1235 |
+- ret = kstrtoul(tmp + 1, 0, offset); |
1236 |
++ ret = kstrtol(tmp, 0, offset); |
1237 |
+ if (ret) |
1238 |
+ return ret; |
1239 |
+- |
1240 |
+ *tmp = '\0'; |
1241 |
+ } else |
1242 |
+ *offset = 0; |
1243 |
+diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h |
1244 |
+index f6398db09114..0afe921df8c8 100644 |
1245 |
+--- a/kernel/trace/trace_probe.h |
1246 |
++++ b/kernel/trace/trace_probe.h |
1247 |
+@@ -335,7 +335,7 @@ extern int traceprobe_conflict_field_name(const char *name, |
1248 |
+ extern void traceprobe_update_arg(struct probe_arg *arg); |
1249 |
+ extern void traceprobe_free_probe_arg(struct probe_arg *arg); |
1250 |
+ |
1251 |
+-extern int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset); |
1252 |
++extern int traceprobe_split_symbol_offset(char *symbol, long *offset); |
1253 |
+ |
1254 |
+ extern ssize_t traceprobe_probes_write(struct file *file, |
1255 |
+ const char __user *buffer, size_t count, loff_t *ppos, |
1256 |
+diff --git a/lib/ioremap.c b/lib/ioremap.c |
1257 |
+index 86c8911b0e3a..5323b59ca393 100644 |
1258 |
+--- a/lib/ioremap.c |
1259 |
++++ b/lib/ioremap.c |
1260 |
+@@ -83,7 +83,8 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr, |
1261 |
+ |
1262 |
+ if (ioremap_pmd_enabled() && |
1263 |
+ ((next - addr) == PMD_SIZE) && |
1264 |
+- IS_ALIGNED(phys_addr + addr, PMD_SIZE)) { |
1265 |
++ IS_ALIGNED(phys_addr + addr, PMD_SIZE) && |
1266 |
++ pmd_free_pte_page(pmd)) { |
1267 |
+ if (pmd_set_huge(pmd, phys_addr + addr, prot)) |
1268 |
+ continue; |
1269 |
+ } |
1270 |
+@@ -109,7 +110,8 @@ static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr, |
1271 |
+ |
1272 |
+ if (ioremap_pud_enabled() && |
1273 |
+ ((next - addr) == PUD_SIZE) && |
1274 |
+- IS_ALIGNED(phys_addr + addr, PUD_SIZE)) { |
1275 |
++ IS_ALIGNED(phys_addr + addr, PUD_SIZE) && |
1276 |
++ pud_free_pmd_page(pud)) { |
1277 |
+ if (pud_set_huge(pud, phys_addr + addr, prot)) |
1278 |
+ continue; |
1279 |
+ } |
1280 |
+diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c |
1281 |
+index cbd20cb8ca11..dc91002d1e0d 100644 |
1282 |
+--- a/sound/drivers/aloop.c |
1283 |
++++ b/sound/drivers/aloop.c |
1284 |
+@@ -192,6 +192,11 @@ static inline void loopback_timer_stop(struct loopback_pcm *dpcm) |
1285 |
+ dpcm->timer.expires = 0; |
1286 |
+ } |
1287 |
+ |
1288 |
++static inline void loopback_timer_stop_sync(struct loopback_pcm *dpcm) |
1289 |
++{ |
1290 |
++ del_timer_sync(&dpcm->timer); |
1291 |
++} |
1292 |
++ |
1293 |
+ #define CABLE_VALID_PLAYBACK (1 << SNDRV_PCM_STREAM_PLAYBACK) |
1294 |
+ #define CABLE_VALID_CAPTURE (1 << SNDRV_PCM_STREAM_CAPTURE) |
1295 |
+ #define CABLE_VALID_BOTH (CABLE_VALID_PLAYBACK|CABLE_VALID_CAPTURE) |
1296 |
+@@ -326,6 +331,8 @@ static int loopback_prepare(struct snd_pcm_substream *substream) |
1297 |
+ struct loopback_cable *cable = dpcm->cable; |
1298 |
+ int bps, salign; |
1299 |
+ |
1300 |
++ loopback_timer_stop_sync(dpcm); |
1301 |
++ |
1302 |
+ salign = (snd_pcm_format_width(runtime->format) * |
1303 |
+ runtime->channels) / 8; |
1304 |
+ bps = salign * runtime->rate; |
1305 |
+@@ -659,7 +666,9 @@ static void free_cable(struct snd_pcm_substream *substream) |
1306 |
+ return; |
1307 |
+ if (cable->streams[!substream->stream]) { |
1308 |
+ /* other stream is still alive */ |
1309 |
++ spin_lock_irq(&cable->lock); |
1310 |
+ cable->streams[substream->stream] = NULL; |
1311 |
++ spin_unlock_irq(&cable->lock); |
1312 |
+ } else { |
1313 |
+ /* free the cable */ |
1314 |
+ loopback->cables[substream->number][dev] = NULL; |
1315 |
+@@ -699,7 +708,6 @@ static int loopback_open(struct snd_pcm_substream *substream) |
1316 |
+ loopback->cables[substream->number][dev] = cable; |
1317 |
+ } |
1318 |
+ dpcm->cable = cable; |
1319 |
+- cable->streams[substream->stream] = dpcm; |
1320 |
+ |
1321 |
+ snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS); |
1322 |
+ |
1323 |
+@@ -731,6 +739,11 @@ static int loopback_open(struct snd_pcm_substream *substream) |
1324 |
+ runtime->hw = loopback_pcm_hardware; |
1325 |
+ else |
1326 |
+ runtime->hw = cable->hw; |
1327 |
++ |
1328 |
++ spin_lock_irq(&cable->lock); |
1329 |
++ cable->streams[substream->stream] = dpcm; |
1330 |
++ spin_unlock_irq(&cable->lock); |
1331 |
++ |
1332 |
+ unlock: |
1333 |
+ if (err < 0) { |
1334 |
+ free_cable(substream); |
1335 |
+@@ -745,7 +758,7 @@ static int loopback_close(struct snd_pcm_substream *substream) |
1336 |
+ struct loopback *loopback = substream->private_data; |
1337 |
+ struct loopback_pcm *dpcm = substream->runtime->private_data; |
1338 |
+ |
1339 |
+- loopback_timer_stop(dpcm); |
1340 |
++ loopback_timer_stop_sync(dpcm); |
1341 |
+ mutex_lock(&loopback->cable_lock); |
1342 |
+ free_cable(substream); |
1343 |
+ mutex_unlock(&loopback->cable_lock); |
1344 |
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c |
1345 |
+index 8e33360ae2e5..8cb14e27988b 100644 |
1346 |
+--- a/sound/pci/hda/patch_realtek.c |
1347 |
++++ b/sound/pci/hda/patch_realtek.c |
1348 |
+@@ -3261,8 +3261,12 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled) |
1349 |
+ pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid); |
1350 |
+ pinval &= ~AC_PINCTL_VREFEN; |
1351 |
+ pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80; |
1352 |
+- if (spec->mute_led_nid) |
1353 |
++ if (spec->mute_led_nid) { |
1354 |
++ /* temporarily power up/down for setting VREF */ |
1355 |
++ snd_hda_power_up_pm(codec); |
1356 |
+ snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval); |
1357 |
++ snd_hda_power_down_pm(codec); |
1358 |
++ } |
1359 |
+ } |
1360 |
+ |
1361 |
+ /* Make sure the led works even in runtime suspend */ |