commit: 323a66be9ef3d4a7514e055204c780958716758d Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> AuthorDate: Sat Nov 26 14:19:40 2016 +0000 Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> CommitDate: Sat Nov 26 14:19:40 2016 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=323a66be
Linux patch 4.8.11 0000_README | 4 + 1010_linux-4.8.11.patch | 2351 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2355 insertions(+) diff --git a/0000_README b/0000_README index 13976e7..4aa1baf 100644 --- a/0000_README +++ b/0000_README @@ -83,6 +83,10 @@ Patch: 1009_linux-4.8.10.patch From: http://www.kernel.org Desc: Linux 4.8.10 +Patch: 1010_linux-4.8.11.patch +From: http://www.kernel.org +Desc: Linux 4.8.11 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1010_linux-4.8.11.patch b/1010_linux-4.8.11.patch new file mode 100644 index 0000000..49be830 --- /dev/null +++ b/1010_linux-4.8.11.patch @@ -0,0 +1,2351 @@ +diff --git a/Makefile b/Makefile +index 7cf2b4985703..2b1bcbacebcd 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 8 +-SUBLEVEL = 10 ++SUBLEVEL = 11 + EXTRAVERSION = + NAME = Psychotic Stoned Sheep + +@@ -399,11 +399,12 @@ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ + -fno-strict-aliasing -fno-common \ + -Werror-implicit-function-declaration \ + -Wno-format-security \ +- -std=gnu89 ++ -std=gnu89 $(call cc-option,-fno-PIE) ++ + + KBUILD_AFLAGS_KERNEL := + KBUILD_CFLAGS_KERNEL := +-KBUILD_AFLAGS := -D__ASSEMBLY__ ++KBUILD_AFLAGS := -D__ASSEMBLY__ $(call cc-option,-fno-PIE) + KBUILD_AFLAGS_MODULE := -DMODULE + KBUILD_CFLAGS_MODULE := -DMODULE + KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds +@@ -621,6 +622,7 @@ include arch/$(SRCARCH)/Makefile + + KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,) + KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,) ++KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) + + ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE + KBUILD_CFLAGS += -Os +diff --git a/arch/arm/boot/dts/imx53-qsb.dts b/arch/arm/boot/dts/imx53-qsb.dts +index dec4b073ceb1..379939699164 100644 +--- a/arch/arm/boot/dts/imx53-qsb.dts ++++ b/arch/arm/boot/dts/imx53-qsb.dts +@@ -64,8 +64,8 @@ + }; + + ldo3_reg: ldo3 { +- regulator-min-microvolt = <600000>; +- regulator-max-microvolt = <1800000>; ++ regulator-min-microvolt = <1725000>; ++ regulator-max-microvolt = <3300000>; + regulator-always-on; + }; + +@@ -76,8 +76,8 @@ + }; + + ldo5_reg: ldo5 { +- regulator-min-microvolt = <1725000>; +- regulator-max-microvolt = <3300000>; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <3600000>; + regulator-always-on; + }; + +@@ -100,14 +100,14 @@ + }; + + ldo9_reg: ldo9 { +- regulator-min-microvolt = <1200000>; ++ regulator-min-microvolt = <1250000>; + regulator-max-microvolt = <3600000>; + regulator-always-on; + }; + + ldo10_reg: ldo10 { +- regulator-min-microvolt = <1250000>; +- regulator-max-microvolt = <3650000>; ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <3600000>; + regulator-always-on; + }; + }; +diff --git a/arch/arm64/include/asm/perf_event.h b/arch/arm64/include/asm/perf_event.h +index 2065f46fa740..38b6a2b49d68 100644 +--- a/arch/arm64/include/asm/perf_event.h ++++ b/arch/arm64/include/asm/perf_event.h +@@ -46,7 +46,15 @@ + #define ARMV8_PMU_EVTYPE_MASK 0xc800ffff /* Mask for writable bits */ + #define ARMV8_PMU_EVTYPE_EVENT 0xffff /* Mask for EVENT bits */ + +-#define ARMV8_PMU_EVTYPE_EVENT_SW_INCR 0 /* Software increment event */ ++/* ++ * PMUv3 event types: required events ++ */ ++#define ARMV8_PMUV3_PERFCTR_SW_INCR 0x00 ++#define ARMV8_PMUV3_PERFCTR_L1D_CACHE_REFILL 0x03 ++#define ARMV8_PMUV3_PERFCTR_L1D_CACHE 0x04 ++#define ARMV8_PMUV3_PERFCTR_BR_MIS_PRED 0x10 ++#define ARMV8_PMUV3_PERFCTR_CPU_CYCLES 0x11 ++#define ARMV8_PMUV3_PERFCTR_BR_PRED 0x12 + + /* + * Event filters for PMUv3 +diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c +index 838ccf123307..2c4df1520c45 100644 +--- a/arch/arm64/kernel/perf_event.c ++++ b/arch/arm64/kernel/perf_event.c +@@ -30,17 +30,9 @@ + + /* + * ARMv8 PMUv3 Performance Events handling code. +- * Common event types. ++ * Common event types (some are defined in asm/perf_event.h). + */ + +-/* Required events. */ +-#define ARMV8_PMUV3_PERFCTR_SW_INCR 0x00 +-#define ARMV8_PMUV3_PERFCTR_L1D_CACHE_REFILL 0x03 +-#define ARMV8_PMUV3_PERFCTR_L1D_CACHE 0x04 +-#define ARMV8_PMUV3_PERFCTR_BR_MIS_PRED 0x10 +-#define ARMV8_PMUV3_PERFCTR_CPU_CYCLES 0x11 +-#define ARMV8_PMUV3_PERFCTR_BR_PRED 0x12 +- + /* At least one of the following is required. */ + #define ARMV8_PMUV3_PERFCTR_INST_RETIRED 0x08 + #define ARMV8_PMUV3_PERFCTR_INST_SPEC 0x1B +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index e51367d159d0..31c144f7339a 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -602,8 +602,14 @@ static bool access_pmu_evcntr(struct kvm_vcpu *vcpu, + + idx = ARMV8_PMU_CYCLE_IDX; + } else { +- BUG(); ++ return false; + } ++ } else if (r->CRn == 0 && r->CRm == 9) { ++ /* PMCCNTR */ ++ if (pmu_access_event_counter_el0_disabled(vcpu)) ++ return false; ++ ++ idx = ARMV8_PMU_CYCLE_IDX; + } else if (r->CRn == 14 && (r->CRm & 12) == 8) { + /* PMEVCNTRn_EL0 */ + if (pmu_access_event_counter_el0_disabled(vcpu)) +@@ -611,7 +617,7 @@ static bool access_pmu_evcntr(struct kvm_vcpu *vcpu, + + idx = ((r->CRm & 3) << 3) | (r->Op2 & 7); + } else { +- BUG(); ++ return false; + } + + if (!pmu_counter_idx_valid(vcpu, idx)) +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index 7ac8e6eaab5b..8d586cff8a41 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -226,17 +226,25 @@ static void __init configure_exceptions(void) + if (firmware_has_feature(FW_FEATURE_OPAL)) + opal_configure_cores(); + +- /* Enable AIL if supported, and we are in hypervisor mode */ +- if (early_cpu_has_feature(CPU_FTR_HVMODE) && +- early_cpu_has_feature(CPU_FTR_ARCH_207S)) { +- unsigned long lpcr = mfspr(SPRN_LPCR); +- mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3); +- } ++ /* AIL on native is done in cpu_ready_for_interrupts() */ + } + } + + static void cpu_ready_for_interrupts(void) + { ++ /* ++ * Enable AIL if supported, and we are in hypervisor mode. This ++ * is called once for every processor. ++ * ++ * If we are not in hypervisor mode the job is done once for ++ * the whole partition in configure_exceptions(). ++ */ ++ if (early_cpu_has_feature(CPU_FTR_HVMODE) && ++ early_cpu_has_feature(CPU_FTR_ARCH_207S)) { ++ unsigned long lpcr = mfspr(SPRN_LPCR); ++ mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3); ++ } ++ + /* Set IR and DR in PACA MSR */ + get_paca()->kernel_msr = MSR_KERNEL; + } +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index b81fe2d63e15..1e81a37c034e 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -347,7 +347,6 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c) + #ifdef CONFIG_SMP + unsigned bits; + int cpu = smp_processor_id(); +- unsigned int socket_id, core_complex_id; + + bits = c->x86_coreid_bits; + /* Low order bits define the core id (index of core in socket) */ +@@ -365,10 +364,7 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c) + if (c->x86 != 0x17 || !cpuid_edx(0x80000006)) + return; + +- socket_id = (c->apicid >> bits) - 1; +- core_complex_id = (c->apicid & ((1 << bits) - 1)) >> 3; +- +- per_cpu(cpu_llc_id, cpu) = (socket_id << 3) | core_complex_id; ++ per_cpu(cpu_llc_id, cpu) = c->apicid >> 3; + #endif + } + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 46f74d461f3f..2fff65794f46 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -210,7 +210,18 @@ static void kvm_on_user_return(struct user_return_notifier *urn) + struct kvm_shared_msrs *locals + = container_of(urn, struct kvm_shared_msrs, urn); + struct kvm_shared_msr_values *values; ++ unsigned long flags; + ++ /* ++ * Disabling irqs at this point since the following code could be ++ * interrupted and executed through kvm_arch_hardware_disable() ++ */ ++ local_irq_save(flags); ++ if (locals->registered) { ++ locals->registered = false; ++ user_return_notifier_unregister(urn); ++ } ++ local_irq_restore(flags); + for (slot = 0; slot < shared_msrs_global.nr; ++slot) { + values = &locals->values[slot]; + if (values->host != values->curr) { +@@ -218,8 +229,6 @@ static void kvm_on_user_return(struct user_return_notifier *urn) + values->curr = values->host; + } + } +- locals->registered = false; +- user_return_notifier_unregister(urn); + } + + static void shared_msr_update(unsigned slot, u32 msr) +@@ -3372,6 +3381,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp, + }; + case KVM_SET_VAPIC_ADDR: { + struct kvm_vapic_addr va; ++ int idx; + + r = -EINVAL; + if (!lapic_in_kernel(vcpu)) +@@ -3379,7 +3389,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, + r = -EFAULT; + if (copy_from_user(&va, argp, sizeof va)) + goto out; ++ idx = srcu_read_lock(&vcpu->kvm->srcu); + r = kvm_lapic_set_vapic_addr(vcpu, va.vapic_addr); ++ srcu_read_unlock(&vcpu->kvm->srcu, idx); + break; + } + case KVM_X86_SETUP_MCE: { +diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile +index ac58c1616408..555b9fa0ad43 100644 +--- a/arch/x86/purgatory/Makefile ++++ b/arch/x86/purgatory/Makefile +@@ -16,6 +16,7 @@ KCOV_INSTRUMENT := n + + KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -MD -Os -mcmodel=large + KBUILD_CFLAGS += -m$(BITS) ++KBUILD_CFLAGS += $(call cc-option,-fno-PIE) + + $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE + $(call if_changed,ld) +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index e44944f4be77..2932a5bd892f 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -1027,6 +1027,8 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a + TRACE_DEVICE(dev); + TRACE_SUSPEND(0); + ++ dpm_wait_for_children(dev, async); ++ + if (async_error) + goto Complete; + +@@ -1038,8 +1040,6 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a + if (dev->power.syscore || dev->power.direct_complete) + goto Complete; + +- dpm_wait_for_children(dev, async); +- + if (dev->pm_domain) { + info = "noirq power domain "; + callback = pm_noirq_op(&dev->pm_domain->ops, state); +@@ -1174,6 +1174,8 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as + + __pm_runtime_disable(dev, false); + ++ dpm_wait_for_children(dev, async); ++ + if (async_error) + goto Complete; + +@@ -1185,8 +1187,6 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as + if (dev->power.syscore || dev->power.direct_complete) + goto Complete; + +- dpm_wait_for_children(dev, async); +- + if (dev->pm_domain) { + info = "late power domain "; + callback = pm_late_early_op(&dev->pm_domain->ops, state); +diff --git a/drivers/clk/imx/clk-pllv3.c b/drivers/clk/imx/clk-pllv3.c +index 19f9b622981a..7a6acc3e4a92 100644 +--- a/drivers/clk/imx/clk-pllv3.c ++++ b/drivers/clk/imx/clk-pllv3.c +@@ -223,7 +223,7 @@ static unsigned long clk_pllv3_av_recalc_rate(struct clk_hw *hw, + temp64 *= mfn; + do_div(temp64, mfd); + +- return (parent_rate * div) + (u32)temp64; ++ return parent_rate * div + (unsigned long)temp64; + } + + static long clk_pllv3_av_round_rate(struct clk_hw *hw, unsigned long rate, +@@ -247,7 +247,11 @@ static long clk_pllv3_av_round_rate(struct clk_hw *hw, unsigned long rate, + do_div(temp64, parent_rate); + mfn = temp64; + +- return parent_rate * div + parent_rate * mfn / mfd; ++ temp64 = (u64)parent_rate; ++ temp64 *= mfn; ++ do_div(temp64, mfd); ++ ++ return parent_rate * div + (unsigned long)temp64; + } + + static int clk_pllv3_av_set_rate(struct clk_hw *hw, unsigned long rate, +diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c +index 3a51fff1b0e7..9adaf48aea23 100644 +--- a/drivers/clk/mmp/clk-of-mmp2.c ++++ b/drivers/clk/mmp/clk-of-mmp2.c +@@ -313,7 +313,7 @@ static void __init mmp2_clk_init(struct device_node *np) + } + + pxa_unit->apmu_base = of_iomap(np, 1); +- if (!pxa_unit->mpmu_base) { ++ if (!pxa_unit->apmu_base) { + pr_err("failed to map apmu registers\n"); + return; + } +diff --git a/drivers/clk/mmp/clk-of-pxa168.c b/drivers/clk/mmp/clk-of-pxa168.c +index 87f2317b2a00..f110c02e83cb 100644 +--- a/drivers/clk/mmp/clk-of-pxa168.c ++++ b/drivers/clk/mmp/clk-of-pxa168.c +@@ -262,7 +262,7 @@ static void __init pxa168_clk_init(struct device_node *np) + } + + pxa_unit->apmu_base = of_iomap(np, 1); +- if (!pxa_unit->mpmu_base) { ++ if (!pxa_unit->apmu_base) { + pr_err("failed to map apmu registers\n"); + return; + } +diff --git a/drivers/clk/mmp/clk-of-pxa910.c b/drivers/clk/mmp/clk-of-pxa910.c +index e22a67f76d93..64d1ef49caeb 100644 +--- a/drivers/clk/mmp/clk-of-pxa910.c ++++ b/drivers/clk/mmp/clk-of-pxa910.c +@@ -282,7 +282,7 @@ static void __init pxa910_clk_init(struct device_node *np) + } + + pxa_unit->apmu_base = of_iomap(np, 1); +- if (!pxa_unit->mpmu_base) { ++ if (!pxa_unit->apmu_base) { + pr_err("failed to map apmu registers\n"); + return; + } +@@ -294,7 +294,7 @@ static void __init pxa910_clk_init(struct device_node *np) + } + + pxa_unit->apbcp_base = of_iomap(np, 3); +- if (!pxa_unit->mpmu_base) { ++ if (!pxa_unit->apbcp_base) { + pr_err("failed to map apbcp registers\n"); + return; + } +diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c +index b3044219772c..2cde3796cb82 100644 +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -4542,6 +4542,15 @@ static int __init caam_algapi_init(void) + if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES)) + continue; + ++ /* ++ * Check support for AES modes not available ++ * on LP devices. ++ */ ++ if ((cha_vid & CHA_ID_LS_AES_MASK) == CHA_ID_LS_AES_LP) ++ if ((alg->class1_alg_type & OP_ALG_AAI_MASK) == ++ OP_ALG_AAI_XTS) ++ continue; ++ + t_alg = caam_alg_alloc(alg); + if (IS_ERR(t_alg)) { + err = PTR_ERR(t_alg); +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 02f2a5621bb0..47d08b9da60d 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -372,14 +372,15 @@ static void pca953x_gpio_set_multiple(struct gpio_chip *gc, + break; + } + +- memcpy(reg_val, chip->reg_output, NBANK(chip)); + mutex_lock(&chip->i2c_lock); ++ memcpy(reg_val, chip->reg_output, NBANK(chip)); + for(bank=0; bank<NBANK(chip); bank++) { + unsigned bankmask = mask[bank / sizeof(*mask)] >> + ((bank % sizeof(*mask)) * 8); + if(bankmask) { + unsigned bankval = bits[bank / sizeof(*bits)] >> + ((bank % sizeof(*bits)) * 8); ++ bankval &= bankmask; + reg_val[bank] = (reg_val[bank] & ~bankmask) | bankval; + } + } +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index b2dee1024166..15704aaf9e4e 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -2667,8 +2667,11 @@ int gpiochip_lock_as_irq(struct gpio_chip *chip, unsigned int offset) + if (IS_ERR(desc)) + return PTR_ERR(desc); + +- /* Flush direction if something changed behind our back */ +- if (chip->get_direction) { ++ /* ++ * If it's fast: flush the direction setting if something changed ++ * behind our back ++ */ ++ if (!chip->can_sleep && chip->get_direction) { + int dir = chip->get_direction(chip, offset); + + if (dir) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index 700c56baf2de..e443073f6ece 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -492,6 +492,7 @@ struct amdgpu_bo { + u64 metadata_flags; + void *metadata; + u32 metadata_size; ++ unsigned prime_shared_count; + /* list of all virtual address to which this bo + * is associated to + */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c +index 651115dcce12..c02db01f6583 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c +@@ -132,7 +132,7 @@ static int amdgpu_bo_list_set(struct amdgpu_device *adev, + entry->priority = min(info[i].bo_priority, + AMDGPU_BO_LIST_MAX_PRIORITY); + entry->tv.bo = &entry->robj->tbo; +- entry->tv.shared = true; ++ entry->tv.shared = !entry->robj->prime_shared_count; + + if (entry->robj->prefered_domains == AMDGPU_GEM_DOMAIN_GDS) + gds_obj = entry->robj; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c +index 7700dc22f243..3826d5aea0a6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c +@@ -74,20 +74,36 @@ amdgpu_gem_prime_import_sg_table(struct drm_device *dev, + if (ret) + return ERR_PTR(ret); + ++ bo->prime_shared_count = 1; + return &bo->gem_base; + } + + int amdgpu_gem_prime_pin(struct drm_gem_object *obj) + { + struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj); +- int ret = 0; ++ long ret = 0; + + ret = amdgpu_bo_reserve(bo, false); + if (unlikely(ret != 0)) + return ret; + ++ /* ++ * Wait for all shared fences to complete before we switch to future ++ * use of exclusive fence on this prime shared bo. ++ */ ++ ret = reservation_object_wait_timeout_rcu(bo->tbo.resv, true, false, ++ MAX_SCHEDULE_TIMEOUT); ++ if (unlikely(ret < 0)) { ++ DRM_DEBUG_PRIME("Fence wait failed: %li\n", ret); ++ amdgpu_bo_unreserve(bo); ++ return ret; ++ } ++ + /* pin buffer into GTT */ + ret = amdgpu_bo_pin(bo, AMDGPU_GEM_DOMAIN_GTT, NULL); ++ if (likely(ret == 0)) ++ bo->prime_shared_count++; ++ + amdgpu_bo_unreserve(bo); + return ret; + } +@@ -102,6 +118,8 @@ void amdgpu_gem_prime_unpin(struct drm_gem_object *obj) + return; + + amdgpu_bo_unpin(bo); ++ if (bo->prime_shared_count) ++ bo->prime_shared_count--; + amdgpu_bo_unreserve(bo); + } + +diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c +index 1f8af87c6294..cf2560708e03 100644 +--- a/drivers/gpu/drm/i915/intel_bios.c ++++ b/drivers/gpu/drm/i915/intel_bios.c +@@ -1143,7 +1143,7 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port, + if (!child) + return; + +- aux_channel = child->raw[25]; ++ aux_channel = child->common.aux_channel; + ddc_pin = child->common.ddc_pin; + + is_dvi = child->common.device_type & DEVICE_TYPE_TMDS_DVI_SIGNALING; +@@ -1673,7 +1673,8 @@ bool intel_bios_is_port_edp(struct drm_i915_private *dev_priv, enum port port) + return false; + } + +-bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, enum port port) ++static bool child_dev_is_dp_dual_mode(const union child_device_config *p_child, ++ enum port port) + { + static const struct { + u16 dp, hdmi; +@@ -1687,22 +1688,35 @@ bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, enum por + [PORT_D] = { DVO_PORT_DPD, DVO_PORT_HDMID, }, + [PORT_E] = { DVO_PORT_DPE, DVO_PORT_HDMIE, }, + }; +- int i; + + if (port == PORT_A || port >= ARRAY_SIZE(port_mapping)) + return false; + +- if (!dev_priv->vbt.child_dev_num) ++ if ((p_child->common.device_type & DEVICE_TYPE_DP_DUAL_MODE_BITS) != ++ (DEVICE_TYPE_DP_DUAL_MODE & DEVICE_TYPE_DP_DUAL_MODE_BITS)) + return false; + ++ if (p_child->common.dvo_port == port_mapping[port].dp) ++ return true; ++ ++ /* Only accept a HDMI dvo_port as DP++ if it has an AUX channel */ ++ if (p_child->common.dvo_port == port_mapping[port].hdmi && ++ p_child->common.aux_channel != 0) ++ return true; ++ ++ return false; ++} ++ ++bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, ++ enum port port) ++{ ++ int i; ++ + for (i = 0; i < dev_priv->vbt.child_dev_num; i++) { + const union child_device_config *p_child = + &dev_priv->vbt.child_dev[i]; + +- if ((p_child->common.dvo_port == port_mapping[port].dp || +- p_child->common.dvo_port == port_mapping[port].hdmi) && +- (p_child->common.device_type & DEVICE_TYPE_DP_DUAL_MODE_BITS) == +- (DEVICE_TYPE_DP_DUAL_MODE & DEVICE_TYPE_DP_DUAL_MODE_BITS)) ++ if (child_dev_is_dp_dual_mode(p_child, port)) + return true; + } + +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 3051182cf483..b8aeb28e14d7 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -4323,21 +4323,11 @@ static enum drm_connector_status + intel_dp_detect(struct drm_connector *connector, bool force) + { + struct intel_dp *intel_dp = intel_attached_dp(connector); +- struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp); +- struct intel_encoder *intel_encoder = &intel_dig_port->base; + enum drm_connector_status status = connector->status; + + DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", + connector->base.id, connector->name); + +- if (intel_dp->is_mst) { +- /* MST devices are disconnected from a monitor POV */ +- intel_dp_unset_edid(intel_dp); +- if (intel_encoder->type != INTEL_OUTPUT_EDP) +- intel_encoder->type = INTEL_OUTPUT_DP; +- return connector_status_disconnected; +- } +- + /* If full detect is not performed yet, do a full detect */ + if (!intel_dp->detect_done) + status = intel_dp_long_pulse(intel_dp->attached_connector); +diff --git a/drivers/gpu/drm/i915/intel_vbt_defs.h b/drivers/gpu/drm/i915/intel_vbt_defs.h +index 68db9621f1f0..8886cab19f98 100644 +--- a/drivers/gpu/drm/i915/intel_vbt_defs.h ++++ b/drivers/gpu/drm/i915/intel_vbt_defs.h +@@ -280,7 +280,8 @@ struct common_child_dev_config { + u8 dp_support:1; + u8 tmds_support:1; + u8 support_reserved:5; +- u8 not_common3[12]; ++ u8 aux_channel; ++ u8 not_common3[11]; + u8 iboost_level; + } __packed; + +diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig +index d223650a97e4..11edabf425ae 100644 +--- a/drivers/i2c/Kconfig ++++ b/drivers/i2c/Kconfig +@@ -59,7 +59,6 @@ config I2C_CHARDEV + + config I2C_MUX + tristate "I2C bus multiplexing support" +- depends on HAS_IOMEM + help + Say Y here if you want the I2C core to support the ability to + handle multiplexed I2C bus topologies, by presenting each +diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig +index e280c8ecc0b5..96de9ce5669b 100644 +--- a/drivers/i2c/muxes/Kconfig ++++ b/drivers/i2c/muxes/Kconfig +@@ -63,6 +63,7 @@ config I2C_MUX_PINCTRL + + config I2C_MUX_REG + tristate "Register-based I2C multiplexer" ++ depends on HAS_IOMEM + help + If you say yes to this option, support will be included for a + register based I2C multiplexer. This driver provides access to +diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c +index 3278ebf1cc5c..7e6f300009c5 100644 +--- a/drivers/i2c/muxes/i2c-mux-pca954x.c ++++ b/drivers/i2c/muxes/i2c-mux-pca954x.c +@@ -247,9 +247,9 @@ static int pca954x_probe(struct i2c_client *client, + /* discard unconfigured channels */ + break; + idle_disconnect_pd = pdata->modes[num].deselect_on_exit; +- data->deselect |= (idle_disconnect_pd +- || idle_disconnect_dt) << num; + } ++ data->deselect |= (idle_disconnect_pd || ++ idle_disconnect_dt) << num; + + ret = i2c_mux_add_adapter(muxc, force, num, class); + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index c99525512b34..71c7c4c328ef 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -80,6 +80,8 @@ static struct ib_cm { + __be32 random_id_operand; + struct list_head timewait_list; + struct workqueue_struct *wq; ++ /* Sync on cm change port state */ ++ spinlock_t state_lock; + } cm; + + /* Counter indexes ordered by attribute ID */ +@@ -161,6 +163,8 @@ struct cm_port { + struct ib_mad_agent *mad_agent; + struct kobject port_obj; + u8 port_num; ++ struct list_head cm_priv_prim_list; ++ struct list_head cm_priv_altr_list; + struct cm_counter_group counter_group[CM_COUNTER_GROUPS]; + }; + +@@ -241,6 +245,12 @@ struct cm_id_private { + u8 service_timeout; + u8 target_ack_delay; + ++ struct list_head prim_list; ++ struct list_head altr_list; ++ /* Indicates that the send port mad is registered and av is set */ ++ int prim_send_port_not_ready; ++ int altr_send_port_not_ready; ++ + struct list_head work_list; + atomic_t work_count; + }; +@@ -259,20 +269,47 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv, + struct ib_mad_agent *mad_agent; + struct ib_mad_send_buf *m; + struct ib_ah *ah; ++ struct cm_av *av; ++ unsigned long flags, flags2; ++ int ret = 0; + ++ /* don't let the port to be released till the agent is down */ ++ spin_lock_irqsave(&cm.state_lock, flags2); ++ spin_lock_irqsave(&cm.lock, flags); ++ if (!cm_id_priv->prim_send_port_not_ready) ++ av = &cm_id_priv->av; ++ else if (!cm_id_priv->altr_send_port_not_ready && ++ (cm_id_priv->alt_av.port)) ++ av = &cm_id_priv->alt_av; ++ else { ++ pr_info("%s: not valid CM id\n", __func__); ++ ret = -ENODEV; ++ spin_unlock_irqrestore(&cm.lock, flags); ++ goto out; ++ } ++ spin_unlock_irqrestore(&cm.lock, flags); ++ /* Make sure the port haven't released the mad yet */ + mad_agent = cm_id_priv->av.port->mad_agent; +- ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr); +- if (IS_ERR(ah)) +- return PTR_ERR(ah); ++ if (!mad_agent) { ++ pr_info("%s: not a valid MAD agent\n", __func__); ++ ret = -ENODEV; ++ goto out; ++ } ++ ah = ib_create_ah(mad_agent->qp->pd, &av->ah_attr); ++ if (IS_ERR(ah)) { ++ ret = PTR_ERR(ah); ++ goto out; ++ } + + m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn, +- cm_id_priv->av.pkey_index, ++ av->pkey_index, + 0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA, + GFP_ATOMIC, + IB_MGMT_BASE_VERSION); + if (IS_ERR(m)) { + ib_destroy_ah(ah); +- return PTR_ERR(m); ++ ret = PTR_ERR(m); ++ goto out; + } + + /* Timeout set by caller if response is expected. */ +@@ -282,7 +319,10 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv, + atomic_inc(&cm_id_priv->refcount); + m->context[0] = cm_id_priv; + *msg = m; +- return 0; ++ ++out: ++ spin_unlock_irqrestore(&cm.state_lock, flags2); ++ return ret; + } + + static int cm_alloc_response_msg(struct cm_port *port, +@@ -352,7 +392,8 @@ static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc, + grh, &av->ah_attr); + } + +-static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av) ++static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av, ++ struct cm_id_private *cm_id_priv) + { + struct cm_device *cm_dev; + struct cm_port *port = NULL; +@@ -387,7 +428,17 @@ static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av) + &av->ah_attr); + av->timeout = path->packet_life_time + 1; + +- return 0; ++ spin_lock_irqsave(&cm.lock, flags); ++ if (&cm_id_priv->av == av) ++ list_add_tail(&cm_id_priv->prim_list, &port->cm_priv_prim_list); ++ else if (&cm_id_priv->alt_av == av) ++ list_add_tail(&cm_id_priv->altr_list, &port->cm_priv_altr_list); ++ else ++ ret = -EINVAL; ++ ++ spin_unlock_irqrestore(&cm.lock, flags); ++ ++ return ret; + } + + static int cm_alloc_id(struct cm_id_private *cm_id_priv) +@@ -677,6 +728,8 @@ struct ib_cm_id *ib_create_cm_id(struct ib_device *device, + spin_lock_init(&cm_id_priv->lock); + init_completion(&cm_id_priv->comp); + INIT_LIST_HEAD(&cm_id_priv->work_list); ++ INIT_LIST_HEAD(&cm_id_priv->prim_list); ++ INIT_LIST_HEAD(&cm_id_priv->altr_list); + atomic_set(&cm_id_priv->work_count, -1); + atomic_set(&cm_id_priv->refcount, 1); + return &cm_id_priv->id; +@@ -892,6 +945,15 @@ retest: + break; + } + ++ spin_lock_irq(&cm.lock); ++ if (!list_empty(&cm_id_priv->altr_list) && ++ (!cm_id_priv->altr_send_port_not_ready)) ++ list_del(&cm_id_priv->altr_list); ++ if (!list_empty(&cm_id_priv->prim_list) && ++ (!cm_id_priv->prim_send_port_not_ready)) ++ list_del(&cm_id_priv->prim_list); ++ spin_unlock_irq(&cm.lock); ++ + cm_free_id(cm_id->local_id); + cm_deref_id(cm_id_priv); + wait_for_completion(&cm_id_priv->comp); +@@ -1192,12 +1254,13 @@ int ib_send_cm_req(struct ib_cm_id *cm_id, + goto out; + } + +- ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av); ++ ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av, ++ cm_id_priv); + if (ret) + goto error1; + if (param->alternate_path) { + ret = cm_init_av_by_path(param->alternate_path, +- &cm_id_priv->alt_av); ++ &cm_id_priv->alt_av, cm_id_priv); + if (ret) + goto error1; + } +@@ -1653,7 +1716,8 @@ static int cm_req_handler(struct cm_work *work) + dev_put(gid_attr.ndev); + } + work->path[0].gid_type = gid_attr.gid_type; +- ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av); ++ ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av, ++ cm_id_priv); + } + if (ret) { + int err = ib_get_cached_gid(work->port->cm_dev->ib_device, +@@ -1672,7 +1736,8 @@ static int cm_req_handler(struct cm_work *work) + goto rejected; + } + if (req_msg->alt_local_lid) { +- ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av); ++ ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av, ++ cm_id_priv); + if (ret) { + ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_ALT_GID, + &work->path[0].sgid, +@@ -2727,7 +2792,8 @@ int ib_send_cm_lap(struct ib_cm_id *cm_id, + goto out; + } + +- ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av); ++ ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av, ++ cm_id_priv); + if (ret) + goto out; + cm_id_priv->alt_av.timeout = +@@ -2839,7 +2905,8 @@ static int cm_lap_handler(struct cm_work *work) + cm_init_av_for_response(work->port, work->mad_recv_wc->wc, + work->mad_recv_wc->recv_buf.grh, + &cm_id_priv->av); +- cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av); ++ cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av, ++ cm_id_priv); + ret = atomic_inc_and_test(&cm_id_priv->work_count); + if (!ret) + list_add_tail(&work->list, &cm_id_priv->work_list); +@@ -3031,7 +3098,7 @@ int ib_send_cm_sidr_req(struct ib_cm_id *cm_id, + return -EINVAL; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- ret = cm_init_av_by_path(param->path, &cm_id_priv->av); ++ ret = cm_init_av_by_path(param->path, &cm_id_priv->av, cm_id_priv); + if (ret) + goto out; + +@@ -3468,7 +3535,9 @@ out: + static int cm_migrate(struct ib_cm_id *cm_id) + { + struct cm_id_private *cm_id_priv; ++ struct cm_av tmp_av; + unsigned long flags; ++ int tmp_send_port_not_ready; + int ret = 0; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +@@ -3477,7 +3546,14 @@ static int cm_migrate(struct ib_cm_id *cm_id) + (cm_id->lap_state == IB_CM_LAP_UNINIT || + cm_id->lap_state == IB_CM_LAP_IDLE)) { + cm_id->lap_state = IB_CM_LAP_IDLE; ++ /* Swap address vector */ ++ tmp_av = cm_id_priv->av; + cm_id_priv->av = cm_id_priv->alt_av; ++ cm_id_priv->alt_av = tmp_av; ++ /* Swap port send ready state */ ++ tmp_send_port_not_ready = cm_id_priv->prim_send_port_not_ready; ++ cm_id_priv->prim_send_port_not_ready = cm_id_priv->altr_send_port_not_ready; ++ cm_id_priv->altr_send_port_not_ready = tmp_send_port_not_ready; + } else + ret = -EINVAL; + spin_unlock_irqrestore(&cm_id_priv->lock, flags); +@@ -3888,6 +3964,9 @@ static void cm_add_one(struct ib_device *ib_device) + port->cm_dev = cm_dev; + port->port_num = i; + ++ INIT_LIST_HEAD(&port->cm_priv_prim_list); ++ INIT_LIST_HEAD(&port->cm_priv_altr_list); ++ + ret = cm_create_port_fs(port); + if (ret) + goto error1; +@@ -3945,6 +4024,8 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) + { + struct cm_device *cm_dev = client_data; + struct cm_port *port; ++ struct cm_id_private *cm_id_priv; ++ struct ib_mad_agent *cur_mad_agent; + struct ib_port_modify port_modify = { + .clr_port_cap_mask = IB_PORT_CM_SUP + }; +@@ -3968,15 +4049,27 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) + + port = cm_dev->port[i-1]; + ib_modify_port(ib_device, port->port_num, 0, &port_modify); ++ /* Mark all the cm_id's as not valid */ ++ spin_lock_irq(&cm.lock); ++ list_for_each_entry(cm_id_priv, &port->cm_priv_altr_list, altr_list) ++ cm_id_priv->altr_send_port_not_ready = 1; ++ list_for_each_entry(cm_id_priv, &port->cm_priv_prim_list, prim_list) ++ cm_id_priv->prim_send_port_not_ready = 1; ++ spin_unlock_irq(&cm.lock); + /* + * We flush the queue here after the going_down set, this + * verify that no new works will be queued in the recv handler, + * after that we can call the unregister_mad_agent + */ + flush_workqueue(cm.wq); +- ib_unregister_mad_agent(port->mad_agent); ++ spin_lock_irq(&cm.state_lock); ++ cur_mad_agent = port->mad_agent; ++ port->mad_agent = NULL; ++ spin_unlock_irq(&cm.state_lock); ++ ib_unregister_mad_agent(cur_mad_agent); + cm_remove_port_fs(port); + } ++ + device_unregister(cm_dev->device); + kfree(cm_dev); + } +@@ -3989,6 +4082,7 @@ static int __init ib_cm_init(void) + INIT_LIST_HEAD(&cm.device_list); + rwlock_init(&cm.device_lock); + spin_lock_init(&cm.lock); ++ spin_lock_init(&cm.state_lock); + cm.listen_service_table = RB_ROOT; + cm.listen_service_id = be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID); + cm.remote_id_table = RB_ROOT; +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index c68746ce6624..bdab61d9103c 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -174,7 +174,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + + cur_base = addr & PAGE_MASK; + +- if (npages == 0) { ++ if (npages == 0 || npages > UINT_MAX) { + ret = -EINVAL; + goto out; + } +diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c +index 0012fa58c105..44b1104eb168 100644 +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -262,12 +262,9 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file, + container_of(uobj, struct ib_uqp_object, uevent.uobject); + + idr_remove_uobj(&ib_uverbs_qp_idr, uobj); +- if (qp != qp->real_qp) { +- ib_close_qp(qp); +- } else { ++ if (qp == qp->real_qp) + ib_uverbs_detach_umcast(qp, uqp); +- ib_destroy_qp(qp); +- } ++ ib_destroy_qp(qp); + ib_uverbs_release_uevent(file, &uqp->uevent); + kfree(uqp); + } +diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c +index bcf76c33726b..e3629983f1bf 100644 +--- a/drivers/infiniband/hw/hfi1/rc.c ++++ b/drivers/infiniband/hw/hfi1/rc.c +@@ -87,7 +87,7 @@ void hfi1_add_rnr_timer(struct rvt_qp *qp, u32 to) + struct hfi1_qp_priv *priv = qp->priv; + + qp->s_flags |= RVT_S_WAIT_RNR; +- qp->s_timer.expires = jiffies + usecs_to_jiffies(to); ++ priv->s_rnr_timer.expires = jiffies + usecs_to_jiffies(to); + add_timer(&priv->s_rnr_timer); + } + +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index 1694037d1eee..8f59a4fded93 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -1152,7 +1152,7 @@ static int pin_vector_pages(struct user_sdma_request *req, + rb_node = hfi1_mmu_rb_extract(pq->handler, + (unsigned long)iovec->iov.iov_base, + iovec->iov.iov_len); +- if (rb_node && !IS_ERR(rb_node)) ++ if (rb_node) + node = container_of(rb_node, struct sdma_mmu_node, rb); + else + rb_node = NULL; +diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c +index 5fc623362731..b9bf0759f10a 100644 +--- a/drivers/infiniband/hw/mlx4/ah.c ++++ b/drivers/infiniband/hw/mlx4/ah.c +@@ -102,7 +102,10 @@ static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr + if (vlan_tag < 0x1000) + vlan_tag |= (ah_attr->sl & 7) << 13; + ah->av.eth.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24)); +- ah->av.eth.gid_index = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index); ++ ret = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index); ++ if (ret < 0) ++ return ERR_PTR(ret); ++ ah->av.eth.gid_index = ret; + ah->av.eth.vlan = cpu_to_be16(vlan_tag); + ah->av.eth.hop_limit = ah_attr->grh.hop_limit; + if (ah_attr->static_rate) { +diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c +index 5df63dacaaa3..efb6414cc5e4 100644 +--- a/drivers/infiniband/hw/mlx4/cq.c ++++ b/drivers/infiniband/hw/mlx4/cq.c +@@ -253,11 +253,14 @@ struct ib_cq *mlx4_ib_create_cq(struct ib_device *ibdev, + if (context) + if (ib_copy_to_udata(udata, &cq->mcq.cqn, sizeof (__u32))) { + err = -EFAULT; +- goto err_dbmap; ++ goto err_cq_free; + } + + return &cq->ibcq; + ++err_cq_free: ++ mlx4_cq_free(dev->dev, &cq->mcq); ++ + err_dbmap: + if (context) + mlx4_ib_db_unmap_user(to_mucontext(context), &cq->db); +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index e4fac9292e4a..ebe43cb7d06b 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -917,8 +917,7 @@ struct ib_cq *mlx5_ib_create_cq(struct ib_device *ibdev, + if (err) + goto err_create; + } else { +- /* for now choose 64 bytes till we have a proper interface */ +- cqe_size = 64; ++ cqe_size = cache_line_size() == 128 ? 128 : 64; + err = create_cq_kernel(dev, cq, entries, cqe_size, &cqb, + &index, &inlen); + if (err) +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index bff8707a2f1f..19f8820b4e92 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -2100,14 +2100,14 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context, + { + struct mlx5_ib_dev *ibdev = (struct mlx5_ib_dev *)context; + struct ib_event ibev; +- ++ bool fatal = false; + u8 port = 0; + + switch (event) { + case MLX5_DEV_EVENT_SYS_ERROR: +- ibdev->ib_active = false; + ibev.event = IB_EVENT_DEVICE_FATAL; + mlx5_ib_handle_internal_error(ibdev); ++ fatal = true; + break; + + case MLX5_DEV_EVENT_PORT_UP: +@@ -2154,6 +2154,9 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context, + + if (ibdev->ib_active) + ib_dispatch_event(&ibev); ++ ++ if (fatal) ++ ibdev->ib_active = false; + } + + static void get_ext_port_caps(struct mlx5_ib_dev *dev) +@@ -2835,7 +2838,7 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev) + } + err = init_node_data(dev); + if (err) +- goto err_dealloc; ++ goto err_free_port; + + mutex_init(&dev->flow_db.lock); + mutex_init(&dev->cap_mask_mutex); +@@ -2845,7 +2848,7 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev) + if (ll == IB_LINK_LAYER_ETHERNET) { + err = mlx5_enable_roce(dev); + if (err) +- goto err_dealloc; ++ goto err_free_port; + } + + err = create_dev_resources(&dev->devr); +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index affc3f6598ca..19d590d39484 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -2037,8 +2037,8 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd, + + mlx5_ib_dbg(dev, "ib qpnum 0x%x, mlx qpn 0x%x, rcqn 0x%x, scqn 0x%x\n", + qp->ibqp.qp_num, qp->trans_qp.base.mqp.qpn, +- to_mcq(init_attr->recv_cq)->mcq.cqn, +- to_mcq(init_attr->send_cq)->mcq.cqn); ++ init_attr->recv_cq ? to_mcq(init_attr->recv_cq)->mcq.cqn : -1, ++ init_attr->send_cq ? to_mcq(init_attr->send_cq)->mcq.cqn : -1); + + qp->trans_qp.xrcdn = xrcdn; + +@@ -4702,6 +4702,14 @@ struct ib_rwq_ind_table *mlx5_ib_create_rwq_ind_table(struct ib_device *device, + udata->inlen)) + return ERR_PTR(-EOPNOTSUPP); + ++ if (init_attr->log_ind_tbl_size > ++ MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)) { ++ mlx5_ib_dbg(dev, "log_ind_tbl_size = %d is bigger than supported = %d\n", ++ init_attr->log_ind_tbl_size, ++ MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)); ++ return ERR_PTR(-EINVAL); ++ } ++ + min_resp_len = offsetof(typeof(resp), reserved) + sizeof(resp.reserved); + if (udata->outlen && udata->outlen < min_resp_len) + return ERR_PTR(-EINVAL); +diff --git a/drivers/infiniband/sw/rdmavt/dma.c b/drivers/infiniband/sw/rdmavt/dma.c +index 33076a5eee2f..04ebbb576385 100644 +--- a/drivers/infiniband/sw/rdmavt/dma.c ++++ b/drivers/infiniband/sw/rdmavt/dma.c +@@ -90,9 +90,6 @@ static u64 rvt_dma_map_page(struct ib_device *dev, struct page *page, + if (WARN_ON(!valid_dma_direction(direction))) + return BAD_DMA_ADDRESS; + +- if (offset + size > PAGE_SIZE) +- return BAD_DMA_ADDRESS; +- + addr = (u64)page_address(page); + if (addr) + addr += offset; +diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c +index eedf2f1cafdf..7f5d7358c99e 100644 +--- a/drivers/infiniband/sw/rxe/rxe_net.c ++++ b/drivers/infiniband/sw/rxe/rxe_net.c +@@ -243,10 +243,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port, + { + int err; + struct socket *sock; +- struct udp_port_cfg udp_cfg; +- struct udp_tunnel_sock_cfg tnl_cfg; +- +- memset(&udp_cfg, 0, sizeof(udp_cfg)); ++ struct udp_port_cfg udp_cfg = {0}; ++ struct udp_tunnel_sock_cfg tnl_cfg = {0}; + + if (ipv6) { + udp_cfg.family = AF_INET6; +@@ -264,10 +262,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port, + return ERR_PTR(err); + } + +- tnl_cfg.sk_user_data = NULL; + tnl_cfg.encap_type = 1; + tnl_cfg.encap_rcv = rxe_udp_encap_recv; +- tnl_cfg.encap_destroy = NULL; + + /* Setup UDP tunnel */ + setup_udp_tunnel_sock(net, sock, &tnl_cfg); +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 22ba24f2a2c1..f724a7ef9b67 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -522,6 +522,7 @@ static void rxe_qp_reset(struct rxe_qp *qp) + if (qp->sq.queue) { + __rxe_do_task(&qp->comp.task); + __rxe_do_task(&qp->req.task); ++ rxe_queue_reset(qp->sq.queue); + } + + /* cleanup attributes */ +@@ -573,6 +574,7 @@ void rxe_qp_error(struct rxe_qp *qp) + { + qp->req.state = QP_STATE_ERROR; + qp->resp.state = QP_STATE_ERROR; ++ qp->attr.qp_state = IB_QPS_ERR; + + /* drain work and packet queues */ + rxe_run_task(&qp->resp.task, 1); +diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c +index 08274254eb88..d14bf496d62d 100644 +--- a/drivers/infiniband/sw/rxe/rxe_queue.c ++++ b/drivers/infiniband/sw/rxe/rxe_queue.c +@@ -84,6 +84,15 @@ err1: + return -EINVAL; + } + ++inline void rxe_queue_reset(struct rxe_queue *q) ++{ ++ /* queue is comprised from header and the memory ++ * of the actual queue. See "struct rxe_queue_buf" in rxe_queue.h ++ * reset only the queue itself and not the management header ++ */ ++ memset(q->buf->data, 0, q->buf_size - sizeof(struct rxe_queue_buf)); ++} ++ + struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, + int *num_elem, + unsigned int elem_size) +diff --git a/drivers/infiniband/sw/rxe/rxe_queue.h b/drivers/infiniband/sw/rxe/rxe_queue.h +index 239fd609c31e..8c8641c87817 100644 +--- a/drivers/infiniband/sw/rxe/rxe_queue.h ++++ b/drivers/infiniband/sw/rxe/rxe_queue.h +@@ -84,6 +84,8 @@ int do_mmap_info(struct rxe_dev *rxe, + size_t buf_size, + struct rxe_mmap_info **ip_p); + ++void rxe_queue_reset(struct rxe_queue *q); ++ + struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, + int *num_elem, + unsigned int elem_size); +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 13a848a518e8..43bb16649e44 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -695,7 +695,8 @@ next_wqe: + qp->req.wqe_index); + wqe->state = wqe_state_done; + wqe->status = IB_WC_SUCCESS; +- goto complete; ++ __rxe_do_task(&qp->comp.task); ++ return 0; + } + payload = mtu; + } +@@ -744,13 +745,17 @@ err: + wqe->status = IB_WC_LOC_PROT_ERR; + wqe->state = wqe_state_error; + +-complete: +- if (qp_type(qp) != IB_QPT_RC) { +- while (rxe_completer(qp) == 0) +- ; +- } +- +- return 0; ++ /* ++ * IBA Spec. Section 10.7.3.1 SIGNALED COMPLETIONS ++ * ---------8<---------8<------------- ++ * ...Note that if a completion error occurs, a Work Completion ++ * will always be generated, even if the signaling ++ * indicator requests an Unsignaled Completion. ++ * ---------8<---------8<------------- ++ */ ++ wqe->wr.send_flags |= IB_SEND_SIGNALED; ++ __rxe_do_task(&qp->comp.task); ++ return -EAGAIN; + + exit: + return -EAGAIN; +diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c +index 41b113875d64..70c646b0097d 100644 +--- a/drivers/mfd/intel-lpss.c ++++ b/drivers/mfd/intel-lpss.c +@@ -502,9 +502,6 @@ int intel_lpss_suspend(struct device *dev) + for (i = 0; i < LPSS_PRIV_REG_COUNT; i++) + lpss->priv_ctx[i] = readl(lpss->priv + i * 4); + +- /* Put the device into reset state */ +- writel(0, lpss->priv + LPSS_PRIV_RESETS); +- + return 0; + } + EXPORT_SYMBOL_GPL(intel_lpss_suspend); +diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c +index 3ac486a597f3..c57e407020f1 100644 +--- a/drivers/mfd/mfd-core.c ++++ b/drivers/mfd/mfd-core.c +@@ -399,6 +399,8 @@ int mfd_clone_cell(const char *cell, const char **clones, size_t n_clones) + clones[i]); + } + ++ put_device(dev); ++ + return 0; + } + EXPORT_SYMBOL(mfd_clone_cell); +diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c +index 94c7cc02fdab..00dd7ff70e01 100644 +--- a/drivers/mfd/stmpe.c ++++ b/drivers/mfd/stmpe.c +@@ -761,6 +761,8 @@ static int stmpe1801_reset(struct stmpe *stmpe) + if (ret < 0) + return ret; + ++ msleep(10); ++ + timeout = jiffies + msecs_to_jiffies(100); + while (time_before(jiffies, timeout)) { + ret = __stmpe_reg_read(stmpe, STMPE1801_REG_SYS_CTRL); +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 1b5f531eeb25..bf3fd34924bd 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -2010,23 +2010,33 @@ static struct virtio_device_id id_table[] = { + { 0 }, + }; + ++#define VIRTNET_FEATURES \ ++ VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM, \ ++ VIRTIO_NET_F_MAC, \ ++ VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6, \ ++ VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6, \ ++ VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO, \ ++ VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ, \ ++ VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN, \ ++ VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ, \ ++ VIRTIO_NET_F_CTRL_MAC_ADDR, \ ++ VIRTIO_NET_F_MTU ++ + static unsigned int features[] = { +- VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM, +- VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC, +- VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6, +- VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6, +- VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO, +- VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ, +- VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN, +- VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ, +- VIRTIO_NET_F_CTRL_MAC_ADDR, ++ VIRTNET_FEATURES, ++}; ++ ++static unsigned int features_legacy[] = { ++ VIRTNET_FEATURES, ++ VIRTIO_NET_F_GSO, + VIRTIO_F_ANY_LAYOUT, +- VIRTIO_NET_F_MTU, + }; + + static struct virtio_driver virtio_net_driver = { + .feature_table = features, + .feature_table_size = ARRAY_SIZE(features), ++ .feature_table_legacy = features_legacy, ++ .feature_table_size_legacy = ARRAY_SIZE(features_legacy), + .driver.name = KBUILD_MODNAME, + .driver.owner = THIS_MODULE, + .id_table = id_table, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +index 4fdc3dad3e85..ea67ae9c87a0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +@@ -1087,6 +1087,15 @@ iwl_mvm_netdetect_config(struct iwl_mvm *mvm, + ret = iwl_mvm_switch_to_d3(mvm); + if (ret) + return ret; ++ } else { ++ /* In theory, we wouldn't have to stop a running sched ++ * scan in order to start another one (for ++ * net-detect). But in practice this doesn't seem to ++ * work properly, so stop any running sched_scan now. ++ */ ++ ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true); ++ if (ret) ++ return ret; + } + + /* rfkill release can be either for wowlan or netdetect */ +@@ -2088,6 +2097,16 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test) + iwl_mvm_update_changed_regdom(mvm); + + if (mvm->net_detect) { ++ /* If this is a non-unified image, we restart the FW, ++ * so no need to stop the netdetect scan. If that ++ * fails, continue and try to get the wake-up reasons, ++ * but trigger a HW restart by keeping a failure code ++ * in ret. ++ */ ++ if (unified_image) ++ ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_NETDETECT, ++ false); ++ + iwl_mvm_query_netdetect_reasons(mvm, vif); + /* has unlocked the mutex, so skip that */ + goto out; +@@ -2271,7 +2290,8 @@ static void iwl_mvm_d3_test_disconn_work_iter(void *_data, u8 *mac, + static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file) + { + struct iwl_mvm *mvm = inode->i_private; +- int remaining_time = 10; ++ bool unified_image = fw_has_capa(&mvm->fw->ucode_capa, ++ IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG); + + mvm->d3_test_active = false; + +@@ -2282,17 +2302,21 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file) + mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED; + + iwl_abort_notification_waits(&mvm->notif_wait); +- ieee80211_restart_hw(mvm->hw); ++ if (!unified_image) { ++ int remaining_time = 10; + +- /* wait for restart and disconnect all interfaces */ +- while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) && +- remaining_time > 0) { +- remaining_time--; +- msleep(1000); +- } ++ ieee80211_restart_hw(mvm->hw); + +- if (remaining_time == 0) +- IWL_ERR(mvm, "Timed out waiting for HW restart to finish!\n"); ++ /* wait for restart and disconnect all interfaces */ ++ while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) && ++ remaining_time > 0) { ++ remaining_time--; ++ msleep(1000); ++ } ++ ++ if (remaining_time == 0) ++ IWL_ERR(mvm, "Timed out waiting for HW restart!\n"); ++ } + + ieee80211_iterate_active_interfaces_atomic( + mvm->hw, IEEE80211_IFACE_ITER_NORMAL, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 5dd77e336617..90a1f4a06ba1 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -4097,7 +4097,6 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm, + struct iwl_mvm_internal_rxq_notif *notif, + u32 size) + { +- DECLARE_WAIT_QUEUE_HEAD_ONSTACK(notif_waitq); + u32 qmask = BIT(mvm->trans->num_rx_queues) - 1; + int ret; + +@@ -4119,7 +4118,7 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm, + } + + if (notif->sync) +- ret = wait_event_timeout(notif_waitq, ++ ret = wait_event_timeout(mvm->rx_sync_waitq, + atomic_read(&mvm->queue_sync_counter) == 0, + HZ); + WARN_ON_ONCE(!ret); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +index 6a615bb73042..e9cb970139c7 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +@@ -932,6 +932,7 @@ struct iwl_mvm { + /* sync d0i3_tx queue and IWL_MVM_STATUS_IN_D0I3 status flag */ + spinlock_t d0i3_tx_lock; + wait_queue_head_t d0i3_exit_waitq; ++ wait_queue_head_t rx_sync_waitq; + + /* BT-Coex */ + struct iwl_bt_coex_profile_notif last_bt_notif; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +index 55d9096da68c..30bbdec97d03 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +@@ -618,6 +618,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg, + spin_lock_init(&mvm->refs_lock); + skb_queue_head_init(&mvm->d0i3_tx); + init_waitqueue_head(&mvm->d0i3_exit_waitq); ++ init_waitqueue_head(&mvm->rx_sync_waitq); + + atomic_set(&mvm->queue_sync_counter, 0); + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +index afb7eb60e454..2b994be10b42 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +@@ -545,7 +545,8 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb, + "Received expired RX queue sync message\n"); + return; + } +- atomic_dec(&mvm->queue_sync_counter); ++ if (!atomic_dec_return(&mvm->queue_sync_counter)) ++ wake_up(&mvm->rx_sync_waitq); + } + + switch (internal_notif->type) { +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index dac120f8861b..3707ec60b575 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -1185,6 +1185,9 @@ static int iwl_mvm_num_scans(struct iwl_mvm *mvm) + + static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type) + { ++ bool unified_image = fw_has_capa(&mvm->fw->ucode_capa, ++ IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG); ++ + /* This looks a bit arbitrary, but the idea is that if we run + * out of possible simultaneous scans and the userspace is + * trying to run a scan type that is already running, we +@@ -1211,12 +1214,30 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type) + return -EBUSY; + return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true); + case IWL_MVM_SCAN_NETDETECT: +- /* No need to stop anything for net-detect since the +- * firmware is restarted anyway. This way, any sched +- * scans that were running will be restarted when we +- * resume. +- */ +- return 0; ++ /* For non-unified images, there's no need to stop ++ * anything for net-detect since the firmware is ++ * restarted anyway. This way, any sched scans that ++ * were running will be restarted when we resume. ++ */ ++ if (!unified_image) ++ return 0; ++ ++ /* If this is a unified image and we ran out of scans, ++ * we need to stop something. Prefer stopping regular ++ * scans, because the results are useless at this ++ * point, and we should be able to keep running ++ * another scheduled scan while suspended. ++ */ ++ if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK) ++ return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, ++ true); ++ if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK) ++ return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, ++ true); ++ ++ /* fall through, something is wrong if no scan was ++ * running but we ran out of scans. ++ */ + default: + WARN_ON(1); + break; +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 78cf9a7f3eac..13842ca124ab 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -526,48 +526,64 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + MODULE_DEVICE_TABLE(pci, iwl_hw_card_ids); + + #ifdef CONFIG_ACPI +-#define SPL_METHOD "SPLC" +-#define SPL_DOMAINTYPE_MODULE BIT(0) +-#define SPL_DOMAINTYPE_WIFI BIT(1) +-#define SPL_DOMAINTYPE_WIGIG BIT(2) +-#define SPL_DOMAINTYPE_RFEM BIT(3) ++#define ACPI_SPLC_METHOD "SPLC" ++#define ACPI_SPLC_DOMAIN_WIFI (0x07) + +-static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx) ++static u64 splc_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splc) + { +- union acpi_object *limits, *domain_type, *power_limit; +- +- if (splx->type != ACPI_TYPE_PACKAGE || +- splx->package.count != 2 || +- splx->package.elements[0].type != ACPI_TYPE_INTEGER || +- splx->package.elements[0].integer.value != 0) { +- IWL_ERR(trans, "Unsupported splx structure\n"); ++ union acpi_object *data_pkg, *dflt_pwr_limit; ++ int i; ++ ++ /* We need at least two elements, one for the revision and one ++ * for the data itself. Also check that the revision is ++ * supported (currently only revision 0). ++ */ ++ if (splc->type != ACPI_TYPE_PACKAGE || ++ splc->package.count < 2 || ++ splc->package.elements[0].type != ACPI_TYPE_INTEGER || ++ splc->package.elements[0].integer.value != 0) { ++ IWL_DEBUG_INFO(trans, ++ "Unsupported structure returned by the SPLC method. Ignoring.\n"); + return 0; + } + +- limits = &splx->package.elements[1]; +- if (limits->type != ACPI_TYPE_PACKAGE || +- limits->package.count < 2 || +- limits->package.elements[0].type != ACPI_TYPE_INTEGER || +- limits->package.elements[1].type != ACPI_TYPE_INTEGER) { +- IWL_ERR(trans, "Invalid limits element\n"); +- return 0; ++ /* loop through all the packages to find the one for WiFi */ ++ for (i = 1; i < splc->package.count; i++) { ++ union acpi_object *domain; ++ ++ data_pkg = &splc->package.elements[i]; ++ ++ /* Skip anything that is not a package with the right ++ * amount of elements (i.e. at least 2 integers). ++ */ ++ if (data_pkg->type != ACPI_TYPE_PACKAGE || ++ data_pkg->package.count < 2 || ++ data_pkg->package.elements[0].type != ACPI_TYPE_INTEGER || ++ data_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) ++ continue; ++ ++ domain = &data_pkg->package.elements[0]; ++ if (domain->integer.value == ACPI_SPLC_DOMAIN_WIFI) ++ break; ++ ++ data_pkg = NULL; + } + +- domain_type = &limits->package.elements[0]; +- power_limit = &limits->package.elements[1]; +- if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) { +- IWL_DEBUG_INFO(trans, "WiFi power is not limited\n"); ++ if (!data_pkg) { ++ IWL_DEBUG_INFO(trans, ++ "No element for the WiFi domain returned by the SPLC method.\n"); + return 0; + } + +- return power_limit->integer.value; ++ dflt_pwr_limit = &data_pkg->package.elements[1]; ++ return dflt_pwr_limit->integer.value; + } + + static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev) + { + acpi_handle pxsx_handle; + acpi_handle handle; +- struct acpi_buffer splx = {ACPI_ALLOCATE_BUFFER, NULL}; ++ struct acpi_buffer splc = {ACPI_ALLOCATE_BUFFER, NULL}; + acpi_status status; + + pxsx_handle = ACPI_HANDLE(&pdev->dev); +@@ -578,23 +594,24 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev) + } + + /* Get the method's handle */ +- status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle); ++ status = acpi_get_handle(pxsx_handle, (acpi_string)ACPI_SPLC_METHOD, ++ &handle); + if (ACPI_FAILURE(status)) { +- IWL_DEBUG_INFO(trans, "SPL method not found\n"); ++ IWL_DEBUG_INFO(trans, "SPLC method not found\n"); + return; + } + + /* Call SPLC with no arguments */ +- status = acpi_evaluate_object(handle, NULL, NULL, &splx); ++ status = acpi_evaluate_object(handle, NULL, NULL, &splc); + if (ACPI_FAILURE(status)) { + IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status); + return; + } + +- trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer); ++ trans->dflt_pwr_limit = splc_get_pwr_limit(trans, splc.pointer); + IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n", + trans->dflt_pwr_limit); +- kfree(splx.pointer); ++ kfree(splc.pointer); + } + + #else /* CONFIG_ACPI */ +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c +index 18650dccdb58..478bba527977 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c +@@ -522,6 +522,7 @@ error: + static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq, + int slots_num, u32 txq_id) + { ++ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); + int ret; + + txq->need_update = false; +@@ -536,6 +537,13 @@ static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq, + return ret; + + spin_lock_init(&txq->lock); ++ ++ if (txq_id == trans_pcie->cmd_queue) { ++ static struct lock_class_key iwl_pcie_cmd_queue_lock_class; ++ ++ lockdep_set_class(&txq->lock, &iwl_pcie_cmd_queue_lock_class); ++ } ++ + __skb_queue_head_init(&txq->overflow_q); + + /* +diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c +index ec2e9c5fb993..22394fe30579 100644 +--- a/drivers/rtc/rtc-omap.c ++++ b/drivers/rtc/rtc-omap.c +@@ -109,6 +109,7 @@ + /* OMAP_RTC_OSC_REG bit fields: */ + #define OMAP_RTC_OSC_32KCLK_EN BIT(6) + #define OMAP_RTC_OSC_SEL_32KCLK_SRC BIT(3) ++#define OMAP_RTC_OSC_OSC32K_GZ_DISABLE BIT(4) + + /* OMAP_RTC_IRQWAKEEN bit fields: */ + #define OMAP_RTC_IRQWAKEEN_ALARM_WAKEEN BIT(1) +@@ -646,8 +647,9 @@ static int omap_rtc_probe(struct platform_device *pdev) + */ + if (rtc->has_ext_clk) { + reg = rtc_read(rtc, OMAP_RTC_OSC_REG); +- rtc_write(rtc, OMAP_RTC_OSC_REG, +- reg | OMAP_RTC_OSC_SEL_32KCLK_SRC); ++ reg &= ~OMAP_RTC_OSC_OSC32K_GZ_DISABLE; ++ reg |= OMAP_RTC_OSC_32KCLK_EN | OMAP_RTC_OSC_SEL_32KCLK_SRC; ++ rtc_writel(rtc, OMAP_RTC_OSC_REG, reg); + } + + rtc->type->lock(rtc); +diff --git a/drivers/uwb/lc-rc.c b/drivers/uwb/lc-rc.c +index d059ad4d0dbd..97ee1b46db69 100644 +--- a/drivers/uwb/lc-rc.c ++++ b/drivers/uwb/lc-rc.c +@@ -56,8 +56,11 @@ static struct uwb_rc *uwb_rc_find_by_index(int index) + struct uwb_rc *rc = NULL; + + dev = class_find_device(&uwb_rc_class, NULL, &index, uwb_rc_index_match); +- if (dev) ++ if (dev) { + rc = dev_get_drvdata(dev); ++ put_device(dev); ++ } ++ + return rc; + } + +@@ -467,7 +470,9 @@ struct uwb_rc *__uwb_rc_try_get(struct uwb_rc *target_rc) + if (dev) { + rc = dev_get_drvdata(dev); + __uwb_rc_get(rc); ++ put_device(dev); + } ++ + return rc; + } + EXPORT_SYMBOL_GPL(__uwb_rc_try_get); +@@ -520,8 +525,11 @@ struct uwb_rc *uwb_rc_get_by_grandpa(const struct device *grandpa_dev) + + dev = class_find_device(&uwb_rc_class, NULL, grandpa_dev, + find_rc_grandpa); +- if (dev) ++ if (dev) { + rc = dev_get_drvdata(dev); ++ put_device(dev); ++ } ++ + return rc; + } + EXPORT_SYMBOL_GPL(uwb_rc_get_by_grandpa); +@@ -553,8 +561,10 @@ struct uwb_rc *uwb_rc_get_by_dev(const struct uwb_dev_addr *addr) + struct uwb_rc *rc = NULL; + + dev = class_find_device(&uwb_rc_class, NULL, addr, find_rc_dev); +- if (dev) ++ if (dev) { + rc = dev_get_drvdata(dev); ++ put_device(dev); ++ } + + return rc; + } +diff --git a/drivers/uwb/pal.c b/drivers/uwb/pal.c +index c1304b8d4985..678e93741ae1 100644 +--- a/drivers/uwb/pal.c ++++ b/drivers/uwb/pal.c +@@ -97,6 +97,8 @@ static bool uwb_rc_class_device_exists(struct uwb_rc *target_rc) + + dev = class_find_device(&uwb_rc_class, NULL, target_rc, find_rc); + ++ put_device(dev); ++ + return (dev != NULL); + } + +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index ea31931386ec..7bd21aaedaaf 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -235,6 +235,7 @@ struct ext4_io_submit { + #define EXT4_MAX_BLOCK_SIZE 65536 + #define EXT4_MIN_BLOCK_LOG_SIZE 10 + #define EXT4_MAX_BLOCK_LOG_SIZE 16 ++#define EXT4_MAX_CLUSTER_LOG_SIZE 30 + #ifdef __KERNEL__ + # define EXT4_BLOCK_SIZE(s) ((s)->s_blocksize) + #else +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 3ec8708989ca..ec89f5005c2d 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3518,7 +3518,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + if (blocksize < EXT4_MIN_BLOCK_SIZE || + blocksize > EXT4_MAX_BLOCK_SIZE) { + ext4_msg(sb, KERN_ERR, +- "Unsupported filesystem blocksize %d", blocksize); ++ "Unsupported filesystem blocksize %d (%d log_block_size)", ++ blocksize, le32_to_cpu(es->s_log_block_size)); ++ goto failed_mount; ++ } ++ if (le32_to_cpu(es->s_log_block_size) > ++ (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { ++ ext4_msg(sb, KERN_ERR, ++ "Invalid log block size: %u", ++ le32_to_cpu(es->s_log_block_size)); + goto failed_mount; + } + +@@ -3650,6 +3658,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + "block size (%d)", clustersize, blocksize); + goto failed_mount; + } ++ if (le32_to_cpu(es->s_log_cluster_size) > ++ (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { ++ ext4_msg(sb, KERN_ERR, ++ "Invalid log cluster size: %u", ++ le32_to_cpu(es->s_log_cluster_size)); ++ goto failed_mount; ++ } + sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) - + le32_to_cpu(es->s_log_block_size); + sbi->s_clusters_per_group = +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 3988b43c2f5a..a621dd98a865 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1985,6 +1985,10 @@ static int fuse_write_end(struct file *file, struct address_space *mapping, + { + struct inode *inode = page->mapping->host; + ++ /* Haven't copied anything? Skip zeroing, size extending, dirtying. */ ++ if (!copied) ++ goto unlock; ++ + if (!PageUptodate(page)) { + /* Zero any unwritten bytes at the end of the page */ + size_t endoff = (pos + copied) & ~PAGE_MASK; +@@ -1995,6 +1999,8 @@ static int fuse_write_end(struct file *file, struct address_space *mapping, + + fuse_write_update_size(inode, pos + copied); + set_page_dirty(page); ++ ++unlock: + unlock_page(page); + put_page(page); + +diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h +index ab02a457da1f..e5d193440374 100644 +--- a/include/linux/sunrpc/svc_xprt.h ++++ b/include/linux/sunrpc/svc_xprt.h +@@ -25,6 +25,7 @@ struct svc_xprt_ops { + void (*xpo_detach)(struct svc_xprt *); + void (*xpo_free)(struct svc_xprt *); + int (*xpo_secure_port)(struct svc_rqst *); ++ void (*xpo_kill_temp_xprt)(struct svc_xprt *); + }; + + struct svc_xprt_class { +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 9530fcd27704..9d592c66f754 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -1341,12 +1341,12 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) + + } else if (new->flags & IRQF_TRIGGER_MASK) { + unsigned int nmsk = new->flags & IRQF_TRIGGER_MASK; +- unsigned int omsk = irq_settings_get_trigger_mask(desc); ++ unsigned int omsk = irqd_get_trigger_type(&desc->irq_data); + + if (nmsk != omsk) + /* hope the handler works with current trigger mode */ + pr_warn("irq %d uses trigger mode %u; requested %u\n", +- irq, nmsk, omsk); ++ irq, omsk, nmsk); + } + + *old_ptr = new; +diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c +index 084452e34a12..bdff5ed57f10 100644 +--- a/kernel/power/suspend_test.c ++++ b/kernel/power/suspend_test.c +@@ -203,8 +203,10 @@ static int __init test_suspend(void) + + /* RTCs have initialized by now too ... can we use one? */ + dev = class_find_device(rtc_class, NULL, NULL, has_wakealarm); +- if (dev) ++ if (dev) { + rtc = rtc_class_open(dev_name(dev)); ++ put_device(dev); ++ } + if (!rtc) { + printk(warn_no_rtc); + return 0; +diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile +index d0a1617b52b4..979e7bfbde7a 100644 +--- a/kernel/trace/Makefile ++++ b/kernel/trace/Makefile +@@ -1,8 +1,4 @@ + +-# We are fully aware of the dangers of __builtin_return_address() +-FRAME_CFLAGS := $(call cc-disable-warning,frame-address) +-KBUILD_CFLAGS += $(FRAME_CFLAGS) +- + # Do not instrument the tracer itself: + + ifdef CONFIG_FUNCTION_TRACER +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 84752c8e28b5..b1d7f1b5e791 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -1856,6 +1856,10 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, + + /* Update rec->flags */ + do_for_each_ftrace_rec(pg, rec) { ++ ++ if (rec->flags & FTRACE_FL_DISABLED) ++ continue; ++ + /* We need to update only differences of filter_hash */ + in_old = !!ftrace_lookup_ip(old_hash, rec->ip); + in_new = !!ftrace_lookup_ip(new_hash, rec->ip); +@@ -1878,6 +1882,10 @@ rollback: + + /* Roll back what we did above */ + do_for_each_ftrace_rec(pg, rec) { ++ ++ if (rec->flags & FTRACE_FL_DISABLED) ++ continue; ++ + if (rec == end) + goto err_out; + +@@ -2391,6 +2399,10 @@ void __weak ftrace_replace_code(int enable) + return; + + do_for_each_ftrace_rec(pg, rec) { ++ ++ if (rec->flags & FTRACE_FL_DISABLED) ++ continue; ++ + failed = __ftrace_replace_code(rec, enable); + if (failed) { + ftrace_bug(failed, rec); +@@ -2757,7 +2769,7 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command) + struct dyn_ftrace *rec; + + do_for_each_ftrace_rec(pg, rec) { +- if (FTRACE_WARN_ON_ONCE(rec->flags)) ++ if (FTRACE_WARN_ON_ONCE(rec->flags & ~FTRACE_FL_DISABLED)) + pr_warn(" %pS flags:%lx\n", + (void *)rec->ip, rec->flags); + } while_for_each_ftrace_rec(); +@@ -3592,6 +3604,10 @@ match_records(struct ftrace_hash *hash, char *func, int len, char *mod) + goto out_unlock; + + do_for_each_ftrace_rec(pg, rec) { ++ ++ if (rec->flags & FTRACE_FL_DISABLED) ++ continue; ++ + if (ftrace_match_record(rec, &func_g, mod_match, exclude_mod)) { + ret = enter_record(hash, rec, clear_filter); + if (ret < 0) { +@@ -3787,6 +3803,9 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, + + do_for_each_ftrace_rec(pg, rec) { + ++ if (rec->flags & FTRACE_FL_DISABLED) ++ continue; ++ + if (!ftrace_match_record(rec, &func_g, NULL, 0)) + continue; + +@@ -4679,6 +4698,9 @@ ftrace_set_func(unsigned long *array, int *idx, int size, char *buffer) + + do_for_each_ftrace_rec(pg, rec) { + ++ if (rec->flags & FTRACE_FL_DISABLED) ++ continue; ++ + if (ftrace_match_record(rec, &func_g, NULL, 0)) { + /* if it is in the array */ + exists = false; +diff --git a/mm/Makefile b/mm/Makefile +index 2ca1faf3fa09..295bd7a9f76b 100644 +--- a/mm/Makefile ++++ b/mm/Makefile +@@ -21,9 +21,6 @@ KCOV_INSTRUMENT_memcontrol.o := n + KCOV_INSTRUMENT_mmzone.o := n + KCOV_INSTRUMENT_vmstat.o := n + +-# Since __builtin_frame_address does work as used, disable the warning. +-CFLAGS_usercopy.o += $(call cc-disable-warning, frame-address) +- + mmu-y := nommu.o + mmu-$(CONFIG_MMU) := gup.o highmem.o memory.o mincore.o \ + mlock.o mmap.o mprotect.o mremap.o msync.o rmap.o \ +diff --git a/net/can/bcm.c b/net/can/bcm.c +index 8e999ffdf28b..8af9d25ff988 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -1549,24 +1549,31 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, + struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; + struct sock *sk = sock->sk; + struct bcm_sock *bo = bcm_sk(sk); ++ int ret = 0; + + if (len < sizeof(*addr)) + return -EINVAL; + +- if (bo->bound) +- return -EISCONN; ++ lock_sock(sk); ++ ++ if (bo->bound) { ++ ret = -EISCONN; ++ goto fail; ++ } + + /* bind a device to this socket */ + if (addr->can_ifindex) { + struct net_device *dev; + + dev = dev_get_by_index(&init_net, addr->can_ifindex); +- if (!dev) +- return -ENODEV; +- ++ if (!dev) { ++ ret = -ENODEV; ++ goto fail; ++ } + if (dev->type != ARPHRD_CAN) { + dev_put(dev); +- return -ENODEV; ++ ret = -ENODEV; ++ goto fail; + } + + bo->ifindex = dev->ifindex; +@@ -1577,17 +1584,24 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, + bo->ifindex = 0; + } + +- bo->bound = 1; +- + if (proc_dir) { + /* unique socket address as filename */ + sprintf(bo->procname, "%lu", sock_i_ino(sk)); + bo->bcm_proc_read = proc_create_data(bo->procname, 0644, + proc_dir, + &bcm_proc_fops, sk); ++ if (!bo->bcm_proc_read) { ++ ret = -ENOMEM; ++ goto fail; ++ } + } + +- return 0; ++ bo->bound = 1; ++ ++fail: ++ release_sock(sk); ++ ++ return ret; + } + + static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, +diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c +index 0af26699bf04..584ac76ec555 100644 +--- a/net/netfilter/nft_dynset.c ++++ b/net/netfilter/nft_dynset.c +@@ -143,7 +143,8 @@ static int nft_dynset_init(const struct nft_ctx *ctx, + if (tb[NFTA_DYNSET_TIMEOUT] != NULL) { + if (!(set->flags & NFT_SET_TIMEOUT)) + return -EINVAL; +- timeout = be64_to_cpu(nla_get_be64(tb[NFTA_DYNSET_TIMEOUT])); ++ timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64( ++ tb[NFTA_DYNSET_TIMEOUT]))); + } + + priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]); +@@ -230,7 +231,8 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr) + goto nla_put_failure; + if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name)) + goto nla_put_failure; +- if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, cpu_to_be64(priv->timeout), ++ if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, ++ cpu_to_be64(jiffies_to_msecs(priv->timeout)), + NFTA_DYNSET_PAD)) + goto nla_put_failure; + if (priv->expr && nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr)) +diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c +index c3f652395a80..3bc1d61694cb 100644 +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -1002,14 +1002,8 @@ static void svc_age_temp_xprts(unsigned long closure) + void svc_age_temp_xprts_now(struct svc_serv *serv, struct sockaddr *server_addr) + { + struct svc_xprt *xprt; +- struct svc_sock *svsk; +- struct socket *sock; + struct list_head *le, *next; + LIST_HEAD(to_be_closed); +- struct linger no_linger = { +- .l_onoff = 1, +- .l_linger = 0, +- }; + + spin_lock_bh(&serv->sv_lock); + list_for_each_safe(le, next, &serv->sv_tempsocks) { +@@ -1027,10 +1021,7 @@ void svc_age_temp_xprts_now(struct svc_serv *serv, struct sockaddr *server_addr) + list_del_init(le); + xprt = list_entry(le, struct svc_xprt, xpt_list); + dprintk("svc_age_temp_xprts_now: closing %p\n", xprt); +- svsk = container_of(xprt, struct svc_sock, sk_xprt); +- sock = svsk->sk_sock; +- kernel_setsockopt(sock, SOL_SOCKET, SO_LINGER, +- (char *)&no_linger, sizeof(no_linger)); ++ xprt->xpt_ops->xpo_kill_temp_xprt(xprt); + svc_close_xprt(xprt); + } + } +diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c +index 57625f64efd5..a4bc98265d88 100644 +--- a/net/sunrpc/svcsock.c ++++ b/net/sunrpc/svcsock.c +@@ -438,6 +438,21 @@ static int svc_tcp_has_wspace(struct svc_xprt *xprt) + return !test_bit(SOCK_NOSPACE, &svsk->sk_sock->flags); + } + ++static void svc_tcp_kill_temp_xprt(struct svc_xprt *xprt) ++{ ++ struct svc_sock *svsk; ++ struct socket *sock; ++ struct linger no_linger = { ++ .l_onoff = 1, ++ .l_linger = 0, ++ }; ++ ++ svsk = container_of(xprt, struct svc_sock, sk_xprt); ++ sock = svsk->sk_sock; ++ kernel_setsockopt(sock, SOL_SOCKET, SO_LINGER, ++ (char *)&no_linger, sizeof(no_linger)); ++} ++ + /* + * See net/ipv6/ip_sockglue.c : ip_cmsg_recv_pktinfo + */ +@@ -648,6 +663,10 @@ static struct svc_xprt *svc_udp_accept(struct svc_xprt *xprt) + return NULL; + } + ++static void svc_udp_kill_temp_xprt(struct svc_xprt *xprt) ++{ ++} ++ + static struct svc_xprt *svc_udp_create(struct svc_serv *serv, + struct net *net, + struct sockaddr *sa, int salen, +@@ -667,6 +686,7 @@ static struct svc_xprt_ops svc_udp_ops = { + .xpo_has_wspace = svc_udp_has_wspace, + .xpo_accept = svc_udp_accept, + .xpo_secure_port = svc_sock_secure_port, ++ .xpo_kill_temp_xprt = svc_udp_kill_temp_xprt, + }; + + static struct svc_xprt_class svc_udp_class = { +@@ -1242,6 +1262,7 @@ static struct svc_xprt_ops svc_tcp_ops = { + .xpo_has_wspace = svc_tcp_has_wspace, + .xpo_accept = svc_tcp_accept, + .xpo_secure_port = svc_sock_secure_port, ++ .xpo_kill_temp_xprt = svc_tcp_kill_temp_xprt, + }; + + static struct svc_xprt_class svc_tcp_class = { +diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c +index 924271c9ef3e..a55b8093a7f9 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c +@@ -67,6 +67,7 @@ static void svc_rdma_detach(struct svc_xprt *xprt); + static void svc_rdma_free(struct svc_xprt *xprt); + static int svc_rdma_has_wspace(struct svc_xprt *xprt); + static int svc_rdma_secure_port(struct svc_rqst *); ++static void svc_rdma_kill_temp_xprt(struct svc_xprt *); + + static struct svc_xprt_ops svc_rdma_ops = { + .xpo_create = svc_rdma_create, +@@ -79,6 +80,7 @@ static struct svc_xprt_ops svc_rdma_ops = { + .xpo_has_wspace = svc_rdma_has_wspace, + .xpo_accept = svc_rdma_accept, + .xpo_secure_port = svc_rdma_secure_port, ++ .xpo_kill_temp_xprt = svc_rdma_kill_temp_xprt, + }; + + struct svc_xprt_class svc_rdma_class = { +@@ -1285,6 +1287,10 @@ static int svc_rdma_secure_port(struct svc_rqst *rqstp) + return 1; + } + ++static void svc_rdma_kill_temp_xprt(struct svc_xprt *xprt) ++{ ++} ++ + int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr) + { + struct ib_send_wr *bad_wr, *n_wr; +diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh +index 973e8c141567..17867e723a51 100755 +--- a/scripts/gcc-x86_64-has-stack-protector.sh ++++ b/scripts/gcc-x86_64-has-stack-protector.sh +@@ -1,6 +1,6 @@ + #!/bin/sh + +-echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs" ++echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs" + if [ "$?" -eq "0" ] ; then + echo y + else +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 26e866f65314..162818058a5d 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6905,8 +6905,6 @@ static const struct hda_fixup alc662_fixups[] = { + .v.pins = (const struct hda_pintbl[]) { + { 0x15, 0x40f000f0 }, /* disabled */ + { 0x16, 0x40f000f0 }, /* disabled */ +- { 0x18, 0x01014011 }, /* LO */ +- { 0x1a, 0x01014012 }, /* LO */ + { } + } + }, +diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c +index 6a23302297c9..4d9d320a7971 100644 +--- a/sound/pci/hda/thinkpad_helper.c ++++ b/sound/pci/hda/thinkpad_helper.c +@@ -13,7 +13,8 @@ static void (*old_vmaster_hook)(void *, int); + static bool is_thinkpad(struct hda_codec *codec) + { + return (codec->core.subsystem_id >> 16 == 0x17aa) && +- (acpi_dev_found("LEN0068") || acpi_dev_found("IBM0068")); ++ (acpi_dev_found("LEN0068") || acpi_dev_found("LEN0268") || ++ acpi_dev_found("IBM0068")); + } + + static void update_tpacpi_mute_led(void *private_data, int enabled) +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 9e5276d6dda0..2ddc034673a8 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -315,7 +315,8 @@ static int snd_usb_audio_free(struct snd_usb_audio *chip) + snd_usb_endpoint_free(ep); + + mutex_destroy(&chip->mutex); +- dev_set_drvdata(&chip->dev->dev, NULL); ++ if (!atomic_read(&chip->shutdown)) ++ dev_set_drvdata(&chip->dev->dev, NULL); + kfree(chip); + return 0; + } +diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c +index de15dbcdcecf..7214913861cf 100644 +--- a/tools/perf/util/hist.c ++++ b/tools/perf/util/hist.c +@@ -1596,18 +1596,18 @@ static void hists__hierarchy_output_resort(struct hists *hists, + if (prog) + ui_progress__update(prog, 1); + ++ hists->nr_entries++; ++ if (!he->filtered) { ++ hists->nr_non_filtered_entries++; ++ hists__calc_col_len(hists, he); ++ } ++ + if (!he->leaf) { + hists__hierarchy_output_resort(hists, prog, + &he->hroot_in, + &he->hroot_out, + min_callchain_hits, + use_callchain); +- hists->nr_entries++; +- if (!he->filtered) { +- hists->nr_non_filtered_entries++; +- hists__calc_col_len(hists, he); +- } +- + continue; + } + +diff --git a/virt/kvm/arm/pmu.c b/virt/kvm/arm/pmu.c +index 6e9c40eea208..69ccce308458 100644 +--- a/virt/kvm/arm/pmu.c ++++ b/virt/kvm/arm/pmu.c +@@ -305,7 +305,7 @@ void kvm_pmu_software_increment(struct kvm_vcpu *vcpu, u64 val) + continue; + type = vcpu_sys_reg(vcpu, PMEVTYPER0_EL0 + i) + & ARMV8_PMU_EVTYPE_EVENT; +- if ((type == ARMV8_PMU_EVTYPE_EVENT_SW_INCR) ++ if ((type == ARMV8_PMUV3_PERFCTR_SW_INCR) + && (enable & BIT(i))) { + reg = vcpu_sys_reg(vcpu, PMEVCNTR0_EL0 + i) + 1; + reg = lower_32_bits(reg); +@@ -379,7 +379,8 @@ void kvm_pmu_set_counter_event_type(struct kvm_vcpu *vcpu, u64 data, + eventsel = data & ARMV8_PMU_EVTYPE_EVENT; + + /* Software increment event does't need to be backed by a perf event */ +- if (eventsel == ARMV8_PMU_EVTYPE_EVENT_SW_INCR) ++ if (eventsel == ARMV8_PMUV3_PERFCTR_SW_INCR && ++ select_idx != ARMV8_PMU_CYCLE_IDX) + return; + + memset(&attr, 0, sizeof(struct perf_event_attr)); +@@ -391,7 +392,8 @@ void kvm_pmu_set_counter_event_type(struct kvm_vcpu *vcpu, u64 data, + attr.exclude_kernel = data & ARMV8_PMU_EXCLUDE_EL1 ? 1 : 0; + attr.exclude_hv = 1; /* Don't count EL2 events */ + attr.exclude_host = 1; /* Don't count host events */ +- attr.config = eventsel; ++ attr.config = (select_idx == ARMV8_PMU_CYCLE_IDX) ? ++ ARMV8_PMUV3_PERFCTR_CPU_CYCLES : eventsel; + + counter = kvm_pmu_get_counter_value(vcpu, select_idx); + /* The initial sample period (overflow count) of an event. */
