diff options
| author |   Anthony G. Basile <blueness@gentoo.org> | 2016-12-10 13:45:09 -0500 |
|---|---|---|
| committer | Anthony G. Basile <blueness@gentoo.org> | 2016-12-10 13:45:09 -0500 |
| commit | 557afe6a49d7fcf5543d7dd195ddf9c8ad754ad8 (patch) | |
| tree | 4a92262a06ade0de1c8b61cb2250db7087cb1e5a | |
| parent | grsecurity-3.1-4.8.12-201612062306 (diff) | |
| download | hardened-patchset-20161208.tar.gz hardened-patchset-20161208.tar.bz2 hardened-patchset-20161208.zip | |
grsecurity-3.1-4.8.13-20161208211820161208
| -rw-r--r-- | 4.8.12/1010_linux-4.8.11.patch | 2351 | ||||
| -rw-r--r-- | 4.8.12/1011_linux-4.8.12.patch | 1563 | ||||
| -rw-r--r-- | 4.8.13/0000_README (renamed from 4.8.12/0000_README) | 14 | ||||
| -rw-r--r-- | 4.8.13/1012_linux-4.8.13.patch | 1063 | ||||
| -rw-r--r-- | 4.8.13/4420_grsecurity-3.1-4.8.13-201612082118.patch (renamed from 4.8.12/4420_grsecurity-3.1-4.8.12-201612062306.patch) | 143 | ||||
| -rw-r--r-- | 4.8.13/4425_grsec_remove_EI_PAX.patch (renamed from 4.8.12/4425_grsec_remove_EI_PAX.patch) | 0 | ||||
| -rw-r--r-- | 4.8.13/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.8.12/4427_force_XATTR_PAX_tmpfs.patch) | 0 | ||||
| -rw-r--r-- | 4.8.13/4430_grsec-remove-localversion-grsec.patch (renamed from 4.8.12/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 4.8.13/4435_grsec-mute-warnings.patch (renamed from 4.8.12/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 4.8.13/4440_grsec-remove-protected-paths.patch (renamed from 4.8.12/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 4.8.13/4450_grsec-kconfig-default-gids.patch (renamed from 4.8.12/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 4.8.13/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.8.12/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 4.8.13/4470_disable-compat_vdso.patch (renamed from 4.8.12/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 4.8.13/4475_emutramp_default_on.patch (renamed from 4.8.12/4475_emutramp_default_on.patch) | 0 |
14 files changed, 1147 insertions, 3987 deletions
diff --git a/4.8.12/1010_linux-4.8.11.patch b/4.8.12/1010_linux-4.8.11.patch deleted file mode 100644 index 5c67d71..0000000 --- a/4.8.12/1010_linux-4.8.11.patch +++ /dev/null @@ -1,2351 +0,0 @@ -diff --git a/Makefile b/Makefile -index 7cf2b49..2b1bcba 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 8 --SUBLEVEL = 10 -+SUBLEVEL = 11 - EXTRAVERSION = - NAME = Psychotic Stoned Sheep - -@@ -399,11 +399,12 @@ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ - -fno-strict-aliasing -fno-common \ - -Werror-implicit-function-declaration \ - -Wno-format-security \ -- -std=gnu89 -+ -std=gnu89 $(call cc-option,-fno-PIE) -+ - - KBUILD_AFLAGS_KERNEL := - KBUILD_CFLAGS_KERNEL := --KBUILD_AFLAGS := -D__ASSEMBLY__ -+KBUILD_AFLAGS := -D__ASSEMBLY__ $(call cc-option,-fno-PIE) - KBUILD_AFLAGS_MODULE := -DMODULE - KBUILD_CFLAGS_MODULE := -DMODULE - KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds -@@ -621,6 +622,7 @@ include arch/$(SRCARCH)/Makefile - - KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,) - KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,) -+KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) - - ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE - KBUILD_CFLAGS += -Os -diff --git a/arch/arm/boot/dts/imx53-qsb.dts b/arch/arm/boot/dts/imx53-qsb.dts -index dec4b07..3799396 100644 ---- a/arch/arm/boot/dts/imx53-qsb.dts -+++ b/arch/arm/boot/dts/imx53-qsb.dts -@@ -64,8 +64,8 @@ - }; - - ldo3_reg: ldo3 { -- regulator-min-microvolt = <600000>; -- regulator-max-microvolt = <1800000>; -+ regulator-min-microvolt = <1725000>; -+ regulator-max-microvolt = <3300000>; - regulator-always-on; - }; - -@@ -76,8 +76,8 @@ - }; - - ldo5_reg: ldo5 { -- regulator-min-microvolt = <1725000>; -- regulator-max-microvolt = <3300000>; -+ regulator-min-microvolt = <1200000>; -+ regulator-max-microvolt = <3600000>; - regulator-always-on; - }; - -@@ -100,14 +100,14 @@ - }; - - ldo9_reg: ldo9 { -- regulator-min-microvolt = <1200000>; -+ regulator-min-microvolt = <1250000>; - regulator-max-microvolt = <3600000>; - regulator-always-on; - }; - - ldo10_reg: ldo10 { -- regulator-min-microvolt = <1250000>; -- regulator-max-microvolt = <3650000>; -+ regulator-min-microvolt = <1200000>; -+ regulator-max-microvolt = <3600000>; - regulator-always-on; - }; - }; -diff --git a/arch/arm64/include/asm/perf_event.h b/arch/arm64/include/asm/perf_event.h -index 2065f46..38b6a2b 100644 ---- a/arch/arm64/include/asm/perf_event.h -+++ b/arch/arm64/include/asm/perf_event.h -@@ -46,7 +46,15 @@ - #define ARMV8_PMU_EVTYPE_MASK 0xc800ffff /* Mask for writable bits */ - #define ARMV8_PMU_EVTYPE_EVENT 0xffff /* Mask for EVENT bits */ - --#define ARMV8_PMU_EVTYPE_EVENT_SW_INCR 0 /* Software increment event */ -+/* -+ * PMUv3 event types: required events -+ */ -+#define ARMV8_PMUV3_PERFCTR_SW_INCR 0x00 -+#define ARMV8_PMUV3_PERFCTR_L1D_CACHE_REFILL 0x03 -+#define ARMV8_PMUV3_PERFCTR_L1D_CACHE 0x04 -+#define ARMV8_PMUV3_PERFCTR_BR_MIS_PRED 0x10 -+#define ARMV8_PMUV3_PERFCTR_CPU_CYCLES 0x11 -+#define ARMV8_PMUV3_PERFCTR_BR_PRED 0x12 - - /* - * Event filters for PMUv3 -diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c -index 838ccf1..2c4df15 100644 ---- a/arch/arm64/kernel/perf_event.c -+++ b/arch/arm64/kernel/perf_event.c -@@ -30,17 +30,9 @@ - - /* - * ARMv8 PMUv3 Performance Events handling code. -- * Common event types. -+ * Common event types (some are defined in asm/perf_event.h). - */ - --/* Required events. */ --#define ARMV8_PMUV3_PERFCTR_SW_INCR 0x00 --#define ARMV8_PMUV3_PERFCTR_L1D_CACHE_REFILL 0x03 --#define ARMV8_PMUV3_PERFCTR_L1D_CACHE 0x04 --#define ARMV8_PMUV3_PERFCTR_BR_MIS_PRED 0x10 --#define ARMV8_PMUV3_PERFCTR_CPU_CYCLES 0x11 --#define ARMV8_PMUV3_PERFCTR_BR_PRED 0x12 -- - /* At least one of the following is required. */ - #define ARMV8_PMUV3_PERFCTR_INST_RETIRED 0x08 - #define ARMV8_PMUV3_PERFCTR_INST_SPEC 0x1B -diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c -index e51367d..31c144f 100644 ---- a/arch/arm64/kvm/sys_regs.c -+++ b/arch/arm64/kvm/sys_regs.c -@@ -602,8 +602,14 @@ static bool access_pmu_evcntr(struct kvm_vcpu *vcpu, - - idx = ARMV8_PMU_CYCLE_IDX; - } else { -- BUG(); -+ return false; - } -+ } else if (r->CRn == 0 && r->CRm == 9) { -+ /* PMCCNTR */ -+ if (pmu_access_event_counter_el0_disabled(vcpu)) -+ return false; -+ -+ idx = ARMV8_PMU_CYCLE_IDX; - } else if (r->CRn == 14 && (r->CRm & 12) == 8) { - /* PMEVCNTRn_EL0 */ - if (pmu_access_event_counter_el0_disabled(vcpu)) -@@ -611,7 +617,7 @@ static bool access_pmu_evcntr(struct kvm_vcpu *vcpu, - - idx = ((r->CRm & 3) << 3) | (r->Op2 & 7); - } else { -- BUG(); -+ return false; - } - - if (!pmu_counter_idx_valid(vcpu, idx)) -diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c -index 7ac8e6e..8d586cf 100644 ---- a/arch/powerpc/kernel/setup_64.c -+++ b/arch/powerpc/kernel/setup_64.c -@@ -226,17 +226,25 @@ static void __init configure_exceptions(void) - if (firmware_has_feature(FW_FEATURE_OPAL)) - opal_configure_cores(); - -- /* Enable AIL if supported, and we are in hypervisor mode */ -- if (early_cpu_has_feature(CPU_FTR_HVMODE) && -- early_cpu_has_feature(CPU_FTR_ARCH_207S)) { -- unsigned long lpcr = mfspr(SPRN_LPCR); -- mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3); -- } -+ /* AIL on native is done in cpu_ready_for_interrupts() */ - } - } - - static void cpu_ready_for_interrupts(void) - { -+ /* -+ * Enable AIL if supported, and we are in hypervisor mode. This -+ * is called once for every processor. -+ * -+ * If we are not in hypervisor mode the job is done once for -+ * the whole partition in configure_exceptions(). -+ */ -+ if (early_cpu_has_feature(CPU_FTR_HVMODE) && -+ early_cpu_has_feature(CPU_FTR_ARCH_207S)) { -+ unsigned long lpcr = mfspr(SPRN_LPCR); -+ mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3); -+ } -+ - /* Set IR and DR in PACA MSR */ - get_paca()->kernel_msr = MSR_KERNEL; - } -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index b81fe2d..1e81a37 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -347,7 +347,6 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c) - #ifdef CONFIG_SMP - unsigned bits; - int cpu = smp_processor_id(); -- unsigned int socket_id, core_complex_id; - - bits = c->x86_coreid_bits; - /* Low order bits define the core id (index of core in socket) */ -@@ -365,10 +364,7 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c) - if (c->x86 != 0x17 || !cpuid_edx(0x80000006)) - return; - -- socket_id = (c->apicid >> bits) - 1; -- core_complex_id = (c->apicid & ((1 << bits) - 1)) >> 3; -- -- per_cpu(cpu_llc_id, cpu) = (socket_id << 3) | core_complex_id; -+ per_cpu(cpu_llc_id, cpu) = c->apicid >> 3; - #endif - } - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 46f74d4..2fff657 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -210,7 +210,18 @@ static void kvm_on_user_return(struct user_return_notifier *urn) - struct kvm_shared_msrs *locals - = container_of(urn, struct kvm_shared_msrs, urn); - struct kvm_shared_msr_values *values; -+ unsigned long flags; - -+ /* -+ * Disabling irqs at this point since the following code could be -+ * interrupted and executed through kvm_arch_hardware_disable() -+ */ -+ local_irq_save(flags); -+ if (locals->registered) { -+ locals->registered = false; -+ user_return_notifier_unregister(urn); -+ } -+ local_irq_restore(flags); - for (slot = 0; slot < shared_msrs_global.nr; ++slot) { - values = &locals->values[slot]; - if (values->host != values->curr) { -@@ -218,8 +229,6 @@ static void kvm_on_user_return(struct user_return_notifier *urn) - values->curr = values->host; - } - } -- locals->registered = false; -- user_return_notifier_unregister(urn); - } - - static void shared_msr_update(unsigned slot, u32 msr) -@@ -3372,6 +3381,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp, - }; - case KVM_SET_VAPIC_ADDR: { - struct kvm_vapic_addr va; -+ int idx; - - r = -EINVAL; - if (!lapic_in_kernel(vcpu)) -@@ -3379,7 +3389,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, - r = -EFAULT; - if (copy_from_user(&va, argp, sizeof va)) - goto out; -+ idx = srcu_read_lock(&vcpu->kvm->srcu); - r = kvm_lapic_set_vapic_addr(vcpu, va.vapic_addr); -+ srcu_read_unlock(&vcpu->kvm->srcu, idx); - break; - } - case KVM_X86_SETUP_MCE: { -diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile -index ac58c16..555b9fa 100644 ---- a/arch/x86/purgatory/Makefile -+++ b/arch/x86/purgatory/Makefile -@@ -16,6 +16,7 @@ KCOV_INSTRUMENT := n - - KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -MD -Os -mcmodel=large - KBUILD_CFLAGS += -m$(BITS) -+KBUILD_CFLAGS += $(call cc-option,-fno-PIE) - - $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE - $(call if_changed,ld) -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index e44944f..2932a5b 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -1027,6 +1027,8 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a - TRACE_DEVICE(dev); - TRACE_SUSPEND(0); - -+ dpm_wait_for_children(dev, async); -+ - if (async_error) - goto Complete; - -@@ -1038,8 +1040,6 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a - if (dev->power.syscore || dev->power.direct_complete) - goto Complete; - -- dpm_wait_for_children(dev, async); -- - if (dev->pm_domain) { - info = "noirq power domain "; - callback = pm_noirq_op(&dev->pm_domain->ops, state); -@@ -1174,6 +1174,8 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as - - __pm_runtime_disable(dev, false); - -+ dpm_wait_for_children(dev, async); -+ - if (async_error) - goto Complete; - -@@ -1185,8 +1187,6 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as - if (dev->power.syscore || dev->power.direct_complete) - goto Complete; - -- dpm_wait_for_children(dev, async); -- - if (dev->pm_domain) { - info = "late power domain "; - callback = pm_late_early_op(&dev->pm_domain->ops, state); -diff --git a/drivers/clk/imx/clk-pllv3.c b/drivers/clk/imx/clk-pllv3.c -index 19f9b62..7a6acc3 100644 ---- a/drivers/clk/imx/clk-pllv3.c -+++ b/drivers/clk/imx/clk-pllv3.c -@@ -223,7 +223,7 @@ static unsigned long clk_pllv3_av_recalc_rate(struct clk_hw *hw, - temp64 *= mfn; - do_div(temp64, mfd); - -- return (parent_rate * div) + (u32)temp64; -+ return parent_rate * div + (unsigned long)temp64; - } - - static long clk_pllv3_av_round_rate(struct clk_hw *hw, unsigned long rate, -@@ -247,7 +247,11 @@ static long clk_pllv3_av_round_rate(struct clk_hw *hw, unsigned long rate, - do_div(temp64, parent_rate); - mfn = temp64; - -- return parent_rate * div + parent_rate * mfn / mfd; -+ temp64 = (u64)parent_rate; -+ temp64 *= mfn; -+ do_div(temp64, mfd); -+ -+ return parent_rate * div + (unsigned long)temp64; - } - - static int clk_pllv3_av_set_rate(struct clk_hw *hw, unsigned long rate, -diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c -index 3a51fff..9adaf48 100644 ---- a/drivers/clk/mmp/clk-of-mmp2.c -+++ b/drivers/clk/mmp/clk-of-mmp2.c -@@ -313,7 +313,7 @@ static void __init mmp2_clk_init(struct device_node *np) - } - - pxa_unit->apmu_base = of_iomap(np, 1); -- if (!pxa_unit->mpmu_base) { -+ if (!pxa_unit->apmu_base) { - pr_err("failed to map apmu registers\n"); - return; - } -diff --git a/drivers/clk/mmp/clk-of-pxa168.c b/drivers/clk/mmp/clk-of-pxa168.c -index 87f2317..f110c02 100644 ---- a/drivers/clk/mmp/clk-of-pxa168.c -+++ b/drivers/clk/mmp/clk-of-pxa168.c -@@ -262,7 +262,7 @@ static void __init pxa168_clk_init(struct device_node *np) - } - - pxa_unit->apmu_base = of_iomap(np, 1); -- if (!pxa_unit->mpmu_base) { -+ if (!pxa_unit->apmu_base) { - pr_err("failed to map apmu registers\n"); - return; - } -diff --git a/drivers/clk/mmp/clk-of-pxa910.c b/drivers/clk/mmp/clk-of-pxa910.c -index e22a67f..64d1ef4 100644 ---- a/drivers/clk/mmp/clk-of-pxa910.c -+++ b/drivers/clk/mmp/clk-of-pxa910.c -@@ -282,7 +282,7 @@ static void __init pxa910_clk_init(struct device_node *np) - } - - pxa_unit->apmu_base = of_iomap(np, 1); -- if (!pxa_unit->mpmu_base) { -+ if (!pxa_unit->apmu_base) { - pr_err("failed to map apmu registers\n"); - return; - } -@@ -294,7 +294,7 @@ static void __init pxa910_clk_init(struct device_node *np) - } - - pxa_unit->apbcp_base = of_iomap(np, 3); -- if (!pxa_unit->mpmu_base) { -+ if (!pxa_unit->apbcp_base) { - pr_err("failed to map apbcp registers\n"); - return; - } -diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c -index b304421..2cde379 100644 ---- a/drivers/crypto/caam/caamalg.c -+++ b/drivers/crypto/caam/caamalg.c -@@ -4542,6 +4542,15 @@ static int __init caam_algapi_init(void) - if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES)) - continue; - -+ /* -+ * Check support for AES modes not available -+ * on LP devices. -+ */ -+ if ((cha_vid & CHA_ID_LS_AES_MASK) == CHA_ID_LS_AES_LP) -+ if ((alg->class1_alg_type & OP_ALG_AAI_MASK) == -+ OP_ALG_AAI_XTS) -+ continue; -+ - t_alg = caam_alg_alloc(alg); - if (IS_ERR(t_alg)) { - err = PTR_ERR(t_alg); -diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c -index 02f2a56..47d08b9 100644 ---- a/drivers/gpio/gpio-pca953x.c -+++ b/drivers/gpio/gpio-pca953x.c -@@ -372,14 +372,15 @@ static void pca953x_gpio_set_multiple(struct gpio_chip *gc, - break; - } - -- memcpy(reg_val, chip->reg_output, NBANK(chip)); - mutex_lock(&chip->i2c_lock); -+ memcpy(reg_val, chip->reg_output, NBANK(chip)); - for(bank=0; bank<NBANK(chip); bank++) { - unsigned bankmask = mask[bank / sizeof(*mask)] >> - ((bank % sizeof(*mask)) * 8); - if(bankmask) { - unsigned bankval = bits[bank / sizeof(*bits)] >> - ((bank % sizeof(*bits)) * 8); -+ bankval &= bankmask; - reg_val[bank] = (reg_val[bank] & ~bankmask) | bankval; - } - } -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index b2dee10..15704aa 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -2667,8 +2667,11 @@ int gpiochip_lock_as_irq(struct gpio_chip *chip, unsigned int offset) - if (IS_ERR(desc)) - return PTR_ERR(desc); - -- /* Flush direction if something changed behind our back */ -- if (chip->get_direction) { -+ /* -+ * If it's fast: flush the direction setting if something changed -+ * behind our back -+ */ -+ if (!chip->can_sleep && chip->get_direction) { - int dir = chip->get_direction(chip, offset); - - if (dir) -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index 700c56b..e443073 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -492,6 +492,7 @@ struct amdgpu_bo { - u64 metadata_flags; - void *metadata; - u32 metadata_size; -+ unsigned prime_shared_count; - /* list of all virtual address to which this bo - * is associated to - */ -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c -index 651115d..c02db01f6 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c -@@ -132,7 +132,7 @@ static int amdgpu_bo_list_set(struct amdgpu_device *adev, - entry->priority = min(info[i].bo_priority, - AMDGPU_BO_LIST_MAX_PRIORITY); - entry->tv.bo = &entry->robj->tbo; -- entry->tv.shared = true; -+ entry->tv.shared = !entry->robj->prime_shared_count; - - if (entry->robj->prefered_domains == AMDGPU_GEM_DOMAIN_GDS) - gds_obj = entry->robj; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c -index 7700dc2..3826d5a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c -@@ -74,20 +74,36 @@ amdgpu_gem_prime_import_sg_table(struct drm_device *dev, - if (ret) - return ERR_PTR(ret); - -+ bo->prime_shared_count = 1; - return &bo->gem_base; - } - - int amdgpu_gem_prime_pin(struct drm_gem_object *obj) - { - struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj); -- int ret = 0; -+ long ret = 0; - - ret = amdgpu_bo_reserve(bo, false); - if (unlikely(ret != 0)) - return ret; - -+ /* -+ * Wait for all shared fences to complete before we switch to future -+ * use of exclusive fence on this prime shared bo. -+ */ -+ ret = reservation_object_wait_timeout_rcu(bo->tbo.resv, true, false, -+ MAX_SCHEDULE_TIMEOUT); -+ if (unlikely(ret < 0)) { -+ DRM_DEBUG_PRIME("Fence wait failed: %li\n", ret); -+ amdgpu_bo_unreserve(bo); -+ return ret; -+ } -+ - /* pin buffer into GTT */ - ret = amdgpu_bo_pin(bo, AMDGPU_GEM_DOMAIN_GTT, NULL); -+ if (likely(ret == 0)) -+ bo->prime_shared_count++; -+ - amdgpu_bo_unreserve(bo); - return ret; - } -@@ -102,6 +118,8 @@ void amdgpu_gem_prime_unpin(struct drm_gem_object *obj) - return; - - amdgpu_bo_unpin(bo); -+ if (bo->prime_shared_count) -+ bo->prime_shared_count--; - amdgpu_bo_unreserve(bo); - } - -diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c -index 1f8af87..cf25607 100644 ---- a/drivers/gpu/drm/i915/intel_bios.c -+++ b/drivers/gpu/drm/i915/intel_bios.c -@@ -1143,7 +1143,7 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port, - if (!child) - return; - -- aux_channel = child->raw[25]; -+ aux_channel = child->common.aux_channel; - ddc_pin = child->common.ddc_pin; - - is_dvi = child->common.device_type & DEVICE_TYPE_TMDS_DVI_SIGNALING; -@@ -1673,7 +1673,8 @@ bool intel_bios_is_port_edp(struct drm_i915_private *dev_priv, enum port port) - return false; - } - --bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, enum port port) -+static bool child_dev_is_dp_dual_mode(const union child_device_config *p_child, -+ enum port port) - { - static const struct { - u16 dp, hdmi; -@@ -1687,22 +1688,35 @@ bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, enum por - [PORT_D] = { DVO_PORT_DPD, DVO_PORT_HDMID, }, - [PORT_E] = { DVO_PORT_DPE, DVO_PORT_HDMIE, }, - }; -- int i; - - if (port == PORT_A || port >= ARRAY_SIZE(port_mapping)) - return false; - -- if (!dev_priv->vbt.child_dev_num) -+ if ((p_child->common.device_type & DEVICE_TYPE_DP_DUAL_MODE_BITS) != -+ (DEVICE_TYPE_DP_DUAL_MODE & DEVICE_TYPE_DP_DUAL_MODE_BITS)) - return false; - -+ if (p_child->common.dvo_port == port_mapping[port].dp) -+ return true; -+ -+ /* Only accept a HDMI dvo_port as DP++ if it has an AUX channel */ -+ if (p_child->common.dvo_port == port_mapping[port].hdmi && -+ p_child->common.aux_channel != 0) -+ return true; -+ -+ return false; -+} -+ -+bool intel_bios_is_port_dp_dual_mode(struct drm_i915_private *dev_priv, -+ enum port port) -+{ -+ int i; -+ - for (i = 0; i < dev_priv->vbt.child_dev_num; i++) { - const union child_device_config *p_child = - &dev_priv->vbt.child_dev[i]; - -- if ((p_child->common.dvo_port == port_mapping[port].dp || -- p_child->common.dvo_port == port_mapping[port].hdmi) && -- (p_child->common.device_type & DEVICE_TYPE_DP_DUAL_MODE_BITS) == -- (DEVICE_TYPE_DP_DUAL_MODE & DEVICE_TYPE_DP_DUAL_MODE_BITS)) -+ if (child_dev_is_dp_dual_mode(p_child, port)) - return true; - } - -diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index 3051182..b8aeb28 100644 ---- a/drivers/gpu/drm/i915/intel_dp.c -+++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -4323,21 +4323,11 @@ static enum drm_connector_status - intel_dp_detect(struct drm_connector *connector, bool force) - { - struct intel_dp *intel_dp = intel_attached_dp(connector); -- struct intel_digital_port *intel_dig_port = dp_to_dig_port(intel_dp); -- struct intel_encoder *intel_encoder = &intel_dig_port->base; - enum drm_connector_status status = connector->status; - - DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", - connector->base.id, connector->name); - -- if (intel_dp->is_mst) { -- /* MST devices are disconnected from a monitor POV */ -- intel_dp_unset_edid(intel_dp); -- if (intel_encoder->type != INTEL_OUTPUT_EDP) -- intel_encoder->type = INTEL_OUTPUT_DP; -- return connector_status_disconnected; -- } -- - /* If full detect is not performed yet, do a full detect */ - if (!intel_dp->detect_done) - status = intel_dp_long_pulse(intel_dp->attached_connector); -diff --git a/drivers/gpu/drm/i915/intel_vbt_defs.h b/drivers/gpu/drm/i915/intel_vbt_defs.h -index 68db962..8886cab1 100644 ---- a/drivers/gpu/drm/i915/intel_vbt_defs.h -+++ b/drivers/gpu/drm/i915/intel_vbt_defs.h -@@ -280,7 +280,8 @@ struct common_child_dev_config { - u8 dp_support:1; - u8 tmds_support:1; - u8 support_reserved:5; -- u8 not_common3[12]; -+ u8 aux_channel; -+ u8 not_common3[11]; - u8 iboost_level; - } __packed; - -diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig -index d223650..11edabf 100644 ---- a/drivers/i2c/Kconfig -+++ b/drivers/i2c/Kconfig -@@ -59,7 +59,6 @@ config I2C_CHARDEV - - config I2C_MUX - tristate "I2C bus multiplexing support" -- depends on HAS_IOMEM - help - Say Y here if you want the I2C core to support the ability to - handle multiplexed I2C bus topologies, by presenting each -diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig -index e280c8e..96de9ce 100644 ---- a/drivers/i2c/muxes/Kconfig -+++ b/drivers/i2c/muxes/Kconfig -@@ -63,6 +63,7 @@ config I2C_MUX_PINCTRL - - config I2C_MUX_REG - tristate "Register-based I2C multiplexer" -+ depends on HAS_IOMEM - help - If you say yes to this option, support will be included for a - register based I2C multiplexer. This driver provides access to -diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c -index 3278ebf..7e6f300 100644 ---- a/drivers/i2c/muxes/i2c-mux-pca954x.c -+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c -@@ -247,9 +247,9 @@ static int pca954x_probe(struct i2c_client *client, - /* discard unconfigured channels */ - break; - idle_disconnect_pd = pdata->modes[num].deselect_on_exit; -- data->deselect |= (idle_disconnect_pd -- || idle_disconnect_dt) << num; - } -+ data->deselect |= (idle_disconnect_pd || -+ idle_disconnect_dt) << num; - - ret = i2c_mux_add_adapter(muxc, force, num, class); - -diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c -index c995255..71c7c4c 100644 ---- a/drivers/infiniband/core/cm.c -+++ b/drivers/infiniband/core/cm.c -@@ -80,6 +80,8 @@ static struct ib_cm { - __be32 random_id_operand; - struct list_head timewait_list; - struct workqueue_struct *wq; -+ /* Sync on cm change port state */ -+ spinlock_t state_lock; - } cm; - - /* Counter indexes ordered by attribute ID */ -@@ -161,6 +163,8 @@ struct cm_port { - struct ib_mad_agent *mad_agent; - struct kobject port_obj; - u8 port_num; -+ struct list_head cm_priv_prim_list; -+ struct list_head cm_priv_altr_list; - struct cm_counter_group counter_group[CM_COUNTER_GROUPS]; - }; - -@@ -241,6 +245,12 @@ struct cm_id_private { - u8 service_timeout; - u8 target_ack_delay; - -+ struct list_head prim_list; -+ struct list_head altr_list; -+ /* Indicates that the send port mad is registered and av is set */ -+ int prim_send_port_not_ready; -+ int altr_send_port_not_ready; -+ - struct list_head work_list; - atomic_t work_count; - }; -@@ -259,20 +269,47 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv, - struct ib_mad_agent *mad_agent; - struct ib_mad_send_buf *m; - struct ib_ah *ah; -+ struct cm_av *av; -+ unsigned long flags, flags2; -+ int ret = 0; - -+ /* don't let the port to be released till the agent is down */ -+ spin_lock_irqsave(&cm.state_lock, flags2); -+ spin_lock_irqsave(&cm.lock, flags); -+ if (!cm_id_priv->prim_send_port_not_ready) -+ av = &cm_id_priv->av; -+ else if (!cm_id_priv->altr_send_port_not_ready && -+ (cm_id_priv->alt_av.port)) -+ av = &cm_id_priv->alt_av; -+ else { -+ pr_info("%s: not valid CM id\n", __func__); -+ ret = -ENODEV; -+ spin_unlock_irqrestore(&cm.lock, flags); -+ goto out; -+ } -+ spin_unlock_irqrestore(&cm.lock, flags); -+ /* Make sure the port haven't released the mad yet */ - mad_agent = cm_id_priv->av.port->mad_agent; -- ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr); -- if (IS_ERR(ah)) -- return PTR_ERR(ah); -+ if (!mad_agent) { -+ pr_info("%s: not a valid MAD agent\n", __func__); -+ ret = -ENODEV; -+ goto out; -+ } -+ ah = ib_create_ah(mad_agent->qp->pd, &av->ah_attr); -+ if (IS_ERR(ah)) { -+ ret = PTR_ERR(ah); -+ goto out; -+ } - - m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn, -- cm_id_priv->av.pkey_index, -+ av->pkey_index, - 0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA, - GFP_ATOMIC, - IB_MGMT_BASE_VERSION); - if (IS_ERR(m)) { - ib_destroy_ah(ah); -- return PTR_ERR(m); -+ ret = PTR_ERR(m); -+ goto out; - } - - /* Timeout set by caller if response is expected. */ -@@ -282,7 +319,10 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv, - atomic_inc(&cm_id_priv->refcount); - m->context[0] = cm_id_priv; - *msg = m; -- return 0; -+ -+out: -+ spin_unlock_irqrestore(&cm.state_lock, flags2); -+ return ret; - } - - static int cm_alloc_response_msg(struct cm_port *port, -@@ -352,7 +392,8 @@ static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc, - grh, &av->ah_attr); - } - --static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av) -+static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av, -+ struct cm_id_private *cm_id_priv) - { - struct cm_device *cm_dev; - struct cm_port *port = NULL; -@@ -387,7 +428,17 @@ static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av) - &av->ah_attr); - av->timeout = path->packet_life_time + 1; - -- return 0; -+ spin_lock_irqsave(&cm.lock, flags); -+ if (&cm_id_priv->av == av) -+ list_add_tail(&cm_id_priv->prim_list, &port->cm_priv_prim_list); -+ else if (&cm_id_priv->alt_av == av) -+ list_add_tail(&cm_id_priv->altr_list, &port->cm_priv_altr_list); -+ else -+ ret = -EINVAL; -+ -+ spin_unlock_irqrestore(&cm.lock, flags); -+ -+ return ret; - } - - static int cm_alloc_id(struct cm_id_private *cm_id_priv) -@@ -677,6 +728,8 @@ struct ib_cm_id *ib_create_cm_id(struct ib_device *device, - spin_lock_init(&cm_id_priv->lock); - init_completion(&cm_id_priv->comp); - INIT_LIST_HEAD(&cm_id_priv->work_list); -+ INIT_LIST_HEAD(&cm_id_priv->prim_list); -+ INIT_LIST_HEAD(&cm_id_priv->altr_list); - atomic_set(&cm_id_priv->work_count, -1); - atomic_set(&cm_id_priv->refcount, 1); - return &cm_id_priv->id; -@@ -892,6 +945,15 @@ static void cm_destroy_id(struct ib_cm_id *cm_id, int err) - break; - } - -+ spin_lock_irq(&cm.lock); -+ if (!list_empty(&cm_id_priv->altr_list) && -+ (!cm_id_priv->altr_send_port_not_ready)) -+ list_del(&cm_id_priv->altr_list); -+ if (!list_empty(&cm_id_priv->prim_list) && -+ (!cm_id_priv->prim_send_port_not_ready)) -+ list_del(&cm_id_priv->prim_list); -+ spin_unlock_irq(&cm.lock); -+ - cm_free_id(cm_id->local_id); - cm_deref_id(cm_id_priv); - wait_for_completion(&cm_id_priv->comp); -@@ -1192,12 +1254,13 @@ int ib_send_cm_req(struct ib_cm_id *cm_id, - goto out; - } - -- ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av); -+ ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av, -+ cm_id_priv); - if (ret) - goto error1; - if (param->alternate_path) { - ret = cm_init_av_by_path(param->alternate_path, -- &cm_id_priv->alt_av); -+ &cm_id_priv->alt_av, cm_id_priv); - if (ret) - goto error1; - } -@@ -1653,7 +1716,8 @@ static int cm_req_handler(struct cm_work *work) - dev_put(gid_attr.ndev); - } - work->path[0].gid_type = gid_attr.gid_type; -- ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av); -+ ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av, -+ cm_id_priv); - } - if (ret) { - int err = ib_get_cached_gid(work->port->cm_dev->ib_device, -@@ -1672,7 +1736,8 @@ static int cm_req_handler(struct cm_work *work) - goto rejected; - } - if (req_msg->alt_local_lid) { -- ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av); -+ ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av, -+ cm_id_priv); - if (ret) { - ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_ALT_GID, - &work->path[0].sgid, -@@ -2727,7 +2792,8 @@ int ib_send_cm_lap(struct ib_cm_id *cm_id, - goto out; - } - -- ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av); -+ ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av, -+ cm_id_priv); - if (ret) - goto out; - cm_id_priv->alt_av.timeout = -@@ -2839,7 +2905,8 @@ static int cm_lap_handler(struct cm_work *work) - cm_init_av_for_response(work->port, work->mad_recv_wc->wc, - work->mad_recv_wc->recv_buf.grh, - &cm_id_priv->av); -- cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av); -+ cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av, -+ cm_id_priv); - ret = atomic_inc_and_test(&cm_id_priv->work_count); - if (!ret) - list_add_tail(&work->list, &cm_id_priv->work_list); -@@ -3031,7 +3098,7 @@ int ib_send_cm_sidr_req(struct ib_cm_id *cm_id, - return -EINVAL; - - cm_id_priv = container_of(cm_id, struct cm_id_private, id); -- ret = cm_init_av_by_path(param->path, &cm_id_priv->av); -+ ret = cm_init_av_by_path(param->path, &cm_id_priv->av, cm_id_priv); - if (ret) - goto out; - -@@ -3468,7 +3535,9 @@ static int cm_establish(struct ib_cm_id *cm_id) - static int cm_migrate(struct ib_cm_id *cm_id) - { - struct cm_id_private *cm_id_priv; -+ struct cm_av tmp_av; - unsigned long flags; -+ int tmp_send_port_not_ready; - int ret = 0; - - cm_id_priv = container_of(cm_id, struct cm_id_private, id); -@@ -3477,7 +3546,14 @@ static int cm_migrate(struct ib_cm_id *cm_id) - (cm_id->lap_state == IB_CM_LAP_UNINIT || - cm_id->lap_state == IB_CM_LAP_IDLE)) { - cm_id->lap_state = IB_CM_LAP_IDLE; -+ /* Swap address vector */ -+ tmp_av = cm_id_priv->av; - cm_id_priv->av = cm_id_priv->alt_av; -+ cm_id_priv->alt_av = tmp_av; -+ /* Swap port send ready state */ -+ tmp_send_port_not_ready = cm_id_priv->prim_send_port_not_ready; -+ cm_id_priv->prim_send_port_not_ready = cm_id_priv->altr_send_port_not_ready; -+ cm_id_priv->altr_send_port_not_ready = tmp_send_port_not_ready; - } else - ret = -EINVAL; - spin_unlock_irqrestore(&cm_id_priv->lock, flags); -@@ -3888,6 +3964,9 @@ static void cm_add_one(struct ib_device *ib_device) - port->cm_dev = cm_dev; - port->port_num = i; - -+ INIT_LIST_HEAD(&port->cm_priv_prim_list); -+ INIT_LIST_HEAD(&port->cm_priv_altr_list); -+ - ret = cm_create_port_fs(port); - if (ret) - goto error1; -@@ -3945,6 +4024,8 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) - { - struct cm_device *cm_dev = client_data; - struct cm_port *port; -+ struct cm_id_private *cm_id_priv; -+ struct ib_mad_agent *cur_mad_agent; - struct ib_port_modify port_modify = { - .clr_port_cap_mask = IB_PORT_CM_SUP - }; -@@ -3968,15 +4049,27 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) - - port = cm_dev->port[i-1]; - ib_modify_port(ib_device, port->port_num, 0, &port_modify); -+ /* Mark all the cm_id's as not valid */ -+ spin_lock_irq(&cm.lock); -+ list_for_each_entry(cm_id_priv, &port->cm_priv_altr_list, altr_list) -+ cm_id_priv->altr_send_port_not_ready = 1; -+ list_for_each_entry(cm_id_priv, &port->cm_priv_prim_list, prim_list) -+ cm_id_priv->prim_send_port_not_ready = 1; -+ spin_unlock_irq(&cm.lock); - /* - * We flush the queue here after the going_down set, this - * verify that no new works will be queued in the recv handler, - * after that we can call the unregister_mad_agent - */ - flush_workqueue(cm.wq); -- ib_unregister_mad_agent(port->mad_agent); -+ spin_lock_irq(&cm.state_lock); -+ cur_mad_agent = port->mad_agent; -+ port->mad_agent = NULL; -+ spin_unlock_irq(&cm.state_lock); -+ ib_unregister_mad_agent(cur_mad_agent); - cm_remove_port_fs(port); - } -+ - device_unregister(cm_dev->device); - kfree(cm_dev); - } -@@ -3989,6 +4082,7 @@ static int __init ib_cm_init(void) - INIT_LIST_HEAD(&cm.device_list); - rwlock_init(&cm.device_lock); - spin_lock_init(&cm.lock); -+ spin_lock_init(&cm.state_lock); - cm.listen_service_table = RB_ROOT; - cm.listen_service_id = be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID); - cm.remote_id_table = RB_ROOT; -diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c -index c68746c..bdab61d 100644 ---- a/drivers/infiniband/core/umem.c -+++ b/drivers/infiniband/core/umem.c -@@ -174,7 +174,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, - - cur_base = addr & PAGE_MASK; - -- if (npages == 0) { -+ if (npages == 0 || npages > UINT_MAX) { - ret = -EINVAL; - goto out; - } -diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c -index 0012fa5..44b1104 100644 ---- a/drivers/infiniband/core/uverbs_main.c -+++ b/drivers/infiniband/core/uverbs_main.c -@@ -262,12 +262,9 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file, - container_of(uobj, struct ib_uqp_object, uevent.uobject); - - idr_remove_uobj(&ib_uverbs_qp_idr, uobj); -- if (qp != qp->real_qp) { -- ib_close_qp(qp); -- } else { -+ if (qp == qp->real_qp) - ib_uverbs_detach_umcast(qp, uqp); -- ib_destroy_qp(qp); -- } -+ ib_destroy_qp(qp); - ib_uverbs_release_uevent(file, &uqp->uevent); - kfree(uqp); - } -diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c -index bcf76c3..e362998 100644 ---- a/drivers/infiniband/hw/hfi1/rc.c -+++ b/drivers/infiniband/hw/hfi1/rc.c -@@ -87,7 +87,7 @@ void hfi1_add_rnr_timer(struct rvt_qp *qp, u32 to) - struct hfi1_qp_priv *priv = qp->priv; - - qp->s_flags |= RVT_S_WAIT_RNR; -- qp->s_timer.expires = jiffies + usecs_to_jiffies(to); -+ priv->s_rnr_timer.expires = jiffies + usecs_to_jiffies(to); - add_timer(&priv->s_rnr_timer); - } - -diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c -index 1694037..8f59a4f 100644 ---- a/drivers/infiniband/hw/hfi1/user_sdma.c -+++ b/drivers/infiniband/hw/hfi1/user_sdma.c -@@ -1152,7 +1152,7 @@ static int pin_vector_pages(struct user_sdma_request *req, - rb_node = hfi1_mmu_rb_extract(pq->handler, - (unsigned long)iovec->iov.iov_base, - iovec->iov.iov_len); -- if (rb_node && !IS_ERR(rb_node)) -+ if (rb_node) - node = container_of(rb_node, struct sdma_mmu_node, rb); - else - rb_node = NULL; -diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c -index 5fc6233..b9bf075 100644 ---- a/drivers/infiniband/hw/mlx4/ah.c -+++ b/drivers/infiniband/hw/mlx4/ah.c -@@ -102,7 +102,10 @@ static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr - if (vlan_tag < 0x1000) - vlan_tag |= (ah_attr->sl & 7) << 13; - ah->av.eth.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24)); -- ah->av.eth.gid_index = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index); -+ ret = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index); -+ if (ret < 0) -+ return ERR_PTR(ret); -+ ah->av.eth.gid_index = ret; - ah->av.eth.vlan = cpu_to_be16(vlan_tag); - ah->av.eth.hop_limit = ah_attr->grh.hop_limit; - if (ah_attr->static_rate) { -diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c -index 5df63da..efb6414 100644 ---- a/drivers/infiniband/hw/mlx4/cq.c -+++ b/drivers/infiniband/hw/mlx4/cq.c -@@ -253,11 +253,14 @@ struct ib_cq *mlx4_ib_create_cq(struct ib_device *ibdev, - if (context) - if (ib_copy_to_udata(udata, &cq->mcq.cqn, sizeof (__u32))) { - err = -EFAULT; -- goto err_dbmap; -+ goto err_cq_free; - } - - return &cq->ibcq; - -+err_cq_free: -+ mlx4_cq_free(dev->dev, &cq->mcq); -+ - err_dbmap: - if (context) - mlx4_ib_db_unmap_user(to_mucontext(context), &cq->db); -diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c -index e4fac929..ebe43cb 100644 ---- a/drivers/infiniband/hw/mlx5/cq.c -+++ b/drivers/infiniband/hw/mlx5/cq.c -@@ -917,8 +917,7 @@ struct ib_cq *mlx5_ib_create_cq(struct ib_device *ibdev, - if (err) - goto err_create; - } else { -- /* for now choose 64 bytes till we have a proper interface */ -- cqe_size = 64; -+ cqe_size = cache_line_size() == 128 ? 128 : 64; - err = create_cq_kernel(dev, cq, entries, cqe_size, &cqb, - &index, &inlen); - if (err) -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index bff8707a..19f8820 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -2100,14 +2100,14 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context, - { - struct mlx5_ib_dev *ibdev = (struct mlx5_ib_dev *)context; - struct ib_event ibev; -- -+ bool fatal = false; - u8 port = 0; - - switch (event) { - case MLX5_DEV_EVENT_SYS_ERROR: -- ibdev->ib_active = false; - ibev.event = IB_EVENT_DEVICE_FATAL; - mlx5_ib_handle_internal_error(ibdev); -+ fatal = true; - break; - - case MLX5_DEV_EVENT_PORT_UP: -@@ -2154,6 +2154,9 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context, - - if (ibdev->ib_active) - ib_dispatch_event(&ibev); -+ -+ if (fatal) -+ ibdev->ib_active = false; - } - - static void get_ext_port_caps(struct mlx5_ib_dev *dev) -@@ -2835,7 +2838,7 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev) - } - err = init_node_data(dev); - if (err) -- goto err_dealloc; -+ goto err_free_port; - - mutex_init(&dev->flow_db.lock); - mutex_init(&dev->cap_mask_mutex); -@@ -2845,7 +2848,7 @@ static void *mlx5_ib_add(struct mlx5_core_dev *mdev) - if (ll == IB_LINK_LAYER_ETHERNET) { - err = mlx5_enable_roce(dev); - if (err) -- goto err_dealloc; -+ goto err_free_port; - } - - err = create_dev_resources(&dev->devr); -diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c -index affc3f6..19d590d 100644 ---- a/drivers/infiniband/hw/mlx5/qp.c -+++ b/drivers/infiniband/hw/mlx5/qp.c -@@ -2037,8 +2037,8 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd, - - mlx5_ib_dbg(dev, "ib qpnum 0x%x, mlx qpn 0x%x, rcqn 0x%x, scqn 0x%x\n", - qp->ibqp.qp_num, qp->trans_qp.base.mqp.qpn, -- to_mcq(init_attr->recv_cq)->mcq.cqn, -- to_mcq(init_attr->send_cq)->mcq.cqn); -+ init_attr->recv_cq ? to_mcq(init_attr->recv_cq)->mcq.cqn : -1, -+ init_attr->send_cq ? to_mcq(init_attr->send_cq)->mcq.cqn : -1); - - qp->trans_qp.xrcdn = xrcdn; - -@@ -4702,6 +4702,14 @@ struct ib_rwq_ind_table *mlx5_ib_create_rwq_ind_table(struct ib_device *device, - udata->inlen)) - return ERR_PTR(-EOPNOTSUPP); - -+ if (init_attr->log_ind_tbl_size > -+ MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)) { -+ mlx5_ib_dbg(dev, "log_ind_tbl_size = %d is bigger than supported = %d\n", -+ init_attr->log_ind_tbl_size, -+ MLX5_CAP_GEN(dev->mdev, log_max_rqt_size)); -+ return ERR_PTR(-EINVAL); -+ } -+ - min_resp_len = offsetof(typeof(resp), reserved) + sizeof(resp.reserved); - if (udata->outlen && udata->outlen < min_resp_len) - return ERR_PTR(-EINVAL); -diff --git a/drivers/infiniband/sw/rdmavt/dma.c b/drivers/infiniband/sw/rdmavt/dma.c -index 33076a5..04ebbb5 100644 ---- a/drivers/infiniband/sw/rdmavt/dma.c -+++ b/drivers/infiniband/sw/rdmavt/dma.c -@@ -90,9 +90,6 @@ static u64 rvt_dma_map_page(struct ib_device *dev, struct page *page, - if (WARN_ON(!valid_dma_direction(direction))) - return BAD_DMA_ADDRESS; - -- if (offset + size > PAGE_SIZE) -- return BAD_DMA_ADDRESS; -- - addr = (u64)page_address(page); - if (addr) - addr += offset; -diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c -index eedf2f1..7f5d735 100644 ---- a/drivers/infiniband/sw/rxe/rxe_net.c -+++ b/drivers/infiniband/sw/rxe/rxe_net.c -@@ -243,10 +243,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port, - { - int err; - struct socket *sock; -- struct udp_port_cfg udp_cfg; -- struct udp_tunnel_sock_cfg tnl_cfg; -- -- memset(&udp_cfg, 0, sizeof(udp_cfg)); -+ struct udp_port_cfg udp_cfg = {0}; -+ struct udp_tunnel_sock_cfg tnl_cfg = {0}; - - if (ipv6) { - udp_cfg.family = AF_INET6; -@@ -264,10 +262,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port, - return ERR_PTR(err); - } - -- tnl_cfg.sk_user_data = NULL; - tnl_cfg.encap_type = 1; - tnl_cfg.encap_rcv = rxe_udp_encap_recv; -- tnl_cfg.encap_destroy = NULL; - - /* Setup UDP tunnel */ - setup_udp_tunnel_sock(net, sock, &tnl_cfg); -diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c -index 22ba24f..f724a7e 100644 ---- a/drivers/infiniband/sw/rxe/rxe_qp.c -+++ b/drivers/infiniband/sw/rxe/rxe_qp.c -@@ -522,6 +522,7 @@ static void rxe_qp_reset(struct rxe_qp *qp) - if (qp->sq.queue) { - __rxe_do_task(&qp->comp.task); - __rxe_do_task(&qp->req.task); -+ rxe_queue_reset(qp->sq.queue); - } - - /* cleanup attributes */ -@@ -573,6 +574,7 @@ void rxe_qp_error(struct rxe_qp *qp) - { - qp->req.state = QP_STATE_ERROR; - qp->resp.state = QP_STATE_ERROR; -+ qp->attr.qp_state = IB_QPS_ERR; - - /* drain work and packet queues */ - rxe_run_task(&qp->resp.task, 1); -diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c -index 0827425..d14bf49 100644 ---- a/drivers/infiniband/sw/rxe/rxe_queue.c -+++ b/drivers/infiniband/sw/rxe/rxe_queue.c -@@ -84,6 +84,15 @@ int do_mmap_info(struct rxe_dev *rxe, - return -EINVAL; - } - -+inline void rxe_queue_reset(struct rxe_queue *q) -+{ -+ /* queue is comprised from header and the memory -+ * of the actual queue. See "struct rxe_queue_buf" in rxe_queue.h -+ * reset only the queue itself and not the management header -+ */ -+ memset(q->buf->data, 0, q->buf_size - sizeof(struct rxe_queue_buf)); -+} -+ - struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, - int *num_elem, - unsigned int elem_size) -diff --git a/drivers/infiniband/sw/rxe/rxe_queue.h b/drivers/infiniband/sw/rxe/rxe_queue.h -index 239fd60..8c8641c 100644 ---- a/drivers/infiniband/sw/rxe/rxe_queue.h -+++ b/drivers/infiniband/sw/rxe/rxe_queue.h -@@ -84,6 +84,8 @@ int do_mmap_info(struct rxe_dev *rxe, - size_t buf_size, - struct rxe_mmap_info **ip_p); - -+void rxe_queue_reset(struct rxe_queue *q); -+ - struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, - int *num_elem, - unsigned int elem_size); -diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c -index 13a848a..43bb166 100644 ---- a/drivers/infiniband/sw/rxe/rxe_req.c -+++ b/drivers/infiniband/sw/rxe/rxe_req.c -@@ -695,7 +695,8 @@ int rxe_requester(void *arg) - qp->req.wqe_index); - wqe->state = wqe_state_done; - wqe->status = IB_WC_SUCCESS; -- goto complete; -+ __rxe_do_task(&qp->comp.task); -+ return 0; - } - payload = mtu; - } -@@ -744,13 +745,17 @@ int rxe_requester(void *arg) - wqe->status = IB_WC_LOC_PROT_ERR; - wqe->state = wqe_state_error; - --complete: -- if (qp_type(qp) != IB_QPT_RC) { -- while (rxe_completer(qp) == 0) -- ; -- } -- -- return 0; -+ /* -+ * IBA Spec. Section 10.7.3.1 SIGNALED COMPLETIONS -+ * ---------8<---------8<------------- -+ * ...Note that if a completion error occurs, a Work Completion -+ * will always be generated, even if the signaling -+ * indicator requests an Unsignaled Completion. -+ * ---------8<---------8<------------- -+ */ -+ wqe->wr.send_flags |= IB_SEND_SIGNALED; -+ __rxe_do_task(&qp->comp.task); -+ return -EAGAIN; - - exit: - return -EAGAIN; -diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c -index 41b1138..70c646b 100644 ---- a/drivers/mfd/intel-lpss.c -+++ b/drivers/mfd/intel-lpss.c -@@ -502,9 +502,6 @@ int intel_lpss_suspend(struct device *dev) - for (i = 0; i < LPSS_PRIV_REG_COUNT; i++) - lpss->priv_ctx[i] = readl(lpss->priv + i * 4); - -- /* Put the device into reset state */ -- writel(0, lpss->priv + LPSS_PRIV_RESETS); -- - return 0; - } - EXPORT_SYMBOL_GPL(intel_lpss_suspend); -diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c -index 3ac486a..c57e407 100644 ---- a/drivers/mfd/mfd-core.c -+++ b/drivers/mfd/mfd-core.c -@@ -399,6 +399,8 @@ int mfd_clone_cell(const char *cell, const char **clones, size_t n_clones) - clones[i]); - } - -+ put_device(dev); -+ - return 0; - } - EXPORT_SYMBOL(mfd_clone_cell); -diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c -index 94c7cc0..00dd7ff 100644 ---- a/drivers/mfd/stmpe.c -+++ b/drivers/mfd/stmpe.c -@@ -761,6 +761,8 @@ static int stmpe1801_reset(struct stmpe *stmpe) - if (ret < 0) - return ret; - -+ msleep(10); -+ - timeout = jiffies + msecs_to_jiffies(100); - while (time_before(jiffies, timeout)) { - ret = __stmpe_reg_read(stmpe, STMPE1801_REG_SYS_CTRL); -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 1b5f531..bf3fd34 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -2010,23 +2010,33 @@ static struct virtio_device_id id_table[] = { - { 0 }, - }; - -+#define VIRTNET_FEATURES \ -+ VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM, \ -+ VIRTIO_NET_F_MAC, \ -+ VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6, \ -+ VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6, \ -+ VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO, \ -+ VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ, \ -+ VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN, \ -+ VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ, \ -+ VIRTIO_NET_F_CTRL_MAC_ADDR, \ -+ VIRTIO_NET_F_MTU -+ - static unsigned int features[] = { -- VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM, -- VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC, -- VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6, -- VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6, -- VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO, -- VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ, -- VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN, -- VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ, -- VIRTIO_NET_F_CTRL_MAC_ADDR, -+ VIRTNET_FEATURES, -+}; -+ -+static unsigned int features_legacy[] = { -+ VIRTNET_FEATURES, -+ VIRTIO_NET_F_GSO, - VIRTIO_F_ANY_LAYOUT, -- VIRTIO_NET_F_MTU, - }; - - static struct virtio_driver virtio_net_driver = { - .feature_table = features, - .feature_table_size = ARRAY_SIZE(features), -+ .feature_table_legacy = features_legacy, -+ .feature_table_size_legacy = ARRAY_SIZE(features_legacy), - .driver.name = KBUILD_MODNAME, - .driver.owner = THIS_MODULE, - .id_table = id_table, -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c -index 4fdc3da..ea67ae9 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c -@@ -1087,6 +1087,15 @@ iwl_mvm_netdetect_config(struct iwl_mvm *mvm, - ret = iwl_mvm_switch_to_d3(mvm); - if (ret) - return ret; -+ } else { -+ /* In theory, we wouldn't have to stop a running sched -+ * scan in order to start another one (for -+ * net-detect). But in practice this doesn't seem to -+ * work properly, so stop any running sched_scan now. -+ */ -+ ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, true); -+ if (ret) -+ return ret; - } - - /* rfkill release can be either for wowlan or netdetect */ -@@ -2088,6 +2097,16 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test) - iwl_mvm_update_changed_regdom(mvm); - - if (mvm->net_detect) { -+ /* If this is a non-unified image, we restart the FW, -+ * so no need to stop the netdetect scan. If that -+ * fails, continue and try to get the wake-up reasons, -+ * but trigger a HW restart by keeping a failure code -+ * in ret. -+ */ -+ if (unified_image) -+ ret = iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_NETDETECT, -+ false); -+ - iwl_mvm_query_netdetect_reasons(mvm, vif); - /* has unlocked the mutex, so skip that */ - goto out; -@@ -2271,7 +2290,8 @@ static void iwl_mvm_d3_test_disconn_work_iter(void *_data, u8 *mac, - static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file) - { - struct iwl_mvm *mvm = inode->i_private; -- int remaining_time = 10; -+ bool unified_image = fw_has_capa(&mvm->fw->ucode_capa, -+ IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG); - - mvm->d3_test_active = false; - -@@ -2282,17 +2302,21 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file) - mvm->trans->system_pm_mode = IWL_PLAT_PM_MODE_DISABLED; - - iwl_abort_notification_waits(&mvm->notif_wait); -- ieee80211_restart_hw(mvm->hw); -+ if (!unified_image) { -+ int remaining_time = 10; - -- /* wait for restart and disconnect all interfaces */ -- while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) && -- remaining_time > 0) { -- remaining_time--; -- msleep(1000); -- } -+ ieee80211_restart_hw(mvm->hw); - -- if (remaining_time == 0) -- IWL_ERR(mvm, "Timed out waiting for HW restart to finish!\n"); -+ /* wait for restart and disconnect all interfaces */ -+ while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) && -+ remaining_time > 0) { -+ remaining_time--; -+ msleep(1000); -+ } -+ -+ if (remaining_time == 0) -+ IWL_ERR(mvm, "Timed out waiting for HW restart!\n"); -+ } - - ieee80211_iterate_active_interfaces_atomic( - mvm->hw, IEEE80211_IFACE_ITER_NORMAL, -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -index 5dd77e3..90a1f4a 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -@@ -4097,7 +4097,6 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm, - struct iwl_mvm_internal_rxq_notif *notif, - u32 size) - { -- DECLARE_WAIT_QUEUE_HEAD_ONSTACK(notif_waitq); - u32 qmask = BIT(mvm->trans->num_rx_queues) - 1; - int ret; - -@@ -4119,7 +4118,7 @@ void iwl_mvm_sync_rx_queues_internal(struct iwl_mvm *mvm, - } - - if (notif->sync) -- ret = wait_event_timeout(notif_waitq, -+ ret = wait_event_timeout(mvm->rx_sync_waitq, - atomic_read(&mvm->queue_sync_counter) == 0, - HZ); - WARN_ON_ONCE(!ret); -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h -index 6a615bb..e9cb970 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h -@@ -932,6 +932,7 @@ struct iwl_mvm { - /* sync d0i3_tx queue and IWL_MVM_STATUS_IN_D0I3 status flag */ - spinlock_t d0i3_tx_lock; - wait_queue_head_t d0i3_exit_waitq; -+ wait_queue_head_t rx_sync_waitq; - - /* BT-Coex */ - struct iwl_bt_coex_profile_notif last_bt_notif; -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -index 55d9096..30bbdec 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -@@ -618,6 +618,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg, - spin_lock_init(&mvm->refs_lock); - skb_queue_head_init(&mvm->d0i3_tx); - init_waitqueue_head(&mvm->d0i3_exit_waitq); -+ init_waitqueue_head(&mvm->rx_sync_waitq); - - atomic_set(&mvm->queue_sync_counter, 0); - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c -index afb7eb6..2b994be 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c -@@ -545,7 +545,8 @@ void iwl_mvm_rx_queue_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb, - "Received expired RX queue sync message\n"); - return; - } -- atomic_dec(&mvm->queue_sync_counter); -+ if (!atomic_dec_return(&mvm->queue_sync_counter)) -+ wake_up(&mvm->rx_sync_waitq); - } - - switch (internal_notif->type) { -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c -index dac120f..3707ec6 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c -@@ -1185,6 +1185,9 @@ static int iwl_mvm_num_scans(struct iwl_mvm *mvm) - - static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type) - { -+ bool unified_image = fw_has_capa(&mvm->fw->ucode_capa, -+ IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG); -+ - /* This looks a bit arbitrary, but the idea is that if we run - * out of possible simultaneous scans and the userspace is - * trying to run a scan type that is already running, we -@@ -1211,12 +1214,30 @@ static int iwl_mvm_check_running_scans(struct iwl_mvm *mvm, int type) - return -EBUSY; - return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, true); - case IWL_MVM_SCAN_NETDETECT: -- /* No need to stop anything for net-detect since the -- * firmware is restarted anyway. This way, any sched -- * scans that were running will be restarted when we -- * resume. -- */ -- return 0; -+ /* For non-unified images, there's no need to stop -+ * anything for net-detect since the firmware is -+ * restarted anyway. This way, any sched scans that -+ * were running will be restarted when we resume. -+ */ -+ if (!unified_image) -+ return 0; -+ -+ /* If this is a unified image and we ran out of scans, -+ * we need to stop something. Prefer stopping regular -+ * scans, because the results are useless at this -+ * point, and we should be able to keep running -+ * another scheduled scan while suspended. -+ */ -+ if (mvm->scan_status & IWL_MVM_SCAN_REGULAR_MASK) -+ return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_REGULAR, -+ true); -+ if (mvm->scan_status & IWL_MVM_SCAN_SCHED_MASK) -+ return iwl_mvm_scan_stop(mvm, IWL_MVM_SCAN_SCHED, -+ true); -+ -+ /* fall through, something is wrong if no scan was -+ * running but we ran out of scans. -+ */ - default: - WARN_ON(1); - break; -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c -index 78cf9a7..13842ca 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c -@@ -526,48 +526,64 @@ static const struct pci_device_id iwl_hw_card_ids[] = { - MODULE_DEVICE_TABLE(pci, iwl_hw_card_ids); - - #ifdef CONFIG_ACPI --#define SPL_METHOD "SPLC" --#define SPL_DOMAINTYPE_MODULE BIT(0) --#define SPL_DOMAINTYPE_WIFI BIT(1) --#define SPL_DOMAINTYPE_WIGIG BIT(2) --#define SPL_DOMAINTYPE_RFEM BIT(3) -+#define ACPI_SPLC_METHOD "SPLC" -+#define ACPI_SPLC_DOMAIN_WIFI (0x07) - --static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx) -+static u64 splc_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splc) - { -- union acpi_object *limits, *domain_type, *power_limit; -- -- if (splx->type != ACPI_TYPE_PACKAGE || -- splx->package.count != 2 || -- splx->package.elements[0].type != ACPI_TYPE_INTEGER || -- splx->package.elements[0].integer.value != 0) { -- IWL_ERR(trans, "Unsupported splx structure\n"); -+ union acpi_object *data_pkg, *dflt_pwr_limit; -+ int i; -+ -+ /* We need at least two elements, one for the revision and one -+ * for the data itself. Also check that the revision is -+ * supported (currently only revision 0). -+ */ -+ if (splc->type != ACPI_TYPE_PACKAGE || -+ splc->package.count < 2 || -+ splc->package.elements[0].type != ACPI_TYPE_INTEGER || -+ splc->package.elements[0].integer.value != 0) { -+ IWL_DEBUG_INFO(trans, -+ "Unsupported structure returned by the SPLC method. Ignoring.\n"); - return 0; - } - -- limits = &splx->package.elements[1]; -- if (limits->type != ACPI_TYPE_PACKAGE || -- limits->package.count < 2 || -- limits->package.elements[0].type != ACPI_TYPE_INTEGER || -- limits->package.elements[1].type != ACPI_TYPE_INTEGER) { -- IWL_ERR(trans, "Invalid limits element\n"); -- return 0; -+ /* loop through all the packages to find the one for WiFi */ -+ for (i = 1; i < splc->package.count; i++) { -+ union acpi_object *domain; -+ -+ data_pkg = &splc->package.elements[i]; -+ -+ /* Skip anything that is not a package with the right -+ * amount of elements (i.e. at least 2 integers). -+ */ -+ if (data_pkg->type != ACPI_TYPE_PACKAGE || -+ data_pkg->package.count < 2 || -+ data_pkg->package.elements[0].type != ACPI_TYPE_INTEGER || -+ data_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) -+ continue; -+ -+ domain = &data_pkg->package.elements[0]; -+ if (domain->integer.value == ACPI_SPLC_DOMAIN_WIFI) -+ break; -+ -+ data_pkg = NULL; - } - -- domain_type = &limits->package.elements[0]; -- power_limit = &limits->package.elements[1]; -- if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) { -- IWL_DEBUG_INFO(trans, "WiFi power is not limited\n"); -+ if (!data_pkg) { -+ IWL_DEBUG_INFO(trans, -+ "No element for the WiFi domain returned by the SPLC method.\n"); - return 0; - } - -- return power_limit->integer.value; -+ dflt_pwr_limit = &data_pkg->package.elements[1]; -+ return dflt_pwr_limit->integer.value; - } - - static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev) - { - acpi_handle pxsx_handle; - acpi_handle handle; -- struct acpi_buffer splx = {ACPI_ALLOCATE_BUFFER, NULL}; -+ struct acpi_buffer splc = {ACPI_ALLOCATE_BUFFER, NULL}; - acpi_status status; - - pxsx_handle = ACPI_HANDLE(&pdev->dev); -@@ -578,23 +594,24 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev) - } - - /* Get the method's handle */ -- status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle); -+ status = acpi_get_handle(pxsx_handle, (acpi_string)ACPI_SPLC_METHOD, -+ &handle); - if (ACPI_FAILURE(status)) { -- IWL_DEBUG_INFO(trans, "SPL method not found\n"); -+ IWL_DEBUG_INFO(trans, "SPLC method not found\n"); - return; - } - - /* Call SPLC with no arguments */ -- status = acpi_evaluate_object(handle, NULL, NULL, &splx); -+ status = acpi_evaluate_object(handle, NULL, NULL, &splc); - if (ACPI_FAILURE(status)) { - IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status); - return; - } - -- trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer); -+ trans->dflt_pwr_limit = splc_get_pwr_limit(trans, splc.pointer); - IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n", - trans->dflt_pwr_limit); -- kfree(splx.pointer); -+ kfree(splc.pointer); - } - - #else /* CONFIG_ACPI */ -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c -index 18650dc..478bba5 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c -@@ -522,6 +522,7 @@ static int iwl_pcie_txq_alloc(struct iwl_trans *trans, - static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq, - int slots_num, u32 txq_id) - { -+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); - int ret; - - txq->need_update = false; -@@ -536,6 +537,13 @@ static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq, - return ret; - - spin_lock_init(&txq->lock); -+ -+ if (txq_id == trans_pcie->cmd_queue) { -+ static struct lock_class_key iwl_pcie_cmd_queue_lock_class; -+ -+ lockdep_set_class(&txq->lock, &iwl_pcie_cmd_queue_lock_class); -+ } -+ - __skb_queue_head_init(&txq->overflow_q); - - /* -diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c -index ec2e9c5..22394fe 100644 ---- a/drivers/rtc/rtc-omap.c -+++ b/drivers/rtc/rtc-omap.c -@@ -109,6 +109,7 @@ - /* OMAP_RTC_OSC_REG bit fields: */ - #define OMAP_RTC_OSC_32KCLK_EN BIT(6) - #define OMAP_RTC_OSC_SEL_32KCLK_SRC BIT(3) -+#define OMAP_RTC_OSC_OSC32K_GZ_DISABLE BIT(4) - - /* OMAP_RTC_IRQWAKEEN bit fields: */ - #define OMAP_RTC_IRQWAKEEN_ALARM_WAKEEN BIT(1) -@@ -646,8 +647,9 @@ static int omap_rtc_probe(struct platform_device *pdev) - */ - if (rtc->has_ext_clk) { - reg = rtc_read(rtc, OMAP_RTC_OSC_REG); -- rtc_write(rtc, OMAP_RTC_OSC_REG, -- reg | OMAP_RTC_OSC_SEL_32KCLK_SRC); -+ reg &= ~OMAP_RTC_OSC_OSC32K_GZ_DISABLE; -+ reg |= OMAP_RTC_OSC_32KCLK_EN | OMAP_RTC_OSC_SEL_32KCLK_SRC; -+ rtc_writel(rtc, OMAP_RTC_OSC_REG, reg); - } - - rtc->type->lock(rtc); -diff --git a/drivers/uwb/lc-rc.c b/drivers/uwb/lc-rc.c -index d059ad4..97ee1b4 100644 ---- a/drivers/uwb/lc-rc.c -+++ b/drivers/uwb/lc-rc.c -@@ -56,8 +56,11 @@ static struct uwb_rc *uwb_rc_find_by_index(int index) - struct uwb_rc *rc = NULL; - - dev = class_find_device(&uwb_rc_class, NULL, &index, uwb_rc_index_match); -- if (dev) -+ if (dev) { - rc = dev_get_drvdata(dev); -+ put_device(dev); -+ } -+ - return rc; - } - -@@ -467,7 +470,9 @@ struct uwb_rc *__uwb_rc_try_get(struct uwb_rc *target_rc) - if (dev) { - rc = dev_get_drvdata(dev); - __uwb_rc_get(rc); -+ put_device(dev); - } -+ - return rc; - } - EXPORT_SYMBOL_GPL(__uwb_rc_try_get); -@@ -520,8 +525,11 @@ struct uwb_rc *uwb_rc_get_by_grandpa(const struct device *grandpa_dev) - - dev = class_find_device(&uwb_rc_class, NULL, grandpa_dev, - find_rc_grandpa); -- if (dev) -+ if (dev) { - rc = dev_get_drvdata(dev); -+ put_device(dev); -+ } -+ - return rc; - } - EXPORT_SYMBOL_GPL(uwb_rc_get_by_grandpa); -@@ -553,8 +561,10 @@ struct uwb_rc *uwb_rc_get_by_dev(const struct uwb_dev_addr *addr) - struct uwb_rc *rc = NULL; - - dev = class_find_device(&uwb_rc_class, NULL, addr, find_rc_dev); -- if (dev) -+ if (dev) { - rc = dev_get_drvdata(dev); -+ put_device(dev); -+ } - - return rc; - } -diff --git a/drivers/uwb/pal.c b/drivers/uwb/pal.c -index c1304b8..678e937 100644 ---- a/drivers/uwb/pal.c -+++ b/drivers/uwb/pal.c -@@ -97,6 +97,8 @@ static bool uwb_rc_class_device_exists(struct uwb_rc *target_rc) - - dev = class_find_device(&uwb_rc_class, NULL, target_rc, find_rc); - -+ put_device(dev); -+ - return (dev != NULL); - } - -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index ea31931..7bd21aa 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -235,6 +235,7 @@ struct ext4_io_submit { - #define EXT4_MAX_BLOCK_SIZE 65536 - #define EXT4_MIN_BLOCK_LOG_SIZE 10 - #define EXT4_MAX_BLOCK_LOG_SIZE 16 -+#define EXT4_MAX_CLUSTER_LOG_SIZE 30 - #ifdef __KERNEL__ - # define EXT4_BLOCK_SIZE(s) ((s)->s_blocksize) - #else -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 3ec8708..ec89f50 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3518,7 +3518,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - if (blocksize < EXT4_MIN_BLOCK_SIZE || - blocksize > EXT4_MAX_BLOCK_SIZE) { - ext4_msg(sb, KERN_ERR, -- "Unsupported filesystem blocksize %d", blocksize); -+ "Unsupported filesystem blocksize %d (%d log_block_size)", -+ blocksize, le32_to_cpu(es->s_log_block_size)); -+ goto failed_mount; -+ } -+ if (le32_to_cpu(es->s_log_block_size) > -+ (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { -+ ext4_msg(sb, KERN_ERR, -+ "Invalid log block size: %u", -+ le32_to_cpu(es->s_log_block_size)); - goto failed_mount; - } - -@@ -3650,6 +3658,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - "block size (%d)", clustersize, blocksize); - goto failed_mount; - } -+ if (le32_to_cpu(es->s_log_cluster_size) > -+ (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { -+ ext4_msg(sb, KERN_ERR, -+ "Invalid log cluster size: %u", -+ le32_to_cpu(es->s_log_cluster_size)); -+ goto failed_mount; -+ } - sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) - - le32_to_cpu(es->s_log_block_size); - sbi->s_clusters_per_group = -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 3988b43..a621dd9 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -1985,6 +1985,10 @@ static int fuse_write_end(struct file *file, struct address_space *mapping, - { - struct inode *inode = page->mapping->host; - -+ /* Haven't copied anything? Skip zeroing, size extending, dirtying. */ -+ if (!copied) -+ goto unlock; -+ - if (!PageUptodate(page)) { - /* Zero any unwritten bytes at the end of the page */ - size_t endoff = (pos + copied) & ~PAGE_MASK; -@@ -1995,6 +1999,8 @@ static int fuse_write_end(struct file *file, struct address_space *mapping, - - fuse_write_update_size(inode, pos + copied); - set_page_dirty(page); -+ -+unlock: - unlock_page(page); - put_page(page); - -diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h -index ab02a45..e5d1934 100644 ---- a/include/linux/sunrpc/svc_xprt.h -+++ b/include/linux/sunrpc/svc_xprt.h -@@ -25,6 +25,7 @@ struct svc_xprt_ops { - void (*xpo_detach)(struct svc_xprt *); - void (*xpo_free)(struct svc_xprt *); - int (*xpo_secure_port)(struct svc_rqst *); -+ void (*xpo_kill_temp_xprt)(struct svc_xprt *); - }; - - struct svc_xprt_class { -diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c -index 9530fcd..9d592c6 100644 ---- a/kernel/irq/manage.c -+++ b/kernel/irq/manage.c -@@ -1341,12 +1341,12 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) - - } else if (new->flags & IRQF_TRIGGER_MASK) { - unsigned int nmsk = new->flags & IRQF_TRIGGER_MASK; -- unsigned int omsk = irq_settings_get_trigger_mask(desc); -+ unsigned int omsk = irqd_get_trigger_type(&desc->irq_data); - - if (nmsk != omsk) - /* hope the handler works with current trigger mode */ - pr_warn("irq %d uses trigger mode %u; requested %u\n", -- irq, nmsk, omsk); -+ irq, omsk, nmsk); - } - - *old_ptr = new; -diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c -index 084452e..bdff5ed 100644 ---- a/kernel/power/suspend_test.c -+++ b/kernel/power/suspend_test.c -@@ -203,8 +203,10 @@ static int __init test_suspend(void) - - /* RTCs have initialized by now too ... can we use one? */ - dev = class_find_device(rtc_class, NULL, NULL, has_wakealarm); -- if (dev) -+ if (dev) { - rtc = rtc_class_open(dev_name(dev)); -+ put_device(dev); -+ } - if (!rtc) { - printk(warn_no_rtc); - return 0; -diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile -index d0a1617..979e7bf 100644 ---- a/kernel/trace/Makefile -+++ b/kernel/trace/Makefile -@@ -1,8 +1,4 @@ - --# We are fully aware of the dangers of __builtin_return_address() --FRAME_CFLAGS := $(call cc-disable-warning,frame-address) --KBUILD_CFLAGS += $(FRAME_CFLAGS) -- - # Do not instrument the tracer itself: - - ifdef CONFIG_FUNCTION_TRACER -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 84752c8..b1d7f1b 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -1856,6 +1856,10 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, - - /* Update rec->flags */ - do_for_each_ftrace_rec(pg, rec) { -+ -+ if (rec->flags & FTRACE_FL_DISABLED) -+ continue; -+ - /* We need to update only differences of filter_hash */ - in_old = !!ftrace_lookup_ip(old_hash, rec->ip); - in_new = !!ftrace_lookup_ip(new_hash, rec->ip); -@@ -1878,6 +1882,10 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops, - - /* Roll back what we did above */ - do_for_each_ftrace_rec(pg, rec) { -+ -+ if (rec->flags & FTRACE_FL_DISABLED) -+ continue; -+ - if (rec == end) - goto err_out; - -@@ -2391,6 +2399,10 @@ void __weak ftrace_replace_code(int enable) - return; - - do_for_each_ftrace_rec(pg, rec) { -+ -+ if (rec->flags & FTRACE_FL_DISABLED) -+ continue; -+ - failed = __ftrace_replace_code(rec, enable); - if (failed) { - ftrace_bug(failed, rec); -@@ -2757,7 +2769,7 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command) - struct dyn_ftrace *rec; - - do_for_each_ftrace_rec(pg, rec) { -- if (FTRACE_WARN_ON_ONCE(rec->flags)) -+ if (FTRACE_WARN_ON_ONCE(rec->flags & ~FTRACE_FL_DISABLED)) - pr_warn(" %pS flags:%lx\n", - (void *)rec->ip, rec->flags); - } while_for_each_ftrace_rec(); -@@ -3592,6 +3604,10 @@ match_records(struct ftrace_hash *hash, char *func, int len, char *mod) - goto out_unlock; - - do_for_each_ftrace_rec(pg, rec) { -+ -+ if (rec->flags & FTRACE_FL_DISABLED) -+ continue; -+ - if (ftrace_match_record(rec, &func_g, mod_match, exclude_mod)) { - ret = enter_record(hash, rec, clear_filter); - if (ret < 0) { -@@ -3787,6 +3803,9 @@ register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, - - do_for_each_ftrace_rec(pg, rec) { - -+ if (rec->flags & FTRACE_FL_DISABLED) -+ continue; -+ - if (!ftrace_match_record(rec, &func_g, NULL, 0)) - continue; - -@@ -4679,6 +4698,9 @@ ftrace_set_func(unsigned long *array, int *idx, int size, char *buffer) - - do_for_each_ftrace_rec(pg, rec) { - -+ if (rec->flags & FTRACE_FL_DISABLED) -+ continue; -+ - if (ftrace_match_record(rec, &func_g, NULL, 0)) { - /* if it is in the array */ - exists = false; -diff --git a/mm/Makefile b/mm/Makefile -index 2ca1faf..295bd7a 100644 ---- a/mm/Makefile -+++ b/mm/Makefile -@@ -21,9 +21,6 @@ KCOV_INSTRUMENT_memcontrol.o := n - KCOV_INSTRUMENT_mmzone.o := n - KCOV_INSTRUMENT_vmstat.o := n - --# Since __builtin_frame_address does work as used, disable the warning. --CFLAGS_usercopy.o += $(call cc-disable-warning, frame-address) -- - mmu-y := nommu.o - mmu-$(CONFIG_MMU) := gup.o highmem.o memory.o mincore.o \ - mlock.o mmap.o mprotect.o mremap.o msync.o rmap.o \ -diff --git a/net/can/bcm.c b/net/can/bcm.c -index 8e999ff..8af9d25 100644 ---- a/net/can/bcm.c -+++ b/net/can/bcm.c -@@ -1549,24 +1549,31 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, - struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; - struct sock *sk = sock->sk; - struct bcm_sock *bo = bcm_sk(sk); -+ int ret = 0; - - if (len < sizeof(*addr)) - return -EINVAL; - -- if (bo->bound) -- return -EISCONN; -+ lock_sock(sk); -+ -+ if (bo->bound) { -+ ret = -EISCONN; -+ goto fail; -+ } - - /* bind a device to this socket */ - if (addr->can_ifindex) { - struct net_device *dev; - - dev = dev_get_by_index(&init_net, addr->can_ifindex); -- if (!dev) -- return -ENODEV; -- -+ if (!dev) { -+ ret = -ENODEV; -+ goto fail; -+ } - if (dev->type != ARPHRD_CAN) { - dev_put(dev); -- return -ENODEV; -+ ret = -ENODEV; -+ goto fail; - } - - bo->ifindex = dev->ifindex; -@@ -1577,17 +1584,24 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, - bo->ifindex = 0; - } - -- bo->bound = 1; -- - if (proc_dir) { - /* unique socket address as filename */ - sprintf(bo->procname, "%lu", sock_i_ino(sk)); - bo->bcm_proc_read = proc_create_data(bo->procname, 0644, - proc_dir, - &bcm_proc_fops, sk); -+ if (!bo->bcm_proc_read) { -+ ret = -ENOMEM; -+ goto fail; -+ } - } - -- return 0; -+ bo->bound = 1; -+ -+fail: -+ release_sock(sk); -+ -+ return ret; - } - - static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, -diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c -index 0af2669..584ac76 100644 ---- a/net/netfilter/nft_dynset.c -+++ b/net/netfilter/nft_dynset.c -@@ -143,7 +143,8 @@ static int nft_dynset_init(const struct nft_ctx *ctx, - if (tb[NFTA_DYNSET_TIMEOUT] != NULL) { - if (!(set->flags & NFT_SET_TIMEOUT)) - return -EINVAL; -- timeout = be64_to_cpu(nla_get_be64(tb[NFTA_DYNSET_TIMEOUT])); -+ timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64( -+ tb[NFTA_DYNSET_TIMEOUT]))); - } - - priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]); -@@ -230,7 +231,8 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr) - goto nla_put_failure; - if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name)) - goto nla_put_failure; -- if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, cpu_to_be64(priv->timeout), -+ if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, -+ cpu_to_be64(jiffies_to_msecs(priv->timeout)), - NFTA_DYNSET_PAD)) - goto nla_put_failure; - if (priv->expr && nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr)) -diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c -index c3f6523..3bc1d61 100644 ---- a/net/sunrpc/svc_xprt.c -+++ b/net/sunrpc/svc_xprt.c -@@ -1002,14 +1002,8 @@ static void svc_age_temp_xprts(unsigned long closure) - void svc_age_temp_xprts_now(struct svc_serv *serv, struct sockaddr *server_addr) - { - struct svc_xprt *xprt; -- struct svc_sock *svsk; -- struct socket *sock; - struct list_head *le, *next; - LIST_HEAD(to_be_closed); -- struct linger no_linger = { -- .l_onoff = 1, -- .l_linger = 0, -- }; - - spin_lock_bh(&serv->sv_lock); - list_for_each_safe(le, next, &serv->sv_tempsocks) { -@@ -1027,10 +1021,7 @@ void svc_age_temp_xprts_now(struct svc_serv *serv, struct sockaddr *server_addr) - list_del_init(le); - xprt = list_entry(le, struct svc_xprt, xpt_list); - dprintk("svc_age_temp_xprts_now: closing %p\n", xprt); -- svsk = container_of(xprt, struct svc_sock, sk_xprt); -- sock = svsk->sk_sock; -- kernel_setsockopt(sock, SOL_SOCKET, SO_LINGER, -- (char *)&no_linger, sizeof(no_linger)); -+ xprt->xpt_ops->xpo_kill_temp_xprt(xprt); - svc_close_xprt(xprt); - } - } -diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c -index 57625f6..a4bc982 100644 ---- a/net/sunrpc/svcsock.c -+++ b/net/sunrpc/svcsock.c -@@ -438,6 +438,21 @@ static int svc_tcp_has_wspace(struct svc_xprt *xprt) - return !test_bit(SOCK_NOSPACE, &svsk->sk_sock->flags); - } - -+static void svc_tcp_kill_temp_xprt(struct svc_xprt *xprt) -+{ -+ struct svc_sock *svsk; -+ struct socket *sock; -+ struct linger no_linger = { -+ .l_onoff = 1, -+ .l_linger = 0, -+ }; -+ -+ svsk = container_of(xprt, struct svc_sock, sk_xprt); -+ sock = svsk->sk_sock; -+ kernel_setsockopt(sock, SOL_SOCKET, SO_LINGER, -+ (char *)&no_linger, sizeof(no_linger)); -+} -+ - /* - * See net/ipv6/ip_sockglue.c : ip_cmsg_recv_pktinfo - */ -@@ -648,6 +663,10 @@ static struct svc_xprt *svc_udp_accept(struct svc_xprt *xprt) - return NULL; - } - -+static void svc_udp_kill_temp_xprt(struct svc_xprt *xprt) -+{ -+} -+ - static struct svc_xprt *svc_udp_create(struct svc_serv *serv, - struct net *net, - struct sockaddr *sa, int salen, -@@ -667,6 +686,7 @@ static struct svc_xprt_ops svc_udp_ops = { - .xpo_has_wspace = svc_udp_has_wspace, - .xpo_accept = svc_udp_accept, - .xpo_secure_port = svc_sock_secure_port, -+ .xpo_kill_temp_xprt = svc_udp_kill_temp_xprt, - }; - - static struct svc_xprt_class svc_udp_class = { -@@ -1242,6 +1262,7 @@ static struct svc_xprt_ops svc_tcp_ops = { - .xpo_has_wspace = svc_tcp_has_wspace, - .xpo_accept = svc_tcp_accept, - .xpo_secure_port = svc_sock_secure_port, -+ .xpo_kill_temp_xprt = svc_tcp_kill_temp_xprt, - }; - - static struct svc_xprt_class svc_tcp_class = { -diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c -index 924271c..a55b809 100644 ---- a/net/sunrpc/xprtrdma/svc_rdma_transport.c -+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c -@@ -67,6 +67,7 @@ static void svc_rdma_detach(struct svc_xprt *xprt); - static void svc_rdma_free(struct svc_xprt *xprt); - static int svc_rdma_has_wspace(struct svc_xprt *xprt); - static int svc_rdma_secure_port(struct svc_rqst *); -+static void svc_rdma_kill_temp_xprt(struct svc_xprt *); - - static struct svc_xprt_ops svc_rdma_ops = { - .xpo_create = svc_rdma_create, -@@ -79,6 +80,7 @@ static struct svc_xprt_ops svc_rdma_ops = { - .xpo_has_wspace = svc_rdma_has_wspace, - .xpo_accept = svc_rdma_accept, - .xpo_secure_port = svc_rdma_secure_port, -+ .xpo_kill_temp_xprt = svc_rdma_kill_temp_xprt, - }; - - struct svc_xprt_class svc_rdma_class = { -@@ -1285,6 +1287,10 @@ static int svc_rdma_secure_port(struct svc_rqst *rqstp) - return 1; - } - -+static void svc_rdma_kill_temp_xprt(struct svc_xprt *xprt) -+{ -+} -+ - int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr) - { - struct ib_send_wr *bad_wr, *n_wr; -diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh -index 973e8c1..17867e7 100755 ---- a/scripts/gcc-x86_64-has-stack-protector.sh -+++ b/scripts/gcc-x86_64-has-stack-protector.sh -@@ -1,6 +1,6 @@ - #!/bin/sh - --echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs" -+echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs" - if [ "$?" -eq "0" ] ; then - echo y - else -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 26e866f..1628180 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -6905,8 +6905,6 @@ static const struct hda_fixup alc662_fixups[] = { - .v.pins = (const struct hda_pintbl[]) { - { 0x15, 0x40f000f0 }, /* disabled */ - { 0x16, 0x40f000f0 }, /* disabled */ -- { 0x18, 0x01014011 }, /* LO */ -- { 0x1a, 0x01014012 }, /* LO */ - { } - } - }, -diff --git a/sound/pci/hda/thinkpad_helper.c b/sound/pci/hda/thinkpad_helper.c -index 6a23302..4d9d320 100644 ---- a/sound/pci/hda/thinkpad_helper.c -+++ b/sound/pci/hda/thinkpad_helper.c -@@ -13,7 +13,8 @@ static void (*old_vmaster_hook)(void *, int); - static bool is_thinkpad(struct hda_codec *codec) - { - return (codec->core.subsystem_id >> 16 == 0x17aa) && -- (acpi_dev_found("LEN0068") || acpi_dev_found("IBM0068")); -+ (acpi_dev_found("LEN0068") || acpi_dev_found("LEN0268") || -+ acpi_dev_found("IBM0068")); - } - - static void update_tpacpi_mute_led(void *private_data, int enabled) -diff --git a/sound/usb/card.c b/sound/usb/card.c -index 9e5276d..2ddc034 100644 ---- a/sound/usb/card.c -+++ b/sound/usb/card.c -@@ -315,7 +315,8 @@ static int snd_usb_audio_free(struct snd_usb_audio *chip) - snd_usb_endpoint_free(ep); - - mutex_destroy(&chip->mutex); -- dev_set_drvdata(&chip->dev->dev, NULL); -+ if (!atomic_read(&chip->shutdown)) -+ dev_set_drvdata(&chip->dev->dev, NULL); - kfree(chip); - return 0; - } -diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c -index de15dbc..7214913 100644 ---- a/tools/perf/util/hist.c -+++ b/tools/perf/util/hist.c -@@ -1596,18 +1596,18 @@ static void hists__hierarchy_output_resort(struct hists *hists, - if (prog) - ui_progress__update(prog, 1); - -+ hists->nr_entries++; -+ if (!he->filtered) { -+ hists->nr_non_filtered_entries++; -+ hists__calc_col_len(hists, he); -+ } -+ - if (!he->leaf) { - hists__hierarchy_output_resort(hists, prog, - &he->hroot_in, - &he->hroot_out, - min_callchain_hits, - use_callchain); -- hists->nr_entries++; -- if (!he->filtered) { -- hists->nr_non_filtered_entries++; -- hists__calc_col_len(hists, he); -- } -- - continue; - } - -diff --git a/virt/kvm/arm/pmu.c b/virt/kvm/arm/pmu.c -index 6e9c40e..69ccce3 100644 ---- a/virt/kvm/arm/pmu.c -+++ b/virt/kvm/arm/pmu.c -@@ -305,7 +305,7 @@ void kvm_pmu_software_increment(struct kvm_vcpu *vcpu, u64 val) - continue; - type = vcpu_sys_reg(vcpu, PMEVTYPER0_EL0 + i) - & ARMV8_PMU_EVTYPE_EVENT; -- if ((type == ARMV8_PMU_EVTYPE_EVENT_SW_INCR) -+ if ((type == ARMV8_PMUV3_PERFCTR_SW_INCR) - && (enable & BIT(i))) { - reg = vcpu_sys_reg(vcpu, PMEVCNTR0_EL0 + i) + 1; - reg = lower_32_bits(reg); -@@ -379,7 +379,8 @@ void kvm_pmu_set_counter_event_type(struct kvm_vcpu *vcpu, u64 data, - eventsel = data & ARMV8_PMU_EVTYPE_EVENT; - - /* Software increment event does't need to be backed by a perf event */ -- if (eventsel == ARMV8_PMU_EVTYPE_EVENT_SW_INCR) -+ if (eventsel == ARMV8_PMUV3_PERFCTR_SW_INCR && -+ select_idx != ARMV8_PMU_CYCLE_IDX) - return; - - memset(&attr, 0, sizeof(struct perf_event_attr)); -@@ -391,7 +392,8 @@ void kvm_pmu_set_counter_event_type(struct kvm_vcpu *vcpu, u64 data, - attr.exclude_kernel = data & ARMV8_PMU_EXCLUDE_EL1 ? 1 : 0; - attr.exclude_hv = 1; /* Don't count EL2 events */ - attr.exclude_host = 1; /* Don't count host events */ -- attr.config = eventsel; -+ attr.config = (select_idx == ARMV8_PMU_CYCLE_IDX) ? -+ ARMV8_PMUV3_PERFCTR_CPU_CYCLES : eventsel; - - counter = kvm_pmu_get_counter_value(vcpu, select_idx); - /* The initial sample period (overflow count) of an event. */ diff --git a/4.8.12/1011_linux-4.8.12.patch b/4.8.12/1011_linux-4.8.12.patch deleted file mode 100644 index 6e460f1..0000000 --- a/4.8.12/1011_linux-4.8.12.patch +++ /dev/null @@ -1,1563 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2b1bcba..7b0c92f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 8 --SUBLEVEL = 11 -+SUBLEVEL = 12 - EXTRAVERSION = - NAME = Psychotic Stoned Sheep - -diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig -index af12c2d..81c11a6 100644 ---- a/arch/parisc/Kconfig -+++ b/arch/parisc/Kconfig -@@ -33,7 +33,9 @@ config PARISC - select HAVE_ARCH_HASH - select HAVE_ARCH_SECCOMP_FILTER - select HAVE_ARCH_TRACEHOOK -- select HAVE_UNSTABLE_SCHED_CLOCK if (SMP || !64BIT) -+ select GENERIC_SCHED_CLOCK -+ select HAVE_UNSTABLE_SCHED_CLOCK if SMP -+ select GENERIC_CLOCKEVENTS - select ARCH_NO_COHERENT_DMA_MMAP - select CPU_NO_EFFICIENT_FFS - -diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c -index 6700127..c2259d4 100644 ---- a/arch/parisc/kernel/cache.c -+++ b/arch/parisc/kernel/cache.c -@@ -369,6 +369,7 @@ void __init parisc_setup_cache_timing(void) - { - unsigned long rangetime, alltime; - unsigned long size, start; -+ unsigned long threshold; - - alltime = mfctl(16); - flush_data_cache(); -@@ -382,17 +383,12 @@ void __init parisc_setup_cache_timing(void) - printk(KERN_DEBUG "Whole cache flush %lu cycles, flushing %lu bytes %lu cycles\n", - alltime, size, rangetime); - -- /* Racy, but if we see an intermediate value, it's ok too... */ -- parisc_cache_flush_threshold = size * alltime / rangetime; -- -- parisc_cache_flush_threshold = L1_CACHE_ALIGN(parisc_cache_flush_threshold); -- if (!parisc_cache_flush_threshold) -- parisc_cache_flush_threshold = FLUSH_THRESHOLD; -- -- if (parisc_cache_flush_threshold > cache_info.dc_size) -- parisc_cache_flush_threshold = cache_info.dc_size; -- -- printk(KERN_INFO "Setting cache flush threshold to %lu kB\n", -+ threshold = L1_CACHE_ALIGN(size * alltime / rangetime); -+ if (threshold > cache_info.dc_size) -+ threshold = cache_info.dc_size; -+ if (threshold) -+ parisc_cache_flush_threshold = threshold; -+ printk(KERN_INFO "Cache flush threshold set to %lu KiB\n", - parisc_cache_flush_threshold/1024); - - /* calculate TLB flush threshold */ -@@ -401,7 +397,7 @@ void __init parisc_setup_cache_timing(void) - flush_tlb_all(); - alltime = mfctl(16) - alltime; - -- size = PAGE_SIZE; -+ size = 0; - start = (unsigned long) _text; - rangetime = mfctl(16); - while (start < (unsigned long) _end) { -@@ -414,13 +410,10 @@ void __init parisc_setup_cache_timing(void) - printk(KERN_DEBUG "Whole TLB flush %lu cycles, flushing %lu bytes %lu cycles\n", - alltime, size, rangetime); - -- parisc_tlb_flush_threshold = size * alltime / rangetime; -- parisc_tlb_flush_threshold *= num_online_cpus(); -- parisc_tlb_flush_threshold = PAGE_ALIGN(parisc_tlb_flush_threshold); -- if (!parisc_tlb_flush_threshold) -- parisc_tlb_flush_threshold = FLUSH_TLB_THRESHOLD; -- -- printk(KERN_INFO "Setting TLB flush threshold to %lu kB\n", -+ threshold = PAGE_ALIGN(num_online_cpus() * size * alltime / rangetime); -+ if (threshold) -+ parisc_tlb_flush_threshold = threshold; -+ printk(KERN_INFO "TLB flush threshold set to %lu KiB\n", - parisc_tlb_flush_threshold/1024); - } - -diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S -index b743a80..6755219 100644 ---- a/arch/parisc/kernel/pacache.S -+++ b/arch/parisc/kernel/pacache.S -@@ -96,7 +96,7 @@ fitmanyloop: /* Loop if LOOP >= 2 */ - - fitmanymiddle: /* Loop if LOOP >= 2 */ - addib,COND(>) -1, %r31, fitmanymiddle /* Adjusted inner loop decr */ -- pitlbe 0(%sr1, %r28) -+ pitlbe %r0(%sr1, %r28) - pitlbe,m %arg1(%sr1, %r28) /* Last pitlbe and addr adjust */ - addib,COND(>) -1, %r29, fitmanymiddle /* Middle loop decr */ - copy %arg3, %r31 /* Re-init inner loop count */ -@@ -139,7 +139,7 @@ fdtmanyloop: /* Loop if LOOP >= 2 */ - - fdtmanymiddle: /* Loop if LOOP >= 2 */ - addib,COND(>) -1, %r31, fdtmanymiddle /* Adjusted inner loop decr */ -- pdtlbe 0(%sr1, %r28) -+ pdtlbe %r0(%sr1, %r28) - pdtlbe,m %arg1(%sr1, %r28) /* Last pdtlbe and addr adjust */ - addib,COND(>) -1, %r29, fdtmanymiddle /* Middle loop decr */ - copy %arg3, %r31 /* Re-init inner loop count */ -@@ -620,12 +620,12 @@ ENTRY(copy_user_page_asm) - /* Purge any old translations */ - - #ifdef CONFIG_PA20 -- pdtlb,l 0(%r28) -- pdtlb,l 0(%r29) -+ pdtlb,l %r0(%r28) -+ pdtlb,l %r0(%r29) - #else - tlb_lock %r20,%r21,%r22 -- pdtlb 0(%r28) -- pdtlb 0(%r29) -+ pdtlb %r0(%r28) -+ pdtlb %r0(%r29) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -768,10 +768,10 @@ ENTRY(clear_user_page_asm) - /* Purge any old translation */ - - #ifdef CONFIG_PA20 -- pdtlb,l 0(%r28) -+ pdtlb,l %r0(%r28) - #else - tlb_lock %r20,%r21,%r22 -- pdtlb 0(%r28) -+ pdtlb %r0(%r28) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -852,10 +852,10 @@ ENTRY(flush_dcache_page_asm) - /* Purge any old translation */ - - #ifdef CONFIG_PA20 -- pdtlb,l 0(%r28) -+ pdtlb,l %r0(%r28) - #else - tlb_lock %r20,%r21,%r22 -- pdtlb 0(%r28) -+ pdtlb %r0(%r28) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -892,10 +892,10 @@ ENTRY(flush_dcache_page_asm) - sync - - #ifdef CONFIG_PA20 -- pdtlb,l 0(%r25) -+ pdtlb,l %r0(%r25) - #else - tlb_lock %r20,%r21,%r22 -- pdtlb 0(%r25) -+ pdtlb %r0(%r25) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -925,13 +925,18 @@ ENTRY(flush_icache_page_asm) - depwi 0, 31,PAGE_SHIFT, %r28 /* Clear any offset bits */ - #endif - -- /* Purge any old translation */ -+ /* Purge any old translation. Note that the FIC instruction -+ * may use either the instruction or data TLB. Given that we -+ * have a flat address space, it's not clear which TLB will be -+ * used. So, we purge both entries. */ - - #ifdef CONFIG_PA20 -+ pdtlb,l %r0(%r28) - pitlb,l %r0(%sr4,%r28) - #else - tlb_lock %r20,%r21,%r22 -- pitlb (%sr4,%r28) -+ pdtlb %r0(%r28) -+ pitlb %r0(%sr4,%r28) - tlb_unlock %r20,%r21,%r22 - #endif - -@@ -970,10 +975,12 @@ ENTRY(flush_icache_page_asm) - sync - - #ifdef CONFIG_PA20 -+ pdtlb,l %r0(%r28) - pitlb,l %r0(%sr4,%r25) - #else - tlb_lock %r20,%r21,%r22 -- pitlb (%sr4,%r25) -+ pdtlb %r0(%r28) -+ pitlb %r0(%sr4,%r25) - tlb_unlock %r20,%r21,%r22 - #endif - -diff --git a/arch/parisc/kernel/pci-dma.c b/arch/parisc/kernel/pci-dma.c -index 02d9ed0..494ff6e 100644 ---- a/arch/parisc/kernel/pci-dma.c -+++ b/arch/parisc/kernel/pci-dma.c -@@ -95,8 +95,8 @@ static inline int map_pte_uncached(pte_t * pte, - - if (!pte_none(*pte)) - printk(KERN_ERR "map_pte_uncached: page already exists\n"); -- set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC)); - purge_tlb_start(flags); -+ set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC)); - pdtlb_kernel(orig_vaddr); - purge_tlb_end(flags); - vaddr += PAGE_SIZE; -diff --git a/arch/parisc/kernel/setup.c b/arch/parisc/kernel/setup.c -index 81d6f63..2e66a88 100644 ---- a/arch/parisc/kernel/setup.c -+++ b/arch/parisc/kernel/setup.c -@@ -334,6 +334,10 @@ static int __init parisc_init(void) - /* tell PDC we're Linux. Nevermind failure. */ - pdc_stable_write(0x40, &osid, sizeof(osid)); - -+ /* start with known state */ -+ flush_cache_all_local(); -+ flush_tlb_all_local(NULL); -+ - processor_init(); - #ifdef CONFIG_SMP - pr_info("CPU(s): %d out of %d %s at %d.%06d MHz online\n", -diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c -index 9b63b87..325f30d 100644 ---- a/arch/parisc/kernel/time.c -+++ b/arch/parisc/kernel/time.c -@@ -14,6 +14,7 @@ - #include <linux/module.h> - #include <linux/rtc.h> - #include <linux/sched.h> -+#include <linux/sched_clock.h> - #include <linux/kernel.h> - #include <linux/param.h> - #include <linux/string.h> -@@ -39,18 +40,6 @@ - - static unsigned long clocktick __read_mostly; /* timer cycles per tick */ - --#ifndef CONFIG_64BIT --/* -- * The processor-internal cycle counter (Control Register 16) is used as time -- * source for the sched_clock() function. This register is 64bit wide on a -- * 64-bit kernel and 32bit on a 32-bit kernel. Since sched_clock() always -- * requires a 64bit counter we emulate on the 32-bit kernel the higher 32bits -- * with a per-cpu variable which we increase every time the counter -- * wraps-around (which happens every ~4 secounds). -- */ --static DEFINE_PER_CPU(unsigned long, cr16_high_32_bits); --#endif -- - /* - * We keep time on PA-RISC Linux by using the Interval Timer which is - * a pair of registers; one is read-only and one is write-only; both -@@ -121,12 +110,6 @@ irqreturn_t __irq_entry timer_interrupt(int irq, void *dev_id) - */ - mtctl(next_tick, 16); - --#if !defined(CONFIG_64BIT) -- /* check for overflow on a 32bit kernel (every ~4 seconds). */ -- if (unlikely(next_tick < now)) -- this_cpu_inc(cr16_high_32_bits); --#endif -- - /* Skip one clocktick on purpose if we missed next_tick. - * The new CR16 must be "later" than current CR16 otherwise - * itimer would not fire until CR16 wrapped - e.g 4 seconds -@@ -208,7 +191,7 @@ EXPORT_SYMBOL(profile_pc); - - /* clock source code */ - --static cycle_t read_cr16(struct clocksource *cs) -+static cycle_t notrace read_cr16(struct clocksource *cs) - { - return get_cycles(); - } -@@ -287,26 +270,9 @@ void read_persistent_clock(struct timespec *ts) - } - - --/* -- * sched_clock() framework -- */ -- --static u32 cyc2ns_mul __read_mostly; --static u32 cyc2ns_shift __read_mostly; -- --u64 sched_clock(void) -+static u64 notrace read_cr16_sched_clock(void) - { -- u64 now; -- -- /* Get current cycle counter (Control Register 16). */ --#ifdef CONFIG_64BIT -- now = mfctl(16); --#else -- now = mfctl(16) + (((u64) this_cpu_read(cr16_high_32_bits)) << 32); --#endif -- -- /* return the value in ns (cycles_2_ns) */ -- return mul_u64_u32_shr(now, cyc2ns_mul, cyc2ns_shift); -+ return get_cycles(); - } - - -@@ -316,17 +282,16 @@ u64 sched_clock(void) - - void __init time_init(void) - { -- unsigned long current_cr16_khz; -+ unsigned long cr16_hz; - -- current_cr16_khz = PAGE0->mem_10msec/10; /* kHz */ - clocktick = (100 * PAGE0->mem_10msec) / HZ; -- -- /* calculate mult/shift values for cr16 */ -- clocks_calc_mult_shift(&cyc2ns_mul, &cyc2ns_shift, current_cr16_khz, -- NSEC_PER_MSEC, 0); -- - start_cpu_itimer(); /* get CPU 0 started */ - -+ cr16_hz = 100 * PAGE0->mem_10msec; /* Hz */ -+ - /* register at clocksource framework */ -- clocksource_register_khz(&clocksource_cr16, current_cr16_khz); -+ clocksource_register_hz(&clocksource_cr16, cr16_hz); -+ -+ /* register as sched_clock source */ -+ sched_clock_register(read_cr16_sched_clock, BITS_PER_LONG, cr16_hz); - } -diff --git a/arch/powerpc/boot/main.c b/arch/powerpc/boot/main.c -index d80161b..60522d2 100644 ---- a/arch/powerpc/boot/main.c -+++ b/arch/powerpc/boot/main.c -@@ -217,8 +217,12 @@ void start(void) - console_ops.close(); - - kentry = (kernel_entry_t) vmlinux.addr; -- if (ft_addr) -- kentry(ft_addr, 0, NULL); -+ if (ft_addr) { -+ if(platform_ops.kentry) -+ platform_ops.kentry(ft_addr, vmlinux.addr); -+ else -+ kentry(ft_addr, 0, NULL); -+ } - else - kentry((unsigned long)initrd.addr, initrd.size, - loader_info.promptr); -diff --git a/arch/powerpc/boot/opal-calls.S b/arch/powerpc/boot/opal-calls.S -index ff2f1b9..2a99fc9 100644 ---- a/arch/powerpc/boot/opal-calls.S -+++ b/arch/powerpc/boot/opal-calls.S -@@ -12,6 +12,19 @@ - - .text - -+ .globl opal_kentry -+opal_kentry: -+ /* r3 is the fdt ptr */ -+ mtctr r4 -+ li r4, 0 -+ li r5, 0 -+ li r6, 0 -+ li r7, 0 -+ ld r11,opal@got(r2) -+ ld r8,0(r11) -+ ld r9,8(r11) -+ bctr -+ - #define OPAL_CALL(name, token) \ - .globl name; \ - name: \ -diff --git a/arch/powerpc/boot/opal.c b/arch/powerpc/boot/opal.c -index 1f37e1c..d7b4fd4 100644 ---- a/arch/powerpc/boot/opal.c -+++ b/arch/powerpc/boot/opal.c -@@ -23,14 +23,25 @@ struct opal { - - static u32 opal_con_id; - -+/* see opal-wrappers.S */ - int64_t opal_console_write(int64_t term_number, u64 *length, const u8 *buffer); - int64_t opal_console_read(int64_t term_number, uint64_t *length, u8 *buffer); - int64_t opal_console_write_buffer_space(uint64_t term_number, uint64_t *length); - int64_t opal_console_flush(uint64_t term_number); - int64_t opal_poll_events(uint64_t *outstanding_event_mask); - -+void opal_kentry(unsigned long fdt_addr, void *vmlinux_addr); -+ - static int opal_con_open(void) - { -+ /* -+ * When OPAL loads the boot kernel it stashes the OPAL base and entry -+ * address in r8 and r9 so the kernel can use the OPAL console -+ * before unflattening the devicetree. While executing the wrapper will -+ * probably trash r8 and r9 so this kentry hook restores them before -+ * entering the decompressed kernel. -+ */ -+ platform_ops.kentry = opal_kentry; - return 0; - } - -diff --git a/arch/powerpc/boot/ops.h b/arch/powerpc/boot/ops.h -index e19b64e..deeae6f 100644 ---- a/arch/powerpc/boot/ops.h -+++ b/arch/powerpc/boot/ops.h -@@ -30,6 +30,7 @@ struct platform_ops { - void * (*realloc)(void *ptr, unsigned long size); - void (*exit)(void); - void * (*vmlinux_alloc)(unsigned long size); -+ void (*kentry)(unsigned long fdt_addr, void *vmlinux_addr); - }; - extern struct platform_ops platform_ops; - -diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h -index e2fb408..fd10b58 100644 ---- a/arch/powerpc/include/asm/mmu.h -+++ b/arch/powerpc/include/asm/mmu.h -@@ -29,6 +29,12 @@ - */ - - /* -+ * Kernel read only support. -+ * We added the ppp value 0b110 in ISA 2.04. -+ */ -+#define MMU_FTR_KERNEL_RO ASM_CONST(0x00004000) -+ -+/* - * We need to clear top 16bits of va (from the remaining 64 bits )in - * tlbie* instructions - */ -@@ -103,10 +109,10 @@ - #define MMU_FTRS_POWER4 MMU_FTRS_DEFAULT_HPTE_ARCH_V2 - #define MMU_FTRS_PPC970 MMU_FTRS_POWER4 | MMU_FTR_TLBIE_CROP_VA - #define MMU_FTRS_POWER5 MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE --#define MMU_FTRS_POWER6 MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE --#define MMU_FTRS_POWER7 MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE --#define MMU_FTRS_POWER8 MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE --#define MMU_FTRS_POWER9 MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE -+#define MMU_FTRS_POWER6 MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_KERNEL_RO -+#define MMU_FTRS_POWER7 MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_KERNEL_RO -+#define MMU_FTRS_POWER8 MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_KERNEL_RO -+#define MMU_FTRS_POWER9 MMU_FTRS_POWER4 | MMU_FTR_LOCKLESS_TLBIE | MMU_FTR_KERNEL_RO - #define MMU_FTRS_CELL MMU_FTRS_DEFAULT_HPTE_ARCH_V2 | \ - MMU_FTR_CI_LARGE_PAGE - #define MMU_FTRS_PA6T MMU_FTRS_DEFAULT_HPTE_ARCH_V2 | \ -diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h -index 978dada..52cbf04 100644 ---- a/arch/powerpc/include/asm/reg.h -+++ b/arch/powerpc/include/asm/reg.h -@@ -355,6 +355,7 @@ - #define LPCR_PECE0 ASM_CONST(0x0000000000004000) /* ext. exceptions can cause exit */ - #define LPCR_PECE1 ASM_CONST(0x0000000000002000) /* decrementer can cause exit */ - #define LPCR_PECE2 ASM_CONST(0x0000000000001000) /* machine check etc can cause exit */ -+#define LPCR_PECE_HVEE ASM_CONST(0x0000400000000000) /* P9 Wakeup on HV interrupts */ - #define LPCR_MER ASM_CONST(0x0000000000000800) /* Mediated External Exception */ - #define LPCR_MER_SH 11 - #define LPCR_TC ASM_CONST(0x0000000000000200) /* Translation control */ -diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S -index 52ff3f0..37c027c 100644 ---- a/arch/powerpc/kernel/cpu_setup_power.S -+++ b/arch/powerpc/kernel/cpu_setup_power.S -@@ -98,8 +98,8 @@ _GLOBAL(__setup_cpu_power9) - li r0,0 - mtspr SPRN_LPID,r0 - mfspr r3,SPRN_LPCR -- ori r3, r3, LPCR_PECEDH -- ori r3, r3, LPCR_HVICE -+ LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE) -+ or r3, r3, r4 - bl __init_LPCR - bl __init_HFSCR - bl __init_tlb_power9 -@@ -118,8 +118,8 @@ _GLOBAL(__restore_cpu_power9) - li r0,0 - mtspr SPRN_LPID,r0 - mfspr r3,SPRN_LPCR -- ori r3, r3, LPCR_PECEDH -- ori r3, r3, LPCR_HVICE -+ LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE) -+ or r3, r3, r4 - bl __init_LPCR - bl __init_HFSCR - bl __init_tlb_power9 -diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c -index 28923b2..8dff9ce 100644 ---- a/arch/powerpc/mm/hash_utils_64.c -+++ b/arch/powerpc/mm/hash_utils_64.c -@@ -190,8 +190,12 @@ unsigned long htab_convert_pte_flags(unsigned long pteflags) - /* - * Kernel read only mapped with ppp bits 0b110 - */ -- if (!(pteflags & _PAGE_WRITE)) -- rflags |= (HPTE_R_PP0 | 0x2); -+ if (!(pteflags & _PAGE_WRITE)) { -+ if (mmu_has_feature(MMU_FTR_KERNEL_RO)) -+ rflags |= (HPTE_R_PP0 | 0x2); -+ else -+ rflags |= 0x3; -+ } - } else { - if (pteflags & _PAGE_RWX) - rflags |= 0x2; -diff --git a/arch/tile/kernel/time.c b/arch/tile/kernel/time.c -index 178989e..ea960d6 100644 ---- a/arch/tile/kernel/time.c -+++ b/arch/tile/kernel/time.c -@@ -218,8 +218,8 @@ void do_timer_interrupt(struct pt_regs *regs, int fault_num) - */ - unsigned long long sched_clock(void) - { -- return clocksource_cyc2ns(get_cycles(), -- sched_clock_mult, SCHED_CLOCK_SHIFT); -+ return mult_frac(get_cycles(), -+ sched_clock_mult, 1ULL << SCHED_CLOCK_SHIFT); - } - - int setup_profiling_timer(unsigned int multiplier) -diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c -index 9b983a4..8fc714b 100644 ---- a/arch/x86/events/intel/ds.c -+++ b/arch/x86/events/intel/ds.c -@@ -1070,20 +1070,20 @@ static void setup_pebs_sample_data(struct perf_event *event, - } - - /* -- * We use the interrupt regs as a base because the PEBS record -- * does not contain a full regs set, specifically it seems to -- * lack segment descriptors, which get used by things like -- * user_mode(). -+ * We use the interrupt regs as a base because the PEBS record does not -+ * contain a full regs set, specifically it seems to lack segment -+ * descriptors, which get used by things like user_mode(). - * -- * In the simple case fix up only the IP and BP,SP regs, for -- * PERF_SAMPLE_IP and PERF_SAMPLE_CALLCHAIN to function properly. -- * A possible PERF_SAMPLE_REGS will have to transfer all regs. -+ * In the simple case fix up only the IP for PERF_SAMPLE_IP. -+ * -+ * We must however always use BP,SP from iregs for the unwinder to stay -+ * sane; the record BP,SP can point into thin air when the record is -+ * from a previous PMI context or an (I)RET happend between the record -+ * and PMI. - */ - *regs = *iregs; - regs->flags = pebs->flags; - set_linear_ip(regs, pebs->ip); -- regs->bp = pebs->bp; -- regs->sp = pebs->sp; - - if (sample_type & PERF_SAMPLE_REGS_INTR) { - regs->ax = pebs->ax; -@@ -1092,10 +1092,21 @@ static void setup_pebs_sample_data(struct perf_event *event, - regs->dx = pebs->dx; - regs->si = pebs->si; - regs->di = pebs->di; -- regs->bp = pebs->bp; -- regs->sp = pebs->sp; - -- regs->flags = pebs->flags; -+ /* -+ * Per the above; only set BP,SP if we don't need callchains. -+ * -+ * XXX: does this make sense? -+ */ -+ if (!(sample_type & PERF_SAMPLE_CALLCHAIN)) { -+ regs->bp = pebs->bp; -+ regs->sp = pebs->sp; -+ } -+ -+ /* -+ * Preserve PERF_EFLAGS_VM from set_linear_ip(). -+ */ -+ regs->flags = pebs->flags | (regs->flags & PERF_EFLAGS_VM); - #ifndef CONFIG_X86_32 - regs->r8 = pebs->r8; - regs->r9 = pebs->r9; -diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h -index 8c4a477..181c238 100644 ---- a/arch/x86/events/perf_event.h -+++ b/arch/x86/events/perf_event.h -@@ -113,7 +113,7 @@ struct debug_store { - * Per register state. - */ - struct er_account { -- raw_spinlock_t lock; /* per-core: protect structure */ -+ raw_spinlock_t lock; /* per-core: protect structure */ - u64 config; /* extra MSR config */ - u64 reg; /* extra MSR number */ - atomic_t ref; /* reference count */ -diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c -index 3fc03a0..c289e2f 100644 ---- a/arch/x86/kernel/fpu/core.c -+++ b/arch/x86/kernel/fpu/core.c -@@ -517,14 +517,14 @@ void fpu__clear(struct fpu *fpu) - { - WARN_ON_FPU(fpu != ¤t->thread.fpu); /* Almost certainly an anomaly */ - -- if (!use_eager_fpu() || !static_cpu_has(X86_FEATURE_FPU)) { -- /* FPU state will be reallocated lazily at the first use. */ -- fpu__drop(fpu); -- } else { -- if (!fpu->fpstate_active) { -- fpu__activate_curr(fpu); -- user_fpu_begin(); -- } -+ fpu__drop(fpu); -+ -+ /* -+ * Make sure fpstate is cleared and initialized. -+ */ -+ if (static_cpu_has(X86_FEATURE_FPU)) { -+ fpu__activate_curr(fpu); -+ user_fpu_begin(); - copy_init_fpstate_to_fpregs(); - } - } -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index cbd7b92..a3ce9d2 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -2105,16 +2105,10 @@ static int em_iret(struct x86_emulate_ctxt *ctxt) - static int em_jmp_far(struct x86_emulate_ctxt *ctxt) - { - int rc; -- unsigned short sel, old_sel; -- struct desc_struct old_desc, new_desc; -- const struct x86_emulate_ops *ops = ctxt->ops; -+ unsigned short sel; -+ struct desc_struct new_desc; - u8 cpl = ctxt->ops->cpl(ctxt); - -- /* Assignment of RIP may only fail in 64-bit mode */ -- if (ctxt->mode == X86EMUL_MODE_PROT64) -- ops->get_segment(ctxt, &old_sel, &old_desc, NULL, -- VCPU_SREG_CS); -- - memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2); - - rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl, -@@ -2124,12 +2118,10 @@ static int em_jmp_far(struct x86_emulate_ctxt *ctxt) - return rc; - - rc = assign_eip_far(ctxt, ctxt->src.val, &new_desc); -- if (rc != X86EMUL_CONTINUE) { -- WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64); -- /* assigning eip failed; restore the old cs */ -- ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS); -- return rc; -- } -+ /* Error handling is not implemented. */ -+ if (rc != X86EMUL_CONTINUE) -+ return X86EMUL_UNHANDLEABLE; -+ - return rc; - } - -@@ -2189,14 +2181,8 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt) - { - int rc; - unsigned long eip, cs; -- u16 old_cs; - int cpl = ctxt->ops->cpl(ctxt); -- struct desc_struct old_desc, new_desc; -- const struct x86_emulate_ops *ops = ctxt->ops; -- -- if (ctxt->mode == X86EMUL_MODE_PROT64) -- ops->get_segment(ctxt, &old_cs, &old_desc, NULL, -- VCPU_SREG_CS); -+ struct desc_struct new_desc; - - rc = emulate_pop(ctxt, &eip, ctxt->op_bytes); - if (rc != X86EMUL_CONTINUE) -@@ -2213,10 +2199,10 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt) - if (rc != X86EMUL_CONTINUE) - return rc; - rc = assign_eip_far(ctxt, eip, &new_desc); -- if (rc != X86EMUL_CONTINUE) { -- WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64); -- ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS); -- } -+ /* Error handling is not implemented. */ -+ if (rc != X86EMUL_CONTINUE) -+ return X86EMUL_UNHANDLEABLE; -+ - return rc; - } - -diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c -index 1a22de7..6e219e5 100644 ---- a/arch/x86/kvm/ioapic.c -+++ b/arch/x86/kvm/ioapic.c -@@ -94,7 +94,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic, - static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic) - { - ioapic->rtc_status.pending_eoi = 0; -- bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPUS); -+ bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID); - } - - static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic); -diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h -index 7d2692a..1cc6e54 100644 ---- a/arch/x86/kvm/ioapic.h -+++ b/arch/x86/kvm/ioapic.h -@@ -42,13 +42,13 @@ struct kvm_vcpu; - - struct dest_map { - /* vcpu bitmap where IRQ has been sent */ -- DECLARE_BITMAP(map, KVM_MAX_VCPUS); -+ DECLARE_BITMAP(map, KVM_MAX_VCPU_ID); - - /* - * Vector sent to a given vcpu, only valid when - * the vcpu's bit in map is set - */ -- u8 vectors[KVM_MAX_VCPUS]; -+ u8 vectors[KVM_MAX_VCPU_ID]; - }; - - -diff --git a/arch/x86/kvm/irq_comm.c b/arch/x86/kvm/irq_comm.c -index 25810b1..e7a112a 100644 ---- a/arch/x86/kvm/irq_comm.c -+++ b/arch/x86/kvm/irq_comm.c -@@ -41,6 +41,15 @@ static int kvm_set_pic_irq(struct kvm_kernel_irq_routing_entry *e, - bool line_status) - { - struct kvm_pic *pic = pic_irqchip(kvm); -+ -+ /* -+ * XXX: rejecting pic routes when pic isn't in use would be better, -+ * but the default routing table is installed while kvm->arch.vpic is -+ * NULL and KVM_CREATE_IRQCHIP can race with KVM_IRQ_LINE. -+ */ -+ if (!pic) -+ return -1; -+ - return kvm_pic_set_irq(pic, e->irqchip.pin, irq_source_id, level); - } - -@@ -49,6 +58,10 @@ static int kvm_set_ioapic_irq(struct kvm_kernel_irq_routing_entry *e, - bool line_status) - { - struct kvm_ioapic *ioapic = kvm->arch.vioapic; -+ -+ if (!ioapic) -+ return -1; -+ - return kvm_ioapic_set_irq(ioapic, e->irqchip.pin, irq_source_id, level, - line_status); - } -diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c -index b62c852..d2255e4 100644 ---- a/arch/x86/kvm/lapic.c -+++ b/arch/x86/kvm/lapic.c -@@ -138,7 +138,7 @@ static inline bool kvm_apic_map_get_logical_dest(struct kvm_apic_map *map, - *mask = dest_id & 0xff; - return true; - case KVM_APIC_MODE_XAPIC_CLUSTER: -- *cluster = map->xapic_cluster_map[dest_id >> 4]; -+ *cluster = map->xapic_cluster_map[(dest_id >> 4) & 0xf]; - *mask = dest_id & 0xf; - return true; - default: -diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c -index 832b98f..a3a983f 100644 ---- a/arch/x86/mm/extable.c -+++ b/arch/x86/mm/extable.c -@@ -135,7 +135,12 @@ void __init early_fixup_exception(struct pt_regs *regs, int trapnr) - if (early_recursion_flag > 2) - goto halt_loop; - -- if (regs->cs != __KERNEL_CS) -+ /* -+ * Old CPUs leave the high bits of CS on the stack -+ * undefined. I'm not sure which CPUs do this, but at least -+ * the 486 DX works this way. -+ */ -+ if ((regs->cs & 0xFFFF) != __KERNEL_CS) - goto fail; - - /* -diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c -index 865f46e..c80765b 100644 ---- a/crypto/asymmetric_keys/x509_cert_parser.c -+++ b/crypto/asymmetric_keys/x509_cert_parser.c -@@ -133,7 +133,6 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen) - return cert; - - error_decode: -- kfree(cert->pub->key); - kfree(ctx); - error_no_ctx: - x509_free_certificate(cert); -diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c -index 29f600f..ff64313 100644 ---- a/drivers/dax/dax.c -+++ b/drivers/dax/dax.c -@@ -323,8 +323,8 @@ static int check_vma(struct dax_dev *dax_dev, struct vm_area_struct *vma, - if (!dax_dev->alive) - return -ENXIO; - -- /* prevent private / writable mappings from being established */ -- if ((vma->vm_flags & (VM_NORESERVE|VM_SHARED|VM_WRITE)) == VM_WRITE) { -+ /* prevent private mappings from being established */ -+ if ((vma->vm_flags & VM_SHARED) != VM_SHARED) { - dev_info(dev, "%s: %s: fail, attempted private mapping\n", - current->comm, func); - return -EINVAL; -diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c -index 73ae849..76dd42d 100644 ---- a/drivers/dax/pmem.c -+++ b/drivers/dax/pmem.c -@@ -77,7 +77,9 @@ static int dax_pmem_probe(struct device *dev) - nsio = to_nd_namespace_io(&ndns->dev); - - /* parse the 'pfn' info block via ->rw_bytes */ -- devm_nsio_enable(dev, nsio); -+ rc = devm_nsio_enable(dev, nsio); -+ if (rc) -+ return rc; - altmap = nvdimm_setup_pfn(nd_pfn, &res, &__altmap); - if (IS_ERR(altmap)) - return PTR_ERR(altmap); -diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c -index 58470f5..8c53748 100644 ---- a/drivers/iommu/dmar.c -+++ b/drivers/iommu/dmar.c -@@ -338,7 +338,9 @@ static int dmar_pci_bus_notifier(struct notifier_block *nb, - struct pci_dev *pdev = to_pci_dev(data); - struct dmar_pci_notify_info *info; - -- /* Only care about add/remove events for physical functions */ -+ /* Only care about add/remove events for physical functions. -+ * For VFs we actually do the lookup based on the corresponding -+ * PF in device_to_iommu() anyway. */ - if (pdev->is_virtfn) - return NOTIFY_DONE; - if (action != BUS_NOTIFY_ADD_DEVICE && -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 1257b0b..7fb5387 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -892,7 +892,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf - return NULL; - - if (dev_is_pci(dev)) { -+ struct pci_dev *pf_pdev; -+ - pdev = to_pci_dev(dev); -+ /* VFs aren't listed in scope tables; we need to look up -+ * the PF instead to find the IOMMU. */ -+ pf_pdev = pci_physfn(pdev); -+ dev = &pf_pdev->dev; - segment = pci_domain_nr(pdev->bus); - } else if (has_acpi_companion(dev)) - dev = &ACPI_COMPANION(dev)->dev; -@@ -905,6 +911,13 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf - for_each_active_dev_scope(drhd->devices, - drhd->devices_cnt, i, tmp) { - if (tmp == dev) { -+ /* For a VF use its original BDF# not that of the PF -+ * which we used for the IOMMU lookup. Strictly speaking -+ * we could do this for all PCI devices; we only need to -+ * get the BDF# from the scope table for ACPI matches. */ -+ if (pdev->is_virtfn) -+ goto got_pdev; -+ - *bus = drhd->devices[i].bus; - *devfn = drhd->devices[i].devfn; - goto out; -diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c -index 8ebb353..cb72e00 100644 ---- a/drivers/iommu/intel-svm.c -+++ b/drivers/iommu/intel-svm.c -@@ -39,10 +39,18 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu) - struct page *pages; - int order; - -- order = ecap_pss(iommu->ecap) + 7 - PAGE_SHIFT; -- if (order < 0) -- order = 0; -- -+ /* Start at 2 because it's defined as 2^(1+PSS) */ -+ iommu->pasid_max = 2 << ecap_pss(iommu->ecap); -+ -+ /* Eventually I'm promised we will get a multi-level PASID table -+ * and it won't have to be physically contiguous. Until then, -+ * limit the size because 8MiB contiguous allocations can be hard -+ * to come by. The limit of 0x20000, which is 1MiB for each of -+ * the PASID and PASID-state tables, is somewhat arbitrary. */ -+ if (iommu->pasid_max > 0x20000) -+ iommu->pasid_max = 0x20000; -+ -+ order = get_order(sizeof(struct pasid_entry) * iommu->pasid_max); - pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); - if (!pages) { - pr_warn("IOMMU: %s: Failed to allocate PASID table\n", -@@ -53,6 +61,8 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu) - pr_info("%s: Allocated order %d PASID table.\n", iommu->name, order); - - if (ecap_dis(iommu->ecap)) { -+ /* Just making it explicit... */ -+ BUILD_BUG_ON(sizeof(struct pasid_entry) != sizeof(struct pasid_state_entry)); - pages = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); - if (pages) - iommu->pasid_state_table = page_address(pages); -@@ -68,11 +78,7 @@ int intel_svm_alloc_pasid_tables(struct intel_iommu *iommu) - - int intel_svm_free_pasid_tables(struct intel_iommu *iommu) - { -- int order; -- -- order = ecap_pss(iommu->ecap) + 7 - PAGE_SHIFT; -- if (order < 0) -- order = 0; -+ int order = get_order(sizeof(struct pasid_entry) * iommu->pasid_max); - - if (iommu->pasid_table) { - free_pages((unsigned long)iommu->pasid_table, order); -@@ -371,8 +377,8 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_ - } - svm->iommu = iommu; - -- if (pasid_max > 2 << ecap_pss(iommu->ecap)) -- pasid_max = 2 << ecap_pss(iommu->ecap); -+ if (pasid_max > iommu->pasid_max) -+ pasid_max = iommu->pasid_max; - - /* Do not use PASID 0 in caching mode (virtualised IOMMU) */ - ret = idr_alloc(&iommu->pasid_idr, svm, -diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c -index 317ef63..8d96a22 100644 ---- a/drivers/media/tuners/tuner-xc2028.c -+++ b/drivers/media/tuners/tuner-xc2028.c -@@ -281,6 +281,14 @@ static void free_firmware(struct xc2028_data *priv) - int i; - tuner_dbg("%s called\n", __func__); - -+ /* free allocated f/w string */ -+ if (priv->fname != firmware_name) -+ kfree(priv->fname); -+ priv->fname = NULL; -+ -+ priv->state = XC2028_NO_FIRMWARE; -+ memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); -+ - if (!priv->firm) - return; - -@@ -291,9 +299,6 @@ static void free_firmware(struct xc2028_data *priv) - - priv->firm = NULL; - priv->firm_size = 0; -- priv->state = XC2028_NO_FIRMWARE; -- -- memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); - } - - static int load_all_firmwares(struct dvb_frontend *fe, -@@ -884,9 +889,8 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type, - return 0; - - fail: -- priv->state = XC2028_NO_FIRMWARE; -+ free_firmware(priv); - -- memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); - if (retry_count < 8) { - msleep(50); - retry_count++; -@@ -1332,11 +1336,8 @@ static int xc2028_dvb_release(struct dvb_frontend *fe) - mutex_lock(&xc2028_list_mutex); - - /* only perform final cleanup if this is the last instance */ -- if (hybrid_tuner_report_instance_count(priv) == 1) { -+ if (hybrid_tuner_report_instance_count(priv) == 1) - free_firmware(priv); -- kfree(priv->ctrl.fname); -- priv->ctrl.fname = NULL; -- } - - if (priv) - hybrid_tuner_release_state(priv); -@@ -1399,19 +1400,8 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg) - - /* - * Copy the config data. -- * For the firmware name, keep a local copy of the string, -- * in order to avoid troubles during device release. - */ -- kfree(priv->ctrl.fname); -- priv->ctrl.fname = NULL; - memcpy(&priv->ctrl, p, sizeof(priv->ctrl)); -- if (p->fname) { -- priv->ctrl.fname = kstrdup(p->fname, GFP_KERNEL); -- if (priv->ctrl.fname == NULL) { -- rc = -ENOMEM; -- goto unlock; -- } -- } - - /* - * If firmware name changed, frees firmware. As free_firmware will -@@ -1426,10 +1416,15 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg) - - if (priv->state == XC2028_NO_FIRMWARE) { - if (!firmware_name[0]) -- priv->fname = priv->ctrl.fname; -+ priv->fname = kstrdup(p->fname, GFP_KERNEL); - else - priv->fname = firmware_name; - -+ if (!priv->fname) { -+ rc = -ENOMEM; -+ goto unlock; -+ } -+ - rc = request_firmware_nowait(THIS_MODULE, 1, - priv->fname, - priv->i2c_props.adap->dev.parent, -diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c -index 239be2f..2267601 100644 ---- a/drivers/mmc/host/sdhci-of-esdhc.c -+++ b/drivers/mmc/host/sdhci-of-esdhc.c -@@ -66,6 +66,20 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, - return ret; - } - } -+ /* -+ * The DAT[3:0] line signal levels and the CMD line signal level are -+ * not compatible with standard SDHC register. The line signal levels -+ * DAT[7:0] are at bits 31:24 and the command line signal level is at -+ * bit 23. All other bits are the same as in the standard SDHC -+ * register. -+ */ -+ if (spec_reg == SDHCI_PRESENT_STATE) { -+ ret = value & 0x000fffff; -+ ret |= (value >> 4) & SDHCI_DATA_LVL_MASK; -+ ret |= (value << 1) & SDHCI_CMD_LVL; -+ return ret; -+ } -+ - ret = value; - return ret; - } -diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h -index 0411c9f..1b3bd1c 100644 ---- a/drivers/mmc/host/sdhci.h -+++ b/drivers/mmc/host/sdhci.h -@@ -73,6 +73,7 @@ - #define SDHCI_DATA_LVL_MASK 0x00F00000 - #define SDHCI_DATA_LVL_SHIFT 20 - #define SDHCI_DATA_0_LVL_MASK 0x00100000 -+#define SDHCI_CMD_LVL 0x01000000 - - #define SDHCI_HOST_CONTROL 0x28 - #define SDHCI_CTRL_LED 0x01 -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index 46c0f5e..58e6029 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -3894,6 +3894,11 @@ _scsih_temp_threshold_events(struct MPT3SAS_ADAPTER *ioc, - } - } - -+static inline bool ata_12_16_cmd(struct scsi_cmnd *scmd) -+{ -+ return (scmd->cmnd[0] == ATA_12 || scmd->cmnd[0] == ATA_16); -+} -+ - /** - * _scsih_flush_running_cmds - completing outstanding commands. - * @ioc: per adapter object -@@ -3915,6 +3920,9 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc) - if (!scmd) - continue; - count++; -+ if (ata_12_16_cmd(scmd)) -+ scsi_internal_device_unblock(scmd->device, -+ SDEV_RUNNING); - mpt3sas_base_free_smid(ioc, smid); - scsi_dma_unmap(scmd); - if (ioc->pci_error_recovery) -@@ -4019,8 +4027,6 @@ _scsih_eedp_error_handling(struct scsi_cmnd *scmd, u16 ioc_status) - SAM_STAT_CHECK_CONDITION; - } - -- -- - /** - * scsih_qcmd - main scsi request entry point - * @scmd: pointer to scsi command object -@@ -4047,6 +4053,13 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) - if (ioc->logging_level & MPT_DEBUG_SCSI) - scsi_print_command(scmd); - -+ /* -+ * Lock the device for any subsequent command until command is -+ * done. -+ */ -+ if (ata_12_16_cmd(scmd)) -+ scsi_internal_device_block(scmd->device); -+ - sas_device_priv_data = scmd->device->hostdata; - if (!sas_device_priv_data || !sas_device_priv_data->sas_target) { - scmd->result = DID_NO_CONNECT << 16; -@@ -4622,6 +4635,9 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply) - if (scmd == NULL) - return 1; - -+ if (ata_12_16_cmd(scmd)) -+ scsi_internal_device_unblock(scmd->device, SDEV_RUNNING); -+ - mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); - - if (mpi_reply == NULL) { -diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c -index 7a22307..afada65 100644 ---- a/drivers/thermal/intel_powerclamp.c -+++ b/drivers/thermal/intel_powerclamp.c -@@ -669,9 +669,16 @@ static struct thermal_cooling_device_ops powerclamp_cooling_ops = { - .set_cur_state = powerclamp_set_cur_state, - }; - -+static const struct x86_cpu_id __initconst intel_powerclamp_ids[] = { -+ { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_MWAIT }, -+ {} -+}; -+MODULE_DEVICE_TABLE(x86cpu, intel_powerclamp_ids); -+ - static int __init powerclamp_probe(void) - { -- if (!boot_cpu_has(X86_FEATURE_MWAIT)) { -+ -+ if (!x86_match_cpu(intel_powerclamp_ids)) { - pr_err("CPU does not support MWAIT"); - return -ENODEV; - } -diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index 69426e6..3dbb4a2 100644 ---- a/drivers/usb/chipidea/core.c -+++ b/drivers/usb/chipidea/core.c -@@ -914,6 +914,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) - if (!ci) - return -ENOMEM; - -+ spin_lock_init(&ci->lock); - ci->dev = dev; - ci->platdata = dev_get_platdata(dev); - ci->imx28_write_fix = !!(ci->platdata->flags & -diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c -index b933568..bced28f 100644 ---- a/drivers/usb/chipidea/udc.c -+++ b/drivers/usb/chipidea/udc.c -@@ -1895,8 +1895,6 @@ static int udc_start(struct ci_hdrc *ci) - struct usb_otg_caps *otg_caps = &ci->platdata->ci_otg_caps; - int retval = 0; - -- spin_lock_init(&ci->lock); -- - ci->gadget.ops = &usb_gadget_ops; - ci->gadget.speed = USB_SPEED_UNKNOWN; - ci->gadget.max_speed = USB_SPEED_HIGH; -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index f61477b..243ac5e 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -131,6 +131,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ - { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ -+ { USB_DEVICE(0x10C4, 0x8962) }, /* Brim Brothers charging dock */ - { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ - { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ - { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 0ff7f38..6e9fc8b 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1012,6 +1012,8 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, - { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, - { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, -+ { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID), -+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 21011c0..48ee04c 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -596,6 +596,12 @@ - #define STK541_PID 0x2109 /* Zigbee Controller */ - - /* -+ * Texas Instruments -+ */ -+#define TI_VID 0x0451 -+#define TI_CC3200_LAUNCHPAD_PID 0xC32A /* SimpleLink Wi-Fi CC3200 LaunchPad */ -+ -+/* - * Blackfin gnICE JTAG - * http://docs.blackfin.uclinux.org/doku.php?id=hw:jtag:gnice - */ -diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c -index ffd0867..1a59f33 100644 ---- a/drivers/usb/storage/transport.c -+++ b/drivers/usb/storage/transport.c -@@ -954,10 +954,15 @@ int usb_stor_CB_transport(struct scsi_cmnd *srb, struct us_data *us) - - /* COMMAND STAGE */ - /* let's send the command via the control pipe */ -+ /* -+ * Command is sometime (f.e. after scsi_eh_prep_cmnd) on the stack. -+ * Stack may be vmallocated. So no DMA for us. Make a copy. -+ */ -+ memcpy(us->iobuf, srb->cmnd, srb->cmd_len); - result = usb_stor_ctrl_transfer(us, us->send_ctrl_pipe, - US_CBI_ADSC, - USB_TYPE_CLASS | USB_RECIP_INTERFACE, 0, -- us->ifnum, srb->cmnd, srb->cmd_len); -+ us->ifnum, us->iobuf, srb->cmd_len); - - /* check the return code for the command */ - usb_stor_dbg(us, "Call to usb_stor_ctrl_transfer() returned %d\n", -diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c -index 52a2831..48efe62 100644 ---- a/fs/nfs/callback.c -+++ b/fs/nfs/callback.c -@@ -261,7 +261,7 @@ static int nfs_callback_up_net(int minorversion, struct svc_serv *serv, - } - - ret = -EPROTONOSUPPORT; -- if (minorversion == 0) -+ if (!IS_ENABLED(CONFIG_NFS_V4_1) || minorversion == 0) - ret = nfs4_callback_up_net(serv, net); - else if (xprt->ops->bc_up) - ret = xprt->ops->bc_up(serv, net); -diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h -index 2d9b6500..d49e26c 100644 ---- a/include/linux/intel-iommu.h -+++ b/include/linux/intel-iommu.h -@@ -429,6 +429,7 @@ struct intel_iommu { - struct page_req_dsc *prq; - unsigned char prq_name[16]; /* Name for PRQ interrupt */ - struct idr pasid_idr; -+ u32 pasid_max; - #endif - struct q_inval *qi; /* Queued invalidation info */ - u32 *iommu_state; /* Store iommu states between suspend and resume.*/ -diff --git a/kernel/events/core.c b/kernel/events/core.c -index fc9bb22..f8c5f5e 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -7908,6 +7908,7 @@ static void perf_event_addr_filters_apply(struct perf_event *event) - * if <size> is not specified, the range is treated as a single address. - */ - enum { -+ IF_ACT_NONE = -1, - IF_ACT_FILTER, - IF_ACT_START, - IF_ACT_STOP, -@@ -7931,6 +7932,7 @@ static const match_table_t if_tokens = { - { IF_SRC_KERNEL, "%u/%u" }, - { IF_SRC_FILEADDR, "%u@%s" }, - { IF_SRC_KERNELADDR, "%u" }, -+ { IF_ACT_NONE, NULL }, - }; - - /* -diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c -index 5464c87..e24388a 100644 ---- a/lib/mpi/mpi-pow.c -+++ b/lib/mpi/mpi-pow.c -@@ -64,8 +64,13 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) - if (!esize) { - /* Exponent is zero, result is 1 mod MOD, i.e., 1 or 0 - * depending on if MOD equals 1. */ -- rp[0] = 1; - res->nlimbs = (msize == 1 && mod->d[0] == 1) ? 0 : 1; -+ if (res->nlimbs) { -+ if (mpi_resize(res, 1) < 0) -+ goto enomem; -+ rp = res->d; -+ rp[0] = 1; -+ } - res->sign = 0; - goto leave; - } -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index a2214c6..7401e99 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -3161,6 +3161,16 @@ should_compact_retry(struct alloc_context *ac, unsigned int order, int alloc_fla - if (!order || order > PAGE_ALLOC_COSTLY_ORDER) - return false; - -+#ifdef CONFIG_COMPACTION -+ /* -+ * This is a gross workaround to compensate a lack of reliable compaction -+ * operation. We cannot simply go OOM with the current state of the compaction -+ * code because this can lead to pre mature OOM declaration. -+ */ -+ if (order <= PAGE_ALLOC_COSTLY_ORDER) -+ return true; -+#endif -+ - /* - * There are setups with compaction disabled which would prefer to loop - * inside the allocator rather than hit the oom killer prematurely. -diff --git a/net/can/bcm.c b/net/can/bcm.c -index 8af9d25..436a753 100644 ---- a/net/can/bcm.c -+++ b/net/can/bcm.c -@@ -77,7 +77,7 @@ - (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \ - (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG)) - --#define CAN_BCM_VERSION "20160617" -+#define CAN_BCM_VERSION "20161123" - - MODULE_DESCRIPTION("PF_CAN broadcast manager protocol"); - MODULE_LICENSE("Dual BSD/GPL"); -@@ -109,8 +109,9 @@ struct bcm_op { - u32 count; - u32 nframes; - u32 currframe; -- struct canfd_frame *frames; -- struct canfd_frame *last_frames; -+ /* void pointers to arrays of struct can[fd]_frame */ -+ void *frames; -+ void *last_frames; - struct canfd_frame sframe; - struct canfd_frame last_sframe; - struct sock *sk; -@@ -681,7 +682,7 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data) - - if (op->flags & RX_FILTER_ID) { - /* the easiest case */ -- bcm_rx_update_and_send(op, &op->last_frames[0], rxframe); -+ bcm_rx_update_and_send(op, op->last_frames, rxframe); - goto rx_starttimer; - } - -@@ -1068,7 +1069,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - - if (msg_head->nframes) { - /* update CAN frames content */ -- err = memcpy_from_msg((u8 *)op->frames, msg, -+ err = memcpy_from_msg(op->frames, msg, - msg_head->nframes * op->cfsiz); - if (err < 0) - return err; -@@ -1118,7 +1119,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - } - - if (msg_head->nframes) { -- err = memcpy_from_msg((u8 *)op->frames, msg, -+ err = memcpy_from_msg(op->frames, msg, - msg_head->nframes * op->cfsiz); - if (err < 0) { - if (op->frames != &op->sframe) -@@ -1163,6 +1164,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - /* check flags */ - - if (op->flags & RX_RTR_FRAME) { -+ struct canfd_frame *frame0 = op->frames; - - /* no timers in RTR-mode */ - hrtimer_cancel(&op->thrtimer); -@@ -1174,8 +1176,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - * prevent a full-load-loopback-test ... ;-] - */ - if ((op->flags & TX_CP_CAN_ID) || -- (op->frames[0].can_id == op->can_id)) -- op->frames[0].can_id = op->can_id & ~CAN_RTR_FLAG; -+ (frame0->can_id == op->can_id)) -+ frame0->can_id = op->can_id & ~CAN_RTR_FLAG; - - } else { - if (op->flags & SETTIMER) { -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 5550a86..396aac7 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -945,4 +945,4 @@ static int __init init_default_flow_dissectors(void) - return 0; - } - --late_initcall_sync(init_default_flow_dissectors); -+core_initcall(init_default_flow_dissectors); -diff --git a/net/wireless/core.h b/net/wireless/core.h -index eee9144..66f2a11 100644 ---- a/net/wireless/core.h -+++ b/net/wireless/core.h -@@ -71,6 +71,7 @@ struct cfg80211_registered_device { - struct list_head bss_list; - struct rb_root bss_tree; - u32 bss_generation; -+ u32 bss_entries; - struct cfg80211_scan_request *scan_req; /* protected by RTNL */ - struct sk_buff *scan_msg; - struct cfg80211_sched_scan_request __rcu *sched_scan_req; -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 0358e12..438143a 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -57,6 +57,19 @@ - * also linked into the probe response struct. - */ - -+/* -+ * Limit the number of BSS entries stored in mac80211. Each one is -+ * a bit over 4k at most, so this limits to roughly 4-5M of memory. -+ * If somebody wants to really attack this though, they'd likely -+ * use small beacons, and only one type of frame, limiting each of -+ * the entries to a much smaller size (in order to generate more -+ * entries in total, so overhead is bigger.) -+ */ -+static int bss_entries_limit = 1000; -+module_param(bss_entries_limit, int, 0644); -+MODULE_PARM_DESC(bss_entries_limit, -+ "limit to number of scan BSS entries (per wiphy, default 1000)"); -+ - #define IEEE80211_SCAN_RESULT_EXPIRE (30 * HZ) - - static void bss_free(struct cfg80211_internal_bss *bss) -@@ -137,6 +150,10 @@ static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev, - - list_del_init(&bss->list); - rb_erase(&bss->rbn, &rdev->bss_tree); -+ rdev->bss_entries--; -+ WARN_ONCE((rdev->bss_entries == 0) ^ list_empty(&rdev->bss_list), -+ "rdev bss entries[%d]/list[empty:%d] corruption\n", -+ rdev->bss_entries, list_empty(&rdev->bss_list)); - bss_ref_put(rdev, bss); - return true; - } -@@ -163,6 +180,40 @@ static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev, - rdev->bss_generation++; - } - -+static bool cfg80211_bss_expire_oldest(struct cfg80211_registered_device *rdev) -+{ -+ struct cfg80211_internal_bss *bss, *oldest = NULL; -+ bool ret; -+ -+ lockdep_assert_held(&rdev->bss_lock); -+ -+ list_for_each_entry(bss, &rdev->bss_list, list) { -+ if (atomic_read(&bss->hold)) -+ continue; -+ -+ if (!list_empty(&bss->hidden_list) && -+ !bss->pub.hidden_beacon_bss) -+ continue; -+ -+ if (oldest && time_before(oldest->ts, bss->ts)) -+ continue; -+ oldest = bss; -+ } -+ -+ if (WARN_ON(!oldest)) -+ return false; -+ -+ /* -+ * The callers make sure to increase rdev->bss_generation if anything -+ * gets removed (and a new entry added), so there's no need to also do -+ * it here. -+ */ -+ -+ ret = __cfg80211_unlink_bss(rdev, oldest); -+ WARN_ON(!ret); -+ return ret; -+} -+ - void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, - bool send_message) - { -@@ -693,6 +744,7 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, - const u8 *ie; - int i, ssidlen; - u8 fold = 0; -+ u32 n_entries = 0; - - ies = rcu_access_pointer(new->pub.beacon_ies); - if (WARN_ON(!ies)) -@@ -716,6 +768,12 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, - /* This is the bad part ... */ - - list_for_each_entry(bss, &rdev->bss_list, list) { -+ /* -+ * we're iterating all the entries anyway, so take the -+ * opportunity to validate the list length accounting -+ */ -+ n_entries++; -+ - if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid)) - continue; - if (bss->pub.channel != new->pub.channel) -@@ -744,6 +802,10 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev, - new->pub.beacon_ies); - } - -+ WARN_ONCE(n_entries != rdev->bss_entries, -+ "rdev bss entries[%d]/list[len:%d] corruption\n", -+ rdev->bss_entries, n_entries); -+ - return true; - } - -@@ -898,7 +960,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev, - } - } - -+ if (rdev->bss_entries >= bss_entries_limit && -+ !cfg80211_bss_expire_oldest(rdev)) { -+ kfree(new); -+ goto drop; -+ } -+ - list_add_tail(&new->list, &rdev->bss_list); -+ rdev->bss_entries++; - rb_insert_bss(rdev, new); - found = new; - } -diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c -index fc3036b..a4d90aa 100644 ---- a/security/apparmor/domain.c -+++ b/security/apparmor/domain.c -@@ -621,8 +621,8 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest) - /* released below */ - cred = get_current_cred(); - cxt = cred_cxt(cred); -- profile = aa_cred_profile(cred); -- previous_profile = cxt->previous; -+ profile = aa_get_newest_profile(aa_cred_profile(cred)); -+ previous_profile = aa_get_newest_profile(cxt->previous); - - if (unconfined(profile)) { - info = "unconfined"; -@@ -718,6 +718,8 @@ int aa_change_hat(const char *hats[], int count, u64 token, bool permtest) - out: - aa_put_profile(hat); - kfree(name); -+ aa_put_profile(profile); -+ aa_put_profile(previous_profile); - put_cred(cred); - - return error; diff --git a/4.8.12/0000_README b/4.8.13/0000_README index 99a02b8..4bb277a 100644 --- a/4.8.12/0000_README +++ b/4.8.13/0000_README @@ -2,15 +2,11 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 1010_linux-4.8.11.patch +Patch: 1012_linux-4.8.13.patch From: http://www.kernel.org -Desc: Linux 4.8.11 +Desc: Linux 4.8.13 -Patch: 1011_linux-4.8.12.patch -From: http://www.kernel.org -Desc: Linux 4.8.12 - -Patch: 4420_grsecurity-3.1-4.8.12-201612062306.patch +Patch: 4420_grsecurity-3.1-4.8.13-201612082118.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity @@ -18,6 +14,10 @@ Patch: 4425_grsec_remove_EI_PAX.patch From: Anthony G. Basile <blueness@gentoo.org> Desc: Remove EI_PAX option and force off +Patch: 4427_force_XATTR_PAX_tmpfs.patch +From: Anthony G. Basile <blueness@gentoo.org> +Desc: Force XATTR_PAX on tmpfs + Patch: 4430_grsec-remove-localversion-grsec.patch From: Kerin Millar <kerframil@gmail.com> Desc: Removes grsecurity's localversion-grsec file diff --git a/4.8.13/1012_linux-4.8.13.patch b/4.8.13/1012_linux-4.8.13.patch new file mode 100644 index 0000000..c742393 --- /dev/null +++ b/4.8.13/1012_linux-4.8.13.patch @@ -0,0 +1,1063 @@ +diff --git a/Makefile b/Makefile +index 7b0c92f..b38abe9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 8 +-SUBLEVEL = 12 ++SUBLEVEL = 13 + EXTRAVERSION = + NAME = Psychotic Stoned Sheep + +diff --git a/arch/arc/include/asm/delay.h b/arch/arc/include/asm/delay.h +index 08e7e2a..a36e860 100644 +--- a/arch/arc/include/asm/delay.h ++++ b/arch/arc/include/asm/delay.h +@@ -22,10 +22,11 @@ + static inline void __delay(unsigned long loops) + { + __asm__ __volatile__( +- " lp 1f \n" +- " nop \n" +- "1: \n" +- : "+l"(loops)); ++ " mov lp_count, %0 \n" ++ " lp 1f \n" ++ " nop \n" ++ "1: \n" ++ : : "r"(loops)); + } + + extern void __bad_udelay(void); +diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h +index 89eeb37..e94ca72 100644 +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep) + + #define pte_page(pte) pfn_to_page(pte_pfn(pte)) + #define mk_pte(page, prot) pfn_pte(page_to_pfn(page), prot) +-#define pfn_pte(pfn, prot) __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot)) ++#define pfn_pte(pfn, prot) __pte(__pfn_to_phys(pfn) | pgprot_val(prot)) + + /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/ + #define pte_pfn(pte) (pte_val(pte) >> PAGE_SHIFT) +diff --git a/arch/arm64/boot/dts/arm/juno-r1.dts b/arch/arm64/boot/dts/arm/juno-r1.dts +index 123a58b..f0b857d 100644 +--- a/arch/arm64/boot/dts/arm/juno-r1.dts ++++ b/arch/arm64/boot/dts/arm/juno-r1.dts +@@ -76,7 +76,7 @@ + compatible = "arm,idle-state"; + arm,psci-suspend-param = <0x1010000>; + local-timer-stop; +- entry-latency-us = <300>; ++ entry-latency-us = <400>; + exit-latency-us = <1200>; + min-residency-us = <2500>; + }; +diff --git a/arch/arm64/boot/dts/arm/juno-r2.dts b/arch/arm64/boot/dts/arm/juno-r2.dts +index 007be82..26aaa6a 100644 +--- a/arch/arm64/boot/dts/arm/juno-r2.dts ++++ b/arch/arm64/boot/dts/arm/juno-r2.dts +@@ -76,7 +76,7 @@ + compatible = "arm,idle-state"; + arm,psci-suspend-param = <0x1010000>; + local-timer-stop; +- entry-latency-us = <300>; ++ entry-latency-us = <400>; + exit-latency-us = <1200>; + min-residency-us = <2500>; + }; +diff --git a/arch/arm64/boot/dts/arm/juno.dts b/arch/arm64/boot/dts/arm/juno.dts +index a7270ef..6e154d9 100644 +--- a/arch/arm64/boot/dts/arm/juno.dts ++++ b/arch/arm64/boot/dts/arm/juno.dts +@@ -76,7 +76,7 @@ + compatible = "arm,idle-state"; + arm,psci-suspend-param = <0x1010000>; + local-timer-stop; +- entry-latency-us = <300>; ++ entry-latency-us = <400>; + exit-latency-us = <1200>; + min-residency-us = <2500>; + }; +diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h +index 7099f26..b96346b 100644 +--- a/arch/arm64/include/asm/cpufeature.h ++++ b/arch/arm64/include/asm/cpufeature.h +@@ -90,7 +90,7 @@ struct arm64_cpu_capabilities { + u16 capability; + int def_scope; /* default scope */ + bool (*matches)(const struct arm64_cpu_capabilities *caps, int scope); +- void (*enable)(void *); /* Called on all active CPUs */ ++ int (*enable)(void *); /* Called on all active CPUs */ + union { + struct { /* To be used for erratum handling only */ + u32 midr_model; +diff --git a/arch/arm64/include/asm/exec.h b/arch/arm64/include/asm/exec.h +index db0563c..f7865dd 100644 +--- a/arch/arm64/include/asm/exec.h ++++ b/arch/arm64/include/asm/exec.h +@@ -18,6 +18,9 @@ + #ifndef __ASM_EXEC_H + #define __ASM_EXEC_H + ++#include <linux/sched.h> ++ + extern unsigned long arch_align_stack(unsigned long sp); ++void uao_thread_switch(struct task_struct *next); + + #endif /* __ASM_EXEC_H */ +diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h +index ace0a96..3be0ab0 100644 +--- a/arch/arm64/include/asm/processor.h ++++ b/arch/arm64/include/asm/processor.h +@@ -190,8 +190,8 @@ static inline void spin_lock_prefetch(const void *ptr) + + #endif + +-void cpu_enable_pan(void *__unused); +-void cpu_enable_uao(void *__unused); +-void cpu_enable_cache_maint_trap(void *__unused); ++int cpu_enable_pan(void *__unused); ++int cpu_enable_uao(void *__unused); ++int cpu_enable_cache_maint_trap(void *__unused); + + #endif /* __ASM_PROCESSOR_H */ +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index 62272ea..94a0330 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -19,7 +19,9 @@ + #define pr_fmt(fmt) "CPU features: " fmt + + #include <linux/bsearch.h> ++#include <linux/cpumask.h> + #include <linux/sort.h> ++#include <linux/stop_machine.h> + #include <linux/types.h> + #include <asm/cpu.h> + #include <asm/cpufeature.h> +@@ -936,7 +938,13 @@ void __init enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps) + { + for (; caps->matches; caps++) + if (caps->enable && cpus_have_cap(caps->capability)) +- on_each_cpu(caps->enable, NULL, true); ++ /* ++ * Use stop_machine() as it schedules the work allowing ++ * us to modify PSTATE, instead of on_each_cpu() which ++ * uses an IPI, giving us a PSTATE that disappears when ++ * we return. ++ */ ++ stop_machine(caps->enable, NULL, cpu_online_mask); + } + + /* +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 6cd2612..9cc8667 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -49,6 +49,7 @@ + #include <asm/alternative.h> + #include <asm/compat.h> + #include <asm/cacheflush.h> ++#include <asm/exec.h> + #include <asm/fpsimd.h> + #include <asm/mmu_context.h> + #include <asm/processor.h> +@@ -303,7 +304,7 @@ static void tls_thread_switch(struct task_struct *next) + } + + /* Restore the UAO state depending on next's addr_limit */ +-static void uao_thread_switch(struct task_struct *next) ++void uao_thread_switch(struct task_struct *next) + { + if (IS_ENABLED(CONFIG_ARM64_UAO)) { + if (task_thread_info(next)->addr_limit == KERNEL_DS) +diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c +index b616e365..23ddf55 100644 +--- a/arch/arm64/kernel/suspend.c ++++ b/arch/arm64/kernel/suspend.c +@@ -1,8 +1,11 @@ + #include <linux/ftrace.h> + #include <linux/percpu.h> + #include <linux/slab.h> ++#include <asm/alternative.h> + #include <asm/cacheflush.h> ++#include <asm/cpufeature.h> + #include <asm/debug-monitors.h> ++#include <asm/exec.h> + #include <asm/pgtable.h> + #include <asm/memory.h> + #include <asm/mmu_context.h> +@@ -48,6 +51,14 @@ void notrace __cpu_suspend_exit(void) + set_my_cpu_offset(per_cpu_offset(smp_processor_id())); + + /* ++ * PSTATE was not saved over suspend/resume, re-enable any detected ++ * features that might not have been set correctly. ++ */ ++ asm(ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, ++ CONFIG_ARM64_PAN)); ++ uao_thread_switch(current); ++ ++ /* + * Restore HW breakpoint registers to sane values + * before debug exceptions are possibly reenabled + * through local_dbg_restore. +diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c +index 771a01a7f..9595d3d 100644 +--- a/arch/arm64/kernel/traps.c ++++ b/arch/arm64/kernel/traps.c +@@ -428,9 +428,10 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs) + force_signal_inject(SIGILL, ILL_ILLOPC, regs, 0); + } + +-void cpu_enable_cache_maint_trap(void *__unused) ++int cpu_enable_cache_maint_trap(void *__unused) + { + config_sctlr_el1(SCTLR_EL1_UCI, 0); ++ return 0; + } + + #define __user_cache_maint(insn, address, res) \ +diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c +index 05d2bd7..67506c3 100644 +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -29,7 +29,9 @@ + #include <linux/sched.h> + #include <linux/highmem.h> + #include <linux/perf_event.h> ++#include <linux/preempt.h> + ++#include <asm/bug.h> + #include <asm/cpufeature.h> + #include <asm/exception.h> + #include <asm/debug-monitors.h> +@@ -671,9 +673,17 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, + NOKPROBE_SYMBOL(do_debug_exception); + + #ifdef CONFIG_ARM64_PAN +-void cpu_enable_pan(void *__unused) ++int cpu_enable_pan(void *__unused) + { ++ /* ++ * We modify PSTATE. This won't work from irq context as the PSTATE ++ * is discarded once we return from the exception. ++ */ ++ WARN_ON_ONCE(in_interrupt()); ++ + config_sctlr_el1(SCTLR_EL1_SPAN, 0); ++ asm(SET_PSTATE_PAN(1)); ++ return 0; + } + #endif /* CONFIG_ARM64_PAN */ + +@@ -684,8 +694,9 @@ void cpu_enable_pan(void *__unused) + * We need to enable the feature at runtime (instead of adding it to + * PSR_MODE_EL1h) as the feature may not be implemented by the cpu. + */ +-void cpu_enable_uao(void *__unused) ++int cpu_enable_uao(void *__unused) + { + asm(SET_PSTATE_UAO(1)); ++ return 0; + } + #endif /* CONFIG_ARM64_UAO */ +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index d0efb5c..a4e070a 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -2344,7 +2344,7 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *ent + frame.next_frame = 0; + frame.return_address = 0; + +- if (!access_ok(VERIFY_READ, fp, 8)) ++ if (!valid_user_frame(fp, sizeof(frame))) + break; + + bytes = __copy_from_user_nmi(&frame.next_frame, fp, 4); +@@ -2354,9 +2354,6 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *ent + if (bytes != 0) + break; + +- if (!valid_user_frame(fp, sizeof(frame))) +- break; +- + perf_callchain_store(entry, cs_base + frame.return_address); + fp = compat_ptr(ss_base + frame.next_frame); + } +@@ -2405,7 +2402,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs + frame.next_frame = NULL; + frame.return_address = 0; + +- if (!access_ok(VERIFY_READ, fp, sizeof(*fp) * 2)) ++ if (!valid_user_frame(fp, sizeof(frame))) + break; + + bytes = __copy_from_user_nmi(&frame.next_frame, fp, sizeof(*fp)); +@@ -2415,9 +2412,6 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs + if (bytes != 0) + break; + +- if (!valid_user_frame(fp, sizeof(frame))) +- break; +- + perf_callchain_store(entry, frame.return_address); + fp = (void __user *)frame.next_frame; + } +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index e207b33..1e007a9 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -1088,7 +1088,7 @@ static void ata_gen_passthru_sense(struct ata_queued_cmd *qc) + desc[1] = tf->command; /* status */ + desc[2] = tf->device; + desc[3] = tf->nsect; +- desc[0] = 0; ++ desc[7] = 0; + if (tf->flags & ATA_TFLAG_LBA48) { + desc[8] |= 0x80; + if (tf->hob_nsect) +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index 04365b1..5163c8f 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -1403,7 +1403,8 @@ static ssize_t hot_remove_store(struct class *class, + zram = idr_find(&zram_index_idr, dev_id); + if (zram) { + ret = zram_remove(zram); +- idr_remove(&zram_index_idr, dev_id); ++ if (!ret) ++ idr_remove(&zram_index_idr, dev_id); + } else { + ret = -ENODEV; + } +diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c +index 838b22a..f2c9274 100644 +--- a/drivers/clk/sunxi/clk-sunxi.c ++++ b/drivers/clk/sunxi/clk-sunxi.c +@@ -373,7 +373,7 @@ static void sun4i_get_apb1_factors(struct factors_request *req) + else + calcp = 3; + +- calcm = (req->parent_rate >> calcp) - 1; ++ calcm = (div >> calcp) - 1; + + req->rate = (req->parent_rate >> calcp) / (calcm + 1); + req->m = calcm; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +index 10b5ddf..1ed085f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +@@ -33,6 +33,7 @@ struct amdgpu_atpx { + + static struct amdgpu_atpx_priv { + bool atpx_detected; ++ bool bridge_pm_usable; + /* handle for device - and atpx */ + acpi_handle dhandle; + acpi_handle other_handle; +@@ -200,7 +201,11 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx) + atpx->is_hybrid = false; + if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) { + printk("ATPX Hybrid Graphics\n"); +- atpx->functions.power_cntl = false; ++ /* ++ * Disable legacy PM methods only when pcie port PM is usable, ++ * otherwise the device might fail to power off or power on. ++ */ ++ atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable; + atpx->is_hybrid = true; + } + +@@ -546,17 +551,25 @@ static bool amdgpu_atpx_detect(void) + struct pci_dev *pdev = NULL; + bool has_atpx = false; + int vga_count = 0; ++ bool d3_supported = false; ++ struct pci_dev *parent_pdev; + + while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) { + vga_count++; + + has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true); ++ ++ parent_pdev = pci_upstream_bridge(pdev); ++ d3_supported |= parent_pdev && parent_pdev->bridge_d3; + } + + while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) { + vga_count++; + + has_atpx |= (amdgpu_atpx_pci_probe_handle(pdev) == true); ++ ++ parent_pdev = pci_upstream_bridge(pdev); ++ d3_supported |= parent_pdev && parent_pdev->bridge_d3; + } + + if (has_atpx && vga_count == 2) { +@@ -564,6 +577,7 @@ static bool amdgpu_atpx_detect(void) + printk(KERN_INFO "vga_switcheroo: detected switching method %s handle\n", + acpi_method_name); + amdgpu_atpx_priv.atpx_detected = true; ++ amdgpu_atpx_priv.bridge_pm_usable = d3_supported; + amdgpu_atpx_init(); + return true; + } +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index a77ce99..b8e3854 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -2540,7 +2540,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj) + page = shmem_read_mapping_page(mapping, i); + if (IS_ERR(page)) { + ret = PTR_ERR(page); +- goto err_pages; ++ goto err_sg; + } + } + #ifdef CONFIG_SWIOTLB +@@ -2583,8 +2583,9 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj) + + return 0; + +-err_pages: ++err_sg: + sg_mark_end(sg); ++err_pages: + for_each_sgt_page(page, sgt_iter, st) + put_page(page); + sg_free_table(st); +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index e26f889..35d385d 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -11791,7 +11791,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, + intel_crtc->reset_counter = i915_reset_counter(&dev_priv->gpu_error); + if (__i915_reset_in_progress_or_wedged(intel_crtc->reset_counter)) { + ret = -EIO; +- goto cleanup; ++ goto unlock; + } + + atomic_inc(&intel_crtc->unpin_work_count); +@@ -11877,6 +11877,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, + if (!IS_ERR_OR_NULL(request)) + i915_add_request_no_flush(request); + atomic_dec(&intel_crtc->unpin_work_count); ++unlock: + mutex_unlock(&dev->struct_mutex); + cleanup: + crtc->primary->fb = old_fb; +diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +index 8f62671f..54acfcc 100644 +--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c ++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +@@ -249,13 +249,6 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev) + if (irq < 0) + return irq; + +- ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler, +- IRQF_TRIGGER_NONE, dev_name(dev), priv); +- if (ret < 0) { +- dev_err(dev, "Failed to request irq %d: %d\n", irq, ret); +- return ret; +- } +- + comp_id = mtk_ddp_comp_get_id(dev->of_node, MTK_DISP_OVL); + if (comp_id < 0) { + dev_err(dev, "Failed to identify by alias: %d\n", comp_id); +@@ -271,6 +264,13 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, priv); + ++ ret = devm_request_irq(dev, irq, mtk_disp_ovl_irq_handler, ++ IRQF_TRIGGER_NONE, dev_name(dev), priv); ++ if (ret < 0) { ++ dev_err(dev, "Failed to request irq %d: %d\n", irq, ret); ++ return ret; ++ } ++ + ret = component_add(dev, &mtk_disp_ovl_component_ops); + if (ret) + dev_err(dev, "Failed to add component: %d\n", ret); +diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +index ddef0d4..34b4ace 100644 +--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c ++++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c +@@ -33,6 +33,7 @@ struct radeon_atpx { + + static struct radeon_atpx_priv { + bool atpx_detected; ++ bool bridge_pm_usable; + /* handle for device - and atpx */ + acpi_handle dhandle; + struct radeon_atpx atpx; +@@ -198,7 +199,11 @@ static int radeon_atpx_validate(struct radeon_atpx *atpx) + atpx->is_hybrid = false; + if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) { + printk("ATPX Hybrid Graphics\n"); +- atpx->functions.power_cntl = false; ++ /* ++ * Disable legacy PM methods only when pcie port PM is usable, ++ * otherwise the device might fail to power off or power on. ++ */ ++ atpx->functions.power_cntl = !radeon_atpx_priv.bridge_pm_usable; + atpx->is_hybrid = true; + } + +@@ -543,11 +548,16 @@ static bool radeon_atpx_detect(void) + struct pci_dev *pdev = NULL; + bool has_atpx = false; + int vga_count = 0; ++ bool d3_supported = false; ++ struct pci_dev *parent_pdev; + + while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) { + vga_count++; + + has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true); ++ ++ parent_pdev = pci_upstream_bridge(pdev); ++ d3_supported |= parent_pdev && parent_pdev->bridge_d3; + } + + /* some newer PX laptops mark the dGPU as a non-VGA display device */ +@@ -555,6 +565,9 @@ static bool radeon_atpx_detect(void) + vga_count++; + + has_atpx |= (radeon_atpx_pci_probe_handle(pdev) == true); ++ ++ parent_pdev = pci_upstream_bridge(pdev); ++ d3_supported |= parent_pdev && parent_pdev->bridge_d3; + } + + if (has_atpx && vga_count == 2) { +@@ -562,6 +575,7 @@ static bool radeon_atpx_detect(void) + printk(KERN_INFO "vga_switcheroo: detected switching method %s handle\n", + acpi_method_name); + radeon_atpx_priv.atpx_detected = true; ++ radeon_atpx_priv.bridge_pm_usable = d3_supported; + radeon_atpx_init(); + return true; + } +diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c +index 5784e20..9f6203c 100644 +--- a/drivers/input/mouse/psmouse-base.c ++++ b/drivers/input/mouse/psmouse-base.c +@@ -1115,10 +1115,6 @@ static int psmouse_extensions(struct psmouse *psmouse, + if (psmouse_try_protocol(psmouse, PSMOUSE_TOUCHKIT_PS2, + &max_proto, set_properties, true)) + return PSMOUSE_TOUCHKIT_PS2; +- +- if (psmouse_try_protocol(psmouse, PSMOUSE_BYD, +- &max_proto, set_properties, true)) +- return PSMOUSE_BYD; + } + + /* +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index a8ff969..cbc7dfa 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -2203,8 +2203,9 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, + is_scanning_required = 1; + } else { + mwifiex_dbg(priv->adapter, MSG, +- "info: trying to associate to '%s' bssid %pM\n", +- (char *)req_ssid.ssid, bss->bssid); ++ "info: trying to associate to '%.*s' bssid %pM\n", ++ req_ssid.ssid_len, (char *)req_ssid.ssid, ++ bss->bssid); + memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN); + break; + } +@@ -2264,8 +2265,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev, + } + + mwifiex_dbg(adapter, INFO, +- "info: Trying to associate to %s and bssid %pM\n", +- (char *)sme->ssid, sme->bssid); ++ "info: Trying to associate to %.*s and bssid %pM\n", ++ (int)sme->ssid_len, (char *)sme->ssid, sme->bssid); + + if (!mwifiex_stop_bg_scan(priv)) + cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy); +@@ -2398,8 +2399,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev, + } + + mwifiex_dbg(priv->adapter, MSG, +- "info: trying to join to %s and bssid %pM\n", +- (char *)params->ssid, params->bssid); ++ "info: trying to join to %.*s and bssid %pM\n", ++ params->ssid_len, (char *)params->ssid, params->bssid); + + mwifiex_set_ibss_params(priv, params); + +diff --git a/drivers/pci/pcie/aer/aer_inject.c b/drivers/pci/pcie/aer/aer_inject.c +index db553dc..2b6a592 100644 +--- a/drivers/pci/pcie/aer/aer_inject.c ++++ b/drivers/pci/pcie/aer/aer_inject.c +@@ -307,20 +307,6 @@ static int pci_bus_set_aer_ops(struct pci_bus *bus) + return 0; + } + +-static struct pci_dev *pcie_find_root_port(struct pci_dev *dev) +-{ +- while (1) { +- if (!pci_is_pcie(dev)) +- break; +- if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) +- return dev; +- if (!dev->bus->self) +- break; +- dev = dev->bus->self; +- } +- return NULL; +-} +- + static int find_aer_device_iter(struct device *device, void *data) + { + struct pcie_device **result = data; +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 93f280d..f6eff4a 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1439,6 +1439,21 @@ static void program_hpp_type1(struct pci_dev *dev, struct hpp_type1 *hpp) + dev_warn(&dev->dev, "PCI-X settings not supported\n"); + } + ++static bool pcie_root_rcb_set(struct pci_dev *dev) ++{ ++ struct pci_dev *rp = pcie_find_root_port(dev); ++ u16 lnkctl; ++ ++ if (!rp) ++ return false; ++ ++ pcie_capability_read_word(rp, PCI_EXP_LNKCTL, &lnkctl); ++ if (lnkctl & PCI_EXP_LNKCTL_RCB) ++ return true; ++ ++ return false; ++} ++ + static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp) + { + int pos; +@@ -1468,9 +1483,20 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp) + ~hpp->pci_exp_devctl_and, hpp->pci_exp_devctl_or); + + /* Initialize Link Control Register */ +- if (pcie_cap_has_lnkctl(dev)) ++ if (pcie_cap_has_lnkctl(dev)) { ++ ++ /* ++ * If the Root Port supports Read Completion Boundary of ++ * 128, set RCB to 128. Otherwise, clear it. ++ */ ++ hpp->pci_exp_lnkctl_and |= PCI_EXP_LNKCTL_RCB; ++ hpp->pci_exp_lnkctl_or &= ~PCI_EXP_LNKCTL_RCB; ++ if (pcie_root_rcb_set(dev)) ++ hpp->pci_exp_lnkctl_or |= PCI_EXP_LNKCTL_RCB; ++ + pcie_capability_clear_and_set_word(dev, PCI_EXP_LNKCTL, + ~hpp->pci_exp_lnkctl_and, hpp->pci_exp_lnkctl_or); ++ } + + /* Find Advanced Error Reporting Enhanced Capability */ + pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR); +diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c +index 0296d81..a813239 100644 +--- a/drivers/pwm/sysfs.c ++++ b/drivers/pwm/sysfs.c +@@ -425,6 +425,8 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip) + if (test_bit(PWMF_EXPORTED, &pwm->flags)) + pwm_unexport_child(parent, pwm); + } ++ ++ put_device(parent); + } + + static int __init pwm_sysfs_init(void) +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 030d002..5138a84 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -2007,7 +2007,7 @@ static struct hpsa_scsi_dev_t *lookup_hpsa_scsi_dev(struct ctlr_info *h, + + static int hpsa_slave_alloc(struct scsi_device *sdev) + { +- struct hpsa_scsi_dev_t *sd; ++ struct hpsa_scsi_dev_t *sd = NULL; + unsigned long flags; + struct ctlr_info *h; + +@@ -2024,7 +2024,8 @@ static int hpsa_slave_alloc(struct scsi_device *sdev) + sd->target = sdev_id(sdev); + sd->lun = sdev->lun; + } +- } else ++ } ++ if (!sd) + sd = lookup_hpsa_scsi_dev(h, sdev_channel(sdev), + sdev_id(sdev), sdev->lun); + +@@ -3805,6 +3806,7 @@ static int hpsa_update_device_info(struct ctlr_info *h, + sizeof(this_device->vendor)); + memcpy(this_device->model, &inq_buff[16], + sizeof(this_device->model)); ++ this_device->rev = inq_buff[2]; + memset(this_device->device_id, 0, + sizeof(this_device->device_id)); + hpsa_get_device_id(h, scsi3addr, this_device->device_id, 8, +@@ -3887,10 +3889,14 @@ static void figure_bus_target_lun(struct ctlr_info *h, + + if (!is_logical_dev_addr_mode(lunaddrbytes)) { + /* physical device, target and lun filled in later */ +- if (is_hba_lunid(lunaddrbytes)) ++ if (is_hba_lunid(lunaddrbytes)) { ++ int bus = HPSA_HBA_BUS; ++ ++ if (!device->rev) ++ bus = HPSA_LEGACY_HBA_BUS; + hpsa_set_bus_target_lun(device, +- HPSA_HBA_BUS, 0, lunid & 0x3fff); +- else ++ bus, 0, lunid & 0x3fff); ++ } else + /* defer target, lun assignment for physical devices */ + hpsa_set_bus_target_lun(device, + HPSA_PHYSICAL_DEVICE_BUS, -1, -1); +diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h +index a1487e6..9d45dde 100644 +--- a/drivers/scsi/hpsa.h ++++ b/drivers/scsi/hpsa.h +@@ -69,6 +69,7 @@ struct hpsa_scsi_dev_t { + u64 sas_address; + unsigned char vendor[8]; /* bytes 8-15 of inquiry data */ + unsigned char model[16]; /* bytes 16-31 of inquiry data */ ++ unsigned char rev; /* byte 2 of inquiry data */ + unsigned char raid_level; /* from inquiry page 0xC1 */ + unsigned char volume_offline; /* discovered via TUR or VPD */ + u16 queue_depth; /* max queue_depth for this device */ +@@ -403,6 +404,7 @@ struct offline_device_entry { + #define HPSA_RAID_VOLUME_BUS 1 + #define HPSA_EXTERNAL_RAID_VOLUME_BUS 2 + #define HPSA_HBA_BUS 0 ++#define HPSA_LEGACY_HBA_BUS 3 + + /* + Send the command to the hardware +diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c +index 04ce7cf..50c7167 100644 +--- a/drivers/scsi/libfc/fc_lport.c ++++ b/drivers/scsi/libfc/fc_lport.c +@@ -308,7 +308,7 @@ struct fc_host_statistics *fc_get_host_stats(struct Scsi_Host *shost) + fc_stats = &lport->host_stats; + memset(fc_stats, 0, sizeof(struct fc_host_statistics)); + +- fc_stats->seconds_since_last_reset = (lport->boot_time - jiffies) / HZ; ++ fc_stats->seconds_since_last_reset = (jiffies - lport->boot_time) / HZ; + + for_each_possible_cpu(cpu) { + struct fc_stats *stats; +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index a78415d..78be4ae 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -329,11 +329,11 @@ static struct dentry *ovl_d_real(struct dentry *dentry, + if (!real) + goto bug; + ++ /* Handle recursion */ ++ real = d_real(real, inode, open_flags); ++ + if (!inode || inode == d_inode(real)) + return real; +- +- /* Handle recursion */ +- return d_real(real, inode, open_flags); + bug: + WARN(1, "ovl_d_real(%pd4, %s:%lu): real dentry not found\n", dentry, + inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0); +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 573c5a1..0a0b2d5 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -256,7 +256,9 @@ + #endif + #endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP && !__CHECKER__ */ + +-#if GCC_VERSION >= 50000 ++#if GCC_VERSION >= 70000 ++#define KASAN_ABI_VERSION 5 ++#elif GCC_VERSION >= 50000 + #define KASAN_ABI_VERSION 4 + #elif GCC_VERSION >= 40902 + #define KASAN_ABI_VERSION 3 +diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h +index 01e8443..d47cc4a 100644 +--- a/include/linux/pagemap.h ++++ b/include/linux/pagemap.h +@@ -364,16 +364,13 @@ static inline struct page *read_mapping_page(struct address_space *mapping, + } + + /* +- * Get the offset in PAGE_SIZE. +- * (TODO: hugepage should have ->index in PAGE_SIZE) ++ * Get index of the page with in radix-tree ++ * (TODO: remove once hugetlb pages will have ->index in PAGE_SIZE) + */ +-static inline pgoff_t page_to_pgoff(struct page *page) ++static inline pgoff_t page_to_index(struct page *page) + { + pgoff_t pgoff; + +- if (unlikely(PageHeadHuge(page))) +- return page->index << compound_order(page); +- + if (likely(!PageTransTail(page))) + return page->index; + +@@ -387,6 +384,18 @@ static inline pgoff_t page_to_pgoff(struct page *page) + } + + /* ++ * Get the offset in PAGE_SIZE. ++ * (TODO: hugepage should have ->index in PAGE_SIZE) ++ */ ++static inline pgoff_t page_to_pgoff(struct page *page) ++{ ++ if (unlikely(PageHeadHuge(page))) ++ return page->index << compound_order(page); ++ ++ return page_to_index(page); ++} ++ ++/* + * Return byte-offset into filesystem object for page. + */ + static inline loff_t page_offset(struct page *page) +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 0ab8359..03f3df0 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1896,6 +1896,20 @@ static inline int pci_pcie_type(const struct pci_dev *dev) + return (pcie_caps_reg(dev) & PCI_EXP_FLAGS_TYPE) >> 4; + } + ++static inline struct pci_dev *pcie_find_root_port(struct pci_dev *dev) ++{ ++ while (1) { ++ if (!pci_is_pcie(dev)) ++ break; ++ if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) ++ return dev; ++ if (!dev->bus->self) ++ break; ++ dev = dev->bus->self; ++ } ++ return NULL; ++} ++ + void pci_request_acs(void); + bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags); + bool pci_acs_path_enabled(struct pci_dev *start, +diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h +index d6d071f..3af60ee 100644 +--- a/include/uapi/linux/input-event-codes.h ++++ b/include/uapi/linux/input-event-codes.h +@@ -640,7 +640,7 @@ + * Control a data application associated with the currently viewed channel, + * e.g. teletext or data broadcast application (MHEG, MHP, HbbTV, etc.) + */ +-#define KEY_DATA 0x275 ++#define KEY_DATA 0x277 + + #define BTN_TRIGGER_HAPPY 0x2c0 + #define BTN_TRIGGER_HAPPY1 0x2c0 +diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h +index 0082fce..85c5a88 100644 +--- a/kernel/rcu/tree_plugin.h ++++ b/kernel/rcu/tree_plugin.h +@@ -2173,6 +2173,7 @@ static int rcu_nocb_kthread(void *arg) + cl++; + c++; + local_bh_enable(); ++ cond_resched_rcu_qs(); + list = next; + } + trace_rcu_batch_end(rdp->rsp->name, c, !!list, 0, 0, 1); +diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h +index e5c2181f..03f4545 100644 +--- a/mm/kasan/kasan.h ++++ b/mm/kasan/kasan.h +@@ -53,6 +53,9 @@ struct kasan_global { + #if KASAN_ABI_VERSION >= 4 + struct kasan_source_location *location; + #endif ++#if KASAN_ABI_VERSION >= 5 ++ char *odr_indicator; ++#endif + }; + + /** +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 728d779..87e1a7ca 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -103,6 +103,7 @@ static struct khugepaged_scan khugepaged_scan = { + .mm_head = LIST_HEAD_INIT(khugepaged_scan.mm_head), + }; + ++#ifdef CONFIG_SYSFS + static ssize_t scan_sleep_millisecs_show(struct kobject *kobj, + struct kobj_attribute *attr, + char *buf) +@@ -295,6 +296,7 @@ struct attribute_group khugepaged_attr_group = { + .attrs = khugepaged_attr, + .name = "khugepaged", + }; ++#endif /* CONFIG_SYSFS */ + + #define VM_NO_KHUGEPAGED (VM_SPECIAL | VM_HUGETLB) + +diff --git a/mm/mlock.c b/mm/mlock.c +index 14645be..9c91acc 100644 +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -190,10 +190,13 @@ unsigned int munlock_vma_page(struct page *page) + */ + spin_lock_irq(zone_lru_lock(zone)); + +- nr_pages = hpage_nr_pages(page); +- if (!TestClearPageMlocked(page)) ++ if (!TestClearPageMlocked(page)) { ++ /* Potentially, PTE-mapped THP: do not skip the rest PTEs */ ++ nr_pages = 1; + goto unlock_out; ++ } + ++ nr_pages = hpage_nr_pages(page); + __mod_zone_page_state(zone, NR_MLOCK, -nr_pages); + + if (__munlock_isolate_lru_page(page, true)) { +diff --git a/mm/truncate.c b/mm/truncate.c +index a01cce4..8d8c62d 100644 +--- a/mm/truncate.c ++++ b/mm/truncate.c +@@ -283,7 +283,7 @@ void truncate_inode_pages_range(struct address_space *mapping, + + if (!trylock_page(page)) + continue; +- WARN_ON(page_to_pgoff(page) != index); ++ WARN_ON(page_to_index(page) != index); + if (PageWriteback(page)) { + unlock_page(page); + continue; +@@ -371,7 +371,7 @@ void truncate_inode_pages_range(struct address_space *mapping, + } + + lock_page(page); +- WARN_ON(page_to_pgoff(page) != index); ++ WARN_ON(page_to_index(page) != index); + wait_on_page_writeback(page); + truncate_inode_page(mapping, page); + unlock_page(page); +@@ -492,7 +492,7 @@ unsigned long invalidate_mapping_pages(struct address_space *mapping, + if (!trylock_page(page)) + continue; + +- WARN_ON(page_to_pgoff(page) != index); ++ WARN_ON(page_to_index(page) != index); + + /* Middle of THP: skip */ + if (PageTransTail(page)) { +@@ -612,7 +612,7 @@ int invalidate_inode_pages2_range(struct address_space *mapping, + } + + lock_page(page); +- WARN_ON(page_to_pgoff(page) != index); ++ WARN_ON(page_to_index(page) != index); + if (page->mapping != mapping) { + unlock_page(page); + continue; +diff --git a/mm/workingset.c b/mm/workingset.c +index 617475f..fb1f918 100644 +--- a/mm/workingset.c ++++ b/mm/workingset.c +@@ -348,7 +348,7 @@ static unsigned long count_shadow_nodes(struct shrinker *shrinker, + shadow_nodes = list_lru_shrink_count(&workingset_shadow_nodes, sc); + local_irq_enable(); + +- if (memcg_kmem_enabled()) { ++ if (sc->memcg) { + pages = mem_cgroup_node_nr_lru_pages(sc->memcg, sc->nid, + LRU_ALL_FILE); + } else { +diff --git a/net/batman-adv/tp_meter.c b/net/batman-adv/tp_meter.c +index 2333777..8af1611 100644 +--- a/net/batman-adv/tp_meter.c ++++ b/net/batman-adv/tp_meter.c +@@ -837,6 +837,7 @@ static int batadv_tp_send(void *arg) + primary_if = batadv_primary_if_get_selected(bat_priv); + if (unlikely(!primary_if)) { + err = BATADV_TP_REASON_DST_UNREACHABLE; ++ tp_vars->reason = err; + goto out; + } + +diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c +index 0bf6709..6fb4314 100644 +--- a/virt/kvm/arm/vgic/vgic-v2.c ++++ b/virt/kvm/arm/vgic/vgic-v2.c +@@ -50,8 +50,10 @@ void vgic_v2_process_maintenance(struct kvm_vcpu *vcpu) + + WARN_ON(cpuif->vgic_lr[lr] & GICH_LR_STATE); + +- kvm_notify_acked_irq(vcpu->kvm, 0, +- intid - VGIC_NR_PRIVATE_IRQS); ++ /* Only SPIs require notification */ ++ if (vgic_valid_spi(vcpu->kvm, intid)) ++ kvm_notify_acked_irq(vcpu->kvm, 0, ++ intid - VGIC_NR_PRIVATE_IRQS); + } + } + +diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c +index 9f0dae3..5c9f974 100644 +--- a/virt/kvm/arm/vgic/vgic-v3.c ++++ b/virt/kvm/arm/vgic/vgic-v3.c +@@ -41,8 +41,10 @@ void vgic_v3_process_maintenance(struct kvm_vcpu *vcpu) + + WARN_ON(cpuif->vgic_lr[lr] & ICH_LR_STATE); + +- kvm_notify_acked_irq(vcpu->kvm, 0, +- intid - VGIC_NR_PRIVATE_IRQS); ++ /* Only SPIs require notification */ ++ if (vgic_valid_spi(vcpu->kvm, intid)) ++ kvm_notify_acked_irq(vcpu->kvm, 0, ++ intid - VGIC_NR_PRIVATE_IRQS); + } + + /* +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 1950782..690d15e 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -2852,10 +2852,10 @@ static int kvm_ioctl_create_device(struct kvm *kvm, + + ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC); + if (ret < 0) { +- ops->destroy(dev); + mutex_lock(&kvm->lock); + list_del(&dev->vm_node); + mutex_unlock(&kvm->lock); ++ ops->destroy(dev); + return ret; + } + diff --git a/4.8.12/4420_grsecurity-3.1-4.8.12-201612062306.patch b/4.8.13/4420_grsecurity-3.1-4.8.13-201612082118.patch index 5929283..a2b5f41 100644 --- a/4.8.12/4420_grsecurity-3.1-4.8.12-201612062306.patch +++ b/4.8.13/4420_grsecurity-3.1-4.8.13-201612082118.patch @@ -407,7 +407,7 @@ index ffab8b5..b8fcd61 100644 A toggle value indicating if modules are allowed to be loaded diff --git a/Makefile b/Makefile -index 7b0c92f..8fa3c72 100644 +index b38abe9..edadcba 100644 --- a/Makefile +++ b/Makefile @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -5301,10 +5301,10 @@ index 37e47a9..f8597fc 100644 } #endif diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c -index 6cd2612..56d72e5c 100644 +index 9cc8667..5edbcff 100644 --- a/arch/arm64/kernel/process.c +++ b/arch/arm64/kernel/process.c -@@ -63,7 +63,7 @@ EXPORT_SYMBOL(__stack_chk_guard); +@@ -64,7 +64,7 @@ EXPORT_SYMBOL(__stack_chk_guard); /* * Function pointers to optional machine specific functions */ @@ -5313,7 +5313,7 @@ index 6cd2612..56d72e5c 100644 EXPORT_SYMBOL_GPL(pm_power_off); void (*arm_pm_restart)(enum reboot_mode reboot_mode, const char *cmd); -@@ -109,7 +109,7 @@ void machine_shutdown(void) +@@ -110,7 +110,7 @@ void machine_shutdown(void) * activity (executing tasks, handling interrupts). smp_send_stop() * achieves this. */ @@ -5322,7 +5322,7 @@ index 6cd2612..56d72e5c 100644 { local_irq_disable(); smp_send_stop(); -@@ -122,12 +122,13 @@ void machine_halt(void) +@@ -123,12 +123,13 @@ void machine_halt(void) * achieves this. When the system power is turned off, it will take all CPUs * with it. */ @@ -5337,7 +5337,7 @@ index 6cd2612..56d72e5c 100644 } /* -@@ -139,7 +140,7 @@ void machine_power_off(void) +@@ -140,7 +141,7 @@ void machine_power_off(void) * executing pre-reset code, and using RAM that the primary CPU's code wishes * to use. Implementing such co-ordination would be essentially impossible. */ @@ -5362,10 +5362,10 @@ index d34fd72..8b6faee 100644 /* orig_sp is the saved pt_regs, find the elr */ diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c -index 771a01a7f..db6d9cc 100644 +index 9595d3d..7ee5abb 100644 --- a/arch/arm64/kernel/traps.c +++ b/arch/arm64/kernel/traps.c -@@ -511,7 +511,7 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs) +@@ -512,7 +512,7 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs) __show_regs(regs); } @@ -19051,7 +19051,7 @@ index b28200d..e93e14d 100644 while (amd_iommu_v2_event_descs[i].attr.attr.name) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c -index d0efb5c..10f0a95 100644 +index a4e070a..6804f87 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -1545,7 +1545,7 @@ static void __init pmu_check_apic(void) @@ -19081,7 +19081,7 @@ index d0efb5c..10f0a95 100644 } return get_desc_base(desc); -@@ -2419,7 +2419,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs +@@ -2413,7 +2413,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs break; perf_callchain_store(entry, frame.return_address); @@ -41996,7 +41996,7 @@ index 223a770..295a507 100644 } diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index e207b33..145ebf0 100644 +index 1e007a9..67c25db 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -4689,7 +4689,7 @@ int ata_sas_port_init(struct ata_port *ap) @@ -46692,10 +46692,10 @@ index e443073..2ce0ad5 100644 int (*request_smu_specific_fw)(struct amdgpu_device *adev, uint32_t fwtype); }; diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c -index 10b5ddf..ed2f78d 100644 +index 1ed085f..76d5db1 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c -@@ -519,7 +519,7 @@ static int amdgpu_atpx_init(void) +@@ -524,7 +524,7 @@ static int amdgpu_atpx_init(void) * look up whether we are the integrated or discrete GPU (all asics). * Returns the client id. */ @@ -48649,10 +48649,10 @@ index 1c2aec3..f807515 100644 /** diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index e26f889..5d197b7 100644 +index 35d385d..7ed8f57 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c -@@ -15592,13 +15592,13 @@ struct intel_quirk { +@@ -15593,13 +15593,13 @@ struct intel_quirk { int subsystem_vendor; int subsystem_device; void (*hook)(struct drm_device *dev); @@ -48669,7 +48669,7 @@ index e26f889..5d197b7 100644 static int intel_dmi_reverse_brightness(const struct dmi_system_id *id) { -@@ -15606,18 +15606,20 @@ static int intel_dmi_reverse_brightness(const struct dmi_system_id *id) +@@ -15607,18 +15607,20 @@ static int intel_dmi_reverse_brightness(const struct dmi_system_id *id) return 1; } @@ -48700,7 +48700,7 @@ index e26f889..5d197b7 100644 .hook = quirk_invert_brightness, }, }; -@@ -15700,7 +15702,7 @@ static void intel_init_quirks(struct drm_device *dev) +@@ -15701,7 +15703,7 @@ static void intel_init_quirks(struct drm_device *dev) q->hook(dev); } for (i = 0; i < ARRAY_SIZE(intel_dmi_quirks); i++) { @@ -49638,10 +49638,10 @@ index b928c17..e5d9400 100644 if (regcomp (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) { diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c -index ddef0d4..c4f3351 100644 +index 34b4ace..2f6e0e6 100644 --- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c +++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c -@@ -516,7 +516,7 @@ static int radeon_atpx_init(void) +@@ -521,7 +521,7 @@ static int radeon_atpx_init(void) * look up whether we are the integrated or discrete GPU (all asics). * Returns the client id. */ @@ -50932,7 +50932,7 @@ index 56dd261..493d7e0 100644 packetlen_aligned = ALIGN(packetlen, sizeof(u64)); diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c -index a1c086b..b45a999 100644 +index a1c086b..b205fcb 100644 --- a/drivers/hv/hv.c +++ b/drivers/hv/hv.c @@ -183,6 +183,7 @@ static struct clocksource hyperv_cs_tsc = { @@ -50963,7 +50963,7 @@ index a1c086b..b45a999 100644 hypercall_msr.enable = 1; - hypercall_msr.guest_physical_address = vmalloc_to_pfn(virtaddr); -+ hypercall_msr.guest_physical_address = __phys_to_pfn(__pa(ktla_ktva((unsigned long)hv_hypercall_page))); ++ hypercall_msr.guest_physical_address = __phys_to_pfn(slow_virt_to_phys((ktla_ktva((unsigned long)hv_hypercall_page)))); wrmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64); /* Confirm that hypercall page did get setup. */ @@ -71550,7 +71550,7 @@ index 70d7ad8..66f87d6 100644 * Boxes that should not use MSI for PCIe PME signaling. */ diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index 93f280d..a349035 100644 +index f6eff4a..9ef8afb 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -180,7 +180,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, @@ -74473,7 +74473,7 @@ index 7028dd3..7392dc6 100644 int rc = -ENODEV; struct net_device *netdev = NULL; diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index 030d002..cbf90d1 100644 +index 5138a84..de71237 100644 --- a/drivers/scsi/hpsa.c +++ b/drivers/scsi/hpsa.c @@ -942,10 +942,10 @@ static inline u32 next_command(struct ctlr_info *h, u8 q) @@ -74498,7 +74498,7 @@ index 030d002..cbf90d1 100644 } } -@@ -7020,17 +7020,17 @@ static void __iomem *remap_pci_mem(ulong base, ulong size) +@@ -7026,17 +7026,17 @@ static void __iomem *remap_pci_mem(ulong base, ulong size) static inline unsigned long get_next_completion(struct ctlr_info *h, u8 q) { @@ -74519,7 +74519,7 @@ index 030d002..cbf90d1 100644 (h->interrupts_enabled == 0); } -@@ -7958,7 +7958,7 @@ static int hpsa_pci_init(struct ctlr_info *h) +@@ -7964,7 +7964,7 @@ static int hpsa_pci_init(struct ctlr_info *h) if (prod_index < 0) return prod_index; h->product_name = products[prod_index].product_name; @@ -74528,7 +74528,7 @@ index 030d002..cbf90d1 100644 h->needs_abort_tags_swizzled = ctlr_needs_abort_tags_swizzled(h->board_id); -@@ -8357,7 +8357,7 @@ static void controller_lockup_detected(struct ctlr_info *h) +@@ -8363,7 +8363,7 @@ static void controller_lockup_detected(struct ctlr_info *h) unsigned long flags; u32 lockup_detected; @@ -74537,7 +74537,7 @@ index 030d002..cbf90d1 100644 spin_lock_irqsave(&h->lock, flags); lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET); if (!lockup_detected) { -@@ -8695,7 +8695,7 @@ reinit_after_soft_reset: +@@ -8701,7 +8701,7 @@ reinit_after_soft_reset: } /* make sure the board interrupts are off */ @@ -74546,7 +74546,7 @@ index 030d002..cbf90d1 100644 rc = hpsa_request_irqs(h, do_hpsa_intr_msi, do_hpsa_intr_intx); if (rc) -@@ -8748,7 +8748,7 @@ reinit_after_soft_reset: +@@ -8754,7 +8754,7 @@ reinit_after_soft_reset: * fake ones to scoop up any residual completions. */ spin_lock_irqsave(&h->lock, flags); @@ -74555,7 +74555,7 @@ index 030d002..cbf90d1 100644 spin_unlock_irqrestore(&h->lock, flags); hpsa_free_irqs(h); rc = hpsa_request_irqs(h, hpsa_msix_discard_completions, -@@ -8778,9 +8778,9 @@ reinit_after_soft_reset: +@@ -8784,9 +8784,9 @@ reinit_after_soft_reset: dev_info(&h->pdev->dev, "Board READY.\n"); dev_info(&h->pdev->dev, "Waiting for stale completions to drain.\n"); @@ -74567,7 +74567,7 @@ index 030d002..cbf90d1 100644 rc = controller_reset_failed(h->cfgtable); if (rc) -@@ -8807,7 +8807,7 @@ reinit_after_soft_reset: +@@ -8813,7 +8813,7 @@ reinit_after_soft_reset: /* Turn the interrupts on so we can service requests */ @@ -74576,7 +74576,7 @@ index 030d002..cbf90d1 100644 hpsa_hba_inquiry(h); -@@ -8833,7 +8833,7 @@ reinit_after_soft_reset: +@@ -8839,7 +8839,7 @@ reinit_after_soft_reset: clean7: /* perf, sg, cmd, irq, shost, pci, lu, aer/h */ hpsa_free_performant_mode(h); @@ -74585,7 +74585,7 @@ index 030d002..cbf90d1 100644 clean6: /* sg, cmd, irq, pci, lockup, wq/aer/h */ hpsa_free_sg_chain_blocks(h); clean5: /* cmd, irq, shost, pci, lu, aer/h */ -@@ -8968,7 +8968,7 @@ static void hpsa_shutdown(struct pci_dev *pdev) +@@ -8974,7 +8974,7 @@ static void hpsa_shutdown(struct pci_dev *pdev) * To write all data in the battery backed cache to disks */ hpsa_flush_cache(h); @@ -74594,7 +74594,7 @@ index 030d002..cbf90d1 100644 hpsa_free_irqs(h); /* init_one 4 */ hpsa_disable_interrupt_mode(h); /* pci_init 2 */ } -@@ -9110,7 +9110,7 @@ static int hpsa_enter_performant_mode(struct ctlr_info *h, u32 trans_support) +@@ -9116,7 +9116,7 @@ static int hpsa_enter_performant_mode(struct ctlr_info *h, u32 trans_support) CFGTBL_Trans_enable_directed_msix | (trans_support & (CFGTBL_Trans_io_accel1 | CFGTBL_Trans_io_accel2)); @@ -74603,7 +74603,7 @@ index 030d002..cbf90d1 100644 /* This is a bit complicated. There are 8 registers on * the controller which we write to to tell it 8 different -@@ -9152,7 +9152,7 @@ static int hpsa_enter_performant_mode(struct ctlr_info *h, u32 trans_support) +@@ -9158,7 +9158,7 @@ static int hpsa_enter_performant_mode(struct ctlr_info *h, u32 trans_support) * perform the superfluous readl() after each command submission. */ if (trans_support & (CFGTBL_Trans_io_accel1 | CFGTBL_Trans_io_accel2)) @@ -74612,7 +74612,7 @@ index 030d002..cbf90d1 100644 /* Controller spec: zero out this buffer. */ for (i = 0; i < h->nreply_queues; i++) -@@ -9182,12 +9182,12 @@ static int hpsa_enter_performant_mode(struct ctlr_info *h, u32 trans_support) +@@ -9188,12 +9188,12 @@ static int hpsa_enter_performant_mode(struct ctlr_info *h, u32 trans_support) * enable outbound interrupt coalescing in accelerator mode; */ if (trans_support & CFGTBL_Trans_io_accel1) { @@ -74628,10 +74628,10 @@ index 030d002..cbf90d1 100644 writel(4, &h->cfgtable->HostWrite.CoalIntCount); } diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h -index a1487e6..53a2c5d 100644 +index 9d45dde..622095a 100644 --- a/drivers/scsi/hpsa.h +++ b/drivers/scsi/hpsa.h -@@ -179,7 +179,7 @@ struct ctlr_info { +@@ -180,7 +180,7 @@ struct ctlr_info { unsigned int msix_vector; unsigned int msi_vector; int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */ @@ -74640,7 +74640,7 @@ index a1487e6..53a2c5d 100644 /* queue and queue Info */ unsigned int Qdepth; -@@ -579,38 +579,38 @@ static unsigned long SA5_ioaccel_mode1_completed(struct ctlr_info *h, u8 q) +@@ -581,38 +581,38 @@ static unsigned long SA5_ioaccel_mode1_completed(struct ctlr_info *h, u8 q) } static struct access_method SA5_access = { @@ -116847,7 +116847,7 @@ index 767377e..2e4b2e8 100644 if (res < 0) { free_page((unsigned long) buf); diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index a78415d..557e8db 100644 +index 78be4ae..37a3935 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -148,8 +148,8 @@ struct dentry *ovl_dentry_real(struct dentry *dentry) @@ -133305,7 +133305,7 @@ index f964ef7..0679632 100644 asmlinkage long compat_sys_lookup_dcookie(u32, u32, char __user *, compat_size_t); /* diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h -index 573c5a1..b902c3f 100644 +index 0a0b2d5..3ae2773 100644 --- a/include/linux/compiler-gcc.h +++ b/include/linux/compiler-gcc.h @@ -116,9 +116,9 @@ @@ -137705,7 +137705,7 @@ index 113ee62..70198a7 100644 spinlock_t lock ____cacheline_aligned; unsigned int processed; diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h -index 01e8443..3a4d158 100644 +index d47cc4a..e1c3886 100644 --- a/include/linux/pagemap.h +++ b/include/linux/pagemap.h @@ -215,7 +215,7 @@ static inline gfp_t readahead_gfp_mask(struct address_space *x) @@ -147795,7 +147795,7 @@ index 6d86ab6..7046dff 100644 } mask_ofl_ipi = rnp->expmask & ~mask_ofl_test; diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h -index 0082fce..29572cb 100644 +index 85c5a88..4479872 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -1174,7 +1174,7 @@ static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu) @@ -147816,7 +147816,7 @@ index 0082fce..29572cb 100644 rdtp->dynticks_nesting, rdtp->dynticks_nmi_nesting, rdp->softirq_snap, kstat_softirqs_cpu(RCU_SOFTIRQ, cpu), READ_ONCE(rsp->n_force_qs) - rsp->n_force_qs_gpstart, -@@ -2177,8 +2177,8 @@ static int rcu_nocb_kthread(void *arg) +@@ -2178,8 +2178,8 @@ static int rcu_nocb_kthread(void *arg) } trace_rcu_batch_end(rdp->rsp->name, c, !!list, 0, 0, 1); smp_mb__before_atomic(); /* _add after CB invocation. */ @@ -147827,7 +147827,7 @@ index 0082fce..29572cb 100644 rdp->n_nocbs_invoked += c; } return 0; -@@ -2533,9 +2533,9 @@ static void rcu_sysidle_enter(int irq) +@@ -2534,9 +2534,9 @@ static void rcu_sysidle_enter(int irq) j = jiffies; WRITE_ONCE(rdtp->dynticks_idle_jiffies, j); smp_mb__before_atomic(); @@ -147839,7 +147839,7 @@ index 0082fce..29572cb 100644 } /* -@@ -2606,9 +2606,9 @@ static void rcu_sysidle_exit(int irq) +@@ -2607,9 +2607,9 @@ static void rcu_sysidle_exit(int irq) /* Record end of idle period. */ smp_mb__before_atomic(); @@ -147851,7 +147851,7 @@ index 0082fce..29572cb 100644 /* * If we are the timekeeping CPU, we are permitted to be non-idle -@@ -2654,7 +2654,7 @@ static void rcu_sysidle_check_cpu(struct rcu_data *rdp, bool *isidle, +@@ -2655,7 +2655,7 @@ static void rcu_sysidle_check_cpu(struct rcu_data *rdp, bool *isidle, WARN_ON_ONCE(smp_processor_id() != tick_do_timer_cpu); /* Pick up current idle and NMI-nesting counter and check. */ @@ -153452,7 +153452,7 @@ index f7ee04a..41da9dc 100644 err = -EPERM; goto out; diff --git a/mm/mlock.c b/mm/mlock.c -index 14645be..e2c7aa1 100644 +index 9c91acc..d377a3b 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -14,6 +14,7 @@ @@ -153463,7 +153463,7 @@ index 14645be..e2c7aa1 100644 #include <linux/sched.h> #include <linux/export.h> #include <linux/rmap.h> -@@ -573,7 +574,7 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, +@@ -576,7 +577,7 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, { unsigned long nstart, end, tmp; struct vm_area_struct * vma, * prev; @@ -153472,7 +153472,7 @@ index 14645be..e2c7aa1 100644 VM_BUG_ON(offset_in_page(start)); VM_BUG_ON(len != PAGE_ALIGN(len)); -@@ -582,6 +583,9 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, +@@ -585,6 +586,9 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, return -EINVAL; if (end == start) return 0; @@ -153482,7 +153482,7 @@ index 14645be..e2c7aa1 100644 vma = find_vma(current->mm, start); if (!vma || vma->vm_start > start) return -ENOMEM; -@@ -591,8 +595,14 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, +@@ -594,8 +598,14 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, prev = vma; for (nstart = start ; ; ) { @@ -153498,7 +153498,7 @@ index 14645be..e2c7aa1 100644 newflags |= flags; /* Here we know that vma->vm_start <= nstart < vma->vm_end. */ -@@ -641,6 +651,10 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla +@@ -644,6 +654,10 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla locked += current->mm->locked_vm; /* check against resource limits */ @@ -153509,7 +153509,7 @@ index 14645be..e2c7aa1 100644 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK)) error = apply_vma_lock_flags(start, len, flags); -@@ -722,6 +736,11 @@ static int apply_mlockall_flags(int flags) +@@ -725,6 +739,11 @@ static int apply_mlockall_flags(int flags) for (vma = current->mm->mmap; vma ; vma = prev->vm_next) { vm_flags_t newflags; @@ -153521,7 +153521,7 @@ index 14645be..e2c7aa1 100644 newflags = vma->vm_flags & VM_LOCKED_CLEAR_MASK; newflags |= to_add; -@@ -754,6 +773,10 @@ SYSCALL_DEFINE1(mlockall, int, flags) +@@ -757,6 +776,10 @@ SYSCALL_DEFINE1(mlockall, int, flags) return -EINTR; ret = -ENOMEM; @@ -162014,10 +162014,23 @@ index 37874e2..d5cd498 100644 + atomic_read_unchecked(&sp->sk_drops)); } diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c -index 7370ad2..7002ca8 100644 +index 7370ad2..7bbfa23 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c -@@ -1073,7 +1073,7 @@ static struct ctl_table ipv6_icmp_table_template[] = { +@@ -447,8 +447,10 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, + + if (__ipv6_addr_needs_scope_id(addr_type)) + iif = skb->dev->ifindex; +- else +- iif = l3mdev_master_ifindex(skb_dst(skb)->dev); ++ else { ++ dst = skb_dst(skb); ++ iif = l3mdev_master_ifindex(dst ? dst->dev : skb->dev); ++ } + + /* + * Must not send error if the source does not uniquely +@@ -1073,7 +1075,7 @@ static struct ctl_table ipv6_icmp_table_template[] = { struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net) { @@ -170235,10 +170248,10 @@ index 0000000..7514850 +fi diff --git a/scripts/gcc-plugins/initify_plugin.c b/scripts/gcc-plugins/initify_plugin.c new file mode 100644 -index 0000000..bdd5d64 +index 0000000..46bd9b9 --- /dev/null +++ b/scripts/gcc-plugins/initify_plugin.c -@@ -0,0 +1,1811 @@ +@@ -0,0 +1,1809 @@ +/* + * Copyright 2015-2016 by Emese Revfy <re.emese@gmail.com> + * Licensed under the GPL v2 @@ -170288,7 +170301,7 @@ index 0000000..bdd5d64 +__visible int plugin_is_GPL_compatible; + +static struct plugin_info initify_plugin_info = { -+ .version = "20161115", ++ .version = "20161208", + .help = "disable\tturn off the initify plugin\n" + "verbose\tprint all initified strings and all" + " functions which should be __init/__exit\n" @@ -171715,10 +171728,8 @@ index 0000000..bdd5d64 + arg = chain_index(i, arg_list); + gcc_assert(arg != NULL_TREE); + -+ if (has_capture_use_local_var(arg)) { -+ error("%qE captures its %u (%qD) parameter, please remove it from the nocapture attribute.", current_function_decl, i + 1, arg); -+ gcc_unreachable(); -+ } ++ if (has_capture_use_local_var(arg)) ++ warning(0, "%qE captures its %u (%qD) parameter, please remove it from the nocapture attribute.", current_function_decl, i + 1, arg); + } +} + @@ -171866,10 +171877,10 @@ index 0000000..bdd5d64 + if (!section_name) + return true; + -+ if (!strcmp(section_name, ".ref.text\000")) -+ return true; ++ if (!strcmp(section_name, ".ref.text")) ++ return false; + -+ if (!strcmp(section_name, ".meminit.text\000")) ++ if (!strcmp(section_name, ".meminit.text")) + return false; + + inform(DECL_SOURCE_LOCATION(fndecl), "Section of %qE: %s\n", fndecl, section_name); @@ -221173,7 +221184,7 @@ index 0a578fe..b81f62d 100644 }) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index 1950782..098c717 100644 +index 690d15e..2d4e146 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -93,12 +93,17 @@ LIST_HEAD(vm_list); diff --git a/4.8.12/4425_grsec_remove_EI_PAX.patch b/4.8.13/4425_grsec_remove_EI_PAX.patch index 594598a..594598a 100644 --- a/4.8.12/4425_grsec_remove_EI_PAX.patch +++ b/4.8.13/4425_grsec_remove_EI_PAX.patch diff --git a/4.8.12/4427_force_XATTR_PAX_tmpfs.patch b/4.8.13/4427_force_XATTR_PAX_tmpfs.patch index 2562d2f..2562d2f 100644 --- a/4.8.12/4427_force_XATTR_PAX_tmpfs.patch +++ b/4.8.13/4427_force_XATTR_PAX_tmpfs.patch diff --git a/4.8.12/4430_grsec-remove-localversion-grsec.patch b/4.8.13/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/4.8.12/4430_grsec-remove-localversion-grsec.patch +++ b/4.8.13/4430_grsec-remove-localversion-grsec.patch diff --git a/4.8.12/4435_grsec-mute-warnings.patch b/4.8.13/4435_grsec-mute-warnings.patch index 8929222..8929222 100644 --- a/4.8.12/4435_grsec-mute-warnings.patch +++ b/4.8.13/4435_grsec-mute-warnings.patch diff --git a/4.8.12/4440_grsec-remove-protected-paths.patch b/4.8.13/4440_grsec-remove-protected-paths.patch index 741546d..741546d 100644 --- a/4.8.12/4440_grsec-remove-protected-paths.patch +++ b/4.8.13/4440_grsec-remove-protected-paths.patch diff --git a/4.8.12/4450_grsec-kconfig-default-gids.patch b/4.8.13/4450_grsec-kconfig-default-gids.patch index 6fd0511..6fd0511 100644 --- a/4.8.12/4450_grsec-kconfig-default-gids.patch +++ b/4.8.13/4450_grsec-kconfig-default-gids.patch diff --git a/4.8.12/4465_selinux-avc_audit-log-curr_ip.patch b/4.8.13/4465_selinux-avc_audit-log-curr_ip.patch index 7248385..7248385 100644 --- a/4.8.12/4465_selinux-avc_audit-log-curr_ip.patch +++ b/4.8.13/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/4.8.12/4470_disable-compat_vdso.patch b/4.8.13/4470_disable-compat_vdso.patch index 1e4b84a..1e4b84a 100644 --- a/4.8.12/4470_disable-compat_vdso.patch +++ b/4.8.13/4470_disable-compat_vdso.patch diff --git a/4.8.12/4475_emutramp_default_on.patch b/4.8.13/4475_emutramp_default_on.patch index 7b468ee..7b468ee 100644 --- a/4.8.12/4475_emutramp_default_on.patch +++ b/4.8.13/4475_emutramp_default_on.patch |