lkml.org 
[lkml]   [2016]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: Linux 4.3.6
    diff --git a/Makefile b/Makefile
    index efc7a766c470..95568cb1f5c6 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -1,6 +1,6 @@
    VERSION = 4
    PATCHLEVEL = 3
    -SUBLEVEL = 5
    +SUBLEVEL = 6
    EXTRAVERSION =
    NAME = Blurry Fish Butt

    diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
    index 9317974c9b8e..326564386cfa 100644
    --- a/arch/arm64/mm/mmu.c
    +++ b/arch/arm64/mm/mmu.c
    @@ -301,6 +301,7 @@ static void create_mapping_late(phys_addr_t phys, unsigned long virt,
    }

    #ifdef CONFIG_DEBUG_RODATA
    +#define SWAPPER_BLOCK_SIZE (PAGE_SHIFT == 12 ? SECTION_SIZE : PAGE_SIZE)
    static void __init __map_memblock(phys_addr_t start, phys_addr_t end)
    {
    /*
    @@ -308,8 +309,8 @@ static void __init __map_memblock(phys_addr_t start, phys_addr_t end)
    * for now. This will get more fine grained later once all memory
    * is mapped
    */
    - unsigned long kernel_x_start = round_down(__pa(_stext), SECTION_SIZE);
    - unsigned long kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
    + unsigned long kernel_x_start = round_down(__pa(_stext), SWAPPER_BLOCK_SIZE);
    + unsigned long kernel_x_end = round_up(__pa(__init_end), SWAPPER_BLOCK_SIZE);

    if (end < kernel_x_start) {
    create_mapping(start, __phys_to_virt(start),
    @@ -397,18 +398,18 @@ void __init fixup_executable(void)
    {
    #ifdef CONFIG_DEBUG_RODATA
    /* now that we are actually fully mapped, make the start/end more fine grained */
    - if (!IS_ALIGNED((unsigned long)_stext, SECTION_SIZE)) {
    + if (!IS_ALIGNED((unsigned long)_stext, SWAPPER_BLOCK_SIZE)) {
    unsigned long aligned_start = round_down(__pa(_stext),
    - SECTION_SIZE);
    + SWAPPER_BLOCK_SIZE);

    create_mapping(aligned_start, __phys_to_virt(aligned_start),
    __pa(_stext) - aligned_start,
    PAGE_KERNEL);
    }

    - if (!IS_ALIGNED((unsigned long)__init_end, SECTION_SIZE)) {
    + if (!IS_ALIGNED((unsigned long)__init_end, SWAPPER_BLOCK_SIZE)) {
    unsigned long aligned_end = round_up(__pa(__init_end),
    - SECTION_SIZE);
    + SWAPPER_BLOCK_SIZE);
    create_mapping(__pa(__init_end), (unsigned long)__init_end,
    aligned_end - __pa(__init_end),
    PAGE_KERNEL);
    diff --git a/arch/parisc/include/asm/compat.h b/arch/parisc/include/asm/compat.h
    index 94710cfc1ce8..0448a2c8eafb 100644
    --- a/arch/parisc/include/asm/compat.h
    +++ b/arch/parisc/include/asm/compat.h
    @@ -206,10 +206,10 @@ struct compat_ipc64_perm {

    struct compat_semid64_ds {
    struct compat_ipc64_perm sem_perm;
    - compat_time_t sem_otime;
    unsigned int __unused1;
    - compat_time_t sem_ctime;
    + compat_time_t sem_otime;
    unsigned int __unused2;
    + compat_time_t sem_ctime;
    compat_ulong_t sem_nsems;
    compat_ulong_t __unused3;
    compat_ulong_t __unused4;
    diff --git a/arch/parisc/include/uapi/asm/ipcbuf.h b/arch/parisc/include/uapi/asm/ipcbuf.h
    index bd956c425785..790c4119f647 100644
    --- a/arch/parisc/include/uapi/asm/ipcbuf.h
    +++ b/arch/parisc/include/uapi/asm/ipcbuf.h
    @@ -1,6 +1,9 @@
    #ifndef __PARISC_IPCBUF_H__
    #define __PARISC_IPCBUF_H__

    +#include <asm/bitsperlong.h>
    +#include <linux/posix_types.h>
    +
    /*
    * The ipc64_perm structure for PA-RISC is almost identical to
    * kern_ipc_perm as we have always had 32-bit UIDs and GIDs in the kernel.
    @@ -10,16 +13,18 @@

    struct ipc64_perm
    {
    - key_t key;
    - uid_t uid;
    - gid_t gid;
    - uid_t cuid;
    - gid_t cgid;
    + __kernel_key_t key;
    + __kernel_uid_t uid;
    + __kernel_gid_t gid;
    + __kernel_uid_t cuid;
    + __kernel_gid_t cgid;
    +#if __BITS_PER_LONG != 64
    unsigned short int __pad1;
    - mode_t mode;
    +#endif
    + __kernel_mode_t mode;
    unsigned short int __pad2;
    unsigned short int seq;
    - unsigned int __pad3;
    + unsigned int __pad3;
    unsigned long long int __unused1;
    unsigned long long int __unused2;
    };
    diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h
    index 294d251ca7b2..2ae13ce592e8 100644
    --- a/arch/parisc/include/uapi/asm/mman.h
    +++ b/arch/parisc/include/uapi/asm/mman.h
    @@ -46,16 +46,6 @@
    #define MADV_DONTFORK 10 /* don't inherit across fork */
    #define MADV_DOFORK 11 /* do inherit across fork */

    -/* The range 12-64 is reserved for page size specification. */
    -#define MADV_4K_PAGES 12 /* Use 4K pages */
    -#define MADV_16K_PAGES 14 /* Use 16K pages */
    -#define MADV_64K_PAGES 16 /* Use 64K pages */
    -#define MADV_256K_PAGES 18 /* Use 256K pages */
    -#define MADV_1M_PAGES 20 /* Use 1 Megabyte pages */
    -#define MADV_4M_PAGES 22 /* Use 4 Megabyte pages */
    -#define MADV_16M_PAGES 24 /* Use 16 Megabyte pages */
    -#define MADV_64M_PAGES 26 /* Use 64 Megabyte pages */
    -
    #define MADV_MERGEABLE 65 /* KSM may merge identical pages */
    #define MADV_UNMERGEABLE 66 /* KSM may not merge identical pages */

    diff --git a/arch/parisc/include/uapi/asm/msgbuf.h b/arch/parisc/include/uapi/asm/msgbuf.h
    index 342138983914..2e83ac758e19 100644
    --- a/arch/parisc/include/uapi/asm/msgbuf.h
    +++ b/arch/parisc/include/uapi/asm/msgbuf.h
    @@ -27,13 +27,13 @@ struct msqid64_ds {
    unsigned int __pad3;
    #endif
    __kernel_time_t msg_ctime; /* last change time */
    - unsigned int msg_cbytes; /* current number of bytes on queue */
    - unsigned int msg_qnum; /* number of messages in queue */
    - unsigned int msg_qbytes; /* max number of bytes on queue */
    + unsigned long msg_cbytes; /* current number of bytes on queue */
    + unsigned long msg_qnum; /* number of messages in queue */
    + unsigned long msg_qbytes; /* max number of bytes on queue */
    __kernel_pid_t msg_lspid; /* pid of last msgsnd */
    __kernel_pid_t msg_lrpid; /* last receive pid */
    - unsigned int __unused1;
    - unsigned int __unused2;
    + unsigned long __unused1;
    + unsigned long __unused2;
    };

    #endif /* _PARISC_MSGBUF_H */
    diff --git a/arch/parisc/include/uapi/asm/posix_types.h b/arch/parisc/include/uapi/asm/posix_types.h
    index b9344256f76b..f3b5f70b9a5f 100644
    --- a/arch/parisc/include/uapi/asm/posix_types.h
    +++ b/arch/parisc/include/uapi/asm/posix_types.h
    @@ -7,8 +7,10 @@
    * assume GCC is being used.
    */

    +#ifndef __LP64__
    typedef unsigned short __kernel_mode_t;
    #define __kernel_mode_t __kernel_mode_t
    +#endif

    typedef unsigned short __kernel_ipc_pid_t;
    #define __kernel_ipc_pid_t __kernel_ipc_pid_t
    diff --git a/arch/parisc/include/uapi/asm/sembuf.h b/arch/parisc/include/uapi/asm/sembuf.h
    index f01d89e30d73..c20971bf520f 100644
    --- a/arch/parisc/include/uapi/asm/sembuf.h
    +++ b/arch/parisc/include/uapi/asm/sembuf.h
    @@ -23,9 +23,9 @@ struct semid64_ds {
    unsigned int __pad2;
    #endif
    __kernel_time_t sem_ctime; /* last change time */
    - unsigned int sem_nsems; /* no. of semaphores in array */
    - unsigned int __unused1;
    - unsigned int __unused2;
    + unsigned long sem_nsems; /* no. of semaphores in array */
    + unsigned long __unused1;
    + unsigned long __unused2;
    };

    #endif /* _PARISC_SEMBUF_H */
    diff --git a/arch/parisc/include/uapi/asm/shmbuf.h b/arch/parisc/include/uapi/asm/shmbuf.h
    index 8496c38560c6..750e13e77991 100644
    --- a/arch/parisc/include/uapi/asm/shmbuf.h
    +++ b/arch/parisc/include/uapi/asm/shmbuf.h
    @@ -30,12 +30,12 @@ struct shmid64_ds {
    #if __BITS_PER_LONG != 64
    unsigned int __pad4;
    #endif
    - size_t shm_segsz; /* size of segment (bytes) */
    + __kernel_size_t shm_segsz; /* size of segment (bytes) */
    __kernel_pid_t shm_cpid; /* pid of creator */
    __kernel_pid_t shm_lpid; /* pid of last operator */
    - unsigned int shm_nattch; /* no. of current attaches */
    - unsigned int __unused1;
    - unsigned int __unused2;
    + unsigned long shm_nattch; /* no. of current attaches */
    + unsigned long __unused1;
    + unsigned long __unused2;
    };

    struct shminfo64 {
    diff --git a/arch/parisc/include/uapi/asm/siginfo.h b/arch/parisc/include/uapi/asm/siginfo.h
    index d7034728f377..1c75565d984b 100644
    --- a/arch/parisc/include/uapi/asm/siginfo.h
    +++ b/arch/parisc/include/uapi/asm/siginfo.h
    @@ -1,6 +1,10 @@
    #ifndef _PARISC_SIGINFO_H
    #define _PARISC_SIGINFO_H

    +#if defined(__LP64__)
    +#define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
    +#endif
    +
    #include <asm-generic/siginfo.h>

    #undef NSIGTRAP
    diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
    index dc1ea796fd60..2264f68f3c2f 100644
    --- a/arch/parisc/kernel/signal.c
    +++ b/arch/parisc/kernel/signal.c
    @@ -435,6 +435,55 @@ handle_signal(struct ksignal *ksig, struct pt_regs *regs, int in_syscall)
    regs->gr[28]);
    }

    +/*
    + * Check how the syscall number gets loaded into %r20 within
    + * the delay branch in userspace and adjust as needed.
    + */
    +
    +static void check_syscallno_in_delay_branch(struct pt_regs *regs)
    +{
    + u32 opcode, source_reg;
    + u32 __user *uaddr;
    + int err;
    +
    + /* Usually we don't have to restore %r20 (the system call number)
    + * because it gets loaded in the delay slot of the branch external
    + * instruction via the ldi instruction.
    + * In some cases a register-to-register copy instruction might have
    + * been used instead, in which case we need to copy the syscall
    + * number into the source register before returning to userspace.
    + */
    +
    + /* A syscall is just a branch, so all we have to do is fiddle the
    + * return pointer so that the ble instruction gets executed again.
    + */
    + regs->gr[31] -= 8; /* delayed branching */
    +
    + /* Get assembler opcode of code in delay branch */
    + uaddr = (unsigned int *) ((regs->gr[31] & ~3) + 4);
    + err = get_user(opcode, uaddr);
    + if (err)
    + return;
    +
    + /* Check if delay branch uses "ldi int,%r20" */
    + if ((opcode & 0xffff0000) == 0x34140000)
    + return; /* everything ok, just return */
    +
    + /* Check if delay branch uses "nop" */
    + if (opcode == INSN_NOP)
    + return;
    +
    + /* Check if delay branch uses "copy %rX,%r20" */
    + if ((opcode & 0xffe0ffff) == 0x08000254) {
    + source_reg = (opcode >> 16) & 31;
    + regs->gr[source_reg] = regs->gr[20];
    + return;
    + }
    +
    + pr_warn("syscall restart: %s (pid %d): unexpected opcode 0x%08x\n",
    + current->comm, task_pid_nr(current), opcode);
    +}
    +
    static inline void
    syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
    {
    @@ -457,10 +506,7 @@ syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
    }
    /* fallthrough */
    case -ERESTARTNOINTR:
    - /* A syscall is just a branch, so all
    - * we have to do is fiddle the return pointer.
    - */
    - regs->gr[31] -= 8; /* delayed branching */
    + check_syscallno_in_delay_branch(regs);
    break;
    }
    }
    @@ -510,15 +556,9 @@ insert_restart_trampoline(struct pt_regs *regs)
    }
    case -ERESTARTNOHAND:
    case -ERESTARTSYS:
    - case -ERESTARTNOINTR: {
    - /* Hooray for delayed branching. We don't
    - * have to restore %r20 (the system call
    - * number) because it gets loaded in the delay
    - * slot of the branch external instruction.
    - */
    - regs->gr[31] -= 8;
    + case -ERESTARTNOINTR:
    + check_syscallno_in_delay_branch(regs);
    return;
    - }
    default:
    break;
    }
    diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
    index c229427fa546..c5fec4890fdf 100644
    --- a/arch/parisc/mm/init.c
    +++ b/arch/parisc/mm/init.c
    @@ -23,6 +23,7 @@
    #include <linux/unistd.h>
    #include <linux/nodemask.h> /* for node_online_map */
    #include <linux/pagemap.h> /* for release_pages and page_cache_release */
    +#include <linux/compat.h>

    #include <asm/pgalloc.h>
    #include <asm/pgtable.h>
    @@ -30,6 +31,7 @@
    #include <asm/pdc_chassis.h>
    #include <asm/mmzone.h>
    #include <asm/sections.h>
    +#include <asm/msgbuf.h>

    extern int data_start;
    extern void parisc_kernel_start(void); /* Kernel entry point in head.S */
    @@ -590,6 +592,20 @@ unsigned long pcxl_dma_start __read_mostly;

    void __init mem_init(void)
    {
    + /* Do sanity checks on IPC (compat) structures */
    + BUILD_BUG_ON(sizeof(struct ipc64_perm) != 48);
    +#ifndef CONFIG_64BIT
    + BUILD_BUG_ON(sizeof(struct semid64_ds) != 80);
    + BUILD_BUG_ON(sizeof(struct msqid64_ds) != 104);
    + BUILD_BUG_ON(sizeof(struct shmid64_ds) != 104);
    +#endif
    +#ifdef CONFIG_COMPAT
    + BUILD_BUG_ON(sizeof(struct compat_ipc64_perm) != sizeof(struct ipc64_perm));
    + BUILD_BUG_ON(sizeof(struct compat_semid64_ds) != 80);
    + BUILD_BUG_ON(sizeof(struct compat_msqid64_ds) != 104);
    + BUILD_BUG_ON(sizeof(struct compat_shmid64_ds) != 104);
    +#endif
    +
    /* Do sanity checks on page table constants */
    BUILD_BUG_ON(PTE_ENTRY_SIZE != sizeof(pte_t));
    BUILD_BUG_ON(PMD_ENTRY_SIZE != sizeof(pmd_t));
    diff --git a/arch/sh/include/uapi/asm/unistd_64.h b/arch/sh/include/uapi/asm/unistd_64.h
    index e6820c86e8c7..47ebd5b5ed55 100644
    --- a/arch/sh/include/uapi/asm/unistd_64.h
    +++ b/arch/sh/include/uapi/asm/unistd_64.h
    @@ -278,7 +278,7 @@
    #define __NR_fsetxattr 256
    #define __NR_getxattr 257
    #define __NR_lgetxattr 258
    -#define __NR_fgetxattr 269
    +#define __NR_fgetxattr 259
    #define __NR_listxattr 260
    #define __NR_llistxattr 261
    #define __NR_flistxattr 262
    diff --git a/arch/x86/crypto/chacha20-ssse3-x86_64.S b/arch/x86/crypto/chacha20-ssse3-x86_64.S
    index 712b13047b41..3a33124e9112 100644
    --- a/arch/x86/crypto/chacha20-ssse3-x86_64.S
    +++ b/arch/x86/crypto/chacha20-ssse3-x86_64.S
    @@ -157,7 +157,9 @@ ENTRY(chacha20_4block_xor_ssse3)
    # done with the slightly better performing SSSE3 byte shuffling,
    # 7/12-bit word rotation uses traditional shift+OR.

    - sub $0x40,%rsp
    + mov %rsp,%r11
    + sub $0x80,%rsp
    + and $~63,%rsp

    # x0..15[0-3] = s0..3[0..3]
    movq 0x00(%rdi),%xmm1
    @@ -620,6 +622,6 @@ ENTRY(chacha20_4block_xor_ssse3)
    pxor %xmm1,%xmm15
    movdqu %xmm15,0xf0(%rsi)

    - add $0x40,%rsp
    + mov %r11,%rsp
    ret
    ENDPROC(chacha20_4block_xor_ssse3)
    diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
    index 225be06edc80..4fe27e074194 100644
    --- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
    +++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
    @@ -330,7 +330,7 @@ ENDPROC(crc_pcl)
    ## PCLMULQDQ tables
    ## Table is 128 entries x 2 words (8 bytes) each
    ################################################################
    -.section .rotata, "a", %progbits
    +.section .rodata, "a", %progbits
    .align 8
    K_table:
    .long 0x493c7d27, 0x00000001
    diff --git a/arch/xtensa/include/asm/asmmacro.h b/arch/xtensa/include/asm/asmmacro.h
    index 755320f6e0bc..746dcc8b5abc 100644
    --- a/arch/xtensa/include/asm/asmmacro.h
    +++ b/arch/xtensa/include/asm/asmmacro.h
    @@ -35,9 +35,10 @@
    * __loop as
    * restart loop. 'as' register must not have been modified!
    *
    - * __endla ar, at, incr
    + * __endla ar, as, incr
    * ar start address (modified)
    - * as scratch register used by macro
    + * as scratch register used by __loops/__loopi macros or
    + * end address used by __loopt macro
    * inc increment
    */

    @@ -97,7 +98,7 @@
    .endm

    /*
    - * loop from ar to ax
    + * loop from ar to as
    */

    .macro __loopt ar, as, at, incr_log2
    diff --git a/arch/xtensa/include/asm/vectors.h b/arch/xtensa/include/asm/vectors.h
    index a46c53f36113..986b5d0cb9e0 100644
    --- a/arch/xtensa/include/asm/vectors.h
    +++ b/arch/xtensa/include/asm/vectors.h
    @@ -48,6 +48,9 @@
    #define LOAD_MEMORY_ADDRESS 0xD0003000
    #endif

    +#define RESET_VECTOR1_VADDR (VIRTUAL_MEMORY_ADDRESS + \
    + XCHAL_RESET_VECTOR1_PADDR)
    +
    #else /* !defined(CONFIG_MMU) */
    /* MMU Not being used - Virtual == Physical */

    @@ -60,6 +63,8 @@
    /* Loaded just above possibly live vectors */
    #define LOAD_MEMORY_ADDRESS (PLATFORM_DEFAULT_MEM_START + 0x3000)

    +#define RESET_VECTOR1_VADDR (XCHAL_RESET_VECTOR1_VADDR)
    +
    #endif /* CONFIG_MMU */

    #define XC_VADDR(offset) (VIRTUAL_MEMORY_ADDRESS + offset)
    @@ -71,10 +76,6 @@
    VECBASE_RESET_VADDR)
    #define RESET_VECTOR_VADDR XC_VADDR(RESET_VECTOR_VECOFS)

    -#define RESET_VECTOR1_VECOFS (XCHAL_RESET_VECTOR1_VADDR - \
    - VECBASE_RESET_VADDR)
    -#define RESET_VECTOR1_VADDR XC_VADDR(RESET_VECTOR1_VECOFS)
    -
    #if defined(XCHAL_HAVE_VECBASE) && XCHAL_HAVE_VECBASE

    #define USER_VECTOR_VADDR XC_VADDR(XCHAL_USER_VECOFS)
    diff --git a/arch/xtensa/kernel/Makefile b/arch/xtensa/kernel/Makefile
    index 50137bc9e150..4db730290d2d 100644
    --- a/arch/xtensa/kernel/Makefile
    +++ b/arch/xtensa/kernel/Makefile
    @@ -16,6 +16,7 @@ obj-$(CONFIG_SMP) += smp.o mxhead.o
    obj-$(CONFIG_XTENSA_VARIANT_HAVE_PERF_EVENTS) += perf_event.o

    AFLAGS_head.o += -mtext-section-literals
    +AFLAGS_mxhead.o += -mtext-section-literals

    # In the Xtensa architecture, assembly generates literals which must always
    # precede the L32R instruction with a relative offset less than 256 kB.
    diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
    index 504130357597..db5c1765b413 100644
    --- a/arch/xtensa/kernel/entry.S
    +++ b/arch/xtensa/kernel/entry.S
    @@ -367,8 +367,10 @@ common_exception:
    s32i a2, a1, PT_SYSCALL
    movi a2, 0
    s32i a3, a1, PT_EXCVADDR
    +#if XCHAL_HAVE_LOOPS
    xsr a2, lcount
    s32i a2, a1, PT_LCOUNT
    +#endif

    /* It is now save to restore the EXC_TABLE_FIXUP variable. */

    @@ -429,11 +431,12 @@ common_exception:
    rsync # PS.WOE => rsync => overflow

    /* Save lbeg, lend */
    -
    +#if XCHAL_HAVE_LOOPS
    rsr a4, lbeg
    rsr a3, lend
    s32i a4, a1, PT_LBEG
    s32i a3, a1, PT_LEND
    +#endif

    /* Save SCOMPARE1 */

    @@ -724,13 +727,14 @@ common_exception_exit:
    wsr a3, sar

    /* Restore LBEG, LEND, LCOUNT */
    -
    +#if XCHAL_HAVE_LOOPS
    l32i a2, a1, PT_LBEG
    l32i a3, a1, PT_LEND
    wsr a2, lbeg
    l32i a2, a1, PT_LCOUNT
    wsr a3, lend
    wsr a2, lcount
    +#endif

    /* We control single stepping through the ICOUNTLEVEL register. */

    diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
    index 15a461e2a0ed..9ed55649ac8e 100644
    --- a/arch/xtensa/kernel/head.S
    +++ b/arch/xtensa/kernel/head.S
    @@ -249,7 +249,7 @@ ENTRY(_startup)

    __loopt a2, a3, a4, 2
    s32i a0, a2, 0
    - __endla a2, a4, 4
    + __endla a2, a3, 4

    #if XCHAL_DCACHE_IS_WRITEBACK

    diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
    index 28fc57ef5b86..4e06ec9769d1 100644
    --- a/arch/xtensa/kernel/setup.c
    +++ b/arch/xtensa/kernel/setup.c
    @@ -334,7 +334,10 @@ extern char _Level5InterruptVector_text_end;
    extern char _Level6InterruptVector_text_start;
    extern char _Level6InterruptVector_text_end;
    #endif
    -
    +#ifdef CONFIG_SMP
    +extern char _SecondaryResetVector_text_start;
    +extern char _SecondaryResetVector_text_end;
    +#endif


    #ifdef CONFIG_S32C1I_SELFTEST
    @@ -506,6 +509,10 @@ void __init setup_arch(char **cmdline_p)
    __pa(&_Level6InterruptVector_text_end), 0);
    #endif

    +#ifdef CONFIG_SMP
    + mem_reserve(__pa(&_SecondaryResetVector_text_start),
    + __pa(&_SecondaryResetVector_text_end), 0);
    +#endif
    parse_early_param();
    bootmem_init();

    diff --git a/arch/xtensa/kernel/vectors.S b/arch/xtensa/kernel/vectors.S
    index abcdb527f18a..fc25318e75ad 100644
    --- a/arch/xtensa/kernel/vectors.S
    +++ b/arch/xtensa/kernel/vectors.S
    @@ -478,6 +478,9 @@ _DoubleExceptionVector_handle_exception:

    ENDPROC(_DoubleExceptionVector)

    + .end literal_prefix
    +
    + .text
    /*
    * Fixup handler for TLB miss in double exception handler for window owerflow.
    * We get here with windowbase set to the window that was being spilled and
    @@ -587,7 +590,6 @@ ENTRY(window_overflow_restore_a0_fixup)

    ENDPROC(window_overflow_restore_a0_fixup)

    - .end literal_prefix
    /*
    * Debug interrupt vector
    *
    diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
    index fc1bc2ba8d5d..d66cd408be13 100644
    --- a/arch/xtensa/kernel/vmlinux.lds.S
    +++ b/arch/xtensa/kernel/vmlinux.lds.S
    @@ -166,8 +166,6 @@ SECTIONS
    RELOCATE_ENTRY(_DebugInterruptVector_text,
    .DebugInterruptVector.text);
    #if defined(CONFIG_SMP)
    - RELOCATE_ENTRY(_SecondaryResetVector_literal,
    - .SecondaryResetVector.literal);
    RELOCATE_ENTRY(_SecondaryResetVector_text,
    .SecondaryResetVector.text);
    #endif
    @@ -282,17 +280,11 @@ SECTIONS

    #if defined(CONFIG_SMP)

    - SECTION_VECTOR (_SecondaryResetVector_literal,
    - .SecondaryResetVector.literal,
    - RESET_VECTOR1_VADDR - 4,
    - SIZEOF(.DoubleExceptionVector.text),
    - .DoubleExceptionVector.text)
    -
    SECTION_VECTOR (_SecondaryResetVector_text,
    .SecondaryResetVector.text,
    RESET_VECTOR1_VADDR,
    - 4,
    - .SecondaryResetVector.literal)
    + SIZEOF(.DoubleExceptionVector.text),
    + .DoubleExceptionVector.text)

    . = LOADADDR(.SecondaryResetVector.text)+SIZEOF(.SecondaryResetVector.text);

    diff --git a/arch/xtensa/lib/usercopy.S b/arch/xtensa/lib/usercopy.S
    index ace1892a875e..7ea4dd68893e 100644
    --- a/arch/xtensa/lib/usercopy.S
    +++ b/arch/xtensa/lib/usercopy.S
    @@ -222,8 +222,8 @@ __xtensa_copy_user:
    loopnez a7, .Loop2done
    #else /* !XCHAL_HAVE_LOOPS */
    beqz a7, .Loop2done
    - slli a10, a7, 4
    - add a10, a10, a3 # a10 = end of last 16B source chunk
    + slli a12, a7, 4
    + add a12, a12, a3 # a12 = end of last 16B source chunk
    #endif /* !XCHAL_HAVE_LOOPS */
    .Loop2:
    EX(l32i, a7, a3, 4, l_fixup)
    @@ -241,7 +241,7 @@ __xtensa_copy_user:
    EX(s32i, a9, a5, 12, s_fixup)
    addi a5, a5, 16
    #if !XCHAL_HAVE_LOOPS
    - blt a3, a10, .Loop2
    + blt a3, a12, .Loop2
    #endif /* !XCHAL_HAVE_LOOPS */
    .Loop2done:
    bbci.l a4, 3, .L12
    diff --git a/arch/xtensa/platforms/iss/setup.c b/arch/xtensa/platforms/iss/setup.c
    index da7d18240866..391820539f0a 100644
    --- a/arch/xtensa/platforms/iss/setup.c
    +++ b/arch/xtensa/platforms/iss/setup.c
    @@ -61,7 +61,9 @@ void platform_restart(void)
    #if XCHAL_NUM_IBREAK > 0
    "wsr a2, ibreakenable\n\t"
    #endif
    +#if XCHAL_HAVE_LOOPS
    "wsr a2, lcount\n\t"
    +#endif
    "movi a2, 0x1f\n\t"
    "wsr a2, ps\n\t"
    "isync\n\t"
    diff --git a/arch/xtensa/platforms/xt2000/setup.c b/arch/xtensa/platforms/xt2000/setup.c
    index b90555cb8089..87678961a8c8 100644
    --- a/arch/xtensa/platforms/xt2000/setup.c
    +++ b/arch/xtensa/platforms/xt2000/setup.c
    @@ -72,7 +72,9 @@ void platform_restart(void)
    #if XCHAL_NUM_IBREAK > 0
    "wsr a2, ibreakenable\n\t"
    #endif
    +#if XCHAL_HAVE_LOOPS
    "wsr a2, lcount\n\t"
    +#endif
    "movi a2, 0x1f\n\t"
    "wsr a2, ps\n\t"
    "isync\n\t"
    diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
    index b4cf70e535ab..e9f65f79cf2e 100644
    --- a/arch/xtensa/platforms/xtfpga/setup.c
    +++ b/arch/xtensa/platforms/xtfpga/setup.c
    @@ -63,7 +63,9 @@ void platform_restart(void)
    #if XCHAL_NUM_IBREAK > 0
    "wsr a2, ibreakenable\n\t"
    #endif
    +#if XCHAL_HAVE_LOOPS
    "wsr a2, lcount\n\t"
    +#endif
    "movi a2, 0x1f\n\t"
    "wsr a2, ps\n\t"
    "isync\n\t"
    diff --git a/block/blk-core.c b/block/blk-core.c
    index 18e92a6645e2..b128c1609347 100644
    --- a/block/blk-core.c
    +++ b/block/blk-core.c
    @@ -1616,8 +1616,6 @@ static void blk_queue_bio(struct request_queue *q, struct bio *bio)
    struct request *req;
    unsigned int request_count = 0;

    - blk_queue_split(q, &bio, q->bio_split);
    -
    /*
    * low level driver can indicate that it wants pages above a
    * certain limit bounced to low memory (ie for highmem, or even
    @@ -1625,6 +1623,8 @@ static void blk_queue_bio(struct request_queue *q, struct bio *bio)
    */
    blk_queue_bounce(q, &bio);

    + blk_queue_split(q, &bio, q->bio_split);
    +
    if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) {
    bio->bi_error = -EIO;
    bio_endio(bio);
    @@ -2023,7 +2023,8 @@ void submit_bio(int rw, struct bio *bio)
    EXPORT_SYMBOL(submit_bio);

    /**
    - * blk_rq_check_limits - Helper function to check a request for the queue limit
    + * blk_cloned_rq_check_limits - Helper function to check a cloned request
    + * for new the queue limits
    * @q: the queue
    * @rq: the request being checked
    *
    @@ -2034,20 +2035,13 @@ EXPORT_SYMBOL(submit_bio);
    * after it is inserted to @q, it should be checked against @q before
    * the insertion using this generic function.
    *
    - * This function should also be useful for request stacking drivers
    - * in some cases below, so export this function.
    * Request stacking drivers like request-based dm may change the queue
    - * limits while requests are in the queue (e.g. dm's table swapping).
    - * Such request stacking drivers should check those requests against
    - * the new queue limits again when they dispatch those requests,
    - * although such checkings are also done against the old queue limits
    - * when submitting requests.
    + * limits when retrying requests on other queues. Those requests need
    + * to be checked against the new queue limits again during dispatch.
    */
    -int blk_rq_check_limits(struct request_queue *q, struct request *rq)
    +static int blk_cloned_rq_check_limits(struct request_queue *q,
    + struct request *rq)
    {
    - if (!rq_mergeable(rq))
    - return 0;
    -
    if (blk_rq_sectors(rq) > blk_queue_get_max_sectors(q, rq->cmd_flags)) {
    printk(KERN_ERR "%s: over max size limit.\n", __func__);
    return -EIO;
    @@ -2067,7 +2061,6 @@ int blk_rq_check_limits(struct request_queue *q, struct request *rq)

    return 0;
    }
    -EXPORT_SYMBOL_GPL(blk_rq_check_limits);

    /**
    * blk_insert_cloned_request - Helper for stacking drivers to submit a request
    @@ -2079,7 +2072,7 @@ int blk_insert_cloned_request(struct request_queue *q, struct request *rq)
    unsigned long flags;
    int where = ELEVATOR_INSERT_BACK;

    - if (blk_rq_check_limits(q, rq))
    + if (blk_cloned_rq_check_limits(q, rq))
    return -EIO;

    if (rq->rq_disk &&
    diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
    index b4ffc5be1a93..e5b5721809e2 100644
    --- a/crypto/ablkcipher.c
    +++ b/crypto/ablkcipher.c
    @@ -277,12 +277,12 @@ static int ablkcipher_walk_first(struct ablkcipher_request *req,
    if (WARN_ON_ONCE(in_irq()))
    return -EDEADLK;

    + walk->iv = req->info;
    walk->nbytes = walk->total;
    if (unlikely(!walk->total))
    return 0;

    walk->iv_buffer = NULL;
    - walk->iv = req->info;
    if (unlikely(((unsigned long)walk->iv & alignmask))) {
    int err = ablkcipher_copy_iv(walk, tfm, alignmask);

    diff --git a/crypto/af_alg.c b/crypto/af_alg.c
    index a8e7aa3e257b..f5e18c2a4852 100644
    --- a/crypto/af_alg.c
    +++ b/crypto/af_alg.c
    @@ -76,6 +76,8 @@ int af_alg_register_type(const struct af_alg_type *type)
    goto unlock;

    type->ops->owner = THIS_MODULE;
    + if (type->ops_nokey)
    + type->ops_nokey->owner = THIS_MODULE;
    node->type = type;
    list_add(&node->list, &alg_types);
    err = 0;
    @@ -125,6 +127,26 @@ int af_alg_release(struct socket *sock)
    }
    EXPORT_SYMBOL_GPL(af_alg_release);

    +void af_alg_release_parent(struct sock *sk)
    +{
    + struct alg_sock *ask = alg_sk(sk);
    + unsigned int nokey = ask->nokey_refcnt;
    + bool last = nokey && !ask->refcnt;
    +
    + sk = ask->parent;
    + ask = alg_sk(sk);
    +
    + lock_sock(sk);
    + ask->nokey_refcnt -= nokey;
    + if (!last)
    + last = !--ask->refcnt;
    + release_sock(sk);
    +
    + if (last)
    + sock_put(sk);
    +}
    +EXPORT_SYMBOL_GPL(af_alg_release_parent);
    +
    static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
    {
    const u32 forbidden = CRYPTO_ALG_INTERNAL;
    @@ -133,6 +155,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
    struct sockaddr_alg *sa = (void *)uaddr;
    const struct af_alg_type *type;
    void *private;
    + int err;

    if (sock->state == SS_CONNECTED)
    return -EINVAL;
    @@ -160,16 +183,22 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
    return PTR_ERR(private);
    }

    + err = -EBUSY;
    lock_sock(sk);
    + if (ask->refcnt | ask->nokey_refcnt)
    + goto unlock;

    swap(ask->type, type);
    swap(ask->private, private);

    + err = 0;
    +
    +unlock:
    release_sock(sk);

    alg_do_release(type, private);

    - return 0;
    + return err;
    }

    static int alg_setkey(struct sock *sk, char __user *ukey,
    @@ -202,11 +231,15 @@ static int alg_setsockopt(struct socket *sock, int level, int optname,
    struct sock *sk = sock->sk;
    struct alg_sock *ask = alg_sk(sk);
    const struct af_alg_type *type;
    - int err = -ENOPROTOOPT;
    + int err = -EBUSY;

    lock_sock(sk);
    + if (ask->refcnt)
    + goto unlock;
    +
    type = ask->type;

    + err = -ENOPROTOOPT;
    if (level != SOL_ALG || !type)
    goto unlock;

    @@ -238,6 +271,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
    struct alg_sock *ask = alg_sk(sk);
    const struct af_alg_type *type;
    struct sock *sk2;
    + unsigned int nokey;
    int err;

    lock_sock(sk);
    @@ -257,20 +291,29 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
    security_sk_clone(sk, sk2);

    err = type->accept(ask->private, sk2);
    - if (err) {
    - sk_free(sk2);
    +
    + nokey = err == -ENOKEY;
    + if (nokey && type->accept_nokey)
    + err = type->accept_nokey(ask->private, sk2);
    +
    + if (err)
    goto unlock;
    - }

    sk2->sk_family = PF_ALG;

    - sock_hold(sk);
    + if (nokey || !ask->refcnt++)
    + sock_hold(sk);
    + ask->nokey_refcnt += nokey;
    alg_sk(sk2)->parent = sk;
    alg_sk(sk2)->type = type;
    + alg_sk(sk2)->nokey_refcnt = nokey;

    newsock->ops = type->ops;
    newsock->state = SS_CONNECTED;

    + if (nokey)
    + newsock->ops = type->ops_nokey;
    +
    err = 0;

    unlock:
    diff --git a/crypto/ahash.c b/crypto/ahash.c
    index 9c1dc8d6106a..d19b52324cf5 100644
    --- a/crypto/ahash.c
    +++ b/crypto/ahash.c
    @@ -451,6 +451,7 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
    struct ahash_alg *alg = crypto_ahash_alg(hash);

    hash->setkey = ahash_nosetkey;
    + hash->has_setkey = false;
    hash->export = ahash_no_export;
    hash->import = ahash_no_import;

    @@ -463,8 +464,10 @@ static int crypto_ahash_init_tfm(struct crypto_tfm *tfm)
    hash->finup = alg->finup ?: ahash_def_finup;
    hash->digest = alg->digest;

    - if (alg->setkey)
    + if (alg->setkey) {
    hash->setkey = alg->setkey;
    + hash->has_setkey = true;
    + }
    if (alg->export)
    hash->export = alg->export;
    if (alg->import)
    diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
    index 1396ad0787fc..68a5ceaa04c8 100644
    --- a/crypto/algif_hash.c
    +++ b/crypto/algif_hash.c
    @@ -34,6 +34,11 @@ struct hash_ctx {
    struct ahash_request req;
    };

    +struct algif_hash_tfm {
    + struct crypto_ahash *hash;
    + bool has_key;
    +};
    +
    static int hash_sendmsg(struct socket *sock, struct msghdr *msg,
    size_t ignored)
    {
    @@ -49,7 +54,8 @@ static int hash_sendmsg(struct socket *sock, struct msghdr *msg,

    lock_sock(sk);
    if (!ctx->more) {
    - err = crypto_ahash_init(&ctx->req);
    + err = af_alg_wait_for_completion(crypto_ahash_init(&ctx->req),
    + &ctx->completion);
    if (err)
    goto unlock;
    }
    @@ -120,6 +126,7 @@ static ssize_t hash_sendpage(struct socket *sock, struct page *page,
    } else {
    if (!ctx->more) {
    err = crypto_ahash_init(&ctx->req);
    + err = af_alg_wait_for_completion(err, &ctx->completion);
    if (err)
    goto unlock;
    }
    @@ -181,9 +188,14 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
    struct sock *sk2;
    struct alg_sock *ask2;
    struct hash_ctx *ctx2;
    + bool more;
    int err;

    - err = crypto_ahash_export(req, state);
    + lock_sock(sk);
    + more = ctx->more;
    + err = more ? crypto_ahash_export(req, state) : 0;
    + release_sock(sk);
    +
    if (err)
    return err;

    @@ -194,7 +206,10 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
    sk2 = newsock->sk;
    ask2 = alg_sk(sk2);
    ctx2 = ask2->private;
    - ctx2->more = 1;
    + ctx2->more = more;
    +
    + if (!more)
    + return err;

    err = crypto_ahash_import(&ctx2->req, state);
    if (err) {
    @@ -227,19 +242,151 @@ static struct proto_ops algif_hash_ops = {
    .accept = hash_accept,
    };

    +static int hash_check_key(struct socket *sock)
    +{
    + int err = 0;
    + struct sock *psk;
    + struct alg_sock *pask;
    + struct algif_hash_tfm *tfm;
    + struct sock *sk = sock->sk;
    + struct alg_sock *ask = alg_sk(sk);
    +
    + lock_sock(sk);
    + if (ask->refcnt)
    + goto unlock_child;
    +
    + psk = ask->parent;
    + pask = alg_sk(ask->parent);
    + tfm = pask->private;
    +
    + err = -ENOKEY;
    + lock_sock_nested(psk, SINGLE_DEPTH_NESTING);
    + if (!tfm->has_key)
    + goto unlock;
    +
    + if (!pask->refcnt++)
    + sock_hold(psk);
    +
    + ask->refcnt = 1;
    + sock_put(psk);
    +
    + err = 0;
    +
    +unlock:
    + release_sock(psk);
    +unlock_child:
    + release_sock(sk);
    +
    + return err;
    +}
    +
    +static int hash_sendmsg_nokey(struct socket *sock, struct msghdr *msg,
    + size_t size)
    +{
    + int err;
    +
    + err = hash_check_key(sock);
    + if (err)
    + return err;
    +
    + return hash_sendmsg(sock, msg, size);
    +}
    +
    +static ssize_t hash_sendpage_nokey(struct socket *sock, struct page *page,
    + int offset, size_t size, int flags)
    +{
    + int err;
    +
    + err = hash_check_key(sock);
    + if (err)
    + return err;
    +
    + return hash_sendpage(sock, page, offset, size, flags);
    +}
    +
    +static int hash_recvmsg_nokey(struct socket *sock, struct msghdr *msg,
    + size_t ignored, int flags)
    +{
    + int err;
    +
    + err = hash_check_key(sock);
    + if (err)
    + return err;
    +
    + return hash_recvmsg(sock, msg, ignored, flags);
    +}
    +
    +static int hash_accept_nokey(struct socket *sock, struct socket *newsock,
    + int flags)
    +{
    + int err;
    +
    + err = hash_check_key(sock);
    + if (err)
    + return err;
    +
    + return hash_accept(sock, newsock, flags);
    +}
    +
    +static struct proto_ops algif_hash_ops_nokey = {
    + .family = PF_ALG,
    +
    + .connect = sock_no_connect,
    + .socketpair = sock_no_socketpair,
    + .getname = sock_no_getname,
    + .ioctl = sock_no_ioctl,
    + .listen = sock_no_listen,
    + .shutdown = sock_no_shutdown,
    + .getsockopt = sock_no_getsockopt,
    + .mmap = sock_no_mmap,
    + .bind = sock_no_bind,
    + .setsockopt = sock_no_setsockopt,
    + .poll = sock_no_poll,
    +
    + .release = af_alg_release,
    + .sendmsg = hash_sendmsg_nokey,
    + .sendpage = hash_sendpage_nokey,
    + .recvmsg = hash_recvmsg_nokey,
    + .accept = hash_accept_nokey,
    +};
    +
    static void *hash_bind(const char *name, u32 type, u32 mask)
    {
    - return crypto_alloc_ahash(name, type, mask);
    + struct algif_hash_tfm *tfm;
    + struct crypto_ahash *hash;
    +
    + tfm = kzalloc(sizeof(*tfm), GFP_KERNEL);
    + if (!tfm)
    + return ERR_PTR(-ENOMEM);
    +
    + hash = crypto_alloc_ahash(name, type, mask);
    + if (IS_ERR(hash)) {
    + kfree(tfm);
    + return ERR_CAST(hash);
    + }
    +
    + tfm->hash = hash;
    +
    + return tfm;
    }

    static void hash_release(void *private)
    {
    - crypto_free_ahash(private);
    + struct algif_hash_tfm *tfm = private;
    +
    + crypto_free_ahash(tfm->hash);
    + kfree(tfm);
    }

    static int hash_setkey(void *private, const u8 *key, unsigned int keylen)
    {
    - return crypto_ahash_setkey(private, key, keylen);
    + struct algif_hash_tfm *tfm = private;
    + int err;
    +
    + err = crypto_ahash_setkey(tfm->hash, key, keylen);
    + tfm->has_key = !err;
    +
    + return err;
    }

    static void hash_sock_destruct(struct sock *sk)
    @@ -253,12 +400,14 @@ static void hash_sock_destruct(struct sock *sk)
    af_alg_release_parent(sk);
    }

    -static int hash_accept_parent(void *private, struct sock *sk)
    +static int hash_accept_parent_nokey(void *private, struct sock *sk)
    {
    struct hash_ctx *ctx;
    struct alg_sock *ask = alg_sk(sk);
    - unsigned len = sizeof(*ctx) + crypto_ahash_reqsize(private);
    - unsigned ds = crypto_ahash_digestsize(private);
    + struct algif_hash_tfm *tfm = private;
    + struct crypto_ahash *hash = tfm->hash;
    + unsigned len = sizeof(*ctx) + crypto_ahash_reqsize(hash);
    + unsigned ds = crypto_ahash_digestsize(hash);

    ctx = sock_kmalloc(sk, len, GFP_KERNEL);
    if (!ctx)
    @@ -278,7 +427,7 @@ static int hash_accept_parent(void *private, struct sock *sk)

    ask->private = ctx;

    - ahash_request_set_tfm(&ctx->req, private);
    + ahash_request_set_tfm(&ctx->req, hash);
    ahash_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
    af_alg_complete, &ctx->completion);

    @@ -287,12 +436,24 @@ static int hash_accept_parent(void *private, struct sock *sk)
    return 0;
    }

    +static int hash_accept_parent(void *private, struct sock *sk)
    +{
    + struct algif_hash_tfm *tfm = private;
    +
    + if (!tfm->has_key && crypto_ahash_has_setkey(tfm->hash))
    + return -ENOKEY;
    +
    + return hash_accept_parent_nokey(private, sk);
    +}
    +
    static const struct af_alg_type algif_type_hash = {
    .bind = hash_bind,
    .release = hash_release,
    .setkey = hash_setkey,
    .accept = hash_accept_parent,
    + .accept_nokey = hash_accept_parent_nokey,
    .ops = &algif_hash_ops,
    + .ops_nokey = &algif_hash_ops_nokey,
    .name = "hash",
    .owner = THIS_MODULE
    };
    diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
    index af31a0ee4057..8ea54ac958ac 100644
    --- a/crypto/algif_skcipher.c
    +++ b/crypto/algif_skcipher.c
    @@ -31,6 +31,11 @@ struct skcipher_sg_list {
    struct scatterlist sg[0];
    };

    +struct skcipher_tfm {
    + struct crypto_skcipher *skcipher;
    + bool has_key;
    +};
    +
    struct skcipher_ctx {
    struct list_head tsgl;
    struct af_alg_sgl rsgl;
    @@ -47,7 +52,7 @@ struct skcipher_ctx {
    bool merge;
    bool enc;

    - struct ablkcipher_request req;
    + struct skcipher_request req;
    };

    struct skcipher_async_rsgl {
    @@ -60,18 +65,10 @@ struct skcipher_async_req {
    struct skcipher_async_rsgl first_sgl;
    struct list_head list;
    struct scatterlist *tsg;
    - char iv[];
    + atomic_t *inflight;
    + struct skcipher_request req;
    };

    -#define GET_SREQ(areq, ctx) (struct skcipher_async_req *)((char *)areq + \
    - crypto_ablkcipher_reqsize(crypto_ablkcipher_reqtfm(&ctx->req)))
    -
    -#define GET_REQ_SIZE(ctx) \
    - crypto_ablkcipher_reqsize(crypto_ablkcipher_reqtfm(&ctx->req))
    -
    -#define GET_IV_SIZE(ctx) \
    - crypto_ablkcipher_ivsize(crypto_ablkcipher_reqtfm(&ctx->req))
    -
    #define MAX_SGL_ENTS ((4096 - sizeof(struct skcipher_sg_list)) / \
    sizeof(struct scatterlist) - 1)

    @@ -97,15 +94,12 @@ static void skcipher_free_async_sgls(struct skcipher_async_req *sreq)

    static void skcipher_async_cb(struct crypto_async_request *req, int err)
    {
    - struct sock *sk = req->data;
    - struct alg_sock *ask = alg_sk(sk);
    - struct skcipher_ctx *ctx = ask->private;
    - struct skcipher_async_req *sreq = GET_SREQ(req, ctx);
    + struct skcipher_async_req *sreq = req->data;
    struct kiocb *iocb = sreq->iocb;

    - atomic_dec(&ctx->inflight);
    + atomic_dec(sreq->inflight);
    skcipher_free_async_sgls(sreq);
    - kfree(req);
    + kzfree(sreq);
    iocb->ki_complete(iocb, err, err);
    }

    @@ -301,9 +295,12 @@ static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg,
    {
    struct sock *sk = sock->sk;
    struct alg_sock *ask = alg_sk(sk);
    + struct sock *psk = ask->parent;
    + struct alg_sock *pask = alg_sk(psk);
    struct skcipher_ctx *ctx = ask->private;
    - struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(&ctx->req);
    - unsigned ivsize = crypto_ablkcipher_ivsize(tfm);
    + struct skcipher_tfm *skc = pask->private;
    + struct crypto_skcipher *tfm = skc->skcipher;
    + unsigned ivsize = crypto_skcipher_ivsize(tfm);
    struct skcipher_sg_list *sgl;
    struct af_alg_control con = {};
    long copied = 0;
    @@ -387,7 +384,8 @@ static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg,

    sgl = list_entry(ctx->tsgl.prev, struct skcipher_sg_list, list);
    sg = sgl->sg;
    - sg_unmark_end(sg + sgl->cur);
    + if (sgl->cur)
    + sg_unmark_end(sg + sgl->cur - 1);
    do {
    i = sgl->cur;
    plen = min_t(int, len, PAGE_SIZE);
    @@ -503,37 +501,43 @@ static int skcipher_recvmsg_async(struct socket *sock, struct msghdr *msg,
    {
    struct sock *sk = sock->sk;
    struct alg_sock *ask = alg_sk(sk);
    + struct sock *psk = ask->parent;
    + struct alg_sock *pask = alg_sk(psk);
    struct skcipher_ctx *ctx = ask->private;
    + struct skcipher_tfm *skc = pask->private;
    + struct crypto_skcipher *tfm = skc->skcipher;
    struct skcipher_sg_list *sgl;
    struct scatterlist *sg;
    struct skcipher_async_req *sreq;
    - struct ablkcipher_request *req;
    + struct skcipher_request *req;
    struct skcipher_async_rsgl *last_rsgl = NULL;
    - unsigned int txbufs = 0, len = 0, tx_nents = skcipher_all_sg_nents(ctx);
    - unsigned int reqlen = sizeof(struct skcipher_async_req) +
    - GET_REQ_SIZE(ctx) + GET_IV_SIZE(ctx);
    + unsigned int txbufs = 0, len = 0, tx_nents;
    + unsigned int reqsize = crypto_skcipher_reqsize(tfm);
    + unsigned int ivsize = crypto_skcipher_ivsize(tfm);
    int err = -ENOMEM;
    bool mark = false;
    + char *iv;

    - lock_sock(sk);
    - req = kmalloc(reqlen, GFP_KERNEL);
    - if (unlikely(!req))
    - goto unlock;
    + sreq = kzalloc(sizeof(*sreq) + reqsize + ivsize, GFP_KERNEL);
    + if (unlikely(!sreq))
    + goto out;

    - sreq = GET_SREQ(req, ctx);
    + req = &sreq->req;
    + iv = (char *)(req + 1) + reqsize;
    sreq->iocb = msg->msg_iocb;
    - memset(&sreq->first_sgl, '\0', sizeof(struct skcipher_async_rsgl));
    INIT_LIST_HEAD(&sreq->list);
    + sreq->inflight = &ctx->inflight;
    +
    + lock_sock(sk);
    + tx_nents = skcipher_all_sg_nents(ctx);
    sreq->tsg = kcalloc(tx_nents, sizeof(*sg), GFP_KERNEL);
    - if (unlikely(!sreq->tsg)) {
    - kfree(req);
    + if (unlikely(!sreq->tsg))
    goto unlock;
    - }
    sg_init_table(sreq->tsg, tx_nents);
    - memcpy(sreq->iv, ctx->iv, GET_IV_SIZE(ctx));
    - ablkcipher_request_set_tfm(req, crypto_ablkcipher_reqtfm(&ctx->req));
    - ablkcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
    - skcipher_async_cb, sk);
    + memcpy(iv, ctx->iv, ivsize);
    + skcipher_request_set_tfm(req, tfm);
    + skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP,
    + skcipher_async_cb, sreq);

    while (iov_iter_count(&msg->msg_iter)) {
    struct skcipher_async_rsgl *rsgl;
    @@ -608,21 +612,23 @@ static int skcipher_recvmsg_async(struct socket *sock, struct msghdr *msg,
    if (mark)
    sg_mark_end(sreq->tsg + txbufs - 1);

    - ablkcipher_request_set_crypt(req, sreq->tsg, sreq->first_sgl.sgl.sg,
    - len, sreq->iv);
    - err = ctx->enc ? crypto_ablkcipher_encrypt(req) :
    - crypto_ablkcipher_decrypt(req);
    + skcipher_request_set_crypt(req, sreq->tsg, sreq->first_sgl.sgl.sg,
    + len, iv);
    + err = ctx->enc ? crypto_skcipher_encrypt(req) :
    + crypto_skcipher_decrypt(req);
    if (err == -EINPROGRESS) {
    atomic_inc(&ctx->inflight);
    err = -EIOCBQUEUED;
    + sreq = NULL;
    goto unlock;
    }
    free:
    skcipher_free_async_sgls(sreq);
    - kfree(req);
    unlock:
    skcipher_wmem_wakeup(sk);
    release_sock(sk);
    + kzfree(sreq);
    +out:
    return err;
    }

    @@ -631,9 +637,12 @@ static int skcipher_recvmsg_sync(struct socket *sock, struct msghdr *msg,
    {
    struct sock *sk = sock->sk;
    struct alg_sock *ask = alg_sk(sk);
    + struct sock *psk = ask->parent;
    + struct alg_sock *pask = alg_sk(psk);
    struct skcipher_ctx *ctx = ask->private;
    - unsigned bs = crypto_ablkcipher_blocksize(crypto_ablkcipher_reqtfm(
    - &ctx->req));
    + struct skcipher_tfm *skc = pask->private;
    + struct crypto_skcipher *tfm = skc->skcipher;
    + unsigned bs = crypto_skcipher_blocksize(tfm);
    struct skcipher_sg_list *sgl;
    struct scatterlist *sg;
    int err = -EAGAIN;
    @@ -642,13 +651,6 @@ static int skcipher_recvmsg_sync(struct socket *sock, struct msghdr *msg,

    lock_sock(sk);
    while (msg_data_left(msg)) {
    - sgl = list_first_entry(&ctx->tsgl,
    - struct skcipher_sg_list, list);
    - sg = sgl->sg;
    -
    - while (!sg->length)
    - sg++;
    -
    if (!ctx->used) {
    err = skcipher_wait_for_data(sk, flags);
    if (err)
    @@ -669,14 +671,20 @@ static int skcipher_recvmsg_sync(struct socket *sock, struct msghdr *msg,
    if (!used)
    goto free;

    - ablkcipher_request_set_crypt(&ctx->req, sg,
    - ctx->rsgl.sg, used,
    - ctx->iv);
    + sgl = list_first_entry(&ctx->tsgl,
    + struct skcipher_sg_list, list);
    + sg = sgl->sg;
    +
    + while (!sg->length)
    + sg++;
    +
    + skcipher_request_set_crypt(&ctx->req, sg, ctx->rsgl.sg, used,
    + ctx->iv);

    err = af_alg_wait_for_completion(
    ctx->enc ?
    - crypto_ablkcipher_encrypt(&ctx->req) :
    - crypto_ablkcipher_decrypt(&ctx->req),
    + crypto_skcipher_encrypt(&ctx->req) :
    + crypto_skcipher_decrypt(&ctx->req),
    &ctx->completion);

    free:
    @@ -749,19 +757,139 @@ static struct proto_ops algif_skcipher_ops = {
    .poll = skcipher_poll,
    };

    +static int skcipher_check_key(struct socket *sock)
    +{
    + int err = 0;
    + struct sock *psk;
    + struct alg_sock *pask;
    + struct skcipher_tfm *tfm;
    + struct sock *sk = sock->sk;
    + struct alg_sock *ask = alg_sk(sk);
    +
    + lock_sock(sk);
    + if (ask->refcnt)
    + goto unlock_child;
    +
    + psk = ask->parent;
    + pask = alg_sk(ask->parent);
    + tfm = pask->private;
    +
    + err = -ENOKEY;
    + lock_sock_nested(psk, SINGLE_DEPTH_NESTING);
    + if (!tfm->has_key)
    + goto unlock;
    +
    + if (!pask->refcnt++)
    + sock_hold(psk);
    +
    + ask->refcnt = 1;
    + sock_put(psk);
    +
    + err = 0;
    +
    +unlock:
    + release_sock(psk);
    +unlock_child:
    + release_sock(sk);
    +
    + return err;
    +}
    +
    +static int skcipher_sendmsg_nokey(struct socket *sock, struct msghdr *msg,
    + size_t size)
    +{
    + int err;
    +
    + err = skcipher_check_key(sock);
    + if (err)
    + return err;
    +
    + return skcipher_sendmsg(sock, msg, size);
    +}
    +
    +static ssize_t skcipher_sendpage_nokey(struct socket *sock, struct page *page,
    + int offset, size_t size, int flags)
    +{
    + int err;
    +
    + err = skcipher_check_key(sock);
    + if (err)
    + return err;
    +
    + return skcipher_sendpage(sock, page, offset, size, flags);
    +}
    +
    +static int skcipher_recvmsg_nokey(struct socket *sock, struct msghdr *msg,
    + size_t ignored, int flags)
    +{
    + int err;
    +
    + err = skcipher_check_key(sock);
    + if (err)
    + return err;
    +
    + return skcipher_recvmsg(sock, msg, ignored, flags);
    +}
    +
    +static struct proto_ops algif_skcipher_ops_nokey = {
    + .family = PF_ALG,
    +
    + .connect = sock_no_connect,
    + .socketpair = sock_no_socketpair,
    + .getname = sock_no_getname,
    + .ioctl = sock_no_ioctl,
    + .listen = sock_no_listen,
    + .shutdown = sock_no_shutdown,
    + .getsockopt = sock_no_getsockopt,
    + .mmap = sock_no_mmap,
    + .bind = sock_no_bind,
    + .accept = sock_no_accept,
    + .setsockopt = sock_no_setsockopt,
    +
    + .release = af_alg_release,
    + .sendmsg = skcipher_sendmsg_nokey,
    + .sendpage = skcipher_sendpage_nokey,
    + .recvmsg = skcipher_recvmsg_nokey,
    + .poll = skcipher_poll,
    +};
    +
    static void *skcipher_bind(const char *name, u32 type, u32 mask)
    {
    - return crypto_alloc_ablkcipher(name, type, mask);
    + struct skcipher_tfm *tfm;
    + struct crypto_skcipher *skcipher;
    +
    + tfm = kzalloc(sizeof(*tfm), GFP_KERNEL);
    + if (!tfm)
    + return ERR_PTR(-ENOMEM);
    +
    + skcipher = crypto_alloc_skcipher(name, type, mask);
    + if (IS_ERR(skcipher)) {
    + kfree(tfm);
    + return ERR_CAST(skcipher);
    + }
    +
    + tfm->skcipher = skcipher;
    +
    + return tfm;
    }

    static void skcipher_release(void *private)
    {
    - crypto_free_ablkcipher(private);
    + struct skcipher_tfm *tfm = private;
    +
    + crypto_free_skcipher(tfm->skcipher);
    + kfree(tfm);
    }

    static int skcipher_setkey(void *private, const u8 *key, unsigned int keylen)
    {
    - return crypto_ablkcipher_setkey(private, key, keylen);
    + struct skcipher_tfm *tfm = private;
    + int err;
    +
    + err = crypto_skcipher_setkey(tfm->skcipher, key, keylen);
    + tfm->has_key = !err;
    +
    + return err;
    }

    static void skcipher_wait(struct sock *sk)
    @@ -778,35 +906,37 @@ static void skcipher_sock_destruct(struct sock *sk)
    {
    struct alg_sock *ask = alg_sk(sk);
    struct skcipher_ctx *ctx = ask->private;
    - struct crypto_ablkcipher *tfm = crypto_ablkcipher_reqtfm(&ctx->req);
    + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(&ctx->req);

    if (atomic_read(&ctx->inflight))
    skcipher_wait(sk);

    skcipher_free_sgl(sk);
    - sock_kzfree_s(sk, ctx->iv, crypto_ablkcipher_ivsize(tfm));
    + sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm));
    sock_kfree_s(sk, ctx, ctx->len);
    af_alg_release_parent(sk);
    }

    -static int skcipher_accept_parent(void *private, struct sock *sk)
    +static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
    {
    struct skcipher_ctx *ctx;
    struct alg_sock *ask = alg_sk(sk);
    - unsigned int len = sizeof(*ctx) + crypto_ablkcipher_reqsize(private);
    + struct skcipher_tfm *tfm = private;
    + struct crypto_skcipher *skcipher = tfm->skcipher;
    + unsigned int len = sizeof(*ctx) + crypto_skcipher_reqsize(skcipher);

    ctx = sock_kmalloc(sk, len, GFP_KERNEL);
    if (!ctx)
    return -ENOMEM;

    - ctx->iv = sock_kmalloc(sk, crypto_ablkcipher_ivsize(private),
    + ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(skcipher),
    GFP_KERNEL);
    if (!ctx->iv) {
    sock_kfree_s(sk, ctx, len);
    return -ENOMEM;
    }

    - memset(ctx->iv, 0, crypto_ablkcipher_ivsize(private));
    + memset(ctx->iv, 0, crypto_skcipher_ivsize(skcipher));

    INIT_LIST_HEAD(&ctx->tsgl);
    ctx->len = len;
    @@ -819,21 +949,34 @@ static int skcipher_accept_parent(void *private, struct sock *sk)

    ask->private = ctx;

    - ablkcipher_request_set_tfm(&ctx->req, private);
    - ablkcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_BACKLOG,
    - af_alg_complete, &ctx->completion);
    + skcipher_request_set_tfm(&ctx->req, skcipher);
    + skcipher_request_set_callback(&ctx->req, CRYPTO_TFM_REQ_MAY_SLEEP |
    + CRYPTO_TFM_REQ_MAY_BACKLOG,
    + af_alg_complete, &ctx->completion);

    sk->sk_destruct = skcipher_sock_destruct;

    return 0;
    }

    +static int skcipher_accept_parent(void *private, struct sock *sk)
    +{
    + struct skcipher_tfm *tfm = private;
    +
    + if (!tfm->has_key && crypto_skcipher_has_setkey(tfm->skcipher))
    + return -ENOKEY;
    +
    + return skcipher_accept_parent_nokey(private, sk);
    +}
    +
    static const struct af_alg_type algif_type_skcipher = {
    .bind = skcipher_bind,
    .release = skcipher_release,
    .setkey = skcipher_setkey,
    .accept = skcipher_accept_parent,
    + .accept_nokey = skcipher_accept_parent_nokey,
    .ops = &algif_skcipher_ops,
    + .ops_nokey = &algif_skcipher_ops_nokey,
    .name = "skcipher",
    .owner = THIS_MODULE
    };
    diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
    index 11b981492031..8cc1622b2ee0 100644
    --- a/crypto/blkcipher.c
    +++ b/crypto/blkcipher.c
    @@ -326,12 +326,12 @@ static int blkcipher_walk_first(struct blkcipher_desc *desc,
    if (WARN_ON_ONCE(in_irq()))
    return -EDEADLK;

    + walk->iv = desc->info;
    walk->nbytes = walk->total;
    if (unlikely(!walk->total))
    return 0;

    walk->buffer = NULL;
    - walk->iv = desc->info;
    if (unlikely(((unsigned long)walk->iv & walk->alignmask))) {
    int err = blkcipher_copy_iv(walk);
    if (err)
    diff --git a/crypto/crc32c_generic.c b/crypto/crc32c_generic.c
    index 06f1b60f02b2..4c0a0e271876 100644
    --- a/crypto/crc32c_generic.c
    +++ b/crypto/crc32c_generic.c
    @@ -172,4 +172,3 @@ MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c");
    MODULE_LICENSE("GPL");
    MODULE_ALIAS_CRYPTO("crc32c");
    MODULE_ALIAS_CRYPTO("crc32c-generic");
    -MODULE_SOFTDEP("pre: crc32c");
    diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
    index 237f3795cfaa..43fe85f20d57 100644
    --- a/crypto/crypto_user.c
    +++ b/crypto/crypto_user.c
    @@ -499,6 +499,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    if (link->dump == NULL)
    return -EINVAL;

    + down_read(&crypto_alg_sem);
    list_for_each_entry(alg, &crypto_alg_list, cra_list)
    dump_alloc += CRYPTO_REPORT_MAXSIZE;

    @@ -508,8 +509,11 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    .done = link->done,
    .min_dump_alloc = dump_alloc,
    };
    - return netlink_dump_start(crypto_nlsk, skb, nlh, &c);
    + err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
    }
    + up_read(&crypto_alg_sem);
    +
    + return err;
    }

    err = nlmsg_parse(nlh, crypto_msg_min[type], attrs, CRYPTOCFGA_MAX,
    diff --git a/crypto/shash.c b/crypto/shash.c
    index ecb1e3d39bf0..359754591653 100644
    --- a/crypto/shash.c
    +++ b/crypto/shash.c
    @@ -354,9 +354,10 @@ int crypto_init_shash_ops_async(struct crypto_tfm *tfm)
    crt->final = shash_async_final;
    crt->finup = shash_async_finup;
    crt->digest = shash_async_digest;
    + crt->setkey = shash_async_setkey;
    +
    + crt->has_setkey = alg->setkey != shash_no_setkey;

    - if (alg->setkey)
    - crt->setkey = shash_async_setkey;
    if (alg->export)
    crt->export = shash_async_export;
    if (alg->import)
    diff --git a/crypto/skcipher.c b/crypto/skcipher.c
    index dd5fc1bf6447..bb7d44d2c843 100644
    --- a/crypto/skcipher.c
    +++ b/crypto/skcipher.c
    @@ -118,6 +118,7 @@ int crypto_init_skcipher_ops_blkcipher(struct crypto_tfm *tfm)
    skcipher->decrypt = skcipher_decrypt_blkcipher;

    skcipher->ivsize = crypto_blkcipher_ivsize(blkcipher);
    + skcipher->has_setkey = calg->cra_blkcipher.max_keysize;

    return 0;
    }
    @@ -210,6 +211,7 @@ int crypto_init_skcipher_ops_ablkcipher(struct crypto_tfm *tfm)
    skcipher->ivsize = crypto_ablkcipher_ivsize(ablkcipher);
    skcipher->reqsize = crypto_ablkcipher_reqsize(ablkcipher) +
    sizeof(struct ablkcipher_request);
    + skcipher->has_setkey = calg->cra_ablkcipher.max_keysize;

    return 0;
    }
    diff --git a/crypto/testmgr.h b/crypto/testmgr.h
    index 64b8a8082645..450f30e2c8e4 100644
    --- a/crypto/testmgr.h
    +++ b/crypto/testmgr.h
    @@ -270,7 +270,7 @@ static struct akcipher_testvec rsa_tv_template[] = {
    .c_size = 256,
    }, {
    .key =
    - "\x30\x82\x01\x09" /* sequence of 265 bytes */
    + "\x30\x82\x01\x0C" /* sequence of 268 bytes */
    "\x02\x82\x01\x00" /* modulus - integer of 256 bytes */
    "\xDB\x10\x1A\xC2\xA3\xF1\xDC\xFF\x13\x6B\xED\x44\xDF\xF0\x02\x6D"
    "\x13\xC7\x88\xDA\x70\x6B\x54\xF1\xE8\x27\xDC\xC3\x0F\x99\x6A\xFA"
    @@ -288,8 +288,9 @@ static struct akcipher_testvec rsa_tv_template[] = {
    "\x55\xE6\x29\x69\xD1\xC2\xE8\xB9\x78\x59\xF6\x79\x10\xC6\x4E\xEB"
    "\x6A\x5E\xB9\x9A\xC7\xC4\x5B\x63\xDA\xA3\x3F\x5E\x92\x7A\x81\x5E"
    "\xD6\xB0\xE2\x62\x8F\x74\x26\xC2\x0C\xD3\x9A\x17\x47\xE6\x8E\xAB"
    - "\x02\x03\x01\x00\x01", /* public key - integer of 3 bytes */
    - .key_len = 269,
    + "\x02\x03\x01\x00\x01" /* public key - integer of 3 bytes */
    + "\x02\x01\x00", /* private key - integer of 1 byte */
    + .key_len = 272,
    .m = "\x54\x85\x9b\x34\x2c\x49\xea\x2a",
    .c =
    "\xb2\x97\x76\xb4\xae\x3e\x38\x3c\x7e\x64\x1f\xcc\xa2\x7f\xf6\xbe"
    diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
    index a46660204e3a..bbd472cadc98 100644
    --- a/drivers/ata/ahci.c
    +++ b/drivers/ata/ahci.c
    @@ -264,6 +264,26 @@ static const struct pci_device_id ahci_pci_tbl[] = {
    { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */
    { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */
    { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */
    + { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */
    + { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */
    { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */
    { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */
    { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
    diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
    index d256a66158be..317f85dfd39a 100644
    --- a/drivers/ata/libahci.c
    +++ b/drivers/ata/libahci.c
    @@ -495,8 +495,8 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
    }
    }

    - /* fabricate port_map from cap.nr_ports */
    - if (!port_map) {
    + /* fabricate port_map from cap.nr_ports for < AHCI 1.3 */
    + if (!port_map && vers < 0x10300) {
    port_map = (1 << ahci_nr_ports(cap)) - 1;
    dev_warn(dev, "forcing PORTS_IMPL to 0x%x\n", port_map);

    @@ -1266,6 +1266,15 @@ static int ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
    ata_tf_to_fis(tf, pmp, is_cmd, fis);
    ahci_fill_cmd_slot(pp, 0, cmd_fis_len | flags | (pmp << 12));

    + /* set port value for softreset of Port Multiplier */
    + if (pp->fbs_enabled && pp->fbs_last_dev != pmp) {
    + tmp = readl(port_mmio + PORT_FBS);
    + tmp &= ~(PORT_FBS_DEV_MASK | PORT_FBS_DEC);
    + tmp |= pmp << PORT_FBS_DEV_OFFSET;
    + writel(tmp, port_mmio + PORT_FBS);
    + pp->fbs_last_dev = pmp;
    + }
    +
    /* issue & wait */
    writel(1, port_mmio + PORT_CMD_ISSUE);

    diff --git a/drivers/base/memory.c b/drivers/base/memory.c
    index 2804aed3f416..25425d3f2575 100644
    --- a/drivers/base/memory.c
    +++ b/drivers/base/memory.c
    @@ -303,6 +303,10 @@ static int memory_subsys_offline(struct device *dev)
    if (mem->state == MEM_OFFLINE)
    return 0;

    + /* Can't offline block with non-present sections */
    + if (mem->section_count != sections_per_block)
    + return -EINVAL;
    +
    return memory_block_change_state(mem, MEM_OFFLINE, MEM_ONLINE);
    }

    diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c
    index 5cb13ca3a3ac..c53617752b93 100644
    --- a/drivers/block/zram/zcomp.c
    +++ b/drivers/block/zram/zcomp.c
    @@ -76,7 +76,7 @@ static void zcomp_strm_free(struct zcomp *comp, struct zcomp_strm *zstrm)
    */
    static struct zcomp_strm *zcomp_strm_alloc(struct zcomp *comp)
    {
    - struct zcomp_strm *zstrm = kmalloc(sizeof(*zstrm), GFP_KERNEL);
    + struct zcomp_strm *zstrm = kmalloc(sizeof(*zstrm), GFP_NOIO);
    if (!zstrm)
    return NULL;

    @@ -85,7 +85,7 @@ static struct zcomp_strm *zcomp_strm_alloc(struct zcomp *comp)
    * allocate 2 pages. 1 for compressed data, plus 1 extra for the
    * case when compressed size is larger than the original one
    */
    - zstrm->buffer = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 1);
    + zstrm->buffer = (void *)__get_free_pages(GFP_NOIO | __GFP_ZERO, 1);
    if (!zstrm->private || !zstrm->buffer) {
    zcomp_strm_free(comp, zstrm);
    zstrm = NULL;
    diff --git a/drivers/block/zram/zcomp_lz4.c b/drivers/block/zram/zcomp_lz4.c
    index f2afb7e988c3..dd6083124276 100644
    --- a/drivers/block/zram/zcomp_lz4.c
    +++ b/drivers/block/zram/zcomp_lz4.c
    @@ -10,17 +10,36 @@
    #include <linux/kernel.h>
    #include <linux/slab.h>
    #include <linux/lz4.h>
    +#include <linux/vmalloc.h>
    +#include <linux/mm.h>

    #include "zcomp_lz4.h"

    static void *zcomp_lz4_create(void)
    {
    - return kzalloc(LZ4_MEM_COMPRESS, GFP_KERNEL);
    + void *ret;
    +
    + /*
    + * This function can be called in swapout/fs write path
    + * so we can't use GFP_FS|IO. And it assumes we already
    + * have at least one stream in zram initialization so we
    + * don't do best effort to allocate more stream in here.
    + * A default stream will work well without further multiple
    + * streams. That's why we use NORETRY | NOWARN.
    + */
    + ret = kzalloc(LZ4_MEM_COMPRESS, GFP_NOIO | __GFP_NORETRY |
    + __GFP_NOWARN);
    + if (!ret)
    + ret = __vmalloc(LZ4_MEM_COMPRESS,
    + GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN |
    + __GFP_ZERO | __GFP_HIGHMEM,
    + PAGE_KERNEL);
    + return ret;
    }

    static void zcomp_lz4_destroy(void *private)
    {
    - kfree(private);
    + kvfree(private);
    }

    static int zcomp_lz4_compress(const unsigned char *src, unsigned char *dst,
    diff --git a/drivers/block/zram/zcomp_lzo.c b/drivers/block/zram/zcomp_lzo.c
    index da1bc47d588e..edc549920fa0 100644
    --- a/drivers/block/zram/zcomp_lzo.c
    +++ b/drivers/block/zram/zcomp_lzo.c
    @@ -10,17 +10,36 @@
    #include <linux/kernel.h>
    #include <linux/slab.h>
    #include <linux/lzo.h>
    +#include <linux/vmalloc.h>
    +#include <linux/mm.h>

    #include "zcomp_lzo.h"

    static void *lzo_create(void)
    {
    - return kzalloc(LZO1X_MEM_COMPRESS, GFP_KERNEL);
    + void *ret;
    +
    + /*
    + * This function can be called in swapout/fs write path
    + * so we can't use GFP_FS|IO. And it assumes we already
    + * have at least one stream in zram initialization so we
    + * don't do best effort to allocate more stream in here.
    + * A default stream will work well without further multiple
    + * streams. That's why we use NORETRY | NOWARN.
    + */
    + ret = kzalloc(LZO1X_MEM_COMPRESS, GFP_NOIO | __GFP_NORETRY |
    + __GFP_NOWARN);
    + if (!ret)
    + ret = __vmalloc(LZO1X_MEM_COMPRESS,
    + GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN |
    + __GFP_ZERO | __GFP_HIGHMEM,
    + PAGE_KERNEL);
    + return ret;
    }

    static void lzo_destroy(void *private)
    {
    - kfree(private);
    + kvfree(private);
    }

    static int lzo_compress(const unsigned char *src, unsigned char *dst,
    diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
    index 9fa15bb9d118..8022c0a96b36 100644
    --- a/drivers/block/zram/zram_drv.c
    +++ b/drivers/block/zram/zram_drv.c
    @@ -1324,7 +1324,6 @@ static int zram_remove(struct zram *zram)

    pr_info("Removed device: %s\n", zram->disk->disk_name);

    - idr_remove(&zram_index_idr, zram->disk->first_minor);
    blk_cleanup_queue(zram->disk->queue);
    del_gendisk(zram->disk);
    put_disk(zram->disk);
    @@ -1366,10 +1365,12 @@ static ssize_t hot_remove_store(struct class *class,
    mutex_lock(&zram_index_mutex);

    zram = idr_find(&zram_index_idr, dev_id);
    - if (zram)
    + if (zram) {
    ret = zram_remove(zram);
    - else
    + idr_remove(&zram_index_idr, dev_id);
    + } else {
    ret = -ENODEV;
    + }

    mutex_unlock(&zram_index_mutex);
    return ret ? ret : count;
    diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
    index 1082d4bb016a..0f8623d88b84 100644
    --- a/drivers/char/tpm/tpm-chip.c
    +++ b/drivers/char/tpm/tpm-chip.c
    @@ -231,7 +231,7 @@ int tpm_chip_register(struct tpm_chip *chip)

    /* Make the chip available. */
    spin_lock(&driver_lock);
    - list_add_rcu(&chip->list, &tpm_chip_list);
    + list_add_tail_rcu(&chip->list, &tpm_chip_list);
    spin_unlock(&driver_lock);

    chip->flags |= TPM_CHIP_FLAG_REGISTERED;
    diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
    index 2b971b3e5c1c..4bb9727c1047 100644
    --- a/drivers/char/tpm/tpm_crb.c
    +++ b/drivers/char/tpm/tpm_crb.c
    @@ -68,7 +68,8 @@ struct crb_control_area {
    u32 int_enable;
    u32 int_sts;
    u32 cmd_size;
    - u64 cmd_pa;
    + u32 cmd_pa_low;
    + u32 cmd_pa_high;
    u32 rsp_size;
    u64 rsp_pa;
    } __packed;
    @@ -263,8 +264,8 @@ static int crb_acpi_add(struct acpi_device *device)
    return -ENOMEM;
    }

    - memcpy_fromio(&pa, &priv->cca->cmd_pa, 8);
    - pa = le64_to_cpu(pa);
    + pa = ((u64) le32_to_cpu(ioread32(&priv->cca->cmd_pa_high)) << 32) |
    + (u64) le32_to_cpu(ioread32(&priv->cca->cmd_pa_low));
    priv->cmd = devm_ioremap_nocache(dev, pa,
    ioread32(&priv->cca->cmd_size));
    if (!priv->cmd) {
    diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
    index 27ebf9511cb4..3e6a22658b63 100644
    --- a/drivers/char/tpm/tpm_ibmvtpm.c
    +++ b/drivers/char/tpm/tpm_ibmvtpm.c
    @@ -491,7 +491,7 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,
    }
    ibmvtpm->rtce_size = be16_to_cpu(crq->len);
    ibmvtpm->rtce_buf = kmalloc(ibmvtpm->rtce_size,
    - GFP_KERNEL);
    + GFP_ATOMIC);
    if (!ibmvtpm->rtce_buf) {
    dev_err(ibmvtpm->dev, "Failed to allocate memory for rtce buffer\n");
    return;
    diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
    index 696ef1d56b4f..19f9c7dc7bc0 100644
    --- a/drivers/char/tpm/tpm_tis.c
    +++ b/drivers/char/tpm/tpm_tis.c
    @@ -805,6 +805,8 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info,
    iowrite32(intmask,
    chip->vendor.iobase +
    TPM_INT_ENABLE(chip->vendor.locality));
    +
    + devm_free_irq(dev, i, chip);
    }
    }
    if (chip->vendor.irq) {
    diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
    index 94433b9fc200..3b70354b0d4b 100644
    --- a/drivers/crypto/caam/caamhash.c
    +++ b/drivers/crypto/caam/caamhash.c
    @@ -829,7 +829,7 @@ static int ahash_update_ctx(struct ahash_request *req)
    state->buf_dma = try_buf_map_to_sec4_sg(jrdev,
    edesc->sec4_sg + 1,
    buf, state->buf_dma,
    - *next_buflen, *buflen);
    + *buflen, last_buflen);

    if (src_nents) {
    src_map_to_sec4_sg(jrdev, req->src, src_nents,
    diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
    index 8abb4bc548cc..69d4a1326fee 100644
    --- a/drivers/crypto/caam/ctrl.c
    +++ b/drivers/crypto/caam/ctrl.c
    @@ -534,8 +534,8 @@ static int caam_probe(struct platform_device *pdev)
    * long pointers in master configuration register
    */
    clrsetbits_32(&ctrl->mcr, MCFGR_AWCACHE_MASK, MCFGR_AWCACHE_CACH |
    - MCFGR_WDENABLE | (sizeof(dma_addr_t) == sizeof(u64) ?
    - MCFGR_LONG_PTR : 0));
    + MCFGR_AWCACHE_BUFF | MCFGR_WDENABLE |
    + (sizeof(dma_addr_t) == sizeof(u64) ? MCFGR_LONG_PTR : 0));

    /*
    * Read the Compile Time paramters and SCFGR to determine
    diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c
    index 0643e3366e33..c0656e7f37b5 100644
    --- a/drivers/crypto/marvell/cesa.c
    +++ b/drivers/crypto/marvell/cesa.c
    @@ -306,7 +306,7 @@ static int mv_cesa_dev_dma_init(struct mv_cesa_dev *cesa)
    return -ENOMEM;

    dma->padding_pool = dmam_pool_create("cesa_padding", dev, 72, 1, 0);
    - if (!dma->cache_pool)
    + if (!dma->padding_pool)
    return -ENOMEM;

    cesa->dma = dma;
    diff --git a/drivers/crypto/nx/nx-aes-ccm.c b/drivers/crypto/nx/nx-aes-ccm.c
    index 73ef49922788..7038f364acb5 100644
    --- a/drivers/crypto/nx/nx-aes-ccm.c
    +++ b/drivers/crypto/nx/nx-aes-ccm.c
    @@ -409,7 +409,7 @@ static int ccm_nx_decrypt(struct aead_request *req,
    processed += to_process;
    } while (processed < nbytes);

    - rc = memcmp(csbcpb->cpb.aes_ccm.out_pat_or_mac, priv->oauth_tag,
    + rc = crypto_memneq(csbcpb->cpb.aes_ccm.out_pat_or_mac, priv->oauth_tag,
    authsize) ? -EBADMSG : 0;
    out:
    spin_unlock_irqrestore(&nx_ctx->lock, irq_flags);
    diff --git a/drivers/crypto/nx/nx-aes-gcm.c b/drivers/crypto/nx/nx-aes-gcm.c
    index eee624f589b6..abd465f479c4 100644
    --- a/drivers/crypto/nx/nx-aes-gcm.c
    +++ b/drivers/crypto/nx/nx-aes-gcm.c
    @@ -21,6 +21,7 @@

    #include <crypto/internal/aead.h>
    #include <crypto/aes.h>
    +#include <crypto/algapi.h>
    #include <crypto/scatterwalk.h>
    #include <linux/module.h>
    #include <linux/types.h>
    @@ -418,7 +419,7 @@ mac:
    itag, req->src, req->assoclen + nbytes,
    crypto_aead_authsize(crypto_aead_reqtfm(req)),
    SCATTERWALK_FROM_SG);
    - rc = memcmp(itag, otag,
    + rc = crypto_memneq(itag, otag,
    crypto_aead_authsize(crypto_aead_reqtfm(req))) ?
    -EBADMSG : 0;
    }
    diff --git a/drivers/crypto/qat/qat_common/adf_ctl_drv.c b/drivers/crypto/qat/qat_common/adf_ctl_drv.c
    index cd8a12af8ec5..35bada05608a 100644
    --- a/drivers/crypto/qat/qat_common/adf_ctl_drv.c
    +++ b/drivers/crypto/qat/qat_common/adf_ctl_drv.c
    @@ -198,7 +198,7 @@ static int adf_copy_key_value_data(struct adf_accel_dev *accel_dev,
    goto out_err;
    }

    - params_head = section_head->params;
    + params_head = section.params;

    while (params_head) {
    if (copy_from_user(&key_val, (void __user *)params_head,
    diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-core.c b/drivers/crypto/sunxi-ss/sun4i-ss-core.c
    index eab6fe227fa0..107cd2a41cae 100644
    --- a/drivers/crypto/sunxi-ss/sun4i-ss-core.c
    +++ b/drivers/crypto/sunxi-ss/sun4i-ss-core.c
    @@ -39,6 +39,7 @@ static struct sun4i_ss_alg_template ss_algs[] = {
    .import = sun4i_hash_import_md5,
    .halg = {
    .digestsize = MD5_DIGEST_SIZE,
    + .statesize = sizeof(struct md5_state),
    .base = {
    .cra_name = "md5",
    .cra_driver_name = "md5-sun4i-ss",
    @@ -66,6 +67,7 @@ static struct sun4i_ss_alg_template ss_algs[] = {
    .import = sun4i_hash_import_sha1,
    .halg = {
    .digestsize = SHA1_DIGEST_SIZE,
    + .statesize = sizeof(struct sha1_state),
    .base = {
    .cra_name = "sha1",
    .cra_driver_name = "sha1-sun4i-ss",
    diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
    index 3b20a1bce703..8b327d89a8fc 100644
    --- a/drivers/crypto/talitos.c
    +++ b/drivers/crypto/talitos.c
    @@ -1015,7 +1015,7 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
    } else
    oicv = (char *)&edesc->link_tbl[0];

    - err = memcmp(oicv, icv, authsize) ? -EBADMSG : 0;
    + err = crypto_memneq(oicv, icv, authsize) ? -EBADMSG : 0;
    }

    kfree(edesc);
    diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c
    index 27a79c0c3888..d95eb8659d1b 100644
    --- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c
    +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c
    @@ -28,7 +28,7 @@
    void
    nvkm_pmu_pgob(struct nvkm_pmu *pmu, bool enable)
    {
    - if (pmu->func->pgob)
    + if (pmu && pmu->func->pgob)
    pmu->func->pgob(pmu, enable);
    }

    diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
    index 426b2f1a3450..33dfcea5fbc9 100644
    --- a/drivers/hid/hid-multitouch.c
    +++ b/drivers/hid/hid-multitouch.c
    @@ -309,6 +309,41 @@ static struct attribute_group mt_attribute_group = {
    .attrs = sysfs_attrs
    };

    +static void mt_get_feature(struct hid_device *hdev, struct hid_report *report)
    +{
    + struct mt_device *td = hid_get_drvdata(hdev);
    + int ret, size = hid_report_len(report);
    + u8 *buf;
    +
    + /*
    + * Only fetch the feature report if initial reports are not already
    + * been retrieved. Currently this is only done for Windows 8 touch
    + * devices.
    + */
    + if (!(hdev->quirks & HID_QUIRK_NO_INIT_REPORTS))
    + return;
    + if (td->mtclass.name != MT_CLS_WIN_8)
    + return;
    +
    + buf = hid_alloc_report_buf(report, GFP_KERNEL);
    + if (!buf)
    + return;
    +
    + ret = hid_hw_raw_request(hdev, report->id, buf, size,
    + HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
    + if (ret < 0) {
    + dev_warn(&hdev->dev, "failed to fetch feature %d\n",
    + report->id);
    + } else {
    + ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
    + size, 0);
    + if (ret)
    + dev_warn(&hdev->dev, "failed to report feature\n");
    + }
    +
    + kfree(buf);
    +}
    +
    static void mt_feature_mapping(struct hid_device *hdev,
    struct hid_field *field, struct hid_usage *usage)
    {
    @@ -322,11 +357,24 @@ static void mt_feature_mapping(struct hid_device *hdev,
    break;
    }

    - td->inputmode = field->report->id;
    - td->inputmode_index = usage->usage_index;
    + if (td->inputmode < 0) {
    + td->inputmode = field->report->id;
    + td->inputmode_index = usage->usage_index;
    + } else {
    + /*
    + * Some elan panels wrongly declare 2 input mode
    + * features, and silently ignore when we set the
    + * value in the second field. Skip the second feature
    + * and hope for the best.
    + */
    + dev_info(&hdev->dev,
    + "Ignoring the extra HID_DG_INPUTMODE\n");
    + }

    break;
    case HID_DG_CONTACTMAX:
    + mt_get_feature(hdev, field->report);
    +
    td->maxcontact_report_id = field->report->id;
    td->maxcontacts = field->value[0];
    if (!td->maxcontacts &&
    @@ -343,6 +391,7 @@ static void mt_feature_mapping(struct hid_device *hdev,
    break;
    }

    + mt_get_feature(hdev, field->report);
    if (field->value[usage->usage_index] == MT_BUTTONTYPE_CLICKPAD)
    td->is_buttonpad = true;

    @@ -1026,8 +1075,13 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
    * reports. Fortunately, the Win8 spec says that all touches
    * should be sent during each report, making the initialization
    * of input reports unnecessary.
    + *
    + * In addition some touchpads do not behave well if we read
    + * all feature reports from them. Instead we prevent
    + * initial report fetching and then selectively fetch each
    + * report we are interested in.
    */
    - hdev->quirks |= HID_QUIRK_NO_INIT_INPUT_REPORTS;
    + hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;

    td = devm_kzalloc(&hdev->dev, sizeof(struct mt_device), GFP_KERNEL);
    if (!td) {
    diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
    index 36712e9f56c2..5dd426fee8cc 100644
    --- a/drivers/hid/usbhid/hid-core.c
    +++ b/drivers/hid/usbhid/hid-core.c
    @@ -477,8 +477,6 @@ static void hid_ctrl(struct urb *urb)
    struct usbhid_device *usbhid = hid->driver_data;
    int unplug = 0, status = urb->status;

    - spin_lock(&usbhid->lock);
    -
    switch (status) {
    case 0: /* success */
    if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN)
    @@ -498,6 +496,8 @@ static void hid_ctrl(struct urb *urb)
    hid_warn(urb->dev, "ctrl urb status %d received\n", status);
    }

    + spin_lock(&usbhid->lock);
    +
    if (unplug) {
    usbhid->ctrltail = usbhid->ctrlhead;
    } else {
    diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
    index 1c758cd1e1ba..10835d1f559b 100644
    --- a/drivers/i2c/busses/i2c-at91.c
    +++ b/drivers/i2c/busses/i2c-at91.c
    @@ -347,8 +347,14 @@ error:

    static void at91_twi_read_next_byte(struct at91_twi_dev *dev)
    {
    - if (!dev->buf_len)
    + /*
    + * If we are in this case, it means there is garbage data in RHR, so
    + * delete them.
    + */
    + if (!dev->buf_len) {
    + at91_twi_read(dev, AT91_TWI_RHR);
    return;
    + }

    /* 8bit read works with and without FIFO */
    *dev->buf = readb_relaxed(dev->base + AT91_TWI_RHR);
    @@ -465,19 +471,73 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id)

    if (!irqstatus)
    return IRQ_NONE;
    - else if (irqstatus & AT91_TWI_RXRDY)
    + /*
    + * In reception, the behavior of the twi device (before sama5d2) is
    + * weird. There is some magic about RXRDY flag! When a data has been
    + * almost received, the reception of a new one is anticipated if there
    + * is no stop command to send. That is the reason why ask for sending
    + * the stop command not on the last data but on the second last one.
    + *
    + * Unfortunately, we could still have the RXRDY flag set even if the
    + * transfer is done and we have read the last data. It might happen
    + * when the i2c slave device sends too quickly data after receiving the
    + * ack from the master. The data has been almost received before having
    + * the order to send stop. In this case, sending the stop command could
    + * cause a RXRDY interrupt with a TXCOMP one. It is better to manage
    + * the RXRDY interrupt first in order to not keep garbage data in the
    + * Receive Holding Register for the next transfer.
    + */
    + if (irqstatus & AT91_TWI_RXRDY)
    at91_twi_read_next_byte(dev);
    - else if (irqstatus & AT91_TWI_TXRDY)
    - at91_twi_write_next_byte(dev);
    -
    - /* catch error flags */
    - dev->transfer_status |= status;

    + /*
    + * When a NACK condition is detected, the I2C controller sets the NACK,
    + * TXCOMP and TXRDY bits all together in the Status Register (SR).
    + *
    + * 1 - Handling NACK errors with CPU write transfer.
    + *
    + * In such case, we should not write the next byte into the Transmit
    + * Holding Register (THR) otherwise the I2C controller would start a new
    + * transfer and the I2C slave is likely to reply by another NACK.
    + *
    + * 2 - Handling NACK errors with DMA write transfer.
    + *
    + * By setting the TXRDY bit in the SR, the I2C controller also triggers
    + * the DMA controller to write the next data into the THR. Then the
    + * result depends on the hardware version of the I2C controller.
    + *
    + * 2a - Without support of the Alternative Command mode.
    + *
    + * This is the worst case: the DMA controller is triggered to write the
    + * next data into the THR, hence starting a new transfer: the I2C slave
    + * is likely to reply by another NACK.
    + * Concurrently, this interrupt handler is likely to be called to manage
    + * the first NACK before the I2C controller detects the second NACK and
    + * sets once again the NACK bit into the SR.
    + * When handling the first NACK, this interrupt handler disables the I2C
    + * controller interruptions, especially the NACK interrupt.
    + * Hence, the NACK bit is pending into the SR. This is why we should
    + * read the SR to clear all pending interrupts at the beginning of
    + * at91_do_twi_transfer() before actually starting a new transfer.
    + *
    + * 2b - With support of the Alternative Command mode.
    + *
    + * When a NACK condition is detected, the I2C controller also locks the
    + * THR (and sets the LOCK bit in the SR): even though the DMA controller
    + * is triggered by the TXRDY bit to write the next data into the THR,
    + * this data actually won't go on the I2C bus hence a second NACK is not
    + * generated.
    + */
    if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
    at91_disable_twi_interrupts(dev);
    complete(&dev->cmd_complete);
    + } else if (irqstatus & AT91_TWI_TXRDY) {
    + at91_twi_write_next_byte(dev);
    }

    + /* catch error flags */
    + dev->transfer_status |= status;
    +
    return IRQ_HANDLED;
    }

    @@ -537,6 +597,9 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
    reinit_completion(&dev->cmd_complete);
    dev->transfer_status = 0;

    + /* Clear pending interrupts, such as NACK. */
    + at91_twi_read(dev, AT91_TWI_SR);
    +
    if (dev->fifo_size) {
    unsigned fifo_mr = at91_twi_read(dev, AT91_TWI_FMR);

    @@ -558,11 +621,6 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
    } else if (dev->msg->flags & I2C_M_RD) {
    unsigned start_flags = AT91_TWI_START;

    - if (at91_twi_read(dev, AT91_TWI_SR) & AT91_TWI_RXRDY) {
    - dev_err(dev->dev, "RXRDY still set!");
    - at91_twi_read(dev, AT91_TWI_RHR);
    - }
    -
    /* if only one byte is to be read, immediately stop transfer */
    if (!has_alt_cmd && dev->buf_len <= 1 &&
    !(dev->msg->flags & I2C_M_RECV_LEN))
    diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
    index 5801227b97ab..43207f52e5a3 100644
    --- a/drivers/i2c/busses/i2c-mv64xxx.c
    +++ b/drivers/i2c/busses/i2c-mv64xxx.c
    @@ -146,6 +146,8 @@ struct mv64xxx_i2c_data {
    bool errata_delay;
    struct reset_control *rstc;
    bool irq_clear_inverted;
    + /* Clk div is 2 to the power n, not 2 to the power n + 1 */
    + bool clk_n_base_0;
    };

    static struct mv64xxx_i2c_regs mv64xxx_i2c_regs_mv64xxx = {
    @@ -757,25 +759,29 @@ MODULE_DEVICE_TABLE(of, mv64xxx_i2c_of_match_table);
    #ifdef CONFIG_OF
    #ifdef CONFIG_HAVE_CLK
    static int
    -mv64xxx_calc_freq(const int tclk, const int n, const int m)
    +mv64xxx_calc_freq(struct mv64xxx_i2c_data *drv_data,
    + const int tclk, const int n, const int m)
    {
    - return tclk / (10 * (m + 1) * (2 << n));
    + if (drv_data->clk_n_base_0)
    + return tclk / (10 * (m + 1) * (1 << n));
    + else
    + return tclk / (10 * (m + 1) * (2 << n));
    }

    static bool
    -mv64xxx_find_baud_factors(const u32 req_freq, const u32 tclk, u32 *best_n,
    - u32 *best_m)
    +mv64xxx_find_baud_factors(struct mv64xxx_i2c_data *drv_data,
    + const u32 req_freq, const u32 tclk)
    {
    int freq, delta, best_delta = INT_MAX;
    int m, n;

    for (n = 0; n <= 7; n++)
    for (m = 0; m <= 15; m++) {
    - freq = mv64xxx_calc_freq(tclk, n, m);
    + freq = mv64xxx_calc_freq(drv_data, tclk, n, m);
    delta = req_freq - freq;
    if (delta >= 0 && delta < best_delta) {
    - *best_m = m;
    - *best_n = n;
    + drv_data->freq_m = m;
    + drv_data->freq_n = n;
    best_delta = delta;
    }
    if (best_delta == 0)
    @@ -813,8 +819,11 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
    if (of_property_read_u32(np, "clock-frequency", &bus_freq))
    bus_freq = 100000; /* 100kHz by default */

    - if (!mv64xxx_find_baud_factors(bus_freq, tclk,
    - &drv_data->freq_n, &drv_data->freq_m)) {
    + if (of_device_is_compatible(np, "allwinner,sun4i-a10-i2c") ||
    + of_device_is_compatible(np, "allwinner,sun6i-a31-i2c"))
    + drv_data->clk_n_base_0 = true;
    +
    + if (!mv64xxx_find_baud_factors(drv_data, bus_freq, tclk)) {
    rc = -EINVAL;
    goto out;
    }
    diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
    index d8b5a8fee1e6..3191dd9984dc 100644
    --- a/drivers/i2c/busses/i2c-rcar.c
    +++ b/drivers/i2c/busses/i2c-rcar.c
    @@ -575,7 +575,7 @@ static int rcar_reg_slave(struct i2c_client *slave)
    if (slave->flags & I2C_CLIENT_TEN)
    return -EAFNOSUPPORT;

    - pm_runtime_forbid(rcar_i2c_priv_to_dev(priv));
    + pm_runtime_get_sync(rcar_i2c_priv_to_dev(priv));

    priv->slave = slave;
    rcar_i2c_write(priv, ICSAR, slave->addr);
    @@ -597,7 +597,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)

    priv->slave = NULL;

    - pm_runtime_allow(rcar_i2c_priv_to_dev(priv));
    + pm_runtime_put(rcar_i2c_priv_to_dev(priv));

    return 0;
    }
    diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
    index 72e97e306bd9..9c4efd308f10 100644
    --- a/drivers/i2c/busses/i2c-rk3x.c
    +++ b/drivers/i2c/busses/i2c-rk3x.c
    @@ -907,7 +907,7 @@ static int rk3x_i2c_probe(struct platform_device *pdev)
    &i2c->scl_fall_ns))
    i2c->scl_fall_ns = 300;
    if (of_property_read_u32(pdev->dev.of_node, "i2c-sda-falling-time-ns",
    - &i2c->scl_fall_ns))
    + &i2c->sda_fall_ns))
    i2c->sda_fall_ns = i2c->scl_fall_ns;

    strlcpy(i2c->adap.name, "rk3x-i2c", sizeof(i2c->adap.name));
    diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
    index a59c3111f7fb..a4347ba78a51 100644
    --- a/drivers/i2c/i2c-core.c
    +++ b/drivers/i2c/i2c-core.c
    @@ -679,7 +679,7 @@ static int i2c_device_probe(struct device *dev)
    if (wakeirq > 0 && wakeirq != client->irq)
    status = dev_pm_set_dedicated_wake_irq(dev, wakeirq);
    else if (client->irq > 0)
    - status = dev_pm_set_wake_irq(dev, wakeirq);
    + status = dev_pm_set_wake_irq(dev, client->irq);
    else
    status = 0;

    diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
    index 7df97777662d..dad768caa9c5 100644
    --- a/drivers/iommu/io-pgtable-arm.c
    +++ b/drivers/iommu/io-pgtable-arm.c
    @@ -405,17 +405,18 @@ static void __arm_lpae_free_pgtable(struct arm_lpae_io_pgtable *data, int lvl,
    arm_lpae_iopte *start, *end;
    unsigned long table_size;

    - /* Only leaf entries at the last level */
    - if (lvl == ARM_LPAE_MAX_LEVELS - 1)
    - return;
    -
    if (lvl == ARM_LPAE_START_LVL(data))
    table_size = data->pgd_size;
    else
    table_size = 1UL << data->pg_shift;

    start = ptep;
    - end = (void *)ptep + table_size;
    +
    + /* Only leaf entries at the last level */
    + if (lvl == ARM_LPAE_MAX_LEVELS - 1)
    + end = ptep;
    + else
    + end = (void *)ptep + table_size;

    while (ptep != end) {
    arm_lpae_iopte pte = *ptep++;
    diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
    index 5a67671a3973..bdc96cd838b8 100644
    --- a/drivers/md/dm-mpath.c
    +++ b/drivers/md/dm-mpath.c
    @@ -1569,11 +1569,8 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
    /*
    * Only pass ioctls through if the device sizes match exactly.
    */
    - if (!bdev || ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) {
    - int err = scsi_verify_blk_ioctl(NULL, cmd);
    - if (err)
    - r = err;
    - }
    + if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
    + r = scsi_verify_blk_ioctl(NULL, cmd);

    if (r == -ENOTCONN && !fatal_signal_pending(current)) {
    spin_lock_irqsave(&m->lock, flags);
    diff --git a/drivers/md/dm.c b/drivers/md/dm.c
    index 1b5c6047e4f1..8af4750f20bf 100644
    --- a/drivers/md/dm.c
    +++ b/drivers/md/dm.c
    @@ -2198,6 +2198,13 @@ static void dm_init_md_queue(struct mapped_device *md)
    * This queue is new, so no concurrency on the queue_flags.
    */
    queue_flag_clear_unlocked(QUEUE_FLAG_STACKABLE, md->queue);
    +
    + /*
    + * Initialize data that will only be used by a non-blk-mq DM queue
    + * - must do so here (in alloc_dev callchain) before queue is used
    + */
    + md->queue->queuedata = md;
    + md->queue->backing_dev_info.congested_data = md;
    }

    static void dm_init_old_md_queue(struct mapped_device *md)
    @@ -2208,10 +2215,7 @@ static void dm_init_old_md_queue(struct mapped_device *md)
    /*
    * Initialize aspects of queue that aren't relevant for blk-mq
    */
    - md->queue->queuedata = md;
    md->queue->backing_dev_info.congested_fn = dm_any_congested;
    - md->queue->backing_dev_info.congested_data = md;
    -
    blk_queue_bounce_limit(md->queue, BLK_BOUNCE_ANY);
    }

    diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
    index 0e09aef43998..88c287db3bde 100644
    --- a/drivers/md/persistent-data/dm-btree.c
    +++ b/drivers/md/persistent-data/dm-btree.c
    @@ -471,8 +471,10 @@ static int btree_split_sibling(struct shadow_spine *s, unsigned parent_index,

    r = insert_at(sizeof(__le64), pn, parent_index + 1,
    le64_to_cpu(rn->keys[0]), &location);
    - if (r)
    + if (r) {
    + unlock_block(s->info, right);
    return r;
    + }

    if (key < le64_to_cpu(rn->keys[0])) {
    unlock_block(s->info, right);
    diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
    index 96f365968306..23bbe61f9ac0 100644
    --- a/drivers/md/raid10.c
    +++ b/drivers/md/raid10.c
    @@ -1944,6 +1944,8 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)

    first = i;
    fbio = r10_bio->devs[i].bio;
    + fbio->bi_iter.bi_size = r10_bio->sectors << 9;
    + fbio->bi_iter.bi_idx = 0;

    vcnt = (r10_bio->sectors + (PAGE_SIZE >> 9) - 1) >> (PAGE_SHIFT - 9);
    /* now find blocks with errors */
    @@ -1987,7 +1989,7 @@ static void sync_request_write(struct mddev *mddev, struct r10bio *r10_bio)
    bio_reset(tbio);

    tbio->bi_vcnt = vcnt;
    - tbio->bi_iter.bi_size = r10_bio->sectors << 9;
    + tbio->bi_iter.bi_size = fbio->bi_iter.bi_size;
    tbio->bi_rw = WRITE;
    tbio->bi_private = r10_bio;
    tbio->bi_iter.bi_sector = r10_bio->devs[i].addr;
    diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
    index 728d2cc8a3e7..175a76114953 100644
    --- a/drivers/media/i2c/ir-kbd-i2c.c
    +++ b/drivers/media/i2c/ir-kbd-i2c.c
    @@ -478,7 +478,6 @@ static const struct i2c_device_id ir_kbd_id[] = {
    { "ir_rx_z8f0811_hdpvr", 0 },
    { }
    };
    -MODULE_DEVICE_TABLE(i2c, ir_kbd_id);

    static struct i2c_driver ir_kbd_driver = {
    .driver = {
    diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
    index 8616fa8193bc..c2e60b4f292d 100644
    --- a/drivers/media/pci/ivtv/ivtv-driver.c
    +++ b/drivers/media/pci/ivtv/ivtv-driver.c
    @@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivtv *itv)
    {
    int i;

    - for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS - 1; i++)
    + for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS; i++)
    if (itv->card->video_inputs[i].video_type == 0)
    break;
    itv->nof_inputs = i;
    - for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS - 1; i++)
    + for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS; i++)
    if (itv->card->audio_inputs[i].audio_type == 0)
    break;
    itv->nof_audio_inputs = i;
    diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c
    index 1d2c310ce838..94f816244407 100644
    --- a/drivers/media/pci/saa7134/saa7134-alsa.c
    +++ b/drivers/media/pci/saa7134/saa7134-alsa.c
    @@ -1211,6 +1211,8 @@ static int alsa_device_init(struct saa7134_dev *dev)

    static int alsa_device_exit(struct saa7134_dev *dev)
    {
    + if (!snd_saa7134_cards[dev->nr])
    + return 1;

    snd_card_free(snd_saa7134_cards[dev->nr]);
    snd_saa7134_cards[dev->nr] = NULL;
    @@ -1260,7 +1262,8 @@ static void saa7134_alsa_exit(void)
    int idx;

    for (idx = 0; idx < SNDRV_CARDS; idx++) {
    - snd_card_free(snd_saa7134_cards[idx]);
    + if (snd_saa7134_cards[idx])
    + snd_card_free(snd_saa7134_cards[idx]);
    }

    saa7134_dmasound_init = NULL;
    diff --git a/drivers/media/platform/sti/c8sectpfe/Kconfig b/drivers/media/platform/sti/c8sectpfe/Kconfig
    index 641ad8f34956..7420a50572d3 100644
    --- a/drivers/media/platform/sti/c8sectpfe/Kconfig
    +++ b/drivers/media/platform/sti/c8sectpfe/Kconfig
    @@ -3,7 +3,6 @@ config DVB_C8SECTPFE
    depends on PINCTRL && DVB_CORE && I2C
    depends on ARCH_STI || ARCH_MULTIPLATFORM || COMPILE_TEST
    select FW_LOADER
    - select FW_LOADER_USER_HELPER_FALLBACK
    select DEBUG_FS
    select DVB_LNBP21 if MEDIA_SUBDRV_AUTOSELECT
    select DVB_STV090x if MEDIA_SUBDRV_AUTOSELECT
    diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
    index a047b4716741..0f5e9143cc7e 100644
    --- a/drivers/media/platform/vivid/vivid-core.c
    +++ b/drivers/media/platform/vivid/vivid-core.c
    @@ -1341,8 +1341,11 @@ static int vivid_remove(struct platform_device *pdev)
    struct vivid_dev *dev;
    unsigned i;

    - for (i = 0; vivid_devs[i]; i++) {
    +
    + for (i = 0; i < n_devs; i++) {
    dev = vivid_devs[i];
    + if (!dev)
    + continue;

    if (dev->has_vid_cap) {
    v4l2_info(&dev->v4l2_dev, "unregistering %s\n",
    diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    index af635430524e..788b31c91330 100644
    --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
    @@ -266,7 +266,7 @@ static int put_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_

    struct v4l2_standard32 {
    __u32 index;
    - __u32 id[2]; /* __u64 would get the alignment wrong */
    + compat_u64 id;
    __u8 name[24];
    struct v4l2_fract frameperiod; /* Frames, not fields */
    __u32 framelines;
    @@ -286,7 +286,7 @@ static int put_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32
    {
    if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard32)) ||
    put_user(kp->index, &up->index) ||
    - copy_to_user(up->id, &kp->id, sizeof(__u64)) ||
    + put_user(kp->id, &up->id) ||
    copy_to_user(up->name, kp->name, 24) ||
    copy_to_user(&up->frameperiod, &kp->frameperiod, sizeof(kp->frameperiod)) ||
    put_user(kp->framelines, &up->framelines) ||
    @@ -587,10 +587,10 @@ struct v4l2_input32 {
    __u32 type; /* Type of input */
    __u32 audioset; /* Associated audios (bitfield) */
    __u32 tuner; /* Associated tuner */
    - v4l2_std_id std;
    + compat_u64 std;
    __u32 status;
    __u32 reserved[4];
    -} __attribute__ ((packed));
    +};

    /* The 64-bit v4l2_input struct has extra padding at the end of the struct.
    Otherwise it is identical to the 32-bit version. */
    @@ -738,6 +738,7 @@ static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
    struct v4l2_event32 {
    __u32 type;
    union {
    + compat_s64 value64;
    __u8 data[64];
    } u;
    __u32 pending;
    diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
    index b6b7dcc1b77d..e1e70b8694a8 100644
    --- a/drivers/media/v4l2-core/v4l2-ctrls.c
    +++ b/drivers/media/v4l2-core/v4l2-ctrls.c
    @@ -2498,7 +2498,7 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctr
    /* We found a control with the given ID, so just get
    the next valid one in the list. */
    list_for_each_entry_continue(ref, &hdl->ctrl_refs, node) {
    - is_compound =
    + is_compound = ref->ctrl->is_array ||
    ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
    if (id < ref->ctrl->id &&
    (is_compound & mask) == match)
    @@ -2512,7 +2512,7 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctr
    is one, otherwise the first 'if' above would have
    been true. */
    list_for_each_entry(ref, &hdl->ctrl_refs, node) {
    - is_compound =
    + is_compound = ref->ctrl->is_array ||
    ref->ctrl->type >= V4L2_CTRL_COMPOUND_TYPES;
    if (id < ref->ctrl->id &&
    (is_compound & mask) == match)
    @@ -2884,7 +2884,7 @@ static int get_ctrl(struct v4l2_ctrl *ctrl, struct v4l2_ext_control *c)
    * cur_to_user() calls below would need to be modified not to access
    * userspace memory when called from get_ctrl().
    */
    - if (!ctrl->is_int)
    + if (!ctrl->is_int && ctrl->type != V4L2_CTRL_TYPE_INTEGER64)
    return -EINVAL;

    if (ctrl->flags & V4L2_CTRL_FLAG_WRITE_ONLY)
    @@ -2942,9 +2942,9 @@ s64 v4l2_ctrl_g_ctrl_int64(struct v4l2_ctrl *ctrl)

    /* It's a driver bug if this happens. */
    WARN_ON(ctrl->is_ptr || ctrl->type != V4L2_CTRL_TYPE_INTEGER64);
    - c.value = 0;
    + c.value64 = 0;
    get_ctrl(ctrl, &c);
    - return c.value;
    + return c.value64;
    }
    EXPORT_SYMBOL(v4l2_ctrl_g_ctrl_int64);

    @@ -3043,7 +3043,7 @@ static void update_from_auto_cluster(struct v4l2_ctrl *master)
    {
    int i;

    - for (i = 0; i < master->ncontrols; i++)
    + for (i = 1; i < master->ncontrols; i++)
    cur_to_new(master->cluster[i]);
    if (!call_op(master, g_volatile_ctrl))
    for (i = 1; i < master->ncontrols; i++)
    diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
    index 2397ceb1dc6b..f42e66624734 100644
    --- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
    +++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
    @@ -100,7 +100,8 @@ static void vb2_dc_prepare(void *buf_priv)
    if (!sgt || buf->db_attach)
    return;

    - dma_sync_sg_for_device(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir);
    + dma_sync_sg_for_device(buf->dev, sgt->sgl, sgt->orig_nents,
    + buf->dma_dir);
    }

    static void vb2_dc_finish(void *buf_priv)
    @@ -112,7 +113,7 @@ static void vb2_dc_finish(void *buf_priv)
    if (!sgt || buf->db_attach)
    return;

    - dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir);
    + dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir);
    }

    /*********************************************/
    diff --git a/drivers/media/v4l2-core/videobuf2-dma-sg.c b/drivers/media/v4l2-core/videobuf2-dma-sg.c
    index be7bd6535c9d..07bd2605c2b1 100644
    --- a/drivers/media/v4l2-core/videobuf2-dma-sg.c
    +++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c
    @@ -210,7 +210,8 @@ static void vb2_dma_sg_prepare(void *buf_priv)
    if (buf->db_attach)
    return;

    - dma_sync_sg_for_device(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir);
    + dma_sync_sg_for_device(buf->dev, sgt->sgl, sgt->orig_nents,
    + buf->dma_dir);
    }

    static void vb2_dma_sg_finish(void *buf_priv)
    @@ -222,7 +223,7 @@ static void vb2_dma_sg_finish(void *buf_priv)
    if (buf->db_attach)
    return;

    - dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->nents, buf->dma_dir);
    + dma_sync_sg_for_cpu(buf->dev, sgt->sgl, sgt->orig_nents, buf->dma_dir);
    }

    static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
    diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
    index 44dc965a2f7c..e7a02ed9fba8 100644
    --- a/drivers/mtd/mtd_blkdevs.c
    +++ b/drivers/mtd/mtd_blkdevs.c
    @@ -192,8 +192,8 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
    if (!dev)
    return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/

    - mutex_lock(&dev->lock);
    mutex_lock(&mtd_table_mutex);
    + mutex_lock(&dev->lock);

    if (dev->open)
    goto unlock;
    @@ -217,8 +217,8 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)

    unlock:
    dev->open++;
    - mutex_unlock(&mtd_table_mutex);
    mutex_unlock(&dev->lock);
    + mutex_unlock(&mtd_table_mutex);
    blktrans_dev_put(dev);
    return ret;

    @@ -228,8 +228,8 @@ error_release:
    error_put:
    module_put(dev->tr->owner);
    kref_put(&dev->ref, blktrans_dev_release);
    - mutex_unlock(&mtd_table_mutex);
    mutex_unlock(&dev->lock);
    + mutex_unlock(&mtd_table_mutex);
    blktrans_dev_put(dev);
    return ret;
    }
    @@ -241,8 +241,8 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
    if (!dev)
    return;

    - mutex_lock(&dev->lock);
    mutex_lock(&mtd_table_mutex);
    + mutex_lock(&dev->lock);

    if (--dev->open)
    goto unlock;
    @@ -256,8 +256,8 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
    __put_mtd_device(dev->mtd);
    }
    unlock:
    - mutex_unlock(&mtd_table_mutex);
    mutex_unlock(&dev->lock);
    + mutex_unlock(&mtd_table_mutex);
    blktrans_dev_put(dev);
    }

    diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
    index cafdb8855a79..919a936abc42 100644
    --- a/drivers/mtd/mtdpart.c
    +++ b/drivers/mtd/mtdpart.c
    @@ -664,8 +664,10 @@ int add_mtd_partitions(struct mtd_info *master,

    for (i = 0; i < nbparts; i++) {
    slave = allocate_partition(master, parts + i, i, cur_offset);
    - if (IS_ERR(slave))
    + if (IS_ERR(slave)) {
    + del_mtd_partitions(master);
    return PTR_ERR(slave);
    + }

    mutex_lock(&mtd_partitions_mutex);
    list_add(&slave->list, &mtd_partitions);
    diff --git a/drivers/mtd/nand/jz4740_nand.c b/drivers/mtd/nand/jz4740_nand.c
    index ebf2cce04cba..ca3270b1299c 100644
    --- a/drivers/mtd/nand/jz4740_nand.c
    +++ b/drivers/mtd/nand/jz4740_nand.c
    @@ -25,6 +25,7 @@

    #include <linux/gpio.h>

    +#include <asm/mach-jz4740/gpio.h>
    #include <asm/mach-jz4740/jz4740_nand.h>

    #define JZ_REG_NAND_CTRL 0x50
    diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
    index ceb68ca8277a..066f967e03b1 100644
    --- a/drivers/mtd/nand/nand_base.c
    +++ b/drivers/mtd/nand/nand_base.c
    @@ -2964,7 +2964,7 @@ static void nand_resume(struct mtd_info *mtd)
    */
    static void nand_shutdown(struct mtd_info *mtd)
    {
    - nand_get_device(mtd, FL_SHUTDOWN);
    + nand_get_device(mtd, FL_PM_SUSPENDED);
    }

    /* Set default functions */
    diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
    index eb4489f9082f..56065632a5b8 100644
    --- a/drivers/mtd/ubi/wl.c
    +++ b/drivers/mtd/ubi/wl.c
    @@ -603,6 +603,7 @@ static int schedule_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
    return 0;
    }

    +static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk);
    /**
    * do_sync_erase - run the erase worker synchronously.
    * @ubi: UBI device description object
    @@ -615,20 +616,16 @@ static int schedule_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
    static int do_sync_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
    int vol_id, int lnum, int torture)
    {
    - struct ubi_work *wl_wrk;
    + struct ubi_work wl_wrk;

    dbg_wl("sync erase of PEB %i", e->pnum);

    - wl_wrk = kmalloc(sizeof(struct ubi_work), GFP_NOFS);
    - if (!wl_wrk)
    - return -ENOMEM;
    -
    - wl_wrk->e = e;
    - wl_wrk->vol_id = vol_id;
    - wl_wrk->lnum = lnum;
    - wl_wrk->torture = torture;
    + wl_wrk.e = e;
    + wl_wrk.vol_id = vol_id;
    + wl_wrk.lnum = lnum;
    + wl_wrk.torture = torture;

    - return erase_worker(ubi, wl_wrk, 0);
    + return __erase_worker(ubi, &wl_wrk);
    }

    /**
    @@ -1014,7 +1011,7 @@ out_unlock:
    }

    /**
    - * erase_worker - physical eraseblock erase worker function.
    + * __erase_worker - physical eraseblock erase worker function.
    * @ubi: UBI device description object
    * @wl_wrk: the work object
    * @shutdown: non-zero if the worker has to free memory and exit
    @@ -1025,8 +1022,7 @@ out_unlock:
    * needed. Returns zero in case of success and a negative error code in case of
    * failure.
    */
    -static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
    - int shutdown)
    +static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
    {
    struct ubi_wl_entry *e = wl_wrk->e;
    int pnum = e->pnum;
    @@ -1034,21 +1030,11 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
    int lnum = wl_wrk->lnum;
    int err, available_consumed = 0;

    - if (shutdown) {
    - dbg_wl("cancel erasure of PEB %d EC %d", pnum, e->ec);
    - kfree(wl_wrk);
    - wl_entry_destroy(ubi, e);
    - return 0;
    - }
    -
    dbg_wl("erase PEB %d EC %d LEB %d:%d",
    pnum, e->ec, wl_wrk->vol_id, wl_wrk->lnum);

    err = sync_erase(ubi, e, wl_wrk->torture);
    if (!err) {
    - /* Fine, we've erased it successfully */
    - kfree(wl_wrk);
    -
    spin_lock(&ubi->wl_lock);
    wl_tree_add(e, &ubi->free);
    ubi->free_count++;
    @@ -1066,7 +1052,6 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
    }

    ubi_err(ubi, "failed to erase PEB %d, error %d", pnum, err);
    - kfree(wl_wrk);

    if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
    err == -EBUSY) {
    @@ -1075,6 +1060,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
    /* Re-schedule the LEB for erasure */
    err1 = schedule_erase(ubi, e, vol_id, lnum, 0);
    if (err1) {
    + wl_entry_destroy(ubi, e);
    err = err1;
    goto out_ro;
    }
    @@ -1150,6 +1136,25 @@ out_ro:
    return err;
    }

    +static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
    + int shutdown)
    +{
    + int ret;
    +
    + if (shutdown) {
    + struct ubi_wl_entry *e = wl_wrk->e;
    +
    + dbg_wl("cancel erasure of PEB %d EC %d", e->pnum, e->ec);
    + kfree(wl_wrk);
    + wl_entry_destroy(ubi, e);
    + return 0;
    + }
    +
    + ret = __erase_worker(ubi, wl_wrk);
    + kfree(wl_wrk);
    + return ret;
    +}
    +
    /**
    * ubi_wl_put_peb - return a PEB to the wear-leveling sub-system.
    * @ubi: UBI device description object
    diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
    index 6e9418ed90c2..bbb789f8990b 100644
    --- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
    +++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
    @@ -2272,7 +2272,7 @@ void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
    struct rtl_priv *rtlpriv = rtl_priv(hw);
    struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));

    - if (!rtlpci->int_clear)
    + if (rtlpci->int_clear)
    rtl8821ae_clear_interrupt(hw);/*clear it here first*/

    rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
    diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
    index 8ee141a55bc5..142bdff4ed60 100644
    --- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
    +++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
    @@ -448,7 +448,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
    MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n");
    MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
    MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n");
    -MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n");
    +MODULE_PARM_DESC(int_clear, "Set to 0 to disable interrupt clear before set (default 1)\n");

    static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);

    diff --git a/drivers/net/wireless/ti/wlcore/io.h b/drivers/net/wireless/ti/wlcore/io.h
    index 0305729d0986..10cf3747694d 100644
    --- a/drivers/net/wireless/ti/wlcore/io.h
    +++ b/drivers/net/wireless/ti/wlcore/io.h
    @@ -207,19 +207,23 @@ static inline int __must_check wlcore_write_reg(struct wl1271 *wl, int reg,

    static inline void wl1271_power_off(struct wl1271 *wl)
    {
    - int ret;
    + int ret = 0;

    if (!test_bit(WL1271_FLAG_GPIO_POWER, &wl->flags))
    return;

    - ret = wl->if_ops->power(wl->dev, false);
    + if (wl->if_ops->power)
    + ret = wl->if_ops->power(wl->dev, false);
    if (!ret)
    clear_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);
    }

    static inline int wl1271_power_on(struct wl1271 *wl)
    {
    - int ret = wl->if_ops->power(wl->dev, true);
    + int ret = 0;
    +
    + if (wl->if_ops->power)
    + ret = wl->if_ops->power(wl->dev, true);
    if (ret == 0)
    set_bit(WL1271_FLAG_GPIO_POWER, &wl->flags);

    diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
    index f1ac2839d97c..720e4e4b5a3c 100644
    --- a/drivers/net/wireless/ti/wlcore/spi.c
    +++ b/drivers/net/wireless/ti/wlcore/spi.c
    @@ -73,7 +73,10 @@
    */
    #define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE)

    -#define WSPI_MAX_NUM_OF_CHUNKS (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE)
    +/* Maximum number of SPI write chunks */
    +#define WSPI_MAX_NUM_OF_CHUNKS \
    + ((SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1)
    +

    struct wl12xx_spi_glue {
    struct device *dev;
    @@ -268,9 +271,10 @@ static int __must_check wl12xx_spi_raw_write(struct device *child, int addr,
    void *buf, size_t len, bool fixed)
    {
    struct wl12xx_spi_glue *glue = dev_get_drvdata(child->parent);
    - struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)];
    + /* SPI write buffers - 2 for each chunk */
    + struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS];
    struct spi_message m;
    - u32 commands[WSPI_MAX_NUM_OF_CHUNKS];
    + u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; /* 1 command per chunk */
    u32 *cmd;
    u32 chunk_len;
    int i;
    diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
    index d3346d23963b..89b3befc7155 100644
    --- a/drivers/pci/bus.c
    +++ b/drivers/pci/bus.c
    @@ -140,6 +140,8 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
    type_mask |= IORESOURCE_TYPE_BITS;

    pci_bus_for_each_resource(bus, r, i) {
    + resource_size_t min_used = min;
    +
    if (!r)
    continue;

    @@ -163,12 +165,12 @@ static int pci_bus_alloc_from_region(struct pci_bus *bus, struct resource *res,
    * overrides "min".
    */
    if (avail.start)
    - min = avail.start;
    + min_used = avail.start;

    max = avail.end;

    /* Ok, try it out.. */
    - ret = allocate_resource(r, res, size, min, max,
    + ret = allocate_resource(r, res, size, min_used, max,
    align, alignf, alignf_data);
    if (ret == 0)
    return 0;
    diff --git a/drivers/pci/host/pci-dra7xx.c b/drivers/pci/host/pci-dra7xx.c
    index 199e29a044cd..ee978705a6f5 100644
    --- a/drivers/pci/host/pci-dra7xx.c
    +++ b/drivers/pci/host/pci-dra7xx.c
    @@ -295,7 +295,8 @@ static int __init dra7xx_add_pcie_port(struct dra7xx_pcie *dra7xx,
    }

    ret = devm_request_irq(&pdev->dev, pp->irq,
    - dra7xx_pcie_msi_irq_handler, IRQF_SHARED,
    + dra7xx_pcie_msi_irq_handler,
    + IRQF_SHARED | IRQF_NO_THREAD,
    "dra7-pcie-msi", pp);
    if (ret) {
    dev_err(&pdev->dev, "failed to request irq\n");
    diff --git a/drivers/pci/host/pci-exynos.c b/drivers/pci/host/pci-exynos.c
    index f9f468d9a819..7b6be7791d33 100644
    --- a/drivers/pci/host/pci-exynos.c
    +++ b/drivers/pci/host/pci-exynos.c
    @@ -523,7 +523,8 @@ static int __init exynos_add_pcie_port(struct pcie_port *pp,

    ret = devm_request_irq(&pdev->dev, pp->msi_irq,
    exynos_pcie_msi_irq_handler,
    - IRQF_SHARED, "exynos-pcie", pp);
    + IRQF_SHARED | IRQF_NO_THREAD,
    + "exynos-pcie", pp);
    if (ret) {
    dev_err(&pdev->dev, "failed to request msi irq\n");
    return ret;
    diff --git a/drivers/pci/host/pci-imx6.c b/drivers/pci/host/pci-imx6.c
    index 8f3a9813c4e5..58713d57c426 100644
    --- a/drivers/pci/host/pci-imx6.c
    +++ b/drivers/pci/host/pci-imx6.c
    @@ -536,7 +536,8 @@ static int __init imx6_add_pcie_port(struct pcie_port *pp,

    ret = devm_request_irq(&pdev->dev, pp->msi_irq,
    imx6_pcie_msi_handler,
    - IRQF_SHARED, "mx6-pcie-msi", pp);
    + IRQF_SHARED | IRQF_NO_THREAD,
    + "mx6-pcie-msi", pp);
    if (ret) {
    dev_err(&pdev->dev, "failed to request MSI irq\n");
    return -ENODEV;
    diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
    index 81df0c1fe063..46d5e07dbdfe 100644
    --- a/drivers/pci/host/pci-tegra.c
    +++ b/drivers/pci/host/pci-tegra.c
    @@ -1288,7 +1288,7 @@ static int tegra_pcie_enable_msi(struct tegra_pcie *pcie)

    msi->irq = err;

    - err = request_irq(msi->irq, tegra_pcie_msi_irq, 0,
    + err = request_irq(msi->irq, tegra_pcie_msi_irq, IRQF_NO_THREAD,
    tegra_msi_irq_chip.name, pcie);
    if (err < 0) {
    dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
    diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
    index 7678fe0820d7..b86e42fcf19f 100644
    --- a/drivers/pci/host/pcie-rcar.c
    +++ b/drivers/pci/host/pcie-rcar.c
    @@ -694,14 +694,16 @@ static int rcar_pcie_enable_msi(struct rcar_pcie *pcie)

    /* Two irqs are for MSI, but they are also used for non-MSI irqs */
    err = devm_request_irq(&pdev->dev, msi->irq1, rcar_pcie_msi_irq,
    - IRQF_SHARED, rcar_msi_irq_chip.name, pcie);
    + IRQF_SHARED | IRQF_NO_THREAD,
    + rcar_msi_irq_chip.name, pcie);
    if (err < 0) {
    dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
    goto err;
    }

    err = devm_request_irq(&pdev->dev, msi->irq2, rcar_pcie_msi_irq,
    - IRQF_SHARED, rcar_msi_irq_chip.name, pcie);
    + IRQF_SHARED | IRQF_NO_THREAD,
    + rcar_msi_irq_chip.name, pcie);
    if (err < 0) {
    dev_err(&pdev->dev, "failed to request IRQ: %d\n", err);
    goto err;
    diff --git a/drivers/pci/host/pcie-spear13xx.c b/drivers/pci/host/pcie-spear13xx.c
    index 98d2683181bc..4aca7167ed95 100644
    --- a/drivers/pci/host/pcie-spear13xx.c
    +++ b/drivers/pci/host/pcie-spear13xx.c
    @@ -163,34 +163,36 @@ static int spear13xx_pcie_establish_link(struct pcie_port *pp)
    * default value in capability register is 512 bytes. So force
    * it to 128 here.
    */
    - dw_pcie_cfg_read(pp->dbi_base, exp_cap_off + PCI_EXP_DEVCTL, 4, &val);
    + dw_pcie_cfg_read(pp->dbi_base + exp_cap_off + PCI_EXP_DEVCTL,
    + 0, 2, &val);
    val &= ~PCI_EXP_DEVCTL_READRQ;
    - dw_pcie_cfg_write(pp->dbi_base, exp_cap_off + PCI_EXP_DEVCTL, 4, val);
    + dw_pcie_cfg_write(pp->dbi_base + exp_cap_off + PCI_EXP_DEVCTL,
    + 0, 2, val);

    - dw_pcie_cfg_write(pp->dbi_base, PCI_VENDOR_ID, 2, 0x104A);
    - dw_pcie_cfg_write(pp->dbi_base, PCI_DEVICE_ID, 2, 0xCD80);
    + dw_pcie_cfg_write(pp->dbi_base + PCI_VENDOR_ID, 0, 2, 0x104A);
    + dw_pcie_cfg_write(pp->dbi_base + PCI_VENDOR_ID, 2, 2, 0xCD80);

    /*
    * if is_gen1 is set then handle it, so that some buggy card
    * also works
    */
    if (spear13xx_pcie->is_gen1) {
    - dw_pcie_cfg_read(pp->dbi_base, exp_cap_off + PCI_EXP_LNKCAP, 4,
    - &val);
    + dw_pcie_cfg_read(pp->dbi_base + exp_cap_off + PCI_EXP_LNKCAP,
    + 0, 4, &val);
    if ((val & PCI_EXP_LNKCAP_SLS) != PCI_EXP_LNKCAP_SLS_2_5GB) {
    val &= ~((u32)PCI_EXP_LNKCAP_SLS);
    val |= PCI_EXP_LNKCAP_SLS_2_5GB;
    - dw_pcie_cfg_write(pp->dbi_base, exp_cap_off +
    - PCI_EXP_LNKCAP, 4, val);
    + dw_pcie_cfg_write(pp->dbi_base + exp_cap_off +
    + PCI_EXP_LNKCAP, 0, 4, val);
    }

    - dw_pcie_cfg_read(pp->dbi_base, exp_cap_off + PCI_EXP_LNKCTL2, 4,
    - &val);
    + dw_pcie_cfg_read(pp->dbi_base + exp_cap_off + PCI_EXP_LNKCTL2,
    + 0, 2, &val);
    if ((val & PCI_EXP_LNKCAP_SLS) != PCI_EXP_LNKCAP_SLS_2_5GB) {
    val &= ~((u32)PCI_EXP_LNKCAP_SLS);
    val |= PCI_EXP_LNKCAP_SLS_2_5GB;
    - dw_pcie_cfg_write(pp->dbi_base, exp_cap_off +
    - PCI_EXP_LNKCTL2, 4, val);
    + dw_pcie_cfg_write(pp->dbi_base + exp_cap_off +
    + PCI_EXP_LNKCTL2, 0, 2, val);
    }
    }

    @@ -279,7 +281,8 @@ static int spear13xx_add_pcie_port(struct pcie_port *pp,
    return -ENODEV;
    }
    ret = devm_request_irq(dev, pp->irq, spear13xx_pcie_irq_handler,
    - IRQF_SHARED, "spear1340-pcie", pp);
    + IRQF_SHARED | IRQF_NO_THREAD,
    + "spear1340-pcie", pp);
    if (ret) {
    dev_err(dev, "failed to request irq %d\n", pp->irq);
    return ret;
    diff --git a/drivers/pci/host/pcie-xilinx.c b/drivers/pci/host/pcie-xilinx.c
    index 3c7a0d580b1e..4cfa46360d12 100644
    --- a/drivers/pci/host/pcie-xilinx.c
    +++ b/drivers/pci/host/pcie-xilinx.c
    @@ -781,7 +781,8 @@ static int xilinx_pcie_parse_dt(struct xilinx_pcie_port *port)

    port->irq = irq_of_parse_and_map(node, 0);
    err = devm_request_irq(dev, port->irq, xilinx_pcie_intr_handler,
    - IRQF_SHARED, "xilinx-pcie", port);
    + IRQF_SHARED | IRQF_NO_THREAD,
    + "xilinx-pcie", port);
    if (err) {
    dev_err(dev, "unable to request irq %d\n", port->irq);
    return err;
    diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
    index ee0ebff103a4..1eadc74d88b4 100644
    --- a/drivers/pci/iov.c
    +++ b/drivers/pci/iov.c
    @@ -54,24 +54,29 @@ static inline void pci_iov_set_numvfs(struct pci_dev *dev, int nr_virtfn)
    * The PF consumes one bus number. NumVFs, First VF Offset, and VF Stride
    * determine how many additional bus numbers will be consumed by VFs.
    *
    - * Iterate over all valid NumVFs and calculate the maximum number of bus
    - * numbers that could ever be required.
    + * Iterate over all valid NumVFs, validate offset and stride, and calculate
    + * the maximum number of bus numbers that could ever be required.
    */
    -static inline u8 virtfn_max_buses(struct pci_dev *dev)
    +static int compute_max_vf_buses(struct pci_dev *dev)
    {
    struct pci_sriov *iov = dev->sriov;
    - int nr_virtfn;
    - u8 max = 0;
    - int busnr;
    + int nr_virtfn, busnr, rc = 0;

    - for (nr_virtfn = 1; nr_virtfn <= iov->total_VFs; nr_virtfn++) {
    + for (nr_virtfn = iov->total_VFs; nr_virtfn; nr_virtfn--) {
    pci_iov_set_numvfs(dev, nr_virtfn);
    + if (!iov->offset || (nr_virtfn > 1 && !iov->stride)) {
    + rc = -EIO;
    + goto out;
    + }
    +
    busnr = pci_iov_virtfn_bus(dev, nr_virtfn - 1);
    - if (busnr > max)
    - max = busnr;
    + if (busnr > iov->max_VF_buses)
    + iov->max_VF_buses = busnr;
    }

    - return max;
    +out:
    + pci_iov_set_numvfs(dev, 0);
    + return rc;
    }

    static struct pci_bus *virtfn_add_bus(struct pci_bus *bus, int busnr)
    @@ -384,7 +389,7 @@ static int sriov_init(struct pci_dev *dev, int pos)
    int rc;
    int nres;
    u32 pgsz;
    - u16 ctrl, total, offset, stride;
    + u16 ctrl, total;
    struct pci_sriov *iov;
    struct resource *res;
    struct pci_dev *pdev;
    @@ -414,11 +419,6 @@ static int sriov_init(struct pci_dev *dev, int pos)

    found:
    pci_write_config_word(dev, pos + PCI_SRIOV_CTRL, ctrl);
    - pci_write_config_word(dev, pos + PCI_SRIOV_NUM_VF, 0);
    - pci_read_config_word(dev, pos + PCI_SRIOV_VF_OFFSET, &offset);
    - pci_read_config_word(dev, pos + PCI_SRIOV_VF_STRIDE, &stride);
    - if (!offset || (total > 1 && !stride))
    - return -EIO;

    pci_read_config_dword(dev, pos + PCI_SRIOV_SUP_PGSIZE, &pgsz);
    i = PAGE_SHIFT > 12 ? PAGE_SHIFT - 12 : 0;
    @@ -456,8 +456,6 @@ found:
    iov->nres = nres;
    iov->ctrl = ctrl;
    iov->total_VFs = total;
    - iov->offset = offset;
    - iov->stride = stride;
    iov->pgsz = pgsz;
    iov->self = dev;
    pci_read_config_dword(dev, pos + PCI_SRIOV_CAP, &iov->cap);
    @@ -474,10 +472,15 @@ found:

    dev->sriov = iov;
    dev->is_physfn = 1;
    - iov->max_VF_buses = virtfn_max_buses(dev);
    + rc = compute_max_vf_buses(dev);
    + if (rc)
    + goto fail_max_buses;

    return 0;

    +fail_max_buses:
    + dev->sriov = NULL;
    + dev->is_physfn = 0;
    failed:
    for (i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
    res = &dev->resource[i + PCI_IOV_RESOURCES];
    diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
    index 92618686604c..eead54cd01b2 100644
    --- a/drivers/pci/pci-sysfs.c
    +++ b/drivers/pci/pci-sysfs.c
    @@ -216,7 +216,10 @@ static ssize_t numa_node_store(struct device *dev,
    if (ret)
    return ret;

    - if (node >= MAX_NUMNODES || !node_online(node))
    + if ((node < 0 && node != NUMA_NO_NODE) || node >= MAX_NUMNODES)
    + return -EINVAL;
    +
    + if (node != NUMA_NO_NODE && !node_online(node))
    return -EINVAL;

    add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
    diff --git a/drivers/remoteproc/remoteproc_debugfs.c b/drivers/remoteproc/remoteproc_debugfs.c
    index 9d30809bb407..916af5096f57 100644
    --- a/drivers/remoteproc/remoteproc_debugfs.c
    +++ b/drivers/remoteproc/remoteproc_debugfs.c
    @@ -156,7 +156,7 @@ rproc_recovery_write(struct file *filp, const char __user *user_buf,
    char buf[10];
    int ret;

    - if (count > sizeof(buf))
    + if (count < 1 || count > sizeof(buf))
    return count;

    ret = copy_from_user(buf, user_buf, count);
    diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
    index 63318e2afba1..3fff59ce065f 100644
    --- a/drivers/spi/spi-atmel.c
    +++ b/drivers/spi/spi-atmel.c
    @@ -773,7 +773,8 @@ static int atmel_spi_next_xfer_dma_submit(struct spi_master *master,

    *plen = len;

    - if (atmel_spi_dma_slave_config(as, &slave_config, 8))
    + if (atmel_spi_dma_slave_config(as, &slave_config,
    + xfer->bits_per_word))
    goto err_exit;

    /* Send both scatterlists */
    diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
    index 3d09e0b69b73..1f8903d356e5 100644
    --- a/drivers/spi/spi-omap2-mcspi.c
    +++ b/drivers/spi/spi-omap2-mcspi.c
    @@ -1217,6 +1217,33 @@ out:
    return status;
    }

    +static int omap2_mcspi_prepare_message(struct spi_master *master,
    + struct spi_message *msg)
    +{
    + struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
    + struct omap2_mcspi_regs *ctx = &mcspi->ctx;
    + struct omap2_mcspi_cs *cs;
    +
    + /* Only a single channel can have the FORCE bit enabled
    + * in its chconf0 register.
    + * Scan all channels and disable them except the current one.
    + * A FORCE can remain from a last transfer having cs_change enabled
    + */
    + list_for_each_entry(cs, &ctx->cs, node) {
    + if (msg->spi->controller_state == cs)
    + continue;
    +
    + if ((cs->chconf0 & OMAP2_MCSPI_CHCONF_FORCE)) {
    + cs->chconf0 &= ~OMAP2_MCSPI_CHCONF_FORCE;
    + writel_relaxed(cs->chconf0,
    + cs->base + OMAP2_MCSPI_CHCONF0);
    + readl_relaxed(cs->base + OMAP2_MCSPI_CHCONF0);
    + }
    + }
    +
    + return 0;
    +}
    +
    static int omap2_mcspi_transfer_one(struct spi_master *master,
    struct spi_device *spi, struct spi_transfer *t)
    {
    @@ -1344,6 +1371,7 @@ static int omap2_mcspi_probe(struct platform_device *pdev)
    master->bits_per_word_mask = SPI_BPW_RANGE_MASK(4, 32);
    master->setup = omap2_mcspi_setup;
    master->auto_runtime_pm = true;
    + master->prepare_message = omap2_mcspi_prepare_message;
    master->transfer_one = omap2_mcspi_transfer_one;
    master->set_cs = omap2_mcspi_set_cs;
    master->cleanup = omap2_mcspi_cleanup;
    diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
    index aa6d284131e0..81b84858cfee 100644
    --- a/drivers/spi/spi-ti-qspi.c
    +++ b/drivers/spi/spi-ti-qspi.c
    @@ -410,11 +410,10 @@ static int ti_qspi_start_transfer_one(struct spi_master *master,

    mutex_unlock(&qspi->list_lock);

    + ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG);
    m->status = status;
    spi_finalize_current_message(master);

    - ti_qspi_write(qspi, qspi->cmd | QSPI_INVAL, QSPI_SPI_CMD_REG);
    -
    return status;
    }

    diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
    index a339c1e9997a..3009121173cd 100644
    --- a/drivers/spi/spi-xilinx.c
    +++ b/drivers/spi/spi-xilinx.c
    @@ -270,6 +270,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)

    while (remaining_words) {
    int n_words, tx_words, rx_words;
    + u32 sr;

    n_words = min(remaining_words, xspi->buffer_size);

    @@ -284,24 +285,33 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
    if (use_irq) {
    xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
    wait_for_completion(&xspi->done);
    - } else
    - while (!(xspi->read_fn(xspi->regs + XSPI_SR_OFFSET) &
    - XSPI_SR_TX_EMPTY_MASK))
    - ;
    -
    - /* A transmit has just completed. Process received data and
    - * check for more data to transmit. Always inhibit the
    - * transmitter while the Isr refills the transmit register/FIFO,
    - * or make sure it is stopped if we're done.
    - */
    - if (use_irq)
    + /* A transmit has just completed. Process received data
    + * and check for more data to transmit. Always inhibit
    + * the transmitter while the Isr refills the transmit
    + * register/FIFO, or make sure it is stopped if we're
    + * done.
    + */
    xspi->write_fn(cr | XSPI_CR_TRANS_INHIBIT,
    - xspi->regs + XSPI_CR_OFFSET);
    + xspi->regs + XSPI_CR_OFFSET);
    + sr = XSPI_SR_TX_EMPTY_MASK;
    + } else
    + sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);

    /* Read out all the data from the Rx FIFO */
    rx_words = n_words;
    - while (rx_words--)
    - xilinx_spi_rx(xspi);
    + while (rx_words) {
    + if ((sr & XSPI_SR_TX_EMPTY_MASK) && (rx_words > 1)) {
    + xilinx_spi_rx(xspi);
    + rx_words--;
    + continue;
    + }
    +
    + sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
    + if (!(sr & XSPI_SR_RX_EMPTY_MASK)) {
    + xilinx_spi_rx(xspi);
    + rx_words--;
    + }
    + }

    remaining_words -= n_words;
    }
    diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
    index a5f53de813d3..a83d9d07df58 100644
    --- a/drivers/spi/spi.c
    +++ b/drivers/spi/spi.c
    @@ -1627,7 +1627,7 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
    master->bus_num = -1;
    master->num_chipselect = 1;
    master->dev.class = &spi_master_class;
    - master->dev.parent = get_device(dev);
    + master->dev.parent = dev;
    spi_master_set_devdata(master, &master[1]);

    return master;
    diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
    index a0285da0244c..1fc7a84a2ded 100644
    --- a/drivers/tty/n_tty.c
    +++ b/drivers/tty/n_tty.c
    @@ -258,16 +258,13 @@ static void n_tty_check_throttle(struct tty_struct *tty)

    static void n_tty_check_unthrottle(struct tty_struct *tty)
    {
    - if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
    - tty->link->ldisc->ops->write_wakeup == n_tty_write_wakeup) {
    + if (tty->driver->type == TTY_DRIVER_TYPE_PTY) {
    if (chars_in_buffer(tty) > TTY_THRESHOLD_UNTHROTTLE)
    return;
    if (!tty->count)
    return;
    n_tty_kick_worker(tty);
    - n_tty_write_wakeup(tty->link);
    - if (waitqueue_active(&tty->link->write_wait))
    - wake_up_interruptible_poll(&tty->link->write_wait, POLLOUT);
    + tty_wakeup(tty->link);
    return;
    }

    @@ -2058,13 +2055,13 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
    size_t eol;
    size_t tail;
    int ret, found = 0;
    - bool eof_push = 0;

    /* N.B. avoid overrun if nr == 0 */
    - n = min(*nr, smp_load_acquire(&ldata->canon_head) - ldata->read_tail);
    - if (!n)
    + if (!*nr)
    return 0;

    + n = min(*nr + 1, smp_load_acquire(&ldata->canon_head) - ldata->read_tail);
    +
    tail = ldata->read_tail & (N_TTY_BUF_SIZE - 1);
    size = min_t(size_t, tail + n, N_TTY_BUF_SIZE);

    @@ -2085,12 +2082,11 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
    n = eol - tail;
    if (n > N_TTY_BUF_SIZE)
    n += N_TTY_BUF_SIZE;
    - n += found;
    - c = n;
    + c = n + found;

    - if (found && !ldata->push && read_buf(ldata, eol) == __DISABLED_CHAR) {
    - n--;
    - eof_push = !n && ldata->read_tail != ldata->line_start;
    + if (!found || read_buf(ldata, eol) != __DISABLED_CHAR) {
    + c = min(*nr, c);
    + n = c;
    }

    n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu size:%zu more:%zu\n",
    @@ -2120,7 +2116,7 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
    ldata->push = 0;
    tty_audit_push(tty);
    }
    - return eof_push ? -EAGAIN : 0;
    + return 0;
    }

    extern ssize_t redirected_tty_write(struct file *, const char __user *,
    @@ -2299,10 +2295,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,

    if (ldata->icanon && !L_EXTPROC(tty)) {
    retval = canon_copy_from_read_buf(tty, &b, &nr);
    - if (retval == -EAGAIN) {
    - retval = 0;
    - continue;
    - } else if (retval)
    + if (retval)
    break;
    } else {
    int uncopied;
    diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
    index a660ab181cca..bcf2de080471 100644
    --- a/drivers/tty/tty_buffer.c
    +++ b/drivers/tty/tty_buffer.c
    @@ -450,7 +450,7 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count)
    count = disc->ops->receive_buf2(tty, p, f, count);
    else {
    count = min_t(int, count, tty->receive_room);
    - if (count)
    + if (count && disc->ops->receive_buf)
    disc->ops->receive_buf(tty, p, f, count);
    }
    return count;
    diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
    index f435977de740..ff7f15f0f1fb 100644
    --- a/drivers/tty/tty_io.c
    +++ b/drivers/tty/tty_io.c
    @@ -1462,13 +1462,13 @@ static int tty_reopen(struct tty_struct *tty)
    {
    struct tty_driver *driver = tty->driver;

    - if (!tty->count)
    - return -EIO;
    -
    if (driver->type == TTY_DRIVER_TYPE_PTY &&
    driver->subtype == PTY_TYPE_MASTER)
    return -EIO;

    + if (!tty->count)
    + return -EAGAIN;
    +
    if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
    return -EBUSY;

    @@ -2087,7 +2087,11 @@ retry_open:

    if (IS_ERR(tty)) {
    retval = PTR_ERR(tty);
    - goto err_file;
    + if (retval != -EAGAIN || signal_pending(current))
    + goto err_file;
    + tty_free_file(filp);
    + schedule();
    + goto retry_open;
    }

    tty_add_file(tty, filp);
    @@ -2654,6 +2658,28 @@ static int tiocsetd(struct tty_struct *tty, int __user *p)
    }

    /**
    + * tiocgetd - get line discipline
    + * @tty: tty device
    + * @p: pointer to user data
    + *
    + * Retrieves the line discipline id directly from the ldisc.
    + *
    + * Locking: waits for ldisc reference (in case the line discipline
    + * is changing or the tty is being hungup)
    + */
    +
    +static int tiocgetd(struct tty_struct *tty, int __user *p)
    +{
    + struct tty_ldisc *ld;
    + int ret;
    +
    + ld = tty_ldisc_ref_wait(tty);
    + ret = put_user(ld->ops->num, p);
    + tty_ldisc_deref(ld);
    + return ret;
    +}
    +
    +/**
    * send_break - performed time break
    * @tty: device to break on
    * @duration: timeout in mS
    @@ -2879,7 +2905,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
    case TIOCGSID:
    return tiocgsid(tty, real_tty, p);
    case TIOCGETD:
    - return put_user(tty->ldisc->ops->num, (int __user *)p);
    + return tiocgetd(tty, p);
    case TIOCSETD:
    return tiocsetd(tty, p);
    case TIOCVHANGUP:
    diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    index 26ca4f910cb0..e4c70dce3e7c 100644
    --- a/drivers/usb/class/cdc-acm.c
    +++ b/drivers/usb/class/cdc-acm.c
    @@ -428,7 +428,8 @@ static void acm_read_bulk_callback(struct urb *urb)
    set_bit(rb->index, &acm->read_urbs_free);
    dev_dbg(&acm->data->dev, "%s - non-zero urb status: %d\n",
    __func__, status);
    - return;
    + if ((status != -ENOENT) || (urb->actual_length == 0))
    + return;
    }

    usb_mark_last_busy(acm->dev);
    @@ -1404,6 +1405,8 @@ made_compressed_probe:
    usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
    NULL, acm->writesize, acm_write_bulk, snd);
    snd->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
    + if (quirks & SEND_ZERO_PACKET)
    + snd->urb->transfer_flags |= URB_ZERO_PACKET;
    snd->instance = acm;
    }

    @@ -1861,6 +1864,10 @@ static const struct usb_device_id acm_ids[] = {
    { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
    USB_CDC_ACM_PROTO_AT_CDMA) },

    + { USB_DEVICE(0x1519, 0x0452), /* Intel 7260 modem */
    + .driver_info = SEND_ZERO_PACKET,
    + },
    +
    { }
    };

    diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
    index dd9af38e7cda..ccfaba9ab4e4 100644
    --- a/drivers/usb/class/cdc-acm.h
    +++ b/drivers/usb/class/cdc-acm.h
    @@ -134,3 +134,4 @@ struct acm {
    #define IGNORE_DEVICE BIT(5)
    #define QUIRK_CONTROL_LINE_STATE BIT(6)
    #define CLEAR_HALT_CONDITIONS BIT(7)
    +#define SEND_ZERO_PACKET BIT(8)
    diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    index 62084335a608..a2fef797d553 100644
    --- a/drivers/usb/core/hub.c
    +++ b/drivers/usb/core/hub.c
    @@ -5377,7 +5377,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
    }

    bos = udev->bos;
    - udev->bos = NULL;

    for (i = 0; i < SET_CONFIG_TRIES; ++i) {

    @@ -5470,8 +5469,11 @@ done:
    usb_set_usb2_hardware_lpm(udev, 1);
    usb_unlocked_enable_lpm(udev);
    usb_enable_ltm(udev);
    - usb_release_bos_descriptor(udev);
    - udev->bos = bos;
    + /* release the new BOS descriptor allocated by hub_port_init() */
    + if (udev->bos != bos) {
    + usb_release_bos_descriptor(udev);
    + udev->bos = bos;
    + }
    return 0;

    re_enumerate:
    diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
    index 78241b5550df..1018f563465b 100644
    --- a/drivers/usb/host/xhci-hub.c
    +++ b/drivers/usb/host/xhci-hub.c
    @@ -616,8 +616,30 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
    if ((raw_port_status & PORT_RESET) ||
    !(raw_port_status & PORT_PE))
    return 0xffffffff;
    - if (time_after_eq(jiffies,
    - bus_state->resume_done[wIndex])) {
    + /* did port event handler already start resume timing? */
    + if (!bus_state->resume_done[wIndex]) {
    + /* If not, maybe we are in a host initated resume? */
    + if (test_bit(wIndex, &bus_state->resuming_ports)) {
    + /* Host initated resume doesn't time the resume
    + * signalling using resume_done[].
    + * It manually sets RESUME state, sleeps 20ms
    + * and sets U0 state. This should probably be
    + * changed, but not right now.
    + */
    + } else {
    + /* port resume was discovered now and here,
    + * start resume timing
    + */
    + unsigned long timeout = jiffies +
    + msecs_to_jiffies(USB_RESUME_TIMEOUT);
    +
    + set_bit(wIndex, &bus_state->resuming_ports);
    + bus_state->resume_done[wIndex] = timeout;
    + mod_timer(&hcd->rh_timer, timeout);
    + }
    + /* Has resume been signalled for USB_RESUME_TIME yet? */
    + } else if (time_after_eq(jiffies,
    + bus_state->resume_done[wIndex])) {
    int time_left;

    xhci_dbg(xhci, "Resume USB2 port %d\n",
    @@ -658,13 +680,24 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
    } else {
    /*
    * The resume has been signaling for less than
    - * 20ms. Report the port status as SUSPEND,
    - * let the usbcore check port status again
    - * and clear resume signaling later.
    + * USB_RESUME_TIME. Report the port status as SUSPEND,
    + * let the usbcore check port status again and clear
    + * resume signaling later.
    */
    status |= USB_PORT_STAT_SUSPEND;
    }
    }
    + /*
    + * Clear stale usb2 resume signalling variables in case port changed
    + * state during resume signalling. For example on error
    + */
    + if ((bus_state->resume_done[wIndex] ||
    + test_bit(wIndex, &bus_state->resuming_ports)) &&
    + (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
    + (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
    + bus_state->resume_done[wIndex] = 0;
    + clear_bit(wIndex, &bus_state->resuming_ports);
    + }
    if ((raw_port_status & PORT_PLS_MASK) == XDEV_U0
    && (raw_port_status & PORT_POWER)
    && (bus_state->suspended_ports & (1 << wIndex))) {
    @@ -995,6 +1028,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
    if ((temp & PORT_PE) == 0)
    goto error;

    + set_bit(wIndex, &bus_state->resuming_ports);
    xhci_set_link_state(xhci, port_array, wIndex,
    XDEV_RESUME);
    spin_unlock_irqrestore(&xhci->lock, flags);
    @@ -1002,6 +1036,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
    spin_lock_irqsave(&xhci->lock, flags);
    xhci_set_link_state(xhci, port_array, wIndex,
    XDEV_U0);
    + clear_bit(wIndex, &bus_state->resuming_ports);
    }
    bus_state->port_c_suspend |= 1 << wIndex;

    diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
    index c47d3e480586..a22c430faea7 100644
    --- a/drivers/usb/host/xhci-pci.c
    +++ b/drivers/usb/host/xhci-pci.c
    @@ -28,7 +28,9 @@
    #include "xhci.h"
    #include "xhci-trace.h"

    -#define PORT2_SSIC_CONFIG_REG2 0x883c
    +#define SSIC_PORT_NUM 2
    +#define SSIC_PORT_CFG2 0x880c
    +#define SSIC_PORT_CFG2_OFFSET 0x30
    #define PROG_DONE (1 << 30)
    #define SSIC_PORT_UNUSED (1 << 31)

    @@ -45,6 +47,7 @@
    #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
    #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
    #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
    +#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8

    static const char hcd_name[] = "xhci_hcd";

    @@ -152,7 +155,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
    (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
    pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
    - pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
    + pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
    + pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI)) {
    xhci->quirks |= XHCI_PME_STUCK_QUIRK;
    }
    if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
    @@ -316,28 +320,36 @@ static void xhci_pme_quirk(struct usb_hcd *hcd, bool suspend)
    struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
    u32 val;
    void __iomem *reg;
    + int i;

    if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
    pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI) {

    - reg = (void __iomem *) xhci->cap_regs + PORT2_SSIC_CONFIG_REG2;
    -
    - /* Notify SSIC that SSIC profile programming is not done */
    - val = readl(reg) & ~PROG_DONE;
    - writel(val, reg);
    -
    - /* Mark SSIC port as unused(suspend) or used(resume) */
    - val = readl(reg);
    - if (suspend)
    - val |= SSIC_PORT_UNUSED;
    - else
    - val &= ~SSIC_PORT_UNUSED;
    - writel(val, reg);
    -
    - /* Notify SSIC that SSIC profile programming is done */
    - val = readl(reg) | PROG_DONE;
    - writel(val, reg);
    - readl(reg);
    + for (i = 0; i < SSIC_PORT_NUM; i++) {
    + reg = (void __iomem *) xhci->cap_regs +
    + SSIC_PORT_CFG2 +
    + i * SSIC_PORT_CFG2_OFFSET;
    +
    + /*
    + * Notify SSIC that SSIC profile programming
    + * is not done.
    + */
    + val = readl(reg) & ~PROG_DONE;
    + writel(val, reg);
    +
    + /* Mark SSIC port as unused(suspend) or used(resume) */
    + val = readl(reg);
    + if (suspend)
    + val |= SSIC_PORT_UNUSED;
    + else
    + val &= ~SSIC_PORT_UNUSED;
    + writel(val, reg);
    +
    + /* Notify SSIC that SSIC profile programming is done */
    + val = readl(reg) | PROG_DONE;
    + writel(val, reg);
    + readl(reg);
    + }
    }

    reg = (void __iomem *) xhci->cap_regs + 0x80a4;
    diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    index fe9e2d3a223c..23c712ec7541 100644
    --- a/drivers/usb/host/xhci-ring.c
    +++ b/drivers/usb/host/xhci-ring.c
    @@ -1583,7 +1583,8 @@ static void handle_port_status(struct xhci_hcd *xhci,
    */
    bogus_port_status = true;
    goto cleanup;
    - } else {
    + } else if (!test_bit(faked_port_index,
    + &bus_state->resuming_ports)) {
    xhci_dbg(xhci, "resume HS port %d\n", port_id);
    bus_state->resume_done[faked_port_index] = jiffies +
    msecs_to_jiffies(USB_RESUME_TIMEOUT);
    diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
    index c58c3c0dbe35..260e510578e7 100644
    --- a/drivers/usb/phy/phy-msm-usb.c
    +++ b/drivers/usb/phy/phy-msm-usb.c
    @@ -1599,6 +1599,8 @@ static int msm_otg_read_dt(struct platform_device *pdev, struct msm_otg *motg)
    &motg->id.nb);
    if (ret < 0) {
    dev_err(&pdev->dev, "register ID notifier failed\n");
    + extcon_unregister_notifier(motg->vbus.extcon,
    + EXTCON_USB, &motg->vbus.nb);
    return ret;
    }

    @@ -1660,15 +1662,6 @@ static int msm_otg_probe(struct platform_device *pdev)
    if (!motg)
    return -ENOMEM;

    - pdata = dev_get_platdata(&pdev->dev);
    - if (!pdata) {
    - if (!np)
    - return -ENXIO;
    - ret = msm_otg_read_dt(pdev, motg);
    - if (ret)
    - return ret;
    - }
    -
    motg->phy.otg = devm_kzalloc(&pdev->dev, sizeof(struct usb_otg),
    GFP_KERNEL);
    if (!motg->phy.otg)
    @@ -1710,6 +1703,15 @@ static int msm_otg_probe(struct platform_device *pdev)
    if (!motg->regs)
    return -ENOMEM;

    + pdata = dev_get_platdata(&pdev->dev);
    + if (!pdata) {
    + if (!np)
    + return -ENXIO;
    + ret = msm_otg_read_dt(pdev, motg);
    + if (ret)
    + return ret;
    + }
    +
    /*
    * NOTE: The PHYs can be multiplexed between the chipidea controller
    * and the dwc3 controller, using a single bit. It is important that
    @@ -1717,8 +1719,10 @@ static int msm_otg_probe(struct platform_device *pdev)
    */
    if (motg->phy_number) {
    phy_select = devm_ioremap_nocache(&pdev->dev, USB2_PHY_SEL, 4);
    - if (!phy_select)
    - return -ENOMEM;
    + if (!phy_select) {
    + ret = -ENOMEM;
    + goto unregister_extcon;
    + }
    /* Enable second PHY with the OTG port */
    writel(0x1, phy_select);
    }
    @@ -1728,7 +1732,8 @@ static int msm_otg_probe(struct platform_device *pdev)
    motg->irq = platform_get_irq(pdev, 0);
    if (motg->irq < 0) {
    dev_err(&pdev->dev, "platform_get_irq failed\n");
    - return motg->irq;
    + ret = motg->irq;
    + goto unregister_extcon;
    }

    regs[0].supply = "vddcx";
    @@ -1737,7 +1742,7 @@ static int msm_otg_probe(struct platform_device *pdev)

    ret = devm_regulator_bulk_get(motg->phy.dev, ARRAY_SIZE(regs), regs);
    if (ret)
    - return ret;
    + goto unregister_extcon;

    motg->vddcx = regs[0].consumer;
    motg->v3p3 = regs[1].consumer;
    @@ -1834,6 +1839,12 @@ disable_clks:
    clk_disable_unprepare(motg->clk);
    if (!IS_ERR(motg->core_clk))
    clk_disable_unprepare(motg->core_clk);
    +unregister_extcon:
    + extcon_unregister_notifier(motg->id.extcon,
    + EXTCON_USB_HOST, &motg->id.nb);
    + extcon_unregister_notifier(motg->vbus.extcon,
    + EXTCON_USB, &motg->vbus.nb);
    +
    return ret;
    }

    diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    index 59b2126b21a3..1dd9919081f8 100644
    --- a/drivers/usb/serial/cp210x.c
    +++ b/drivers/usb/serial/cp210x.c
    @@ -98,6 +98,7 @@ static const struct usb_device_id id_table[] = {
    { USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
    { USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
    { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
    + { USB_DEVICE(0x10C4, 0x81D7) }, /* IAI Corp. RCB-CV-USB USB to RS485 Adaptor */
    { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */
    { USB_DEVICE(0x10C4, 0x81E7) }, /* Aerocomm Radio */
    { USB_DEVICE(0x10C4, 0x81E8) }, /* Zephyr Bioharness */
    diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    index a5a0376bbd48..8c660ae401d8 100644
    --- a/drivers/usb/serial/ftdi_sio.c
    +++ b/drivers/usb/serial/ftdi_sio.c
    @@ -824,6 +824,7 @@ static const struct usb_device_id id_table_combined[] = {
    { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID),
    .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
    + { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
    { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },

    /* Papouch devices based on FTDI chip */
    diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    index 67c6d4469730..a84df2513994 100644
    --- a/drivers/usb/serial/ftdi_sio_ids.h
    +++ b/drivers/usb/serial/ftdi_sio_ids.h
    @@ -615,6 +615,7 @@
    */
    #define RATOC_VENDOR_ID 0x0584
    #define RATOC_PRODUCT_ID_USB60F 0xb020
    +#define RATOC_PRODUCT_ID_SCU18 0xb03a

    /*
    * Infineon Technologies
    diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    index e945b5195258..35622fba4305 100644
    --- a/drivers/usb/serial/option.c
    +++ b/drivers/usb/serial/option.c
    @@ -271,6 +271,8 @@ static void option_instat_callback(struct urb *urb);
    #define TELIT_PRODUCT_CC864_SINGLE 0x1006
    #define TELIT_PRODUCT_DE910_DUAL 0x1010
    #define TELIT_PRODUCT_UE910_V2 0x1012
    +#define TELIT_PRODUCT_LE922_USBCFG0 0x1042
    +#define TELIT_PRODUCT_LE922_USBCFG3 0x1043
    #define TELIT_PRODUCT_LE920 0x1200
    #define TELIT_PRODUCT_LE910 0x1201

    @@ -623,6 +625,16 @@ static const struct option_blacklist_info sierra_mc73xx_blacklist = {
    .reserved = BIT(8) | BIT(10) | BIT(11),
    };

    +static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
    + .sendsetup = BIT(2),
    + .reserved = BIT(0) | BIT(1) | BIT(3),
    +};
    +
    +static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = {
    + .sendsetup = BIT(0),
    + .reserved = BIT(1) | BIT(2) | BIT(3),
    +};
    +
    static const struct usb_device_id option_ids[] = {
    { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
    { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
    @@ -1172,6 +1184,10 @@ static const struct usb_device_id option_ids[] = {
    { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
    { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
    { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
    + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
    + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
    + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3),
    + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
    { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
    .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
    { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
    @@ -1691,7 +1707,7 @@ static const struct usb_device_id option_ids[] = {
    { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
    { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
    .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    - { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
    + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) },
    { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
    .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
    diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
    index 60afb39eb73c..337a0be89fcf 100644
    --- a/drivers/usb/serial/visor.c
    +++ b/drivers/usb/serial/visor.c
    @@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial)
    (serial->num_interrupt_in == 0))
    return 0;

    + if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    /*
    * It appears that Treos and Kyoceras want to use the
    * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint,
    @@ -597,8 +602,10 @@ static int clie_5_attach(struct usb_serial *serial)
    */

    /* some sanity check */
    - if (serial->num_ports < 2)
    - return -1;
    + if (serial->num_bulk_out < 2) {
    + dev_err(&serial->interface->dev, "missing bulk out endpoints\n");
    + return -ENODEV;
    + }

    /* port 0 now uses the modified endpoint Address */
    port = serial->port[0];
    diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
    index 6b659967898e..e6572a665b2e 100644
    --- a/fs/binfmt_elf.c
    +++ b/fs/binfmt_elf.c
    @@ -759,16 +759,16 @@ static int load_elf_binary(struct linux_binprm *bprm)
    */
    would_dump(bprm, interpreter);

    - retval = kernel_read(interpreter, 0, bprm->buf,
    - BINPRM_BUF_SIZE);
    - if (retval != BINPRM_BUF_SIZE) {
    + /* Get the exec headers */
    + retval = kernel_read(interpreter, 0,
    + (void *)&loc->interp_elf_ex,
    + sizeof(loc->interp_elf_ex));
    + if (retval != sizeof(loc->interp_elf_ex)) {
    if (retval >= 0)
    retval = -EIO;
    goto out_free_dentry;
    }

    - /* Get the exec headers */
    - loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
    break;
    }
    elf_ppnt++;
    diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
    index 3cbb0e834694..3ce646792c7e 100644
    --- a/fs/cachefiles/rdwr.c
    +++ b/fs/cachefiles/rdwr.c
    @@ -885,7 +885,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
    loff_t pos, eof;
    size_t len;
    void *data;
    - int ret;
    + int ret = -ENOBUFS;

    ASSERT(op != NULL);
    ASSERT(page != NULL);
    @@ -905,6 +905,15 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
    cache = container_of(object->fscache.cache,
    struct cachefiles_cache, cache);

    + pos = (loff_t)page->index << PAGE_SHIFT;
    +
    + /* We mustn't write more data than we have, so we have to beware of a
    + * partial page at EOF.
    + */
    + eof = object->fscache.store_limit_l;
    + if (pos >= eof)
    + goto error;
    +
    /* write the page to the backing filesystem and let it store it in its
    * own time */
    path.mnt = cache->mnt;
    @@ -912,40 +921,38 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
    file = dentry_open(&path, O_RDWR | O_LARGEFILE, cache->cache_cred);
    if (IS_ERR(file)) {
    ret = PTR_ERR(file);
    - } else {
    - pos = (loff_t) page->index << PAGE_SHIFT;
    -
    - /* we mustn't write more data than we have, so we have
    - * to beware of a partial page at EOF */
    - eof = object->fscache.store_limit_l;
    - len = PAGE_SIZE;
    - if (eof & ~PAGE_MASK) {
    - ASSERTCMP(pos, <, eof);
    - if (eof - pos < PAGE_SIZE) {
    - _debug("cut short %llx to %llx",
    - pos, eof);
    - len = eof - pos;
    - ASSERTCMP(pos + len, ==, eof);
    - }
    - }
    -
    - data = kmap(page);
    - ret = __kernel_write(file, data, len, &pos);
    - kunmap(page);
    - if (ret != len)
    - ret = -EIO;
    - fput(file);
    + goto error_2;
    }

    - if (ret < 0) {
    - if (ret == -EIO)
    - cachefiles_io_error_obj(
    - object, "Write page to backing file failed");
    - ret = -ENOBUFS;
    + len = PAGE_SIZE;
    + if (eof & ~PAGE_MASK) {
    + if (eof - pos < PAGE_SIZE) {
    + _debug("cut short %llx to %llx",
    + pos, eof);
    + len = eof - pos;
    + ASSERTCMP(pos + len, ==, eof);
    + }
    }

    - _leave(" = %d", ret);
    - return ret;
    + data = kmap(page);
    + ret = __kernel_write(file, data, len, &pos);
    + kunmap(page);
    + fput(file);
    + if (ret != len)
    + goto error_eio;
    +
    + _leave(" = 0");
    + return 0;
    +
    +error_eio:
    + ret = -EIO;
    +error_2:
    + if (ret == -EIO)
    + cachefiles_io_error_obj(object,
    + "Write page to backing file failed");
    +error:
    + _leave(" = -ENOBUFS [%d]", ret);
    + return -ENOBUFS;
    }

    /*
    diff --git a/fs/ext2/super.c b/fs/ext2/super.c
    index 900e19cf9ef6..2597b0663bf2 100644
    --- a/fs/ext2/super.c
    +++ b/fs/ext2/super.c
    @@ -566,6 +566,8 @@ static int parse_options(char *options, struct super_block *sb)
    /* Fall through */
    case Opt_dax:
    #ifdef CONFIG_FS_DAX
    + ext2_msg(sb, KERN_WARNING,
    + "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
    set_opt(sbi->s_mount_opt, DAX);
    #else
    ext2_msg(sb, KERN_INFO, "dax option not supported");
    diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c
    index 2fab243a4c9e..7d6cda4738a4 100644
    --- a/fs/ext4/crypto.c
    +++ b/fs/ext4/crypto.c
    @@ -408,7 +408,7 @@ int ext4_encrypted_zeroout(struct inode *inode, struct ext4_extent *ex)
    struct ext4_crypto_ctx *ctx;
    struct page *ciphertext_page = NULL;
    struct bio *bio;
    - ext4_lblk_t lblk = ex->ee_block;
    + ext4_lblk_t lblk = le32_to_cpu(ex->ee_block);
    ext4_fsblk_t pblk = ext4_ext_pblock(ex);
    unsigned int len = ext4_ext_get_actual_len(ex);
    int ret, err = 0;
    diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
    index fd1f28be5296..eb897089fbd0 100644
    --- a/fs/ext4/ext4.h
    +++ b/fs/ext4/ext4.h
    @@ -26,6 +26,7 @@
    #include <linux/seqlock.h>
    #include <linux/mutex.h>
    #include <linux/timer.h>
    +#include <linux/version.h>
    #include <linux/wait.h>
    #include <linux/blockgroup_lock.h>
    #include <linux/percpu_counter.h>
    @@ -723,19 +724,55 @@ struct move_extent {
    <= (EXT4_GOOD_OLD_INODE_SIZE + \
    (einode)->i_extra_isize)) \

    +/*
    + * We use an encoding that preserves the times for extra epoch "00":
    + *
    + * extra msb of adjust for signed
    + * epoch 32-bit 32-bit tv_sec to
    + * bits time decoded 64-bit tv_sec 64-bit tv_sec valid time range
    + * 0 0 1 -0x80000000..-0x00000001 0x000000000 1901-12-13..1969-12-31
    + * 0 0 0 0x000000000..0x07fffffff 0x000000000 1970-01-01..2038-01-19
    + * 0 1 1 0x080000000..0x0ffffffff 0x100000000 2038-01-19..2106-02-07
    + * 0 1 0 0x100000000..0x17fffffff 0x100000000 2106-02-07..2174-02-25
    + * 1 0 1 0x180000000..0x1ffffffff 0x200000000 2174-02-25..2242-03-16
    + * 1 0 0 0x200000000..0x27fffffff 0x200000000 2242-03-16..2310-04-04
    + * 1 1 1 0x280000000..0x2ffffffff 0x300000000 2310-04-04..2378-04-22
    + * 1 1 0 0x300000000..0x37fffffff 0x300000000 2378-04-22..2446-05-10
    + *
    + * Note that previous versions of the kernel on 64-bit systems would
    + * incorrectly use extra epoch bits 1,1 for dates between 1901 and
    + * 1970. e2fsck will correct this, assuming that it is run on the
    + * affected filesystem before 2242.
    + */
    +
    static inline __le32 ext4_encode_extra_time(struct timespec *time)
    {
    - return cpu_to_le32((sizeof(time->tv_sec) > 4 ?
    - (time->tv_sec >> 32) & EXT4_EPOCH_MASK : 0) |
    - ((time->tv_nsec << EXT4_EPOCH_BITS) & EXT4_NSEC_MASK));
    + u32 extra = sizeof(time->tv_sec) > 4 ?
    + ((time->tv_sec - (s32)time->tv_sec) >> 32) & EXT4_EPOCH_MASK : 0;
    + return cpu_to_le32(extra | (time->tv_nsec << EXT4_EPOCH_BITS));
    }

    static inline void ext4_decode_extra_time(struct timespec *time, __le32 extra)
    {
    - if (sizeof(time->tv_sec) > 4)
    - time->tv_sec |= (__u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK)
    - << 32;
    - time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
    + if (unlikely(sizeof(time->tv_sec) > 4 &&
    + (extra & cpu_to_le32(EXT4_EPOCH_MASK)))) {
    +#if LINUX_VERSION_CODE < KERNEL_VERSION(4,20,0)
    + /* Handle legacy encoding of pre-1970 dates with epoch
    + * bits 1,1. We assume that by kernel version 4.20,
    + * everyone will have run fsck over the affected
    + * filesystems to correct the problem. (This
    + * backwards compatibility may be removed before this
    + * time, at the discretion of the ext4 developers.)
    + */
    + u64 extra_bits = le32_to_cpu(extra) & EXT4_EPOCH_MASK;
    + if (extra_bits == 3 && ((time->tv_sec) & 0x80000000) != 0)
    + extra_bits = 0;
    + time->tv_sec += extra_bits << 32;
    +#else
    + time->tv_sec += (u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK) << 32;
    +#endif
    + }
    + time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
    }

    #define EXT4_INODE_SET_XTIME(xtime, inode, raw_inode) \
    diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
    index cf0c472047e3..c7c53fd46a41 100644
    --- a/fs/ext4/resize.c
    +++ b/fs/ext4/resize.c
    @@ -1040,7 +1040,7 @@ exit_free:
    * do not copy the full number of backups at this time. The resize
    * which changed s_groups_count will backup again.
    */
    -static void update_backups(struct super_block *sb, int blk_off, char *data,
    +static void update_backups(struct super_block *sb, sector_t blk_off, char *data,
    int size, int meta_bg)
    {
    struct ext4_sb_info *sbi = EXT4_SB(sb);
    @@ -1065,7 +1065,7 @@ static void update_backups(struct super_block *sb, int blk_off, char *data,
    group = ext4_list_backups(sb, &three, &five, &seven);
    last = sbi->s_groups_count;
    } else {
    - group = ext4_meta_bg_first_group(sb, group) + 1;
    + group = ext4_get_group_number(sb, blk_off) + 1;
    last = (ext4_group_t)(group + EXT4_DESC_PER_BLOCK(sb) - 2);
    }

    diff --git a/fs/ext4/super.c b/fs/ext4/super.c
    index df84bd256c9f..7683892d855c 100644
    --- a/fs/ext4/super.c
    +++ b/fs/ext4/super.c
    @@ -1664,8 +1664,12 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
    }
    sbi->s_jquota_fmt = m->mount_opt;
    #endif
    -#ifndef CONFIG_FS_DAX
    } else if (token == Opt_dax) {
    +#ifdef CONFIG_FS_DAX
    + ext4_msg(sb, KERN_WARNING,
    + "DAX enabled. Warning: EXPERIMENTAL, use at your own risk");
    + sbi->s_mount_opt |= m->mount_opt;
    +#else
    ext4_msg(sb, KERN_INFO, "dax option not supported");
    return -1;
    #endif
    diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
    index c677f2c1044b..3627fd7cf4a0 100644
    --- a/fs/ext4/symlink.c
    +++ b/fs/ext4/symlink.c
    @@ -52,7 +52,7 @@ static const char *ext4_encrypted_follow_link(struct dentry *dentry, void **cook
    /* Symlink is encrypted */
    sd = (struct ext4_encrypted_symlink_data *)caddr;
    cstr.name = sd->encrypted_path;
    - cstr.len = le32_to_cpu(sd->len);
    + cstr.len = le16_to_cpu(sd->len);
    if ((cstr.len +
    sizeof(struct ext4_encrypted_symlink_data) - 1) >
    max_size) {
    diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
    index 8f15fc134040..6726c4a5efa2 100644
    --- a/fs/f2fs/dir.c
    +++ b/fs/f2fs/dir.c
    @@ -787,7 +787,6 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
    else
    d_type = DT_UNKNOWN;

    - /* encrypted case */
    de_name.name = d->filename[bit_pos];
    de_name.len = le16_to_cpu(de->name_len);

    @@ -795,12 +794,20 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
    int save_len = fstr->len;
    int ret;

    + de_name.name = kmalloc(de_name.len, GFP_NOFS);
    + if (!de_name.name)
    + return false;
    +
    + memcpy(de_name.name, d->filename[bit_pos], de_name.len);
    +
    ret = f2fs_fname_disk_to_usr(d->inode, &de->hash_code,
    &de_name, fstr);
    - de_name = *fstr;
    - fstr->len = save_len;
    + kfree(de_name.name);
    if (ret < 0)
    return true;
    +
    + de_name = *fstr;
    + fstr->len = save_len;
    }

    if (!dir_emit(ctx, de_name.name, de_name.len,
    diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
    index a680bf38e4f0..dfa01c88b34b 100644
    --- a/fs/f2fs/namei.c
    +++ b/fs/f2fs/namei.c
    @@ -947,8 +947,13 @@ static const char *f2fs_encrypted_follow_link(struct dentry *dentry, void **cook

    /* Symlink is encrypted */
    sd = (struct f2fs_encrypted_symlink_data *)caddr;
    - cstr.name = sd->encrypted_path;
    cstr.len = le16_to_cpu(sd->len);
    + cstr.name = kmalloc(cstr.len, GFP_NOFS);
    + if (!cstr.name) {
    + res = -ENOMEM;
    + goto errout;
    + }
    + memcpy(cstr.name, sd->encrypted_path, cstr.len);

    /* this is broken symlink case */
    if (cstr.name[0] == 0 && cstr.len == 0) {
    @@ -970,6 +975,8 @@ static const char *f2fs_encrypted_follow_link(struct dentry *dentry, void **cook
    if (res < 0)
    goto errout;

    + kfree(cstr.name);
    +
    paddr = pstr.name;

    /* Null-terminate the name */
    @@ -979,6 +986,7 @@ static const char *f2fs_encrypted_follow_link(struct dentry *dentry, void **cook
    page_cache_release(cpage);
    return *cookie = paddr;
    errout:
    + kfree(cstr.name);
    f2fs_fname_crypto_free_buffer(&pstr);
    kunmap(cpage);
    page_cache_release(cpage);
    diff --git a/fs/fat/dir.c b/fs/fat/dir.c
    index 4afc4d9d2e41..8b2127ffb226 100644
    --- a/fs/fat/dir.c
    +++ b/fs/fat/dir.c
    @@ -610,9 +610,9 @@ parse_record:
    int status = fat_parse_long(inode, &cpos, &bh, &de,
    &unicode, &nr_slots);
    if (status < 0) {
    - ctx->pos = cpos;
    + bh = NULL;
    ret = status;
    - goto out;
    + goto end_of_dir;
    } else if (status == PARSE_INVALID)
    goto record_end;
    else if (status == PARSE_NOT_LONGNAME)
    @@ -654,8 +654,9 @@ parse_record:
    fill_len = short_len;

    start_filldir:
    - if (!fake_offset)
    - ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
    + ctx->pos = cpos - (nr_slots + 1) * sizeof(struct msdos_dir_entry);
    + if (fake_offset && ctx->pos < 2)
    + ctx->pos = 2;

    if (!memcmp(de->name, MSDOS_DOT, MSDOS_NAME)) {
    if (!dir_emit_dot(file, ctx))
    @@ -681,14 +682,19 @@ record_end:
    fake_offset = 0;
    ctx->pos = cpos;
    goto get_new;
    +
    end_of_dir:
    - ctx->pos = cpos;
    + if (fake_offset && cpos < 2)
    + ctx->pos = 2;
    + else
    + ctx->pos = cpos;
    fill_failed:
    brelse(bh);
    if (unicode)
    __putname(unicode);
    out:
    mutex_unlock(&sbi->s_lock);
    +
    return ret;
    }

    diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c
    index 6d941f56faf4..9b28649df3a1 100644
    --- a/fs/fscache/netfs.c
    +++ b/fs/fscache/netfs.c
    @@ -22,6 +22,7 @@ static LIST_HEAD(fscache_netfs_list);
    int __fscache_register_netfs(struct fscache_netfs *netfs)
    {
    struct fscache_netfs *ptr;
    + struct fscache_cookie *cookie;
    int ret;

    _enter("{%s}", netfs->name);
    @@ -29,29 +30,25 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
    INIT_LIST_HEAD(&netfs->link);

    /* allocate a cookie for the primary index */
    - netfs->primary_index =
    - kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL);
    + cookie = kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL);

    - if (!netfs->primary_index) {
    + if (!cookie) {
    _leave(" = -ENOMEM");
    return -ENOMEM;
    }

    /* initialise the primary index cookie */
    - atomic_set(&netfs->primary_index->usage, 1);
    - atomic_set(&netfs->primary_index->n_children, 0);
    - atomic_set(&netfs->primary_index->n_active, 1);
    + atomic_set(&cookie->usage, 1);
    + atomic_set(&cookie->n_children, 0);
    + atomic_set(&cookie->n_active, 1);

    - netfs->primary_index->def = &fscache_fsdef_netfs_def;
    - netfs->primary_index->parent = &fscache_fsdef_index;
    - netfs->primary_index->netfs_data = netfs;
    - netfs->primary_index->flags = 1 << FSCACHE_COOKIE_ENABLED;
    + cookie->def = &fscache_fsdef_netfs_def;
    + cookie->parent = &fscache_fsdef_index;
    + cookie->netfs_data = netfs;
    + cookie->flags = 1 << FSCACHE_COOKIE_ENABLED;

    - atomic_inc(&netfs->primary_index->parent->usage);
    - atomic_inc(&netfs->primary_index->parent->n_children);
    -
    - spin_lock_init(&netfs->primary_index->lock);
    - INIT_HLIST_HEAD(&netfs->primary_index->backing_objects);
    + spin_lock_init(&cookie->lock);
    + INIT_HLIST_HEAD(&cookie->backing_objects);

    /* check the netfs type is not already present */
    down_write(&fscache_addremove_sem);
    @@ -62,6 +59,10 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
    goto already_registered;
    }

    + atomic_inc(&cookie->parent->usage);
    + atomic_inc(&cookie->parent->n_children);
    +
    + netfs->primary_index = cookie;
    list_add(&netfs->link, &fscache_netfs_list);
    ret = 0;

    @@ -70,11 +71,8 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
    already_registered:
    up_write(&fscache_addremove_sem);

    - if (ret < 0) {
    - netfs->primary_index->parent = NULL;
    - __fscache_cookie_put(netfs->primary_index);
    - netfs->primary_index = NULL;
    - }
    + if (ret < 0)
    + kmem_cache_free(fscache_cookie_jar, cookie);

    _leave(" = %d", ret);
    return ret;
    diff --git a/fs/fscache/page.c b/fs/fscache/page.c
    index 483bbc613bf0..ca916af5a7c4 100644
    --- a/fs/fscache/page.c
    +++ b/fs/fscache/page.c
    @@ -816,7 +816,7 @@ static void fscache_write_op(struct fscache_operation *_op)
    goto superseded;
    page = results[0];
    _debug("gang %d [%lx]", n, page->index);
    - if (page->index > op->store_limit) {
    + if (page->index >= op->store_limit) {
    fscache_stat(&fscache_n_store_pages_over_limit);
    goto superseded;
    }
    diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
    index 316adb968b65..de4bdfac0cec 100644
    --- a/fs/hugetlbfs/inode.c
    +++ b/fs/hugetlbfs/inode.c
    @@ -332,12 +332,17 @@ static void remove_huge_page(struct page *page)
    * truncation is indicated by end of range being LLONG_MAX
    * In this case, we first scan the range and release found pages.
    * After releasing pages, hugetlb_unreserve_pages cleans up region/reserv
    - * maps and global counts.
    + * maps and global counts. Page faults can not race with truncation
    + * in this routine. hugetlb_no_page() prevents page faults in the
    + * truncated range. It checks i_size before allocation, and again after
    + * with the page table lock for the page held. The same lock must be
    + * acquired to unmap a page.
    * hole punch is indicated if end is not LLONG_MAX
    * In the hole punch case we scan the range and release found pages.
    * Only when releasing a page is the associated region/reserv map
    * deleted. The region/reserv map for ranges without associated
    - * pages are not modified.
    + * pages are not modified. Page faults can race with hole punch.
    + * This is indicated if we find a mapped page.
    * Note: If the passed end of range value is beyond the end of file, but
    * not LLONG_MAX this routine still performs a hole punch operation.
    */
    @@ -361,46 +366,37 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
    next = start;
    while (next < end) {
    /*
    - * Make sure to never grab more pages that we
    - * might possibly need.
    + * Don't grab more pages than the number left in the range.
    */
    if (end - next < lookup_nr)
    lookup_nr = end - next;

    /*
    - * This pagevec_lookup() may return pages past 'end',
    - * so we must check for page->index > end.
    + * When no more pages are found, we are done.
    */
    - if (!pagevec_lookup(&pvec, mapping, next, lookup_nr)) {
    - if (next == start)
    - break;
    - next = start;
    - continue;
    - }
    + if (!pagevec_lookup(&pvec, mapping, next, lookup_nr))
    + break;

    for (i = 0; i < pagevec_count(&pvec); ++i) {
    struct page *page = pvec.pages[i];
    u32 hash;

    + /*
    + * The page (index) could be beyond end. This is
    + * only possible in the punch hole case as end is
    + * max page offset in the truncate case.
    + */
    + next = page->index;
    + if (next >= end)
    + break;
    +
    hash = hugetlb_fault_mutex_hash(h, current->mm,
    &pseudo_vma,
    mapping, next, 0);
    mutex_lock(&hugetlb_fault_mutex_table[hash]);

    lock_page(page);
    - if (page->index >= end) {
    - unlock_page(page);
    - mutex_unlock(&hugetlb_fault_mutex_table[hash]);
    - next = end; /* we are done */
    - break;
    - }
    -
    - /*
    - * If page is mapped, it was faulted in after being
    - * unmapped. Do nothing in this race case. In the
    - * normal case page is not mapped.
    - */
    - if (!page_mapped(page)) {
    + if (likely(!page_mapped(page))) {
    bool rsv_on_error = !PagePrivate(page);
    /*
    * We must free the huge page and remove
    @@ -421,17 +417,23 @@ static void remove_inode_hugepages(struct inode *inode, loff_t lstart,
    hugetlb_fix_reserve_counts(
    inode, rsv_on_error);
    }
    + } else {
    + /*
    + * If page is mapped, it was faulted in after
    + * being unmapped. It indicates a race between
    + * hole punch and page fault. Do nothing in
    + * this case. Getting here in a truncate
    + * operation is a bug.
    + */
    + BUG_ON(truncate_op);
    }

    - if (page->index > next)
    - next = page->index;
    -
    - ++next;
    unlock_page(page);
    -
    mutex_unlock(&hugetlb_fault_mutex_table[hash]);
    }
    + ++next;
    huge_pagevec_release(&pvec);
    + cond_resched();
    }

    if (truncate_op)
    @@ -647,9 +649,6 @@ static long hugetlbfs_fallocate(struct file *file, int mode, loff_t offset,
    if (!(mode & FALLOC_FL_KEEP_SIZE) && offset + len > inode->i_size)
    i_size_write(inode, offset + len);
    inode->i_ctime = CURRENT_TIME;
    - spin_lock(&inode->i_lock);
    - inode->i_private = NULL;
    - spin_unlock(&inode->i_lock);
    out:
    mutex_unlock(&inode->i_mutex);
    return error;
    diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
    index 8c44654ce274..684996c8a3a4 100644
    --- a/fs/jbd2/checkpoint.c
    +++ b/fs/jbd2/checkpoint.c
    @@ -427,7 +427,6 @@ static int journal_clean_one_cp_list(struct journal_head *jh, bool destroy)
    struct journal_head *last_jh;
    struct journal_head *next_jh = jh;
    int ret;
    - int freed = 0;

    if (!jh)
    return 0;
    @@ -441,10 +440,9 @@ static int journal_clean_one_cp_list(struct journal_head *jh, bool destroy)
    else
    ret = __jbd2_journal_remove_checkpoint(jh) + 1;
    if (!ret)
    - return freed;
    + return 0;
    if (ret == 2)
    return 1;
    - freed = 1;
    /*
    * This function only frees up some memory
    * if possible so we dont have an obligation
    @@ -452,10 +450,10 @@ static int journal_clean_one_cp_list(struct journal_head *jh, bool destroy)
    * requested:
    */
    if (need_resched())
    - return freed;
    + return 0;
    } while (jh != last_jh);

    - return freed;
    + return 0;
    }

    /*
    diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
    index 6b8338ec2464..1498ad9f731a 100644
    --- a/fs/jbd2/transaction.c
    +++ b/fs/jbd2/transaction.c
    @@ -1009,7 +1009,8 @@ out:
    }

    /* Fast check whether buffer is already attached to the required transaction */
    -static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh)
    +static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh,
    + bool undo)
    {
    struct journal_head *jh;
    bool ret = false;
    @@ -1036,6 +1037,9 @@ static bool jbd2_write_access_granted(handle_t *handle, struct buffer_head *bh)
    jh = READ_ONCE(bh->b_private);
    if (!jh)
    goto out;
    + /* For undo access buffer must have data copied */
    + if (undo && !jh->b_committed_data)
    + goto out;
    if (jh->b_transaction != handle->h_transaction &&
    jh->b_next_transaction != handle->h_transaction)
    goto out;
    @@ -1073,7 +1077,7 @@ int jbd2_journal_get_write_access(handle_t *handle, struct buffer_head *bh)
    struct journal_head *jh;
    int rc;

    - if (jbd2_write_access_granted(handle, bh))
    + if (jbd2_write_access_granted(handle, bh, false))
    return 0;

    jh = jbd2_journal_add_journal_head(bh);
    @@ -1210,7 +1214,7 @@ int jbd2_journal_get_undo_access(handle_t *handle, struct buffer_head *bh)
    char *committed_data = NULL;

    JBUFFER_TRACE(jh, "entry");
    - if (jbd2_write_access_granted(handle, bh))
    + if (jbd2_write_access_granted(handle, bh, true))
    return 0;

    jh = jbd2_journal_add_journal_head(bh);
    @@ -2152,6 +2156,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,

    if (!buffer_dirty(bh)) {
    /* bdflush has written it. We can drop it now */
    + __jbd2_journal_remove_checkpoint(jh);
    goto zap_buffer;
    }

    @@ -2181,6 +2186,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
    /* The orphan record's transaction has
    * committed. We can cleanse this buffer */
    clear_buffer_jbddirty(bh);
    + __jbd2_journal_remove_checkpoint(jh);
    goto zap_buffer;
    }
    }
    diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
    index 5133bb18830e..c8bd1ddb7df8 100644
    --- a/fs/nfs/nfs4proc.c
    +++ b/fs/nfs/nfs4proc.c
    @@ -8060,7 +8060,6 @@ static void nfs4_layoutreturn_release(void *calldata)
    pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
    pnfs_mark_matching_lsegs_invalid(lo, &freeme, &lrp->args.range);
    pnfs_clear_layoutreturn_waitbit(lo);
    - lo->plh_block_lgets--;
    spin_unlock(&lo->plh_inode->i_lock);
    pnfs_free_lseg_list(&freeme);
    pnfs_put_layout_hdr(lrp->args.layout);
    diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
    index ce38b4ccc9ab..5e355650eea0 100644
    --- a/fs/ocfs2/dlm/dlmmaster.c
    +++ b/fs/ocfs2/dlm/dlmmaster.c
    @@ -2519,6 +2519,11 @@ static int dlm_migrate_lockres(struct dlm_ctxt *dlm,
    spin_lock(&dlm->master_lock);
    ret = dlm_add_migration_mle(dlm, res, mle, &oldmle, name,
    namelen, target, dlm->node_num);
    + /* get an extra reference on the mle.
    + * otherwise the assert_master from the new
    + * master will destroy this.
    + */
    + dlm_get_mle_inuse(mle);
    spin_unlock(&dlm->master_lock);
    spin_unlock(&dlm->spinlock);

    @@ -2554,6 +2559,7 @@ fail:
    if (mle_added) {
    dlm_mle_detach_hb_events(dlm, mle);
    dlm_put_mle(mle);
    + dlm_put_mle_inuse(mle);
    } else if (mle) {
    kmem_cache_free(dlm_mle_cache, mle);
    mle = NULL;
    @@ -2571,17 +2577,6 @@ fail:
    * ensure that all assert_master work is flushed. */
    flush_workqueue(dlm->dlm_worker);

    - /* get an extra reference on the mle.
    - * otherwise the assert_master from the new
    - * master will destroy this.
    - * also, make sure that all callers of dlm_get_mle
    - * take both dlm->spinlock and dlm->master_lock */
    - spin_lock(&dlm->spinlock);
    - spin_lock(&dlm->master_lock);
    - dlm_get_mle_inuse(mle);
    - spin_unlock(&dlm->master_lock);
    - spin_unlock(&dlm->spinlock);
    -
    /* notify new node and send all lock state */
    /* call send_one_lockres with migration flag.
    * this serves as notice to the target node that a
    @@ -3310,6 +3305,15 @@ top:
    mle->new_master != dead_node)
    continue;

    + if (mle->new_master == dead_node && mle->inuse) {
    + mlog(ML_NOTICE, "%s: target %u died during "
    + "migration from %u, the MLE is "
    + "still keep used, ignore it!\n",
    + dlm->name, dead_node,
    + mle->master);
    + continue;
    + }
    +
    /* If we have reached this point, this mle needs to be
    * removed from the list and freed. */
    dlm_clean_migration_mle(dlm, mle);
    diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
    index 58eaa5c0d387..572a3dc4861f 100644
    --- a/fs/ocfs2/dlm/dlmrecovery.c
    +++ b/fs/ocfs2/dlm/dlmrecovery.c
    @@ -2360,6 +2360,8 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
    break;
    }
    }
    + dlm_lockres_clear_refmap_bit(dlm, res,
    + dead_node);
    spin_unlock(&res->spinlock);
    continue;
    }
    diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
    index 1c91103c1333..9a894aecc960 100644
    --- a/fs/ocfs2/dlmglue.c
    +++ b/fs/ocfs2/dlmglue.c
    @@ -1390,6 +1390,7 @@ static int __ocfs2_cluster_lock(struct ocfs2_super *osb,
    unsigned int gen;
    int noqueue_attempted = 0;
    int dlm_locked = 0;
    + int kick_dc = 0;

    if (!(lockres->l_flags & OCFS2_LOCK_INITIALIZED)) {
    mlog_errno(-EINVAL);
    @@ -1524,7 +1525,12 @@ update_holders:
    unlock:
    lockres_clear_flags(lockres, OCFS2_LOCK_UPCONVERT_FINISHING);

    + /* ocfs2_unblock_lock reques on seeing OCFS2_LOCK_UPCONVERT_FINISHING */
    + kick_dc = (lockres->l_flags & OCFS2_LOCK_BLOCKED);
    +
    spin_unlock_irqrestore(&lockres->l_lock, flags);
    + if (kick_dc)
    + ocfs2_wake_downconvert_thread(osb);
    out:
    /*
    * This is helping work around a lock inversion between the page lock
    diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
    index 12bfa9ca5583..c0356c18cdf5 100644
    --- a/fs/ocfs2/namei.c
    +++ b/fs/ocfs2/namei.c
    @@ -369,13 +369,11 @@ static int ocfs2_mknod(struct inode *dir,
    goto leave;
    }

    - status = posix_acl_create(dir, &mode, &default_acl, &acl);
    + status = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl);
    if (status) {
    mlog_errno(status);
    goto leave;
    }
    - /* update inode->i_mode after mask with "umask". */
    - inode->i_mode = mode;

    handle = ocfs2_start_trans(osb, ocfs2_mknod_credits(osb->sb,
    S_ISDIR(mode),
    diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c
    index d5da6f624142..79b8021302b3 100644
    --- a/fs/ocfs2/resize.c
    +++ b/fs/ocfs2/resize.c
    @@ -54,11 +54,12 @@
    static u16 ocfs2_calc_new_backup_super(struct inode *inode,
    struct ocfs2_group_desc *gd,
    u16 cl_cpg,
    + u16 old_bg_clusters,
    int set)
    {
    int i;
    u16 backups = 0;
    - u32 cluster;
    + u32 cluster, lgd_cluster;
    u64 blkno, gd_blkno, lgd_blkno = le64_to_cpu(gd->bg_blkno);

    for (i = 0; i < OCFS2_MAX_BACKUP_SUPERBLOCKS; i++) {
    @@ -71,6 +72,12 @@ static u16 ocfs2_calc_new_backup_super(struct inode *inode,
    else if (gd_blkno > lgd_blkno)
    break;

    + /* check if already done backup super */
    + lgd_cluster = ocfs2_blocks_to_clusters(inode->i_sb, lgd_blkno);
    + lgd_cluster += old_bg_clusters;
    + if (lgd_cluster >= cluster)
    + continue;
    +
    if (set)
    ocfs2_set_bit(cluster % cl_cpg,
    (unsigned long *)gd->bg_bitmap);
    @@ -99,6 +106,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
    u16 chain, num_bits, backups = 0;
    u16 cl_bpc = le16_to_cpu(cl->cl_bpc);
    u16 cl_cpg = le16_to_cpu(cl->cl_cpg);
    + u16 old_bg_clusters;

    trace_ocfs2_update_last_group_and_inode(new_clusters,
    first_new_cluster);
    @@ -112,6 +120,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,

    group = (struct ocfs2_group_desc *)group_bh->b_data;

    + old_bg_clusters = le16_to_cpu(group->bg_bits) / cl_bpc;
    /* update the group first. */
    num_bits = new_clusters * cl_bpc;
    le16_add_cpu(&group->bg_bits, num_bits);
    @@ -125,7 +134,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
    OCFS2_FEATURE_COMPAT_BACKUP_SB)) {
    backups = ocfs2_calc_new_backup_super(bm_inode,
    group,
    - cl_cpg, 1);
    + cl_cpg, old_bg_clusters, 1);
    le16_add_cpu(&group->bg_free_bits_count, -1 * backups);
    }

    @@ -163,7 +172,7 @@ out_rollback:
    if (ret < 0) {
    ocfs2_calc_new_backup_super(bm_inode,
    group,
    - cl_cpg, 0);
    + cl_cpg, old_bg_clusters, 0);
    le16_add_cpu(&group->bg_free_bits_count, backups);
    le16_add_cpu(&group->bg_bits, -1 * num_bits);
    le16_add_cpu(&group->bg_free_bits_count, -1 * num_bits);
    diff --git a/fs/pipe.c b/fs/pipe.c
    index 8865f7963700..14788ddcd3f3 100644
    --- a/fs/pipe.c
    +++ b/fs/pipe.c
    @@ -366,18 +366,17 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
    int offset = buf->offset + buf->len;

    if (ops->can_merge && offset + chars <= PAGE_SIZE) {
    - int error = ops->confirm(pipe, buf);
    - if (error)
    + ret = ops->confirm(pipe, buf);
    + if (ret)
    goto out;

    ret = copy_page_from_iter(buf->page, offset, chars, from);
    if (unlikely(ret < chars)) {
    - error = -EFAULT;
    + ret = -EFAULT;
    goto out;
    }
    do_wakeup = 1;
    - buf->len += chars;
    - ret = chars;
    + buf->len += ret;
    if (!iov_iter_count(from))
    goto out;
    }
    diff --git a/fs/proc/base.c b/fs/proc/base.c
    index 29595af32866..4b6fb2cbd928 100644
    --- a/fs/proc/base.c
    +++ b/fs/proc/base.c
    @@ -2484,6 +2484,7 @@ static ssize_t proc_coredump_filter_write(struct file *file,
    mm = get_task_mm(task);
    if (!mm)
    goto out_no_mm;
    + ret = 0;

    for (i = 0, mask = 1; i < MMF_DUMP_FILTER_BITS; i++, mask <<= 1) {
    if (val & mask)
    diff --git a/fs/proc/fd.c b/fs/proc/fd.c
    index 6e5fcd00733e..3c2a915c695a 100644
    --- a/fs/proc/fd.c
    +++ b/fs/proc/fd.c
    @@ -291,11 +291,19 @@ static struct dentry *proc_lookupfd(struct inode *dir, struct dentry *dentry,
    */
    int proc_fd_permission(struct inode *inode, int mask)
    {
    - int rv = generic_permission(inode, mask);
    + struct task_struct *p;
    + int rv;
    +
    + rv = generic_permission(inode, mask);
    if (rv == 0)
    - return 0;
    - if (task_tgid(current) == proc_pid(inode))
    + return rv;
    +
    + rcu_read_lock();
    + p = pid_task(proc_pid(inode), PIDTYPE_PID);
    + if (p && same_thread_group(p, current))
    rv = 0;
    + rcu_read_unlock();
    +
    return rv;
    }

    diff --git a/fs/seq_file.c b/fs/seq_file.c
    index 225586e141ca..a8e288755f24 100644
    --- a/fs/seq_file.c
    +++ b/fs/seq_file.c
    @@ -25,12 +25,17 @@ static void seq_set_overflow(struct seq_file *m)
    static void *seq_buf_alloc(unsigned long size)
    {
    void *buf;
    + gfp_t gfp = GFP_KERNEL;

    /*
    - * __GFP_NORETRY to avoid oom-killings with high-order allocations -
    - * it's better to fall back to vmalloc() than to kill things.
    + * For high order allocations, use __GFP_NORETRY to avoid oom-killing -
    + * it's better to fall back to vmalloc() than to kill things. For small
    + * allocations, just use GFP_KERNEL which will oom kill, thus no need
    + * for vmalloc fallback.
    */
    - buf = kmalloc(size, GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
    + if (size > PAGE_SIZE)
    + gfp |= __GFP_NORETRY | __GFP_NOWARN;
    + buf = kmalloc(size, gfp);
    if (!buf && size > PAGE_SIZE)
    buf = vmalloc(size);
    return buf;
    diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
    index 590ad9206e3f..02fa1dcc5969 100644
    --- a/fs/sysv/inode.c
    +++ b/fs/sysv/inode.c
    @@ -162,15 +162,8 @@ void sysv_set_inode(struct inode *inode, dev_t rdev)
    inode->i_fop = &sysv_dir_operations;
    inode->i_mapping->a_ops = &sysv_aops;
    } else if (S_ISLNK(inode->i_mode)) {
    - if (inode->i_blocks) {
    - inode->i_op = &sysv_symlink_inode_operations;
    - inode->i_mapping->a_ops = &sysv_aops;
    - } else {
    - inode->i_op = &simple_symlink_inode_operations;
    - inode->i_link = (char *)SYSV_I(inode)->i_data;
    - nd_terminate_link(inode->i_link, inode->i_size,
    - sizeof(SYSV_I(inode)->i_data) - 1);
    - }
    + inode->i_op = &sysv_symlink_inode_operations;
    + inode->i_mapping->a_ops = &sysv_aops;
    } else
    init_special_inode(inode, inode->i_mode, rdev);
    }
    diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
    index cbc8d5d2755a..c66f2423e1f5 100644
    --- a/fs/tracefs/inode.c
    +++ b/fs/tracefs/inode.c
    @@ -340,8 +340,12 @@ static struct dentry *start_creating(const char *name, struct dentry *parent)
    dput(dentry);
    dentry = ERR_PTR(-EEXIST);
    }
    - if (IS_ERR(dentry))
    +
    + if (IS_ERR(dentry)) {
    mutex_unlock(&parent->d_inode->i_mutex);
    + simple_release_fs(&tracefs_mount, &tracefs_mount_count);
    + }
    +
    return dentry;
    }

    diff --git a/include/crypto/hash.h b/include/crypto/hash.h
    index 8e920b44c0ac..da791ac52f13 100644
    --- a/include/crypto/hash.h
    +++ b/include/crypto/hash.h
    @@ -204,6 +204,7 @@ struct crypto_ahash {
    unsigned int keylen);

    unsigned int reqsize;
    + bool has_setkey;
    struct crypto_tfm base;
    };

    @@ -361,6 +362,11 @@ static inline void *ahash_request_ctx(struct ahash_request *req)
    int crypto_ahash_setkey(struct crypto_ahash *tfm, const u8 *key,
    unsigned int keylen);

    +static inline bool crypto_ahash_has_setkey(struct crypto_ahash *tfm)
    +{
    + return tfm->has_setkey;
    +}
    +
    /**
    * crypto_ahash_finup() - update and finalize message digest
    * @req: reference to the ahash_request handle that holds all information
    diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
    index 018afb264ac2..a2bfd7843f18 100644
    --- a/include/crypto/if_alg.h
    +++ b/include/crypto/if_alg.h
    @@ -30,6 +30,9 @@ struct alg_sock {

    struct sock *parent;

    + unsigned int refcnt;
    + unsigned int nokey_refcnt;
    +
    const struct af_alg_type *type;
    void *private;
    };
    @@ -50,9 +53,11 @@ struct af_alg_type {
    void (*release)(void *private);
    int (*setkey)(void *private, const u8 *key, unsigned int keylen);
    int (*accept)(void *private, struct sock *sk);
    + int (*accept_nokey)(void *private, struct sock *sk);
    int (*setauthsize)(void *private, unsigned int authsize);

    struct proto_ops *ops;
    + struct proto_ops *ops_nokey;
    struct module *owner;
    char name[14];
    };
    @@ -67,6 +72,7 @@ int af_alg_register_type(const struct af_alg_type *type);
    int af_alg_unregister_type(const struct af_alg_type *type);

    int af_alg_release(struct socket *sock);
    +void af_alg_release_parent(struct sock *sk);
    int af_alg_accept(struct sock *sk, struct socket *newsock);

    int af_alg_make_sg(struct af_alg_sgl *sgl, struct iov_iter *iter, int len);
    @@ -83,11 +89,6 @@ static inline struct alg_sock *alg_sk(struct sock *sk)
    return (struct alg_sock *)sk;
    }

    -static inline void af_alg_release_parent(struct sock *sk)
    -{
    - sock_put(alg_sk(sk)->parent);
    -}
    -
    static inline void af_alg_init_completion(struct af_alg_completion *completion)
    {
    init_completion(&completion->completion);
    diff --git a/include/crypto/skcipher.h b/include/crypto/skcipher.h
    index d8dd41fb034f..fd8742a40ff3 100644
    --- a/include/crypto/skcipher.h
    +++ b/include/crypto/skcipher.h
    @@ -61,6 +61,8 @@ struct crypto_skcipher {
    unsigned int ivsize;
    unsigned int reqsize;

    + bool has_setkey;
    +
    struct crypto_tfm base;
    };

    @@ -305,6 +307,11 @@ static inline int crypto_skcipher_setkey(struct crypto_skcipher *tfm,
    return tfm->setkey(tfm, key, keylen);
    }

    +static inline bool crypto_skcipher_has_setkey(struct crypto_skcipher *tfm)
    +{
    + return tfm->has_setkey;
    +}
    +
    /**
    * crypto_skcipher_reqtfm() - obtain cipher handle from request
    * @req: skcipher_request out of which the cipher handle is to be obtained
    diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
    index 19c2e947d4d1..3a3ff074782f 100644
    --- a/include/linux/blkdev.h
    +++ b/include/linux/blkdev.h
    @@ -767,7 +767,6 @@ extern void blk_rq_set_block_pc(struct request *);
    extern void blk_requeue_request(struct request_queue *, struct request *);
    extern void blk_add_request_payload(struct request *rq, struct page *page,
    unsigned int len);
    -extern int blk_rq_check_limits(struct request_queue *q, struct request *rq);
    extern int blk_lld_busy(struct request_queue *q);
    extern int blk_rq_prep_clone(struct request *rq, struct request *rq_src,
    struct bio_set *bs, gfp_t gfp_mask,
    diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
    index 76dd4f0da5ca..2ead22dd74a0 100644
    --- a/include/linux/hrtimer.h
    +++ b/include/linux/hrtimer.h
    @@ -87,7 +87,8 @@ enum hrtimer_restart {
    * @function: timer expiry callback function
    * @base: pointer to the timer base (per cpu and per clock)
    * @state: state information (See bit values above)
    - * @start_pid: timer statistics field to store the pid of the task which
    + * @is_rel: Set if the timer was armed relative
    + * @start_pid: timer statistics field to store the pid of the task which
    * started the timer
    * @start_site: timer statistics field to store the site where the timer
    * was started
    @@ -101,7 +102,8 @@ struct hrtimer {
    ktime_t _softexpires;
    enum hrtimer_restart (*function)(struct hrtimer *);
    struct hrtimer_clock_base *base;
    - unsigned long state;
    + u8 state;
    + u8 is_rel;
    #ifdef CONFIG_TIMER_STATS
    int start_pid;
    void *start_site;
    @@ -321,6 +323,27 @@ static inline void clock_was_set_delayed(void) { }

    #endif

    +static inline ktime_t
    +__hrtimer_expires_remaining_adjusted(const struct hrtimer *timer, ktime_t now)
    +{
    + ktime_t rem = ktime_sub(timer->node.expires, now);
    +
    + /*
    + * Adjust relative timers for the extra we added in
    + * hrtimer_start_range_ns() to prevent short timeouts.
    + */
    + if (IS_ENABLED(CONFIG_TIME_LOW_RES) && timer->is_rel)
    + rem.tv64 -= hrtimer_resolution;
    + return rem;
    +}
    +
    +static inline ktime_t
    +hrtimer_expires_remaining_adjusted(const struct hrtimer *timer)
    +{
    + return __hrtimer_expires_remaining_adjusted(timer,
    + timer->base->get_time());
    +}
    +
    extern void clock_was_set(void);
    #ifdef CONFIG_TIMERFD
    extern void timerfd_clock_was_set(void);
    @@ -390,7 +413,12 @@ static inline void hrtimer_restart(struct hrtimer *timer)
    }

    /* Query timers: */
    -extern ktime_t hrtimer_get_remaining(const struct hrtimer *timer);
    +extern ktime_t __hrtimer_get_remaining(const struct hrtimer *timer, bool adjust);
    +
    +static inline ktime_t hrtimer_get_remaining(const struct hrtimer *timer)
    +{
    + return __hrtimer_get_remaining(timer, false);
    +}

    extern u64 hrtimer_get_next_event(void);

    diff --git a/include/linux/signal.h b/include/linux/signal.h
    index ab1e0392b5ac..92557bbce7e7 100644
    --- a/include/linux/signal.h
    +++ b/include/linux/signal.h
    @@ -239,7 +239,6 @@ extern int sigprocmask(int, sigset_t *, sigset_t *);
    extern void set_current_blocked(sigset_t *);
    extern void __set_current_blocked(const sigset_t *);
    extern int show_unhandled_signals;
    -extern int sigsuspend(sigset_t *);

    struct sigaction {
    #ifndef __ARCH_HAS_IRIX_SIGACTION
    diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h
    index f6cbef78db62..3b91ad5d5115 100644
    --- a/include/sound/rawmidi.h
    +++ b/include/sound/rawmidi.h
    @@ -167,6 +167,10 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
    int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count);
    int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
    unsigned char *buffer, int count);
    +int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
    + unsigned char *buffer, int count);
    +int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream,
    + int count);

    /* main midi functions */

    diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
    index 8f0324ef72ab..9982616ce712 100644
    --- a/kernel/printk/printk.c
    +++ b/kernel/printk/printk.c
    @@ -269,6 +269,9 @@ static u32 clear_idx;
    #define PREFIX_MAX 32
    #define LOG_LINE_MAX (1024 - PREFIX_MAX)

    +#define LOG_LEVEL(v) ((v) & 0x07)
    +#define LOG_FACILITY(v) ((v) >> 3 & 0xff)
    +
    /* record buffer */
    #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
    #define LOG_ALIGN 4
    @@ -611,7 +614,6 @@ struct devkmsg_user {
    static ssize_t devkmsg_write(struct kiocb *iocb, struct iov_iter *from)
    {
    char *buf, *line;
    - int i;
    int level = default_message_loglevel;
    int facility = 1; /* LOG_USER */
    size_t len = iov_iter_count(from);
    @@ -641,12 +643,13 @@ static ssize_t devkmsg_write(struct kiocb *iocb, struct iov_iter *from)
    line = buf;
    if (line[0] == '<') {
    char *endp = NULL;
    + unsigned int u;

    - i = simple_strtoul(line+1, &endp, 10);
    + u = simple_strtoul(line + 1, &endp, 10);
    if (endp && endp[0] == '>') {
    - level = i & 7;
    - if (i >> 3)
    - facility = i >> 3;
    + level = LOG_LEVEL(u);
    + if (LOG_FACILITY(u) != 0)
    + facility = LOG_FACILITY(u);
    endp++;
    len -= endp - line;
    line = endp;
    diff --git a/kernel/sched/core.c b/kernel/sched/core.c
    index bcd214e4b4d6..9a584b204e85 100644
    --- a/kernel/sched/core.c
    +++ b/kernel/sched/core.c
    @@ -6678,7 +6678,7 @@ static void sched_init_numa(void)

    sched_domains_numa_masks[i][j] = mask;

    - for (k = 0; k < nr_node_ids; k++) {
    + for_each_node(k) {
    if (node_distance(j, k) > sched_domains_numa_distance[i])
    continue;

    diff --git a/kernel/signal.c b/kernel/signal.c
    index 0f6bbbe77b46..6c863ca42a76 100644
    --- a/kernel/signal.c
    +++ b/kernel/signal.c
    @@ -3552,7 +3552,7 @@ SYSCALL_DEFINE0(pause)

    #endif

    -int sigsuspend(sigset_t *set)
    +static int sigsuspend(sigset_t *set)
    {
    current->saved_sigmask = current->blocked;
    set_current_blocked(set);
    diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
    index 457a373e2181..8be98288dcbc 100644
    --- a/kernel/time/hrtimer.c
    +++ b/kernel/time/hrtimer.c
    @@ -897,10 +897,10 @@ static int enqueue_hrtimer(struct hrtimer *timer,
    */
    static void __remove_hrtimer(struct hrtimer *timer,
    struct hrtimer_clock_base *base,
    - unsigned long newstate, int reprogram)
    + u8 newstate, int reprogram)
    {
    struct hrtimer_cpu_base *cpu_base = base->cpu_base;
    - unsigned int state = timer->state;
    + u8 state = timer->state;

    timer->state = newstate;
    if (!(state & HRTIMER_STATE_ENQUEUED))
    @@ -930,7 +930,7 @@ static inline int
    remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart)
    {
    if (hrtimer_is_queued(timer)) {
    - unsigned long state = timer->state;
    + u8 state = timer->state;
    int reprogram;

    /*
    @@ -954,6 +954,22 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool rest
    return 0;
    }

    +static inline ktime_t hrtimer_update_lowres(struct hrtimer *timer, ktime_t tim,
    + const enum hrtimer_mode mode)
    +{
    +#ifdef CONFIG_TIME_LOW_RES
    + /*
    + * CONFIG_TIME_LOW_RES indicates that the system has no way to return
    + * granular time values. For relative timers we add hrtimer_resolution
    + * (i.e. one jiffie) to prevent short timeouts.
    + */
    + timer->is_rel = mode & HRTIMER_MODE_REL;
    + if (timer->is_rel)
    + tim = ktime_add_safe(tim, ktime_set(0, hrtimer_resolution));
    +#endif
    + return tim;
    +}
    +
    /**
    * hrtimer_start_range_ns - (re)start an hrtimer on the current CPU
    * @timer: the timer to be added
    @@ -974,19 +990,10 @@ void hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
    /* Remove an active timer from the queue: */
    remove_hrtimer(timer, base, true);

    - if (mode & HRTIMER_MODE_REL) {
    + if (mode & HRTIMER_MODE_REL)
    tim = ktime_add_safe(tim, base->get_time());
    - /*
    - * CONFIG_TIME_LOW_RES is a temporary way for architectures
    - * to signal that they simply return xtime in
    - * do_gettimeoffset(). In this case we want to round up by
    - * resolution when starting a relative timer, to avoid short
    - * timeouts. This will go away with the GTOD framework.
    - */
    -#ifdef CONFIG_TIME_LOW_RES
    - tim = ktime_add_safe(tim, ktime_set(0, hrtimer_resolution));
    -#endif
    - }
    +
    + tim = hrtimer_update_lowres(timer, tim, mode);

    hrtimer_set_expires_range_ns(timer, tim, delta_ns);

    @@ -1074,19 +1081,23 @@ EXPORT_SYMBOL_GPL(hrtimer_cancel);
    /**
    * hrtimer_get_remaining - get remaining time for the timer
    * @timer: the timer to read
    + * @adjust: adjust relative timers when CONFIG_TIME_LOW_RES=y
    */
    -ktime_t hrtimer_get_remaining(const struct hrtimer *timer)
    +ktime_t __hrtimer_get_remaining(const struct hrtimer *timer, bool adjust)
    {
    unsigned long flags;
    ktime_t rem;

    lock_hrtimer_base(timer, &flags);
    - rem = hrtimer_expires_remaining(timer);
    + if (IS_ENABLED(CONFIG_TIME_LOW_RES) && adjust)
    + rem = hrtimer_expires_remaining_adjusted(timer);
    + else
    + rem = hrtimer_expires_remaining(timer);
    unlock_hrtimer_base(timer, &flags);

    return rem;
    }
    -EXPORT_SYMBOL_GPL(hrtimer_get_remaining);
    +EXPORT_SYMBOL_GPL(__hrtimer_get_remaining);

    #ifdef CONFIG_NO_HZ_COMMON
    /**
    @@ -1220,6 +1231,14 @@ static void __run_hrtimer(struct hrtimer_cpu_base *cpu_base,
    fn = timer->function;

    /*
    + * Clear the 'is relative' flag for the TIME_LOW_RES case. If the
    + * timer is restarted with a period then it becomes an absolute
    + * timer. If its not restarted it does not matter.
    + */
    + if (IS_ENABLED(CONFIG_TIME_LOW_RES))
    + timer->is_rel = false;
    +
    + /*
    * Because we run timers from hardirq context, there is no chance
    * they get migrated to another cpu, therefore its safe to unlock
    * the timer base.
    diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
    index f75e35b60149..ba7d8b288bb3 100644
    --- a/kernel/time/timer_list.c
    +++ b/kernel/time/timer_list.c
    @@ -69,7 +69,7 @@ print_timer(struct seq_file *m, struct hrtimer *taddr, struct hrtimer *timer,
    print_name_offset(m, taddr);
    SEQ_printf(m, ", ");
    print_name_offset(m, timer->function);
    - SEQ_printf(m, ", S:%02lx", timer->state);
    + SEQ_printf(m, ", S:%02x", timer->state);
    #ifdef CONFIG_TIMER_STATS
    SEQ_printf(m, ", ");
    print_name_offset(m, timer->start_site);
    diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
    index 6e79408674aa..69f97541ce6e 100644
    --- a/kernel/trace/trace.c
    +++ b/kernel/trace/trace.c
    @@ -6602,7 +6602,7 @@ static int instance_rmdir(const char *name)
    tracing_set_nop(tr);
    event_trace_del_tracer(tr);
    ftrace_destroy_function_files(tr);
    - debugfs_remove_recursive(tr->dir);
    + tracefs_remove_recursive(tr->dir);
    free_trace_buffers(tr);

    kfree(tr->name);
    diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
    index 36c1455b7567..2dbffe22cbcf 100644
    --- a/kernel/trace/trace_printk.c
    +++ b/kernel/trace/trace_printk.c
    @@ -267,6 +267,7 @@ static const char **find_next(void *v, loff_t *pos)
    if (*pos < last_index + start_index)
    return __start___tracepoint_str + (*pos - last_index);

    + start_index += last_index;
    return find_next_mod_format(start_index, v, fmt, pos);
    }

    diff --git a/lib/hexdump.c b/lib/hexdump.c
    index 8d74c20d8595..992457b1284c 100644
    --- a/lib/hexdump.c
    +++ b/lib/hexdump.c
    @@ -169,11 +169,15 @@ int hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize,
    }
    } else {
    for (j = 0; j < len; j++) {
    - if (linebuflen < lx + 3)
    + if (linebuflen < lx + 2)
    goto overflow2;
    ch = ptr[j];
    linebuf[lx++] = hex_asc_hi(ch);
    + if (linebuflen < lx + 2)
    + goto overflow2;
    linebuf[lx++] = hex_asc_lo(ch);
    + if (linebuflen < lx + 2)
    + goto overflow2;
    linebuf[lx++] = ' ';
    }
    if (j)
    diff --git a/lib/libcrc32c.c b/lib/libcrc32c.c
    index 6a08ce7d6adc..acf9da449f81 100644
    --- a/lib/libcrc32c.c
    +++ b/lib/libcrc32c.c
    @@ -74,3 +74,4 @@ module_exit(libcrc32c_mod_fini);
    MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
    MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations");
    MODULE_LICENSE("GPL");
    +MODULE_SOFTDEP("pre: crc32c");
    diff --git a/mm/backing-dev.c b/mm/backing-dev.c
    index 619984fc07ec..4cf30e1ca163 100644
    --- a/mm/backing-dev.c
    +++ b/mm/backing-dev.c
    @@ -957,8 +957,9 @@ EXPORT_SYMBOL(congestion_wait);
    * jiffies for either a BDI to exit congestion of the given @sync queue
    * or a write to complete.
    *
    - * In the absence of zone congestion, cond_resched() is called to yield
    - * the processor if necessary but otherwise does not sleep.
    + * In the absence of zone congestion, a short sleep or a cond_resched is
    + * performed to yield the processor and to allow other subsystems to make
    + * a forward progress.
    *
    * The return value is 0 if the sleep is for the full timeout. Otherwise,
    * it is the number of jiffies that were still remaining when the function
    @@ -978,7 +979,19 @@ long wait_iff_congested(struct zone *zone, int sync, long timeout)
    */
    if (atomic_read(&nr_wb_congested[sync]) == 0 ||
    !test_bit(ZONE_CONGESTED, &zone->flags)) {
    - cond_resched();
    +
    + /*
    + * Memory allocation/reclaim might be called from a WQ
    + * context and the current implementation of the WQ
    + * concurrency control doesn't recognize that a particular
    + * WQ is congested if the worker thread is looping without
    + * ever sleeping. Therefore we have to do a short sleep
    + * here rather than calling cond_resched().
    + */
    + if (current->flags & PF_WQ_WORKER)
    + schedule_timeout_uninterruptible(1);
    + else
    + cond_resched();

    /* In case we scheduled, work out time remaining */
    ret = timeout - (jiffies - start);
    diff --git a/mm/hugetlb.c b/mm/hugetlb.c
    index 9cc773483624..960f0ace6824 100644
    --- a/mm/hugetlb.c
    +++ b/mm/hugetlb.c
    @@ -372,8 +372,10 @@ retry_locked:
    spin_unlock(&resv->lock);

    trg = kmalloc(sizeof(*trg), GFP_KERNEL);
    - if (!trg)
    + if (!trg) {
    + kfree(nrg);
    return -ENOMEM;
    + }

    spin_lock(&resv->lock);
    list_add(&trg->link, &resv->region_cache);
    @@ -483,8 +485,16 @@ static long region_del(struct resv_map *resv, long f, long t)
    retry:
    spin_lock(&resv->lock);
    list_for_each_entry_safe(rg, trg, head, link) {
    - if (rg->to <= f)
    + /*
    + * Skip regions before the range to be deleted. file_region
    + * ranges are normally of the form [from, to). However, there
    + * may be a "placeholder" entry in the map which is of the form
    + * (from, to) with from == to. Check for placeholder entries
    + * at the beginning of the range to be deleted.
    + */
    + if (rg->to <= f && (rg->to != rg->from || rg->to != f))
    continue;
    +
    if (rg->from >= t)
    break;

    @@ -1790,7 +1800,10 @@ struct page *alloc_huge_page(struct vm_area_struct *vma,
    page = alloc_buddy_huge_page(h, NUMA_NO_NODE);
    if (!page)
    goto out_uncharge_cgroup;
    -
    + if (!avoid_reserve && vma_has_reserves(vma, gbl_chg)) {
    + SetPagePrivate(page);
    + h->resv_huge_pages--;
    + }
    spin_lock(&hugetlb_lock);
    list_move(&page->lru, &h->hugepage_activelist);
    /* Fall through */
    @@ -3587,12 +3600,12 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
    } else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))
    return VM_FAULT_HWPOISON_LARGE |
    VM_FAULT_SET_HINDEX(hstate_index(h));
    + } else {
    + ptep = huge_pte_alloc(mm, address, huge_page_size(h));
    + if (!ptep)
    + return VM_FAULT_OOM;
    }

    - ptep = huge_pte_alloc(mm, address, huge_page_size(h));
    - if (!ptep)
    - return VM_FAULT_OOM;
    -
    mapping = vma->vm_file->f_mapping;
    idx = vma_hugecache_offset(h, vma, address);

    diff --git a/mm/memcontrol.c b/mm/memcontrol.c
    index c57c4423c688..2233233282c6 100644
    --- a/mm/memcontrol.c
    +++ b/mm/memcontrol.c
    @@ -902,14 +902,20 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
    if (prev && reclaim->generation != iter->generation)
    goto out_unlock;

    - do {
    + while (1) {
    pos = READ_ONCE(iter->position);
    + if (!pos || css_tryget(&pos->css))
    + break;
    /*
    - * A racing update may change the position and
    - * put the last reference, hence css_tryget(),
    - * or retry to see the updated position.
    + * css reference reached zero, so iter->position will
    + * be cleared by ->css_released. However, we should not
    + * rely on this happening soon, because ->css_released
    + * is called from a work queue, and by busy-waiting we
    + * might block it. So we clear iter->position right
    + * away.
    */
    - } while (pos && !css_tryget(&pos->css));
    + (void)cmpxchg(&iter->position, pos, NULL);
    + }
    }

    if (pos)
    @@ -955,17 +961,13 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root,
    }

    if (reclaim) {
    - if (cmpxchg(&iter->position, pos, memcg) == pos) {
    - if (memcg)
    - css_get(&memcg->css);
    - if (pos)
    - css_put(&pos->css);
    - }
    -
    /*
    - * pairs with css_tryget when dereferencing iter->position
    - * above.
    + * The position could have already been updated by a competing
    + * thread, so check that the value hasn't changed since we read
    + * it to avoid reclaiming from the same cgroup twice.
    */
    + (void)cmpxchg(&iter->position, pos, memcg);
    +
    if (pos)
    css_put(&pos->css);

    @@ -998,6 +1000,28 @@ void mem_cgroup_iter_break(struct mem_cgroup *root,
    css_put(&prev->css);
    }

    +static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
    +{
    + struct mem_cgroup *memcg = dead_memcg;
    + struct mem_cgroup_reclaim_iter *iter;
    + struct mem_cgroup_per_zone *mz;
    + int nid, zid;
    + int i;
    +
    + while ((memcg = parent_mem_cgroup(memcg))) {
    + for_each_node(nid) {
    + for (zid = 0; zid < MAX_NR_ZONES; zid++) {
    + mz = &memcg->nodeinfo[nid]->zoneinfo[zid];
    + for (i = 0; i <= DEF_PRIORITY; i++) {
    + iter = &mz->iter[i];
    + cmpxchg(&iter->position,
    + dead_memcg, NULL);
    + }
    + }
    + }
    + }
    +}
    +
    /*
    * Iteration constructs for visiting all cgroups (under a tree). If
    * loops are exited prematurely (break), mem_cgroup_iter_break() must
    @@ -2836,9 +2860,9 @@ static unsigned long tree_stat(struct mem_cgroup *memcg,
    return val;
    }

    -static inline u64 mem_cgroup_usage(struct mem_cgroup *memcg, bool swap)
    +static inline unsigned long mem_cgroup_usage(struct mem_cgroup *memcg, bool swap)
    {
    - u64 val;
    + unsigned long val;

    if (mem_cgroup_is_root(memcg)) {
    val = tree_stat(memcg, MEM_CGROUP_STAT_CACHE);
    @@ -2851,7 +2875,7 @@ static inline u64 mem_cgroup_usage(struct mem_cgroup *memcg, bool swap)
    else
    val = page_counter_read(&memcg->memsw);
    }
    - return val << PAGE_SHIFT;
    + return val;
    }

    enum {
    @@ -2885,9 +2909,9 @@ static u64 mem_cgroup_read_u64(struct cgroup_subsys_state *css,
    switch (MEMFILE_ATTR(cft->private)) {
    case RES_USAGE:
    if (counter == &memcg->memory)
    - return mem_cgroup_usage(memcg, false);
    + return (u64)mem_cgroup_usage(memcg, false) * PAGE_SIZE;
    if (counter == &memcg->memsw)
    - return mem_cgroup_usage(memcg, true);
    + return (u64)mem_cgroup_usage(memcg, true) * PAGE_SIZE;
    return (u64)page_counter_read(counter) * PAGE_SIZE;
    case RES_LIMIT:
    return (u64)counter->limit * PAGE_SIZE;
    @@ -3387,7 +3411,6 @@ static int __mem_cgroup_usage_register_event(struct mem_cgroup *memcg,
    ret = page_counter_memparse(args, "-1", &threshold);
    if (ret)
    return ret;
    - threshold <<= PAGE_SHIFT;

    mutex_lock(&memcg->thresholds_lock);

    @@ -4361,6 +4384,13 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
    wb_memcg_offline(memcg);
    }

    +static void mem_cgroup_css_released(struct cgroup_subsys_state *css)
    +{
    + struct mem_cgroup *memcg = mem_cgroup_from_css(css);
    +
    + invalidate_reclaim_iterators(memcg);
    +}
    +
    static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
    {
    struct mem_cgroup *memcg = mem_cgroup_from_css(css);
    @@ -5217,6 +5247,7 @@ struct cgroup_subsys memory_cgrp_subsys = {
    .css_alloc = mem_cgroup_css_alloc,
    .css_online = mem_cgroup_css_online,
    .css_offline = mem_cgroup_css_offline,
    + .css_released = mem_cgroup_css_released,
    .css_free = mem_cgroup_css_free,
    .css_reset = mem_cgroup_css_reset,
    .can_attach = mem_cgroup_can_attach,
    diff --git a/mm/oom_kill.c b/mm/oom_kill.c
    index 1ecc0bcaecc5..8ad35aa45436 100644
    --- a/mm/oom_kill.c
    +++ b/mm/oom_kill.c
    @@ -554,6 +554,12 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p,

    /* mm cannot safely be dereferenced after task_unlock(victim) */
    mm = victim->mm;
    + /*
    + * We should send SIGKILL before setting TIF_MEMDIE in order to prevent
    + * the OOM victim from depleting the memory reserves from the user
    + * space under its control.
    + */
    + do_send_sig_info(SIGKILL, SEND_SIG_FORCED, victim, true);
    mark_oom_victim(victim);
    pr_err("Killed process %d (%s) total-vm:%lukB, anon-rss:%lukB, file-rss:%lukB\n",
    task_pid_nr(victim), victim->comm, K(victim->mm->total_vm),
    @@ -585,7 +591,6 @@ void oom_kill_process(struct oom_control *oc, struct task_struct *p,
    }
    rcu_read_unlock();

    - do_send_sig_info(SIGKILL, SEND_SIG_FORCED, victim, true);
    put_task_struct(victim);
    }
    #undef K
    diff --git a/mm/slab.c b/mm/slab.c
    index 4fcc5dd8d5a6..461935bab9ef 100644
    --- a/mm/slab.c
    +++ b/mm/slab.c
    @@ -282,6 +282,7 @@ static void kmem_cache_node_init(struct kmem_cache_node *parent)

    #define CFLGS_OFF_SLAB (0x80000000UL)
    #define OFF_SLAB(x) ((x)->flags & CFLGS_OFF_SLAB)
    +#define OFF_SLAB_MIN_SIZE (max_t(size_t, PAGE_SIZE >> 5, KMALLOC_MIN_SIZE + 1))

    #define BATCHREFILL_LIMIT 16
    /*
    @@ -2212,7 +2213,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
    * it too early on. Always use on-slab management when
    * SLAB_NOLEAKTRACE to avoid recursive calls into kmemleak)
    */
    - if ((size >= (PAGE_SIZE >> 5)) && !slab_early_init &&
    + if (size >= OFF_SLAB_MIN_SIZE && !slab_early_init &&
    !(flags & SLAB_NOLEAKTRACE))
    /*
    * Size is large, assume best to place the slab management obj
    @@ -2276,7 +2277,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
    /*
    * This is a possibility for one of the kmalloc_{dma,}_caches.
    * But since we go off slab only for object size greater than
    - * PAGE_SIZE/8, and kmalloc_{dma,}_caches get created
    + * OFF_SLAB_MIN_SIZE, and kmalloc_{dma,}_caches get created
    * in ascending order,this should not happen at all.
    * But leave a BUG_ON for some lucky dude.
    */
    diff --git a/mm/vmstat.c b/mm/vmstat.c
    index fbf14485a049..34444706a3a7 100644
    --- a/mm/vmstat.c
    +++ b/mm/vmstat.c
    @@ -1357,6 +1357,7 @@ static const struct file_operations proc_vmstat_file_operations = {
    #endif /* CONFIG_PROC_FS */

    #ifdef CONFIG_SMP
    +static struct workqueue_struct *vmstat_wq;
    static DEFINE_PER_CPU(struct delayed_work, vmstat_work);
    int sysctl_stat_interval __read_mostly = HZ;
    static cpumask_var_t cpu_stat_off;
    @@ -1369,7 +1370,7 @@ static void vmstat_update(struct work_struct *w)
    * to occur in the future. Keep on running the
    * update worker thread.
    */
    - schedule_delayed_work_on(smp_processor_id(),
    + queue_delayed_work_on(smp_processor_id(), vmstat_wq,
    this_cpu_ptr(&vmstat_work),
    round_jiffies_relative(sysctl_stat_interval));
    } else {
    @@ -1438,7 +1439,7 @@ static void vmstat_shepherd(struct work_struct *w)
    if (need_update(cpu) &&
    cpumask_test_and_clear_cpu(cpu, cpu_stat_off))

    - schedule_delayed_work_on(cpu,
    + queue_delayed_work_on(cpu, vmstat_wq,
    &per_cpu(vmstat_work, cpu), 0);

    put_online_cpus();
    @@ -1527,6 +1528,7 @@ static int __init setup_vmstat(void)

    start_shepherd_timer();
    cpu_notifier_register_done();
    + vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
    #endif
    #ifdef CONFIG_PROC_FS
    proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
    diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
    index f135b1b6fcdc..3734fc4d2e74 100644
    --- a/mm/zsmalloc.c
    +++ b/mm/zsmalloc.c
    @@ -304,7 +304,12 @@ static void free_handle(struct zs_pool *pool, unsigned long handle)

    static void record_obj(unsigned long handle, unsigned long obj)
    {
    - *(unsigned long *)handle = obj;
    + /*
    + * lsb of @obj represents handle lock while other bits
    + * represent object value the handle is pointing so
    + * updating shouldn't do store tearing.
    + */
    + WRITE_ONCE(*(unsigned long *)handle, obj);
    }

    /* zpool driver */
    @@ -1629,6 +1634,13 @@ static int migrate_zspage(struct zs_pool *pool, struct size_class *class,
    free_obj = obj_malloc(d_page, class, handle);
    zs_object_copy(free_obj, used_obj, class);
    index++;
    + /*
    + * record_obj updates handle's value to free_obj and it will
    + * invalidate lock bit(ie, HANDLE_PIN_BIT) of handle, which
    + * breaks synchronization using pin_tag(e,g, zs_free) so
    + * let's keep the lock bit.
    + */
    + free_obj |= BIT(HANDLE_PIN_BIT);
    record_obj(handle, free_obj);
    unpin_tag(handle);
    obj_free(pool, class, used_obj);
    diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
    index 36fb6b527829..5be9ffbe90ba 100644
    --- a/security/integrity/digsig.c
    +++ b/security/integrity/digsig.c
    @@ -105,7 +105,7 @@ int __init integrity_load_x509(const unsigned int id, const char *path)
    rc,
    ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
    KEY_USR_VIEW | KEY_USR_READ),
    - KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_TRUSTED);
    + KEY_ALLOC_NOT_IN_QUOTA);
    if (IS_ERR(key)) {
    rc = PTR_ERR(key);
    pr_err("Problem loading X.509 certificate (%d): %s\n",
    diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
    index 1334e02ae8f4..3d145a3ffccf 100644
    --- a/security/integrity/evm/evm_main.c
    +++ b/security/integrity/evm/evm_main.c
    @@ -23,6 +23,7 @@
    #include <linux/integrity.h>
    #include <linux/evm.h>
    #include <crypto/hash.h>
    +#include <crypto/algapi.h>
    #include "evm.h"

    int evm_initialized;
    @@ -148,7 +149,7 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
    xattr_value_len, calc.digest);
    if (rc)
    break;
    - rc = memcmp(xattr_data->digest, calc.digest,
    + rc = crypto_memneq(xattr_data->digest, calc.digest,
    sizeof(calc.digest));
    if (rc)
    rc = -EINVAL;
    diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
    index b123c42e7dc8..b554d7f9e3be 100644
    --- a/sound/core/compress_offload.c
    +++ b/sound/core/compress_offload.c
    @@ -44,6 +44,13 @@
    #include <sound/compress_offload.h>
    #include <sound/compress_driver.h>

    +/* struct snd_compr_codec_caps overflows the ioctl bit size for some
    + * architectures, so we need to disable the relevant ioctls.
    + */
    +#if _IOC_SIZEBITS < 14
    +#define COMPR_CODEC_CAPS_OVERFLOW
    +#endif
    +
    /* TODO:
    * - add substream support for multiple devices in case of
    * SND_DYNAMIC_MINORS is not used
    @@ -438,6 +445,7 @@ out:
    return retval;
    }

    +#ifndef COMPR_CODEC_CAPS_OVERFLOW
    static int
    snd_compr_get_codec_caps(struct snd_compr_stream *stream, unsigned long arg)
    {
    @@ -461,6 +469,7 @@ out:
    kfree(caps);
    return retval;
    }
    +#endif /* !COMPR_CODEC_CAPS_OVERFLOW */

    /* revisit this with snd_pcm_preallocate_xxx */
    static int snd_compr_allocate_buffer(struct snd_compr_stream *stream,
    @@ -799,9 +808,11 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
    case _IOC_NR(SNDRV_COMPRESS_GET_CAPS):
    retval = snd_compr_get_caps(stream, arg);
    break;
    +#ifndef COMPR_CODEC_CAPS_OVERFLOW
    case _IOC_NR(SNDRV_COMPRESS_GET_CODEC_CAPS):
    retval = snd_compr_get_codec_caps(stream, arg);
    break;
    +#endif
    case _IOC_NR(SNDRV_COMPRESS_SET_PARAMS):
    retval = snd_compr_set_params(stream, arg);
    break;
    diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
    index 58550cc93f28..33e72c809e50 100644
    --- a/sound/core/oss/pcm_oss.c
    +++ b/sound/core/oss/pcm_oss.c
    @@ -834,7 +834,8 @@ static int choose_rate(struct snd_pcm_substream *substream,
    return snd_pcm_hw_param_near(substream, params, SNDRV_PCM_HW_PARAM_RATE, best_rate, NULL);
    }

    -static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream)
    +static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream,
    + bool trylock)
    {
    struct snd_pcm_runtime *runtime = substream->runtime;
    struct snd_pcm_hw_params *params, *sparams;
    @@ -848,7 +849,10 @@ static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream)
    struct snd_mask sformat_mask;
    struct snd_mask mask;

    - if (mutex_lock_interruptible(&runtime->oss.params_lock))
    + if (trylock) {
    + if (!(mutex_trylock(&runtime->oss.params_lock)))
    + return -EAGAIN;
    + } else if (mutex_lock_interruptible(&runtime->oss.params_lock))
    return -EINTR;
    sw_params = kmalloc(sizeof(*sw_params), GFP_KERNEL);
    params = kmalloc(sizeof(*params), GFP_KERNEL);
    @@ -1092,7 +1096,7 @@ static int snd_pcm_oss_get_active_substream(struct snd_pcm_oss_file *pcm_oss_fil
    if (asubstream == NULL)
    asubstream = substream;
    if (substream->runtime->oss.params) {
    - err = snd_pcm_oss_change_params(substream);
    + err = snd_pcm_oss_change_params(substream, false);
    if (err < 0)
    return err;
    }
    @@ -1132,7 +1136,7 @@ static int snd_pcm_oss_make_ready(struct snd_pcm_substream *substream)
    return 0;
    runtime = substream->runtime;
    if (runtime->oss.params) {
    - err = snd_pcm_oss_change_params(substream);
    + err = snd_pcm_oss_change_params(substream, false);
    if (err < 0)
    return err;
    }
    @@ -2163,7 +2167,7 @@ static int snd_pcm_oss_get_space(struct snd_pcm_oss_file *pcm_oss_file, int stre
    runtime = substream->runtime;

    if (runtime->oss.params &&
    - (err = snd_pcm_oss_change_params(substream)) < 0)
    + (err = snd_pcm_oss_change_params(substream, false)) < 0)
    return err;

    info.fragsize = runtime->oss.period_bytes;
    @@ -2800,7 +2804,12 @@ static int snd_pcm_oss_mmap(struct file *file, struct vm_area_struct *area)
    return -EIO;

    if (runtime->oss.params) {
    - if ((err = snd_pcm_oss_change_params(substream)) < 0)
    + /* use mutex_trylock() for params_lock for avoiding a deadlock
    + * between mmap_sem and params_lock taken by
    + * copy_from/to_user() in snd_pcm_oss_write/read()
    + */
    + err = snd_pcm_oss_change_params(substream, true);
    + if (err < 0)
    return err;
    }
    #ifdef CONFIG_SND_PCM_OSS_PLUGINS
    diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
    index a7759846fbaa..795437b10082 100644
    --- a/sound/core/rawmidi.c
    +++ b/sound/core/rawmidi.c
    @@ -942,31 +942,36 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
    unsigned long flags;
    long result = 0, count1;
    struct snd_rawmidi_runtime *runtime = substream->runtime;
    + unsigned long appl_ptr;

    + spin_lock_irqsave(&runtime->lock, flags);
    while (count > 0 && runtime->avail) {
    count1 = runtime->buffer_size - runtime->appl_ptr;
    if (count1 > count)
    count1 = count;
    - spin_lock_irqsave(&runtime->lock, flags);
    if (count1 > (int)runtime->avail)
    count1 = runtime->avail;
    +
    + /* update runtime->appl_ptr before unlocking for userbuf */
    + appl_ptr = runtime->appl_ptr;
    + runtime->appl_ptr += count1;
    + runtime->appl_ptr %= runtime->buffer_size;
    + runtime->avail -= count1;
    +
    if (kernelbuf)
    - memcpy(kernelbuf + result, runtime->buffer + runtime->appl_ptr, count1);
    + memcpy(kernelbuf + result, runtime->buffer + appl_ptr, count1);
    if (userbuf) {
    spin_unlock_irqrestore(&runtime->lock, flags);
    if (copy_to_user(userbuf + result,
    - runtime->buffer + runtime->appl_ptr, count1)) {
    + runtime->buffer + appl_ptr, count1)) {
    return result > 0 ? result : -EFAULT;
    }
    spin_lock_irqsave(&runtime->lock, flags);
    }
    - runtime->appl_ptr += count1;
    - runtime->appl_ptr %= runtime->buffer_size;
    - runtime->avail -= count1;
    - spin_unlock_irqrestore(&runtime->lock, flags);
    result += count1;
    count -= count1;
    }
    + spin_unlock_irqrestore(&runtime->lock, flags);
    return result;
    }

    @@ -1055,23 +1060,16 @@ int snd_rawmidi_transmit_empty(struct snd_rawmidi_substream *substream)
    EXPORT_SYMBOL(snd_rawmidi_transmit_empty);

    /**
    - * snd_rawmidi_transmit_peek - copy data from the internal buffer
    + * __snd_rawmidi_transmit_peek - copy data from the internal buffer
    * @substream: the rawmidi substream
    * @buffer: the buffer pointer
    * @count: data size to transfer
    *
    - * Copies data from the internal output buffer to the given buffer.
    - *
    - * Call this in the interrupt handler when the midi output is ready,
    - * and call snd_rawmidi_transmit_ack() after the transmission is
    - * finished.
    - *
    - * Return: The size of copied data, or a negative error code on failure.
    + * This is a variant of snd_rawmidi_transmit_peek() without spinlock.
    */
    -int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
    +int __snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
    unsigned char *buffer, int count)
    {
    - unsigned long flags;
    int result, count1;
    struct snd_rawmidi_runtime *runtime = substream->runtime;

    @@ -1081,7 +1079,6 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
    return -EINVAL;
    }
    result = 0;
    - spin_lock_irqsave(&runtime->lock, flags);
    if (runtime->avail >= runtime->buffer_size) {
    /* warning: lowlevel layer MUST trigger down the hardware */
    goto __skip;
    @@ -1106,25 +1103,47 @@ int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
    }
    }
    __skip:
    + return result;
    +}
    +EXPORT_SYMBOL(__snd_rawmidi_transmit_peek);
    +
    +/**
    + * snd_rawmidi_transmit_peek - copy data from the internal buffer
    + * @substream: the rawmidi substream
    + * @buffer: the buffer pointer
    + * @count: data size to transfer
    + *
    + * Copies data from the internal output buffer to the given buffer.
    + *
    + * Call this in the interrupt handler when the midi output is ready,
    + * and call snd_rawmidi_transmit_ack() after the transmission is
    + * finished.
    + *
    + * Return: The size of copied data, or a negative error code on failure.
    + */
    +int snd_rawmidi_transmit_peek(struct snd_rawmidi_substream *substream,
    + unsigned char *buffer, int count)
    +{
    + struct snd_rawmidi_runtime *runtime = substream->runtime;
    + int result;
    + unsigned long flags;
    +
    + spin_lock_irqsave(&runtime->lock, flags);
    + result = __snd_rawmidi_transmit_peek(substream, buffer, count);
    spin_unlock_irqrestore(&runtime->lock, flags);
    return result;
    }
    EXPORT_SYMBOL(snd_rawmidi_transmit_peek);

    /**
    - * snd_rawmidi_transmit_ack - acknowledge the transmission
    + * __snd_rawmidi_transmit_ack - acknowledge the transmission
    * @substream: the rawmidi substream
    * @count: the transferred count
    *
    - * Advances the hardware pointer for the internal output buffer with
    - * the given size and updates the condition.
    - * Call after the transmission is finished.
    - *
    - * Return: The advanced size if successful, or a negative error code on failure.
    + * This is a variant of __snd_rawmidi_transmit_ack() without spinlock.
    */
    -int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
    +int __snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
    {
    - unsigned long flags;
    struct snd_rawmidi_runtime *runtime = substream->runtime;

    if (runtime->buffer == NULL) {
    @@ -1132,7 +1151,6 @@ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
    "snd_rawmidi_transmit_ack: output is not active!!!\n");
    return -EINVAL;
    }
    - spin_lock_irqsave(&runtime->lock, flags);
    snd_BUG_ON(runtime->avail + count > runtime->buffer_size);
    runtime->hw_ptr += count;
    runtime->hw_ptr %= runtime->buffer_size;
    @@ -1142,9 +1160,32 @@ int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
    if (runtime->drain || snd_rawmidi_ready(substream))
    wake_up(&runtime->sleep);
    }
    - spin_unlock_irqrestore(&runtime->lock, flags);
    return count;
    }
    +EXPORT_SYMBOL(__snd_rawmidi_transmit_ack);
    +
    +/**
    + * snd_rawmidi_transmit_ack - acknowledge the transmission
    + * @substream: the rawmidi substream
    + * @count: the transferred count
    + *
    + * Advances the hardware pointer for the internal output buffer with
    + * the given size and updates the condition.
    + * Call after the transmission is finished.
    + *
    + * Return: The advanced size if successful, or a negative error code on failure.
    + */
    +int snd_rawmidi_transmit_ack(struct snd_rawmidi_substream *substream, int count)
    +{
    + struct snd_rawmidi_runtime *runtime = substream->runtime;
    + int result;
    + unsigned long flags;
    +
    + spin_lock_irqsave(&runtime->lock, flags);
    + result = __snd_rawmidi_transmit_ack(substream, count);
    + spin_unlock_irqrestore(&runtime->lock, flags);
    + return result;
    +}
    EXPORT_SYMBOL(snd_rawmidi_transmit_ack);

    /**
    @@ -1160,12 +1201,22 @@ EXPORT_SYMBOL(snd_rawmidi_transmit_ack);
    int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
    unsigned char *buffer, int count)
    {
    + struct snd_rawmidi_runtime *runtime = substream->runtime;
    + int result;
    + unsigned long flags;
    +
    + spin_lock_irqsave(&runtime->lock, flags);
    if (!substream->opened)
    - return -EBADFD;
    - count = snd_rawmidi_transmit_peek(substream, buffer, count);
    - if (count < 0)
    - return count;
    - return snd_rawmidi_transmit_ack(substream, count);
    + result = -EBADFD;
    + else {
    + count = __snd_rawmidi_transmit_peek(substream, buffer, count);
    + if (count <= 0)
    + result = count;
    + else
    + result = __snd_rawmidi_transmit_ack(substream, count);
    + }
    + spin_unlock_irqrestore(&runtime->lock, flags);
    + return result;
    }
    EXPORT_SYMBOL(snd_rawmidi_transmit);

    @@ -1177,8 +1228,9 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
    unsigned long flags;
    long count1, result;
    struct snd_rawmidi_runtime *runtime = substream->runtime;
    + unsigned long appl_ptr;

    - if (snd_BUG_ON(!kernelbuf && !userbuf))
    + if (!kernelbuf && !userbuf)
    return -EINVAL;
    if (snd_BUG_ON(!runtime->buffer))
    return -EINVAL;
    @@ -1197,12 +1249,19 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
    count1 = count;
    if (count1 > (long)runtime->avail)
    count1 = runtime->avail;
    +
    + /* update runtime->appl_ptr before unlocking for userbuf */
    + appl_ptr = runtime->appl_ptr;
    + runtime->appl_ptr += count1;
    + runtime->appl_ptr %= runtime->buffer_size;
    + runtime->avail -= count1;
    +
    if (kernelbuf)
    - memcpy(runtime->buffer + runtime->appl_ptr,
    + memcpy(runtime->buffer + appl_ptr,
    kernelbuf + result, count1);
    else if (userbuf) {
    spin_unlock_irqrestore(&runtime->lock, flags);
    - if (copy_from_user(runtime->buffer + runtime->appl_ptr,
    + if (copy_from_user(runtime->buffer + appl_ptr,
    userbuf + result, count1)) {
    spin_lock_irqsave(&runtime->lock, flags);
    result = result > 0 ? result : -EFAULT;
    @@ -1210,9 +1269,6 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream,
    }
    spin_lock_irqsave(&runtime->lock, flags);
    }
    - runtime->appl_ptr += count1;
    - runtime->appl_ptr %= runtime->buffer_size;
    - runtime->avail -= count1;
    result += count1;
    count -= count1;
    }
    diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
    index b1221b29728e..6779e82b46dd 100644
    --- a/sound/core/seq/oss/seq_oss_init.c
    +++ b/sound/core/seq/oss/seq_oss_init.c
    @@ -202,7 +202,7 @@ snd_seq_oss_open(struct file *file, int level)

    dp->index = i;
    if (i >= SNDRV_SEQ_OSS_MAX_CLIENTS) {
    - pr_err("ALSA: seq_oss: too many applications\n");
    + pr_debug("ALSA: seq_oss: too many applications\n");
    rc = -ENOMEM;
    goto _error;
    }
    diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
    index 0f3b38184fe5..b16dbef04174 100644
    --- a/sound/core/seq/oss/seq_oss_synth.c
    +++ b/sound/core/seq/oss/seq_oss_synth.c
    @@ -308,7 +308,7 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp)
    struct seq_oss_synth *rec;
    struct seq_oss_synthinfo *info;

    - if (snd_BUG_ON(dp->max_synthdev >= SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
    + if (snd_BUG_ON(dp->max_synthdev > SNDRV_SEQ_OSS_MAX_SYNTH_DEVS))
    return;
    for (i = 0; i < dp->max_synthdev; i++) {
    info = &dp->synths[i];
    diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
    index 13cfa815732d..58e79e02f217 100644
    --- a/sound/core/seq/seq_clientmgr.c
    +++ b/sound/core/seq/seq_clientmgr.c
    @@ -678,6 +678,9 @@ static int deliver_to_subscribers(struct snd_seq_client *client,
    else
    down_read(&grp->list_mutex);
    list_for_each_entry(subs, &grp->list_head, src_list) {
    + /* both ports ready? */
    + if (atomic_read(&subs->ref_count) != 2)
    + continue;
    event->dest = subs->info.dest;
    if (subs->info.flags & SNDRV_SEQ_PORT_SUBS_TIMESTAMP)
    /* convert time according to flag with subscription */
    diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
    index 55170a20ae72..921fb2bd8fad 100644
    --- a/sound/core/seq/seq_ports.c
    +++ b/sound/core/seq/seq_ports.c
    @@ -173,10 +173,6 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
    }

    /* */
    -enum group_type {
    - SRC_LIST, DEST_LIST
    -};
    -
    static int subscribe_port(struct snd_seq_client *client,
    struct snd_seq_client_port *port,
    struct snd_seq_port_subs_info *grp,
    @@ -203,6 +199,20 @@ static struct snd_seq_client_port *get_client_port(struct snd_seq_addr *addr,
    return NULL;
    }

    +static void delete_and_unsubscribe_port(struct snd_seq_client *client,
    + struct snd_seq_client_port *port,
    + struct snd_seq_subscribers *subs,
    + bool is_src, bool ack);
    +
    +static inline struct snd_seq_subscribers *
    +get_subscriber(struct list_head *p, bool is_src)
    +{
    + if (is_src)
    + return list_entry(p, struct snd_seq_subscribers, src_list);
    + else
    + return list_entry(p, struct snd_seq_subscribers, dest_list);
    +}
    +
    /*
    * remove all subscribers on the list
    * this is called from port_delete, for each src and dest list.
    @@ -210,7 +220,7 @@ static struct snd_seq_client_port *get_client_port(struct snd_seq_addr *addr,
    static void clear_subscriber_list(struct snd_seq_client *client,
    struct snd_seq_client_port *port,
    struct snd_seq_port_subs_info *grp,
    - int grptype)
    + int is_src)
    {
    struct list_head *p, *n;

    @@ -219,15 +229,13 @@ static void clear_subscriber_list(struct snd_seq_client *client,
    struct snd_seq_client *c;
    struct snd_seq_client_port *aport;

    - if (grptype == SRC_LIST) {
    - subs = list_entry(p, struct snd_seq_subscribers, src_list);
    + subs = get_subscriber(p, is_src);
    + if (is_src)
    aport = get_client_port(&subs->info.dest, &c);
    - } else {
    - subs = list_entry(p, struct snd_seq_subscribers, dest_list);
    + else
    aport = get_client_port(&subs->info.sender, &c);
    - }
    - list_del(p);
    - unsubscribe_port(client, port, grp, &subs->info, 0);
    + delete_and_unsubscribe_port(client, port, subs, is_src, false);
    +
    if (!aport) {
    /* looks like the connected port is being deleted.
    * we decrease the counter, and when both ports are deleted
    @@ -235,21 +243,14 @@ static void clear_subscriber_list(struct snd_seq_client *client,
    */
    if (atomic_dec_and_test(&subs->ref_count))
    kfree(subs);
    - } else {
    - /* ok we got the connected port */
    - struct snd_seq_port_subs_info *agrp;
    - agrp = (grptype == SRC_LIST) ? &aport->c_dest : &aport->c_src;
    - down_write(&agrp->list_mutex);
    - if (grptype == SRC_LIST)
    - list_del(&subs->dest_list);
    - else
    - list_del(&subs->src_list);
    - up_write(&agrp->list_mutex);
    - unsubscribe_port(c, aport, agrp, &subs->info, 1);
    - kfree(subs);
    - snd_seq_port_unlock(aport);
    - snd_seq_client_unlock(c);
    + continue;
    }
    +
    + /* ok we got the connected port */
    + delete_and_unsubscribe_port(c, aport, subs, !is_src, true);
    + kfree(subs);
    + snd_seq_port_unlock(aport);
    + snd_seq_client_unlock(c);
    }
    }

    @@ -262,8 +263,8 @@ static int port_delete(struct snd_seq_client *client,
    snd_use_lock_sync(&port->use_lock);

    /* clear subscribers info */
    - clear_subscriber_list(client, port, &port->c_src, SRC_LIST);
    - clear_subscriber_list(client, port, &port->c_dest, DEST_LIST);
    + clear_subscriber_list(client, port, &port->c_src, true);
    + clear_subscriber_list(client, port, &port->c_dest, false);

    if (port->private_free)
    port->private_free(port->private_data);
    @@ -479,85 +480,120 @@ static int match_subs_info(struct snd_seq_port_subscribe *r,
    return 0;
    }

    -
    -/* connect two ports */
    -int snd_seq_port_connect(struct snd_seq_client *connector,
    - struct snd_seq_client *src_client,
    - struct snd_seq_client_port *src_port,
    - struct snd_seq_client *dest_client,
    - struct snd_seq_client_port *dest_port,
    - struct snd_seq_port_subscribe *info)
    +static int check_and_subscribe_port(struct snd_seq_client *client,
    + struct snd_seq_client_port *port,
    + struct snd_seq_subscribers *subs,
    + bool is_src, bool exclusive, bool ack)
    {
    - struct snd_seq_port_subs_info *src = &src_port->c_src;
    - struct snd_seq_port_subs_info *dest = &dest_port->c_dest;
    - struct snd_seq_subscribers *subs, *s;
    - int err, src_called = 0;
    - unsigned long flags;
    - int exclusive;
    + struct snd_seq_port_subs_info *grp;
    + struct list_head *p;
    + struct snd_seq_subscribers *s;
    + int err;

    - subs = kzalloc(sizeof(*subs), GFP_KERNEL);
    - if (! subs)
    - return -ENOMEM;
    -
    - subs->info = *info;
    - atomic_set(&subs->ref_count, 2);
    -
    - down_write(&src->list_mutex);
    - down_write_nested(&dest->list_mutex, SINGLE_DEPTH_NESTING);
    -
    - exclusive = info->flags & SNDRV_SEQ_PORT_SUBS_EXCLUSIVE ? 1 : 0;
    + grp = is_src ? &port->c_src : &port->c_dest;
    err = -EBUSY;
    + down_write(&grp->list_mutex);
    if (exclusive) {
    - if (! list_empty(&src->list_head) || ! list_empty(&dest->list_head))
    + if (!list_empty(&grp->list_head))
    goto __error;
    } else {
    - if (src->exclusive || dest->exclusive)
    + if (grp->exclusive)
    goto __error;
    /* check whether already exists */
    - list_for_each_entry(s, &src->list_head, src_list) {
    - if (match_subs_info(info, &s->info))
    - goto __error;
    - }
    - list_for_each_entry(s, &dest->list_head, dest_list) {
    - if (match_subs_info(info, &s->info))
    + list_for_each(p, &grp->list_head) {
    + s = get_subscriber(p, is_src);
    + if (match_subs_info(&subs->info, &s->info))
    goto __error;
    }
    }

    - if ((err = subscribe_port(src_client, src_port, src, info,
    - connector->number != src_client->number)) < 0)
    - goto __error;
    - src_called = 1;
    -
    - if ((err = subscribe_port(dest_client, dest_port, dest, info,
    - connector->number != dest_client->number)) < 0)
    + err = subscribe_port(client, port, grp, &subs->info, ack);
    + if (err < 0) {
    + grp->exclusive = 0;
    goto __error;
    + }

    /* add to list */
    - write_lock_irqsave(&src->list_lock, flags);
    - // write_lock(&dest->list_lock); // no other lock yet
    - list_add_tail(&subs->src_list, &src->list_head);
    - list_add_tail(&subs->dest_list, &dest->list_head);
    - // write_unlock(&dest->list_lock); // no other lock yet
    - write_unlock_irqrestore(&src->list_lock, flags);
    + write_lock_irq(&grp->list_lock);
    + if (is_src)
    + list_add_tail(&subs->src_list, &grp->list_head);
    + else
    + list_add_tail(&subs->dest_list, &grp->list_head);
    + grp->exclusive = exclusive;
    + atomic_inc(&subs->ref_count);
    + write_unlock_irq(&grp->list_lock);
    + err = 0;
    +
    + __error:
    + up_write(&grp->list_mutex);
    + return err;
    +}

    - src->exclusive = dest->exclusive = exclusive;
    +static void delete_and_unsubscribe_port(struct snd_seq_client *client,
    + struct snd_seq_client_port *port,
    + struct snd_seq_subscribers *subs,
    + bool is_src, bool ack)
    +{
    + struct snd_seq_port_subs_info *grp;
    +
    + grp = is_src ? &port->c_src : &port->c_dest;
    + down_write(&grp->list_mutex);
    + write_lock_irq(&grp->list_lock);
    + if (is_src)
    + list_del(&subs->src_list);
    + else
    + list_del(&subs->dest_list);
    + grp->exclusive = 0;
    + write_unlock_irq(&grp->list_lock);
    + up_write(&grp->list_mutex);
    +
    + unsubscribe_port(client, port, grp, &subs->info, ack);
    +}
    +
    +/* connect two ports */
    +int snd_seq_port_connect(struct snd_seq_client *connector,
    + struct snd_seq_client *src_client,
    + struct snd_seq_client_port *src_port,
    + struct snd_seq_client *dest_client,
    + struct snd_seq_client_port *dest_port,
    + struct snd_seq_port_subscribe *info)
    +{
    + struct snd_seq_subscribers *subs;
    + bool exclusive;
    + int err;
    +
    + subs = kzalloc(sizeof(*subs), GFP_KERNEL);
    + if (!subs)
    + return -ENOMEM;
    +
    + subs->info = *info;
    + atomic_set(&subs->ref_count, 0);
    + INIT_LIST_HEAD(&subs->src_list);
    + INIT_LIST_HEAD(&subs->dest_list);
    +
    + exclusive = !!(info->flags & SNDRV_SEQ_PORT_SUBS_EXCLUSIVE);
    +
    + err = check_and_subscribe_port(src_client, src_port, subs, true,
    + exclusive,
    + connector->number != src_client->number);
    + if (err < 0)
    + goto error;
    + err = check_and_subscribe_port(dest_client, dest_port, subs, false,
    + exclusive,
    + connector->number != dest_client->number);
    + if (err < 0)
    + goto error_dest;

    - up_write(&dest->list_mutex);
    - up_write(&src->list_mutex);
    return 0;

    - __error:
    - if (src_called)
    - unsubscribe_port(src_client, src_port, src, info,
    - connector->number != src_client->number);
    + error_dest:
    + delete_and_unsubscribe_port(src_client, src_port, subs, true,
    + connector->number != src_client->number);
    + error:
    kfree(subs);
    - up_write(&dest->list_mutex);
    - up_write(&src->list_mutex);
    return err;
    }

    -
    /* remove the connection */
    int snd_seq_port_disconnect(struct snd_seq_client *connector,
    struct snd_seq_client *src_client,
    @@ -567,37 +603,28 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector,
    struct snd_seq_port_subscribe *info)
    {
    struct snd_seq_port_subs_info *src = &src_port->c_src;
    - struct snd_seq_port_subs_info *dest = &dest_port->c_dest;
    struct snd_seq_subscribers *subs;
    int err = -ENOENT;
    - unsigned long flags;

    down_write(&src->list_mutex);
    - down_write_nested(&dest->list_mutex, SINGLE_DEPTH_NESTING);
    -
    /* look for the connection */
    list_for_each_entry(subs, &src->list_head, src_list) {
    if (match_subs_info(info, &subs->info)) {
    - write_lock_irqsave(&src->list_lock, flags);
    - // write_lock(&dest->list_lock); // no lock yet
    - list_del(&subs->src_list);
    - list_del(&subs->dest_list);
    - // write_unlock(&dest->list_lock);
    - write_unlock_irqrestore(&src->list_lock, flags);
    - src->exclusive = dest->exclusive = 0;
    - unsubscribe_port(src_client, src_port, src, info,
    - connector->number != src_client->number);
    - unsubscribe_port(dest_client, dest_port, dest, info,
    - connector->number != dest_client->number);
    - kfree(subs);
    + atomic_dec(&subs->ref_count); /* mark as not ready */
    err = 0;
    break;
    }
    }
    -
    - up_write(&dest->list_mutex);
    up_write(&src->list_mutex);
    - return err;
    + if (err < 0)
    + return err;
    +
    + delete_and_unsubscribe_port(src_client, src_port, subs, true,
    + connector->number != src_client->number);
    + delete_and_unsubscribe_port(dest_client, dest_port, subs, false,
    + connector->number != dest_client->number);
    + kfree(subs);
    + return 0;
    }


    diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
    index 82b220c769c1..293104926098 100644
    --- a/sound/core/seq/seq_timer.c
    +++ b/sound/core/seq/seq_timer.c
    @@ -90,6 +90,9 @@ void snd_seq_timer_delete(struct snd_seq_timer **tmr)

    void snd_seq_timer_defaults(struct snd_seq_timer * tmr)
    {
    + unsigned long flags;
    +
    + spin_lock_irqsave(&tmr->lock, flags);
    /* setup defaults */
    tmr->ppq = 96; /* 96 PPQ */
    tmr->tempo = 500000; /* 120 BPM */
    @@ -105,21 +108,25 @@ void snd_seq_timer_defaults(struct snd_seq_timer * tmr)
    tmr->preferred_resolution = seq_default_timer_resolution;

    tmr->skew = tmr->skew_base = SKEW_BASE;
    + spin_unlock_irqrestore(&tmr->lock, flags);
    }

    -void snd_seq_timer_reset(struct snd_seq_timer * tmr)
    +static void seq_timer_reset(struct snd_seq_timer *tmr)
    {
    - unsigned long flags;
    -
    - spin_lock_irqsave(&tmr->lock, flags);
    -
    /* reset time & songposition */
    tmr->cur_time.tv_sec = 0;
    tmr->cur_time.tv_nsec = 0;

    tmr->tick.cur_tick = 0;
    tmr->tick.fraction = 0;
    +}
    +
    +void snd_seq_timer_reset(struct snd_seq_timer *tmr)
    +{
    + unsigned long flags;

    + spin_lock_irqsave(&tmr->lock, flags);
    + seq_timer_reset(tmr);
    spin_unlock_irqrestore(&tmr->lock, flags);
    }

    @@ -138,8 +145,11 @@ static void snd_seq_timer_interrupt(struct snd_timer_instance *timeri,
    tmr = q->timer;
    if (tmr == NULL)
    return;
    - if (!tmr->running)
    + spin_lock_irqsave(&tmr->lock, flags);
    + if (!tmr->running) {
    + spin_unlock_irqrestore(&tmr->lock, flags);
    return;
    + }

    resolution *= ticks;
    if (tmr->skew != tmr->skew_base) {
    @@ -148,8 +158,6 @@ static void snd_seq_timer_interrupt(struct snd_timer_instance *timeri,
    (((resolution & 0xffff) * tmr->skew) >> 16);
    }

    - spin_lock_irqsave(&tmr->lock, flags);
    -
    /* update timer */
    snd_seq_inc_time_nsec(&tmr->cur_time, resolution);

    @@ -296,26 +304,30 @@ int snd_seq_timer_open(struct snd_seq_queue *q)
    t->callback = snd_seq_timer_interrupt;
    t->callback_data = q;
    t->flags |= SNDRV_TIMER_IFLG_AUTO;
    + spin_lock_irq(&tmr->lock);
    tmr->timeri = t;
    + spin_unlock_irq(&tmr->lock);
    return 0;
    }

    int snd_seq_timer_close(struct snd_seq_queue *q)
    {
    struct snd_seq_timer *tmr;
    + struct snd_timer_instance *t;

    tmr = q->timer;
    if (snd_BUG_ON(!tmr))
    return -EINVAL;
    - if (tmr->timeri) {
    - snd_timer_stop(tmr->timeri);
    - snd_timer_close(tmr->timeri);
    - tmr->timeri = NULL;
    - }
    + spin_lock_irq(&tmr->lock);
    + t = tmr->timeri;
    + tmr->timeri = NULL;
    + spin_unlock_irq(&tmr->lock);
    + if (t)
    + snd_timer_close(t);
    return 0;
    }

    -int snd_seq_timer_stop(struct snd_seq_timer * tmr)
    +static int seq_timer_stop(struct snd_seq_timer *tmr)
    {
    if (! tmr->timeri)
    return -EINVAL;
    @@ -326,6 +338,17 @@ int snd_seq_timer_stop(struct snd_seq_timer * tmr)
    return 0;
    }

    +int snd_seq_timer_stop(struct snd_seq_timer *tmr)
    +{
    + unsigned long flags;
    + int err;
    +
    + spin_lock_irqsave(&tmr->lock, flags);
    + err = seq_timer_stop(tmr);
    + spin_unlock_irqrestore(&tmr->lock, flags);
    + return err;
    +}
    +
    static int initialize_timer(struct snd_seq_timer *tmr)
    {
    struct snd_timer *t;
    @@ -358,13 +381,13 @@ static int initialize_timer(struct snd_seq_timer *tmr)
    return 0;
    }

    -int snd_seq_timer_start(struct snd_seq_timer * tmr)
    +static int seq_timer_start(struct snd_seq_timer *tmr)
    {
    if (! tmr->timeri)
    return -EINVAL;
    if (tmr->running)
    - snd_seq_timer_stop(tmr);
    - snd_seq_timer_reset(tmr);
    + seq_timer_stop(tmr);
    + seq_timer_reset(tmr);
    if (initialize_timer(tmr) < 0)
    return -EINVAL;
    snd_timer_start(tmr->timeri, tmr->ticks);
    @@ -373,14 +396,25 @@ int snd_seq_timer_start(struct snd_seq_timer * tmr)
    return 0;
    }

    -int snd_seq_timer_continue(struct snd_seq_timer * tmr)
    +int snd_seq_timer_start(struct snd_seq_timer *tmr)
    +{
    + unsigned long flags;
    + int err;
    +
    + spin_lock_irqsave(&tmr->lock, flags);
    + err = seq_timer_start(tmr);
    + spin_unlock_irqrestore(&tmr->lock, flags);
    + return err;
    +}
    +
    +static int seq_timer_continue(struct snd_seq_timer *tmr)
    {
    if (! tmr->timeri)
    return -EINVAL;
    if (tmr->running)
    return -EBUSY;
    if (! tmr->initialized) {
    - snd_seq_timer_reset(tmr);
    + seq_timer_reset(tmr);
    if (initialize_timer(tmr) < 0)
    return -EINVAL;
    }
    @@ -390,11 +424,24 @@ int snd_seq_timer_continue(struct snd_seq_timer * tmr)
    return 0;
    }

    +int snd_seq_timer_continue(struct snd_seq_timer *tmr)
    +{
    + unsigned long flags;
    + int err;
    +
    + spin_lock_irqsave(&tmr->lock, flags);
    + err = seq_timer_continue(tmr);
    + spin_unlock_irqrestore(&tmr->lock, flags);
    + return err;
    +}
    +
    /* return current 'real' time. use timeofday() to get better granularity. */
    snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
    {
    snd_seq_real_time_t cur_time;
    + unsigned long flags;

    + spin_lock_irqsave(&tmr->lock, flags);
    cur_time = tmr->cur_time;
    if (tmr->running) {
    struct timeval tm;
    @@ -410,7 +457,7 @@ snd_seq_real_time_t snd_seq_timer_get_cur_time(struct snd_seq_timer *tmr)
    }
    snd_seq_sanity_real_time(&cur_time);
    }
    -
    + spin_unlock_irqrestore(&tmr->lock, flags);
    return cur_time;
    }

    diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
    index 56e0f4cd3f82..81134e067184 100644
    --- a/sound/core/seq/seq_virmidi.c
    +++ b/sound/core/seq/seq_virmidi.c
    @@ -155,21 +155,26 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
    struct snd_virmidi *vmidi = substream->runtime->private_data;
    int count, res;
    unsigned char buf[32], *pbuf;
    + unsigned long flags;

    if (up) {
    vmidi->trigger = 1;
    if (vmidi->seq_mode == SNDRV_VIRMIDI_SEQ_DISPATCH &&
    !(vmidi->rdev->flags & SNDRV_VIRMIDI_SUBSCRIBE)) {
    - snd_rawmidi_transmit_ack(substream, substream->runtime->buffer_size - substream->runtime->avail);
    - return; /* ignored */
    + while (snd_rawmidi_transmit(substream, buf,
    + sizeof(buf)) > 0) {
    + /* ignored */
    + }
    + return;
    }
    if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
    if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
    return;
    vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
    }
    + spin_lock_irqsave(&substream->runtime->lock, flags);
    while (1) {
    - count = snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
    + count = __snd_rawmidi_transmit_peek(substream, buf, sizeof(buf));
    if (count <= 0)
    break;
    pbuf = buf;
    @@ -179,16 +184,18 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream,
    snd_midi_event_reset_encode(vmidi->parser);
    continue;
    }
    - snd_rawmidi_transmit_ack(substream, res);
    + __snd_rawmidi_transmit_ack(substream, res);
    pbuf += res;
    count -= res;
    if (vmidi->event.type != SNDRV_SEQ_EVENT_NONE) {
    if (snd_seq_kernel_client_dispatch(vmidi->client, &vmidi->event, in_atomic(), 0) < 0)
    - return;
    + goto out;
    vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
    }
    }
    }
    + out:
    + spin_unlock_irqrestore(&substream->runtime->lock, flags);
    } else {
    vmidi->trigger = 0;
    }
    @@ -254,9 +261,13 @@ static int snd_virmidi_output_open(struct snd_rawmidi_substream *substream)
    */
    static int snd_virmidi_input_close(struct snd_rawmidi_substream *substream)
    {
    + struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
    struct snd_virmidi *vmidi = substream->runtime->private_data;
    - snd_midi_event_free(vmidi->parser);
    +
    + write_lock_irq(&rdev->filelist_lock);
    list_del(&vmidi->list);
    + write_unlock_irq(&rdev->filelist_lock);
    + snd_midi_event_free(vmidi->parser);
    substream->runtime->private_data = NULL;
    kfree(vmidi);
    return 0;
    diff --git a/sound/core/timer.c b/sound/core/timer.c
    index 0a049c4578f1..f24c9fccf008 100644
    --- a/sound/core/timer.c
    +++ b/sound/core/timer.c
    @@ -305,8 +305,7 @@ int snd_timer_open(struct snd_timer_instance **ti,
    return 0;
    }

    -static int _snd_timer_stop(struct snd_timer_instance *timeri,
    - int keep_flag, int event);
    +static int _snd_timer_stop(struct snd_timer_instance *timeri, int event);

    /*
    * close a timer instance
    @@ -348,7 +347,7 @@ int snd_timer_close(struct snd_timer_instance *timeri)
    spin_unlock_irq(&timer->lock);
    mutex_lock(&register_mutex);
    list_del(&timeri->open_list);
    - if (timer && list_empty(&timer->open_list_head) &&
    + if (list_empty(&timer->open_list_head) &&
    timer->hw.close)
    timer->hw.close(timer);
    /* remove slave links */
    @@ -423,7 +422,7 @@ static void snd_timer_notify1(struct snd_timer_instance *ti, int event)
    spin_lock_irqsave(&timer->lock, flags);
    list_for_each_entry(ts, &ti->slave_active_head, active_list)
    if (ts->ccallback)
    - ts->ccallback(ti, event + 100, &tstamp, resolution);
    + ts->ccallback(ts, event + 100, &tstamp, resolution);
    spin_unlock_irqrestore(&timer->lock, flags);
    }

    @@ -452,6 +451,10 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri)
    unsigned long flags;

    spin_lock_irqsave(&slave_active_lock, flags);
    + if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
    + spin_unlock_irqrestore(&slave_active_lock, flags);
    + return -EBUSY;
    + }
    timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
    if (timeri->master && timeri->timer) {
    spin_lock(&timeri->timer->lock);
    @@ -476,7 +479,8 @@ int snd_timer_start(struct snd_timer_instance *timeri, unsigned int ticks)
    return -EINVAL;
    if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) {
    result = snd_timer_start_slave(timeri);
    - snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
    + if (result >= 0)
    + snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
    return result;
    }
    timer = timeri->timer;
    @@ -485,16 +489,22 @@ int snd_timer_start(struct snd_timer_instance *timeri, unsigned int ticks)
    if (timer->card && timer->card->shutdown)
    return -ENODEV;
    spin_lock_irqsave(&timer->lock, flags);
    + if (timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
    + SNDRV_TIMER_IFLG_START)) {
    + result = -EBUSY;
    + goto unlock;
    + }
    timeri->ticks = timeri->cticks = ticks;
    timeri->pticks = 0;
    result = snd_timer_start1(timer, timeri, ticks);
    + unlock:
    spin_unlock_irqrestore(&timer->lock, flags);
    - snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
    + if (result >= 0)
    + snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_START);
    return result;
    }

    -static int _snd_timer_stop(struct snd_timer_instance * timeri,
    - int keep_flag, int event)
    +static int _snd_timer_stop(struct snd_timer_instance *timeri, int event)
    {
    struct snd_timer *timer;
    unsigned long flags;
    @@ -503,19 +513,30 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri,
    return -ENXIO;

    if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) {
    - if (!keep_flag) {
    - spin_lock_irqsave(&slave_active_lock, flags);
    - timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
    - list_del_init(&timeri->ack_list);
    - list_del_init(&timeri->active_list);
    + spin_lock_irqsave(&slave_active_lock, flags);
    + if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) {
    spin_unlock_irqrestore(&slave_active_lock, flags);
    + return -EBUSY;
    }
    + if (timeri->timer)
    + spin_lock(&timeri->timer->lock);
    + timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
    + list_del_init(&timeri->ack_list);
    + list_del_init(&timeri->active_list);
    + if (timeri->timer)
    + spin_unlock(&timeri->timer->lock);
    + spin_unlock_irqrestore(&slave_active_lock, flags);
    goto __end;
    }
    timer = timeri->timer;
    if (!timer)
    return -EINVAL;
    spin_lock_irqsave(&timer->lock, flags);
    + if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
    + SNDRV_TIMER_IFLG_START))) {
    + spin_unlock_irqrestore(&timer->lock, flags);
    + return -EBUSY;
    + }
    list_del_init(&timeri->ack_list);
    list_del_init(&timeri->active_list);
    if (timer->card && timer->card->shutdown) {
    @@ -534,9 +555,7 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri,
    }
    }
    }
    - if (!keep_flag)
    - timeri->flags &=
    - ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
    + timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
    spin_unlock_irqrestore(&timer->lock, flags);
    __end:
    if (event != SNDRV_TIMER_EVENT_RESOLUTION)
    @@ -555,7 +574,7 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
    unsigned long flags;
    int err;

    - err = _snd_timer_stop(timeri, 0, SNDRV_TIMER_EVENT_STOP);
    + err = _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_STOP);
    if (err < 0)
    return err;
    timer = timeri->timer;
    @@ -587,10 +606,15 @@ int snd_timer_continue(struct snd_timer_instance *timeri)
    if (timer->card && timer->card->shutdown)
    return -ENODEV;
    spin_lock_irqsave(&timer->lock, flags);
    + if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
    + result = -EBUSY;
    + goto unlock;
    + }
    if (!timeri->cticks)
    timeri->cticks = 1;
    timeri->pticks = 0;
    result = snd_timer_start1(timer, timeri, timer->sticks);
    + unlock:
    spin_unlock_irqrestore(&timer->lock, flags);
    snd_timer_notify1(timeri, SNDRV_TIMER_EVENT_CONTINUE);
    return result;
    @@ -601,7 +625,7 @@ int snd_timer_continue(struct snd_timer_instance *timeri)
    */
    int snd_timer_pause(struct snd_timer_instance * timeri)
    {
    - return _snd_timer_stop(timeri, 0, SNDRV_TIMER_EVENT_PAUSE);
    + return _snd_timer_stop(timeri, SNDRV_TIMER_EVENT_PAUSE);
    }

    /*
    @@ -724,8 +748,8 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
    ti->cticks = ti->ticks;
    } else {
    ti->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
    - if (--timer->running)
    - list_del_init(&ti->active_list);
    + --timer->running;
    + list_del_init(&ti->active_list);
    }
    if ((timer->hw.flags & SNDRV_TIMER_HW_TASKLET) ||
    (ti->flags & SNDRV_TIMER_IFLG_FAST))
    @@ -1900,6 +1924,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
    {
    struct snd_timer_user *tu;
    long result = 0, unit;
    + int qhead;
    int err = 0;

    tu = file->private_data;
    @@ -1911,7 +1936,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,

    if ((file->f_flags & O_NONBLOCK) != 0 || result > 0) {
    err = -EAGAIN;
    - break;
    + goto _error;
    }

    set_current_state(TASK_INTERRUPTIBLE);
    @@ -1926,42 +1951,37 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,

    if (tu->disconnected) {
    err = -ENODEV;
    - break;
    + goto _error;
    }
    if (signal_pending(current)) {
    err = -ERESTARTSYS;
    - break;
    + goto _error;
    }
    }

    + qhead = tu->qhead++;
    + tu->qhead %= tu->queue_size;
    spin_unlock_irq(&tu->qlock);
    - if (err < 0)
    - goto _error;

    if (tu->tread) {
    - if (copy_to_user(buffer, &tu->tqueue[tu->qhead++],
    - sizeof(struct snd_timer_tread))) {
    + if (copy_to_user(buffer, &tu->tqueue[qhead],
    + sizeof(struct snd_timer_tread)))
    err = -EFAULT;
    - goto _error;
    - }
    } else {
    - if (copy_to_user(buffer, &tu->queue[tu->qhead++],
    - sizeof(struct snd_timer_read))) {
    + if (copy_to_user(buffer, &tu->queue[qhead],
    + sizeof(struct snd_timer_read)))
    err = -EFAULT;
    - goto _error;
    - }
    }

    - tu->qhead %= tu->queue_size;
    -
    - result += unit;
    - buffer += unit;
    -
    spin_lock_irq(&tu->qlock);
    tu->qused--;
    + if (err < 0)
    + goto _error;
    + result += unit;
    + buffer += unit;
    }
    - spin_unlock_irq(&tu->qlock);
    _error:
    + spin_unlock_irq(&tu->qlock);
    return result > 0 ? result : err;
    }

    diff --git a/sound/drivers/dummy.c b/sound/drivers/dummy.c
    index 016e451ed506..a9f7a75702d2 100644
    --- a/sound/drivers/dummy.c
    +++ b/sound/drivers/dummy.c
    @@ -109,6 +109,9 @@ struct dummy_timer_ops {
    snd_pcm_uframes_t (*pointer)(struct snd_pcm_substream *);
    };

    +#define get_dummy_ops(substream) \
    + (*(const struct dummy_timer_ops **)(substream)->runtime->private_data)
    +
    struct dummy_model {
    const char *name;
    int (*playback_constraints)(struct snd_pcm_runtime *runtime);
    @@ -137,7 +140,6 @@ struct snd_dummy {
    int iobox;
    struct snd_kcontrol *cd_volume_ctl;
    struct snd_kcontrol *cd_switch_ctl;
    - const struct dummy_timer_ops *timer_ops;
    };

    /*
    @@ -231,6 +233,8 @@ static struct dummy_model *dummy_models[] = {
    */

    struct dummy_systimer_pcm {
    + /* ops must be the first item */
    + const struct dummy_timer_ops *timer_ops;
    spinlock_t lock;
    struct timer_list timer;
    unsigned long base_time;
    @@ -366,6 +370,8 @@ static struct dummy_timer_ops dummy_systimer_ops = {
    */

    struct dummy_hrtimer_pcm {
    + /* ops must be the first item */
    + const struct dummy_timer_ops *timer_ops;
    ktime_t base_time;
    ktime_t period_time;
    atomic_t running;
    @@ -492,31 +498,25 @@ static struct dummy_timer_ops dummy_hrtimer_ops = {

    static int dummy_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
    {
    - struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
    -
    switch (cmd) {
    case SNDRV_PCM_TRIGGER_START:
    case SNDRV_PCM_TRIGGER_RESUME:
    - return dummy->timer_ops->start(substream);
    + return get_dummy_ops(substream)->start(substream);
    case SNDRV_PCM_TRIGGER_STOP:
    case SNDRV_PCM_TRIGGER_SUSPEND:
    - return dummy->timer_ops->stop(substream);
    + return get_dummy_ops(substream)->stop(substream);
    }
    return -EINVAL;
    }

    static int dummy_pcm_prepare(struct snd_pcm_substream *substream)
    {
    - struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
    -
    - return dummy->timer_ops->prepare(substream);
    + return get_dummy_ops(substream)->prepare(substream);
    }

    static snd_pcm_uframes_t dummy_pcm_pointer(struct snd_pcm_substream *substream)
    {
    - struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
    -
    - return dummy->timer_ops->pointer(substream);
    + return get_dummy_ops(substream)->pointer(substream);
    }

    static struct snd_pcm_hardware dummy_pcm_hardware = {
    @@ -562,17 +562,19 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream)
    struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
    struct dummy_model *model = dummy->model;
    struct snd_pcm_runtime *runtime = substream->runtime;
    + const struct dummy_timer_ops *ops;
    int err;

    - dummy->timer_ops = &dummy_systimer_ops;
    + ops = &dummy_systimer_ops;
    #ifdef CONFIG_HIGH_RES_TIMERS
    if (hrtimer)
    - dummy->timer_ops = &dummy_hrtimer_ops;
    + ops = &dummy_hrtimer_ops;
    #endif

    - err = dummy->timer_ops->create(substream);
    + err = ops->create(substream);
    if (err < 0)
    return err;
    + get_dummy_ops(substream) = ops;

    runtime->hw = dummy->pcm_hw;
    if (substream->pcm->device & 1) {
    @@ -594,7 +596,7 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream)
    err = model->capture_constraints(substream->runtime);
    }
    if (err < 0) {
    - dummy->timer_ops->free(substream);
    + get_dummy_ops(substream)->free(substream);
    return err;
    }
    return 0;
    @@ -602,8 +604,7 @@ static int dummy_pcm_open(struct snd_pcm_substream *substream)

    static int dummy_pcm_close(struct snd_pcm_substream *substream)
    {
    - struct snd_dummy *dummy = snd_pcm_substream_chip(substream);
    - dummy->timer_ops->free(substream);
    + get_dummy_ops(substream)->free(substream);
    return 0;
    }

    diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c
    index 5be5242e1ed8..7fdf34e80d5e 100644
    --- a/sound/firewire/bebob/bebob_stream.c
    +++ b/sound/firewire/bebob/bebob_stream.c
    @@ -47,14 +47,16 @@ static const unsigned int bridgeco_freq_table[] = {
    [6] = 0x07,
    };

    -static unsigned int
    -get_formation_index(unsigned int rate)
    +static int
    +get_formation_index(unsigned int rate, unsigned int *index)
    {
    unsigned int i;

    for (i = 0; i < ARRAY_SIZE(snd_bebob_rate_table); i++) {
    - if (snd_bebob_rate_table[i] == rate)
    - return i;
    + if (snd_bebob_rate_table[i] == rate) {
    + *index = i;
    + return 0;
    + }
    }
    return -EINVAL;
    }
    @@ -424,7 +426,9 @@ make_both_connections(struct snd_bebob *bebob, unsigned int rate)
    goto end;

    /* confirm params for both streams */
    - index = get_formation_index(rate);
    + err = get_formation_index(rate, &index);
    + if (err < 0)
    + goto end;
    pcm_channels = bebob->tx_stream_formations[index].pcm;
    midi_channels = bebob->tx_stream_formations[index].midi;
    amdtp_stream_set_parameters(&bebob->tx_stream,
    diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
    index 24f91114a32c..98fe629c1f86 100644
    --- a/sound/pci/hda/hda_generic.c
    +++ b/sound/pci/hda/hda_generic.c
    @@ -771,9 +771,6 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
    unsigned int caps;
    unsigned int mask, val;

    - if (!enable && is_active_nid(codec, nid, dir, idx_to_check))
    - return;
    -
    caps = query_amp_caps(codec, nid, dir);
    val = get_amp_val_to_activate(codec, nid, dir, caps, enable);
    mask = get_amp_mask_to_modify(codec, nid, dir, idx_to_check, caps);
    @@ -784,12 +781,22 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
    update_amp(codec, nid, dir, idx, mask, val);
    }

    +static void check_and_activate_amp(struct hda_codec *codec, hda_nid_t nid,
    + int dir, int idx, int idx_to_check,
    + bool enable)
    +{
    + /* check whether the given amp is still used by others */
    + if (!enable && is_active_nid(codec, nid, dir, idx_to_check))
    + return;
    + activate_amp(codec, nid, dir, idx, idx_to_check, enable);
    +}
    +
    static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
    int i, bool enable)
    {
    hda_nid_t nid = path->path[i];
    init_amp(codec, nid, HDA_OUTPUT, 0);
    - activate_amp(codec, nid, HDA_OUTPUT, 0, 0, enable);
    + check_and_activate_amp(codec, nid, HDA_OUTPUT, 0, 0, enable);
    }

    static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
    @@ -817,9 +824,16 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
    * when aa-mixer is available, we need to enable the path as well
    */
    for (n = 0; n < nums; n++) {
    - if (n != idx && (!add_aamix || conn[n] != spec->mixer_merge_nid))
    - continue;
    - activate_amp(codec, nid, HDA_INPUT, n, idx, enable);
    + if (n != idx) {
    + if (conn[n] != spec->mixer_merge_nid)
    + continue;
    + /* when aamix is disabled, force to off */
    + if (!add_aamix) {
    + activate_amp(codec, nid, HDA_INPUT, n, n, false);
    + continue;
    + }
    + }
    + check_and_activate_amp(codec, nid, HDA_INPUT, n, idx, enable);
    }
    }

    @@ -1580,6 +1594,12 @@ static bool map_singles(struct hda_codec *codec, int outs,
    return found;
    }

    +static inline bool has_aamix_out_paths(struct hda_gen_spec *spec)
    +{
    + return spec->aamix_out_paths[0] || spec->aamix_out_paths[1] ||
    + spec->aamix_out_paths[2];
    +}
    +
    /* create a new path including aamix if available, and return its index */
    static int check_aamix_out_path(struct hda_codec *codec, int path_idx)
    {
    @@ -2422,25 +2442,51 @@ static void update_aamix_paths(struct hda_codec *codec, bool do_mix,
    }
    }

    +/* re-initialize the output paths; only called from loopback_mixing_put() */
    +static void update_output_paths(struct hda_codec *codec, int num_outs,
    + const int *paths)
    +{
    + struct hda_gen_spec *spec = codec->spec;
    + struct nid_path *path;
    + int i;
    +
    + for (i = 0; i < num_outs; i++) {
    + path = snd_hda_get_path_from_idx(codec, paths[i]);
    + if (path)
    + snd_hda_activate_path(codec, path, path->active,
    + spec->aamix_mode);
    + }
    +}
    +
    static int loopback_mixing_put(struct snd_kcontrol *kcontrol,
    struct snd_ctl_elem_value *ucontrol)
    {
    struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
    struct hda_gen_spec *spec = codec->spec;
    + const struct auto_pin_cfg *cfg = &spec->autocfg;
    unsigned int val = ucontrol->value.enumerated.item[0];

    if (val == spec->aamix_mode)
    return 0;
    spec->aamix_mode = val;
    - update_aamix_paths(codec, val, spec->out_paths[0],
    - spec->aamix_out_paths[0],
    - spec->autocfg.line_out_type);
    - update_aamix_paths(codec, val, spec->hp_paths[0],
    - spec->aamix_out_paths[1],
    - AUTO_PIN_HP_OUT);
    - update_aamix_paths(codec, val, spec->speaker_paths[0],
    - spec->aamix_out_paths[2],
    - AUTO_PIN_SPEAKER_OUT);
    + if (has_aamix_out_paths(spec)) {
    + update_aamix_paths(codec, val, spec->out_paths[0],
    + spec->aamix_out_paths[0],
    + cfg->line_out_type);
    + update_aamix_paths(codec, val, spec->hp_paths[0],
    + spec->aamix_out_paths[1],
    + AUTO_PIN_HP_OUT);
    + update_aamix_paths(codec, val, spec->speaker_paths[0],
    + spec->aamix_out_paths[2],
    + AUTO_PIN_SPEAKER_OUT);
    + } else {
    + update_output_paths(codec, cfg->line_outs, spec->out_paths);
    + if (cfg->line_out_type != AUTO_PIN_HP_OUT)
    + update_output_paths(codec, cfg->hp_outs, spec->hp_paths);
    + if (cfg->line_out_type != AUTO_PIN_SPEAKER_OUT)
    + update_output_paths(codec, cfg->speaker_outs,
    + spec->speaker_paths);
    + }
    return 1;
    }

    @@ -2458,12 +2504,13 @@ static int create_loopback_mixing_ctl(struct hda_codec *codec)

    if (!spec->mixer_nid)
    return 0;
    - if (!(spec->aamix_out_paths[0] || spec->aamix_out_paths[1] ||
    - spec->aamix_out_paths[2]))
    - return 0;
    if (!snd_hda_gen_add_kctl(spec, NULL, &loopback_mixing_enum))
    return -ENOMEM;
    spec->have_aamix_ctl = 1;
    + /* if no explicit aamix path is present (e.g. for Realtek codecs),
    + * enable aamix as default -- just for compatibility
    + */
    + spec->aamix_mode = !has_aamix_out_paths(spec);
    return 0;
    }

    @@ -3998,9 +4045,9 @@ static void pin_power_callback(struct hda_codec *codec,
    struct hda_jack_callback *jack,
    bool on)
    {
    - if (jack && jack->tbl->nid)
    + if (jack && jack->nid)
    sync_power_state_change(codec,
    - set_pin_power_jack(codec, jack->tbl->nid, on));
    + set_pin_power_jack(codec, jack->nid, on));
    }

    /* callback only doing power up -- called at first */
    @@ -5664,6 +5711,8 @@ static void init_aamix_paths(struct hda_codec *codec)

    if (!spec->have_aamix_ctl)
    return;
    + if (!has_aamix_out_paths(spec))
    + return;
    update_aamix_paths(codec, spec->aamix_mode, spec->out_paths[0],
    spec->aamix_out_paths[0],
    spec->autocfg.line_out_type);
    diff --git a/sound/pci/hda/hda_jack.c b/sound/pci/hda/hda_jack.c
    index 366efbf87d41..b6dbe653b74f 100644
    --- a/sound/pci/hda/hda_jack.c
    +++ b/sound/pci/hda/hda_jack.c
    @@ -259,7 +259,7 @@ snd_hda_jack_detect_enable_callback(struct hda_codec *codec, hda_nid_t nid,
    if (!callback)
    return ERR_PTR(-ENOMEM);
    callback->func = func;
    - callback->tbl = jack;
    + callback->nid = jack->nid;
    callback->next = jack->callback;
    jack->callback = callback;
    }
    diff --git a/sound/pci/hda/hda_jack.h b/sound/pci/hda/hda_jack.h
    index 387d30984dfe..1009909ea158 100644
    --- a/sound/pci/hda/hda_jack.h
    +++ b/sound/pci/hda/hda_jack.h
    @@ -21,7 +21,7 @@ struct hda_jack_callback;
    typedef void (*hda_jack_callback_fn) (struct hda_codec *, struct hda_jack_callback *);

    struct hda_jack_callback {
    - struct hda_jack_tbl *tbl;
    + hda_nid_t nid;
    hda_jack_callback_fn func;
    unsigned int private_data; /* arbitrary data */
    struct hda_jack_callback *next;
    diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
    index 5b8a5b84a03c..304a0d7a6481 100644
    --- a/sound/pci/hda/patch_ca0132.c
    +++ b/sound/pci/hda/patch_ca0132.c
    @@ -4427,13 +4427,16 @@ static void ca0132_process_dsp_response(struct hda_codec *codec,
    static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
    {
    struct ca0132_spec *spec = codec->spec;
    + struct hda_jack_tbl *tbl;

    /* Delay enabling the HP amp, to let the mic-detection
    * state machine run.
    */
    cancel_delayed_work_sync(&spec->unsol_hp_work);
    schedule_delayed_work(&spec->unsol_hp_work, msecs_to_jiffies(500));
    - cb->tbl->block_report = 1;
    + tbl = snd_hda_jack_tbl_get(codec, cb->nid);
    + if (tbl)
    + tbl->block_report = 1;
    }

    static void amic_callback(struct hda_codec *codec, struct hda_jack_callback *cb)
    diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
    index 85813de26da8..ac38222cce49 100644
    --- a/sound/pci/hda/patch_cirrus.c
    +++ b/sound/pci/hda/patch_cirrus.c
    @@ -613,6 +613,7 @@ enum {
    CS4208_MAC_AUTO,
    CS4208_MBA6,
    CS4208_MBP11,
    + CS4208_MACMINI,
    CS4208_GPIO0,
    };

    @@ -620,6 +621,7 @@ static const struct hda_model_fixup cs4208_models[] = {
    { .id = CS4208_GPIO0, .name = "gpio0" },
    { .id = CS4208_MBA6, .name = "mba6" },
    { .id = CS4208_MBP11, .name = "mbp11" },
    + { .id = CS4208_MACMINI, .name = "macmini" },
    {}
    };

    @@ -631,6 +633,7 @@ static const struct snd_pci_quirk cs4208_fixup_tbl[] = {
    /* codec SSID matching */
    static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {
    SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
    + SND_PCI_QUIRK(0x106b, 0x6c00, "MacMini 7,1", CS4208_MACMINI),
    SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
    SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
    SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11),
    @@ -665,6 +668,24 @@ static void cs4208_fixup_mac(struct hda_codec *codec,
    snd_hda_apply_fixup(codec, action);
    }

    +/* MacMini 7,1 has the inverted jack detection */
    +static void cs4208_fixup_macmini(struct hda_codec *codec,
    + const struct hda_fixup *fix, int action)
    +{
    + static const struct hda_pintbl pincfgs[] = {
    + { 0x18, 0x00ab9150 }, /* mic (audio-in) jack: disable detect */
    + { 0x21, 0x004be140 }, /* SPDIF: disable detect */
    + { }
    + };
    +
    + if (action == HDA_FIXUP_ACT_PRE_PROBE) {
    + /* HP pin (0x10) has an inverted detection */
    + codec->inv_jack_detect = 1;
    + /* disable the bogus Mic and SPDIF jack detections */
    + snd_hda_apply_pincfgs(codec, pincfgs);
    + }
    +}
    +
    static int cs4208_spdif_sw_put(struct snd_kcontrol *kcontrol,
    struct snd_ctl_elem_value *ucontrol)
    {
    @@ -708,6 +729,12 @@ static const struct hda_fixup cs4208_fixups[] = {
    .chained = true,
    .chain_id = CS4208_GPIO0,
    },
    + [CS4208_MACMINI] = {
    + .type = HDA_FIXUP_FUNC,
    + .v.func = cs4208_fixup_macmini,
    + .chained = true,
    + .chain_id = CS4208_GPIO0,
    + },
    [CS4208_GPIO0] = {
    .type = HDA_FIXUP_FUNC,
    .v.func = cs4208_fixup_gpio0,
    diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
    index d1c74295a362..57d4cce06ab6 100644
    --- a/sound/pci/hda/patch_hdmi.c
    +++ b/sound/pci/hda/patch_hdmi.c
    @@ -438,7 +438,8 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol,
    eld = &per_pin->sink_eld;

    mutex_lock(&per_pin->lock);
    - if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data)) {
    + if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data) ||
    + eld->eld_size > ELD_MAX_SIZE) {
    mutex_unlock(&per_pin->lock);
    snd_BUG();
    return -EINVAL;
    @@ -1183,7 +1184,7 @@ static void check_presence_and_report(struct hda_codec *codec, hda_nid_t nid)
    static void jack_callback(struct hda_codec *codec,
    struct hda_jack_callback *jack)
    {
    - check_presence_and_report(codec, jack->tbl->nid);
    + check_presence_and_report(codec, jack->nid);
    }

    static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
    diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    index 887f37761f18..f33c58d3850e 100644
    --- a/sound/pci/hda/patch_realtek.c
    +++ b/sound/pci/hda/patch_realtek.c
    @@ -282,7 +282,7 @@ static void alc_update_knob_master(struct hda_codec *codec,
    uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
    if (!uctl)
    return;
    - val = snd_hda_codec_read(codec, jack->tbl->nid, 0,
    + val = snd_hda_codec_read(codec, jack->nid, 0,
    AC_VERB_GET_VOLUME_KNOB_CONTROL, 0);
    val &= HDA_AMP_VOLMASK;
    uctl->value.integer.value[0] = val;
    @@ -1795,7 +1795,6 @@ enum {
    ALC882_FIXUP_NO_PRIMARY_HP,
    ALC887_FIXUP_ASUS_BASS,
    ALC887_FIXUP_BASS_CHMAP,
    - ALC882_FIXUP_DISABLE_AAMIX,
    };

    static void alc889_fixup_coef(struct hda_codec *codec,
    @@ -1957,8 +1956,6 @@ static void alc882_fixup_no_primary_hp(struct hda_codec *codec,

    static void alc_fixup_bass_chmap(struct hda_codec *codec,
    const struct hda_fixup *fix, int action);
    -static void alc_fixup_disable_aamix(struct hda_codec *codec,
    - const struct hda_fixup *fix, int action);

    static const struct hda_fixup alc882_fixups[] = {
    [ALC882_FIXUP_ABIT_AW9D_MAX] = {
    @@ -2196,10 +2193,6 @@ static const struct hda_fixup alc882_fixups[] = {
    .type = HDA_FIXUP_FUNC,
    .v.func = alc_fixup_bass_chmap,
    },
    - [ALC882_FIXUP_DISABLE_AAMIX] = {
    - .type = HDA_FIXUP_FUNC,
    - .v.func = alc_fixup_disable_aamix,
    - },
    };

    static const struct snd_pci_quirk alc882_fixup_tbl[] = {
    @@ -2238,6 +2231,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
    SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
    SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
    SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
    + SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),

    /* All Apple entries are in codec SSIDs */
    SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
    @@ -2267,7 +2261,6 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
    SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
    SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
    SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
    - SND_PCI_QUIRK(0x1458, 0xa182, "Gigabyte Z170X-UD3", ALC882_FIXUP_DISABLE_AAMIX),
    SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
    SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
    SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
    diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
    index 14a62b8117fd..79f78989a7b6 100644
    --- a/sound/pci/hda/patch_sigmatel.c
    +++ b/sound/pci/hda/patch_sigmatel.c
    @@ -493,9 +493,9 @@ static void jack_update_power(struct hda_codec *codec,
    if (!spec->num_pwrs)
    return;

    - if (jack && jack->tbl->nid) {
    - stac_toggle_power_map(codec, jack->tbl->nid,
    - snd_hda_jack_detect(codec, jack->tbl->nid),
    + if (jack && jack->nid) {
    + stac_toggle_power_map(codec, jack->nid,
    + snd_hda_jack_detect(codec, jack->nid),
    true);
    return;
    }
    diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
    index 5c101af0ac63..a06cdcfffd2a 100644
    --- a/sound/soc/codecs/rt5645.c
    +++ b/sound/soc/codecs/rt5645.c
    @@ -500,7 +500,7 @@ static const struct snd_kcontrol_new rt5645_snd_controls[] = {

    /* IN1/IN2 Control */
    SOC_SINGLE_TLV("IN1 Boost", RT5645_IN1_CTRL1,
    - RT5645_BST_SFT1, 8, 0, bst_tlv),
    + RT5645_BST_SFT1, 12, 0, bst_tlv),
    SOC_SINGLE_TLV("IN2 Boost", RT5645_IN2_CTRL,
    RT5645_BST_SFT2, 8, 0, bst_tlv),

    diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
    index 70e4b9d8bdcd..81133fe5f2d0 100644
    --- a/sound/soc/soc-pcm.c
    +++ b/sound/soc/soc-pcm.c
    @@ -1696,7 +1696,8 @@ int dpcm_be_dai_hw_free(struct snd_soc_pcm_runtime *fe, int stream)
    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PREPARE) &&
    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED) &&
    - (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP))
    + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) &&
    + (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND))
    continue;

    dev_dbg(be->dev, "ASoC: hw_free BE %s\n",
    diff --git a/sound/usb/midi.c b/sound/usb/midi.c
    index bec63e0d2605..f059326a4914 100644
    --- a/sound/usb/midi.c
    +++ b/sound/usb/midi.c
    @@ -2451,7 +2451,6 @@ int snd_usbmidi_create(struct snd_card *card,
    else
    err = snd_usbmidi_create_endpoints(umidi, endpoints);
    if (err < 0) {
    - snd_usbmidi_free(umidi);
    return err;
    }

    diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
    index fb9a8a5787a6..37d8ababfc04 100644
    --- a/sound/usb/quirks.c
    +++ b/sound/usb/quirks.c
    @@ -1118,6 +1118,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
    switch (chip->usb_id) {
    case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */
    case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
    + case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
    case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
    case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
    case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
    @@ -1202,8 +1203,12 @@ void snd_usb_set_interface_quirk(struct usb_device *dev)
    * "Playback Design" products need a 50ms delay after setting the
    * USB interface.
    */
    - if (le16_to_cpu(dev->descriptor.idVendor) == 0x23ba)
    + switch (le16_to_cpu(dev->descriptor.idVendor)) {
    + case 0x23ba: /* Playback Design */
    + case 0x0644: /* TEAC Corp. */
    mdelay(50);
    + break;
    + }
    }

    void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
    @@ -1218,6 +1223,14 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,
    (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
    mdelay(20);

    + /*
    + * "TEAC Corp." products need a 20ms delay after each
    + * class compliant request
    + */
    + if ((le16_to_cpu(dev->descriptor.idVendor) == 0x0644) &&
    + (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
    + mdelay(20);
    +
    /* Marantz/Denon devices with USB DAC functionality need a delay
    * after each class compliant request
    */
    @@ -1266,7 +1279,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
    case USB_ID(0x20b1, 0x3008): /* iFi Audio micro/nano iDSD */
    case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */
    case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */
    - case USB_ID(0x22d8, 0x0416): /* OPPO HA-1*/
    + case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */
    if (fp->altsetting == 2)
    return SNDRV_PCM_FMTBIT_DSD_U32_BE;
    break;
    @@ -1275,6 +1288,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
    case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */
    case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */
    case USB_ID(0x20b1, 0x3023): /* Aune X1S 32BIT/384 DSD DAC */
    + case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */
    if (fp->altsetting == 3)
    return SNDRV_PCM_FMTBIT_DSD_U32_BE;
    break;
    \
     
     \ /
      Last update: 2016-02-20 00:21    [W:4.990 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site