diff --git a/Patches/LineageOS-18.1/android_kernel_oneplus_sdm845/4.9.277-qc.patch b/Patches/LineageOS-18.1/android_kernel_oneplus_sdm845/4.9.282-qc+4.9.295-aosp.patch similarity index 76% rename from Patches/LineageOS-18.1/android_kernel_oneplus_sdm845/4.9.277-qc.patch rename to Patches/LineageOS-18.1/android_kernel_oneplus_sdm845/4.9.282-qc+4.9.295-aosp.patch index 35c17c6a..fb5562f4 100644 --- a/Patches/LineageOS-18.1/android_kernel_oneplus_sdm845/4.9.277-qc.patch +++ b/Patches/LineageOS-18.1/android_kernel_oneplus_sdm845/4.9.282-qc+4.9.295-aosp.patch @@ -1,10 +1,12 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Tad -Date: Wed, 20 Oct 2021 22:45:20 -0400 -Subject: [PATCH] Merge remote-tracking branch 'qc/msm-4.9' into HEAD +Date: Wed, 5 Jan 2022 23:45:46 -0500 +Subject: [PATCH] Merge in qc/msm-4.9 and aosp/android-4.9-q + +4.9.227 to 4.9.295 Signed-off-by: Tad -Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 +Change-Id: Iba2aa368279739a0acd367fe199a506c65c24b42 --- Documentation/ABI/testing/sysfs-bus-iio | 3 +- Documentation/DocBook/libata.tmpl | 2 +- @@ -14,16 +16,22 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 .../devicetree/bindings/input/misc/bma2x2.txt | 61 + .../devicetree/bindings/input/misc/ltr553.txt | 67 + .../devicetree/bindings/leds/leds-aw2013.txt | 75 + + .../devicetree/bindings/mtd/gpmc-nand.txt | 2 +- .../devicetree/bindings/net/nfc/nxp-nci.txt | 2 +- .../devicetree/bindings/net/nfc/pn544.txt | 2 +- .../devicetree/bindings/pci/msm_ep_pcie.txt | 1 + + .../bindings/regulator/samsung,s5m8767.txt | 23 +- .../devicetree/bindings/sound/wm8994.txt | 18 +- .../devicetree/bindings/spi/spi_qsd.txt | 8 +- .../devicetree/bindings/vendor-prefixes.txt | 1 + Documentation/filesystems/affs.txt | 16 +- + .../filesystems/mandatory-locking.txt | 10 + Documentation/filesystems/sysfs.txt | 8 +- + Documentation/gpu/drm-client.rst | 15 + + Documentation/gpu/index.rst | 1 + Documentation/kernel-parameters.txt | 15 + .../media/uapi/dvb/fe-get-property.rst | 7 +- + Documentation/networking/bonding.txt | 11 +- Documentation/networking/ip-sysctl.txt | 10 + Documentation/sphinx/parse-headers.pl | 2 +- Documentation/target/tcm_mod_builder.py | 2 +- @@ -32,8 +40,9 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 .../postprocess/trace-vmscan-postprocess.pl | 2 +- Documentation/virtual/kvm/api.txt | 2 + Makefile | 52 +- - arch/alpha/include/asm/io.h | 8 +- + arch/alpha/include/asm/io.h | 14 +- arch/alpha/include/asm/uaccess.h | 67 +- + arch/alpha/kernel/smp.c | 2 +- arch/alpha/lib/Makefile | 33 +- arch/alpha/lib/clear_user.S | 66 +- arch/alpha/lib/copy_user.S | 82 +- @@ -42,17 +51,25 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/arc/Makefile | 1 + arch/arc/include/asm/elf.h | 2 +- arch/arc/include/asm/page.h | 1 + + arch/arc/include/asm/pgtable.h | 2 + arch/arc/kernel/entry.S | 4 +- arch/arc/kernel/signal.c | 4 +- arch/arc/kernel/stacktrace.c | 30 +- + arch/arc/kernel/vmlinux.lds.S | 2 + + arch/arc/mm/cache.c | 2 +- arch/arc/plat-eznps/include/plat/ctop.h | 1 - arch/arm/Kconfig | 9 +- - arch/arm/Makefile | 6 +- + arch/arm/Makefile | 28 +- + arch/arm/boot/bootp/Makefile | 2 +- + arch/arm/boot/compressed/Makefile | 4 +- + arch/arm/boot/compressed/decompress.c | 3 + arch/arm/boot/compressed/head.S | 4 +- arch/arm/boot/dts/am335x-cm-t335.dts | 2 +- + arch/arm/boot/dts/am43x-epos-evm.dts | 2 +- arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 + arch/arm/boot/dts/at91sam9rl.dtsi | 19 +- + arch/arm/boot/dts/bcm5301x.dtsi | 2 + arch/arm/boot/dts/bcm63138.dtsi | 2 +- arch/arm/boot/dts/bcm7445-bcm97445svmb.dts | 4 +- arch/arm/boot/dts/bcm7445.dtsi | 2 +- @@ -70,7 +87,11 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 5 +- arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +- arch/arm/boot/dts/lpc32xx.dtsi | 3 - + arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 2 +- + arch/arm/boot/dts/omap3-gta04.dtsi | 2 +- + .../boot/dts/omap3-overo-tobiduo-common.dtsi | 2 +- arch/arm/boot/dts/omap3.dtsi | 3 + + arch/arm/boot/dts/omap3430-sdp.dts | 2 +- arch/arm/boot/dts/omap4.dtsi | 5 + arch/arm/boot/dts/omap443x.dtsi | 2 + arch/arm/boot/dts/omap5.dtsi | 5 + @@ -91,8 +112,13 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/arm/boot/dts/sama5d4.dtsi | 2 +- arch/arm/boot/dts/socfpga.dtsi | 2 +- arch/arm/boot/dts/socfpga_arria10.dtsi | 4 +- + arch/arm/boot/dts/spear3xx.dtsi | 2 +- + arch/arm/boot/dts/ste-nomadik-stn8815.dtsi | 4 +- arch/arm/boot/dts/stm32f429.dtsi | 2 +- arch/arm/boot/dts/sun4i-a10.dtsi | 2 +- + arch/arm/boot/dts/tegra20-tamonten.dtsi | 14 +- + arch/arm/boot/dts/versatile-ab.dts | 5 +- + arch/arm/boot/dts/versatile-pb.dts | 2 +- arch/arm/configs/msm8909-perf_defconfig | 39 +- arch/arm/configs/msm8909_defconfig | 38 +- arch/arm/configs/msm8937go-perf_defconfig | 75 +- @@ -100,66 +126,94 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/arm/configs/sa415m-perf_defconfig | 1 - arch/arm/configs/sa415m_defconfig | 1 - arch/arm/configs/sdm670-perf_defconfig | 6 + - .../configs/vendor/msm8909go-perf_defconfig | 555 +++++++ - arch/arm/configs/vendor/msm8909go_defconfig | 596 +++++++ + .../configs/vendor/msm8909go-perf_defconfig | 555 +++ + arch/arm/configs/vendor/msm8909go_defconfig | 596 +++ + arch/arm/include/asm/ftrace.h | 3 + + arch/arm/include/asm/insn.h | 8 +- + arch/arm/include/asm/module.h | 10 + arch/arm/include/asm/percpu.h | 2 + + arch/arm/include/asm/pgtable-2level.h | 2 + + arch/arm/include/asm/pgtable-3level.h | 2 + + arch/arm/include/asm/tlb.h | 8 + arch/arm/include/asm/unified.h | 77 +- + arch/arm/kernel/Makefile | 6 +- + arch/arm/kernel/entry-armv.S | 8 +- + arch/arm/kernel/ftrace.c | 45 +- arch/arm/kernel/head.S | 6 +- arch/arm/kernel/hw_breakpoint.c | 123 +- + arch/arm/kernel/insn.c | 19 +- + arch/arm/kernel/module-plts.c | 49 +- arch/arm/kernel/ptrace.c | 4 +- + arch/arm/kernel/return_address.c | 4 - arch/arm/kernel/setup.c | 16 +- - arch/arm/kernel/stacktrace.c | 24 + + arch/arm/kernel/signal.c | 14 +- + arch/arm/kernel/stacktrace.c | 23 + arch/arm/kvm/mmu.c | 8 +- arch/arm/mach-at91/pm.c | 11 +- arch/arm/mach-footbridge/dc21285.c | 12 +- arch/arm/mach-imx/pm-imx5.c | 6 +- - arch/arm/mach-imx/pm-imx6.c | 10 +- + arch/arm/mach-imx/pm-imx6.c | 12 +- arch/arm/mach-imx/suspend-imx53.S | 4 +- arch/arm/mach-imx/suspend-imx6.S | 1 + arch/arm/mach-integrator/Kconfig | 7 +- arch/arm/mach-keystone/keystone.c | 4 +- arch/arm/mach-omap2/board-n8x0.c | 2 +- arch/arm/mach-omap2/omap_device.c | 8 +- + arch/arm/mach-socfpga/core.h | 2 +- + arch/arm/mach-socfpga/platsmp.c | 8 +- arch/arm/mach-socfpga/pm.c | 8 +- arch/arm/mach-tegra/tegra.c | 4 +- + arch/arm/mm/Kconfig | 2 +- arch/arm/mm/cache-l2x0.c | 16 +- - arch/arm/mm/proc-macros.S | 3 +- + arch/arm/mm/copypage-fa.c | 35 +- + arch/arm/mm/copypage-feroceon.c | 98 +- + arch/arm/mm/copypage-v4mc.c | 19 +- + arch/arm/mm/copypage-v4wb.c | 41 +- + arch/arm/mm/copypage-v4wt.c | 37 +- + arch/arm/mm/copypage-xsc3.c | 71 +- + arch/arm/mm/copypage-xscale.c | 71 +- + arch/arm/mm/proc-macros.S | 4 +- arch/arm/plat-samsung/Kconfig | 1 + - arch/arm/probes/kprobes/core.c | 6 + + arch/arm/probes/kprobes/core.c | 8 +- arch/arm/probes/kprobes/test-thumb.c | 10 +- arch/arm/probes/uprobes/core.c | 4 +- arch/arm/xen/p2m.c | 33 +- + arch/arm64/Kconfig | 2 +- arch/arm64/Kconfig.platforms | 1 + arch/arm64/boot/dts/arm/juno-base.dtsi | 6 +- .../boot/dts/exynos/exynos7-espresso.dts | 3 +- - arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +- + arch/arm64/boot/dts/exynos/exynos7.dtsi | 6 +- .../arm64/boot/dts/freescale/fsl-ls1043a.dtsi | 1 + + arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 11 +- arch/arm64/boot/dts/mediatek/mt8173.dtsi | 2 +- arch/arm64/boot/dts/nvidia/tegra210.dtsi | 1 + arch/arm64/boot/dts/qcom/Makefile | 10 +- - .../batterydata-qrd-skue-4v35-2000mah.dtsi | 121 ++ - ...si-panel-arglass-boe-dual-1080p-video.dtsi | 99 ++ + .../batterydata-qrd-skue-4v35-2000mah.dtsi | 121 + + ...si-panel-arglass-boe-dual-1080p-video.dtsi | 99 + .../qcom/dsi-panel-hx8379c-fwvga-video.dtsi | 90 + ...en3-batterydata-goertek-merlin-230mah.dtsi | 80 + arch/arm64/boot/dts/qcom/msm-gdsc-sdm845.dtsi | 3 +- .../arm64/boot/dts/qcom/msm8905-qrd-skub.dtsi | 18 +- .../boot/dts/qcom/msm8909-1gb-qrd-skue.dts | 20 + - .../dts/qcom/msm8909-camera-sensor-skue.dtsi | 129 ++ + .../dts/qcom/msm8909-camera-sensor-skue.dtsi | 129 + .../boot/dts/qcom/msm8909-coresight.dtsi | 30 +- .../boot/dts/qcom/msm8909-mdss-panels.dtsi | 1 + arch/arm64/boot/dts/qcom/msm8909-pm8909.dtsi | 4 - - .../arm64/boot/dts/qcom/msm8909-qrd-skue.dtsi | 490 ++++++ + .../arm64/boot/dts/qcom/msm8909-qrd-skue.dtsi | 490 +++ arch/arm64/boot/dts/qcom/msm8909-qrd.dtsi | 9 + arch/arm64/boot/dts/qcom/msm8909-vidc.dtsi | 4 +- arch/arm64/boot/dts/qcom/msm8909.dtsi | 10 + arch/arm64/boot/dts/qcom/msm8916-pins.dtsi | 12 +- arch/arm64/boot/dts/qcom/msm8916.dtsi | 8 +- + .../boot/dts/qcom/qcs605-lc-ipcamera-base.dts | 5 +- + .../dts/qcom/qcs605-lc-ipcamera-overlay.dts | 4 +- + .../boot/dts/qcom/qcs605-lc-ipcamera.dts | 5 +- .../qcom/qcs605-pm660-pm8005-regulator.dtsi | 4 +- arch/arm64/boot/dts/qcom/qcs605.dtsi | 17 + arch/arm64/boot/dts/qcom/qm215.dtsi | 22 +- arch/arm64/boot/dts/qcom/sdm429-bg-soc.dtsi | 2 + arch/arm64/boot/dts/qcom/sdm429-spyro.dtsi | 1 + - .../qcom/sdm670-camera-sensor-arglass.dtsi | 431 +++++ + .../qcom/sdm670-camera-sensor-arglass.dtsi | 431 ++ .../dts/qcom/sdm670-camera-sensor-svr.dtsi | 2 +- arch/arm64/boot/dts/qcom/sdm670-gpu.dtsi | 7 +- .../boot/dts/qcom/sdm670-sde-display.dtsi | 45 +- @@ -171,15 +225,16 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 .../dts/qcom/sdw3100-msm8909w-1gb-wtp.dts | 4 +- .../boot/dts/qcom/sdw3100-msm8909w-wtp.dts | 4 +- .../boot/dts/qcom/sxr1130-arglass-overlay.dts | 35 + - .../qcom/sxr1130-arglass-pinctrl-overlay.dtsi | 150 ++ + .../qcom/sxr1130-arglass-pinctrl-overlay.dtsi | 150 + arch/arm64/boot/dts/qcom/sxr1130-arglass.dts | 72 + - arch/arm64/boot/dts/qcom/sxr1130-arglass.dtsi | 536 ++++++ + arch/arm64/boot/dts/qcom/sxr1130-arglass.dtsi | 536 +++ arch/arm64/boot/dts/qcom/sxr1130-svr.dtsi | 28 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 3 + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 +- arch/arm64/configs/cuttlefish_defconfig | 2 +- - arch/arm64/configs/sdm670-perf_defconfig | 3 +- - arch/arm64/configs/sdm670_defconfig | 1 - + arch/arm64/configs/qcs605_defconfig | 1 + + arch/arm64/configs/sdm670-perf_defconfig | 4 +- + arch/arm64/configs/sdm670_defconfig | 2 +- arch/arm64/configs/sdm845-perf_defconfig | 1 - arch/arm64/configs/sdm845_defconfig | 1 - arch/arm64/include/asm/atomic_ll_sc.h | 109 +- @@ -199,6 +254,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/arm64/kernel/kgdb.c | 2 +- arch/arm64/kernel/perf_event.c | 50 +- arch/arm64/kernel/perf_regs.c | 25 +- + arch/arm64/kernel/process.c | 4 +- arch/arm64/kernel/psci.c | 5 +- arch/arm64/kernel/ptrace.c | 4 +- arch/arm64/kernel/traps.c | 8 - @@ -211,60 +267,97 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/arm64/mm/numa.c | 6 +- arch/h8300/kernel/asm-offsets.c | 3 + arch/hexagon/kernel/vmlinux.lds.S | 7 +- + arch/hexagon/lib/io.c | 4 + + arch/ia64/Kconfig.debug | 2 +- arch/ia64/include/asm/ptrace.h | 8 +- arch/ia64/include/asm/syscall.h | 2 +- + arch/ia64/include/asm/tlb.h | 10 + arch/ia64/kernel/Makefile | 2 +- arch/ia64/kernel/mca.c | 2 +- arch/ia64/kernel/mca_drv.c | 2 +- arch/ia64/kernel/ptrace.c | 24 +- arch/ia64/mm/discontig.c | 6 +- arch/ia64/scripts/unwcheck.py | 2 +- + arch/m68k/Kconfig.machine | 1 + + arch/m68k/emu/nfeth.c | 4 +- arch/m68k/include/asm/m53xxacr.h | 6 +- arch/m68k/include/asm/mac_via.h | 1 + + arch/m68k/include/asm/raw_io.h | 20 +- arch/m68k/mac/config.c | 21 +- arch/m68k/mac/iop.c | 21 +- arch/m68k/mac/via.c | 6 +- arch/m68k/q40/config.c | 1 + - arch/mips/Kconfig | 1 + - arch/mips/Makefile | 13 +- + arch/mips/Kconfig | 5 + + arch/mips/Makefile | 15 +- arch/mips/alchemy/board-xxs1500.c | 1 + arch/mips/alchemy/common/clock.c | 9 +- arch/mips/bcm47xx/Kconfig | 1 + + arch/mips/bcm63xx/clk.c | 6 + arch/mips/boot/compressed/Makefile | 6 +- arch/mips/boot/compressed/decompress.c | 5 +- arch/mips/include/asm/cpu-type.h | 1 + arch/mips/include/asm/div64.h | 55 +- arch/mips/include/asm/hugetlb.h | 8 +- arch/mips/include/asm/kvm_host.h | 6 +- + arch/mips/include/asm/pgtable-32.h | 3 + arch/mips/kernel/genex.S | 6 +- arch/mips/kernel/mips-cm.c | 6 +- + arch/mips/kernel/r2300_fpu.S | 4 +- arch/mips/kernel/relocate.c | 10 +- arch/mips/kernel/setup.c | 10 + arch/mips/kernel/smp-bmips.c | 2 + + arch/mips/kernel/syscall.c | 9 - arch/mips/kernel/time.c | 65 + arch/mips/kernel/topology.c | 2 +- arch/mips/kernel/traps.c | 1 + arch/mips/kernel/vmlinux.lds.S | 3 +- arch/mips/lantiq/irq.c | 2 +- + arch/mips/lantiq/xway/dma.c | 14 +- arch/mips/lib/mips-atomic.c | 12 +- arch/mips/mm/c-r4k.c | 6 +- arch/mips/mm/tlb-r4k.c | 1 + + arch/mips/mti-malta/malta-dtshim.c | 2 +- + arch/mips/mti-malta/malta-platform.c | 3 +- arch/mips/pci/pci-legacy.c | 9 +- arch/mips/ralink/of.c | 2 + arch/mips/sni/a20r.c | 9 +- + arch/mips/sni/time.c | 4 +- arch/mips/vdso/genvdso.c | 10 + arch/mips/vdso/vdso.h | 2 +- + arch/nios2/include/asm/irqflags.h | 4 +- + arch/nios2/include/asm/registers.h | 2 +- + arch/nios2/platform/Kconfig.platform | 1 + arch/openrisc/include/asm/barrier.h | 9 + - arch/openrisc/kernel/entry.S | 4 +- + arch/openrisc/kernel/entry.S | 6 +- arch/openrisc/kernel/setup.c | 2 + arch/parisc/include/asm/atomic.h | 2 + arch/parisc/include/asm/cmpxchg.h | 2 + + arch/parisc/include/asm/page.h | 2 +- + arch/parisc/install.sh | 1 + + arch/parisc/kernel/entry.S | 4 +- + arch/parisc/kernel/signal.c | 6 + + arch/parisc/kernel/smp.c | 19 +- arch/parisc/lib/bitops.c | 12 + + arch/parisc/mm/init.c | 4 +- arch/powerpc/Kconfig | 2 +- arch/powerpc/Kconfig.debug | 1 + + arch/powerpc/boot/crt0.S | 3 - arch/powerpc/boot/devtree.c | 59 +- + arch/powerpc/boot/dts/charon.dts | 2 +- + arch/powerpc/boot/dts/digsy_mtc.dts | 2 +- arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | 8 + arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | 16 + + arch/powerpc/boot/dts/fsl/t1023rdb.dts | 2 +- + arch/powerpc/boot/dts/lite5200.dts | 2 +- + arch/powerpc/boot/dts/lite5200b.dts | 2 +- + arch/powerpc/boot/dts/media5200.dts | 2 +- + arch/powerpc/boot/dts/mpc5200b.dtsi | 2 +- + arch/powerpc/boot/dts/o2d.dts | 2 +- + arch/powerpc/boot/dts/o2d.dtsi | 2 +- + arch/powerpc/boot/dts/o2dnt2.dts | 2 +- + arch/powerpc/boot/dts/o3dnt.dts | 2 +- + arch/powerpc/boot/dts/pcm032.dts | 2 +- + arch/powerpc/boot/dts/tqm5200.dts | 2 +- arch/powerpc/boot/ns16550.c | 9 +- arch/powerpc/configs/pasemi_defconfig | 1 - arch/powerpc/configs/ppc6xx_defconfig | 1 - @@ -284,6 +377,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/powerpc/include/asm/nohash/pgtable.h | 4 +- arch/powerpc/include/asm/percpu.h | 4 +- arch/powerpc/include/asm/ps3.h | 2 + + arch/powerpc/include/asm/pte-common.h | 2 + arch/powerpc/include/asm/reg.h | 2 +- arch/powerpc/include/asm/security_features.h | 7 + arch/powerpc/include/asm/setup.h | 4 + @@ -295,23 +389,28 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/powerpc/kernel/head_8xx.S | 8 +- arch/powerpc/kernel/iommu.c | 4 +- arch/powerpc/kernel/machine_kexec.c | 8 +- + arch/powerpc/kernel/module_64.c | 2 +- arch/powerpc/kernel/prom.c | 2 +- - arch/powerpc/kernel/setup_64.c | 120 ++ + arch/powerpc/kernel/setup_64.c | 120 + arch/powerpc/kernel/sysfs.c | 42 +- arch/powerpc/kernel/tau_6xx.c | 82 +- arch/powerpc/kernel/vdso.c | 2 +- arch/powerpc/kernel/vmlinux.lds.S | 14 + arch/powerpc/kvm/book3s_rtas.c | 25 +- arch/powerpc/lib/checksum_wrappers.c | 4 + - arch/powerpc/lib/feature-fixups.c | 119 ++ + arch/powerpc/lib/feature-fixups.c | 119 + arch/powerpc/lib/string.S | 4 +- arch/powerpc/lib/string_64.S | 6 +- arch/powerpc/mm/fault.c | 7 +- + arch/powerpc/net/bpf_jit.h | 25 +- + arch/powerpc/net/bpf_jit_comp64.c | 47 +- arch/powerpc/perf/core-book3s.c | 27 +- arch/powerpc/perf/hv-24x7.c | 10 - arch/powerpc/perf/hv-gpci-requests.h | 6 +- + arch/powerpc/perf/hv-gpci.c | 2 +- arch/powerpc/perf/isa207-common.c | 14 +- arch/powerpc/platforms/52xx/lite5200_sleep.S | 2 +- + arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c | 3 +- arch/powerpc/platforms/Kconfig | 9 +- arch/powerpc/platforms/cell/Kconfig | 1 + arch/powerpc/platforms/cell/spufs/file.c | 113 +- @@ -328,6 +427,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/powerpc/platforms/pseries/rng.c | 1 + arch/powerpc/platforms/pseries/setup.c | 8 + arch/powerpc/platforms/pseries/suspend.c | 1 - + arch/powerpc/sysdev/dcr-low.S | 2 +- arch/powerpc/sysdev/mpic_msgr.c | 2 +- arch/powerpc/sysdev/xics/icp-hv.c | 1 + arch/powerpc/xmon/nonstdio.c | 2 +- @@ -336,29 +436,40 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/s390/include/asm/kvm_host.h | 8 +- arch/s390/include/asm/percpu.h | 28 +- arch/s390/include/asm/syscall.h | 12 +- + arch/s390/include/asm/tlb.h | 14 + arch/s390/kernel/cpcmd.c | 6 +- - arch/s390/kernel/dis.c | 2 +- + arch/s390/kernel/dis.c | 4 +- arch/s390/kernel/early.c | 2 + arch/s390/kernel/entry.S | 1 + arch/s390/kernel/ftrace.c | 2 + + arch/s390/kernel/jump_label.c | 2 +- arch/s390/kernel/mcount.S | 4 +- arch/s390/kernel/perf_cpum_sf.c | 2 +- arch/s390/kernel/ptrace.c | 31 +- - arch/s390/kernel/setup.c | 8 +- + arch/s390/kernel/setup.c | 11 +- arch/s390/kernel/smp.c | 2 +- + arch/s390/lib/string.c | 15 +- + arch/s390/mm/gmap.c | 5 +- arch/s390/mm/hugetlbpage.c | 2 +- - arch/s390/net/bpf_jit_comp.c | 2 +- + arch/s390/net/bpf_jit_comp.c | 61 +- + arch/sh/Kconfig.debug | 1 + arch/sh/boards/mach-landisk/setup.c | 3 + arch/sh/drivers/dma/Kconfig | 3 +- + arch/sh/include/asm/sfp-machine.h | 8 + + arch/sh/include/asm/tlb.h | 10 + + arch/sh/kernel/cpu/sh4a/smp-shx3.c | 5 +- arch/sh/kernel/entry-common.S | 6 +- arch/sparc/Kconfig | 2 +- - arch/sparc/kernel/ptrace_32.c | 233 ++- + arch/sparc/kernel/mdesc.c | 3 +- + arch/sparc/kernel/ptrace_32.c | 233 +- arch/sparc/kernel/ptrace_64.c | 17 +- arch/sparc/kernel/smp_64.c | 65 +- + arch/sparc/lib/iomap.c | 2 + arch/sparc/lib/memset.S | 1 + arch/um/drivers/chan_user.c | 3 +- arch/um/drivers/slip_user.c | 3 +- arch/um/drivers/xterm.c | 5 + + arch/um/include/asm/tlb.h | 12 + arch/um/kernel/dyn.lds.S | 6 + arch/um/kernel/sigio.c | 6 +- arch/um/kernel/uml.lds.S | 6 + @@ -372,26 +483,34 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/x86/configs/x86_64_cuttlefish_defconfig | 4 +- arch/x86/configs/x86_64_defconfig | 2 +- arch/x86/entry/entry_64.S | 2 +- - arch/x86/events/amd/ibs.c | 53 +- + arch/x86/events/amd/ibs.c | 61 +- arch/x86/events/amd/iommu.c | 6 +- + arch/x86/events/core.c | 1 + arch/x86/events/intel/cstate.c | 6 +- arch/x86/events/intel/ds.c | 2 +- arch/x86/events/intel/pt.c | 4 +- arch/x86/events/intel/rapl.c | 14 +- arch/x86/events/intel/uncore.c | 4 +- arch/x86/events/intel/uncore.h | 12 +- + arch/x86/events/intel/uncore_snbep.c | 4 + + arch/x86/events/perf_event.h | 3 +- arch/x86/include/asm/apic.h | 10 - arch/x86/include/asm/archrandom.h | 8 +- arch/x86/include/asm/barrier.h | 18 + arch/x86/include/asm/bitops.h | 29 +- arch/x86/include/asm/cpufeatures.h | 2 +- - arch/x86/include/asm/fpu/internal.h | 19 +- + arch/x86/include/asm/fpu/internal.h | 49 +- arch/x86/include/asm/insn.h | 15 + arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/nospec-branch.h | 5 +- + arch/x86/include/asm/page_64_types.h | 2 +- arch/x86/include/asm/percpu.h | 2 +- + arch/x86/include/asm/pgtable-3level_types.h | 1 + + arch/x86/include/asm/pgtable.h | 4 +- arch/x86/include/asm/pkeys.h | 5 + arch/x86/include/asm/processor.h | 9 - + arch/x86/include/asm/proto.h | 2 + + arch/x86/include/asm/svm.h | 2 + arch/x86/include/asm/thread_info.h | 23 +- arch/x86/include/asm/tlbflush.h | 11 +- arch/x86/kernel/apic/apic.c | 4 + @@ -405,14 +524,15 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/x86/kernel/crash.c | 3 +- arch/x86/kernel/fpu/regset.c | 2 +- arch/x86/kernel/fpu/signal.c | 18 +- - arch/x86/kernel/fpu/xstate.c | 9 +- + arch/x86/kernel/fpu/xstate.c | 47 +- arch/x86/kernel/i8259.c | 2 +- + arch/x86/kernel/irq.c | 4 +- arch/x86/kernel/kexec-bzimage64.c | 3 +- arch/x86/kernel/kprobes/core.c | 17 +- arch/x86/kernel/module.c | 1 + arch/x86/kernel/process.c | 28 +- arch/x86/kernel/process.h | 2 +- - arch/x86/kernel/reboot.c | 46 +- + arch/x86/kernel/reboot.c | 49 +- arch/x86/kernel/signal.c | 24 +- arch/x86/kernel/time.c | 4 - arch/x86/kernel/uprobes.c | 10 +- @@ -420,36 +540,47 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 arch/x86/kvm/cpuid.c | 8 +- arch/x86/kvm/emulate.c | 10 +- arch/x86/kvm/lapic.c | 2 +- - arch/x86/kvm/mmu.c | 3 +- + arch/x86/kvm/mmu.c | 14 +- arch/x86/kvm/mmutrace.h | 2 +- arch/x86/kvm/pmu_intel.c | 2 +- - arch/x86/kvm/svm.c | 10 +- + arch/x86/kvm/svm.c | 16 +- arch/x86/kvm/vmx.c | 3 +- - arch/x86/kvm/x86.c | 22 +- + arch/x86/kvm/x86.c | 26 +- arch/x86/lib/msr-smp.c | 4 +- arch/x86/math-emu/wm_sqrt.S | 2 +- arch/x86/mm/init.c | 2 - + arch/x86/mm/init_64.c | 6 +- arch/x86/mm/pgtable.c | 2 + arch/x86/net/bpf_jit_comp.c | 11 +- arch/x86/pci/fixup.c | 4 + + arch/x86/tools/chkobjdump.awk | 1 + arch/x86/tools/relocs.c | 12 +- - arch/x86/xen/p2m.c | 59 +- + arch/x86/xen/enlighten.c | 22 +- + arch/x86/xen/p2m.c | 63 +- arch/x86/xen/spinlock.c | 12 +- + arch/xtensa/Kconfig | 2 +- + arch/xtensa/kernel/irq.c | 2 +- arch/xtensa/kernel/perf_event.c | 2 +- arch/xtensa/kernel/setup.c | 3 +- arch/xtensa/kernel/xtensa_ksyms.c | 4 +- arch/xtensa/mm/cache.c | 14 + + arch/xtensa/platforms/iss/console.c | 17 +- arch/xtensa/platforms/iss/simdisk.c | 1 - + arch/xtensa/platforms/xtfpga/setup.c | 12 +- block/blk-mq.c | 8 +- block/blk-settings.c | 12 + + block/blk-throttle.c | 1 + block/genhd.c | 9 +- + block/ioprio.c | 3 + build.config.aarch64 | 1 + + certs/Makefile | 8 + crypto/af_alg.c | 30 +- crypto/algboss.c | 2 - crypto/algif_aead.c | 13 +- crypto/algif_hash.c | 9 +- crypto/algif_skcipher.c | 9 +- crypto/ecdh_helper.c | 3 + + crypto/pcrypt.c | 12 +- crypto/shash.c | 18 +- drivers/acpi/Makefile | 5 + drivers/acpi/acpi_amba.c | 1 + @@ -457,8 +588,13 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/acpi/acpi_dbg.c | 3 + drivers/acpi/acpi_extlog.c | 6 +- drivers/acpi/acpi_pnp.c | 3 + + drivers/acpi/acpica/acglobal.h | 2 + drivers/acpi/acpica/exprep.c | 4 - + drivers/acpi/acpica/hwesleep.c | 8 +- + drivers/acpi/acpica/hwsleep.c | 11 +- + drivers/acpi/acpica/hwxfsleep.c | 7 + drivers/acpi/acpica/utdelete.c | 6 +- + drivers/acpi/battery.c | 2 +- drivers/acpi/bus.c | 1 + drivers/acpi/cppc_acpi.c | 4 +- drivers/acpi/custom_method.c | 4 +- @@ -467,35 +603,39 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/acpi/ec.c | 16 +- drivers/acpi/evged.c | 22 +- drivers/acpi/internal.h | 8 +- - drivers/acpi/nfit/core.c | 2 +- + drivers/acpi/nfit/core.c | 5 +- + drivers/acpi/pmic/intel_pmic.c | 51 +- drivers/acpi/processor_idle.c | 40 + drivers/acpi/resource.c | 2 +- drivers/acpi/scan.c | 122 +- drivers/acpi/sysfs.c | 8 +- drivers/acpi/thermal.c | 55 +- drivers/acpi/video_detect.c | 9 + - drivers/amba/bus.c | 20 +- - drivers/android/binder.c | 17 +- + drivers/amba/bus.c | 23 +- + drivers/android/binder.c | 56 +- drivers/ata/acard-ahci.c | 6 +- drivers/ata/ahci_brcm.c | 14 +- drivers/ata/ahci_sunxi.c | 2 +- drivers/ata/libahci.c | 6 +- drivers/ata/libahci_platform.c | 4 +- - drivers/ata/libata-core.c | 25 +- + drivers/ata/libata-core.c | 63 +- + drivers/ata/libata-eh.c | 8 + drivers/ata/libata-scsi.c | 17 +- drivers/ata/libata-sff.c | 12 +- drivers/ata/pata_arasan_cf.c | 15 +- drivers/ata/pata_ep93xx.c | 2 +- drivers/ata/pata_ixp4xx_cf.c | 6 +- + drivers/ata/pata_legacy.c | 6 +- drivers/ata/pata_macio.c | 6 +- drivers/ata/pata_octeon_cf.c | 5 +- drivers/ata/pata_pxa.c | 8 +- drivers/ata/pata_rb532_cf.c | 6 +- drivers/ata/pdc_adma.c | 7 +- - drivers/ata/sata_fsl.c | 4 +- + drivers/ata/sata_dwc_460ex.c | 12 +- + drivers/ata/sata_fsl.c | 24 +- drivers/ata/sata_highbank.c | 6 +- drivers/ata/sata_inic162x.c | 4 +- - drivers/ata/sata_mv.c | 38 +- + drivers/ata/sata_mv.c | 42 +- drivers/ata/sata_nv.c | 18 +- drivers/ata/sata_promise.c | 6 +- drivers/ata/sata_qstor.c | 8 +- @@ -512,23 +652,28 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/atm/lanai.c | 5 +- drivers/atm/nicstar.c | 28 +- drivers/atm/uPD98402.c | 2 +- - drivers/base/core.c | 14 +- + drivers/auxdisplay/img-ascii-lcd.c | 10 + + drivers/base/core.c | 15 +- drivers/base/dd.c | 5 +- drivers/base/platform.c | 2 + drivers/base/power/main.c | 16 +- + drivers/base/power/wakeirq.c | 14 +- + drivers/base/regmap/regcache-rbtree.c | 7 +- drivers/base/regmap/regmap-debugfs.c | 6 + - drivers/base/regmap/regmap.c | 2 +- - drivers/block/Kconfig | 1 + + drivers/base/regmap/regmap.c | 4 +- + drivers/bcma/main.c | 6 +- + drivers/block/Kconfig | 5 +- drivers/block/brd.c | 1 - + drivers/block/cryptoloop.c | 2 + drivers/block/drbd/drbd_bitmap.c | 2 +- - drivers/block/floppy.c | 27 +- - drivers/block/loop.c | 369 +++-- + drivers/block/loop.c | 369 +- drivers/block/ps3disk.c | 1 - drivers/block/rbd.c | 21 +- drivers/block/rsxx/core.c | 9 +- drivers/block/virtio_blk.c | 3 + drivers/block/xen-blkback/blkback.c | 52 +- drivers/block/xen-blkback/xenbus.c | 9 +- + drivers/block/xen-blkfront.c | 141 +- drivers/block/zram/zram_drv.c | 2 +- drivers/block/zram/zram_drv.h | 1 - drivers/bluetooth/bluetooth-power.c | 9 + @@ -542,12 +687,13 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/char/adsprpc_shared.h | 2 +- drivers/char/agp/Kconfig | 2 +- drivers/char/agp/intel-gtt.c | 8 +- + drivers/char/agp/parisc-agp.c | 6 +- drivers/char/diag/diag_dci.c | 11 +- drivers/char/diag/diag_masks.c | 5 +- drivers/char/diag/diag_memorydevice.c | 22 +- drivers/char/diag/diag_usb.c | 4 +- drivers/char/diag/diagchar.h | 15 + - drivers/char/diag/diagchar_core.c | 219 ++- + drivers/char/diag/diagchar_core.c | 219 +- drivers/char/diag/diagfwd.c | 32 +- drivers/char/diag/diagfwd.h | 5 +- drivers/char/diag/diagfwd_cntl.c | 5 +- @@ -567,6 +713,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/clk/clk.c | 30 +- drivers/clk/meson/clk-pll.c | 2 +- drivers/clk/mvebu/armada-37xx-xtal.c | 4 +- + drivers/clk/mvebu/kirkwood.c | 1 + drivers/clk/qcom/gcc-msm8916.c | 8 +- drivers/clk/rockchip/clk-rk3228.c | 2 +- drivers/clk/samsung/clk-exynos4.c | 4 +- @@ -591,52 +738,68 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/clocksource/h8300_timer8.c | 2 +- drivers/clocksource/mxs_timer.c | 5 +- drivers/cpufreq/acpi-cpufreq.c | 3 +- + drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +- drivers/cpufreq/highbank-cpufreq.c | 7 + drivers/cpufreq/loongson1-cpufreq.c | 1 + drivers/cpufreq/powernow-k8.c | 9 +- drivers/cpufreq/powernv-cpufreq.c | 22 +- drivers/cpufreq/scpi-cpufreq.c | 1 + drivers/cpufreq/sti-cpufreq.c | 13 +- - drivers/cpuidle/sysfs.c | 6 +- + drivers/cpuidle/sysfs.c | 5 +- drivers/crypto/ccp/ccp-dev.h | 1 + drivers/crypto/ccp/ccp-ops.c | 42 +- drivers/crypto/ixp4xx_crypto.c | 4 +- + drivers/crypto/mxs-dcp.c | 81 +- drivers/crypto/nx/nx-842-pseries.c | 9 +- drivers/crypto/omap-aes.c | 3 +- - drivers/crypto/omap-sham.c | 67 +- + drivers/crypto/omap-sham.c | 69 +- + .../qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 +- drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 +- + .../qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 +- drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 +- - drivers/crypto/qat/qat_common/adf_isr.c | 29 +- + .../crypto/qat/qat_common/adf_common_drv.h | 8 +- + drivers/crypto/qat/qat_common/adf_init.c | 5 +- + drivers/crypto/qat/qat_common/adf_isr.c | 36 +- + drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 16 +- drivers/crypto/qat/qat_common/adf_transport.c | 1 + - drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +- + drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 +- + drivers/crypto/qat/qat_common/adf_vf_isr.c | 30 +- drivers/crypto/qat/qat_common/qat_algs.c | 10 +- drivers/crypto/qat/qat_common/qat_hal.c | 6 +- drivers/crypto/qat/qat_common/qat_uclo.c | 10 +- + .../qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 +- drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 +- - drivers/crypto/talitos.c | 8 +- + drivers/crypto/talitos.c | 12 +- drivers/crypto/ux500/hash/hash_core.c | 1 + drivers/devfreq/tegra-devfreq.c | 4 +- + drivers/dma/Kconfig | 2 +- + drivers/dma/acpi-dma.c | 10 +- drivers/dma/at_hdmac.c | 2 + + drivers/dma/at_xdmac.c | 2 +- drivers/dma/dma-jz4780.c | 7 +- + drivers/dma/dmaengine.h | 2 +- drivers/dma/dw/Kconfig | 2 + drivers/dma/fsl-edma.c | 7 + drivers/dma/fsldma.c | 6 + drivers/dma/ioat/dma.c | 12 + drivers/dma/ioat/dma.h | 2 - - drivers/dma/of-dma.c | 8 +- + drivers/dma/of-dma.c | 17 +- drivers/dma/pl330.c | 10 +- drivers/dma/qcom/Kconfig | 1 + drivers/dma/qcom/hidma_mgmt.c | 14 + + drivers/dma/sh/usb-dmac.c | 2 +- drivers/dma/ste_dma40.c | 3 + drivers/dma/tegra20-apb-dma.c | 3 +- drivers/dma/tegra210-adma.c | 5 +- - drivers/dma/xilinx/xilinx_dma.c | 12 +- + drivers/dma/xilinx/xilinx_dma.c | 14 +- drivers/dma/xilinx/zynqmp_dma.c | 24 +- drivers/edac/amd64_edac.c | 2 + drivers/edac/edac_device_sysfs.c | 1 + drivers/edac/edac_pci_sysfs.c | 2 +- drivers/edac/i5100_edac.c | 11 +- drivers/edac/ie31200_edac.c | 50 +- + drivers/edac/sb_edac.c | 2 +- + drivers/edac/synopsys_edac.c | 2 +- drivers/extcon/extcon-adc-jack.c | 3 +- drivers/extcon/extcon-arizona.c | 17 +- drivers/extcon/extcon-max77693.c | 2 +- @@ -646,31 +809,55 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/firewire/nosy.c | 9 +- drivers/firmware/Kconfig | 1 + drivers/firmware/efi/Kconfig | 11 + - drivers/firmware/efi/cper.c | 4 +- + drivers/firmware/efi/cper.c | 8 +- drivers/firmware/efi/efi.c | 2 +- drivers/firmware/efi/efivars.c | 4 +- drivers/firmware/efi/esrt.c | 2 +- drivers/firmware/efi/memattr.c | 5 - + drivers/firmware/efi/runtime-wrappers.c | 2 +- drivers/firmware/qemu_fw_cfg.c | 8 +- + drivers/firmware/scpi_pm_domain.c | 10 +- drivers/gpio/gpio-pcf857x.c | 2 +- drivers/gpio/gpio-tc3589x.c | 2 +- drivers/gpio/gpio-zynq.c | 5 +- drivers/gpio/gpiolib-of.c | 2 +- - .../gpu/drm/amd/amdgpu/amdgpu_connectors.c | 16 +- + drivers/gpu/drm/Kconfig | 7 + + drivers/gpu/drm/Makefile | 4 +- + .../gpu/drm/amd/amdgpu/amdgpu_connectors.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 4 +- drivers/gpu/drm/amd/amdgpu/atom.c | 4 +- drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 +- - drivers/gpu/drm/drm_auth.c | 3 +- - drivers/gpu/drm/drm_debugfs.c | 8 +- + drivers/gpu/drm/drm_atomic_helper.c | 4 +- + drivers/gpu/drm/drm_auth.c | 23 +- + drivers/gpu/drm/drm_blend.c | 38 +- + drivers/gpu/drm/drm_bootsplash.c | 337 ++ + drivers/gpu/drm/drm_client.c | 477 +++ + drivers/gpu/drm/drm_client_modeset.c | 1020 +++++ + drivers/gpu/drm/drm_connector.c | 21 +- + drivers/gpu/drm/drm_crtc.c | 30 +- + drivers/gpu/drm/drm_crtc_internal.h | 15 +- + drivers/gpu/drm/drm_debugfs.c | 17 +- drivers/gpu/drm/drm_dp_aux_dev.c | 2 +- drivers/gpu/drm/drm_dp_mst_topology.c | 58 +- + drivers/gpu/drm/drm_drv.c | 7 +- drivers/gpu/drm/drm_encoder_slave.c | 5 +- + drivers/gpu/drm/drm_fb_helper.c | 4 +- + drivers/gpu/drm/drm_fops.c | 291 +- + drivers/gpu/drm/drm_framebuffer.c | 43 +- drivers/gpu/drm/drm_gem.c | 10 +- + drivers/gpu/drm/drm_internal.h | 5 +- + drivers/gpu/drm/drm_ioctl.c | 4 +- drivers/gpu/drm/drm_mipi_dsi.c | 6 +- + drivers/gpu/drm/drm_modes.c | 135 +- + drivers/gpu/drm/drm_plane_helper.c | 3 +- + drivers/gpu/drm/drm_probe_helper.c | 3 + + drivers/gpu/drm/drm_rect.c | 32 +- + drivers/gpu/drm/drm_splash.h | 3527 +++++++++++++++++ drivers/gpu/drm/gma500/cdv_intel_display.c | 2 + drivers/gpu/drm/gma500/cdv_intel_dp.c | 4 +- drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 +- @@ -681,19 +868,30 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/gpu/drm/imx/imx-ldb.c | 17 +- drivers/gpu/drm/imx/imx-tve.c | 20 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 7 +- + drivers/gpu/drm/msm/dp/dp_display.c | 23 +- + drivers/gpu/drm/msm/dp/dp_display.h | 3 +- drivers/gpu/drm/msm/dp/dp_panel.c | 77 +- drivers/gpu/drm/msm/dsi-staging/dsi_panel.c | 2 +- + drivers/gpu/drm/msm/dsi/dsi.c | 6 +- + drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +- drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c | 2 +- + drivers/gpu/drm/msm/edp/edp_ctrl.c | 3 +- .../gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c | 10 +- drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c | 3 +- - drivers/gpu/drm/msm/msm_drv.c | 28 +- + drivers/gpu/drm/msm/msm_drv.c | 32 +- + drivers/gpu/drm/msm/msm_drv.h | 3 +- drivers/gpu/drm/msm/msm_fence.c | 2 +- + drivers/gpu/drm/msm/msm_gem.c | 4 +- drivers/gpu/drm/msm/sde/sde_connector.c | 10 +- + drivers/gpu/drm/msm/sde/sde_crtc.c | 5 +- + drivers/gpu/drm/msm/sde/sde_plane.c | 30 +- drivers/gpu/drm/nouveau/nouveau_bo.c | 4 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 4 +- + drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 + drivers/gpu/drm/nouveau/nouveau_drm.c | 8 +- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 5 +- drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +- + .../gpu/drm/nouveau/nvkm/engine/device/ctrl.c | 2 +- .../gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 2 +- .../gpu/drm/nouveau/nvkm/subdev/i2c/auxg94.c | 4 +- .../drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 12 +- @@ -712,6 +910,8 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/gpu/drm/radeon/radeon_uvd.c | 4 +- drivers/gpu/drm/tegra/sor.c | 10 +- drivers/gpu/drm/tilcdc/tilcdc_panel.c | 6 +- + drivers/gpu/drm/udl/udl_connector.c | 2 +- + drivers/gpu/drm/vc4/vc4_bo.c | 2 +- drivers/gpu/drm/virtio/virtgpu_kms.c | 3 + drivers/gpu/drm/virtio/virtgpu_vq.c | 10 +- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 +- @@ -723,7 +923,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/gpu/msm/adreno_a5xx.c | 15 +- drivers/gpu/msm/adreno_a5xx.h | 4 +- drivers/gpu/msm/adreno_a5xx_preempt.c | 8 +- - drivers/gpu/msm/adreno_a6xx.c | 33 +- + drivers/gpu/msm/adreno_a6xx.c | 36 +- drivers/gpu/msm/adreno_a6xx.h | 4 +- drivers/gpu/msm/adreno_a6xx_preempt.c | 35 +- drivers/gpu/msm/adreno_a6xx_snapshot.c | 49 +- @@ -738,6 +938,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/gpu/msm/kgsl.h | 13 +- drivers/gpu/msm/kgsl_compat.c | 4 +- drivers/gpu/msm/kgsl_debugfs.c | 2 +- + drivers/gpu/msm/kgsl_drawobj.c | 35 +- drivers/gpu/msm/kgsl_gmu.c | 15 +- drivers/gpu/msm/kgsl_gmu.h | 2 +- drivers/gpu/msm/kgsl_ioctl.c | 4 +- @@ -745,34 +946,61 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/gpu/msm/kgsl_mmu.c | 2 +- drivers/gpu/msm/kgsl_sharedmem.c | 1 + drivers/gpu/msm/kgsl_trace.h | 10 +- + drivers/hid/Kconfig | 10 +- drivers/hid/hid-alps.c | 1 + - drivers/hid/hid-apple.c | 18 + + drivers/hid/hid-apple.c | 25 + + drivers/hid/hid-betopff.c | 13 +- + drivers/hid/hid-chicony.c | 8 +- drivers/hid/hid-core.c | 21 +- + drivers/hid/hid-corsair.c | 7 +- drivers/hid/hid-cypress.c | 44 +- + drivers/hid/hid-elo.c | 3 + drivers/hid/hid-gt683r.c | 1 + + drivers/hid/hid-holtek-kbd.c | 9 +- + drivers/hid/hid-holtek-mouse.c | 24 + drivers/hid/hid-ids.h | 3 + drivers/hid/hid-input.c | 4 + + drivers/hid/hid-lg.c | 10 +- drivers/hid/hid-magicmouse.c | 6 + drivers/hid/hid-multitouch.c | 2 + drivers/hid/hid-plantronics.c | 60 +- - drivers/hid/hid-roccat-kone.c | 23 +- + drivers/hid/hid-prodikeys.c | 10 +- + drivers/hid/hid-roccat-arvo.c | 3 + + drivers/hid/hid-roccat-isku.c | 3 + + drivers/hid/hid-roccat-kone.c | 26 +- + drivers/hid/hid-roccat-koneplus.c | 3 + + drivers/hid/hid-roccat-konepure.c | 3 + + drivers/hid/hid-roccat-kovaplus.c | 3 + + drivers/hid/hid-roccat-lua.c | 3 + + drivers/hid/hid-roccat-pyra.c | 3 + + drivers/hid/hid-roccat-ryos.c | 3 + + drivers/hid/hid-roccat-savu.c | 3 + + drivers/hid/hid-samsung.c | 3 + drivers/hid/hid-sensor-hub.c | 16 +- - drivers/hid/i2c-hid/i2c-hid-core.c | 26 +- + drivers/hid/hid-uclogic.c | 3 + + drivers/hid/i2c-hid/i2c-hid-core.c | 29 +- drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 16 + - drivers/hid/usbhid/hid-core.c | 2 +- + drivers/hid/uhid.c | 3 +- + drivers/hid/usbhid/hid-core.c | 18 +- drivers/hid/usbhid/hid-pidff.c | 1 + drivers/hid/usbhid/hiddev.c | 4 + + drivers/hid/wacom_sys.c | 17 +- drivers/hsi/controllers/omap_ssi_core.c | 2 +- drivers/hsi/hsi_core.c | 3 +- drivers/hv/channel_mgmt.c | 31 +- + drivers/hv/hyperv_vmbus.h | 1 + drivers/hwmon/acpi_power_meter.c | 4 +- drivers/hwmon/applesmc.c | 31 +- + drivers/hwmon/dell-smm-hwmon.c | 7 +- drivers/hwmon/emc2103.c | 2 +- + drivers/hwmon/hwmon.c | 6 +- drivers/hwmon/lm80.c | 11 +- - drivers/hwmon/lm90.c | 42 +- + drivers/hwmon/lm90.c | 50 +- drivers/hwmon/max31722.c | 9 - drivers/hwmon/max31790.c | 2 +- drivers/hwmon/max6697.c | 7 +- + drivers/hwmon/pmbus/lm25066.c | 23 + + drivers/hwmon/tmp421.c | 24 +- drivers/hwtracing/intel_th/gth.c | 4 +- drivers/hwtracing/stm/heartbeat.c | 6 +- drivers/i2c/algos/i2c-algo-pca.c | 38 +- @@ -781,44 +1009,55 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/i2c/busses/i2c-cpm.c | 3 + drivers/i2c/busses/i2c-eg20t.c | 1 + drivers/i2c/busses/i2c-emev2.c | 5 +- + drivers/i2c/busses/i2c-highlander.c | 2 +- drivers/i2c/busses/i2c-i801.c | 6 +- drivers/i2c/busses/i2c-imx.c | 86 +- + drivers/i2c/busses/i2c-iop3xx.c | 6 +- drivers/i2c/busses/i2c-jz4780.c | 5 +- drivers/i2c/busses/i2c-mpc.c | 95 +- + drivers/i2c/busses/i2c-mt65xx.c | 2 +- drivers/i2c/busses/i2c-octeon-core.c | 2 +- drivers/i2c/busses/i2c-piix4.c | 3 +- drivers/i2c/busses/i2c-pxa.c | 13 +- drivers/i2c/busses/i2c-qcom-geni.c | 13 +- drivers/i2c/busses/i2c-qup.c | 3 +- drivers/i2c/busses/i2c-rcar.c | 8 +- + drivers/i2c/busses/i2c-rk3x.c | 4 +- drivers/i2c/busses/i2c-robotfuzz-osif.c | 4 +- - drivers/i2c/busses/i2c-s3c2410.c | 3 + + drivers/i2c/busses/i2c-s3c2410.c | 5 +- drivers/i2c/busses/i2c-sh7760.c | 5 +- + drivers/i2c/busses/i2c-xlr.c | 6 +- drivers/i2c/i2c-core.c | 5 +- + drivers/i2c/i2c-dev.c | 5 +- drivers/i2c/muxes/i2c-mux-pca954x.c | 6 +- drivers/ide/ide-cd.c | 8 +- drivers/ide/ide-cd.h | 6 +- drivers/iio/accel/bma180.c | 85 +- drivers/iio/accel/bma220_spi.c | 10 +- drivers/iio/accel/bmc150-accel-core.c | 15 +- - drivers/iio/accel/kxcjk-1013.c | 39 +- - drivers/iio/accel/kxsd9.c | 16 +- + drivers/iio/accel/kxcjk-1013.c | 44 +- + drivers/iio/accel/kxsd9.c | 22 +- drivers/iio/accel/mma7455_core.c | 16 +- - drivers/iio/accel/mma8452.c | 16 +- + drivers/iio/accel/mma8452.c | 18 +- drivers/iio/accel/stk8312.c | 12 +- drivers/iio/accel/stk8ba50.c | 17 +- drivers/iio/adc/ad7793.c | 1 + drivers/iio/adc/ina2xx-adc.c | 11 +- drivers/iio/adc/mcp3422.c | 16 +- + drivers/iio/adc/palmas_gpadc.c | 4 +- drivers/iio/adc/rockchip_saradc.c | 2 +- drivers/iio/adc/ti-adc081c.c | 11 +- drivers/iio/adc/ti-adc12138.c | 13 +- + drivers/iio/adc/ti-adc128s052.c | 6 + drivers/iio/adc/ti-ads1015.c | 22 +- drivers/iio/adc/vf610_adc.c | 10 +- + drivers/iio/common/ssp_sensors/ssp_spi.c | 11 +- + drivers/iio/dac/ad5446.c | 9 +- drivers/iio/dac/ad5504.c | 4 +- drivers/iio/dac/ad5592r-base.c | 4 +- + drivers/iio/dac/ad5624r_spi.c | 18 +- drivers/iio/gyro/bmg160_core.c | 10 +- - drivers/iio/gyro/itg3200_buffer.c | 15 +- + drivers/iio/gyro/itg3200_buffer.c | 17 +- drivers/iio/health/afe4403.c | 13 +- drivers/iio/health/afe4404.c | 8 +- drivers/iio/humidity/am2315.c | 16 +- @@ -829,9 +1068,11 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/iio/industrialio-buffer.c | 6 +- drivers/iio/light/hid-sensor-prox.c | 14 +- drivers/iio/light/isl29125.c | 10 +- - drivers/iio/light/ltr501.c | 30 +- + drivers/iio/light/ltr501.c | 32 +- drivers/iio/light/max44000.c | 12 +- + drivers/iio/light/opt3001.c | 6 +- drivers/iio/light/si1145.c | 19 +- + drivers/iio/light/stk3310.c | 6 +- drivers/iio/light/tcs3414.c | 10 +- drivers/iio/magnetometer/ak8974.c | 29 +- drivers/iio/magnetometer/ak8975.c | 26 +- @@ -850,6 +1091,8 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/infiniband/hw/cxgb4/cm.c | 9 +- drivers/infiniband/hw/cxgb4/cq.c | 3 + drivers/infiniband/hw/cxgb4/qp.c | 3 +- + drivers/infiniband/hw/hfi1/init.c | 2 +- + drivers/infiniband/hw/hfi1/sdma.c | 9 +- drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 1 - drivers/infiniband/hw/i40iw/i40iw_cm.c | 2 +- drivers/infiniband/hw/i40iw/i40iw_main.c | 5 - @@ -858,9 +1101,12 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/infiniband/hw/mlx4/cm.c | 3 + drivers/infiniband/hw/mlx4/mad.c | 34 +- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 + + drivers/infiniband/hw/mlx4/qp.c | 4 +- drivers/infiniband/hw/mthca/mthca_cq.c | 12 +- drivers/infiniband/hw/mthca/mthca_dev.h | 1 - drivers/infiniband/hw/qedr/main.c | 2 +- + drivers/infiniband/hw/qedr/verbs.c | 15 +- + drivers/infiniband/hw/qib/qib_user_sdma.c | 35 +- drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 3 + drivers/infiniband/sw/rdmavt/vt.c | 4 +- drivers/infiniband/sw/rxe/rxe.c | 5 +- @@ -868,6 +1114,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/infiniband/sw/rxe/rxe_mcast.c | 4 +- drivers/infiniband/sw/rxe/rxe_mr.c | 3 +- drivers/infiniband/sw/rxe/rxe_net.c | 53 +- + drivers/infiniband/sw/rxe/rxe_param.h | 2 +- drivers/infiniband/sw/rxe/rxe_qp.c | 14 +- drivers/infiniband/sw/rxe/rxe_recv.c | 11 +- drivers/infiniband/sw/rxe/rxe_req.c | 7 +- @@ -876,7 +1123,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/infiniband/sw/rxe/rxe_verbs.h | 22 - drivers/input/ff-core.c | 13 +- drivers/input/joydev.c | 9 +- - drivers/input/joystick/xpad.c | 20 +- + drivers/input/joystick/xpad.c | 22 +- drivers/input/keyboard/cros_ec_keyb.c | 1 + drivers/input/keyboard/ep93xx_keypad.c | 4 +- drivers/input/keyboard/hil_kbd.c | 1 + @@ -889,17 +1136,19 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/input/misc/cm109.c | 7 +- drivers/input/misc/uinput.c | 18 + drivers/input/mouse/cyapa_gen6.c | 2 +- + drivers/input/mouse/elantech.c | 13 + drivers/input/mouse/psmouse-base.c | 2 +- drivers/input/mouse/sentelic.c | 2 +- drivers/input/serio/hil_mlc.c | 21 +- drivers/input/serio/hp_sdc_mlc.c | 8 +- - drivers/input/serio/i8042-x86ia64io.h | 83 + + drivers/input/serio/i8042-x86ia64io.h | 97 + drivers/input/serio/i8042.c | 15 +- drivers/input/serio/sun4i-ps2.c | 9 +- drivers/input/touchscreen/ads7846.c | 8 +- drivers/input/touchscreen/elo.c | 4 +- drivers/input/touchscreen/goodix.c | 12 + drivers/input/touchscreen/imx6ul_tsc.c | 27 +- + drivers/input/touchscreen/of_touchscreen.c | 18 +- drivers/input/touchscreen/raydium_i2c_ts.c | 3 +- drivers/input/touchscreen/silead.c | 44 +- drivers/input/touchscreen/usbtouchscreen.c | 8 +- @@ -911,14 +1160,20 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/iommu/intel_irq_remapping.c | 12 +- drivers/iommu/iova.c | 4 +- drivers/iommu/omap-iommu-debug.c | 3 + - drivers/ipack/carriers/tpci200.c | 5 +- + drivers/ipack/carriers/tpci200.c | 33 +- + drivers/ipack/devices/ipoctal.c | 63 +- drivers/irqchip/irq-alpine-msi.c | 3 +- + drivers/irqchip/irq-armada-370-xp.c | 16 +- + drivers/irqchip/irq-bcm6345-l1.c | 2 +- + drivers/irqchip/irq-gic-v3-its.c | 2 +- drivers/irqchip/irq-gic.c | 13 +- - drivers/isdn/capi/kcapi.c | 4 +- + drivers/irqchip/irq-nvic.c | 2 +- + drivers/irqchip/irq-s3c24xx.c | 22 +- + drivers/isdn/capi/kcapi.c | 9 +- drivers/isdn/hardware/mISDN/hfcpci.c | 2 +- drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 +- drivers/isdn/hardware/mISDN/mISDNipac.c | 2 +- - drivers/isdn/hardware/mISDN/netjet.c | 1 - + drivers/isdn/hardware/mISDN/netjet.c | 3 +- drivers/isdn/mISDN/Kconfig | 1 + drivers/leds/led-class.c | 1 + drivers/leds/led-triggers.c | 10 +- @@ -932,6 +1187,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/leds/leds-lp5523.c | 2 +- drivers/leds/leds-wm831x-status.c | 14 +- drivers/macintosh/windfarm_pm112.c | 22 +- + drivers/mcb/mcb-core.c | 12 +- drivers/md/bcache/bcache.h | 1 + drivers/md/bcache/bset.c | 2 +- drivers/md/bcache/btree.c | 22 +- @@ -951,7 +1207,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/md/md-cluster.c | 1 + drivers/md/md.c | 53 +- .../md/persistent-data/dm-btree-internal.h | 4 +- - drivers/md/persistent-data/dm-btree-remove.c | 3 +- + drivers/md/persistent-data/dm-btree-remove.c | 5 +- .../md/persistent-data/dm-space-map-common.c | 2 + .../md/persistent-data/dm-space-map-common.h | 8 +- .../md/persistent-data/dm-space-map-disk.c | 9 +- @@ -960,7 +1216,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/media/common/siano/smscoreapi.c | 22 +- drivers/media/common/siano/smscoreapi.h | 4 +- drivers/media/common/siano/smsdvb-main.c | 9 +- - drivers/media/dvb-core/dvb_frontend.c | 571 ++++--- + drivers/media/dvb-core/dvb_frontend.c | 571 ++- drivers/media/dvb-core/dvb_frontend.h | 13 - drivers/media/dvb-core/dvb_net.c | 25 +- drivers/media/dvb-core/dvbdev.c | 1 + @@ -974,18 +1230,20 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/media/i2c/adv7604.c | 2 +- drivers/media/i2c/adv7842.c | 2 +- drivers/media/i2c/m5mols/m5mols_core.c | 3 +- + drivers/media/i2c/mt9p031.c | 28 +- drivers/media/i2c/s5c73m3/s5c73m3-core.c | 6 +- drivers/media/i2c/s5c73m3/s5c73m3.h | 2 +- drivers/media/i2c/s5k4ecgx.c | 10 +- drivers/media/i2c/s5k5baf.c | 6 +- drivers/media/i2c/s5k6aa.c | 10 +- - drivers/media/i2c/tc358743.c | 3 +- + drivers/media/i2c/tc358743.c | 5 +- drivers/media/pci/bt8xx/bt878.c | 3 + drivers/media/pci/bt8xx/bttv-driver.c | 13 +- drivers/media/pci/cobalt/cobalt-driver.c | 1 + drivers/media/pci/cobalt/cobalt-driver.h | 7 +- drivers/media/pci/cx23885/cx23888-ir.c | 5 +- drivers/media/pci/cx25821/cx25821-core.c | 4 +- + .../pci/netup_unidvb/netup_unidvb_core.c | 27 +- .../media/pci/netup_unidvb/netup_unidvb_spi.c | 5 +- drivers/media/pci/ngene/ngene-core.c | 2 +- drivers/media/pci/ngene/ngene.h | 14 +- @@ -1003,10 +1261,11 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/media/platform/exynos4-is/fimc-lite.c | 2 +- drivers/media/platform/exynos4-is/media-dev.c | 5 +- drivers/media/platform/exynos4-is/mipi-csis.c | 4 +- - .../camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c | 193 ++- + .../msm/camera/cam_cdm/cam_cdm_core_common.c | 13 +- + .../camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c | 202 +- .../camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.h | 4 +- .../cam_jpeg_dma_hw_info_ver_4_2_0.h | 53 + - .../jpeg_hw/jpeg_dma_hw/jpeg_dma_core.c | 242 ++- + .../jpeg_hw/jpeg_dma_hw/jpeg_dma_core.c | 242 +- .../jpeg_hw/jpeg_dma_hw/jpeg_dma_core.h | 41 +- .../jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.c | 17 +- .../jpeg_hw/jpeg_enc_hw/jpeg_enc_core.c | 3 +- @@ -1015,6 +1274,8 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 .../msm/camera/cam_req_mgr/cam_req_mgr_core.h | 2 +- .../msm/camera_v2/sensor/csiphy/msm_csiphy.c | 74 +- .../msm/camera_v2/sensor/csiphy/msm_csiphy.h | 8 +- + .../cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c | 9 +- + .../camera_v3/cam_req_mgr/cam_req_mgr_util.c | 17 - .../cam_sensor_module/cam_cci/cam_cci_core.c | 160 +- .../cam_sensor_module/cam_cci/cam_cci_dev.h | 3 +- .../cam_sensor_module/cam_cci/cam_cci_soc.c | 6 +- @@ -1022,20 +1283,26 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 .../platform/msm/vidc_3x/msm_vidc_res_parse.c | 7 +- .../platform/msm/vidc_3x/msm_vidc_resources.h | 3 +- .../media/platform/msm/vidc_3x/venus_hfi.c | 19 +- + drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 +- drivers/media/platform/omap3isp/isp.c | 6 +- drivers/media/platform/omap3isp/isppreview.c | 4 +- drivers/media/platform/pxa_camera.c | 3 + drivers/media/platform/rcar-fcp.c | 9 +- drivers/media/platform/s3c-camif/camif-core.c | 5 +- drivers/media/platform/s5p-g2d/g2d.c | 3 + + drivers/media/platform/s5p-mfc/s5p_mfc.c | 2 +- drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 3 +- drivers/media/platform/sti/hva/hva-hw.c | 5 +- drivers/media/platform/ti-vpe/cal.c | 6 +- drivers/media/platform/ti-vpe/vpe.c | 2 + drivers/media/platform/vivid/vivid-vid-out.c | 2 +- drivers/media/platform/vsp1/vsp1_drv.c | 15 +- + drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +- + drivers/media/radio/si470x/radio-si470x-usb.c | 2 +- drivers/media/rc/ati_remote.c | 4 + - drivers/media/rc/ite-cir.c | 8 +- + drivers/media/rc/ite-cir.c | 6 + + drivers/media/rc/mceusb.c | 1 + + drivers/media/rc/rc-loopback.c | 2 +- drivers/media/rc/sunxi-cir.c | 2 + drivers/media/tuners/m88rs6000t.c | 6 +- drivers/media/tuners/qm1d1c0042.c | 4 +- @@ -1044,14 +1311,20 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/media/usb/cpia2/cpia2_core.c | 12 + drivers/media/usb/cpia2/cpia2_usb.c | 13 +- drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +- + drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 11 +- + drivers/media/usb/dvb-usb/az6027.c | 1 + drivers/media/usb/dvb-usb/cxusb.c | 2 +- + drivers/media/usb/dvb-usb/dibusb-common.c | 2 +- drivers/media/usb/dvb-usb/dibusb-mb.c | 2 +- drivers/media/usb/dvb-usb/dtv5100.c | 7 +- drivers/media/usb/dvb-usb/dvb-usb-init.c | 20 +- drivers/media/usb/dvb-usb/dvb-usb.h | 3 +- drivers/media/usb/dvb-usb/friio-fe.c | 24 - drivers/media/usb/dvb-usb/gp8psk.c | 2 +- + drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 +- + drivers/media/usb/dvb-usb/vp702x.c | 12 +- drivers/media/usb/em28xx/em28xx-dvb.c | 1 + + drivers/media/usb/go7007/go7007-driver.c | 26 - drivers/media/usb/go7007/go7007-usb.c | 4 +- drivers/media/usb/go7007/snd-go7007.c | 35 +- drivers/media/usb/gspca/gspca.c | 3 + @@ -1062,22 +1335,27 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/media/usb/gspca/sunplus.c | 8 +- drivers/media/usb/msi2500/msi2500.c | 2 +- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 4 +- + drivers/media/usb/stkwebcam/stk-webcam.c | 6 +- drivers/media/usb/tm6000/tm6000-dvb.c | 4 + drivers/media/usb/usbtv/usbtv-audio.c | 2 +- drivers/media/usb/usbtv/usbtv-core.c | 3 +- drivers/media/usb/uvc/uvc_driver.c | 7 +- - drivers/media/usb/uvc/uvc_v4l2.c | 30 + + drivers/media/usb/uvc/uvc_v4l2.c | 71 +- drivers/media/usb/uvc/uvc_video.c | 27 + drivers/media/usb/zr364xx/zr364xx.c | 1 + drivers/media/v4l2-core/v4l2-fh.c | 1 + drivers/media/v4l2-core/v4l2-ioctl.c | 19 +- + drivers/media/v4l2-core/videobuf2-core.c | 13 +- drivers/memory/emif.c | 33 +- drivers/memory/fsl-corenet-cf.c | 6 +- - drivers/memory/fsl_ifc.c | 8 +- + drivers/memory/fsl_ifc.c | 21 +- drivers/memory/omap-gpmc.c | 11 +- drivers/memstick/core/memstick.c | 1 - - drivers/memstick/host/r592.c | 12 +- + drivers/memstick/core/ms_block.c | 2 +- + drivers/memstick/host/jmb38x_ms.c | 2 +- + drivers/memstick/host/r592.c | 20 +- drivers/message/fusion/mptscsih.c | 17 +- + drivers/mfd/ab8500-core.c | 2 +- drivers/mfd/arizona-core.c | 18 + drivers/mfd/da9052-i2c.c | 1 + drivers/mfd/dln2.c | 4 + @@ -1085,9 +1363,13 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/mfd/rtsx_pcr.c | 4 +- drivers/mfd/sm501.c | 8 +- drivers/mfd/stmpe-i2c.c | 2 +- + drivers/mfd/stmpe.c | 4 +- + drivers/mfd/tc3589x.c | 2 +- drivers/mfd/wm831x-auxadc.c | 3 +- drivers/mfd/wm8994-core.c | 1 + + drivers/mfd/wm8994-irq.c | 2 +- drivers/misc/atmel-ssc.c | 24 +- + drivers/misc/cb710/sgbuf2.c | 2 +- drivers/misc/cxl/sysfs.c | 2 +- drivers/misc/eeprom/at25.c | 2 +- drivers/misc/eeprom/eeprom_93xx46.c | 16 + @@ -1107,20 +1389,25 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/misc/vmw_vmci/vmci_context.c | 2 +- drivers/misc/vmw_vmci/vmci_doorbell.c | 2 +- drivers/misc/vmw_vmci/vmci_guest.c | 2 +- - drivers/misc/vmw_vmci/vmci_queue_pair.c | 15 +- + drivers/misc/vmw_vmci/vmci_queue_pair.c | 21 +- drivers/mmc/core/core.c | 11 +- drivers/mmc/core/host.c | 10 + drivers/mmc/core/mmc.c | 14 +- drivers/mmc/core/sd.c | 6 + drivers/mmc/core/sdio_cis.c | 9 + + drivers/mmc/host/Kconfig | 2 +- + drivers/mmc/host/dw_mmc-exynos.c | 14 + + drivers/mmc/host/dw_mmc.c | 25 +- + drivers/mmc/host/moxart-mmc.c | 1 + drivers/mmc/host/mtk-sd.c | 18 +- - drivers/mmc/host/mxs-mmc.c | 2 +- + drivers/mmc/host/mxs-mmc.c | 12 +- + drivers/mmc/host/rtsx_pci_sdmmc.c | 36 +- drivers/mmc/host/sdhci-esdhc-imx.c | 5 +- - drivers/mmc/host/sdhci.c | 4 + + drivers/mmc/host/sdhci.c | 10 + drivers/mmc/host/sdhci.h | 1 + drivers/mmc/host/usdhi6rol0.c | 5 +- drivers/mmc/host/via-sdmmc.c | 6 + - drivers/mmc/host/vub300.c | 2 +- + drivers/mmc/host/vub300.c | 20 +- drivers/mtd/chips/cfi_cmdset_0002.c | 1 - drivers/mtd/cmdlinepart.c | 35 +- drivers/mtd/devices/msm_qpic_nand.c | 84 +- @@ -1128,12 +1415,12 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/mtd/mtdchar.c | 56 +- drivers/mtd/mtdoops.c | 11 +- drivers/mtd/nand/ams-delta.c | 2 +- - drivers/mtd/nand/atmel_nand.c | 2 +- + drivers/mtd/nand/atmel_nand.c | 3 +- drivers/mtd/nand/au1550nd.c | 2 +- drivers/mtd/nand/bcm47xxnflash/main.c | 2 +- drivers/mtd/nand/bf5xx_nand.c | 2 +- drivers/mtd/nand/brcmnand/brcmnand.c | 18 +- - drivers/mtd/nand/cafe_nand.c | 2 +- + drivers/mtd/nand/cafe_nand.c | 6 +- drivers/mtd/nand/cmx270_nand.c | 2 +- drivers/mtd/nand/cs553x_nand.c | 2 +- drivers/mtd/nand/davinci_nand.c | 2 +- @@ -1176,11 +1463,12 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/mtd/nand/vf610_nfc.c | 2 +- drivers/mtd/nand/xway_nand.c | 4 +- drivers/mtd/spi-nor/cadence-quadspi.c | 2 +- - drivers/mtd/spi-nor/hisi-sfc.c | 4 +- + drivers/mtd/spi-nor/hisi-sfc.c | 5 +- drivers/mtd/ubi/wl.c | 13 + drivers/net/appletalk/cops.c | 4 +- drivers/net/bonding/bond_main.c | 88 +- - drivers/net/bonding/bond_sysfs_slave.c | 18 +- + drivers/net/bonding/bond_options.c | 2 +- + drivers/net/bonding/bond_sysfs_slave.c | 54 +- drivers/net/caif/caif_serial.c | 2 +- drivers/net/can/c_can/c_can.c | 24 +- drivers/net/can/c_can/c_can_pci.c | 3 +- @@ -1188,25 +1476,38 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/net/can/dev.c | 21 +- drivers/net/can/flexcan.c | 20 +- drivers/net/can/m_can/m_can.c | 7 +- + drivers/net/can/pch_can.c | 2 +- + drivers/net/can/rcar/rcar_can.c | 20 +- + drivers/net/can/sja1000/ems_pcmcia.c | 7 +- + drivers/net/can/sja1000/peak_pci.c | 9 +- drivers/net/can/softing/softing_main.c | 9 +- - drivers/net/can/usb/ems_usb.c | 3 +- + drivers/net/can/usb/ems_usb.c | 17 +- + drivers/net/can/usb/esd_usb2.c | 20 +- drivers/net/can/usb/gs_usb.c | 131 +- - drivers/net/can/usb/kvaser_usb.c | 6 +- + drivers/net/can/usb/kvaser_usb.c | 47 +- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 57 +- - drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 48 +- - drivers/net/dsa/b53/b53_common.c | 24 +- + drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 53 +- + drivers/net/can/usb/usb_8dev.c | 15 +- + drivers/net/dsa/b53/b53_common.c | 27 +- drivers/net/dsa/b53/b53_regs.h | 1 + drivers/net/dsa/bcm_sf2.c | 21 +- drivers/net/dsa/bcm_sf2_regs.h | 2 + + drivers/net/ethernet/Kconfig | 1 + drivers/net/ethernet/aeroflex/greth.c | 3 +- drivers/net/ethernet/allwinner/sun4i-emac.c | 11 +- + drivers/net/ethernet/altera/altera_tse_main.c | 9 +- drivers/net/ethernet/amazon/ena/ena_com.c | 6 +- drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 +- drivers/net/ethernet/amd/pcnet32.c | 5 +- + drivers/net/ethernet/arc/Kconfig | 1 + drivers/net/ethernet/arc/emac_mdio.c | 1 + drivers/net/ethernet/atheros/alx/main.c | 18 +- drivers/net/ethernet/broadcom/b44.c | 3 +- + drivers/net/ethernet/broadcom/bcmsysport.c | 5 + + drivers/net/ethernet/broadcom/bcmsysport.h | 1 + drivers/net/ethernet/broadcom/bnx2.c | 2 +- + .../net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +- + .../ethernet/broadcom/bnx2x/bnx2x_init_ops.h | 4 +- .../net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 31 +- @@ -1218,6 +1519,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 .../ethernet/cavium/liquidio/cn23xx_pf_regs.h | 2 +- .../ethernet/cavium/liquidio/cn66xx_regs.h | 2 +- .../ethernet/cavium/thunder/nicvf_queues.c | 2 +- + drivers/net/ethernet/chelsio/cxgb/cxgb2.c | 1 + drivers/net/ethernet/chelsio/cxgb3/sge.c | 1 + .../ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 2 +- .../net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c | 18 +- @@ -1228,12 +1530,15 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/net/ethernet/cisco/enic/enic_main.c | 27 +- drivers/net/ethernet/davicom/dm9000.c | 27 +- drivers/net/ethernet/dec/tulip/de2104x.c | 2 +- + drivers/net/ethernet/dec/tulip/de4x5.c | 34 +- + drivers/net/ethernet/dec/tulip/winbond-840.c | 7 +- drivers/net/ethernet/ec_bhf.c | 4 +- drivers/net/ethernet/emulex/benet/be_main.c | 1 + drivers/net/ethernet/ethoc.c | 3 +- drivers/net/ethernet/ezchip/nps_enet.c | 4 +- drivers/net/ethernet/faraday/ftgmac100.c | 4 + - drivers/net/ethernet/freescale/fec_main.c | 4 +- + drivers/net/ethernet/freescale/fec.h | 3 + + drivers/net/ethernet/freescale/fec_main.c | 8 +- drivers/net/ethernet/freescale/fec_ptp.c | 11 + drivers/net/ethernet/freescale/fman/fman.c | 3 +- .../net/ethernet/freescale/fman/fman_dtsec.c | 4 +- @@ -1247,92 +1552,122 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/net/ethernet/freescale/ucc_geth.c | 2 +- drivers/net/ethernet/freescale/ucc_geth.h | 9 +- drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 + + .../ethernet/hisilicon/hns/hns_dsaf_misc.c | 4 + drivers/net/ethernet/hisilicon/hns/hns_enet.c | 9 +- .../net/ethernet/hisilicon/hns/hns_ethtool.c | 4 + + drivers/net/ethernet/i825xx/82596.c | 2 +- drivers/net/ethernet/ibm/ehea/ehea_main.c | 9 +- drivers/net/ethernet/ibm/ibmveth.c | 13 +- drivers/net/ethernet/ibm/ibmvnic.c | 41 +- - drivers/net/ethernet/intel/e100.c | 12 +- + drivers/net/ethernet/intel/e100.c | 34 +- drivers/net/ethernet/intel/e1000/e1000_main.c | 22 +- drivers/net/ethernet/intel/e1000e/82571.c | 2 + drivers/net/ethernet/intel/e1000e/e1000.h | 1 - + drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +- + drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 + drivers/net/ethernet/intel/e1000e/netdev.c | 33 +- drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 1 + .../net/ethernet/intel/i40e/i40e_adminq_cmd.h | 2 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 35 +- - drivers/net/ethernet/intel/i40e/i40e_main.c | 60 +- + drivers/net/ethernet/intel/i40e/i40e_main.c | 62 +- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 +- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 32 +- - .../net/ethernet/intel/i40evf/i40evf_main.c | 1 + + .../net/ethernet/intel/i40evf/i40evf_main.c | 3 +- drivers/net/ethernet/intel/igb/igb_ethtool.c | 3 +- drivers/net/ethernet/intel/igb/igb_main.c | 21 +- + drivers/net/ethernet/intel/igbvf/netdev.c | 1 + drivers/net/ethernet/intel/ixgbe/ixgbe.h | 1 + .../net/ethernet/intel/ixgbe/ixgbe_common.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 11 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 27 + + drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 3 + drivers/net/ethernet/korina.c | 5 +- + drivers/net/ethernet/marvell/mvneta.c | 2 +- drivers/net/ethernet/marvell/pxa168_eth.c | 2 +- drivers/net/ethernet/marvell/sky2.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 1 + - .../net/ethernet/mellanox/mlx4/en_ethtool.c | 6 +- - .../net/ethernet/mellanox/mlx4/en_netdev.c | 22 +- + .../net/ethernet/mellanox/mlx4/en_ethtool.c | 12 +- + .../net/ethernet/mellanox/mlx4/en_netdev.c | 25 +- drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +- drivers/net/ethernet/mellanox/mlx4/fw.h | 4 +- - drivers/net/ethernet/mellanox/mlx4/main.c | 2 + + drivers/net/ethernet/mellanox/mlx4/main.c | 3 + drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 8 +- drivers/net/ethernet/mellanox/mlx4/mr.c | 2 +- drivers/net/ethernet/mellanox/mlx4/port.c | 107 +- .../ethernet/mellanox/mlx4/resource_tracker.c | 1 + .../net/ethernet/mellanox/mlx5/core/en_fs.c | 1 + .../net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- + .../net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +- .../ethernet/mellanox/mlx5/core/pagealloc.c | 21 +- drivers/net/ethernet/mellanox/mlxsw/core.c | 13 +- drivers/net/ethernet/micrel/ks8842.c | 4 + + .../ethernet/microchip/encx24j600-regmap.c | 10 +- + drivers/net/ethernet/microchip/encx24j600.c | 5 +- + .../net/ethernet/microchip/encx24j600_hw.h | 4 +- drivers/net/ethernet/moxa/moxart_ether.c | 4 +- .../net/ethernet/myricom/myri10ge/myri10ge.c | 1 + - drivers/net/ethernet/nxp/lpc_eth.c | 3 +- + drivers/net/ethernet/natsemi/natsemi.c | 8 +- + drivers/net/ethernet/natsemi/xtsonic.c | 2 +- + drivers/net/ethernet/neterion/s2io.c | 2 +- + .../net/ethernet/neterion/vxge/vxge-main.c | 6 +- + drivers/net/ethernet/nxp/lpc_eth.c | 8 +- .../ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 29 +- drivers/net/ethernet/pasemi/pasemi_mac.c | 8 +- .../ethernet/qlogic/netxen/netxen_nic_main.c | 9 +- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 4 +- drivers/net/ethernet/qlogic/qed/qed_int.c | 3 +- + drivers/net/ethernet/qlogic/qed/qed_main.c | 7 +- drivers/net/ethernet/qlogic/qed/qed_vf.c | 23 +- - drivers/net/ethernet/qlogic/qla3xxx.c | 2 +- + drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- + drivers/net/ethernet/qlogic/qla3xxx.c | 27 +- + .../ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 14 +- .../ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 +- .../ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 3 +- + .../net/ethernet/qlogic/qlcnic/qlcnic_init.c | 1 - .../net/ethernet/qlogic/qlcnic/qlcnic_main.c | 2 + .../ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 + + .../net/ethernet/qlogic/qlcnic/qlcnic_sriov.h | 2 +- + .../qlogic/qlcnic/qlcnic_sriov_common.c | 12 +- + .../ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c | 4 +- drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +- drivers/net/ethernet/qualcomm/emac/emac.c | 20 +- + drivers/net/ethernet/rdc/r6040.c | 9 +- drivers/net/ethernet/realtek/r8169.c | 110 +- drivers/net/ethernet/renesas/ravb_main.c | 36 +- - drivers/net/ethernet/renesas/sh_eth.c | 8 +- + drivers/net/ethernet/renesas/sh_eth.c | 9 +- drivers/net/ethernet/rocker/rocker_main.c | 4 +- drivers/net/ethernet/sfc/ef10_sriov.c | 25 +- + drivers/net/ethernet/sfc/ptp.c | 4 +- + drivers/net/ethernet/sfc/siena_sriov.c | 2 +- + drivers/net/ethernet/sis/sis900.c | 7 +- + drivers/net/ethernet/smsc/smc911x.c | 5 + drivers/net/ethernet/smsc/smc91x.c | 4 +- - .../ethernet/stmicro/stmmac/dwmac-ipq806x.c | 3 + + .../ethernet/stmicro/stmmac/dwmac-ipq806x.c | 21 +- .../ethernet/stmicro/stmmac/dwmac-meson8b.c | 6 +- .../net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 8 +- .../net/ethernet/stmicro/stmmac/dwmac1000.h | 8 +- .../ethernet/stmicro/stmmac/dwmac1000_core.c | 3 + .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 15 +- - .../net/ethernet/stmicro/stmmac/stmmac_main.c | 13 +- - drivers/net/ethernet/sun/niu.c | 34 +- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 15 +- + drivers/net/ethernet/sun/niu.c | 35 +- drivers/net/ethernet/sun/sunvnet_common.c | 24 +- drivers/net/ethernet/tehuti/tehuti.c | 1 + - drivers/net/ethernet/ti/davinci_emac.c | 4 +- + drivers/net/ethernet/ti/davinci_emac.c | 20 +- drivers/net/ethernet/ti/netcp_core.c | 2 +- drivers/net/ethernet/ti/tlan.c | 3 +- drivers/net/ethernet/toshiba/spider_net.c | 4 +- - drivers/net/ethernet/xilinx/ll_temac_main.c | 5 + + drivers/net/ethernet/wiznet/w5100.c | 2 + + drivers/net/ethernet/xilinx/ll_temac_main.c | 3 + + drivers/net/ethernet/xilinx/xilinx_emaclite.c | 5 +- drivers/net/fddi/Kconfig | 15 +- drivers/net/fddi/defxx.c | 47 +- - drivers/net/fjes/fjes_main.c | 4 + + drivers/net/fjes/fjes_main.c | 9 + drivers/net/geneve.c | 36 +- drivers/net/gtp.c | 5 +- - drivers/net/hamradio/mkiss.c | 1 + + drivers/net/hamradio/6pack.c | 10 +- + drivers/net/hamradio/mkiss.c | 6 +- drivers/net/hamradio/yam.c | 1 + drivers/net/hippi/rrunner.c | 2 +- drivers/net/ieee802154/adf7242.c | 4 +- @@ -1342,31 +1677,42 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/net/macvlan.c | 4 + drivers/net/phy/Kconfig | 1 + drivers/net/phy/dp83640.c | 4 + + drivers/net/phy/dp83640_reg.h | 2 +- drivers/net/phy/mdio-bcm-unimac.c | 2 + + drivers/net/phy/mdio-mux.c | 6 +- drivers/net/phy/mdio-octeon.c | 2 - drivers/net/phy/mdio-thunder.c | 1 - - drivers/net/phy/mdio_bus.c | 3 +- + drivers/net/phy/mdio_bus.c | 10 +- + drivers/net/phy/mdio_device.c | 11 + + drivers/net/phy/micrel.c | 5 +- drivers/net/phy/phy_device.c | 3 +- + drivers/net/ppp/ppp_generic.c | 21 +- drivers/net/team/team.c | 3 +- - drivers/net/tun.c | 48 + + drivers/net/tun.c | 53 + + drivers/net/usb/Kconfig | 4 + drivers/net/usb/asix_common.c | 2 +- drivers/net/usb/ax88172a.c | 1 + drivers/net/usb/ax88179_178a.c | 15 +- drivers/net/usb/cdc-phonet.c | 2 + drivers/net/usb/cdc_eem.c | 2 +- - drivers/net/usb/cdc_ncm.c | 25 +- + drivers/net/usb/cdc_mbim.c | 5 + + drivers/net/usb/cdc_ncm.c | 27 +- drivers/net/usb/dm9601.c | 4 + - drivers/net/usb/hso.c | 47 +- + drivers/net/usb/hso.c | 104 +- drivers/net/usb/ipheth.c | 2 +- - drivers/net/usb/lan78xx.c | 113 +- + drivers/net/usb/lan78xx.c | 136 +- + drivers/net/usb/pegasus.c | 14 +- drivers/net/usb/qmi_wwan.c | 14 +- - drivers/net/usb/r8152.c | 2 +- + drivers/net/usb/r8152.c | 5 +- drivers/net/usb/rndis_host.c | 4 +- drivers/net/usb/rtl8150.c | 16 +- drivers/net/usb/smsc75xx.c | 12 +- drivers/net/usb/smsc95xx.c | 11 +- + drivers/net/usb/usbnet.c | 5 + drivers/net/virtio_net.c | 12 +- + drivers/net/vmxnet3/vmxnet3_drv.c | 1 - drivers/net/vmxnet3/vmxnet3_ethtool.c | 2 + + drivers/net/vrf.c | 2 + drivers/net/vxlan.c | 16 +- drivers/net/wan/Kconfig | 1 + drivers/net/wan/cosa.c | 1 + @@ -1381,30 +1727,42 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/net/wan/x25_asy.c | 21 +- drivers/net/wimax/i2400m/op-rfkill.c | 2 +- drivers/net/wireless/ath/ar5523/ar5523.c | 2 + + drivers/net/wireless/ath/ath.h | 3 +- drivers/net/wireless/ath/ath10k/htt_rx.c | 77 +- drivers/net/wireless/ath/ath10k/hw.h | 2 +- - drivers/net/wireless/ath/ath10k/mac.c | 18 +- + drivers/net/wireless/ath/ath10k/mac.c | 24 +- + drivers/net/wireless/ath/ath10k/wmi.h | 3 + + drivers/net/wireless/ath/ath5k/mac80211-ops.c | 2 +- drivers/net/wireless/ath/ath6kl/main.c | 3 + - drivers/net/wireless/ath/ath6kl/wmi.c | 5 + + drivers/net/wireless/ath/ath6kl/usb.c | 7 +- + drivers/net/wireless/ath/ath6kl/wmi.c | 9 +- + .../net/wireless/ath/ath9k/ar9003_eeprom.c | 3 +- drivers/net/wireless/ath/ath9k/ath9k.h | 3 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 81 +- drivers/net/wireless/ath/ath9k/hif_usb.h | 6 + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 12 +- + drivers/net/wireless/ath/ath9k/htc_drv_main.c | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 8 + - drivers/net/wireless/ath/ath9k/hw.c | 2 +- - drivers/net/wireless/ath/ath9k/main.c | 5 + + drivers/net/wireless/ath/ath9k/hw.c | 14 +- + drivers/net/wireless/ath/ath9k/hw.h | 1 + + drivers/net/wireless/ath/ath9k/main.c | 104 +- drivers/net/wireless/ath/ath9k/wmi.c | 6 +- drivers/net/wireless/ath/ath9k/wmi.h | 3 +- drivers/net/wireless/ath/ath9k/xmit.c | 6 + drivers/net/wireless/ath/carl9170/Kconfig | 8 +- drivers/net/wireless/ath/carl9170/fw.c | 4 +- drivers/net/wireless/ath/carl9170/main.c | 21 +- - drivers/net/wireless/ath/wcn36xx/main.c | 2 +- + .../net/wireless/ath/dfs_pattern_detector.c | 10 +- + drivers/net/wireless/ath/key.c | 41 +- + drivers/net/wireless/ath/wcn36xx/main.c | 6 +- + drivers/net/wireless/ath/wcn36xx/smd.c | 44 +- drivers/net/wireless/ath/wil6210/Kconfig | 1 + drivers/net/wireless/broadcom/b43/main.c | 2 +- + drivers/net/wireless/broadcom/b43/phy_g.c | 2 +- drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- .../net/wireless/broadcom/b43legacy/main.c | 1 + + .../net/wireless/broadcom/b43legacy/radio.c | 2 +- .../net/wireless/broadcom/b43legacy/xmit.c | 1 + .../broadcom/brcm80211/brcmfmac/fwil_types.h | 2 +- .../broadcom/brcm80211/brcmfmac/msgbuf.c | 2 + @@ -1415,23 +1773,32 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 .../wireless/intel/iwlwifi/mvm/debugfs-vif.c | 3 + .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 3 +- + .../net/wireless/intel/iwlwifi/mvm/utils.c | 3 + .../net/wireless/intel/iwlwifi/pcie/trans.c | 38 +- drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 12 +- .../wireless/intersil/orinoco/orinoco_usb.c | 14 +- drivers/net/wireless/intersil/p54/p54pci.c | 4 +- + .../net/wireless/marvell/libertas/if_usb.c | 2 + drivers/net/wireless/marvell/libertas/mesh.c | 28 +- + .../net/wireless/marvell/libertas_tf/if_usb.c | 2 + + drivers/net/wireless/marvell/mwifiex/11n.c | 5 +- .../net/wireless/marvell/mwifiex/cfg80211.c | 14 +- - drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- + drivers/net/wireless/marvell/mwifiex/cmdevt.c | 4 +- + drivers/net/wireless/marvell/mwifiex/fw.h | 10 +- drivers/net/wireless/marvell/mwifiex/join.c | 2 + + drivers/net/wireless/marvell/mwifiex/pcie.c | 8 + drivers/net/wireless/marvell/mwifiex/scan.c | 2 +- drivers/net/wireless/marvell/mwifiex/sdio.c | 2 + .../wireless/marvell/mwifiex/sta_cmdresp.c | 24 +- - drivers/net/wireless/marvell/mwl8k.c | 1 + + drivers/net/wireless/marvell/mwifiex/usb.c | 16 + + drivers/net/wireless/marvell/mwl8k.c | 3 +- drivers/net/wireless/mediatek/mt7601u/dma.c | 5 +- .../net/wireless/mediatek/mt7601u/eeprom.c | 2 +- + .../realtek/rtl818x/rtl8187/rtl8225.c | 14 +- .../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 10 +- drivers/net/wireless/realtek/rtlwifi/base.c | 19 +- drivers/net/wireless/realtek/rtlwifi/usb.c | 13 +- + drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +- drivers/net/wireless/st/cw1200/cw1200_sdio.c | 1 + drivers/net/wireless/st/cw1200/main.c | 2 + drivers/net/wireless/ti/wl1251/cmd.c | 9 +- @@ -1441,13 +1808,15 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/net/wireless/ti/wlcore/wlcore.h | 3 - drivers/net/wireless/wl3501.h | 47 +- drivers/net/wireless/wl3501_cs.c | 54 +- - drivers/net/xen-netback/common.h | 15 + + drivers/net/xen-netback/common.h | 16 + drivers/net/xen-netback/interface.c | 63 +- - drivers/net/xen-netback/netback.c | 21 +- - drivers/net/xen-netback/rx.c | 22 +- + drivers/net/xen-netback/netback.c | 23 +- + drivers/net/xen-netback/rx.c | 83 +- drivers/net/xen-netback/xenbus.c | 14 +- - drivers/net/xen-netfront.c | 64 +- - drivers/nfc/pn533/pn533.c | 3 + + drivers/net/xen-netfront.c | 444 ++- + drivers/nfc/nfcsim.c | 3 +- + drivers/nfc/pn533/pn533.c | 9 +- + drivers/nfc/port100.c | 4 +- drivers/nfc/s3fwrn5/core.c | 1 + drivers/nfc/s3fwrn5/firmware.c | 4 +- drivers/nfc/s3fwrn5/i2c.c | 4 +- @@ -1455,25 +1824,32 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/ntb/hw/amd/ntb_hw_amd.c | 1 + drivers/nvdimm/dimm_devs.c | 18 +- drivers/nvdimm/nd.h | 1 - + drivers/nvme/host/pci.c | 7 +- drivers/nvme/target/core.c | 26 +- + drivers/nvmem/core.c | 3 +- drivers/of/address.c | 4 +- drivers/of/fdt.c | 8 +- drivers/of/of_reserved_mem.c | 21 +- + drivers/parisc/dino.c | 18 +- drivers/parisc/sba_iommu.c | 2 +- + drivers/parport/ieee1284_ops.c | 2 +- drivers/pci/access.c | 8 +- drivers/pci/bus.c | 6 +- - drivers/pci/host/pci-aardvark.c | 4 - + drivers/pci/host/pci-aardvark.c | 13 +- drivers/pci/host/pci-xgene-msi.c | 10 +- drivers/pci/host/pcie-rcar.c | 9 +- drivers/pci/hotplug/acpiphp_glue.c | 15 +- drivers/pci/hotplug/rpadlpar_sysfs.c | 14 +- + drivers/pci/msi.c | 146 +- drivers/pci/pci-label.c | 2 +- + drivers/pci/pci.c | 15 +- drivers/pci/pcie/aspm.c | 11 +- drivers/pci/pcie/ptm.c | 22 +- drivers/pci/probe.c | 25 +- - drivers/pci/quirks.c | 38 + + drivers/pci/quirks.c | 52 +- drivers/pci/slot.c | 12 +- - drivers/pci/syscall.c | 10 +- + drivers/pci/syscall.c | 14 +- + drivers/pcmcia/i82092.c | 1 + drivers/phy/phy-dm816x-usb.c | 17 +- drivers/phy/phy-s5pv210-usb2.c | 4 + drivers/phy/phy-twl4030-usb.c | 2 +- @@ -1487,35 +1863,42 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/pinctrl/pinctrl-amd.h | 2 +- drivers/pinctrl/pinctrl-falcon.c | 14 +- drivers/pinctrl/pinctrl-rockchip.c | 15 +- - drivers/pinctrl/pinctrl-single.c | 11 +- + drivers/pinctrl/pinctrl-single.c | 12 +- drivers/pinctrl/qcom/pinctrl-msm.c | 4 +- drivers/pinctrl/qcom/pinctrl-sdxpoorwills.c | 6 +- drivers/pinctrl/samsung/pinctrl-exynos.c | 9 + + drivers/platform/chrome/cros_ec_proto.c | 9 + drivers/platform/msm/ep_pcie/ep_pcie.c | 17 +- drivers/platform/msm/ep_pcie/ep_pcie_com.h | 61 +- - drivers/platform/msm/ep_pcie/ep_pcie_core.c | 976 ++++++++++- + drivers/platform/msm/ep_pcie/ep_pcie_core.c | 976 ++++- drivers/platform/msm/ep_pcie/ep_pcie_dbg.c | 4 +- drivers/platform/msm/ep_pcie/ep_pcie_phy.c | 31 +- drivers/platform/msm/ipa/ipa_v2/ipa_flt.c | 2 +- drivers/platform/msm/ipa/ipa_v2/ipa_i.h | 2 +- - drivers/platform/msm/ipa/ipa_v3/ipa_flt.c | 5 +- + drivers/platform/msm/ipa/ipa_v3/ipa_flt.c | 7 +- + drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c | 11 +- drivers/platform/msm/ipa/ipa_v3/ipa_i.h | 2 + drivers/platform/msm/ipa/ipa_v3/ipa_mhi.c | 11 +- drivers/platform/msm/ipa/ipa_v3/ipa_rt.c | 5 +- + .../platform/msm/ipa/ipa_v3/ipahal/ipahal.c | 76 +- + .../platform/msm/ipa/ipa_v3/ipahal/ipahal.h | 8 +- .../msm/ipa/ipa_v3/ipahal/ipahal_fltrt.c | 15 +- .../msm/ipa/ipa_v3/ipahal/ipahal_fltrt.h | 5 +- .../msm/ipa/ipa_v3/ipahal/ipahal_fltrt_i.h | 3 +- + .../platform/msm/ipa/ipa_v3/ipahal/ipahal_i.h | 3 +- drivers/platform/msm/mhi_dev/mhi.c | 10 +- drivers/platform/msm/mhi_dev/mhi_sm.c | 21 +- drivers/platform/msm/qcom-geni-se.c | 13 +- drivers/platform/msm/sps/bam.c | 16 +- drivers/platform/x86/acer-wmi.c | 9 +- - drivers/platform/x86/hp_accel.c | 22 +- + drivers/platform/x86/hp_accel.c | 24 +- drivers/platform/x86/intel-hid.c | 2 +- drivers/platform/x86/intel-vbtn.c | 2 +- drivers/platform/x86/intel_punit_ipc.c | 1 + - drivers/platform/x86/thinkpad_acpi.c | 37 +- + drivers/platform/x86/intel_scu_ipc.c | 2 +- + drivers/platform/x86/thinkpad_acpi.c | 51 +- drivers/platform/x86/toshiba_acpi.c | 4 +- + drivers/platform/x86/wmi.c | 9 +- drivers/power/reset/at91-sama5d2_shdwc.c | 2 +- drivers/power/reset/gpio-poweroff.c | 1 + drivers/power/reset/vexpress-poweroff.c | 1 + @@ -1524,16 +1907,19 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/power/supply/ab8500_btemp.c | 1 + drivers/power/supply/ab8500_charger.c | 19 +- drivers/power/supply/ab8500_fg.c | 1 + + drivers/power/supply/axp288_fuel_gauge.c | 4 +- + drivers/power/supply/bq27xxx_battery_i2c.c | 3 +- drivers/power/supply/charger-manager.c | 1 + drivers/power/supply/generic-adc-battery.c | 2 +- drivers/power/supply/lp8788-charger.c | 20 +- + drivers/power/supply/max17042_battery.c | 16 +- drivers/power/supply/pm2301_charger.c | 2 +- drivers/power/supply/qcom/qpnp-fg-gen3.c | 4 + .../power/supply/qcom/qpnp-linear-charger.c | 11 +- drivers/power/supply/qcom/qpnp-smb2.c | 11 + drivers/power/supply/qcom/smb-lib.c | 12 +- drivers/power/supply/qcom/smb-lib.h | 3 +- - drivers/power/supply/rt5033_battery.c | 7 + + drivers/power/supply/rt5033_battery.c | 9 +- drivers/power/supply/s3c_adc_battery.c | 2 +- drivers/power/supply/smb347-charger.c | 1 + drivers/power/supply/test_power.c | 6 + @@ -1541,7 +1927,9 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/power/supply/tps65217_charger.c | 2 +- drivers/powercap/powercap_sys.c | 4 +- drivers/ps3/ps3stor_lib.c | 2 +- + drivers/ptp/ptp_pch.c | 1 + drivers/pwm/pwm-bcm-iproc.c | 9 +- + drivers/pwm/pwm-lpc32xx.c | 10 +- drivers/pwm/pwm-rockchip.c | 1 - drivers/pwm/pwm-spear.c | 4 - drivers/pwm/pwm-tegra.c | 13 - @@ -1551,6 +1939,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/regulator/axp20x-regulator.c | 7 +- drivers/regulator/core.c | 105 +- drivers/regulator/da9052-regulator.c | 3 +- + drivers/regulator/s5m8767.c | 21 +- drivers/regulator/ti-abb-regulator.c | 12 +- drivers/remoteproc/qcom_q6v5_pil.c | 6 + drivers/reset/core.c | 5 +- @@ -1558,6 +1947,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/rtc/rtc-max77686.c | 4 +- drivers/rtc/rtc-proc.c | 4 +- drivers/rtc/rtc-rx8010.c | 24 +- + drivers/rtc/rtc-tps65910.c | 2 +- drivers/s390/block/dasd.c | 3 +- drivers/s390/block/dasd_alias.c | 22 +- drivers/s390/char/sclp_vt220.c | 4 +- @@ -1568,10 +1958,11 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/s390/cio/qdio_setup.c | 1 - drivers/s390/cio/qdio_thinint.c | 14 +- drivers/s390/net/qeth_l2_main.c | 4 + - drivers/scsi/BusLogic.c | 6 +- + drivers/scsi/BusLogic.c | 10 +- drivers/scsi/BusLogic.h | 2 +- drivers/scsi/FlashPoint.c | 32 +- drivers/scsi/aacraid/aachba.c | 8 +- + drivers/scsi/advansys.c | 4 +- drivers/scsi/aic7xxx/aic7xxx_core.c | 2 +- drivers/scsi/arm/acornscsi.c | 4 +- drivers/scsi/arm/cumana_2.c | 2 +- @@ -1581,7 +1972,10 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/scsi/bnx2fc/Kconfig | 1 + drivers/scsi/bnx2i/Kconfig | 1 + drivers/scsi/csiostor/csio_hw.c | 2 +- + drivers/scsi/csiostor/csio_lnode.c | 2 +- + drivers/scsi/dc395x.c | 1 + drivers/scsi/device_handler/scsi_dh_alua.c | 14 +- + drivers/scsi/device_handler/scsi_dh_rdac.c | 4 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/fnic/fnic_main.c | 1 + drivers/scsi/gdth.h | 3 - @@ -1594,7 +1988,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/scsi/libfc/fc_disc.c | 12 +- drivers/scsi/libfc/fc_exch.c | 16 +- drivers/scsi/libfc/fc_lport.c | 2 +- - drivers/scsi/libiscsi.c | 189 ++- + drivers/scsi/libiscsi.c | 189 +- drivers/scsi/libsas/sas_ata.c | 6 +- drivers/scsi/libsas/sas_port.c | 4 +- drivers/scsi/lpfc/lpfc_ct.c | 137 +- @@ -1602,35 +1996,45 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/scsi/lpfc/lpfc_els.c | 15 +- drivers/scsi/lpfc/lpfc_hw.h | 36 +- drivers/scsi/lpfc/lpfc_nportdisc.c | 2 - - drivers/scsi/lpfc/lpfc_sli.c | 5 +- + drivers/scsi/lpfc/lpfc_sli.c | 6 +- drivers/scsi/lpfc/lpfc_vport.c | 26 +- + drivers/scsi/megaraid/megaraid_mm.c | 21 +- drivers/scsi/mesh.c | 8 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 +- - drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 6 +- drivers/scsi/mvumi.c | 1 + drivers/scsi/pm8001/pm8001_init.c | 3 +- drivers/scsi/pm8001/pm8001_sas.c | 2 +- drivers/scsi/qla2xxx/qla_attr.c | 8 +- + drivers/scsi/qla2xxx/qla_gbl.h | 2 - + drivers/scsi/qla2xxx/qla_mr.c | 23 - drivers/scsi/qla2xxx/qla_nx.c | 3 +- + drivers/scsi/qla2xxx/qla_os.c | 27 +- drivers/scsi/qla2xxx/qla_target.c | 2 + drivers/scsi/qla2xxx/qla_target.h | 2 +- drivers/scsi/qla2xxx/qla_tmpl.c | 9 +- drivers/scsi/qla2xxx/qla_tmpl.h | 2 +- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 2 + drivers/scsi/qla4xxx/ql4_os.c | 2 +- - drivers/scsi/scsi_debug.c | 6 + + drivers/scsi/scsi.c | 4 +- + drivers/scsi/scsi_debug.c | 10 +- drivers/scsi/scsi_devinfo.c | 5 +- drivers/scsi/scsi_lib.c | 5 +- - drivers/scsi/scsi_scan.c | 7 +- - drivers/scsi/scsi_transport_iscsi.c | 142 +- + drivers/scsi/scsi_scan.c | 10 +- + drivers/scsi/scsi_sysfs.c | 9 + + drivers/scsi/scsi_transport_iscsi.c | 154 +- drivers/scsi/scsi_transport_spi.c | 2 +- + drivers/scsi/sd.c | 9 +- + drivers/scsi/ses.c | 2 +- drivers/scsi/sni_53c710.c | 5 +- drivers/scsi/sr.c | 8 +- drivers/scsi/st.c | 2 +- drivers/scsi/sun3x_esp.c | 4 +- drivers/scsi/ufs/ufs_quirks.h | 1 + drivers/scsi/ufs/ufshcd.c | 56 +- + drivers/scsi/virtio_scsi.c | 4 +- drivers/scsi/vmw_pvscsi.c | 8 +- + drivers/sh/maple/maple.c | 5 +- drivers/soc/fsl/qbman/qman.c | 2 +- drivers/soc/qcom/bgcom_interface.c | 6 +- drivers/soc/qcom/bgcom_spi.c | 6 +- @@ -1642,11 +2046,15 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/soc/qcom/peripheral-loader.c | 11 +- drivers/soc/qcom/rpmh_master_stat.c | 7 +- drivers/soc/qcom/smp2p.c | 5 +- + drivers/soc/qcom/smsm.c | 11 +- + drivers/soc/tegra/fuse/fuse-tegra.c | 2 +- + drivers/soc/tegra/fuse/fuse.h | 2 +- drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +- + drivers/soc/tegra/pmc.c | 4 +- drivers/soc/ti/knav_dma.c | 13 +- drivers/soc/ti/knav_qmss_queue.c | 4 +- drivers/spi/Kconfig | 3 + - drivers/spi/spi-bcm-qspi.c | 42 +- + drivers/spi/spi-bcm-qspi.c | 47 +- drivers/spi/spi-bcm2835.c | 26 +- drivers/spi/spi-bcm2835aux.c | 21 +- drivers/spi/spi-cadence.c | 6 +- @@ -1657,9 +2065,10 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/spi/spi-fsl-dspi.c | 2 +- drivers/spi/spi-img-spfi.c | 4 +- drivers/spi/spi-loopback-test.c | 4 +- - drivers/spi/spi-mt65xx.c | 16 +- + drivers/spi/spi-mt65xx.c | 17 +- drivers/spi/spi-omap-100k.c | 8 +- - drivers/spi/spi-pic32.c | 1 + + drivers/spi/spi-pic32.c | 2 + + drivers/spi/spi-pl022.c | 5 +- drivers/spi/spi-pxa2xx-pci.c | 27 +- drivers/spi/spi-pxa2xx.c | 7 +- drivers/spi/spi-rb4xx.c | 2 +- @@ -1670,16 +2079,18 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/spi/spi-sun6i.c | 20 +- drivers/spi/spi-tegra114.c | 2 + drivers/spi/spi-tegra20-sflash.c | 1 + - drivers/spi/spi-tegra20-slink.c | 2 + + drivers/spi/spi-tegra20-slink.c | 6 +- drivers/spi/spi-ti-qspi.c | 1 + drivers/spi/spi-topcliff-pch.c | 4 +- drivers/spi/spi.c | 73 +- - drivers/spi/spi_qsd.c | 204 ++- + drivers/spi/spi_qsd.c | 204 +- drivers/spi/spi_qsd.h | 3 +- drivers/spi/spidev.c | 24 +- drivers/ssb/sdio.c | 1 - + drivers/staging/android/ion/ion.c | 49 +- drivers/staging/android/ion/ion_heap.c | 4 +- drivers/staging/android/vsoc.c | 3 +- + drivers/staging/board/board.c | 7 +- .../staging/comedi/drivers/addi_apci_1032.c | 24 +- .../staging/comedi/drivers/addi_apci_1500.c | 52 +- .../staging/comedi/drivers/addi_apci_1564.c | 20 +- @@ -1689,12 +2100,14 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/staging/comedi/drivers/das6402.c | 2 +- drivers/staging/comedi/drivers/das800.c | 2 +- drivers/staging/comedi/drivers/dmm32at.c | 2 +- + drivers/staging/comedi/drivers/dt9812.c | 115 +- drivers/staging/comedi/drivers/me4000.c | 2 +- drivers/staging/comedi/drivers/mf6x4.c | 3 +- drivers/staging/comedi/drivers/ni_6527.c | 2 +- + drivers/staging/comedi/drivers/ni_usb6501.c | 10 + drivers/staging/comedi/drivers/pcl711.c | 2 +- drivers/staging/comedi/drivers/pcl818.c | 2 +- - drivers/staging/comedi/drivers/vmk80xx.c | 3 + + drivers/staging/comedi/drivers/vmk80xx.c | 31 +- drivers/staging/emxx_udc/emxx_udc.c | 4 +- drivers/staging/fsl-mc/bus/mc-io.c | 7 +- drivers/staging/fwserial/fwserial.c | 2 + @@ -1702,9 +2115,10 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/staging/greybus/audio_codec.c | 2 + drivers/staging/greybus/audio_topology.c | 29 +- drivers/staging/greybus/sdio.c | 10 +- - drivers/staging/greybus/uart.c | 2 - + drivers/staging/greybus/uart.c | 64 +- drivers/staging/iio/cdc/ad7746.c | 1 - drivers/staging/iio/light/tsl2583.c | 9 + + drivers/staging/ks7010/ks7010_sdio.c | 2 +- drivers/staging/ks7010/ks_wlan_net.c | 6 +- drivers/staging/media/cec/cec-api.c | 8 +- drivers/staging/media/omap4iss/iss.c | 4 +- @@ -1716,13 +2130,15 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/staging/rtl8188eu/core/rtw_ap.c | 5 + .../staging/rtl8188eu/os_dep/ioctl_linux.c | 6 +- drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + + drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 +- drivers/staging/rtl8192e/rtl8192e/rtl_wx.c | 7 +- drivers/staging/rtl8192e/rtllib.h | 2 +- drivers/staging/rtl8192e/rtllib_rx.c | 2 +- - drivers/staging/rtl8192u/r8192U_core.c | 4 +- + drivers/staging/rtl8192u/r8192U_core.c | 22 +- drivers/staging/rtl8192u/r8192U_wx.c | 6 +- drivers/staging/rtl8712/rtl871x_cmd.c | 6 +- drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 2 +- + drivers/staging/rtl8712/usb_ops_linux.c | 2 +- drivers/staging/sm750fb/sm750.c | 1 + drivers/staging/speakup/speakup_dectlk.c | 2 +- drivers/staging/wlan-ng/hfa384x_usb.c | 5 - @@ -1731,58 +2147,74 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/target/iscsi/iscsi_target_login.c | 6 +- drivers/target/iscsi/iscsi_target_login.h | 3 +- drivers/target/iscsi/iscsi_target_nego.c | 3 +- + drivers/target/target_core_alua.c | 1 - + drivers/target/target_core_device.c | 2 + + drivers/target/target_core_internal.h | 1 + drivers/target/target_core_pscsi.c | 11 +- drivers/target/target_core_sbc.c | 35 +- - drivers/target/target_core_transport.c | 28 +- + drivers/target/target_core_transport.c | 104 +- drivers/target/target_core_user.c | 9 +- - drivers/target/target_core_xcopy.c | 220 ++- + drivers/target/target_core_xcopy.c | 220 +- drivers/target/target_core_xcopy.h | 1 + drivers/tee/tee_shm.c | 5 +- drivers/thermal/fair_share.c | 4 + drivers/thermal/hisi_thermal.c | 2 +- drivers/thermal/mtk_thermal.c | 6 +- - drivers/thermal/thermal_core.c | 2 +- + drivers/thermal/samsung/exynos_tmu.c | 1 + + drivers/thermal/thermal_core.c | 4 +- .../ti-soc-thermal/omap4-thermal-data.c | 23 +- .../thermal/ti-soc-thermal/omap4xxx-bandgap.h | 10 +- + drivers/tty/hvc/hvc_xen.c | 47 +- drivers/tty/hvc/hvcs.c | 14 +- + drivers/tty/hvc/hvsi.c | 19 +- drivers/tty/ipwireless/network.c | 4 +- drivers/tty/ipwireless/tty.c | 2 +- drivers/tty/n_gsm.c | 26 +- drivers/tty/nozomi.c | 9 +- drivers/tty/pty.c | 2 +- drivers/tty/serial/8250/8250_core.c | 13 +- + drivers/tty/serial/8250/8250_dw.c | 2 +- drivers/tty/serial/8250/8250_mtk.c | 20 +- drivers/tty/serial/8250/8250_omap.c | 13 +- - drivers/tty/serial/8250/8250_pci.c | 11 + - drivers/tty/serial/8250/8250_port.c | 25 +- + drivers/tty/serial/8250/8250_pci.c | 13 +- + drivers/tty/serial/8250/8250_port.c | 40 +- drivers/tty/serial/8250/serial_cs.c | 13 +- drivers/tty/serial/Kconfig | 1 + - drivers/tty/serial/amba-pl011.c | 17 +- + drivers/tty/serial/amba-pl011.c | 18 +- drivers/tty/serial/fsl_lpuart.c | 3 + drivers/tty/serial/imx.c | 20 +- + drivers/tty/serial/jsm/jsm_neo.c | 2 + + drivers/tty/serial/jsm/jsm_tty.c | 3 + drivers/tty/serial/max310x.c | 6 +- + drivers/tty/serial/msm_serial.c | 3 + drivers/tty/serial/msm_serial_hs.c | 4 +- + drivers/tty/serial/mvebu-uart.c | 2 +- drivers/tty/serial/rp2.c | 52 +- drivers/tty/serial/samsung.c | 16 +- - drivers/tty/serial/serial_core.c | 4 + + drivers/tty/serial/serial_core.c | 33 +- drivers/tty/serial/serial_txx9.c | 3 + drivers/tty/serial/sh-sci.c | 8 + drivers/tty/serial/stm32-usart.c | 12 +- - drivers/tty/tty_io.c | 59 +- + drivers/tty/serial/xilinx_uartps.c | 3 +- + drivers/tty/tty_buffer.c | 3 + + drivers/tty/tty_io.c | 63 +- drivers/tty/vt/consolemap.c | 2 +- drivers/tty/vt/keyboard.c | 39 +- - drivers/tty/vt/vt.c | 60 +- - drivers/tty/vt/vt_ioctl.c | 46 +- + drivers/tty/vt/vt.c | 81 +- + drivers/tty/vt/vt_ioctl.c | 57 +- drivers/uio/uio_pdrv_genirq.c | 2 +- + drivers/usb/Kconfig | 3 +- drivers/usb/c67x00/c67x00-sched.c | 2 +- drivers/usb/chipidea/ci_hdrc_imx.c | 9 +- - drivers/usb/chipidea/core.c | 24 + - drivers/usb/class/cdc-acm.c | 62 +- + drivers/usb/chipidea/core.c | 41 +- + drivers/usb/class/cdc-acm.c | 70 +- drivers/usb/class/cdc-wdm.c | 72 +- drivers/usb/class/usblp.c | 50 +- - drivers/usb/core/config.c | 11 + + drivers/usb/class/usbtmc.c | 8 +- + drivers/usb/common/usb-otg-fsm.c | 6 +- + drivers/usb/core/config.c | 17 +- drivers/usb/core/devio.c | 14 +- - drivers/usb/core/hub.c | 71 +- + drivers/usb/core/hub.c | 94 +- drivers/usb/core/hub.h | 6 +- drivers/usb/core/message.c | 91 +- drivers/usb/core/quirks.c | 60 +- @@ -1798,12 +2230,12 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/usb/dwc2/platform.c | 18 +- drivers/usb/dwc3/core.c | 2 +- drivers/usb/dwc3/core.h | 4 +- - drivers/usb/dwc3/dwc3-msm.c | 33 +- + drivers/usb/dwc3/dwc3-msm.c | 53 +- drivers/usb/dwc3/ep0.c | 3 + - drivers/usb/dwc3/gadget.c | 62 +- + drivers/usb/dwc3/gadget.c | 78 +- drivers/usb/dwc3/ulpi.c | 20 +- drivers/usb/gadget/Kconfig | 2 + - drivers/usb/gadget/composite.c | 86 +- + drivers/usb/gadget/composite.c | 108 +- drivers/usb/gadget/config.c | 8 + drivers/usb/gadget/configfs.c | 24 +- drivers/usb/gadget/function/f_accessory.c | 156 +- @@ -1827,13 +2259,16 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/usb/gadget/function/f_uac1.c | 2 + drivers/usb/gadget/function/f_uac2.c | 35 +- drivers/usb/gadget/function/f_uvc.c | 7 +- - drivers/usb/gadget/function/u_ether.c | 2 +- + drivers/usb/gadget/function/u_ether.c | 7 +- drivers/usb/gadget/function/uvc_video.c | 3 +- drivers/usb/gadget/legacy/acm_ms.c | 4 +- + drivers/usb/gadget/legacy/dbgp.c | 15 +- drivers/usb/gadget/legacy/ether.c | 4 +- - drivers/usb/gadget/legacy/hid.c | 4 +- - drivers/usb/gadget/legacy/inode.c | 3 + + drivers/usb/gadget/legacy/hid.c | 8 +- + drivers/usb/gadget/legacy/inode.c | 19 +- drivers/usb/gadget/u_f.h | 38 +- + drivers/usb/gadget/udc/Kconfig | 1 + + drivers/usb/gadget/udc/at91_udc.c | 4 +- drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +- drivers/usb/gadget/udc/bdc/Kconfig | 2 +- drivers/usb/gadget/udc/bdc/bdc_core.c | 4 + @@ -1845,10 +2280,11 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/usb/gadget/udc/gr_udc.c | 7 +- drivers/usb/gadget/udc/lpc32xx_udc.c | 11 +- drivers/usb/gadget/udc/m66592-udc.c | 2 +- + drivers/usb/gadget/udc/mv_u3d_core.c | 19 +- drivers/usb/gadget/udc/mv_udc_core.c | 3 +- drivers/usb/gadget/udc/net2280.c | 4 +- drivers/usb/gadget/udc/pch_udc.c | 49 +- - drivers/usb/gadget/udc/r8a66597-udc.c | 2 + + drivers/usb/gadget/udc/r8a66597-udc.c | 4 +- drivers/usb/gadget/udc/s3c2410_udc.c | 4 - drivers/usb/gadget/usbstring.c | 4 +- drivers/usb/host/ehci-exynos.c | 5 +- @@ -1857,27 +2293,31 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/usb/host/ehci-mv.c | 8 +- drivers/usb/host/ehci-mxc.c | 2 + drivers/usb/host/ehci-omap.c | 1 + - drivers/usb/host/ehci-pci.c | 7 + - drivers/usb/host/fotg210-hcd.c | 4 +- + drivers/usb/host/ehci-orion.c | 8 +- + drivers/usb/host/ehci-pci.c | 10 + + drivers/usb/host/fotg210-hcd.c | 45 +- + drivers/usb/host/fotg210.h | 5 - drivers/usb/host/fsl-mph-dr-of.c | 9 +- - drivers/usb/host/max3421-hcd.c | 44 +- + drivers/usb/host/max3421-hcd.c | 69 +- drivers/usb/host/ohci-exynos.c | 5 +- drivers/usb/host/ohci-hcd.c | 18 +- drivers/usb/host/ohci-sm501.c | 1 + + drivers/usb/host/ohci-tmio.c | 5 +- drivers/usb/host/oxu210hp-hcd.c | 4 +- drivers/usb/host/sl811-hcd.c | 9 +- drivers/usb/host/xhci-ext-caps.h | 5 +- - drivers/usb/host/xhci-hub.c | 26 +- + drivers/usb/host/xhci-hub.c | 29 +- drivers/usb/host/xhci-mem.c | 9 + drivers/usb/host/xhci-mtk-sch.c | 4 + drivers/usb/host/xhci-mtk.c | 10 +- - drivers/usb/host/xhci-pci.c | 3 + + drivers/usb/host/xhci-pci.c | 5 + drivers/usb/host/xhci-plat.c | 24 + drivers/usb/host/xhci-ring.c | 33 +- drivers/usb/host/xhci-tegra.c | 7 + - drivers/usb/host/xhci.c | 66 +- + drivers/usb/host/xhci.c | 42 +- drivers/usb/host/xhci.h | 2 +- drivers/usb/misc/adutux.c | 1 + + drivers/usb/misc/iowarrior.c | 8 +- drivers/usb/misc/lvstest.c | 2 +- drivers/usb/misc/sisusbvga/Kconfig | 2 +- drivers/usb/misc/sisusbvga/sisusb.c | 2 +- @@ -1886,42 +2326,50 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/usb/misc/uss720.c | 1 + drivers/usb/misc/yurex.c | 5 +- drivers/usb/musb/musb_core.c | 31 +- + drivers/usb/musb/musb_gadget.c | 4 +- + drivers/usb/musb/tusb6010.c | 6 + drivers/usb/pd/policy_engine.c | 53 +- + drivers/usb/phy/phy-fsl-usb.c | 2 + + drivers/usb/phy/phy-isp1301.c | 2 +- + drivers/usb/phy/phy-tahvo.c | 4 +- + drivers/usb/phy/phy-twl6030-usb.c | 5 + drivers/usb/renesas_usbhs/fifo.c | 9 + drivers/usb/renesas_usbhs/pipe.c | 2 + drivers/usb/serial/ch341.c | 7 +- - drivers/usb/serial/cp210x.c | 25 + + drivers/usb/serial/cp210x.c | 26 + drivers/usb/serial/cyberjack.c | 7 +- drivers/usb/serial/cypress_m8.c | 2 + drivers/usb/serial/cypress_m8.h | 3 + drivers/usb/serial/digi_acceleport.c | 45 +- - drivers/usb/serial/ftdi_sio.c | 47 +- - drivers/usb/serial/ftdi_sio_ids.h | 16 + + drivers/usb/serial/ftdi_sio.c | 48 +- + drivers/usb/serial/ftdi_sio_ids.h | 19 + drivers/usb/serial/io_edgeport.c | 26 +- drivers/usb/serial/iuu_phoenix.c | 42 +- + drivers/usb/serial/keyspan.c | 15 +- drivers/usb/serial/keyspan_pda.c | 65 +- drivers/usb/serial/kl5kusb105.c | 10 +- - drivers/usb/serial/mos7720.c | 6 +- - drivers/usb/serial/mos7840.c | 4 +- + drivers/usb/serial/mos7720.c | 10 +- + drivers/usb/serial/mos7840.c | 6 +- drivers/usb/serial/omninet.c | 2 + - drivers/usb/serial/option.c | 66 +- + drivers/usb/serial/option.c | 96 +- drivers/usb/serial/pl2303.c | 2 + drivers/usb/serial/pl2303.h | 2 + - drivers/usb/serial/qcserial.c | 1 + + drivers/usb/serial/qcserial.c | 2 + drivers/usb/serial/quatech2.c | 6 +- drivers/usb/serial/ti_usb_3410_5052.c | 3 + drivers/usb/storage/uas.c | 14 +- - drivers/usb/storage/unusual_devs.h | 2 +- + drivers/usb/storage/unusual_devs.h | 21 +- drivers/usb/storage/unusual_uas.h | 28 + drivers/usb/usbip/stub_dev.c | 49 +- drivers/usb/usbip/usbip_common.h | 3 + drivers/usb/usbip/usbip_event.c | 2 + - drivers/usb/usbip/vhci_hcd.c | 1 + + drivers/usb/usbip/vhci_hcd.c | 25 + drivers/usb/usbip/vhci_sysfs.c | 63 +- drivers/usb/usbip/vudc_dev.c | 1 + drivers/usb/usbip/vudc_sysfs.c | 55 +- + drivers/vfio/Kconfig | 2 +- drivers/vfio/pci/Kconfig | 1 + - drivers/vfio/pci/vfio_pci.c | 368 +++- + drivers/vfio/pci/vfio_pci.c | 368 +- drivers/vfio/pci/vfio_pci_config.c | 67 +- drivers/vfio/pci/vfio_pci_intrs.c | 18 +- drivers/vfio/pci/vfio_pci_private.h | 16 + @@ -1929,27 +2377,33 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/vfio/platform/vfio_platform_common.c | 2 +- drivers/vfio/vfio_iommu_type1.c | 36 +- drivers/vhost/net.c | 6 +- - drivers/vhost/vhost.c | 2 +- - drivers/vhost/vringh.c | 9 +- + drivers/vhost/vhost.c | 12 +- + drivers/vhost/vringh.c | 11 +- + drivers/vhost/vsock.c | 2 +- drivers/video/backlight/lm3630a_bl.c | 12 +- drivers/video/backlight/lp855x_bl.c | 20 +- drivers/video/backlight/sky81452-backlight.c | 1 + drivers/video/console/Kconfig | 25 - drivers/video/console/bitblit.c | 15 +- - drivers/video/console/fbcon.c | 373 +---- + drivers/video/console/fbcon.c | 373 +- drivers/video/console/fbcon.h | 9 +- drivers/video/console/fbcon_ccw.c | 15 +- drivers/video/console/fbcon_cw.c | 15 +- drivers/video/console/fbcon_rotate.c | 1 + drivers/video/console/fbcon_ud.c | 15 +- drivers/video/console/newport_con.c | 19 +- + drivers/video/console/sticon.c | 12 +- drivers/video/console/tileblit.c | 3 +- - drivers/video/console/vgacon.c | 211 +-- + drivers/video/console/vgacon.c | 223 +- drivers/video/fbdev/Kconfig | 2 +- + drivers/video/fbdev/asiliantfb.c | 3 + + drivers/video/fbdev/chipsfb.c | 2 +- drivers/video/fbdev/core/fbcmap.c | 8 +- + drivers/video/fbdev/core/fbmem.c | 11 + drivers/video/fbdev/hgafb.c | 21 +- drivers/video/fbdev/hyperv_fb.c | 5 +- drivers/video/fbdev/imsttfb.c | 5 - + drivers/video/fbdev/kyro/fbdev.c | 8 + drivers/video/fbdev/msm/mdp3_ctrl.c | 3 + drivers/video/fbdev/msm/mdss_spi_display.c | 1 - drivers/video/fbdev/msm/mdss_spi_panel.c | 2 + @@ -1963,18 +2417,20 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/video/fbdev/omap2/omapfb/dss/venc.c | 7 +- drivers/video/fbdev/pvr2fb.c | 2 + drivers/video/fbdev/pxafb.c | 4 +- + drivers/video/fbdev/riva/fbdev.c | 3 + drivers/video/fbdev/sis/init.c | 11 +- drivers/video/fbdev/sm712fb.c | 2 + drivers/video/fbdev/vga16fb.c | 16 +- drivers/video/fbdev/w100fb.c | 2 + drivers/virt/fsl_hypervisor.c | 17 +- - drivers/virtio/virtio_ring.c | 3 + + drivers/virtio/virtio_ring.c | 9 +- drivers/w1/masters/mxc_w1.c | 14 +- drivers/w1/masters/omap_hdq.c | 10 +- drivers/watchdog/aspeed_wdt.c | 2 +- drivers/watchdog/da9062_wdt.c | 5 - - drivers/watchdog/f71808e_wdt.c | 13 +- + drivers/watchdog/f71808e_wdt.c | 17 +- drivers/watchdog/lpc18xx_wdt.c | 2 +- + drivers/watchdog/omap_wdt.c | 6 +- drivers/watchdog/qcom-wdt.c | 2 +- drivers/watchdog/rdc321x_wdt.c | 5 +- drivers/watchdog/sbc60xxwdt.c | 2 +- @@ -1982,12 +2438,13 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/watchdog/w83877f_wdt.c | 2 +- drivers/xen/balloon.c | 12 +- drivers/xen/events/events_2l.c | 31 +- - drivers/xen/events/events_base.c | 590 ++++++- + drivers/xen/events/events_base.c | 608 ++- drivers/xen/events/events_fifo.c | 87 +- drivers/xen/events/events_internal.h | 42 +- drivers/xen/evtchn.c | 7 +- drivers/xen/gntdev.c | 33 +- drivers/xen/preempt.c | 2 +- + .../xen/xen-pciback/conf_space_capability.c | 2 +- drivers/xen/xen-pciback/pci_stub.c | 14 +- drivers/xen/xen-pciback/pciback.h | 12 +- drivers/xen/xen-pciback/pciback_ops.c | 48 +- @@ -1995,7 +2452,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 drivers/xen/xen-pciback/xenbus.c | 26 +- drivers/xen/xen-scsiback.c | 27 +- drivers/xen/xenbus/xenbus_client.c | 18 +- - drivers/xen/xenbus/xenbus_probe.c | 1 + + drivers/xen/xenbus/xenbus_probe.c | 28 +- drivers/xen/xenbus/xenbus_probe.h | 2 + drivers/xen/xenbus/xenbus_probe_backend.c | 7 + drivers/xen/xenbus/xenbus_xs.c | 38 +- @@ -2006,7 +2463,9 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 fs/binfmt_misc.c | 29 +- fs/block_dev.c | 10 + fs/btrfs/Kconfig | 2 + + fs/btrfs/async-thread.c | 14 + fs/btrfs/backref.c | 1 + + fs/btrfs/compression.c | 2 +- fs/btrfs/ctree.c | 23 +- fs/btrfs/ctree.h | 2 + fs/btrfs/delayed-inode.c | 8 + @@ -2019,7 +2478,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 fs/btrfs/file-item.c | 16 +- fs/btrfs/file.c | 4 +- fs/btrfs/free-space-cache.c | 12 +- - fs/btrfs/inode.c | 85 +- + fs/btrfs/inode.c | 93 +- fs/btrfs/ioctl.c | 48 +- fs/btrfs/qgroup.c | 6 +- fs/btrfs/raid56.c | 58 +- @@ -2031,24 +2490,25 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 fs/btrfs/tests/btrfs-tests.c | 8 +- fs/btrfs/tests/inode-tests.c | 1 + fs/btrfs/transaction.c | 6 +- - fs/btrfs/tree-log.c | 41 +- + fs/btrfs/tree-log.c | 45 +- fs/btrfs/volumes.c | 25 +- fs/buffer.c | 25 +- fs/cachefiles/rdwr.c | 3 +- fs/ceph/addr.c | 12 +- - fs/ceph/caps.c | 26 +- + fs/ceph/caps.c | 28 +- fs/ceph/file.c | 1 + fs/ceph/inode.c | 1 + fs/ceph/mds_client.c | 14 +- fs/cifs/asn1.c | 16 +- - fs/cifs/cifs_unicode.c | 8 +- + fs/cifs/cifs_unicode.c | 17 +- fs/cifs/cifsfs.c | 2 +- fs/cifs/cifsglob.h | 9 +- - fs/cifs/connect.c | 5 + + fs/cifs/connect.c | 10 +- fs/cifs/dir.c | 22 +- fs/cifs/file.c | 22 +- fs/cifs/inode.c | 9 + fs/cifs/misc.c | 17 +- + fs/cifs/sess.c | 2 +- fs/cifs/smb1ops.c | 8 +- fs/cifs/smb2misc.c | 36 +- fs/cifs/smb2ops.c | 58 +- @@ -2068,9 +2528,11 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 fs/efivarfs/inode.c | 2 + fs/efivarfs/super.c | 3 + fs/eventpoll.c | 71 +- - fs/exec.c | 2 +- + fs/exec.c | 4 +- + fs/ext2/balloc.c | 14 +- fs/ext2/ialloc.c | 3 +- fs/ext4/block_validity.c | 71 +- + fs/ext4/dir.c | 6 +- fs/ext4/ext4.h | 9 +- fs/ext4/ext4_extents.h | 9 +- fs/ext4/extents.c | 64 +- @@ -2078,7 +2540,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 fs/ext4/fsync.c | 28 +- fs/ext4/ialloc.c | 59 +- fs/ext4/indirect.c | 6 +- - fs/ext4/inline.c | 1 + + fs/ext4/inline.c | 7 + fs/ext4/inode.c | 24 +- fs/ext4/ioctl.c | 3 + fs/ext4/mballoc.c | 5 +- @@ -2088,18 +2550,27 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 fs/f2fs/file.c | 3 +- fs/f2fs/inline.c | 3 +- fs/fat/inode.c | 6 + + fs/file.c | 19 +- + fs/file_table.c | 9 +- fs/fs-writeback.c | 120 +- fs/fuse/cuse.c | 2 + - fs/fuse/dev.c | 40 +- + fs/fuse/dev.c | 54 +- + fs/fuse/dir.c | 2 +- fs/fuse/file.c | 12 +- fs/fuse/fuse_i.h | 2 +- + fs/gfs2/acl.c | 30 +- fs/gfs2/glock.c | 5 +- - fs/gfs2/lock_dlm.c | 8 +- + fs/gfs2/lock_dlm.c | 13 +- fs/gfs2/ops_fstype.c | 20 +- fs/gfs2/rgrp.c | 9 +- fs/gfs2/super.c | 10 +- + fs/hfs/bfind.c | 14 +- + fs/hfs/bnode.c | 25 +- + fs/hfs/btree.h | 7 + + fs/hfs/super.c | 10 +- fs/hugetlbfs/inode.c | 7 +- fs/isofs/dir.c | 1 + + fs/isofs/inode.c | 2 + fs/isofs/namei.c | 1 + fs/jbd2/transaction.c | 26 + fs/jffs2/compr_rtime.c | 3 + @@ -2112,61 +2583,76 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 fs/jfs/jfs_dmap.h | 2 +- fs/jfs/jfs_filsys.h | 1 + fs/jfs/jfs_logmgr.c | 1 + - fs/jfs/jfs_mount.c | 10 + + fs/jfs/jfs_mount.c | 61 +- fs/libfs.c | 6 +- fs/lockd/host.c | 20 +- fs/minix/inode.c | 36 +- fs/minix/itree_common.c | 8 +- + fs/namespace.c | 57 +- fs/nfs/Kconfig | 2 +- fs/nfs/client.c | 2 +- fs/nfs/dir.c | 3 + fs/nfs/filelayout/filelayout.c | 2 +- fs/nfs/flexfilelayout/flexfilelayout.c | 13 +- + fs/nfs/flexfilelayout/flexfilelayoutdev.c | 4 +- fs/nfs/inode.c | 10 +- fs/nfs/internal.h | 12 +- fs/nfs/namespace.c | 12 +- fs/nfs/nfs3proc.c | 4 +- fs/nfs/nfs3xdr.c | 3 +- - fs/nfs/nfs42proc.c | 21 +- + fs/nfs/nfs42proc.c | 26 +- + fs/nfs/nfs42xdr.c | 3 +- fs/nfs/nfs4file.c | 2 +- fs/nfs/nfs4proc.c | 34 +- fs/nfs/nfs4xdr.c | 6 +- fs/nfs/pagelist.c | 12 +- fs/nfs/pnfs.c | 17 +- + fs/nfs/pnfs_nfs.c | 4 +- fs/nfs_common/grace.c | 6 +- fs/nfsd/nfs3xdr.c | 7 +- fs/nfsd/nfs4callback.c | 2 + + fs/nfsd/nfs4state.c | 9 +- + fs/nfsd/nfs4xdr.c | 19 +- + fs/nfsd/nfsctl.c | 5 +- fs/nfsd/nfssvc.c | 3 +- fs/nilfs2/segment.c | 2 + - fs/nilfs2/sysfs.c | 1 + + fs/nilfs2/sysfs.c | 27 +- fs/ntfs/inode.c | 14 +- + fs/ocfs2/alloc.c | 46 +- fs/ocfs2/aops.c | 11 +- fs/ocfs2/cluster/heartbeat.c | 8 +- - fs/ocfs2/file.c | 63 +- + fs/ocfs2/dlmglue.c | 3 +- + fs/ocfs2/file.c | 90 +- fs/ocfs2/filecheck.c | 6 +- fs/ocfs2/ocfs2.h | 4 +- fs/ocfs2/ocfs2_fs.h | 4 +- fs/ocfs2/stackglue.c | 8 +- fs/ocfs2/suballoc.c | 13 +- - fs/ocfs2/super.c | 5 +- + fs/ocfs2/super.c | 19 +- + fs/orangefs/dcache.c | 4 +- fs/orangefs/super.c | 2 +- fs/overlayfs/copy_up.c | 17 +- + fs/overlayfs/dir.c | 10 +- + fs/pipe.c | 19 +- fs/proc/base.c | 15 +- fs/proc/inode.c | 2 +- fs/proc/self.c | 9 +- fs/proc/task_mmu.c | 1 + fs/proc/thread_self.c | 2 +- - fs/quota/quota_tree.c | 8 +- + fs/proc/vmcore.c | 15 +- + fs/qnx4/dir.c | 69 +- + fs/quota/quota_tree.c | 23 +- fs/quota/quota_v2.c | 1 + fs/reiserfs/inode.c | 9 +- fs/reiserfs/journal.c | 14 + - fs/reiserfs/stree.c | 6 + - fs/reiserfs/super.c | 8 +- + fs/reiserfs/stree.c | 27 + + fs/reiserfs/super.c | 16 +- fs/reiserfs/xattr.c | 7 + fs/reiserfs/xattr.h | 2 +- fs/romfs/storage.c | 4 +- fs/select.c | 10 +- fs/seq_file.c | 3 + + fs/signalfd.c | 12 +- fs/squashfs/export.c | 45 +- fs/squashfs/file.c | 6 +- fs/squashfs/id.c | 42 +- @@ -2177,12 +2663,14 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 fs/squashfs/xattr_id.c | 68 +- fs/super.c | 33 +- fs/sysfs/file.c | 55 + + fs/tracefs/inode.c | 79 +- fs/ubifs/debug.c | 1 + fs/ubifs/dir.c | 7 + fs/ubifs/io.c | 29 +- fs/udf/inode.c | 34 +- + fs/udf/misc.c | 13 +- fs/udf/namei.c | 4 + - fs/udf/super.c | 6 + + fs/udf/super.c | 31 +- fs/ufs/super.c | 2 +- fs/xattr.c | 84 +- fs/xfs/libxfs/xfs_alloc.c | 16 + @@ -2201,9 +2689,19 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 gen_headers_arm.bp | 3 + gen_headers_arm64.bp | 3 + include/acpi/acpi_bus.h | 1 + - include/asm-generic/vmlinux.lds.h | 10 +- + include/asm-generic/pgtable.h | 13 + + include/asm-generic/tlb.h | 2 + + include/asm-generic/vmlinux.lds.h | 11 +- include/crypto/if_alg.h | 4 +- include/crypto/internal/hash.h | 8 +- + include/crypto/public_key.h | 4 +- + include/drm/drmP.h | 45 + + include/drm/drm_atomic.h | 113 +- + include/drm/drm_blend.h | 19 +- + include/drm/drm_client.h | 177 + + include/drm/drm_connector.h | 19 + + include/drm/drm_framebuffer.h | 6 + + include/drm/drm_modes.h | 9 + include/linux/acpi.h | 7 + include/linux/backing-dev.h | 10 + include/linux/bitops.h | 2 +- @@ -2214,23 +2712,29 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 include/linux/cgroup.h | 4 +- include/linux/compat.h | 2 - include/linux/compiler-gcc.h | 6 + + include/linux/compiler.h | 2 + + include/linux/console.h | 2 + include/linux/console_struct.h | 1 + + include/linux/cred.h | 14 +- include/linux/debugfs.h | 5 +- include/linux/device-mapper.h | 2 - + include/linux/device.h | 1 + include/linux/diagchar.h | 40 +- include/linux/eeprom_93xx46.h | 2 + include/linux/efi.h | 4 + include/linux/elfcore.h | 22 + include/linux/elfnote.h | 2 +- include/linux/extcon/extcon-adc-jack.h | 2 +- + include/linux/file.h | 2 + + include/linux/filter.h | 1 + include/linux/font.h | 13 + - include/linux/fs.h | 8 +- + include/linux/fs.h | 12 +- include/linux/ftrace.h | 4 +- include/linux/futex.h | 44 +- include/linux/genhd.h | 2 + - include/linux/hid.h | 47 +- + include/linux/hid.h | 63 +- include/linux/hil_mlc.h | 2 +- - include/linux/hugetlb.h | 20 +- + include/linux/hugetlb.h | 29 +- include/linux/i2c-algo-pca.h | 15 + include/linux/icmpv6.h | 48 +- include/linux/ide.h | 1 - @@ -2240,19 +2744,24 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 include/linux/input.h | 1 + include/linux/intel-iommu.h | 6 +- include/linux/io-mapping.h | 5 +- + include/linux/ipc_namespace.h | 15 + include/linux/ipv6.h | 2 +- include/linux/kdev_t.h | 22 +- include/linux/kgdb.h | 2 +- include/linux/khugepaged.h | 5 + - include/linux/kprobes.h | 4 + + include/linux/kprobes.h | 6 + include/linux/kref.h | 2 + include/linux/kvm_host.h | 11 +- - include/linux/libata.h | 17 +- + include/linux/libata.h | 20 +- include/linux/log2.h | 2 +- + include/linux/lsm_hooks.h | 32 +- + include/linux/mdio.h | 3 + include/linux/memcontrol.h | 23 +- include/linux/mfd/abx500/ux500_chargalg.h | 2 +- + include/linux/mfd/rt5033-private.h | 4 +- include/linux/mmdebug.h | 21 +- include/linux/mmzone.h | 3 +- + include/linux/msi.h | 2 +- include/linux/msm-sps.h | 4 +- include/linux/msm_ep_pcie.h | 34 +- include/linux/mtd/map.h | 2 +- @@ -2264,18 +2773,23 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 include/linux/overflow.h | 1 + include/linux/page_ext.h | 8 + include/linux/pagemap.h | 13 +- + include/linux/pci.h | 5 +- include/linux/perf_event.h | 2 +- - include/linux/prandom.h | 110 ++ + include/linux/power/max17042_battery.h | 2 +- + include/linux/prandom.h | 110 + include/linux/qed/qed_chain.h | 26 +- include/linux/random.h | 63 +- - include/linux/sched.h | 9 +- + include/linux/sched.h | 11 +- include/linux/sched/sysctl.h | 1 + + include/linux/security.h | 28 +- include/linux/seq_buf.h | 2 +- include/linux/seqlock.h | 11 +- - include/linux/skbuff.h | 16 +- + include/linux/shm.h | 13 +- + include/linux/siphash.h | 14 +- + include/linux/skbuff.h | 18 +- include/linux/spi/qcom-spi.h | 8 +- include/linux/spi/spi.h | 5 + - include/linux/string.h | 4 + + include/linux/string.h | 34 + include/linux/sunrpc/gss_api.h | 1 + include/linux/sunrpc/svcauth_gss.h | 3 +- include/linux/sunrpc/xdr.h | 3 +- @@ -2293,13 +2807,16 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 include/linux/uaccess.h | 26 + include/linux/usb.h | 37 + include/linux/usb/composite.h | 3 + + include/linux/usb/otg-fsm.h | 1 + include/linux/usb/quirks.h | 3 + include/linux/usb/usbnet.h | 2 + include/linux/virtio_vsock.h | 3 +- + include/linux/wait.h | 26 + include/linux/xattr.h | 2 + include/linux/zsmalloc.h | 2 +- include/net/addrconf.h | 1 + - include/net/bluetooth/hci_core.h | 31 +- + include/net/af_unix.h | 1 + + include/net/bluetooth/hci_core.h | 32 +- include/net/bluetooth/l2cap.h | 2 + include/net/bonding.h | 8 + include/net/caif/caif_dev.h | 2 +- @@ -2313,14 +2830,18 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 include/net/inet_connection_sock.h | 4 + include/net/inet_ecn.h | 1 + include/net/ip6_route.h | 2 +- + include/net/llc.h | 4 +- + include/net/llc_pdu.h | 31 +- include/net/ndisc.h | 2 +- include/net/netfilter/nf_tables.h | 2 + include/net/netns/ipv4.h | 1 + - include/net/nfc/nci_core.h | 1 + + include/net/nfc/nci_core.h | 2 + + include/net/nl802154.h | 7 +- include/net/red.h | 16 +- include/net/rtnetlink.h | 2 + - include/net/sctp/constants.h | 8 +- - include/net/sock.h | 15 +- + include/net/sctp/constants.h | 12 +- + include/net/sctp/structs.h | 2 +- + include/net/sock.h | 17 +- include/net/tcp.h | 6 +- include/net/xfrm.h | 49 +- include/scsi/libfcoe.h | 2 +- @@ -2330,14 +2851,15 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 include/soc/nps/common.h | 6 + include/soc/qcom/boot_stats.h | 4 +- include/sound/compress_driver.h | 10 +- - include/target/target_core_base.h | 4 + + include/target/target_core_base.h | 10 +- include/trace/events/target.h | 12 +- include/trace/events/writeback.h | 48 +- + include/uapi/drm/drm_mode.h | 47 + include/uapi/linux/bcache.h | 2 +- include/uapi/linux/btrfs_tree.h | 2 + include/uapi/linux/const.h | 5 + include/uapi/linux/cryptouser.h | 2 + - include/uapi/linux/dvb/frontend.h | 592 +++++-- + include/uapi/linux/dvb/frontend.h | 592 ++- include/uapi/linux/ethtool.h | 2 +- include/uapi/linux/kernel.h | 9 +- include/uapi/linux/kvm.h | 2 + @@ -2350,88 +2872,103 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 .../uapi/linux/netfilter/nfnetlink_cthelper.h | 2 +- include/uapi/linux/netfilter/x_tables.h | 2 +- include/uapi/linux/netlink.h | 2 +- + include/uapi/linux/pci_regs.h | 6 + include/uapi/linux/pr.h | 2 + include/uapi/linux/qrtr.h | 1 + - include/uapi/linux/slatecom_interface.h | 93 ++ + include/uapi/linux/serial_reg.h | 1 + + include/uapi/linux/slatecom_interface.h | 93 + include/uapi/linux/sysctl.h | 2 +- include/uapi/linux/tty_flags.h | 4 +- include/uapi/linux/usb/ch9.h | 3 + include/xen/events.h | 29 +- include/xen/grant_table.h | 1 + + include/xen/interface/io/ring.h | 257 +- include/xen/xenbus.h | 15 +- init/Kconfig | 6 +- init/main.c | 6 +- init/version.c | 4 +- + ipc/shm.c | 176 +- kernel/Makefile | 4 - kernel/audit.c | 48 +- kernel/audit.h | 2 +- kernel/audit_watch.c | 2 - kernel/auditfilter.c | 13 +- + kernel/bpf/core.c | 4 +- kernel/bpf/hashtab.c | 8 - - kernel/bpf/stackmap.c | 2 + + kernel/bpf/stackmap.c | 5 +- kernel/bpf/verifier.c | 7 +- - kernel/cgroup.c | 43 +- + kernel/cgroup.c | 74 +- kernel/cpu.c | 6 +- kernel/cpu_pm.c | 4 +- kernel/debug/debug_core.c | 27 +- kernel/debug/kdb/kdb_io.c | 8 +- kernel/debug/kdb/kdb_private.h | 2 +- kernel/elfcore.c | 25 - - kernel/events/core.c | 64 +- + kernel/events/core.c | 66 +- kernel/events/internal.h | 2 +- kernel/events/uprobes.c | 2 +- kernel/exit.c | 60 +- - kernel/fork.c | 50 +- - kernel/futex.c | 1476 +++++++++++++---- - kernel/futex_compat.c | 201 --- + kernel/fork.c | 51 +- + kernel/futex.c | 1476 +++++-- + kernel/futex_compat.c | 201 - kernel/gcov/gcc_4_7.c | 4 +- kernel/irq/Kconfig | 1 + kernel/irq/manage.c | 4 + kernel/kexec_file.c | 4 +- kernel/kmod.c | 9 + - kernel/kprobes.c | 48 +- + kernel/kprobes.c | 51 +- kernel/kthread.c | 80 +- + kernel/locking/lockdep.c | 2 +- kernel/locking/lockdep_proc.c | 2 +- kernel/locking/rtmutex-debug.c | 9 - kernel/locking/rtmutex-debug.h | 3 - - kernel/locking/rtmutex.c | 213 ++- + kernel/locking/rtmutex.c | 213 +- kernel/locking/rtmutex.h | 2 - kernel/locking/rtmutex_common.h | 17 +- kernel/module.c | 27 +- kernel/pid.c | 4 +- - kernel/power/hibernate.c | 11 - + kernel/pid_namespace.c | 2 +- + kernel/power/hibernate.c | 17 +- + kernel/power/swap.c | 5 +- kernel/printk/nmi.c | 16 +- - kernel/printk/printk.c | 3 + + kernel/printk/printk.c | 10 + + kernel/profile.c | 21 +- kernel/ptrace.c | 18 +- kernel/reboot.c | 28 +- kernel/relay.c | 1 + - kernel/sched/core.c | 8 +- + kernel/sched/core.c | 11 +- + kernel/sched/cpufreq_schedutil.c | 20 +- kernel/sched/fair.c | 16 +- kernel/sched/rt.c | 1 + + kernel/sched/wait.c | 8 + kernel/seccomp.c | 2 + - kernel/sys.c | 4 +- + kernel/signal.c | 17 +- + kernel/sys.c | 11 +- kernel/sysctl.c | 2 +- kernel/time/alarmtimer.c | 2 +- kernel/time/hrtimer.c | 2 +- kernel/time/posix-cpu-timers.c | 2 +- - kernel/time/timekeeping.c | 3 +- + kernel/time/timekeeping.c | 6 +- kernel/time/timer.c | 5 +- - kernel/trace/blktrace.c | 13 + - kernel/trace/ftrace.c | 56 +- + kernel/trace/blktrace.c | 21 + + kernel/trace/ftrace.c | 60 +- kernel/trace/ring_buffer.c | 94 +- kernel/trace/trace.c | 76 +- - kernel/trace/trace.h | 32 +- + kernel/trace/trace.h | 92 +- kernel/trace/trace_clock.c | 44 +- kernel/trace/trace_entries.h | 2 +- - kernel/trace/trace_events.c | 5 +- + kernel/trace/trace_events.c | 12 +- kernel/trace/trace_events_hist.c | 6 +- kernel/trace/trace_events_trigger.c | 21 +- + kernel/trace/trace_functions.c | 2 +- kernel/trace/trace_hwlat.c | 37 +- kernel/trace/trace_selftest.c | 9 +- + kernel/trace/tracing_map.c | 43 +- kernel/tracepoint.c | 80 +- - kernel/workqueue.c | 27 +- + kernel/workqueue.c | 47 +- lib/crc32.c | 2 +- lib/decompress_unlz4.c | 8 + + lib/decompress_unxz.c | 2 +- lib/dynamic_debug.c | 23 +- lib/fonts/font_10x18.c | 9 +- lib/fonts/font_6x10.c | 9 +- @@ -2448,66 +2985,90 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 lib/iov_iter.c | 2 +- lib/kobject_uevent.c | 9 +- lib/mpi/longlong.h | 2 +- - lib/random32.c | 462 ++++-- + lib/random32.c | 462 ++- lib/seq_buf.c | 8 +- + lib/siphash.c | 12 +- lib/stackdepot.c | 6 +- - lib/string.c | 71 +- + lib/string.c | 137 +- lib/swiotlb.c | 6 +- + lib/test_bpf.c | 13 +- + lib/xz/xz_dec_lzma2.c | 21 +- + lib/xz/xz_dec_stream.c | 6 +- lib/zlib_inflate/inffast.c | 91 +- - mm/backing-dev.c | 1 + + mm/backing-dev.c | 8 + mm/filemap.c | 8 + - mm/huge_memory.c | 94 +- - mm/hugetlb.c | 138 +- + mm/gup.c | 48 +- + mm/huge_memory.c | 101 +- + mm/hugetlb.c | 210 +- mm/khugepaged.c | 72 +- + mm/kmemleak.c | 2 +- mm/ksm.c | 1 + mm/maccess.c | 167 +- mm/memblock.c | 48 +- mm/memcontrol.c | 4 +- mm/memory-failure.c | 87 +- - mm/memory.c | 8 +- + mm/memory.c | 24 +- mm/memory_hotplug.c | 10 +- mm/mempolicy.c | 6 +- mm/mmap.c | 3 + + mm/oom_kill.c | 23 +- mm/page-writeback.c | 4 +- - mm/page_alloc.c | 17 +- + mm/page_alloc.c | 25 +- mm/page_ext.c | 8 +- mm/page_io.c | 11 +- mm/pagewalk.c | 4 +- + mm/slab.h | 2 +- mm/slab_common.c | 2 +- mm/slob.c | 2 + mm/slub.c | 32 +- mm/swap_state.c | 3 +- mm/swapfile.c | 2 +- mm/vmstat.c | 3 + - mm/zsmalloc.c | 17 +- + mm/zsmalloc.c | 37 +- + net/802/garp.c | 14 + + net/802/mrp.c | 14 + net/9p/trans_fd.c | 58 +- + net/9p/trans_virtio.c | 4 +- + net/Makefile | 2 +- net/appletalk/ddp.c | 33 +- net/atm/lec.c | 6 + - net/ax25/af_ax25.c | 10 +- + net/ax25/af_ax25.c | 14 +- net/batman-adv/bat_iv_ogm.c | 4 +- - net/batman-adv/bridge_loop_avoidance.c | 47 +- + net/batman-adv/bat_v_ogm.c | 11 +- + net/batman-adv/bridge_loop_avoidance.c | 158 +- net/batman-adv/bridge_loop_avoidance.h | 4 +- + net/batman-adv/fragmentation.c | 42 +- net/batman-adv/gateway_client.c | 6 +- + net/batman-adv/hard-interface.c | 3 + net/batman-adv/log.c | 1 + + net/batman-adv/main.c | 56 +- + net/batman-adv/multicast.c | 31 + + net/batman-adv/multicast.h | 15 + + net/batman-adv/network-coding.c | 4 +- net/batman-adv/routing.c | 4 + - net/batman-adv/soft-interface.c | 6 +- - net/batman-adv/translation-table.c | 2 + + net/batman-adv/soft-interface.c | 11 +- + net/batman-adv/translation-table.c | 6 +- net/bluetooth/6lowpan.c | 5 + net/bluetooth/a2mp.c | 23 +- net/bluetooth/amp.c | 3 + + net/bluetooth/cmtp/cmtp.h | 2 +- net/bluetooth/cmtp/core.c | 5 + net/bluetooth/hci_conn.c | 17 + - net/bluetooth/hci_core.c | 29 +- - net/bluetooth/hci_event.c | 127 +- + net/bluetooth/hci_core.c | 43 +- + net/bluetooth/hci_event.c | 142 +- net/bluetooth/hci_request.c | 12 +- - net/bluetooth/hci_sock.c | 4 +- + net/bluetooth/hci_sock.c | 49 +- + net/bluetooth/hci_sysfs.c | 3 + + net/bluetooth/hidp/core.c | 5 +- net/bluetooth/l2cap_core.c | 40 +- - net/bluetooth/l2cap_sock.c | 39 +- + net/bluetooth/l2cap_sock.c | 49 +- net/bluetooth/mgmt.c | 13 +- + net/bluetooth/sco.c | 74 +- net/bluetooth/smp.c | 9 + net/bridge/br_device.c | 1 + - net/bridge/br_if.c | 17 +- + net/bridge/br_if.c | 19 +- net/bridge/br_netfilter_hooks.c | 7 +- + net/bridge/br_netlink.c | 2 +- net/bridge/br_vlan.c | 4 +- net/bridge/netfilter/ebt_limit.c | 1 + net/caif/caif_dev.c | 13 +- @@ -2515,42 +3076,51 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 net/caif/caif_usb.c | 14 +- net/caif/cfcnfg.c | 16 +- net/caif/cfserl.c | 5 + + net/caif/chnl_net.c | 19 +- net/can/bcm.c | 71 +- net/can/gw.c | 3 + - net/can/raw.c | 62 +- + net/can/raw.c | 82 +- net/ceph/messenger.c | 5 + net/compat.c | 3 +- net/core/dev.c | 65 +- net/core/devlink.c | 6 +- net/core/fib_rules.c | 2 +- net/core/filter.c | 11 +- - net/core/neighbour.c | 3 +- + net/core/flow_dissector.c | 12 +- + net/core/neighbour.c | 5 +- net/core/net-sysfs.c | 2 +- net/core/netpoll.c | 24 +- net/core/pktgen.c | 2 +- - net/core/rtnetlink.c | 4 + - net/core/skbuff.c | 49 +- - net/core/sock.c | 25 +- + net/core/rtnetlink.c | 6 +- + net/core/skbuff.c | 54 +- + net/core/sock.c | 37 +- + net/core/stream.c | 3 - + net/core/sysctl_net_core.c | 2 +- net/dcb/dcbnl.c | 2 + + net/dccp/dccp.h | 6 +- net/dccp/ipv6.c | 5 + + net/dccp/minisocks.c | 2 + net/decnet/af_decnet.c | 27 +- net/hsr/hsr_device.c | 3 +- net/hsr/hsr_framereg.c | 3 +- net/ieee802154/nl-mac.c | 11 +- net/ieee802154/nl-phy.c | 4 +- net/ieee802154/nl802154.c | 61 +- + net/ieee802154/socket.c | 7 +- net/ipc_router/Kconfig | 11 + net/ipc_router/ipc_router_core.c | 8 +- net/ipv4/cipso_ipv4.c | 1 + + net/ipv4/devinet.c | 2 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/fib_semantics.c | 2 +- net/ipv4/fib_trie.c | 2 +- - net/ipv4/icmp.c | 34 + - net/ipv4/igmp.c | 1 + + net/ipv4/icmp.c | 57 +- + net/ipv4/igmp.c | 3 + net/ipv4/inet_connection_sock.c | 37 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/inet_hashtables.c | 1 + - net/ipv4/ip_output.c | 5 +- + net/ipv4/ip_gre.c | 2 + + net/ipv4/ip_output.c | 10 +- net/ipv4/ip_tunnel.c | 24 +- net/ipv4/ipconfig.c | 13 +- net/ipv4/netfilter/arp_tables.c | 2 + @@ -2558,18 +3128,18 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 net/ipv4/netfilter/ipt_CLUSTERIP.c | 1 + net/ipv4/netfilter/ipt_rpfilter.c | 2 +- net/ipv4/ping.c | 15 +- - net/ipv4/route.c | 43 +- + net/ipv4/route.c | 89 +- net/ipv4/syncookies.c | 9 +- net/ipv4/sysctl_net_ipv4.c | 33 +- net/ipv4/tcp.c | 15 +- - net/ipv4/tcp_bbr.c | 2 +- + net/ipv4/tcp_bbr.c | 4 +- net/ipv4/tcp_cong.c | 2 +- - net/ipv4/tcp_cubic.c | 2 + - net/ipv4/tcp_input.c | 28 +- - net/ipv4/tcp_ipv4.c | 20 +- + net/ipv4/tcp_cubic.c | 7 +- + net/ipv4/tcp_input.c | 30 +- + net/ipv4/tcp_ipv4.c | 25 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 43 +- - net/ipv4/udp.c | 12 +- + net/ipv4/udp.c | 22 +- net/ipv4/udp_offload.c | 2 +- net/ipv6/addrconf.c | 7 +- net/ipv6/ah6.c | 3 +- @@ -2583,27 +3153,30 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 net/ipv6/ip6_vti.c | 3 +- net/ipv6/ipv6_sockglue.c | 14 +- net/ipv6/mcast.c | 4 +- - net/ipv6/netfilter/ip6_tables.c | 23 +- + net/ipv6/netfilter/ip6_tables.c | 24 +- net/ipv6/netfilter/ip6t_NPT.c | 2 + net/ipv6/output_core.c | 28 +- net/ipv6/route.c | 8 +- net/ipv6/sit.c | 16 +- net/ipv6/syncookies.c | 10 +- net/ipv6/tcp_ipv6.c | 24 +- - net/ipv6/udp.c | 5 +- + net/ipv6/udp.c | 7 +- net/ipv6/xfrm6_output.c | 2 +- net/iucv/af_iucv.c | 7 +- net/key/af_key.c | 13 +- - net/l2tp/l2tp_core.c | 48 +- + net/l2tp/l2tp_core.c | 52 +- net/l2tp/l2tp_core.h | 3 - net/lapb/lapb_out.c | 3 +- - net/llc/af_llc.c | 10 +- + net/llc/af_llc.c | 20 +- + net/llc/llc_s_ac.c | 2 +- + net/mac80211/agg-tx.c | 2 +- net/mac80211/cfg.c | 5 +- + net/mac80211/debugfs_sta.c | 1 + net/mac80211/driver-ops.c | 5 +- net/mac80211/ibss.c | 2 + net/mac80211/ieee80211_i.h | 39 +- net/mac80211/iface.c | 15 +- - net/mac80211/key.c | 7 + + net/mac80211/key.c | 8 + net/mac80211/key.h | 2 + net/mac80211/main.c | 20 +- net/mac80211/mesh_hwmp.c | 2 +- @@ -2612,70 +3185,88 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 net/mac80211/rate.c | 3 +- net/mac80211/rc80211_minstrel.c | 27 +- net/mac80211/rc80211_minstrel.h | 1 - - net/mac80211/rx.c | 186 ++- + net/mac80211/rx.c | 189 +- net/mac80211/sta_info.c | 38 +- - net/mac80211/sta_info.h | 31 + - net/mac80211/tx.c | 35 +- + net/mac80211/sta_info.h | 32 + + net/mac80211/tx.c | 51 +- net/mac80211/vht.c | 8 +- - net/mac80211/wpa.c | 12 +- + net/mac80211/wpa.c | 18 +- net/mac802154/llsec.c | 2 +- net/mac802154/tx.c | 8 +- net/mpls/mpls_gso.c | 3 + net/ncsi/ncsi-rsp.c | 2 +- + net/netfilter/Kconfig | 2 +- net/netfilter/ipset/ip_set_core.c | 2 + - net/netfilter/ipset/ip_set_hash_gen.h | 20 +- - net/netfilter/ipvs/ip_vs_ctl.c | 9 +- - net/netfilter/nf_conntrack_core.c | 3 +- + net/netfilter/ipset/ip_set_hash_gen.h | 24 +- + net/netfilter/ipvs/ip_vs_conn.c | 4 + + net/netfilter/ipvs/ip_vs_ctl.c | 14 +- + net/netfilter/nf_conntrack_core.c | 10 +- net/netfilter/nf_conntrack_netlink.c | 2 + net/netfilter/nf_conntrack_standalone.c | 8 +- net/netfilter/nf_synproxy_core.c | 5 + net/netfilter/nf_tables_api.c | 3 +- net/netfilter/nfnetlink_cthelper.c | 8 +- + net/netfilter/nfnetlink_queue.c | 2 +- net/netfilter/nft_dynset.c | 4 +- net/netfilter/nft_exthdr.c | 3 + - net/netfilter/nft_nat.c | 4 +- + net/netfilter/nft_nat.c | 8 +- net/netfilter/nft_payload.c | 4 +- - net/netfilter/x_tables.c | 73 +- + net/netfilter/x_tables.c | 84 +- net/netfilter/xt_CT.c | 3 + + net/netfilter/xt_IDLETIMER.c | 1 + + net/netfilter/xt_LED.c | 1 + net/netfilter/xt_RATEEST.c | 4 + net/netfilter/xt_TEE.c | 2 + net/netfilter/xt_bpf.c | 2 + net/netfilter/xt_cgroup.c | 1 + net/netfilter/xt_connlimit.c | 1 + net/netfilter/xt_hashlimit.c | 4 + - net/netfilter/xt_limit.c | 2 + + net/netfilter/xt_limit.c | 1 + + net/netfilter/xt_nfacct.c | 1 + net/netfilter/xt_quota.c | 1 + - net/netfilter/xt_quota2.c | 21 +- + net/netfilter/xt_quota2.c | 25 +- net/netfilter/xt_rateest.c | 1 + net/netfilter/xt_recent.c | 12 +- + net/netfilter/xt_statistic.c | 1 + net/netfilter/xt_string.c | 1 + + net/netlabel/netlabel_cipso_v4.c | 12 +- net/netlabel/netlabel_domainhash.c | 59 +- net/netlabel/netlabel_mgmt.c | 19 +- net/netlabel/netlabel_unlabeled.c | 17 +- - net/netlink/af_netlink.c | 6 +- + net/netlink/af_netlink.c | 29 +- net/netlink/genetlink.c | 52 - net/netrom/nr_timer.c | 20 +- + net/nfc/af_nfc.c | 3 + + net/nfc/core.c | 32 +- + net/nfc/digital_core.c | 9 +- net/nfc/digital_dep.c | 2 + + net/nfc/digital_technology.c | 8 +- net/nfc/llcp_sock.c | 16 + - net/nfc/nci/core.c | 1 + + net/nfc/nci/core.c | 31 +- net/nfc/nci/hci.c | 5 + - net/nfc/netlink.c | 3 +- + net/nfc/nci/rsp.c | 2 + + net/nfc/netlink.c | 15 +- net/nfc/rawsock.c | 9 +- net/openvswitch/actions.c | 8 +- net/openvswitch/conntrack.c | 22 +- net/packet/af_packet.c | 41 +- + net/phonet/pep.c | 2 + net/qrtr/qrtr.c | 7 +- + net/rds/ib_frmr.c | 4 +- net/rds/recv.c | 5 +- + net/rds/tcp.c | 2 +- net/rose/rose_loopback.c | 17 +- net/rxrpc/call_accept.c | 7 + net/rxrpc/conn_event.c | 6 +- net/rxrpc/key.c | 22 +- net/rxrpc/recvmsg.c | 2 +- net/rxrpc/sendmsg.c | 2 +- + net/sched/cls_flower.c | 4 + net/sched/cls_tcindex.c | 10 +- net/sched/sch_api.c | 11 +- net/sched/sch_choke.c | 7 +- net/sched/sch_dsmark.c | 3 +- + net/sched/sch_fifo.c | 3 + net/sched/sch_generic.c | 1 + net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 7 +- @@ -2683,12 +3274,13 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 net/sched/sch_teql.c | 3 + net/sctp/associola.c | 5 +- net/sctp/auth.c | 1 + - net/sctp/bind_addr.c | 1 + - net/sctp/input.c | 6 +- - net/sctp/protocol.c | 1 + - net/sctp/sm_make_chunk.c | 2 +- + net/sctp/bind_addr.c | 21 +- + net/sctp/input.c | 15 +- + net/sctp/ipv6.c | 7 +- + net/sctp/protocol.c | 11 +- + net/sctp/sm_make_chunk.c | 44 +- net/sctp/sm_sideeffect.c | 4 +- - net/sctp/sm_statefuns.c | 3 +- + net/sctp/sm_statefuns.c | 7 +- net/sctp/socket.c | 47 +- net/sctp/transport.c | 2 +- net/socket.c | 2 +- @@ -2697,7 +3289,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 net/sunrpc/auth_gss/auth_gss_internal.h | 45 + net/sunrpc/auth_gss/gss_krb5_mech.c | 31 +- net/sunrpc/auth_gss/gss_mech_switch.c | 12 +- - net/sunrpc/auth_gss/svcauth_gss.c | 29 +- + net/sunrpc/auth_gss/svcauth_gss.c | 31 +- net/sunrpc/clnt.c | 8 + net/sunrpc/rpc_pipe.c | 1 + net/sunrpc/rpcb_clnt.c | 4 +- @@ -2714,24 +3306,29 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 net/tipc/link.c | 11 +- net/tipc/msg.c | 14 +- net/tipc/netlink_compat.c | 14 +- - net/tipc/socket.c | 3 + - net/unix/af_unix.c | 18 +- - net/vmw_vsock/af_vsock.c | 16 +- + net/tipc/socket.c | 14 +- + net/unix/Kconfig | 5 + + net/unix/Makefile | 2 + + net/unix/af_unix.c | 169 +- + net/unix/garbage.c | 68 +- + net/unix/scm.c | 161 + + net/unix/scm.h | 10 + + net/vmw_vsock/af_vsock.c | 18 +- net/vmw_vsock/virtio_transport.c | 96 +- net/vmw_vsock/virtio_transport_common.c | 8 +- net/vmw_vsock/vmci_transport.c | 3 +- net/wireless/nl80211.c | 16 +- net/wireless/reg.c | 5 +- - net/wireless/scan.c | 2 + + net/wireless/scan.c | 4 +- net/wireless/sme.c | 2 +- - net/wireless/util.c | 11 +- + net/wireless/util.c | 12 +- net/wireless/wext-core.c | 5 +- net/wireless/wext-spy.c | 14 +- net/x25/af_x25.c | 11 +- net/x25/x25_subr.c | 6 + net/xfrm/Kconfig | 11 + net/xfrm/Makefile | 1 + - net/xfrm/xfrm_compat.c | 629 +++++++ + net/xfrm/xfrm_compat.c | 629 +++ net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_state.c | 98 +- net/xfrm/xfrm_user.c | 138 +- @@ -2739,6 +3336,7 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 samples/kfifo/bytestream-example.c | 8 +- samples/kfifo/inttype-example.c | 8 +- samples/kfifo/record-example.c | 8 +- + samples/kprobes/kretprobe_example.c | 2 +- samples/mic/mpssd/mpssd.c | 4 +- scripts/Kbuild.include | 11 +- scripts/Makefile | 9 +- @@ -2764,17 +3362,21 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 scripts/mksysmap | 2 +- scripts/profile2linkerlist.pl | 2 +- scripts/recordmcount.c | 2 +- - scripts/recordmcount.pl | 19 +- + scripts/recordmcount.pl | 21 +- scripts/setlocalversion | 21 +- scripts/show_delta | 2 +- scripts/stackdelta | 2 +- - scripts/tracing/draw_functrace.py | 2 +- + scripts/tracing/draw_functrace.py | 8 +- security/integrity/evm/evm_crypto.c | 2 +- + security/integrity/evm/evm_main.c | 2 +- security/integrity/ima/ima.h | 7 +- security/integrity/ima/ima_crypto.c | 2 + + security/integrity/ima/ima_mok.c | 2 +- security/integrity/ima/ima_policy.c | 3 +- security/keys/trusted.c | 2 +- security/lsm_audit.c | 7 +- + security/security.c | 14 +- + security/selinux/hooks.c | 34 +- security/selinux/include/classmap.h | 3 +- security/selinux/include/security.h | 1 + security/selinux/nlmsgtab.c | 24 +- @@ -2782,19 +3384,27 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 security/selinux/ss/policydb.c | 4 + security/selinux/ss/policydb.h | 2 + security/selinux/ss/services.c | 6 + - security/smack/smackfs.c | 52 +- + security/smack/smack_access.c | 17 +- + security/smack/smackfs.c | 63 +- sound/core/compress_offload.c | 4 + sound/core/control.c | 2 +- + sound/core/control_compat.c | 3 + sound/core/info.c | 4 +- sound/core/init.c | 2 - + sound/core/jack.c | 4 + + sound/core/oss/mixer_oss.c | 43 +- sound/core/oss/mulaw.c | 4 +- - sound/core/oss/pcm_oss.c | 28 +- + sound/core/oss/pcm_oss.c | 57 +- + sound/core/pcm_lib.c | 2 +- sound/core/pcm_native.c | 5 + sound/core/seq/oss/seq_oss.c | 11 +- sound/core/seq/oss/seq_oss_synth.c | 3 +- + sound/core/seq/seq_device.c | 8 +- + sound/core/seq/seq_ports.c | 39 +- sound/core/seq/seq_queue.h | 8 +- - sound/core/timer.c | 3 +- + sound/core/timer.c | 20 +- sound/drivers/aloop.c | 11 +- + sound/drivers/opl3/opl3_midi.c | 2 +- sound/drivers/opl3/opl3_synth.c | 2 + sound/firewire/Kconfig | 5 +- sound/firewire/bebob/bebob.c | 5 +- @@ -2804,9 +3414,11 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 sound/firewire/tascam/tascam.c | 30 +- sound/hda/ext/hdac_ext_controller.c | 2 + sound/hda/hdac_bus.c | 4 + + sound/hda/hdac_controller.c | 5 +- sound/hda/hdac_device.c | 2 + sound/isa/cmi8330.c | 2 +- sound/isa/es1688/es1688.c | 4 +- + sound/isa/gus/gus_dma.c | 2 + sound/isa/sb/emu8000.c | 4 +- sound/isa/sb/sb16_csp.c | 20 +- sound/isa/sb/sb8.c | 4 - @@ -2815,13 +3427,18 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 sound/pci/ca0106/ca0106_main.c | 3 +- sound/pci/cs46xx/cs46xx_lib.c | 2 +- sound/pci/cs46xx/dsp_spos_scb_lib.c | 2 +- + sound/pci/ctxfi/ctamixer.c | 14 +- + sound/pci/ctxfi/ctdaio.c | 16 +- sound/pci/ctxfi/cthw20k2.c | 2 +- + sound/pci/ctxfi/ctresource.c | 7 +- + sound/pci/ctxfi/ctresource.h | 4 +- + sound/pci/ctxfi/ctsrc.c | 7 +- sound/pci/echoaudio/echoaudio.c | 2 - sound/pci/hda/hda_auto_parser.c | 6 + sound/pci/hda/hda_bind.c | 4 + sound/pci/hda/hda_codec.c | 2 +- sound/pci/hda/hda_controller.c | 11 +- - sound/pci/hda/hda_generic.c | 30 +- + sound/pci/hda/hda_generic.c | 40 +- sound/pci/hda/hda_generic.h | 1 + sound/pci/hda/hda_tegra.c | 3 + sound/pci/hda/patch_ca0132.c | 16 +- @@ -2849,14 +3466,16 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 sound/soc/codecs/wm_adsp.c | 5 +- sound/soc/fsl/fsl_asrc_dma.c | 1 + sound/soc/fsl/fsl_esai.c | 8 +- - sound/soc/intel/atom/sst-mfld-platform-pcm.c | 11 +- + sound/soc/intel/atom/sst-mfld-platform-pcm.c | 14 +- + sound/soc/intel/boards/bytcr_rt5640.c | 9 +- sound/soc/intel/boards/haswell.c | 1 + sound/soc/jz4740/jz4740-i2s.c | 4 + sound/soc/kirkwood/kirkwood-dma.c | 2 +- sound/soc/qcom/lpass-platform.c | 3 +- sound/soc/soc-core.c | 2 +- - sound/soc/soc-dapm.c | 1 + + sound/soc/soc-dapm.c | 39 +- sound/soc/soc-pcm.c | 2 + + sound/soc/soc-topology.c | 3 + sound/soc/tegra/tegra30_ahub.c | 4 +- sound/soc/tegra/tegra30_i2s.c | 4 +- sound/soc/tegra/tegra_alc5632.c | 1 + @@ -2868,22 +3487,29 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 sound/soc/tegra/tegra_wm8903.c | 1 + sound/soc/tegra/tegra_wm9712.c | 1 + sound/soc/tegra/trimslice.c | 1 + + sound/synth/emux/emux.c | 2 +- + sound/usb/6fire/comm.c | 2 +- + sound/usb/6fire/firmware.c | 6 +- sound/usb/card.c | 34 +- sound/usb/card.h | 1 + sound/usb/clock.c | 6 + sound/usb/format.c | 4 + sound/usb/line6/capture.c | 2 + - sound/usb/line6/driver.c | 4 + + sound/usb/line6/driver.c | 18 +- + sound/usb/line6/driver.h | 2 +- sound/usb/line6/playback.c | 2 + sound/usb/line6/pod.c | 5 - + sound/usb/line6/podhd.c | 6 +- + sound/usb/line6/toneport.c | 2 +- sound/usb/line6/variax.c | 6 - sound/usb/midi.c | 54 +- + sound/usb/misc/ua101.c | 4 +- sound/usb/mixer.c | 34 +- sound/usb/mixer.h | 15 +- sound/usb/mixer_quirks.c | 6 +- sound/usb/mixer_scarlett.c | 6 +- sound/usb/pcm.c | 59 +- - sound/usb/quirks-table.h | 124 ++ + sound/usb/quirks-table.h | 156 + sound/usb/quirks.c | 29 +- sound/usb/stream.c | 7 +- sound/usb/usbaudio.h | 4 +- @@ -2954,13 +3580,15 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 tools/testing/selftests/powerpc/utils.c | 37 +- tools/testing/selftests/x86/protection_keys.c | 4 +- tools/testing/selftests/x86/syscall_nt.c | 1 + + tools/usb/testusb.c | 14 +- tools/usb/usbip/libsrc/usbip_host_common.c | 2 +- virt/kvm/kvm_main.c | 25 +- - 2950 files changed, 34406 insertions(+), 14407 deletions(-) + 3575 files changed, 47472 insertions(+), 18042 deletions(-) create mode 100644 Documentation/devicetree/bindings/input/hall_sensor.txt create mode 100644 Documentation/devicetree/bindings/input/misc/bma2x2.txt create mode 100644 Documentation/devicetree/bindings/input/misc/ltr553.txt create mode 100644 Documentation/devicetree/bindings/leds/leds-aw2013.txt + create mode 100644 Documentation/gpu/drm-client.rst mode change 100755 => 100644 arch/arm/configs/msm8909-perf_defconfig mode change 100755 => 100644 arch/arm/configs/msm8937go-perf_defconfig create mode 100644 arch/arm/configs/vendor/msm8909go-perf_defconfig @@ -2980,9 +3608,14 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 create mode 100644 arch/openrisc/include/asm/barrier.h create mode 100644 arch/powerpc/include/asm/book3s/64/kup-radix.h create mode 100644 arch/powerpc/include/asm/kup.h + create mode 100644 drivers/gpu/drm/drm_bootsplash.c + create mode 100644 drivers/gpu/drm/drm_client.c + create mode 100644 drivers/gpu/drm/drm_client_modeset.c + create mode 100644 drivers/gpu/drm/drm_splash.h mode change 100644 => 100755 drivers/irqchip/irq-gic.c create mode 100644 drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/jpeg_dma_hw/cam_jpeg_dma_hw_info_ver_4_2_0.h mode change 100644 => 100755 drivers/usb/host/xhci-plat.c + create mode 100644 include/drm/drm_client.h mode change 100644 => 100755 include/linux/overflow.h create mode 100644 include/linux/prandom.h create mode 100644 include/uapi/linux/slatecom_interface.h @@ -2990,6 +3623,8 @@ Change-Id: Ida80f1cbbe6bf13f844296e3ecaf09043820ced2 delete mode 100644 kernel/futex_compat.c mode change 100644 => 100755 net/netlink/genetlink.c create mode 100644 net/sunrpc/auth_gss/auth_gss_internal.h + create mode 100644 net/unix/scm.c + create mode 100644 net/unix/scm.h create mode 100644 net/xfrm/xfrm_compat.c diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio @@ -3330,6 +3965,19 @@ index 000000000000..4b18135d6318 + aw2013,off-time-ms = <1>; + }; + }; +diff --git a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt +index 174f68c26c1b..34981b98d807 100644 +--- a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt ++++ b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt +@@ -123,7 +123,7 @@ on various other factors also like; + so the device should have enough free bytes available its OOB/Spare + area to accommodate ECC for entire page. In general following expression + helps in determining if given device can accommodate ECC syndrome: +- "2 + (PAGESIZE / 512) * ECC_BYTES" >= OOBSIZE" ++ "2 + (PAGESIZE / 512) * ECC_BYTES" <= OOBSIZE" + where + OOBSIZE number of bytes in OOB/spare area + PAGESIZE number of bytes in main-area of device page diff --git a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt index 5b6cd9b3f628..0188bbd2e35f 100644 --- a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt @@ -3368,6 +4016,53 @@ index 138fb7e8516b..4fb30ba56279 100644 Example: +diff --git a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +index 093edda0c8df..6cd83d920155 100644 +--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt ++++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt +@@ -13,6 +13,14 @@ common regulator binding documented in: + + + Required properties of the main device node (the parent!): ++ - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used ++ for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. ++ ++ [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional ++ property is specified, then all the eight voltage values for the ++ 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. ++ ++Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV) + units for buck2 when changing voltage using gpio dvs. Refer to [1] below + for additional information. +@@ -25,26 +33,13 @@ Required properties of the main device node (the parent!): + units for buck4 when changing voltage using gpio dvs. Refer to [1] below + for additional information. + +- - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used +- for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. +- +- [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage' +- property should specify atleast one voltage level (which would be a +- safe operating voltage). +- +- If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional +- property is specified, then all the eight voltage values for the +- 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. +- +-Optional properties of the main device node (the parent!): + - s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs. + - s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs. + - s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs. + + Additional properties required if either of the optional properties are used: + +- - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from ++ - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from + the possible 8 options selectable by the dvs gpios. The value of this + property should be between 0 and 7. If not specified or if out of range, the + default value of this property is set to 0. diff --git a/Documentation/devicetree/bindings/sound/wm8994.txt b/Documentation/devicetree/bindings/sound/wm8994.txt index 68c4e8d96bed..b309de00cd83 100644 --- a/Documentation/devicetree/bindings/sound/wm8994.txt @@ -3477,6 +4172,24 @@ index 71b63c2b9841..a8f1a58e3692 100644 - All other flags (suid, sgid, ...) are ignored and will not be retained. +diff --git a/Documentation/filesystems/mandatory-locking.txt b/Documentation/filesystems/mandatory-locking.txt +index 0979d1d2ca8b..a251ca33164a 100644 +--- a/Documentation/filesystems/mandatory-locking.txt ++++ b/Documentation/filesystems/mandatory-locking.txt +@@ -169,3 +169,13 @@ havoc if they lock crucial files. The way around it is to change the file + permissions (remove the setgid bit) before trying to read or write to it. + Of course, that might be a bit tricky if the system is hung :-( + ++7. The "mand" mount option ++-------------------------- ++Mandatory locking is disabled on all filesystems by default, and must be ++administratively enabled by mounting with "-o mand". That mount option ++is only allowed if the mounting task has the CAP_SYS_ADMIN capability. ++ ++Since kernel v4.5, it is possible to disable mandatory locking ++altogether by setting CONFIG_MANDATORY_FILE_LOCKING to "n". A kernel ++with this disabled will reject attempts to mount filesystems with the ++"mand" mount option with the error status EPERM. diff --git a/Documentation/filesystems/sysfs.txt b/Documentation/filesystems/sysfs.txt index 24da7b32c489..1218a5e2975c 100644 --- a/Documentation/filesystems/sysfs.txt @@ -3497,6 +4210,39 @@ index 24da7b32c489..1218a5e2975c 100644 - store() should return the number of bytes used from the buffer. If the entire buffer has been used, just return the count argument. +diff --git a/Documentation/gpu/drm-client.rst b/Documentation/gpu/drm-client.rst +new file mode 100644 +index 000000000000..58b5a1d1219d +--- /dev/null ++++ b/Documentation/gpu/drm-client.rst +@@ -0,0 +1,15 @@ ++================= ++Kernel clients ++================= ++ ++.. kernel-doc:: drivers/gpu/drm/drm_client.c ++ :doc: overview ++ ++.. kernel-doc:: include/drm/drm_client.h ++ :internal: ++ ++.. kernel-doc:: drivers/gpu/drm/drm_client.c ++ :export: ++ ++.. kernel-doc:: drivers/gpu/drm/drm_client_modeset.c ++ :export: +diff --git a/Documentation/gpu/index.rst b/Documentation/gpu/index.rst +index be0dafcf5556..78fd55c74606 100644 +--- a/Documentation/gpu/index.rst ++++ b/Documentation/gpu/index.rst +@@ -10,6 +10,7 @@ Linux GPU Driver Developer's Guide + drm-kms + drm-kms-helpers + drm-uapi ++ drm-client + i915 + vga-switcheroo + vgaarbiter diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt index a2bff3173088..a55b528cdf1e 100644 --- a/Documentation/kernel-parameters.txt @@ -3562,6 +4308,28 @@ index 015d4db597b5..c80c5fc6e916 100644 - ``FE_GET_PROPERTY:`` +diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt +index 57f52cdce32e..07b53b2b13df 100644 +--- a/Documentation/networking/bonding.txt ++++ b/Documentation/networking/bonding.txt +@@ -191,11 +191,12 @@ ad_actor_sys_prio + ad_actor_system + + In an AD system, this specifies the mac-address for the actor in +- protocol packet exchanges (LACPDUs). The value cannot be NULL or +- multicast. It is preferred to have the local-admin bit set for this +- mac but driver does not enforce it. If the value is not given then +- system defaults to using the masters' mac address as actors' system +- address. ++ protocol packet exchanges (LACPDUs). The value cannot be a multicast ++ address. If the all-zeroes MAC is specified, bonding will internally ++ use the MAC of the bond itself. It is preferred to have the ++ local-admin bit set for this mac but driver does not enforce it. If ++ the value is not given then system defaults to using the masters' ++ mac address as actors' system address. + + This parameter has effect only in 802.3ad mode and is available through + SysFs interface. diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt index 54de8ff14627..f29ca1c89375 100644 --- a/Documentation/networking/ip-sysctl.txt @@ -3650,14 +4418,14 @@ index d1908e50b506..b8f5bf2a890a 100644 __u64 evt_page; __u64 msg_page; diff --git a/Makefile b/Makefile -index 63c7cdc23d65..f574747c3ba5 100644 +index 63c7cdc23d65..69ed7f4b23a0 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ VERSION = 4 PATCHLEVEL = 9 -SUBLEVEL = 227 -+SUBLEVEL = 277 ++SUBLEVEL = 295 EXTRAVERSION = NAME = Roaring Lionus @@ -3778,9 +4546,36 @@ index 63c7cdc23d65..f574747c3ba5 100644 # # A module can be listed more than once in obj-m resulting in diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h -index ff4049155c84..355aec0867f4 100644 +index ff4049155c84..e55a5e6ab460 100644 --- a/arch/alpha/include/asm/io.h +++ b/arch/alpha/include/asm/io.h +@@ -60,7 +60,7 @@ extern inline void set_hae(unsigned long new_hae) + * Change virtual addresses to physical addresses and vv. + */ + #ifdef USE_48_BIT_KSEG +-static inline unsigned long virt_to_phys(void *address) ++static inline unsigned long virt_to_phys(volatile void *address) + { + return (unsigned long)address - IDENT_ADDR; + } +@@ -70,7 +70,7 @@ static inline void * phys_to_virt(unsigned long address) + return (void *) (address + IDENT_ADDR); + } + #else +-static inline unsigned long virt_to_phys(void *address) ++static inline unsigned long virt_to_phys(volatile void *address) + { + unsigned long phys = (unsigned long)address; + +@@ -111,7 +111,7 @@ static inline dma_addr_t __deprecated isa_page_to_bus(struct page *page) + extern unsigned long __direct_map_base; + extern unsigned long __direct_map_size; + +-static inline unsigned long __deprecated virt_to_bus(void *address) ++static inline unsigned long __deprecated virt_to_bus(volatile void *address) + { + unsigned long phys = virt_to_phys(address); + unsigned long bus = phys + __direct_map_base; @@ -491,10 +491,10 @@ extern inline void writeq(u64 b, volatile void __iomem *addr) } #endif @@ -3897,6 +4692,19 @@ index 94f587535dee..181254a20a2a 100644 #define user_addr_max() \ (segment_eq(get_fs(), USER_DS) ? TASK_SIZE : ~0UL) +diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c +index 46bf263c3153..d2477a502ce7 100644 +--- a/arch/alpha/kernel/smp.c ++++ b/arch/alpha/kernel/smp.c +@@ -584,7 +584,7 @@ void + smp_send_stop(void) + { + cpumask_t to_whom; +- cpumask_copy(&to_whom, cpu_possible_mask); ++ cpumask_copy(&to_whom, cpu_online_mask); + cpumask_clear_cpu(smp_processor_id(), &to_whom); + #ifdef DEBUG_IPI_MSG + if (hard_smp_processor_id() != boot_cpu_id) diff --git a/arch/alpha/lib/Makefile b/arch/alpha/lib/Makefile index 59660743237c..a80815960364 100644 --- a/arch/alpha/lib/Makefile @@ -4682,6 +5490,21 @@ index ffb5f33475f1..f0f43eb709d2 100644 #define copy_page(to, from) memcpy((to), (from), PAGE_SIZE) struct vm_area_struct; +diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h +index c10f5cb203e6..81198a6773c6 100644 +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -137,8 +137,10 @@ + + #ifdef CONFIG_ARC_HAS_PAE40 + #define PTE_BITS_NON_RWX_IN_PD1 (0xff00000000 | PAGE_MASK | _PAGE_CACHEABLE) ++#define MAX_POSSIBLE_PHYSMEM_BITS 40 + #else + #define PTE_BITS_NON_RWX_IN_PD1 (PAGE_MASK | _PAGE_CACHEABLE) ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #endif + + /************************************************************************** diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S index 85d9ea4a0acc..37ad245cf989 100644 --- a/arch/arc/kernel/entry.S @@ -4805,6 +5628,32 @@ index b9192a653b7e..3ee19b1e79be 100644 } return address; /* return the last address it saw */ +diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S +index f35ed578e007..4d823d3f65bb 100644 +--- a/arch/arc/kernel/vmlinux.lds.S ++++ b/arch/arc/kernel/vmlinux.lds.S +@@ -92,6 +92,8 @@ SECTIONS + CPUIDLE_TEXT + LOCK_TEXT + KPROBES_TEXT ++ IRQENTRY_TEXT ++ SOFTIRQENTRY_TEXT + *(.fixup) + *(.gnu.warning) + } +diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c +index fefe357c3d31..076b5e8c8562 100644 +--- a/arch/arc/mm/cache.c ++++ b/arch/arc/mm/cache.c +@@ -923,7 +923,7 @@ void clear_user_page(void *to, unsigned long u_vaddr, struct page *page) + clear_page(to); + clear_bit(PG_dc_clean, &page->flags); + } +- ++EXPORT_SYMBOL(clear_user_page); + + /********************************************************************** + * Explicit Cache flush request from user space via syscall diff --git a/arch/arc/plat-eznps/include/plat/ctop.h b/arch/arc/plat-eznps/include/plat/ctop.h index 3c401ce0351e..fb959828630c 100644 --- a/arch/arc/plat-eznps/include/plat/ctop.h @@ -4856,9 +5705,56 @@ index 76b0f4131eaf..767c8b14ca2d 100644 bool "Runtime patch udiv/sdiv instructions into __aeabi_{u}idiv()" depends on CPU_32v7 && !XIP_KERNEL diff --git a/arch/arm/Makefile b/arch/arm/Makefile -index 963a87972cc8..d212d6b8f2e1 100644 +index 963a87972cc8..2599b3ca81da 100644 --- a/arch/arm/Makefile +++ b/arch/arm/Makefile +@@ -77,15 +77,15 @@ KBUILD_CFLAGS += $(call cc-option,-fno-ipa-sra) + # Note that GCC does not numerically define an architecture version + # macro, but instead defines a whole series of macros which makes + # testing for a specific architecture or later rather impossible. +-arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m -Wa,-march=armv7-m +-arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 $(call cc-option,-march=armv7-a,-march=armv5t -Wa$(comma)-march=armv7-a) +-arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6,-march=armv5t -Wa$(comma)-march=armv6) ++arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m ++arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 -march=armv7-a ++arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 -march=armv6 + # Only override the compiler option if ARMv6. The ARMv6K extensions are + # always available in ARMv7 + ifeq ($(CONFIG_CPU_32v6),y) +-arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6k,-march=armv5t -Wa$(comma)-march=armv6k) ++arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 -march=armv6k + endif +-arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 $(call cc-option,-march=armv5te,-march=armv4t) ++arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 -march=armv5te + arch-$(CONFIG_CPU_32v4T) =-D__LINUX_ARM_ARCH__=4 -march=armv4t + arch-$(CONFIG_CPU_32v4) =-D__LINUX_ARM_ARCH__=4 -march=armv4 + arch-$(CONFIG_CPU_32v3) =-D__LINUX_ARM_ARCH__=3 -march=armv3 +@@ -99,7 +99,7 @@ tune-$(CONFIG_CPU_ARM720T) =-mtune=arm7tdmi + tune-$(CONFIG_CPU_ARM740T) =-mtune=arm7tdmi + tune-$(CONFIG_CPU_ARM9TDMI) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_ARM940T) =-mtune=arm9tdmi +-tune-$(CONFIG_CPU_ARM946E) =$(call cc-option,-mtune=arm9e,-mtune=arm9tdmi) ++tune-$(CONFIG_CPU_ARM946E) =-mtune=arm9e + tune-$(CONFIG_CPU_ARM920T) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_ARM922T) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_ARM925T) =-mtune=arm9tdmi +@@ -107,11 +107,11 @@ tune-$(CONFIG_CPU_ARM926T) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_FA526) =-mtune=arm9tdmi + tune-$(CONFIG_CPU_SA110) =-mtune=strongarm110 + tune-$(CONFIG_CPU_SA1100) =-mtune=strongarm1100 +-tune-$(CONFIG_CPU_XSCALE) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale +-tune-$(CONFIG_CPU_XSC3) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale +-tune-$(CONFIG_CPU_FEROCEON) =$(call cc-option,-mtune=marvell-f,-mtune=xscale) +-tune-$(CONFIG_CPU_V6) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm) +-tune-$(CONFIG_CPU_V6K) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm) ++tune-$(CONFIG_CPU_XSCALE) =-mtune=xscale ++tune-$(CONFIG_CPU_XSC3) =-mtune=xscale ++tune-$(CONFIG_CPU_FEROCEON) =-mtune=xscale ++tune-$(CONFIG_CPU_V6) =-mtune=arm1136j-s ++tune-$(CONFIG_CPU_V6K) =-mtune=arm1136j-s + + # Evaluate tune cc-option calls now + tune-y := $(tune-y) @@ -126,9 +126,11 @@ ifeq ($(CONFIG_ARM_UNWIND),y) CFLAGS_ABI +=-funwind-tables endif @@ -4881,6 +5777,56 @@ index 963a87972cc8..d212d6b8f2e1 100644 AFLAGS_ISA :=$(CFLAGS_ISA) endif +diff --git a/arch/arm/boot/bootp/Makefile b/arch/arm/boot/bootp/Makefile +index 5e4acd253b30..8d1e31b4ba94 100644 +--- a/arch/arm/boot/bootp/Makefile ++++ b/arch/arm/boot/bootp/Makefile +@@ -7,7 +7,7 @@ + + GCOV_PROFILE := n + +-LDFLAGS_bootp :=-p --no-undefined -X \ ++LDFLAGS_bootp := --no-undefined -X \ + --defsym initrd_phys=$(INITRD_PHYS) \ + --defsym params_phys=$(PARAMS_PHYS) -T + AFLAGS_initrd.o :=-DINITRD=\"$(INITRD)\" +diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile +index 552c7d7f84ce..561dbc0ee2ba 100644 +--- a/arch/arm/boot/compressed/Makefile ++++ b/arch/arm/boot/compressed/Makefile +@@ -86,6 +86,8 @@ $(addprefix $(obj)/,$(libfdt_objs) atags_to_fdt.o): \ + $(addprefix $(obj)/,$(libfdt_hdrs)) + + ifeq ($(CONFIG_ARM_ATAG_DTB_COMPAT),y) ++CFLAGS_REMOVE_atags_to_fdt.o += -Wframe-larger-than=${CONFIG_FRAME_WARN} ++CFLAGS_atags_to_fdt.o += -Wframe-larger-than=1280 + OBJS += $(libfdt_objs) atags_to_fdt.o + endif + +@@ -126,8 +128,6 @@ endif + ifeq ($(CONFIG_CPU_ENDIAN_BE8),y) + LDFLAGS_vmlinux += --be8 + endif +-# ? +-LDFLAGS_vmlinux += -p + # Report unresolved symbol references + LDFLAGS_vmlinux += --no-undefined + # Delete all temporary local symbols +diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c +index a0765e7ed6c7..b0255cbf3b76 100644 +--- a/arch/arm/boot/compressed/decompress.c ++++ b/arch/arm/boot/compressed/decompress.c +@@ -46,7 +46,10 @@ extern char * strstr(const char * s1, const char *s2); + #endif + + #ifdef CONFIG_KERNEL_XZ ++/* Prevent KASAN override of string helpers in decompressor */ ++#undef memmove + #define memmove memmove ++#undef memcpy + #define memcpy memcpy + #include "../../../../lib/decompress_unxz.c" + #endif diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S index f1b4ea9700b8..658efefff545 100644 --- a/arch/arm/boot/compressed/head.S @@ -4910,6 +5856,19 @@ index 947c81b7aaaf..56a04d3086c3 100644 /* WLS1271 WiFi */ wlcore: wlcore@1 { compatible = "ti,wl1271"; +diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts +index 21918807c9f6..f42a92391289 100644 +--- a/arch/arm/boot/dts/am43x-epos-evm.dts ++++ b/arch/arm/boot/dts/am43x-epos-evm.dts +@@ -411,7 +411,7 @@ + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&i2c0_pins>; +- clock-frequency = <400000>; ++ clock-frequency = <100000>; + + tps65218: tps65218@24 { + reg = <0x24>; diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts index 5a53fcf542ab..07133c5ad294 100644 --- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts @@ -4999,6 +5958,19 @@ index 70adf940d98c..620aa3f555f8 100644 }; }; +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 4616452ce74d..e0f96be549f1 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -234,6 +234,8 @@ + + gpio-controller; + #gpio-cells = <2>; ++ interrupt-controller; ++ #interrupt-cells = <2>; + }; + + usb2: usb2@21000 { diff --git a/arch/arm/boot/dts/bcm63138.dtsi b/arch/arm/boot/dts/bcm63138.dtsi index 547369c69e96..aedbea888684 100644 --- a/arch/arm/boot/dts/bcm63138.dtsi @@ -5297,6 +6269,45 @@ index 2802c9565b6c..976a75a4eb2c 100644 }; }; +diff --git a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +index 73e272fadc20..58d288fddd9c 100644 +--- a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi ++++ b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +@@ -28,7 +28,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 719150693449..338ee6bd0e0c 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -352,7 +352,7 @@ + compatible = "bosch,bma180"; + reg = <0x41>; + pinctrl-names = "default"; +- pintcrl-0 = <&bma180_pins>; ++ pinctrl-0 = <&bma180_pins>; + interrupt-parent = <&gpio4>; + interrupts = <19 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_115 */ + }; +diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +index 82e98ee3023a..3dbeb7a6c569 100644 +--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi ++++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +@@ -25,7 +25,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; diff --git a/arch/arm/boot/dts/omap3.dtsi b/arch/arm/boot/dts/omap3.dtsi index 2008648b8c9f..0a7600d06fb5 100644 --- a/arch/arm/boot/dts/omap3.dtsi @@ -5311,6 +6322,19 @@ index 2008648b8c9f..0a7600d06fb5 100644 serial0 = &uart1; serial1 = &uart2; serial2 = &uart3; +diff --git a/arch/arm/boot/dts/omap3430-sdp.dts b/arch/arm/boot/dts/omap3430-sdp.dts +index abd6921143be..e0ba97bd41b7 100644 +--- a/arch/arm/boot/dts/omap3430-sdp.dts ++++ b/arch/arm/boot/dts/omap3430-sdp.dts +@@ -104,7 +104,7 @@ + + nand@1,0 { + compatible = "ti,omap2-nand"; +- reg = <0 0 4>; /* CS0, offset 0, IO size 4 */ ++ reg = <1 0 4>; /* CS1, offset 0, IO size 4 */ + interrupt-parent = <&gpmc>; + interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */ + <1 IRQ_TYPE_NONE>; /* termcount */ diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi index 4d6584f15b17..7e5a09c3d2a6 100644 --- a/arch/arm/boot/dts/omap4.dtsi @@ -5883,6 +6907,40 @@ index f520cbff5e1c..342ae7ef9f08 100644 clocks = <&l4_sys_free_clk>; clock-names = "timer"; }; +diff --git a/arch/arm/boot/dts/spear3xx.dtsi b/arch/arm/boot/dts/spear3xx.dtsi +index 118135d75899..4e4166d96b26 100644 +--- a/arch/arm/boot/dts/spear3xx.dtsi ++++ b/arch/arm/boot/dts/spear3xx.dtsi +@@ -53,7 +53,7 @@ + }; + + gmac: eth@e0800000 { +- compatible = "st,spear600-gmac"; ++ compatible = "snps,dwmac-3.40a"; + reg = <0xe0800000 0x8000>; + interrupts = <23 22>; + interrupt-names = "macirq", "eth_wake_irq"; +diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi +index 1077ceebb2d6..87494773f409 100644 +--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi ++++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi +@@ -755,14 +755,14 @@ + status = "disabled"; + }; + +- vica: intc@10140000 { ++ vica: interrupt-controller@10140000 { + compatible = "arm,versatile-vic"; + interrupt-controller; + #interrupt-cells = <1>; + reg = <0x10140000 0x20>; + }; + +- vicb: intc@10140020 { ++ vicb: interrupt-controller@10140020 { + compatible = "arm,versatile-vic"; + interrupt-controller; + #interrupt-cells = <1>; diff --git a/arch/arm/boot/dts/stm32f429.dtsi b/arch/arm/boot/dts/stm32f429.dtsi index 336ee4fb587d..64dc50afc385 100644 --- a/arch/arm/boot/dts/stm32f429.dtsi @@ -5909,6 +6967,81 @@ index 7e7dfc2b43db..d1af56d2f25e 100644 hysteresis = <2000>; type = "passive"; }; +diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi +index 27d2bbbf1eae..a613e3b85b45 100644 +--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi ++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi +@@ -184,8 +184,9 @@ + nvidia,pins = "ata", "atb", "atc", "atd", "ate", + "cdev1", "cdev2", "dap1", "dtb", "gma", + "gmb", "gmc", "gmd", "gme", "gpu7", +- "gpv", "i2cp", "pta", "rm", "slxa", +- "slxk", "spia", "spib", "uac"; ++ "gpv", "i2cp", "irrx", "irtx", "pta", ++ "rm", "slxa", "slxk", "spia", "spib", ++ "uac"; + nvidia,pull = ; + nvidia,tristate = ; + }; +@@ -210,7 +211,7 @@ + conf_ddc { + nvidia,pins = "ddc", "dta", "dtd", "kbca", + "kbcb", "kbcc", "kbcd", "kbce", "kbcf", +- "sdc"; ++ "sdc", "uad", "uca"; + nvidia,pull = ; + nvidia,tristate = ; + }; +@@ -220,10 +221,9 @@ + "lvp0", "owc", "sdb"; + nvidia,tristate = ; + }; +- conf_irrx { +- nvidia,pins = "irrx", "irtx", "sdd", "spic", +- "spie", "spih", "uaa", "uab", "uad", +- "uca", "ucb"; ++ conf_sdd { ++ nvidia,pins = "sdd", "spic", "spie", "spih", ++ "uaa", "uab", "ucb"; + nvidia,pull = ; + nvidia,tristate = ; + }; +diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts +index 00d7d28e86f0..4633b79bf5ea 100644 +--- a/arch/arm/boot/dts/versatile-ab.dts ++++ b/arch/arm/boot/dts/versatile-ab.dts +@@ -154,16 +154,15 @@ + #size-cells = <1>; + ranges; + +- vic: intc@10140000 { ++ vic: interrupt-controller@10140000 { + compatible = "arm,versatile-vic"; + interrupt-controller; + #interrupt-cells = <1>; + reg = <0x10140000 0x1000>; +- clear-mask = <0xffffffff>; + valid-mask = <0xffffffff>; + }; + +- sic: intc@10003000 { ++ sic: interrupt-controller@10003000 { + compatible = "arm,versatile-sic"; + interrupt-controller; + #interrupt-cells = <1>; +diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts +index 33a8eb28374e..3a23164c2c2d 100644 +--- a/arch/arm/boot/dts/versatile-pb.dts ++++ b/arch/arm/boot/dts/versatile-pb.dts +@@ -6,7 +6,7 @@ + + amba { + /* The Versatile PB is using more SIC IRQ lines than the AB */ +- sic: intc@10003000 { ++ sic: interrupt-controller@10003000 { + clear-mask = <0xffffffff>; + /* + * Valid interrupt lines mask according to diff --git a/arch/arm/configs/msm8909-perf_defconfig b/arch/arm/configs/msm8909-perf_defconfig old mode 100755 new mode 100644 @@ -7758,6 +8891,70 @@ index 000000000000..b1b56d757c35 +CONFIG_CRYPTO_AES_ARM_BS=y +CONFIG_CRYPTO_AES_ARM_CE=y +CONFIG_QMI_ENCDEC=y +diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h +index 22b73112b75f..1c30be0f5dd0 100644 +--- a/arch/arm/include/asm/ftrace.h ++++ b/arch/arm/include/asm/ftrace.h +@@ -14,6 +14,9 @@ struct dyn_arch_ftrace { + #ifdef CONFIG_OLD_MCOUNT + bool old_mcount; + #endif ++#ifdef CONFIG_ARM_MODULE_PLTS ++ struct module *mod; ++#endif + }; + + static inline unsigned long ftrace_call_adjust(unsigned long addr) +diff --git a/arch/arm/include/asm/insn.h b/arch/arm/include/asm/insn.h +index e96065da4dae..0043bf609f27 100644 +--- a/arch/arm/include/asm/insn.h ++++ b/arch/arm/include/asm/insn.h +@@ -12,18 +12,18 @@ arm_gen_nop(void) + } + + unsigned long +-__arm_gen_branch(unsigned long pc, unsigned long addr, bool link); ++__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn); + + static inline unsigned long + arm_gen_branch(unsigned long pc, unsigned long addr) + { +- return __arm_gen_branch(pc, addr, false); ++ return __arm_gen_branch(pc, addr, false, true); + } + + static inline unsigned long +-arm_gen_branch_link(unsigned long pc, unsigned long addr) ++arm_gen_branch_link(unsigned long pc, unsigned long addr, bool warn) + { +- return __arm_gen_branch(pc, addr, true); ++ return __arm_gen_branch(pc, addr, true, warn); + } + + #endif +diff --git a/arch/arm/include/asm/module.h b/arch/arm/include/asm/module.h +index ed2319663a1e..3cfbe8181224 100644 +--- a/arch/arm/include/asm/module.h ++++ b/arch/arm/include/asm/module.h +@@ -18,8 +18,18 @@ enum { + }; + #endif + ++#define PLT_ENT_STRIDE L1_CACHE_BYTES ++#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32)) ++#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT) ++ ++struct plt_entries { ++ u32 ldr[PLT_ENT_COUNT]; ++ u32 lit[PLT_ENT_COUNT]; ++}; ++ + struct mod_plt_sec { + struct elf32_shdr *plt; ++ struct plt_entries *plt_ent; + int plt_count; + }; + diff --git a/arch/arm/include/asm/percpu.h b/arch/arm/include/asm/percpu.h index a89b4076cde4..72821b4721ad 100644 --- a/arch/arm/include/asm/percpu.h @@ -7771,6 +8968,51 @@ index a89b4076cde4..72821b4721ad 100644 /* * Same as asm-generic/percpu.h, except that we store the per cpu offset * in the TPIDRPRW. TPIDRPRW only exists on V6K and V7 +diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h +index 92fd2c8a9af0..6154902bed83 100644 +--- a/arch/arm/include/asm/pgtable-2level.h ++++ b/arch/arm/include/asm/pgtable-2level.h +@@ -78,6 +78,8 @@ + #define PTE_HWTABLE_OFF (PTE_HWTABLE_PTRS * sizeof(pte_t)) + #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u32)) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 ++ + /* + * PMD_SHIFT determines the size of the area a second-level page table can map + * PGDIR_SHIFT determines what a third-level page table entry can map +diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h +index 2a029bceaf2f..35807e611b6e 100644 +--- a/arch/arm/include/asm/pgtable-3level.h ++++ b/arch/arm/include/asm/pgtable-3level.h +@@ -37,6 +37,8 @@ + #define PTE_HWTABLE_OFF (0) + #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u64)) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 40 ++ + /* + * PGDIR_SHIFT determines the size a top-level page table entry can map. + */ +diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h +index 1e25cd80589e..1cee2d540956 100644 +--- a/arch/arm/include/asm/tlb.h ++++ b/arch/arm/include/asm/tlb.h +@@ -278,6 +278,14 @@ tlb_remove_pmd_tlb_entry(struct mmu_gather *tlb, pmd_t *pmdp, unsigned long addr + tlb_add_flush(tlb, addr); + } + ++static inline void ++tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address, ++ unsigned long size) ++{ ++ tlb_add_flush(tlb, address); ++ tlb_add_flush(tlb, address + size - PMD_SIZE); ++} ++ + #define pte_free_tlb(tlb, ptep, addr) __pte_free_tlb(tlb, ptep, addr) + #define pmd_free_tlb(tlb, pmdp, addr) __pmd_free_tlb(tlb, pmdp, addr) + #define pud_free_tlb(tlb, pudp, addr) pud_free((tlb)->mm, pudp) diff --git a/arch/arm/include/asm/unified.h b/arch/arm/include/asm/unified.h index a91ae499614c..2c3b952be63e 100644 --- a/arch/arm/include/asm/unified.h @@ -7865,6 +9107,151 @@ index a91ae499614c..2c3b952be63e 100644 -#endif /* CONFIG_ARM_ASM_UNIFIED */ - #endif /* !__ASM_UNIFIED_H */ +diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile +index adb9add28b6f..9bddd762880c 100644 +--- a/arch/arm/kernel/Makefile ++++ b/arch/arm/kernel/Makefile +@@ -16,10 +16,14 @@ CFLAGS_REMOVE_return_address.o = -pg + # Object file lists. + + obj-y := elf.o entry-common.o irq.o opcodes.o \ +- process.o ptrace.o reboot.o return_address.o \ ++ process.o ptrace.o reboot.o \ + setup.o signal.o sigreturn_codes.o \ + stacktrace.o sys_arm.o time.o traps.o + ++ifneq ($(CONFIG_ARM_UNWIND),y) ++obj-$(CONFIG_FRAME_POINTER) += return_address.o ++endif ++ + obj-$(CONFIG_ATAGS) += atags_parse.o + obj-$(CONFIG_ATAGS_PROC) += atags_proc.o + obj-$(CONFIG_DEPRECATED_PARAM_STRUCT) += atags_compat.o +diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S +index 9f157e7c51e7..2cac25a69a85 100644 +--- a/arch/arm/kernel/entry-armv.S ++++ b/arch/arm/kernel/entry-armv.S +@@ -631,11 +631,9 @@ call_fpe: + tstne r0, #0x04000000 @ bit 26 set on both ARM and Thumb-2 + reteq lr + and r8, r0, #0x00000f00 @ mask out CP number +- THUMB( lsr r8, r8, #8 ) + mov r7, #1 +- add r6, r10, #TI_USED_CP +- ARM( strb r7, [r6, r8, lsr #8] ) @ set appropriate used_cp[] +- THUMB( strb r7, [r6, r8] ) @ set appropriate used_cp[] ++ add r6, r10, r8, lsr #8 @ add used_cp[] array offset first ++ strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[] + #ifdef CONFIG_IWMMXT + @ Test if we need to give access to iWMMXt coprocessors + ldr r5, [r10, #TI_FLAGS] +@@ -644,7 +642,7 @@ call_fpe: + bcs iwmmxt_task_enable + #endif + ARM( add pc, pc, r8, lsr #6 ) +- THUMB( lsl r8, r8, #2 ) ++ THUMB( lsr r8, r8, #6 ) + THUMB( add pc, r8 ) + nop + +diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c +index 414e60ed0257..b1cf37fec354 100644 +--- a/arch/arm/kernel/ftrace.c ++++ b/arch/arm/kernel/ftrace.c +@@ -95,9 +95,10 @@ int ftrace_arch_code_modify_post_process(void) + return 0; + } + +-static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr) ++static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr, ++ bool warn) + { +- return arm_gen_branch_link(pc, addr); ++ return arm_gen_branch_link(pc, addr, warn); + } + + static int ftrace_modify_code(unsigned long pc, unsigned long old, +@@ -136,14 +137,14 @@ int ftrace_update_ftrace_func(ftrace_func_t func) + int ret; + + pc = (unsigned long)&ftrace_call; +- new = ftrace_call_replace(pc, (unsigned long)func); ++ new = ftrace_call_replace(pc, (unsigned long)func, true); + + ret = ftrace_modify_code(pc, 0, new, false); + + #ifdef CONFIG_OLD_MCOUNT + if (!ret) { + pc = (unsigned long)&ftrace_call_old; +- new = ftrace_call_replace(pc, (unsigned long)func); ++ new = ftrace_call_replace(pc, (unsigned long)func, true); + + ret = ftrace_modify_code(pc, 0, new, false); + } +@@ -156,9 +157,21 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + { + unsigned long new, old; + unsigned long ip = rec->ip; ++ unsigned long aaddr = adjust_address(rec, addr); ++ struct module *mod = NULL; ++ ++#ifdef CONFIG_ARM_MODULE_PLTS ++ mod = rec->arch.mod; ++#endif + + old = ftrace_nop_replace(rec); +- new = ftrace_call_replace(ip, adjust_address(rec, addr)); ++ new = ftrace_call_replace(ip, aaddr, !mod); ++#ifdef CONFIG_ARM_MODULE_PLTS ++ if (!new && mod) { ++ aaddr = get_module_plt(mod, ip, aaddr); ++ new = ftrace_call_replace(ip, aaddr, true); ++ } ++#endif + + return ftrace_modify_code(rec->ip, old, new, true); + } +@@ -166,12 +179,29 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + int ftrace_make_nop(struct module *mod, + struct dyn_ftrace *rec, unsigned long addr) + { ++ unsigned long aaddr = adjust_address(rec, addr); + unsigned long ip = rec->ip; + unsigned long old; + unsigned long new; + int ret; + +- old = ftrace_call_replace(ip, adjust_address(rec, addr)); ++#ifdef CONFIG_ARM_MODULE_PLTS ++ /* mod is only supplied during module loading */ ++ if (!mod) ++ mod = rec->arch.mod; ++ else ++ rec->arch.mod = mod; ++#endif ++ ++ old = ftrace_call_replace(ip, aaddr, ++ !IS_ENABLED(CONFIG_ARM_MODULE_PLTS) || !mod); ++#ifdef CONFIG_ARM_MODULE_PLTS ++ if (!old && mod) { ++ aaddr = get_module_plt(mod, ip, aaddr); ++ old = ftrace_call_replace(ip, aaddr, true); ++ } ++#endif ++ + new = ftrace_nop_replace(rec); + ret = ftrace_modify_code(ip, old, new, true); + +@@ -179,7 +209,8 @@ int ftrace_make_nop(struct module *mod, + if (ret == -EINVAL && addr == MCOUNT_ADDR) { + rec->arch.old_mcount = true; + +- old = ftrace_call_replace(ip, adjust_address(rec, addr)); ++ old = ftrace_call_replace(ip, adjust_address(rec, addr), ++ !IS_ENABLED(CONFIG_ARM_MODULE_PLTS) || !mod); + new = ftrace_nop_replace(rec); + ret = ftrace_modify_code(ip, old, new, true); + } diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S index 04286fd9e09c..2e336acd68b0 100644 --- a/arch/arm/kernel/head.S @@ -8073,6 +9460,173 @@ index 25538a935874..59e04e2d9d9d 100644 enable_single_step(bp, addr); goto unlock; } +diff --git a/arch/arm/kernel/insn.c b/arch/arm/kernel/insn.c +index b760340b7014..eaded01b7edf 100644 +--- a/arch/arm/kernel/insn.c ++++ b/arch/arm/kernel/insn.c +@@ -2,8 +2,9 @@ + #include + #include + +-static unsigned long +-__arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link) ++static unsigned long __arm_gen_branch_thumb2(unsigned long pc, ++ unsigned long addr, bool link, ++ bool warn) + { + unsigned long s, j1, j2, i1, i2, imm10, imm11; + unsigned long first, second; +@@ -11,7 +12,7 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link) + + offset = (long)addr - (long)(pc + 4); + if (offset < -16777216 || offset > 16777214) { +- WARN_ON_ONCE(1); ++ WARN_ON_ONCE(warn); + return 0; + } + +@@ -32,8 +33,8 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link) + return __opcode_thumb32_compose(first, second); + } + +-static unsigned long +-__arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link) ++static unsigned long __arm_gen_branch_arm(unsigned long pc, unsigned long addr, ++ bool link, bool warn) + { + unsigned long opcode = 0xea000000; + long offset; +@@ -43,7 +44,7 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link) + + offset = (long)addr - (long)(pc + 8); + if (unlikely(offset < -33554432 || offset > 33554428)) { +- WARN_ON_ONCE(1); ++ WARN_ON_ONCE(warn); + return 0; + } + +@@ -53,10 +54,10 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link) + } + + unsigned long +-__arm_gen_branch(unsigned long pc, unsigned long addr, bool link) ++__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn) + { + if (IS_ENABLED(CONFIG_THUMB2_KERNEL)) +- return __arm_gen_branch_thumb2(pc, addr, link); ++ return __arm_gen_branch_thumb2(pc, addr, link, warn); + else +- return __arm_gen_branch_arm(pc, addr, link); ++ return __arm_gen_branch_arm(pc, addr, link, warn); + } +diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c +index 3d0c2e4dda1d..ed0e09cc735f 100644 +--- a/arch/arm/kernel/module-plts.c ++++ b/arch/arm/kernel/module-plts.c +@@ -7,6 +7,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -14,10 +15,6 @@ + #include + #include + +-#define PLT_ENT_STRIDE L1_CACHE_BYTES +-#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32)) +-#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT) +- + #ifdef CONFIG_THUMB2_KERNEL + #define PLT_ENT_LDR __opcode_to_mem_thumb32(0xf8dff000 | \ + (PLT_ENT_STRIDE - 4)) +@@ -26,9 +23,11 @@ + (PLT_ENT_STRIDE - 8)) + #endif + +-struct plt_entries { +- u32 ldr[PLT_ENT_COUNT]; +- u32 lit[PLT_ENT_COUNT]; ++static const u32 fixed_plts[] = { ++#ifdef CONFIG_DYNAMIC_FTRACE ++ FTRACE_ADDR, ++ MCOUNT_ADDR, ++#endif + }; + + static bool in_init(const struct module *mod, unsigned long loc) +@@ -36,14 +35,40 @@ static bool in_init(const struct module *mod, unsigned long loc) + return loc - (u32)mod->init_layout.base < mod->init_layout.size; + } + ++static void prealloc_fixed(struct mod_plt_sec *pltsec, struct plt_entries *plt) ++{ ++ int i; ++ ++ if (!ARRAY_SIZE(fixed_plts) || pltsec->plt_count) ++ return; ++ pltsec->plt_count = ARRAY_SIZE(fixed_plts); ++ ++ for (i = 0; i < ARRAY_SIZE(plt->ldr); ++i) ++ plt->ldr[i] = PLT_ENT_LDR; ++ ++ BUILD_BUG_ON(sizeof(fixed_plts) > sizeof(plt->lit)); ++ memcpy(plt->lit, fixed_plts, sizeof(fixed_plts)); ++} ++ + u32 get_module_plt(struct module *mod, unsigned long loc, Elf32_Addr val) + { + struct mod_plt_sec *pltsec = !in_init(mod, loc) ? &mod->arch.core : + &mod->arch.init; ++ struct plt_entries *plt; ++ int idx; ++ ++ /* cache the address, ELF header is available only during module load */ ++ if (!pltsec->plt_ent) ++ pltsec->plt_ent = (struct plt_entries *)pltsec->plt->sh_addr; ++ plt = pltsec->plt_ent; + +- struct plt_entries *plt = (struct plt_entries *)pltsec->plt->sh_addr; +- int idx = 0; ++ prealloc_fixed(pltsec, plt); ++ ++ for (idx = 0; idx < ARRAY_SIZE(fixed_plts); ++idx) ++ if (plt->lit[idx] == val) ++ return (u32)&plt->ldr[idx]; + ++ idx = 0; + /* + * Look for an existing entry pointing to 'val'. Given that the + * relocations are sorted, this will be the last entry we allocated. +@@ -191,8 +216,8 @@ static unsigned int count_plts(const Elf32_Sym *syms, Elf32_Addr base, + int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, + char *secstrings, struct module *mod) + { +- unsigned long core_plts = 0; +- unsigned long init_plts = 0; ++ unsigned long core_plts = ARRAY_SIZE(fixed_plts); ++ unsigned long init_plts = ARRAY_SIZE(fixed_plts); + Elf32_Shdr *s, *sechdrs_end = sechdrs + ehdr->e_shnum; + Elf32_Sym *syms = NULL; + +@@ -247,6 +272,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, + mod->arch.core.plt->sh_size = round_up(core_plts * PLT_ENT_SIZE, + sizeof(struct plt_entries)); + mod->arch.core.plt_count = 0; ++ mod->arch.core.plt_ent = NULL; + + mod->arch.init.plt->sh_type = SHT_NOBITS; + mod->arch.init.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC; +@@ -254,6 +280,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, + mod->arch.init.plt->sh_size = round_up(init_plts * PLT_ENT_SIZE, + sizeof(struct plt_entries)); + mod->arch.init.plt_count = 0; ++ mod->arch.init.plt_ent = NULL; + + pr_debug("%s: plt=%x, init.plt=%x\n", __func__, + mod->arch.core.plt->sh_size, mod->arch.init.plt->sh_size); diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c index ae738a6319f6..364985c96a92 100644 --- a/arch/arm/kernel/ptrace.c @@ -8088,6 +9642,26 @@ index ae738a6319f6..364985c96a92 100644 .cpsr_mask = PSR_T_BIT, .cpsr_val = PSR_T_BIT, .fn = break_trap, +diff --git a/arch/arm/kernel/return_address.c b/arch/arm/kernel/return_address.c +index 36ed35073289..f945742dea44 100644 +--- a/arch/arm/kernel/return_address.c ++++ b/arch/arm/kernel/return_address.c +@@ -10,8 +10,6 @@ + */ + #include + #include +- +-#if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) + #include + + #include +@@ -56,6 +54,4 @@ void *return_address(unsigned int level) + return NULL; + } + +-#endif /* if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) */ +- + EXPORT_SYMBOL_GPL(return_address); diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c index 775d70c81587..108b5d17e89e 100755 --- a/arch/arm/kernel/setup.c @@ -8127,8 +9701,39 @@ index 775d70c81587..108b5d17e89e 100755 : "r14"); #endif } +diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c +index 7abc908ebea0..f82a1ac22164 100644 +--- a/arch/arm/kernel/signal.c ++++ b/arch/arm/kernel/signal.c +@@ -626,18 +626,20 @@ struct page *get_signal_page(void) + + addr = page_address(page); + ++ /* Poison the entire page */ ++ memset32(addr, __opcode_to_mem_arm(0xe7fddef1), ++ PAGE_SIZE / sizeof(u32)); ++ + /* Give the signal return code some randomness */ + offset = 0x200 + (get_random_int() & 0x7fc); + signal_return_offset = offset; + +- /* +- * Copy signal return handlers into the vector page, and +- * set sigreturn to be a pointer to these. +- */ ++ /* Copy signal return handlers into the page */ + memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes)); + +- ptr = (unsigned long)addr + offset; +- flush_icache_range(ptr, ptr + sizeof(sigreturn_codes)); ++ /* Flush out all instructions in this page */ ++ ptr = (unsigned long)addr; ++ flush_icache_range(ptr, ptr + PAGE_SIZE); + + return page; + } diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c -index fe76010f75cf..7e939c7b0a21 100644 +index fe76010f75cf..45d09bda3b01 100644 --- a/arch/arm/kernel/stacktrace.c +++ b/arch/arm/kernel/stacktrace.c @@ -19,6 +19,19 @@ @@ -8151,7 +9756,7 @@ index fe76010f75cf..7e939c7b0a21 100644 * Note that with framepointer enabled, even the leaf functions have the same * prologue and epilogue, therefore we can ignore the LR value in this case. */ -@@ -31,6 +44,16 @@ int notrace unwind_frame(struct stackframe *frame) +@@ -31,6 +44,15 @@ int notrace unwind_frame(struct stackframe *frame) low = frame->sp; high = ALIGN(low, THREAD_SIZE); @@ -8162,13 +9767,12 @@ index fe76010f75cf..7e939c7b0a21 100644 + + frame->sp = frame->fp; + frame->fp = *(unsigned long *)(fp); -+ frame->pc = frame->lr; -+ frame->lr = *(unsigned long *)(fp + 4); ++ frame->pc = *(unsigned long *)(fp + 4); +#else /* check current frame pointer is within bounds */ if (fp < low + 12 || fp > high - 4) return -EINVAL; -@@ -39,6 +62,7 @@ int notrace unwind_frame(struct stackframe *frame) +@@ -39,6 +61,7 @@ int notrace unwind_frame(struct stackframe *frame) frame->fp = *(unsigned long *)(fp - 12); frame->sp = *(unsigned long *)(fp - 8); frame->pc = *(unsigned long *)(fp - 4); @@ -8316,10 +9920,18 @@ index 868781fd460c..14c630c899c5 100644 of_node_put(node); diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c -index dd9eb3f14f45..6da26692f2fd 100644 +index dd9eb3f14f45..950c9f2ffe00 100644 --- a/arch/arm/mach-imx/pm-imx6.c +++ b/arch/arm/mach-imx/pm-imx6.c -@@ -481,14 +481,14 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -481,14 +482,14 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) if (!ocram_pool) { pr_warn("%s: ocram pool unavailable!\n", __func__); ret = -ENODEV; @@ -8336,7 +9948,7 @@ index dd9eb3f14f45..6da26692f2fd 100644 } ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base); -@@ -511,7 +511,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) +@@ -511,7 +512,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) ret = imx6_pm_get_base(&pm_info->mmdc_base, socdata->mmdc_compat); if (ret) { pr_warn("%s: failed to get mmdc base %d!\n", __func__, ret); @@ -8345,7 +9957,7 @@ index dd9eb3f14f45..6da26692f2fd 100644 } ret = imx6_pm_get_base(&pm_info->src_base, socdata->src_compat); -@@ -558,7 +558,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) +@@ -558,7 +559,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) &imx6_suspend, MX6Q_SUSPEND_OCRAM_SIZE - sizeof(*pm_info)); @@ -8354,7 +9966,7 @@ index dd9eb3f14f45..6da26692f2fd 100644 pl310_cache_map_failed: iounmap(pm_info->gpc_base.vbase); -@@ -568,6 +568,8 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) +@@ -568,6 +569,8 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) iounmap(pm_info->src_base.vbase); src_map_failed: iounmap(pm_info->mmdc_base.vbase); @@ -8363,6 +9975,14 @@ index dd9eb3f14f45..6da26692f2fd 100644 put_node: of_node_put(node); +@@ -604,6 +607,7 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata + + static void imx6_pm_stby_poweroff(void) + { ++ gic_cpu_if_down(0); + imx6_set_lpm(STOP_POWER_OFF); + imx6q_suspend_finish(0); + diff --git a/arch/arm/mach-imx/suspend-imx53.S b/arch/arm/mach-imx/suspend-imx53.S index 5ed078ad110a..f12d24104075 100644 --- a/arch/arm/mach-imx/suspend-imx53.S @@ -8485,6 +10105,55 @@ index f989145480c8..bf236b7af8c1 100644 } break; case BUS_NOTIFY_ADD_DEVICE: +diff --git a/arch/arm/mach-socfpga/core.h b/arch/arm/mach-socfpga/core.h +index 65e1817d8afe..692a287a8712 100644 +--- a/arch/arm/mach-socfpga/core.h ++++ b/arch/arm/mach-socfpga/core.h +@@ -48,7 +48,7 @@ extern void __iomem *sdr_ctl_base_addr; + u32 socfpga_sdram_self_refresh(u32 sdr_base); + extern unsigned int socfpga_sdram_self_refresh_sz; + +-extern char secondary_trampoline, secondary_trampoline_end; ++extern char secondary_trampoline[], secondary_trampoline_end[]; + + extern unsigned long socfpga_cpu1start_addr; + +diff --git a/arch/arm/mach-socfpga/platsmp.c b/arch/arm/mach-socfpga/platsmp.c +index 07945748b571..1dfc9e7389a7 100644 +--- a/arch/arm/mach-socfpga/platsmp.c ++++ b/arch/arm/mach-socfpga/platsmp.c +@@ -31,14 +31,14 @@ + + static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle) + { +- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline; ++ int trampoline_size = secondary_trampoline_end - secondary_trampoline; + + if (socfpga_cpu1start_addr) { + /* This will put CPU #1 into reset. */ + writel(RSTMGR_MPUMODRST_CPU1, + rst_manager_base_addr + SOCFPGA_RSTMGR_MODMPURST); + +- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size); ++ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size); + + writel(virt_to_phys(secondary_startup), + sys_manager_base_addr + (socfpga_cpu1start_addr & 0x000000ff)); +@@ -56,12 +56,12 @@ static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle) + + static int socfpga_a10_boot_secondary(unsigned int cpu, struct task_struct *idle) + { +- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline; ++ int trampoline_size = secondary_trampoline_end - secondary_trampoline; + + if (socfpga_cpu1start_addr) { + writel(RSTMGR_MPUMODRST_CPU1, rst_manager_base_addr + + SOCFPGA_A10_RSTMGR_MODMPURST); +- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size); ++ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size); + + writel(virt_to_phys(secondary_startup), + sys_manager_base_addr + (socfpga_cpu1start_addr & 0x00000fff)); diff --git a/arch/arm/mach-socfpga/pm.c b/arch/arm/mach-socfpga/pm.c index c378ab0c2431..93f2245c9775 100644 --- a/arch/arm/mach-socfpga/pm.c @@ -8539,6 +10208,19 @@ index e01cbca196b5..a67fcf7a5643 100644 .smp = smp_ops(tegra_smp_ops), .map_io = tegra_map_common_io, .init_early = tegra_init_early, +diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig +index 1ebcf03c2623..9d9171ff521a 100644 +--- a/arch/arm/mm/Kconfig ++++ b/arch/arm/mm/Kconfig +@@ -731,7 +731,7 @@ config CPU_BIG_ENDIAN + config CPU_ENDIAN_BE8 + bool + depends on CPU_BIG_ENDIAN +- default CPU_V6 || CPU_V6K || CPU_V7 ++ default CPU_V6 || CPU_V6K || CPU_V7 || CPU_V7M + help + Support for the BE-8 (big-endian) mode on ARMv6 and ARMv7 processors. + diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c index d1870c777c6e..3a465bfa7d4a 100644 --- a/arch/arm/mm/cache-l2x0.c @@ -8576,8 +10258,501 @@ index d1870c777c6e..3a465bfa7d4a 100644 } else if (ret != -EINVAL) { pr_err("L2C-310 OF prefetch-instr property value is missing\n"); } +diff --git a/arch/arm/mm/copypage-fa.c b/arch/arm/mm/copypage-fa.c +index d130a5ece5d5..bf24690ec83a 100644 +--- a/arch/arm/mm/copypage-fa.c ++++ b/arch/arm/mm/copypage-fa.c +@@ -17,26 +17,25 @@ + /* + * Faraday optimised copy_user_page + */ +-static void __naked +-fa_copy_user_page(void *kto, const void *kfrom) ++static void fa_copy_user_page(void *kto, const void *kfrom) + { +- asm("\ +- stmfd sp!, {r4, lr} @ 2\n\ +- mov r2, %0 @ 1\n\ +-1: ldmia r1!, {r3, r4, ip, lr} @ 4\n\ +- stmia r0, {r3, r4, ip, lr} @ 4\n\ +- mcr p15, 0, r0, c7, c14, 1 @ 1 clean and invalidate D line\n\ +- add r0, r0, #16 @ 1\n\ +- ldmia r1!, {r3, r4, ip, lr} @ 4\n\ +- stmia r0, {r3, r4, ip, lr} @ 4\n\ +- mcr p15, 0, r0, c7, c14, 1 @ 1 clean and invalidate D line\n\ +- add r0, r0, #16 @ 1\n\ +- subs r2, r2, #1 @ 1\n\ ++ int tmp; ++ ++ asm volatile ("\ ++1: ldmia %1!, {r3, r4, ip, lr} @ 4\n\ ++ stmia %0, {r3, r4, ip, lr} @ 4\n\ ++ mcr p15, 0, %0, c7, c14, 1 @ 1 clean and invalidate D line\n\ ++ add %0, %0, #16 @ 1\n\ ++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\ ++ stmia %0, {r3, r4, ip, lr} @ 4\n\ ++ mcr p15, 0, %0, c7, c14, 1 @ 1 clean and invalidate D line\n\ ++ add %0, %0, #16 @ 1\n\ ++ subs %2, %2, #1 @ 1\n\ + bne 1b @ 1\n\ +- mcr p15, 0, r2, c7, c10, 4 @ 1 drain WB\n\ +- ldmfd sp!, {r4, pc} @ 3" +- : +- : "I" (PAGE_SIZE / 32)); ++ mcr p15, 0, %2, c7, c10, 4 @ 1 drain WB" ++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp) ++ : "2" (PAGE_SIZE / 32) ++ : "r3", "r4", "ip", "lr"); + } + + void fa_copy_user_highpage(struct page *to, struct page *from, +diff --git a/arch/arm/mm/copypage-feroceon.c b/arch/arm/mm/copypage-feroceon.c +index 49ee0c1a7209..cc819732d9b8 100644 +--- a/arch/arm/mm/copypage-feroceon.c ++++ b/arch/arm/mm/copypage-feroceon.c +@@ -13,58 +13,56 @@ + #include + #include + +-static void __naked +-feroceon_copy_user_page(void *kto, const void *kfrom) ++static void feroceon_copy_user_page(void *kto, const void *kfrom) + { +- asm("\ +- stmfd sp!, {r4-r9, lr} \n\ +- mov ip, %2 \n\ +-1: mov lr, r1 \n\ +- ldmia r1!, {r2 - r9} \n\ +- pld [lr, #32] \n\ +- pld [lr, #64] \n\ +- pld [lr, #96] \n\ +- pld [lr, #128] \n\ +- pld [lr, #160] \n\ +- pld [lr, #192] \n\ +- pld [lr, #224] \n\ +- stmia r0, {r2 - r9} \n\ +- ldmia r1!, {r2 - r9} \n\ +- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\ +- add r0, r0, #32 \n\ +- stmia r0, {r2 - r9} \n\ +- ldmia r1!, {r2 - r9} \n\ +- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\ +- add r0, r0, #32 \n\ +- stmia r0, {r2 - r9} \n\ +- ldmia r1!, {r2 - r9} \n\ +- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\ +- add r0, r0, #32 \n\ +- stmia r0, {r2 - r9} \n\ +- ldmia r1!, {r2 - r9} \n\ +- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\ +- add r0, r0, #32 \n\ +- stmia r0, {r2 - r9} \n\ +- ldmia r1!, {r2 - r9} \n\ +- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\ +- add r0, r0, #32 \n\ +- stmia r0, {r2 - r9} \n\ +- ldmia r1!, {r2 - r9} \n\ +- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\ +- add r0, r0, #32 \n\ +- stmia r0, {r2 - r9} \n\ +- ldmia r1!, {r2 - r9} \n\ +- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\ +- add r0, r0, #32 \n\ +- stmia r0, {r2 - r9} \n\ +- subs ip, ip, #(32 * 8) \n\ +- mcr p15, 0, r0, c7, c14, 1 @ clean and invalidate D line\n\ +- add r0, r0, #32 \n\ ++ int tmp; ++ ++ asm volatile ("\ ++1: ldmia %1!, {r2 - r7, ip, lr} \n\ ++ pld [%1, #0] \n\ ++ pld [%1, #32] \n\ ++ pld [%1, #64] \n\ ++ pld [%1, #96] \n\ ++ pld [%1, #128] \n\ ++ pld [%1, #160] \n\ ++ pld [%1, #192] \n\ ++ stmia %0, {r2 - r7, ip, lr} \n\ ++ ldmia %1!, {r2 - r7, ip, lr} \n\ ++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\ ++ add %0, %0, #32 \n\ ++ stmia %0, {r2 - r7, ip, lr} \n\ ++ ldmia %1!, {r2 - r7, ip, lr} \n\ ++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\ ++ add %0, %0, #32 \n\ ++ stmia %0, {r2 - r7, ip, lr} \n\ ++ ldmia %1!, {r2 - r7, ip, lr} \n\ ++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\ ++ add %0, %0, #32 \n\ ++ stmia %0, {r2 - r7, ip, lr} \n\ ++ ldmia %1!, {r2 - r7, ip, lr} \n\ ++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\ ++ add %0, %0, #32 \n\ ++ stmia %0, {r2 - r7, ip, lr} \n\ ++ ldmia %1!, {r2 - r7, ip, lr} \n\ ++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\ ++ add %0, %0, #32 \n\ ++ stmia %0, {r2 - r7, ip, lr} \n\ ++ ldmia %1!, {r2 - r7, ip, lr} \n\ ++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\ ++ add %0, %0, #32 \n\ ++ stmia %0, {r2 - r7, ip, lr} \n\ ++ ldmia %1!, {r2 - r7, ip, lr} \n\ ++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\ ++ add %0, %0, #32 \n\ ++ stmia %0, {r2 - r7, ip, lr} \n\ ++ subs %2, %2, #(32 * 8) \n\ ++ mcr p15, 0, %0, c7, c14, 1 @ clean and invalidate D line\n\ ++ add %0, %0, #32 \n\ + bne 1b \n\ +- mcr p15, 0, ip, c7, c10, 4 @ drain WB\n\ +- ldmfd sp!, {r4-r9, pc}" +- : +- : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE)); ++ mcr p15, 0, %2, c7, c10, 4 @ drain WB" ++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp) ++ : "2" (PAGE_SIZE) ++ : "r2", "r3", "r4", "r5", "r6", "r7", "ip", "lr"); + } + + void feroceon_copy_user_highpage(struct page *to, struct page *from, +diff --git a/arch/arm/mm/copypage-v4mc.c b/arch/arm/mm/copypage-v4mc.c +index 1267e64133b9..db624170854a 100644 +--- a/arch/arm/mm/copypage-v4mc.c ++++ b/arch/arm/mm/copypage-v4mc.c +@@ -40,12 +40,11 @@ static DEFINE_RAW_SPINLOCK(minicache_lock); + * instruction. If your processor does not supply this, you have to write your + * own copy_user_highpage that does the right thing. + */ +-static void __naked +-mc_copy_user_page(void *from, void *to) ++static void mc_copy_user_page(void *from, void *to) + { +- asm volatile( +- "stmfd sp!, {r4, lr} @ 2\n\ +- mov r4, %2 @ 1\n\ ++ int tmp; ++ ++ asm volatile ("\ + ldmia %0!, {r2, r3, ip, lr} @ 4\n\ + 1: mcr p15, 0, %1, c7, c6, 1 @ 1 invalidate D line\n\ + stmia %1!, {r2, r3, ip, lr} @ 4\n\ +@@ -55,13 +54,13 @@ mc_copy_user_page(void *from, void *to) + mcr p15, 0, %1, c7, c6, 1 @ 1 invalidate D line\n\ + stmia %1!, {r2, r3, ip, lr} @ 4\n\ + ldmia %0!, {r2, r3, ip, lr} @ 4\n\ +- subs r4, r4, #1 @ 1\n\ ++ subs %2, %2, #1 @ 1\n\ + stmia %1!, {r2, r3, ip, lr} @ 4\n\ + ldmneia %0!, {r2, r3, ip, lr} @ 4\n\ +- bne 1b @ 1\n\ +- ldmfd sp!, {r4, pc} @ 3" +- : +- : "r" (from), "r" (to), "I" (PAGE_SIZE / 64)); ++ bne 1b @ " ++ : "+&r" (from), "+&r" (to), "=&r" (tmp) ++ : "2" (PAGE_SIZE / 64) ++ : "r2", "r3", "ip", "lr"); + } + + void v4_mc_copy_user_highpage(struct page *to, struct page *from, +diff --git a/arch/arm/mm/copypage-v4wb.c b/arch/arm/mm/copypage-v4wb.c +index 067d0fdd630c..cd3e165afeed 100644 +--- a/arch/arm/mm/copypage-v4wb.c ++++ b/arch/arm/mm/copypage-v4wb.c +@@ -22,29 +22,28 @@ + * instruction. If your processor does not supply this, you have to write your + * own copy_user_highpage that does the right thing. + */ +-static void __naked +-v4wb_copy_user_page(void *kto, const void *kfrom) ++static void v4wb_copy_user_page(void *kto, const void *kfrom) + { +- asm("\ +- stmfd sp!, {r4, lr} @ 2\n\ +- mov r2, %2 @ 1\n\ +- ldmia r1!, {r3, r4, ip, lr} @ 4\n\ +-1: mcr p15, 0, r0, c7, c6, 1 @ 1 invalidate D line\n\ +- stmia r0!, {r3, r4, ip, lr} @ 4\n\ +- ldmia r1!, {r3, r4, ip, lr} @ 4+1\n\ +- stmia r0!, {r3, r4, ip, lr} @ 4\n\ +- ldmia r1!, {r3, r4, ip, lr} @ 4\n\ +- mcr p15, 0, r0, c7, c6, 1 @ 1 invalidate D line\n\ +- stmia r0!, {r3, r4, ip, lr} @ 4\n\ +- ldmia r1!, {r3, r4, ip, lr} @ 4\n\ +- subs r2, r2, #1 @ 1\n\ +- stmia r0!, {r3, r4, ip, lr} @ 4\n\ +- ldmneia r1!, {r3, r4, ip, lr} @ 4\n\ ++ int tmp; ++ ++ asm volatile ("\ ++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\ ++1: mcr p15, 0, %0, c7, c6, 1 @ 1 invalidate D line\n\ ++ stmia %0!, {r3, r4, ip, lr} @ 4\n\ ++ ldmia %1!, {r3, r4, ip, lr} @ 4+1\n\ ++ stmia %0!, {r3, r4, ip, lr} @ 4\n\ ++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\ ++ mcr p15, 0, %0, c7, c6, 1 @ 1 invalidate D line\n\ ++ stmia %0!, {r3, r4, ip, lr} @ 4\n\ ++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\ ++ subs %2, %2, #1 @ 1\n\ ++ stmia %0!, {r3, r4, ip, lr} @ 4\n\ ++ ldmneia %1!, {r3, r4, ip, lr} @ 4\n\ + bne 1b @ 1\n\ +- mcr p15, 0, r1, c7, c10, 4 @ 1 drain WB\n\ +- ldmfd sp!, {r4, pc} @ 3" +- : +- : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64)); ++ mcr p15, 0, %1, c7, c10, 4 @ 1 drain WB" ++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp) ++ : "2" (PAGE_SIZE / 64) ++ : "r3", "r4", "ip", "lr"); + } + + void v4wb_copy_user_highpage(struct page *to, struct page *from, +diff --git a/arch/arm/mm/copypage-v4wt.c b/arch/arm/mm/copypage-v4wt.c +index b85c5da2e510..8614572e1296 100644 +--- a/arch/arm/mm/copypage-v4wt.c ++++ b/arch/arm/mm/copypage-v4wt.c +@@ -20,27 +20,26 @@ + * dirty data in the cache. However, we do have to ensure that + * subsequent reads are up to date. + */ +-static void __naked +-v4wt_copy_user_page(void *kto, const void *kfrom) ++static void v4wt_copy_user_page(void *kto, const void *kfrom) + { +- asm("\ +- stmfd sp!, {r4, lr} @ 2\n\ +- mov r2, %2 @ 1\n\ +- ldmia r1!, {r3, r4, ip, lr} @ 4\n\ +-1: stmia r0!, {r3, r4, ip, lr} @ 4\n\ +- ldmia r1!, {r3, r4, ip, lr} @ 4+1\n\ +- stmia r0!, {r3, r4, ip, lr} @ 4\n\ +- ldmia r1!, {r3, r4, ip, lr} @ 4\n\ +- stmia r0!, {r3, r4, ip, lr} @ 4\n\ +- ldmia r1!, {r3, r4, ip, lr} @ 4\n\ +- subs r2, r2, #1 @ 1\n\ +- stmia r0!, {r3, r4, ip, lr} @ 4\n\ +- ldmneia r1!, {r3, r4, ip, lr} @ 4\n\ ++ int tmp; ++ ++ asm volatile ("\ ++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\ ++1: stmia %0!, {r3, r4, ip, lr} @ 4\n\ ++ ldmia %1!, {r3, r4, ip, lr} @ 4+1\n\ ++ stmia %0!, {r3, r4, ip, lr} @ 4\n\ ++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\ ++ stmia %0!, {r3, r4, ip, lr} @ 4\n\ ++ ldmia %1!, {r3, r4, ip, lr} @ 4\n\ ++ subs %2, %2, #1 @ 1\n\ ++ stmia %0!, {r3, r4, ip, lr} @ 4\n\ ++ ldmneia %1!, {r3, r4, ip, lr} @ 4\n\ + bne 1b @ 1\n\ +- mcr p15, 0, r2, c7, c7, 0 @ flush ID cache\n\ +- ldmfd sp!, {r4, pc} @ 3" +- : +- : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64)); ++ mcr p15, 0, %2, c7, c7, 0 @ flush ID cache" ++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp) ++ : "2" (PAGE_SIZE / 64) ++ : "r3", "r4", "ip", "lr"); + } + + void v4wt_copy_user_highpage(struct page *to, struct page *from, +diff --git a/arch/arm/mm/copypage-xsc3.c b/arch/arm/mm/copypage-xsc3.c +index 03a2042aced5..55cbc3a89d85 100644 +--- a/arch/arm/mm/copypage-xsc3.c ++++ b/arch/arm/mm/copypage-xsc3.c +@@ -21,53 +21,46 @@ + + /* + * XSC3 optimised copy_user_highpage +- * r0 = destination +- * r1 = source + * + * The source page may have some clean entries in the cache already, but we + * can safely ignore them - break_cow() will flush them out of the cache + * if we eventually end up using our copied page. + * + */ +-static void __naked +-xsc3_mc_copy_user_page(void *kto, const void *kfrom) ++static void xsc3_mc_copy_user_page(void *kto, const void *kfrom) + { +- asm("\ +- stmfd sp!, {r4, r5, lr} \n\ +- mov lr, %2 \n\ +- \n\ +- pld [r1, #0] \n\ +- pld [r1, #32] \n\ +-1: pld [r1, #64] \n\ +- pld [r1, #96] \n\ ++ int tmp; ++ ++ asm volatile ("\ ++ pld [%1, #0] \n\ ++ pld [%1, #32] \n\ ++1: pld [%1, #64] \n\ ++ pld [%1, #96] \n\ + \n\ +-2: ldrd r2, [r1], #8 \n\ +- mov ip, r0 \n\ +- ldrd r4, [r1], #8 \n\ +- mcr p15, 0, ip, c7, c6, 1 @ invalidate\n\ +- strd r2, [r0], #8 \n\ +- ldrd r2, [r1], #8 \n\ +- strd r4, [r0], #8 \n\ +- ldrd r4, [r1], #8 \n\ +- strd r2, [r0], #8 \n\ +- strd r4, [r0], #8 \n\ +- ldrd r2, [r1], #8 \n\ +- mov ip, r0 \n\ +- ldrd r4, [r1], #8 \n\ +- mcr p15, 0, ip, c7, c6, 1 @ invalidate\n\ +- strd r2, [r0], #8 \n\ +- ldrd r2, [r1], #8 \n\ +- subs lr, lr, #1 \n\ +- strd r4, [r0], #8 \n\ +- ldrd r4, [r1], #8 \n\ +- strd r2, [r0], #8 \n\ +- strd r4, [r0], #8 \n\ ++2: ldrd r2, [%1], #8 \n\ ++ ldrd r4, [%1], #8 \n\ ++ mcr p15, 0, %0, c7, c6, 1 @ invalidate\n\ ++ strd r2, [%0], #8 \n\ ++ ldrd r2, [%1], #8 \n\ ++ strd r4, [%0], #8 \n\ ++ ldrd r4, [%1], #8 \n\ ++ strd r2, [%0], #8 \n\ ++ strd r4, [%0], #8 \n\ ++ ldrd r2, [%1], #8 \n\ ++ ldrd r4, [%1], #8 \n\ ++ mcr p15, 0, %0, c7, c6, 1 @ invalidate\n\ ++ strd r2, [%0], #8 \n\ ++ ldrd r2, [%1], #8 \n\ ++ subs %2, %2, #1 \n\ ++ strd r4, [%0], #8 \n\ ++ ldrd r4, [%1], #8 \n\ ++ strd r2, [%0], #8 \n\ ++ strd r4, [%0], #8 \n\ + bgt 1b \n\ +- beq 2b \n\ +- \n\ +- ldmfd sp!, {r4, r5, pc}" +- : +- : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64 - 1)); ++ beq 2b " ++ : "+&r" (kto), "+&r" (kfrom), "=&r" (tmp) ++ : "2" (PAGE_SIZE / 64 - 1) ++ : "r2", "r3", "r4", "r5"); + } + + void xsc3_mc_copy_user_highpage(struct page *to, struct page *from, +@@ -85,8 +78,6 @@ void xsc3_mc_copy_user_highpage(struct page *to, struct page *from, + + /* + * XScale optimised clear_user_page +- * r0 = destination +- * r1 = virtual user address of ultimate destination page + */ + void xsc3_mc_clear_user_highpage(struct page *page, unsigned long vaddr) + { +diff --git a/arch/arm/mm/copypage-xscale.c b/arch/arm/mm/copypage-xscale.c +index 0fb85025344d..c775d4b7adb0 100644 +--- a/arch/arm/mm/copypage-xscale.c ++++ b/arch/arm/mm/copypage-xscale.c +@@ -36,52 +36,51 @@ static DEFINE_RAW_SPINLOCK(minicache_lock); + * Dcache aliasing issue. The writes will be forwarded to the write buffer, + * and merged as appropriate. + */ +-static void __naked +-mc_copy_user_page(void *from, void *to) ++static void mc_copy_user_page(void *from, void *to) + { ++ int tmp; ++ + /* + * Strangely enough, best performance is achieved + * when prefetching destination as well. (NP) + */ +- asm volatile( +- "stmfd sp!, {r4, r5, lr} \n\ +- mov lr, %2 \n\ +- pld [r0, #0] \n\ +- pld [r0, #32] \n\ +- pld [r1, #0] \n\ +- pld [r1, #32] \n\ +-1: pld [r0, #64] \n\ +- pld [r0, #96] \n\ +- pld [r1, #64] \n\ +- pld [r1, #96] \n\ +-2: ldrd r2, [r0], #8 \n\ +- ldrd r4, [r0], #8 \n\ +- mov ip, r1 \n\ +- strd r2, [r1], #8 \n\ +- ldrd r2, [r0], #8 \n\ +- strd r4, [r1], #8 \n\ +- ldrd r4, [r0], #8 \n\ +- strd r2, [r1], #8 \n\ +- strd r4, [r1], #8 \n\ ++ asm volatile ("\ ++ pld [%0, #0] \n\ ++ pld [%0, #32] \n\ ++ pld [%1, #0] \n\ ++ pld [%1, #32] \n\ ++1: pld [%0, #64] \n\ ++ pld [%0, #96] \n\ ++ pld [%1, #64] \n\ ++ pld [%1, #96] \n\ ++2: ldrd r2, [%0], #8 \n\ ++ ldrd r4, [%0], #8 \n\ ++ mov ip, %1 \n\ ++ strd r2, [%1], #8 \n\ ++ ldrd r2, [%0], #8 \n\ ++ strd r4, [%1], #8 \n\ ++ ldrd r4, [%0], #8 \n\ ++ strd r2, [%1], #8 \n\ ++ strd r4, [%1], #8 \n\ + mcr p15, 0, ip, c7, c10, 1 @ clean D line\n\ +- ldrd r2, [r0], #8 \n\ ++ ldrd r2, [%0], #8 \n\ + mcr p15, 0, ip, c7, c6, 1 @ invalidate D line\n\ +- ldrd r4, [r0], #8 \n\ +- mov ip, r1 \n\ +- strd r2, [r1], #8 \n\ +- ldrd r2, [r0], #8 \n\ +- strd r4, [r1], #8 \n\ +- ldrd r4, [r0], #8 \n\ +- strd r2, [r1], #8 \n\ +- strd r4, [r1], #8 \n\ ++ ldrd r4, [%0], #8 \n\ ++ mov ip, %1 \n\ ++ strd r2, [%1], #8 \n\ ++ ldrd r2, [%0], #8 \n\ ++ strd r4, [%1], #8 \n\ ++ ldrd r4, [%0], #8 \n\ ++ strd r2, [%1], #8 \n\ ++ strd r4, [%1], #8 \n\ + mcr p15, 0, ip, c7, c10, 1 @ clean D line\n\ +- subs lr, lr, #1 \n\ ++ subs %2, %2, #1 \n\ + mcr p15, 0, ip, c7, c6, 1 @ invalidate D line\n\ + bgt 1b \n\ +- beq 2b \n\ +- ldmfd sp!, {r4, r5, pc} " +- : +- : "r" (from), "r" (to), "I" (PAGE_SIZE / 64 - 1)); ++ beq 2b " ++ : "+&r" (from), "+&r" (to), "=&r" (tmp) ++ : "2" (PAGE_SIZE / 64 - 1) ++ : "r2", "r3", "r4", "r5", "ip"); + } + + void xscale_mc_copy_user_highpage(struct page *to, struct page *from, diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S -index cb41b18eef0e..516fefc2d7bd 100644 +index cb41b18eef0e..faea6baeae76 100644 --- a/arch/arm/mm/proc-macros.S +++ b/arch/arm/mm/proc-macros.S @@ -4,6 +4,7 @@ @@ -8597,6 +10772,14 @@ index cb41b18eef0e..516fefc2d7bd 100644 bic \rd, \rd, #63 ldr \rd, [\rd, #TI_TASK] ldr \rd, [\rd, #TSK_ACTIVE_MM] +@@ -344,6 +345,7 @@ ENTRY(\name\()_cache_fns) + + .macro define_tlb_functions name:req, flags_up:req, flags_smp + .type \name\()_tlb_fns, #object ++ .align 2 + ENTRY(\name\()_tlb_fns) + .long \name\()_flush_user_tlb_range + .long \name\()_flush_kern_tlb_range diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig index 3265b8f86069..6ec01491735e 100644 --- a/arch/arm/plat-samsung/Kconfig @@ -8610,7 +10793,7 @@ index 3265b8f86069..6ec01491735e 100644 Say Y here if you want verbose debugging from the PM Suspend and Resume code. See diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c -index 3eb018fa1a1f..c3362ddd6c4c 100644 +index 3eb018fa1a1f..bc7a5dbaf423 100644 --- a/arch/arm/probes/kprobes/core.c +++ b/arch/arm/probes/kprobes/core.c @@ -270,6 +270,7 @@ void __kprobes kprobe_handler(struct pt_regs *regs) @@ -8633,6 +10816,15 @@ index 3eb018fa1a1f..c3362ddd6c4c 100644 default: /* impossible cases */ BUG(); +@@ -660,7 +666,7 @@ static struct undef_hook kprobes_arm_break_hook = { + + #endif /* !CONFIG_THUMB2_KERNEL */ + +-int __init arch_init_kprobes() ++int __init arch_init_kprobes(void) + { + arm_probes_decode_init(); + #ifdef CONFIG_THUMB2_KERNEL diff --git a/arch/arm/probes/kprobes/test-thumb.c b/arch/arm/probes/kprobes/test-thumb.c index b683b4517458..4254391f3906 100644 --- a/arch/arm/probes/kprobes/test-thumb.c @@ -8743,6 +10935,19 @@ index 0ed01f2d5ee4..b4ec8d1b0bef 100644 } return 0; +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index bca2c3c13530..63e16bed4eea 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -458,7 +458,7 @@ config ARM64_ERRATUM_1024718 + help + This option adds work around for Arm Cortex-A55 Erratum 1024718. + +- Affected Cortex-A55 cores (r0p0, r0p1, r1p0) could cause incorrect ++ Affected Cortex-A55 cores (all revisions) could cause incorrect + update of the hardware dirty bit when the DBM/AP bits are updated + without a break-before-make. The work around is to disable the usage + of hardware DBM locally on the affected cores. CPUs not affected by diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms index 0b3990b7db6f..8a9030c4e633 100644 --- a/arch/arm64/Kconfig.platforms @@ -8806,7 +11011,7 @@ index c528dd52ba2d..e43e804c42c3 100644 ldo8_reg: LDO8 { diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi -index 6328a66ed97e..4c7c40ce5066 100644 +index 6328a66ed97e..1fe4d1dd50ee 100644 --- a/arch/arm64/boot/dts/exynos/exynos7.dtsi +++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi @@ -65,8 +65,10 @@ @@ -8821,6 +11026,15 @@ index 6328a66ed97e..4c7c40ce5066 100644 }; soc: soc { +@@ -92,7 +94,7 @@ + #address-cells = <0>; + interrupt-controller; + reg = <0x11001000 0x1000>, +- <0x11002000 0x1000>, ++ <0x11002000 0x2000>, + <0x11004000 0x2000>, + <0x11006000 0x2000>; + }; diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi index 97d331ec2500..cd8db85f7c11 100644 --- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi @@ -8833,6 +11047,28 @@ index 97d331ec2500..cd8db85f7c11 100644 sec_jr0: jr@10000 { compatible = "fsl,sec-v5.4-job-ring", +diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +index f2004b0955f1..1a2f13203355 100644 +--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +@@ -186,8 +186,15 @@ + #interrupt-cells = <1>; + msi-parent = <&pcie0>; + msi-controller; +- ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x1000000 /* Port 0 MEM */ +- 0x81000000 0 0xe9000000 0 0xe9000000 0 0x10000>; /* Port 0 IO*/ ++ /* ++ * The 128 MiB address range [0xe8000000-0xf0000000] is ++ * dedicated for PCIe and can be assigned to 8 windows ++ * with size a power of two. Use one 64 KiB window for ++ * IO at the end and the remaining seven windows ++ * (totaling 127 MiB) for MEM. ++ */ ++ ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x07f00000 /* Port 0 MEM */ ++ 0x81000000 0 0xefff0000 0 0xefff0000 0 0x00010000>; /* Port 0 IO */ + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pcie_intc 0>, + <0 0 0 2 &pcie_intc 1>, diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi index b307d6b6357e..ad34be46c361 100644 --- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi @@ -9029,7 +11265,7 @@ index 000000000000..98d6bd9288f4 +}; diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-arglass-boe-dual-1080p-video.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-arglass-boe-dual-1080p-video.dtsi new file mode 100644 -index 000000000000..a579e3e11200 +index 000000000000..ab2de32b61f5 --- /dev/null +++ b/arch/arm64/boot/dts/qcom/dsi-panel-arglass-boe-dual-1080p-video.dtsi @@ -0,0 +1,99 @@ @@ -9103,8 +11339,8 @@ index 000000000000..a579e3e11200 + 39 01 00 00 00 00 02 35 00 + /* CMD2 P1 */ + 39 01 00 00 00 00 03 F0 AA 11 -+ 39 01 00 00 00 00 0A C2 00 00 03 FF 03 -+ FF 00 90 C2 ++ 39 01 00 00 00 00 0A C2 00 00 01 99 03 ++ FF 00 90 02 + /* CMD2 P2 */ + 39 01 00 00 00 00 03 F0 AA 12 + 39 01 00 00 00 00 02 B0 93 @@ -10282,6 +12518,62 @@ index 08b88f6791be..c2557cf43b3d 100644 assigned-clocks = <&gcc BYTE0_CLK_SRC>, <&gcc PCLK0_CLK_SRC>; +diff --git a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera-base.dts b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera-base.dts +index 622230c00c41..88feae968398 100644 +--- a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera-base.dts ++++ b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera-base.dts +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2018, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2018, 2021 The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -18,5 +18,6 @@ + / { + model = "Qualcomm Technologies, Inc. QCS605 LC SoC Ipcam base"; + compatible = "qcom,qcs605"; +- qcom,board-id = <0 4>; ++ qcom,msm-id = <347 0x0>; ++ qcom,board-id = <8 6>; + }; +diff --git a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera-overlay.dts b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera-overlay.dts +index 0cb7c3386ead..faf2593e25ac 100644 +--- a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera-overlay.dts ++++ b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera-overlay.dts +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2018, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2018, 2021 The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -26,5 +26,5 @@ + model = "Qualcomm Technologies, Inc. QC605 LC Groot + PM8005 IPC"; + compatible = "qcom,qcs605-mtp", "qcom,qcs605", "qcom,mtp"; + qcom,msm-id = <347 0x0>; +- qcom,board-id = <0x020208 4>; ++ qcom,board-id = <8 6>; + }; +diff --git a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dts b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dts +index 37dc8e0f9014..e1063f2b64e2 100644 +--- a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dts ++++ b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dts +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2018, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2018, 2021 The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -20,5 +20,6 @@ + / { + model = "Qualcomm Technologies, Inc. QC605 LC Groot + PM8005 IPC"; + compatible = "qcom,qcs605-mtp", "qcom,qcs605", "qcom,mtp"; +- qcom,board-id = <0x020208 4>; ++ qcom,msm-id = <347 0x0>; ++ qcom,board-id = <8 6>; + }; diff --git a/arch/arm64/boot/dts/qcom/qcs605-pm660-pm8005-regulator.dtsi b/arch/arm64/boot/dts/qcom/qcs605-pm660-pm8005-regulator.dtsi index 8efb7c1948d1..7fc81cab5a87 100644 --- a/arch/arm64/boot/dts/qcom/qcs605-pm660-pm8005-regulator.dtsi @@ -12013,8 +14305,20 @@ index f1b3aa19524f..54b9b78a673d 100644 CONFIG_ZSMALLOC=y CONFIG_SECCOMP=y CONFIG_PARAVIRT=y +diff --git a/arch/arm64/configs/qcs605_defconfig b/arch/arm64/configs/qcs605_defconfig +index 3b7319cb1d8a..5be9bbe7f0a0 100644 +--- a/arch/arm64/configs/qcs605_defconfig ++++ b/arch/arm64/configs/qcs605_defconfig +@@ -403,6 +403,7 @@ CONFIG_DVB_MPQ_DEMUX=m + CONFIG_DVB_MPQ_SW=y + CONFIG_QCOM_KGSL=y + CONFIG_DRM=y ++CONFIG_DRM_CLIENT_BOOTSPLASH=y + CONFIG_DRM_SDE_EVTLOG_DEBUG=y + CONFIG_DRM_SDE_RSC=y + CONFIG_DRM_LT_LT9611=y diff --git a/arch/arm64/configs/sdm670-perf_defconfig b/arch/arm64/configs/sdm670-perf_defconfig -index 2c93d34ee738..24e6aa097e7f 100755 +index 2c93d34ee738..ceab0c9c24f9 100755 --- a/arch/arm64/configs/sdm670-perf_defconfig +++ b/arch/arm64/configs/sdm670-perf_defconfig @@ -22,7 +22,6 @@ CONFIG_CPUSETS=y @@ -12025,7 +14329,15 @@ index 2c93d34ee738..24e6aa097e7f 100755 CONFIG_CGROUP_BPF=y CONFIG_SCHED_CORE_CTL=y CONFIG_NAMESPACES=y -@@ -626,6 +625,8 @@ CONFIG_CPU_FREQ_SWITCH_PROFILER=y +@@ -395,6 +394,7 @@ CONFIG_DVB_MPQ_DEMUX=m + CONFIG_DVB_MPQ_SW=y + CONFIG_QCOM_KGSL=y + CONFIG_DRM=y ++CONFIG_DRM_CLIENT_BOOTSPLASH=y + CONFIG_DRM_DP_CEC=y + CONFIG_DRM_SDE_EVTLOG_DEBUG=y + CONFIG_DRM_SDE_RSC=y +@@ -626,6 +626,8 @@ CONFIG_CPU_FREQ_SWITCH_PROFILER=y CONFIG_DEBUG_ALIGN_RODATA=y CONFIG_CORESIGHT=y CONFIG_CORESIGHT_LINK_AND_SINK_TMC=y @@ -12035,7 +14347,7 @@ index 2c93d34ee738..24e6aa097e7f 100755 CONFIG_CORESIGHT_STM=y CONFIG_CORESIGHT_TPDA=y diff --git a/arch/arm64/configs/sdm670_defconfig b/arch/arm64/configs/sdm670_defconfig -index d2da7e63d2e9..cfdd7c6a1449 100755 +index d2da7e63d2e9..57da388a6d88 100755 --- a/arch/arm64/configs/sdm670_defconfig +++ b/arch/arm64/configs/sdm670_defconfig @@ -24,7 +24,6 @@ CONFIG_CGROUP_CPUACCT=y @@ -12046,6 +14358,14 @@ index d2da7e63d2e9..cfdd7c6a1449 100755 CONFIG_CGROUP_BPF=y CONFIG_SCHED_CORE_CTL=y CONFIG_NAMESPACES=y +@@ -403,6 +402,7 @@ CONFIG_DVB_MPQ_DEMUX=m + CONFIG_DVB_MPQ_SW=y + CONFIG_QCOM_KGSL=y + CONFIG_DRM=y ++CONFIG_DRM_CLIENT_BOOTSPLASH=y + CONFIG_DRM_DP_CEC=y + CONFIG_DRM_SDE_EVTLOG_DEBUG=y + CONFIG_DRM_SDE_RSC=y diff --git a/arch/arm64/configs/sdm845-perf_defconfig b/arch/arm64/configs/sdm845-perf_defconfig index c9b3dda39168..e970e8962916 100755 --- a/arch/arm64/configs/sdm845-perf_defconfig @@ -13084,6 +15404,28 @@ index 3f62b35fb6f1..815c395a1076 100644 } if ((u32)idx == PERF_REG_ARM64_SP) +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 0a66fa1db63a..d489df145ec4 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -58,7 +58,7 @@ + + #ifdef CONFIG_CC_STACKPROTECTOR + #include +-unsigned long __stack_chk_guard __read_mostly; ++unsigned long __stack_chk_guard __ro_after_init; + EXPORT_SYMBOL(__stack_chk_guard); + #endif + +@@ -193,7 +193,7 @@ static void show_data(unsigned long addr, int nbytes, const char *name) + if (addr < KIMAGE_VADDR || addr > -256UL) + return; + +- printk("\n%s: %#lx:\n", name, addr); ++ printk("\n%s: %pS:\n", name, addr); + + /* + * round address down to a 32 bit boundary diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c index 35e0e6464e62..884b8d5b1cdf 100755 --- a/arch/arm64/kernel/psci.c @@ -13510,6 +15852,52 @@ index ec87e67feb19..22c10102712a 100644 + DISCARDS } +diff --git a/arch/hexagon/lib/io.c b/arch/hexagon/lib/io.c +index 885c9626d5e0..e5dfed1cf151 100644 +--- a/arch/hexagon/lib/io.c ++++ b/arch/hexagon/lib/io.c +@@ -40,6 +40,7 @@ void __raw_readsw(const void __iomem *addr, void *data, int len) + *dst++ = *src; + + } ++EXPORT_SYMBOL(__raw_readsw); + + /* + * __raw_writesw - read words a short at a time +@@ -60,6 +61,7 @@ void __raw_writesw(void __iomem *addr, const void *data, int len) + + + } ++EXPORT_SYMBOL(__raw_writesw); + + /* Pretty sure len is pre-adjusted for the length of the access already */ + void __raw_readsl(const void __iomem *addr, void *data, int len) +@@ -75,6 +77,7 @@ void __raw_readsl(const void __iomem *addr, void *data, int len) + + + } ++EXPORT_SYMBOL(__raw_readsl); + + void __raw_writesl(void __iomem *addr, const void *data, int len) + { +@@ -89,3 +92,4 @@ void __raw_writesl(void __iomem *addr, const void *data, int len) + + + } ++EXPORT_SYMBOL(__raw_writesl); +diff --git a/arch/ia64/Kconfig.debug b/arch/ia64/Kconfig.debug +index de9d507ba0fd..ee6c7f75f479 100644 +--- a/arch/ia64/Kconfig.debug ++++ b/arch/ia64/Kconfig.debug +@@ -41,7 +41,7 @@ config DISABLE_VHPT + + config IA64_DEBUG_CMPXCHG + bool "Turn on compare-and-exchange bug checking (slow!)" +- depends on DEBUG_KERNEL ++ depends on DEBUG_KERNEL && PRINTK + help + Selecting this option turns on bug checking for the IA-64 + compare-and-exchange instructions. This is slow! Itaniums diff --git a/arch/ia64/include/asm/ptrace.h b/arch/ia64/include/asm/ptrace.h index 845143990a1d..9d3d4fb87a7a 100644 --- a/arch/ia64/include/asm/ptrace.h @@ -13549,6 +15937,27 @@ index 1d0b875fec44..ec909eec0b4c 100644 } static inline long syscall_get_return_value(struct task_struct *task, +diff --git a/arch/ia64/include/asm/tlb.h b/arch/ia64/include/asm/tlb.h +index 77e541cf0e5d..34f4a5359561 100644 +--- a/arch/ia64/include/asm/tlb.h ++++ b/arch/ia64/include/asm/tlb.h +@@ -272,6 +272,16 @@ __tlb_remove_tlb_entry (struct mmu_gather *tlb, pte_t *ptep, unsigned long addre + tlb->end_addr = address + PAGE_SIZE; + } + ++static inline void ++tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address, ++ unsigned long size) ++{ ++ if (tlb->start_addr > address) ++ tlb->start_addr = address; ++ if (tlb->end_addr < address + size) ++ tlb->end_addr = address + size; ++} ++ + #define tlb_migrate_finish(mm) platform_tlb_migrate_finish(mm) + + #define tlb_start_vma(tlb, vma) do { } while (0) diff --git a/arch/ia64/kernel/Makefile b/arch/ia64/kernel/Makefile index 9edda5466020..bcd3668f1bb8 100644 --- a/arch/ia64/kernel/Makefile @@ -13679,6 +16088,33 @@ index 2bfd941ff7c7..c27849889e19 100644 # # Usage: unwcheck.py FILE # +diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine +index 2a5c7abb2896..f622c3ccafc3 100644 +--- a/arch/m68k/Kconfig.machine ++++ b/arch/m68k/Kconfig.machine +@@ -184,6 +184,7 @@ config INIT_LCD + config MEMORY_RESERVE + int "Memory reservation (MiB)" + depends on (UCSIMM || UCDIMM) ++ default 0 + help + Reserve certain memory regions on 68x328 based boards. + +diff --git a/arch/m68k/emu/nfeth.c b/arch/m68k/emu/nfeth.c +index a0985fd088d1..7d695fc7a2d0 100644 +--- a/arch/m68k/emu/nfeth.c ++++ b/arch/m68k/emu/nfeth.c +@@ -260,8 +260,8 @@ static void __exit nfeth_cleanup(void) + + for (i = 0; i < MAX_UNIT; i++) { + if (nfeth_dev[i]) { +- unregister_netdev(nfeth_dev[0]); +- free_netdev(nfeth_dev[0]); ++ unregister_netdev(nfeth_dev[i]); ++ free_netdev(nfeth_dev[i]); + } + } + free_irq(nfEtherIRQ, nfeth_interrupt); diff --git a/arch/m68k/include/asm/m53xxacr.h b/arch/m68k/include/asm/m53xxacr.h index 3177ce8331d6..baee0c77b981 100644 --- a/arch/m68k/include/asm/m53xxacr.h @@ -13708,6 +16144,42 @@ index 53c632c85b03..dff6db19ae4d 100644 extern void via_register_interrupts(void); extern void via_irq_enable(int); extern void via_irq_disable(int); +diff --git a/arch/m68k/include/asm/raw_io.h b/arch/m68k/include/asm/raw_io.h +index 932faa35655b..2238232c360e 100644 +--- a/arch/m68k/include/asm/raw_io.h ++++ b/arch/m68k/include/asm/raw_io.h +@@ -30,21 +30,21 @@ extern void __iounmap(void *addr, unsigned long size); + * two accesses to memory, which may be undesirable for some devices. + */ + #define in_8(addr) \ +- ({ u8 __v = (*(__force volatile u8 *) (addr)); __v; }) ++ ({ u8 __v = (*(__force volatile u8 *) (unsigned long)(addr)); __v; }) + #define in_be16(addr) \ +- ({ u16 __v = (*(__force volatile u16 *) (addr)); __v; }) ++ ({ u16 __v = (*(__force volatile u16 *) (unsigned long)(addr)); __v; }) + #define in_be32(addr) \ +- ({ u32 __v = (*(__force volatile u32 *) (addr)); __v; }) ++ ({ u32 __v = (*(__force volatile u32 *) (unsigned long)(addr)); __v; }) + #define in_le16(addr) \ +- ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (addr)); __v; }) ++ ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (unsigned long)(addr)); __v; }) + #define in_le32(addr) \ +- ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (addr)); __v; }) ++ ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (unsigned long)(addr)); __v; }) + +-#define out_8(addr,b) (void)((*(__force volatile u8 *) (addr)) = (b)) +-#define out_be16(addr,w) (void)((*(__force volatile u16 *) (addr)) = (w)) +-#define out_be32(addr,l) (void)((*(__force volatile u32 *) (addr)) = (l)) +-#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (addr)) = cpu_to_le16(w)) +-#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (addr)) = cpu_to_le32(l)) ++#define out_8(addr,b) (void)((*(__force volatile u8 *) (unsigned long)(addr)) = (b)) ++#define out_be16(addr,w) (void)((*(__force volatile u16 *) (unsigned long)(addr)) = (w)) ++#define out_be32(addr,l) (void)((*(__force volatile u32 *) (unsigned long)(addr)) = (l)) ++#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (unsigned long)(addr)) = cpu_to_le16(w)) ++#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (unsigned long)(addr)) = cpu_to_le32(l)) + + #define raw_inb in_8 + #define raw_inw in_be16 diff --git a/arch/m68k/mac/config.c b/arch/m68k/mac/config.c index e46895316eb0..dcf18e1ca0bb 100644 --- a/arch/m68k/mac/config.c @@ -13861,10 +16333,20 @@ index ea89a24f4600..cc0f924bbdd2 100644 if (tmp & Q40_RTC_PLL_SIGN) pll->pll_value = -pll->pll_value; diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index f8a529c85279..24eb7fe7922e 100644 +index f8a529c85279..9708c319a744 100644 --- a/arch/mips/Kconfig +++ b/arch/mips/Kconfig -@@ -848,6 +848,7 @@ config SNI_RM +@@ -267,6 +267,9 @@ config BCM63XX + select SYS_SUPPORTS_32BIT_KERNEL + select SYS_SUPPORTS_BIG_ENDIAN + select SYS_HAS_EARLY_PRINTK ++ select SYS_HAS_CPU_BMIPS32_3300 ++ select SYS_HAS_CPU_BMIPS4350 ++ select SYS_HAS_CPU_BMIPS4380 + select SWAP_IO_SPACE + select GPIOLIB + select HAVE_CLK +@@ -848,6 +851,7 @@ config SNI_RM select I8253 select I8259 select ISA @@ -13872,8 +16354,16 @@ index f8a529c85279..24eb7fe7922e 100644 select SWAP_IO_SPACE if CPU_BIG_ENDIAN select SYS_HAS_CPU_R4X00 select SYS_HAS_CPU_R5000 +@@ -1372,6 +1376,7 @@ config CPU_LOONGSON3 + select WEAK_REORDERING_BEYOND_LLSC + select MIPS_PGD_C0_CONTEXT + select MIPS_L1_CACHE_SHIFT_6 ++ select MIPS_FP_SUPPORT + select GPIOLIB + help + The Loongson 3 processor implements the MIPS64R2 instruction diff --git a/arch/mips/Makefile b/arch/mips/Makefile -index 1a6bac7b076f..25f3bfef9b39 100644 +index 1a6bac7b076f..af4eff7d22ec 100644 --- a/arch/mips/Makefile +++ b/arch/mips/Makefile @@ -256,12 +256,23 @@ ifdef CONFIG_64BIT @@ -13901,6 +16391,15 @@ index 1a6bac7b076f..25f3bfef9b39 100644 VMLINUX_ENTRY_ADDRESS=$(entry-y) \ PLATFORM="$(platform-y)" ifdef CONFIG_32BIT +@@ -275,7 +286,7 @@ LDFLAGS += -m $(ld-emul) + + ifdef CONFIG_MIPS + CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \ +- egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \ ++ egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \ + sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g') + ifdef CONFIG_64BIT + CHECKFLAGS += -m64 diff --git a/arch/mips/alchemy/board-xxs1500.c b/arch/mips/alchemy/board-xxs1500.c index 0fc53e08a894..c05f7376148a 100644 --- a/arch/mips/alchemy/board-xxs1500.c @@ -13952,6 +16451,23 @@ index e970fd9cf769..7ca7384fd5c9 100644 select BCMA_DRIVER_PCI_HOSTMODE if PCI select BCMA_DRIVER_GPIO default y +diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c +index b49fc9cb9cad..4f375050ab8e 100644 +--- a/arch/mips/bcm63xx/clk.c ++++ b/arch/mips/bcm63xx/clk.c +@@ -336,6 +336,12 @@ void clk_disable(struct clk *clk) + + EXPORT_SYMBOL(clk_disable); + ++struct clk *clk_get_parent(struct clk *clk) ++{ ++ return NULL; ++} ++EXPORT_SYMBOL(clk_get_parent); ++ + unsigned long clk_get_rate(struct clk *clk) + { + return clk->rate; diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile index 2f77e250b91d..3e93eea5a5f5 100644 --- a/arch/mips/boot/compressed/Makefile @@ -14155,6 +16671,34 @@ index bebec370324f..22573b4f25b6 100644 #define TLB_IS_GLOBAL(x) ((x).tlb_lo[0] & (x).tlb_lo[1] & ENTRYLO_G) #define TLB_VPN2(x) ((x).tlb_hi & VPN2_MASK) #define TLB_ASID(x) ((x).tlb_hi & KVM_ENTRYHI_ASID) +diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h +index c0be540e83cb..2c6df5a92e1e 100644 +--- a/arch/mips/include/asm/pgtable-32.h ++++ b/arch/mips/include/asm/pgtable-32.h +@@ -110,6 +110,7 @@ static inline void pmd_clear(pmd_t *pmdp) + + #if defined(CONFIG_XPA) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 40 + #define pte_pfn(x) (((unsigned long)((x).pte_high >> _PFN_SHIFT)) | (unsigned long)((x).pte_low << _PAGE_PRESENT_SHIFT)) + static inline pte_t + pfn_pte(unsigned long pfn, pgprot_t prot) +@@ -125,6 +126,7 @@ pfn_pte(unsigned long pfn, pgprot_t prot) + + #elif defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32) + ++#define MAX_POSSIBLE_PHYSMEM_BITS 36 + #define pte_pfn(x) ((unsigned long)((x).pte_high >> 6)) + + static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot) +@@ -139,6 +141,7 @@ static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot) + + #else + ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 + #ifdef CONFIG_CPU_VR41XX + #define pte_pfn(x) ((unsigned long)((x).pte >> (PAGE_SHIFT + 2))) + #define pfn_pte(pfn, prot) __pte(((pfn) << (PAGE_SHIFT + 2)) | pgprot_val(prot)) diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S index ae810da4d499..59ed811eb32a 100644 --- a/arch/mips/kernel/genex.S @@ -14200,6 +16744,21 @@ index 60177a612cb1..df65516778a2 100644 "0x1c", "0x1d", "0x1e", "0x1f" }; +diff --git a/arch/mips/kernel/r2300_fpu.S b/arch/mips/kernel/r2300_fpu.S +index 918f2f6d3861..ca3476728079 100644 +--- a/arch/mips/kernel/r2300_fpu.S ++++ b/arch/mips/kernel/r2300_fpu.S +@@ -27,8 +27,8 @@ + #define EX2(a,b) \ + 9: a,##b; \ + .section __ex_table,"a"; \ +- PTR 9b,bad_stack; \ +- PTR 9b+4,bad_stack; \ ++ PTR 9b,fault; \ ++ PTR 9b+4,fault; \ + .previous + + .set noreorder diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c index 1958910b75c0..b4a7c303019b 100644 --- a/arch/mips/kernel/relocate.c @@ -14256,6 +16815,23 @@ index 416d53f587e7..6e3671752775 100644 switch (current_cpu_type()) { case CPU_BMIPS4350: case CPU_BMIPS4380: +diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c +index 4234b2d726c5..67d3cba60c9f 100644 +--- a/arch/mips/kernel/syscall.c ++++ b/arch/mips/kernel/syscall.c +@@ -244,12 +244,3 @@ SYSCALL_DEFINE3(cachectl, char *, addr, int, nbytes, int, op) + { + return -ENOSYS; + } +- +-/* +- * If we ever come here the user sp is bad. Zap the process right away. +- * Due to the bad stack signaling wouldn't work. +- */ +-asmlinkage void bad_stack(void) +-{ +- do_exit(SIGSEGV); +-} diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c index a7f81261c781..b15ee1258668 100644 --- a/arch/mips/kernel/time.c @@ -14397,6 +16973,71 @@ index 7c6f75c2aa4d..e64f678ca12c 100644 ltq_ebu_w32(ltq_ebu_r32(LTQ_EBU_PCC_ISTAT) | 0x10, LTQ_EBU_PCC_ISTAT); } +diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c +index cef811755123..fc9eff29d8ff 100644 +--- a/arch/mips/lantiq/xway/dma.c ++++ b/arch/mips/lantiq/xway/dma.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -39,6 +40,7 @@ + #define LTQ_DMA_PCTRL 0x44 + #define LTQ_DMA_IRNEN 0xf4 + ++#define DMA_ID_CHNR GENMASK(26, 20) /* channel number */ + #define DMA_DESCPT BIT(3) /* descriptor complete irq */ + #define DMA_TX BIT(8) /* TX channel direction */ + #define DMA_CHAN_ON BIT(0) /* channel on / off bit */ +@@ -49,7 +51,6 @@ + #define DMA_POLL BIT(31) /* turn on channel polling */ + #define DMA_CLK_DIV4 BIT(6) /* polling clock divider */ + #define DMA_2W_BURST BIT(1) /* 2 word burst length */ +-#define DMA_MAX_CHANNEL 20 /* the soc has 20 channels */ + #define DMA_ETOP_ENDIANNESS (0xf << 8) /* endianness swap etop channels */ + #define DMA_WEIGHT (BIT(17) | BIT(16)) /* default channel wheight */ + +@@ -216,7 +217,7 @@ ltq_dma_init(struct platform_device *pdev) + { + struct clk *clk; + struct resource *res; +- unsigned id; ++ unsigned int id, nchannels; + int i; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +@@ -232,21 +233,24 @@ ltq_dma_init(struct platform_device *pdev) + clk_enable(clk); + ltq_dma_w32_mask(0, DMA_RESET, LTQ_DMA_CTRL); + ++ usleep_range(1, 10); ++ + /* disable all interrupts */ + ltq_dma_w32(0, LTQ_DMA_IRNEN); + + /* reset/configure each channel */ +- for (i = 0; i < DMA_MAX_CHANNEL; i++) { ++ id = ltq_dma_r32(LTQ_DMA_ID); ++ nchannels = ((id & DMA_ID_CHNR) >> 20); ++ for (i = 0; i < nchannels; i++) { + ltq_dma_w32(i, LTQ_DMA_CS); + ltq_dma_w32(DMA_CHAN_RST, LTQ_DMA_CCTRL); + ltq_dma_w32(DMA_POLL | DMA_CLK_DIV4, LTQ_DMA_CPOLL); + ltq_dma_w32_mask(DMA_CHAN_ON, 0, LTQ_DMA_CCTRL); + } + +- id = ltq_dma_r32(LTQ_DMA_ID); + dev_info(&pdev->dev, + "Init done - hw rev: %X, ports: %d, channels: %d\n", +- id & 0x1f, (id >> 16) & 0xf, id >> 20); ++ id & 0x1f, (id >> 16) & 0xf, nchannels); + + return 0; + } diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c index 5530070e0d05..57497a26e79c 100644 --- a/arch/mips/lib/mips-atomic.c @@ -14492,6 +17133,33 @@ index 0596505770db..11985399c469 100644 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ +diff --git a/arch/mips/mti-malta/malta-dtshim.c b/arch/mips/mti-malta/malta-dtshim.c +index c398582c316f..4fc73ee2ca9d 100644 +--- a/arch/mips/mti-malta/malta-dtshim.c ++++ b/arch/mips/mti-malta/malta-dtshim.c +@@ -26,7 +26,7 @@ + #define ROCIT_CONFIG_GEN1_MEMMAP_SHIFT 8 + #define ROCIT_CONFIG_GEN1_MEMMAP_MASK (0xf << 8) + +-static unsigned char fdt_buf[16 << 10] __initdata; ++static unsigned char fdt_buf[16 << 10] __initdata __aligned(8); + + /* determined physical memory size, not overridden by command line args */ + extern unsigned long physical_memsize; +diff --git a/arch/mips/mti-malta/malta-platform.c b/arch/mips/mti-malta/malta-platform.c +index 516e1233d771..0e51db7ac172 100644 +--- a/arch/mips/mti-malta/malta-platform.c ++++ b/arch/mips/mti-malta/malta-platform.c +@@ -48,7 +48,8 @@ static struct plat_serial8250_port uart8250_data[] = { + .mapbase = 0x1f000900, /* The CBUS UART */ + .irq = MIPS_CPU_IRQ_BASE + MIPSCPU_INT_MB2, + .uartclk = 3686400, /* Twice the usual clk! */ +- .iotype = UPIO_MEM32, ++ .iotype = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN) ? ++ UPIO_MEM32BE : UPIO_MEM32, + .flags = CBUS_UART_FLAGS, + .regshift = 3, + }, diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c index 2d6886f09ba3..009b840ee5ef 100644 --- a/arch/mips/pci/pci-legacy.c @@ -14564,6 +17232,27 @@ index f9407e170476..c6af7047eb0d 100644 set_c0_status(IE_IRQ0); } +diff --git a/arch/mips/sni/time.c b/arch/mips/sni/time.c +index 7ee14f41fc25..1ea060f08ffe 100644 +--- a/arch/mips/sni/time.c ++++ b/arch/mips/sni/time.c +@@ -17,14 +17,14 @@ static int a20r_set_periodic(struct clock_event_device *evt) + { + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0x34; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV >> 8; + wmb(); + + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0xb4; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV >> 8; + wmb(); diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c index 530a36f465ce..afcc86726448 100644 --- a/arch/mips/vdso/genvdso.c @@ -14653,6 +17342,53 @@ index cfb1be441dec..921589b45bc2 100644 } #endif /* CONFIG_CLKSRC_MIPS_GIC */ +diff --git a/arch/nios2/include/asm/irqflags.h b/arch/nios2/include/asm/irqflags.h +index 75ab92e639f8..0338fcb88203 100644 +--- a/arch/nios2/include/asm/irqflags.h ++++ b/arch/nios2/include/asm/irqflags.h +@@ -22,7 +22,7 @@ + + static inline unsigned long arch_local_save_flags(void) + { +- return RDCTL(CTL_STATUS); ++ return RDCTL(CTL_FSTATUS); + } + + /* +@@ -31,7 +31,7 @@ static inline unsigned long arch_local_save_flags(void) + */ + static inline void arch_local_irq_restore(unsigned long flags) + { +- WRCTL(CTL_STATUS, flags); ++ WRCTL(CTL_FSTATUS, flags); + } + + static inline void arch_local_irq_disable(void) +diff --git a/arch/nios2/include/asm/registers.h b/arch/nios2/include/asm/registers.h +index 615bce19b546..33824f2ad1ab 100644 +--- a/arch/nios2/include/asm/registers.h ++++ b/arch/nios2/include/asm/registers.h +@@ -24,7 +24,7 @@ + #endif + + /* control register numbers */ +-#define CTL_STATUS 0 ++#define CTL_FSTATUS 0 + #define CTL_ESTATUS 1 + #define CTL_BSTATUS 2 + #define CTL_IENABLE 3 +diff --git a/arch/nios2/platform/Kconfig.platform b/arch/nios2/platform/Kconfig.platform +index d3e5df9fb36b..78ffc0bf4ebe 100644 +--- a/arch/nios2/platform/Kconfig.platform ++++ b/arch/nios2/platform/Kconfig.platform +@@ -37,6 +37,7 @@ config NIOS2_DTB_PHYS_ADDR + + config NIOS2_DTB_SOURCE_BOOL + bool "Compile and link device tree into kernel image" ++ depends on !COMPILE_TEST + default n + help + This allows you to specify a dts (device tree source) file diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h new file mode 100644 index 000000000000..7538294721be @@ -14669,10 +17405,26 @@ index 000000000000..7538294721be + +#endif /* __ASM_BARRIER_H */ diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S -index c17e8451d997..3fbe420f49c4 100644 +index c17e8451d997..92cdc1e56b60 100644 --- a/arch/openrisc/kernel/entry.S +++ b/arch/openrisc/kernel/entry.S -@@ -1092,13 +1092,13 @@ ENTRY(__sys_clone) +@@ -491,6 +491,7 @@ EXCEPTION_ENTRY(_external_irq_handler) + l.bnf 1f // ext irq enabled, all ok. + l.nop + ++#ifdef CONFIG_PRINTK + l.addi r1,r1,-0x8 + l.movhi r3,hi(42f) + l.ori r3,r3,lo(42f) +@@ -504,6 +505,7 @@ EXCEPTION_ENTRY(_external_irq_handler) + .string "\n\rESR interrupt bug: in _external_irq_handler (ESR %x)\n\r" + .align 4 + .previous ++#endif + + l.ori r4,r4,SPR_SR_IEE // fix the bug + // l.sw PT_SR(r1),r4 +@@ -1092,13 +1094,13 @@ ENTRY(__sys_clone) l.movhi r29,hi(sys_clone) l.ori r29,r29,lo(sys_clone) l.j _fork_save_extra_regs_and_call @@ -14734,6 +17486,114 @@ index 90253bdc2ee5..8dc6d198039d 100644 } __cmpxchg_called_with_bad_pointer(); return old; +diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h +index 80e742a1c162..088888fcf8df 100644 +--- a/arch/parisc/include/asm/page.h ++++ b/arch/parisc/include/asm/page.h +@@ -174,7 +174,7 @@ extern int npmem_ranges; + #include + #include + +-#define PAGE0 ((struct zeropage *)__PAGE_OFFSET) ++#define PAGE0 ((struct zeropage *)absolute_pointer(__PAGE_OFFSET)) + + /* DEFINITION OF THE ZERO-PAGE (PAG0) */ + /* based on work by Jason Eckhardt (jason@equator.com) */ +diff --git a/arch/parisc/install.sh b/arch/parisc/install.sh +index 6f68784fea25..a8c49815f58c 100644 +--- a/arch/parisc/install.sh ++++ b/arch/parisc/install.sh +@@ -39,6 +39,7 @@ verify "$3" + if [ -n "${INSTALLKERNEL}" ]; then + if [ -x ~/bin/${INSTALLKERNEL} ]; then exec ~/bin/${INSTALLKERNEL} "$@"; fi + if [ -x /sbin/${INSTALLKERNEL} ]; then exec /sbin/${INSTALLKERNEL} "$@"; fi ++ if [ -x /usr/sbin/${INSTALLKERNEL} ]; then exec /usr/sbin/${INSTALLKERNEL} "$@"; fi + fi + + # Default install +diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S +index 63b140bde2a3..ad20414b7fb5 100644 +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -1849,8 +1849,8 @@ syscall_restore: + LDREG TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 + + /* Are we being ptraced? */ +- ldw TASK_FLAGS(%r1),%r19 +- ldi _TIF_SYSCALL_TRACE_MASK,%r2 ++ LDREG TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19 ++ ldi _TIF_SINGLESTEP|_TIF_BLOCKSTEP,%r2 + and,COND(=) %r19,%r2,%r0 + b,n syscall_restore_rfi + +diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c +index 2264f68f3c2f..d9a4d6ffc0a8 100644 +--- a/arch/parisc/kernel/signal.c ++++ b/arch/parisc/kernel/signal.c +@@ -239,6 +239,12 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs, + #endif + + usp = (regs->gr[30] & ~(0x01UL)); ++#ifdef CONFIG_64BIT ++ if (is_compat_task()) { ++ /* The gcc alloca implementation leaves garbage in the upper 32 bits of sp */ ++ usp = (compat_uint_t)usp; ++ } ++#endif + /*FIXME: frame_size parameter is unused, remove it. */ + frame = get_sigframe(&ksig->ka, usp, sizeof(*frame)); + +diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c +index 75dab2871346..af966c1c922f 100644 +--- a/arch/parisc/kernel/smp.c ++++ b/arch/parisc/kernel/smp.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -74,7 +75,10 @@ enum ipi_message_type { + IPI_CALL_FUNC, + IPI_CPU_START, + IPI_CPU_STOP, +- IPI_CPU_TEST ++ IPI_CPU_TEST, ++#ifdef CONFIG_KGDB ++ IPI_ENTER_KGDB, ++#endif + }; + + +@@ -170,7 +174,12 @@ ipi_interrupt(int irq, void *dev_id) + case IPI_CPU_TEST: + smp_debug(100, KERN_DEBUG "CPU%d is alive!\n", this_cpu); + break; +- ++#ifdef CONFIG_KGDB ++ case IPI_ENTER_KGDB: ++ smp_debug(100, KERN_DEBUG "CPU%d ENTER_KGDB\n", this_cpu); ++ kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs()); ++ break; ++#endif + default: + printk(KERN_CRIT "Unknown IPI num on CPU%d: %lu\n", + this_cpu, which); +@@ -226,6 +235,12 @@ send_IPI_allbutself(enum ipi_message_type op) + } + } + ++#ifdef CONFIG_KGDB ++void kgdb_roundup_cpus(void) ++{ ++ send_IPI_allbutself(IPI_ENTER_KGDB); ++} ++#endif + + inline void + smp_send_stop(void) { send_IPI_allbutself(IPI_CPU_STOP); } diff --git a/arch/parisc/lib/bitops.c b/arch/parisc/lib/bitops.c index 8e45b0a97abf..3284a7adb0a3 100644 --- a/arch/parisc/lib/bitops.c @@ -14754,6 +17614,31 @@ index 8e45b0a97abf..3284a7adb0a3 100644 + _atomic_spin_unlock_irqrestore(ptr, flags); + return prev; +} +diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c +index dbbe3932f833..7bdc449615e8 100644 +--- a/arch/parisc/mm/init.c ++++ b/arch/parisc/mm/init.c +@@ -940,9 +940,9 @@ void flush_tlb_all(void) + { + int do_recycle; + +- __inc_irq_stat(irq_tlb_count); + do_recycle = 0; + spin_lock(&sid_lock); ++ __inc_irq_stat(irq_tlb_count); + if (dirty_space_ids > RECYCLE_THRESHOLD) { + BUG_ON(recycle_inuse); /* FIXME: Use a semaphore/wait queue here */ + get_dirty_sids(&recycle_ndirty,recycle_dirty_array); +@@ -961,8 +961,8 @@ void flush_tlb_all(void) + #else + void flush_tlb_all(void) + { +- __inc_irq_stat(irq_tlb_count); + spin_lock(&sid_lock); ++ __inc_irq_stat(irq_tlb_count); + flush_tlb_all_local(NULL); + recycle_sids(); + spin_unlock(&sid_lock); diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index a4632af7f64e..2351ad8657c7 100644 --- a/arch/powerpc/Kconfig @@ -14779,6 +17664,20 @@ index 63292f64b25a..f66326339bc8 100644 help Provide fault-injection capability for IOMMU. Each device can be selectively enabled via the fail_iommu property. +diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S +index a3550e8f1a77..51669cdbf011 100644 +--- a/arch/powerpc/boot/crt0.S ++++ b/arch/powerpc/boot/crt0.S +@@ -49,9 +49,6 @@ p_end: .long _end + p_pstack: .long _platform_stack_top + #endif + +- .globl _zimage_start +- /* Clang appears to require the .weak directive to be after the symbol +- * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */ + .weak _zimage_start + _zimage_start: + .globl _zimage_start_lib diff --git a/arch/powerpc/boot/devtree.c b/arch/powerpc/boot/devtree.c index a7e21a35c03a..27c84b82b588 100644 --- a/arch/powerpc/boot/devtree.c @@ -14961,6 +17860,32 @@ index a7e21a35c03a..27c84b82b588 100644 for (n = 0; n < nres; n++) { if (!dt_xlate_reg(node, n, &xaddr, NULL)) +diff --git a/arch/powerpc/boot/dts/charon.dts b/arch/powerpc/boot/dts/charon.dts +index 0e00e508eaa6..1c8fe20752e6 100644 +--- a/arch/powerpc/boot/dts/charon.dts ++++ b/arch/powerpc/boot/dts/charon.dts +@@ -39,7 +39,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x08000000>; // 128MB + }; +diff --git a/arch/powerpc/boot/dts/digsy_mtc.dts b/arch/powerpc/boot/dts/digsy_mtc.dts +index 955bff629df3..bf511255f3ae 100644 +--- a/arch/powerpc/boot/dts/digsy_mtc.dts ++++ b/arch/powerpc/boot/dts/digsy_mtc.dts +@@ -20,7 +20,7 @@ + model = "intercontrol,digsy-mtc"; + compatible = "intercontrol,digsy-mtc"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x02000000>; // 32MB + }; + diff --git a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi index af12ead88c5f..404f570ebe23 100644 --- a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi @@ -15009,6 +17934,149 @@ index 51e975d7631a..8921f17fca42 100644 /include/ "qoriq-duart-0.dtsi" /include/ "qoriq-duart-1.dtsi" /include/ "qoriq-gpio-0.dtsi" +diff --git a/arch/powerpc/boot/dts/fsl/t1023rdb.dts b/arch/powerpc/boot/dts/fsl/t1023rdb.dts +index 29757623e5ba..f5f8f969dd58 100644 +--- a/arch/powerpc/boot/dts/fsl/t1023rdb.dts ++++ b/arch/powerpc/boot/dts/fsl/t1023rdb.dts +@@ -125,7 +125,7 @@ + + fm1mac3: ethernet@e4000 { + phy-handle = <&sgmii_aqr_phy3>; +- phy-connection-type = "sgmii-2500"; ++ phy-connection-type = "2500base-x"; + sleep = <&rcpm 0x20000000>; + }; + +diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts +index 179a1785d645..18d137a3393f 100644 +--- a/arch/powerpc/boot/dts/lite5200.dts ++++ b/arch/powerpc/boot/dts/lite5200.dts +@@ -36,7 +36,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts +index 5abb46c5cc95..29419cf81e04 100644 +--- a/arch/powerpc/boot/dts/lite5200b.dts ++++ b/arch/powerpc/boot/dts/lite5200b.dts +@@ -35,7 +35,7 @@ + led4 { gpios = <&gpio_simple 2 1>; }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x10000000>; // 256MB + }; + +diff --git a/arch/powerpc/boot/dts/media5200.dts b/arch/powerpc/boot/dts/media5200.dts +index b5413cb85f13..3d57463bc49d 100644 +--- a/arch/powerpc/boot/dts/media5200.dts ++++ b/arch/powerpc/boot/dts/media5200.dts +@@ -36,7 +36,7 @@ + }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB RAM + }; + +diff --git a/arch/powerpc/boot/dts/mpc5200b.dtsi b/arch/powerpc/boot/dts/mpc5200b.dtsi +index 969b2200b2f9..ecfba675b561 100644 +--- a/arch/powerpc/boot/dts/mpc5200b.dtsi ++++ b/arch/powerpc/boot/dts/mpc5200b.dtsi +@@ -37,7 +37,7 @@ + }; + }; + +- memory: memory { ++ memory: memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/o2d.dts b/arch/powerpc/boot/dts/o2d.dts +index 9f6dd4d889b3..5a676e8141ca 100644 +--- a/arch/powerpc/boot/dts/o2d.dts ++++ b/arch/powerpc/boot/dts/o2d.dts +@@ -16,7 +16,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o2d.dtsi b/arch/powerpc/boot/dts/o2d.dtsi +index cf073e693f24..1b4df5f64b58 100644 +--- a/arch/powerpc/boot/dts/o2d.dtsi ++++ b/arch/powerpc/boot/dts/o2d.dtsi +@@ -23,7 +23,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/o2dnt2.dts b/arch/powerpc/boot/dts/o2dnt2.dts +index a0f5b97a4f06..5184c461a205 100644 +--- a/arch/powerpc/boot/dts/o2dnt2.dts ++++ b/arch/powerpc/boot/dts/o2dnt2.dts +@@ -16,7 +16,7 @@ + model = "ifm,o2dnt2"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o3dnt.dts b/arch/powerpc/boot/dts/o3dnt.dts +index acce49326491..045b90171924 100644 +--- a/arch/powerpc/boot/dts/o3dnt.dts ++++ b/arch/powerpc/boot/dts/o3dnt.dts +@@ -16,7 +16,7 @@ + model = "ifm,o3dnt"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/pcm032.dts b/arch/powerpc/boot/dts/pcm032.dts +index 96b139bf50e9..ac3f53c1a1f5 100644 +--- a/arch/powerpc/boot/dts/pcm032.dts ++++ b/arch/powerpc/boot/dts/pcm032.dts +@@ -26,7 +26,7 @@ + model = "phytec,pcm032"; + compatible = "phytec,pcm032"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/tqm5200.dts b/arch/powerpc/boot/dts/tqm5200.dts +index 1db07f6cf133..68b9e8240fb5 100644 +--- a/arch/powerpc/boot/dts/tqm5200.dts ++++ b/arch/powerpc/boot/dts/tqm5200.dts +@@ -36,7 +36,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; diff --git a/arch/powerpc/boot/ns16550.c b/arch/powerpc/boot/ns16550.c index 8c9ead94be06..cea34a20085c 100644 --- a/arch/powerpc/boot/ns16550.c @@ -15484,6 +18552,21 @@ index a19f831a4cc9..83a6d99e9994 100644 /* driver variables (set by ps3_dma_region_create) */ unsigned long bus_addr; +diff --git a/arch/powerpc/include/asm/pte-common.h b/arch/powerpc/include/asm/pte-common.h +index 4ba26dd259fd..0d81cd9dd60e 100644 +--- a/arch/powerpc/include/asm/pte-common.h ++++ b/arch/powerpc/include/asm/pte-common.h +@@ -101,8 +101,10 @@ static inline bool pte_user(pte_t pte) + */ + #if defined(CONFIG_PPC32) && defined(CONFIG_PTE_64BIT) + #define PTE_RPN_MASK (~((1ULL<idx * 4)) & 0x03fffffc)) ++#define PPC_JMP(dest) \ ++ do { \ ++ long offset = (long)(dest) - (ctx->idx * 4); \ ++ if (offset < -0x2000000 || offset > 0x1fffffc || offset & 0x3) { \ ++ pr_err_ratelimited("Branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \ ++ return -ERANGE; \ ++ } \ ++ EMIT(PPC_INST_BRANCH | (offset & 0x03fffffc)); \ ++ } while (0) + /* "cond" here covers BO:BI fields. */ +-#define PPC_BCC_SHORT(cond, dest) EMIT(PPC_INST_BRANCH_COND | \ +- (((cond) & 0x3ff) << 16) | \ +- (((dest) - (ctx->idx * 4)) & \ +- 0xfffc)) ++#define PPC_BCC_SHORT(cond, dest) \ ++ do { \ ++ long offset = (long)(dest) - (ctx->idx * 4); \ ++ if (offset < -0x8000 || offset > 0x7fff || offset & 0x3) { \ ++ pr_err_ratelimited("Conditional branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \ ++ return -ERANGE; \ ++ } \ ++ EMIT(PPC_INST_BRANCH_COND | (((cond) & 0x3ff) << 16) | (offset & 0xfffc)); \ ++ } while (0) ++ + /* Sign-extended 32-bit immediate load */ + #define PPC_LI32(d, i) do { \ + if ((int)(uintptr_t)(i) >= -32768 && \ +diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c +index 888ee95340da..5a834e34c5b4 100644 +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -239,7 +239,7 @@ static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 + PPC_BLRL(); + } + +-static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out) ++static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out) + { + /* + * By now, the eBPF program has already setup parameters in r3, r4 and r5 +@@ -300,7 +300,9 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 + bpf_jit_emit_common_epilogue(image, ctx); + + PPC_BCTR(); ++ + /* out: */ ++ return 0; + } + + /* Assemble the body code between the prologue & epilogue */ +@@ -310,7 +312,7 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + { + const struct bpf_insn *insn = fp->insnsi; + int flen = fp->len; +- int i; ++ int i, ret; + + /* Start of epilogue code - will only be valid 2nd pass onwards */ + u32 exit_addr = addrs[flen]; +@@ -361,18 +363,25 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + PPC_SUB(dst_reg, dst_reg, src_reg); + goto bpf_alu32_trunc; + case BPF_ALU | BPF_ADD | BPF_K: /* (u32) dst += (u32) imm */ +- case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */ + case BPF_ALU64 | BPF_ADD | BPF_K: /* dst += imm */ ++ if (!imm) { ++ goto bpf_alu32_trunc; ++ } else if (imm >= -32768 && imm < 32768) { ++ PPC_ADDI(dst_reg, dst_reg, IMM_L(imm)); ++ } else { ++ PPC_LI32(b2p[TMP_REG_1], imm); ++ PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]); ++ } ++ goto bpf_alu32_trunc; ++ case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */ + case BPF_ALU64 | BPF_SUB | BPF_K: /* dst -= imm */ +- if (BPF_OP(code) == BPF_SUB) +- imm = -imm; +- if (imm) { +- if (imm >= -32768 && imm < 32768) +- PPC_ADDI(dst_reg, dst_reg, IMM_L(imm)); +- else { +- PPC_LI32(b2p[TMP_REG_1], imm); +- PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]); +- } ++ if (!imm) { ++ goto bpf_alu32_trunc; ++ } else if (imm > -32768 && imm <= 32768) { ++ PPC_ADDI(dst_reg, dst_reg, IMM_L(-imm)); ++ } else { ++ PPC_LI32(b2p[TMP_REG_1], imm); ++ PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]); + } + goto bpf_alu32_trunc; + case BPF_ALU | BPF_MUL | BPF_X: /* (u32) dst *= (u32) src */ +@@ -430,8 +439,14 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */ + if (imm == 0) + return -EINVAL; +- else if (imm == 1) +- goto bpf_alu32_trunc; ++ if (imm == 1) { ++ if (BPF_OP(code) == BPF_DIV) { ++ goto bpf_alu32_trunc; ++ } else { ++ PPC_LI(dst_reg, 0); ++ break; ++ } ++ } + + PPC_LI32(b2p[TMP_REG_1], imm); + switch (BPF_CLASS(code)) { +@@ -932,7 +947,9 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + */ + case BPF_JMP | BPF_CALL | BPF_X: + ctx->seen |= SEEN_TAILCALL; +- bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]); ++ ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]); ++ if (ret < 0) ++ return ret; + break; + + default: diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c index ba49ae6625f1..f2d8f35c181f 100644 --- a/arch/powerpc/perf/core-book3s.c @@ -17018,6 +20247,19 @@ index acd17648cd18..5ea24d16a74a 100644 #include I(REQUEST_BEGIN) REQUEST(__count(0, 8, tlbie_instructions_issued) /* +diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c +index 43fabb3cae0f..160b86d9d819 100644 +--- a/arch/powerpc/perf/hv-gpci.c ++++ b/arch/powerpc/perf/hv-gpci.c +@@ -168,7 +168,7 @@ static unsigned long single_gpci_request(u32 req, u32 starting_index, + */ + count = 0; + for (i = offset; i < offset + length; i++) +- count |= arg->bytes[i] << (i - offset); ++ count |= (u64)(arg->bytes[i]) << ((length - 1 - (i - offset)) * 8); + + *value = count; + out: diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c index 6143c99f3ec5..2d3557406424 100644 --- a/arch/powerpc/perf/isa207-common.c @@ -17070,6 +20312,21 @@ index 08ab6fefcf7a..5f44e9223413 100644 1: mftb r13 /* current */ cmp cr0, r13, r12 +diff --git a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c +index f05325f0cc03..ddd2953965aa 100644 +--- a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c ++++ b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c +@@ -98,9 +98,8 @@ int __init mpc85xx_setup_pmc(void) + pr_err("Could not map guts node address\n"); + return -ENOMEM; + } ++ qoriq_pm_ops = &mpc85xx_pm_ops; + } + +- qoriq_pm_ops = &mpc85xx_pm_ops; +- + return 0; + } diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig index fbdae8377b71..a7ba4c61d8e9 100644 --- a/arch/powerpc/platforms/Kconfig @@ -17803,6 +21060,19 @@ index e76aefae2aa2..0a0e0c8256f6 100644 .prepare_late = pseries_prepare_late, .enter = pseries_suspend_enter, }; +diff --git a/arch/powerpc/sysdev/dcr-low.S b/arch/powerpc/sysdev/dcr-low.S +index e687bb2003ff..5589fbe48bbd 100644 +--- a/arch/powerpc/sysdev/dcr-low.S ++++ b/arch/powerpc/sysdev/dcr-low.S +@@ -15,7 +15,7 @@ + #include + + #define DCR_ACCESS_PROLOG(table) \ +- cmpli cr0,r3,1024; \ ++ cmplwi cr0,r3,1024; \ + rlwinm r3,r3,4,18,27; \ + lis r5,table@h; \ + ori r5,r5,table@l; \ diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c index 47fb336741d4..e26552708a28 100644 --- a/arch/powerpc/sysdev/mpic_msgr.c @@ -18024,6 +21294,31 @@ index 6bc941be6921..166fbd74e316 100644 } static inline long syscall_get_return_value(struct task_struct *task, +diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h +index 15711de10403..d2681d5a3d5a 100644 +--- a/arch/s390/include/asm/tlb.h ++++ b/arch/s390/include/asm/tlb.h +@@ -116,6 +116,20 @@ static inline void tlb_remove_page_size(struct mmu_gather *tlb, + return tlb_remove_page(tlb, page); + } + ++static inline void tlb_flush_pmd_range(struct mmu_gather *tlb, ++ unsigned long address, unsigned long size) ++{ ++ /* ++ * the range might exceed the original range that was provided to ++ * tlb_gather_mmu(), so we need to update it despite the fact it is ++ * usually not updated. ++ */ ++ if (tlb->start > address) ++ tlb->start = address; ++ if (tlb->end < address + size) ++ tlb->end = address + size; ++} ++ + /* + * pte_free_tlb frees a pte table and clears the CRSTE for the + * page table from the tlb. diff --git a/arch/s390/kernel/cpcmd.c b/arch/s390/kernel/cpcmd.c index 7f48e568ac64..540912666740 100644 --- a/arch/s390/kernel/cpcmd.c @@ -18044,9 +21339,18 @@ index 7f48e568ac64..540912666740 100644 asm volatile( " sam31\n" diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c -index f9dca1aed9a4..17b3e82415f8 100644 +index f9dca1aed9a4..7dfc0c1ce486 100644 --- a/arch/s390/kernel/dis.c +++ b/arch/s390/kernel/dis.c +@@ -2018,7 +2018,7 @@ void show_code(struct pt_regs *regs) + start += opsize; + pr_cont("%s", buffer); + ptr = buffer; +- ptr += sprintf(ptr, "\n\t "); ++ ptr += sprintf(ptr, "\n "); + hops++; + } + pr_cont("\n"); @@ -2026,7 +2026,7 @@ void show_code(struct pt_regs *regs) void print_fn_code(unsigned char *code, unsigned long len) @@ -18101,6 +21405,19 @@ index 60a8a4e207ed..2ed98bd07415 100644 return 0; } +diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c +index 083b05f5f5ab..cbc187706648 100644 +--- a/arch/s390/kernel/jump_label.c ++++ b/arch/s390/kernel/jump_label.c +@@ -43,7 +43,7 @@ static void jump_label_bug(struct jump_entry *entry, struct insn *expected, + unsigned char *ipe = (unsigned char *)expected; + unsigned char *ipn = (unsigned char *)new; + +- pr_emerg("Jump label code mismatch at %pS [%p]\n", ipc, ipc); ++ pr_emerg("Jump label code mismatch at %pS [%px]\n", ipc, ipc); + pr_emerg("Found: %6ph\n", ipc); + pr_emerg("Expected: %6ph\n", ipe); + pr_emerg("New: %6ph\n", ipn); diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S index e9df35249f9f..26f4e758c412 100644 --- a/arch/s390/kernel/mcount.S @@ -18196,7 +21513,7 @@ index fc2974b929c3..ee757d6f585e 100644 *(__u32*)((addr_t) ®s->psw + addr*2 + 4) = tmp; } diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c -index a559908d180e..9939879f5f25 100644 +index a559908d180e..2f3b7802d8b8 100644 --- a/arch/s390/kernel/setup.c +++ b/arch/s390/kernel/setup.c @@ -137,7 +137,7 @@ static void __init set_preferred_console(void) @@ -18235,6 +21552,16 @@ index a559908d180e..9939879f5f25 100644 { #ifdef CONFIG_CRASH_DUMP if (OLDMEM_BASE) +@@ -693,9 +693,6 @@ static void __init setup_memory(void) + storage_key_init_range(reg->base, reg->base + reg->size); + } + psw_set_key(PAGE_DEFAULT_KEY); +- +- /* Only cosmetics */ +- memblock_enforce_memory_limit(memblock_end_of_DRAM()); + } + + /* diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c index cba8e56cd63d..54eb8fe95212 100644 --- a/arch/s390/kernel/smp.c @@ -18248,6 +21575,49 @@ index cba8e56cd63d..54eb8fe95212 100644 bool configured; u16 core_id; int nr, i; +diff --git a/arch/s390/lib/string.c b/arch/s390/lib/string.c +index 48352bffbc92..a82335215d54 100644 +--- a/arch/s390/lib/string.c ++++ b/arch/s390/lib/string.c +@@ -225,14 +225,13 @@ EXPORT_SYMBOL(strcmp); + */ + char * strrchr(const char * s, int c) + { +- size_t len = __strend(s) - s; +- +- if (len) +- do { +- if (s[len] == (char) c) +- return (char *) s + len; +- } while (--len > 0); +- return NULL; ++ ssize_t len = __strend(s) - s; ++ ++ do { ++ if (s[len] == (char)c) ++ return (char *)s + len; ++ } while (--len >= 0); ++ return NULL; + } + EXPORT_SYMBOL(strrchr); + +diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c +index 0195c3983f54..65f802f70547 100644 +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -662,9 +662,10 @@ void __gmap_zap(struct gmap *gmap, unsigned long gaddr) + vmaddr |= gaddr & ~PMD_MASK; + /* Get pointer to the page table entry */ + ptep = get_locked_pte(gmap->mm, vmaddr, &ptl); +- if (likely(ptep)) ++ if (likely(ptep)) { + ptep_zap_unused(gmap->mm, vmaddr, ptep, 0); +- pte_unmap_unlock(ptep, ptl); ++ pte_unmap_unlock(ptep, ptl); ++ } + } + } + EXPORT_SYMBOL_GPL(__gmap_zap); diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c index 4a0c5bce3552..8a22def411c5 100644 --- a/arch/s390/mm/hugetlbpage.c @@ -18262,7 +21632,7 @@ index 4a0c5bce3552..8a22def411c5 100644 } else pte_val(pte) = _PAGE_INVALID; diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c -index 9b15a1dc6628..ed58ebab96cd 100644 +index 9b15a1dc6628..3d88c56d30f9 100644 --- a/arch/s390/net/bpf_jit_comp.c +++ b/arch/s390/net/bpf_jit_comp.c @@ -116,7 +116,7 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1) @@ -18274,6 +21644,131 @@ index 9b15a1dc6628..ed58ebab96cd 100644 jit->seen_reg[r1] = 1; } +@@ -591,10 +591,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + EMIT4(0xb9080000, dst_reg, src_reg); + break; + case BPF_ALU | BPF_ADD | BPF_K: /* dst = (u32) dst + (u32) imm */ +- if (!imm) +- break; +- /* alfi %dst,imm */ +- EMIT6_IMM(0xc20b0000, dst_reg, imm); ++ if (imm != 0) { ++ /* alfi %dst,imm */ ++ EMIT6_IMM(0xc20b0000, dst_reg, imm); ++ } + EMIT_ZERO(dst_reg); + break; + case BPF_ALU64 | BPF_ADD | BPF_K: /* dst = dst + imm */ +@@ -616,17 +616,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + EMIT4(0xb9090000, dst_reg, src_reg); + break; + case BPF_ALU | BPF_SUB | BPF_K: /* dst = (u32) dst - (u32) imm */ +- if (!imm) +- break; +- /* alfi %dst,-imm */ +- EMIT6_IMM(0xc20b0000, dst_reg, -imm); ++ if (imm != 0) { ++ /* alfi %dst,-imm */ ++ EMIT6_IMM(0xc20b0000, dst_reg, -imm); ++ } + EMIT_ZERO(dst_reg); + break; + case BPF_ALU64 | BPF_SUB | BPF_K: /* dst = dst - imm */ + if (!imm) + break; +- /* agfi %dst,-imm */ +- EMIT6_IMM(0xc2080000, dst_reg, -imm); ++ if (imm == -0x80000000) { ++ /* algfi %dst,0x80000000 */ ++ EMIT6_IMM(0xc20a0000, dst_reg, 0x80000000); ++ } else { ++ /* agfi %dst,-imm */ ++ EMIT6_IMM(0xc2080000, dst_reg, -imm); ++ } + break; + /* + * BPF_MUL +@@ -641,10 +646,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + EMIT4(0xb90c0000, dst_reg, src_reg); + break; + case BPF_ALU | BPF_MUL | BPF_K: /* dst = (u32) dst * (u32) imm */ +- if (imm == 1) +- break; +- /* msfi %r5,imm */ +- EMIT6_IMM(0xc2010000, dst_reg, imm); ++ if (imm != 1) { ++ /* msfi %r5,imm */ ++ EMIT6_IMM(0xc2010000, dst_reg, imm); ++ } + EMIT_ZERO(dst_reg); + break; + case BPF_ALU64 | BPF_MUL | BPF_K: /* dst = dst * imm */ +@@ -705,6 +710,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + if (BPF_OP(insn->code) == BPF_MOD) + /* lhgi %dst,0 */ + EMIT4_IMM(0xa7090000, dst_reg, 0); ++ else ++ EMIT_ZERO(dst_reg); + break; + } + /* lhi %w0,0 */ +@@ -797,10 +804,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + EMIT4(0xb9820000, dst_reg, src_reg); + break; + case BPF_ALU | BPF_XOR | BPF_K: /* dst = (u32) dst ^ (u32) imm */ +- if (!imm) +- break; +- /* xilf %dst,imm */ +- EMIT6_IMM(0xc0070000, dst_reg, imm); ++ if (imm != 0) { ++ /* xilf %dst,imm */ ++ EMIT6_IMM(0xc0070000, dst_reg, imm); ++ } + EMIT_ZERO(dst_reg); + break; + case BPF_ALU64 | BPF_XOR | BPF_K: /* dst = dst ^ imm */ +@@ -821,10 +828,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + EMIT6_DISP_LH(0xeb000000, 0x000d, dst_reg, dst_reg, src_reg, 0); + break; + case BPF_ALU | BPF_LSH | BPF_K: /* dst = (u32) dst << (u32) imm */ +- if (imm == 0) +- break; +- /* sll %dst,imm(%r0) */ +- EMIT4_DISP(0x89000000, dst_reg, REG_0, imm); ++ if (imm != 0) { ++ /* sll %dst,imm(%r0) */ ++ EMIT4_DISP(0x89000000, dst_reg, REG_0, imm); ++ } + EMIT_ZERO(dst_reg); + break; + case BPF_ALU64 | BPF_LSH | BPF_K: /* dst = dst << imm */ +@@ -846,10 +853,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + EMIT6_DISP_LH(0xeb000000, 0x000c, dst_reg, dst_reg, src_reg, 0); + break; + case BPF_ALU | BPF_RSH | BPF_K: /* dst = (u32) dst >> (u32) imm */ +- if (imm == 0) +- break; +- /* srl %dst,imm(%r0) */ +- EMIT4_DISP(0x88000000, dst_reg, REG_0, imm); ++ if (imm != 0) { ++ /* srl %dst,imm(%r0) */ ++ EMIT4_DISP(0x88000000, dst_reg, REG_0, imm); ++ } + EMIT_ZERO(dst_reg); + break; + case BPF_ALU64 | BPF_RSH | BPF_K: /* dst = dst >> imm */ +diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug +index 5f2bb4242c0f..c50c397cbcf7 100644 +--- a/arch/sh/Kconfig.debug ++++ b/arch/sh/Kconfig.debug +@@ -60,6 +60,7 @@ config DUMP_CODE + + config DWARF_UNWINDER + bool "Enable the DWARF unwinder for stacktraces" ++ depends on DEBUG_KERNEL + select FRAME_POINTER + depends on SUPERH32 + default n diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c index f1147caebacf..af69fb7fef7c 100644 --- a/arch/sh/boards/mach-landisk/setup.c @@ -18302,6 +21797,62 @@ index 78bc97b1d027..ac834e9e0e0a 100644 help This enables support for the DMA controller for the Dreamcast's G2 bus. Drivers that want this will generally enable this on +diff --git a/arch/sh/include/asm/sfp-machine.h b/arch/sh/include/asm/sfp-machine.h +index d3c548443f2a..dd195c6f3b9d 100644 +--- a/arch/sh/include/asm/sfp-machine.h ++++ b/arch/sh/include/asm/sfp-machine.h +@@ -25,6 +25,14 @@ + #ifndef _SFP_MACHINE_H + #define _SFP_MACHINE_H + ++#ifdef __BIG_ENDIAN__ ++#define __BYTE_ORDER __BIG_ENDIAN ++#define __LITTLE_ENDIAN 0 ++#else ++#define __BYTE_ORDER __LITTLE_ENDIAN ++#define __BIG_ENDIAN 0 ++#endif ++ + #define _FP_W_TYPE_SIZE 32 + #define _FP_W_TYPE unsigned long + #define _FP_WS_TYPE signed long +diff --git a/arch/sh/include/asm/tlb.h b/arch/sh/include/asm/tlb.h +index 025cdb1032f6..9f6ab2cd10fc 100644 +--- a/arch/sh/include/asm/tlb.h ++++ b/arch/sh/include/asm/tlb.h +@@ -115,6 +115,16 @@ static inline bool __tlb_remove_page_size(struct mmu_gather *tlb, + return __tlb_remove_page(tlb, page); + } + ++static inline void ++tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address, ++ unsigned long size) ++{ ++ if (tlb->start > address) ++ tlb->start = address; ++ if (tlb->end < address + size) ++ tlb->end = address + size; ++} ++ + static inline bool __tlb_remove_pte_page(struct mmu_gather *tlb, + struct page *page) + { +diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +index 0d3637c494bf..c1f66c35e0c1 100644 +--- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c ++++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +@@ -76,8 +76,9 @@ static void shx3_prepare_cpus(unsigned int max_cpus) + BUILD_BUG_ON(SMP_MSG_NR >= 8); + + for (i = 0; i < SMP_MSG_NR; i++) +- request_irq(104 + i, ipi_interrupt_handler, +- IRQF_PERCPU, "IPI", (void *)(long)i); ++ if (request_irq(104 + i, ipi_interrupt_handler, ++ IRQF_PERCPU, "IPI", (void *)(long)i)) ++ pr_err("Failed to request irq %d\n", i); + + for (i = 0; i < max_cpus; i++) + set_cpu_present(i, true); diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S index 28cc61216b64..ed5b758c650d 100644 --- a/arch/sh/kernel/entry-common.S @@ -18346,6 +21897,27 @@ index cef42d4be292..f6d9c44b32df 100644 select HAVE_UID16 select ARCH_WANT_OLD_COMPAT_IPC select COMPAT_OLD_SIGACTION +diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c +index 8a6982dfd733..5aa33bf7139e 100644 +--- a/arch/sparc/kernel/mdesc.c ++++ b/arch/sparc/kernel/mdesc.c +@@ -37,6 +37,7 @@ struct mdesc_hdr { + u32 node_sz; /* node block size */ + u32 name_sz; /* name block size */ + u32 data_sz; /* data block size */ ++ char data[]; + } __attribute__((aligned(16))); + + struct mdesc_elem { +@@ -369,7 +370,7 @@ void mdesc_update(void) + + static struct mdesc_elem *node_block(struct mdesc_hdr *mdesc) + { +- return (struct mdesc_elem *) (mdesc + 1); ++ return (struct mdesc_elem *) mdesc->data; + } + + static void *name_block(struct mdesc_hdr *mdesc) diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c index a331fdc11a2c..2f4316c14266 100644 --- a/arch/sparc/kernel/ptrace_32.c @@ -18768,6 +22340,21 @@ index ca7cb8e57ab0..b81cdd53d090 100644 __flush_tlb_page(context, vaddr); put_cpu(); +diff --git a/arch/sparc/lib/iomap.c b/arch/sparc/lib/iomap.c +index c4d42a50ebc0..fa4abbaf27de 100644 +--- a/arch/sparc/lib/iomap.c ++++ b/arch/sparc/lib/iomap.c +@@ -18,8 +18,10 @@ void ioport_unmap(void __iomem *addr) + EXPORT_SYMBOL(ioport_map); + EXPORT_SYMBOL(ioport_unmap); + ++#ifdef CONFIG_PCI + void pci_iounmap(struct pci_dev *dev, void __iomem * addr) + { + /* nothing to do */ + } + EXPORT_SYMBOL(pci_iounmap); ++#endif diff --git a/arch/sparc/lib/memset.S b/arch/sparc/lib/memset.S index bb539b42b088..992db8a0f7c9 100644 --- a/arch/sparc/lib/memset.S @@ -18845,6 +22432,29 @@ index 20e30be44795..e3b422ebce09 100644 os_close_file(fd); } +diff --git a/arch/um/include/asm/tlb.h b/arch/um/include/asm/tlb.h +index 821ff0acfe17..6fb47b17179f 100644 +--- a/arch/um/include/asm/tlb.h ++++ b/arch/um/include/asm/tlb.h +@@ -128,6 +128,18 @@ static inline void tlb_remove_page_size(struct mmu_gather *tlb, + return tlb_remove_page(tlb, page); + } + ++static inline void ++tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address, ++ unsigned long size) ++{ ++ tlb->need_flush = 1; ++ ++ if (tlb->start > address) ++ tlb->start = address; ++ if (tlb->end < address + size) ++ tlb->end = address + size; ++} ++ + /** + * tlb_remove_tlb_entry - remember a pte unmapping for later tlb invalidation. + * diff --git a/arch/um/kernel/dyn.lds.S b/arch/um/kernel/dyn.lds.S index 4fdbcf958cd5..558e5258dfff 100644 --- a/arch/um/kernel/dyn.lds.S @@ -19087,18 +22697,19 @@ index 657984f10953..cfb1f34fea02 100644 TRACE_IRQS_ON 1: diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c -index 5f72b473f3ed..f6e57bebbc6b 100644 +index 5f72b473f3ed..5c6aad14cdd9 100644 --- a/arch/x86/events/amd/ibs.c +++ b/arch/x86/events/amd/ibs.c -@@ -88,6 +88,7 @@ struct perf_ibs { +@@ -88,6 +88,8 @@ struct perf_ibs { u64 max_period; unsigned long offset_mask[1]; int offset_max; + unsigned int fetch_count_reset_broken : 1; ++ unsigned int fetch_ignore_if_zero_rip : 1; struct cpu_perf_ibs __percpu *pcpu; struct attribute **format_attrs; -@@ -345,11 +346,15 @@ static u64 get_ibs_op_count(u64 config) +@@ -345,11 +347,15 @@ static u64 get_ibs_op_count(u64 config) { u64 count = 0; @@ -19118,7 +22729,7 @@ index 5f72b473f3ed..f6e57bebbc6b 100644 return count; } -@@ -374,7 +379,12 @@ perf_ibs_event_update(struct perf_ibs *perf_ibs, struct perf_event *event, +@@ -374,7 +380,12 @@ perf_ibs_event_update(struct perf_ibs *perf_ibs, struct perf_event *event, static inline void perf_ibs_enable_event(struct perf_ibs *perf_ibs, struct hw_perf_event *hwc, u64 config) { @@ -19132,7 +22743,7 @@ index 5f72b473f3ed..f6e57bebbc6b 100644 } /* -@@ -636,18 +646,24 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) +@@ -636,18 +647,24 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) perf_ibs->offset_max, offset + 1); } while (offset < offset_max); @@ -19167,7 +22778,18 @@ index 5f72b473f3ed..f6e57bebbc6b 100644 size++; } } -@@ -743,6 +759,13 @@ static __init void perf_event_ibs_init(void) +@@ -657,6 +674,10 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) + if (check_rip && (ibs_data.regs[2] & IBS_RIP_INVALID)) { + regs.flags &= ~PERF_EFLAGS_EXACT; + } else { ++ /* Workaround for erratum #1197 */ ++ if (perf_ibs->fetch_ignore_if_zero_rip && !(ibs_data.regs[1])) ++ goto out; ++ + set_linear_ip(®s, ibs_data.regs[1]); + regs.flags |= PERF_EFLAGS_EXACT; + } +@@ -743,6 +764,16 @@ static __init void perf_event_ibs_init(void) { struct attribute **attr = ibs_op_format_attrs; @@ -19177,6 +22799,9 @@ index 5f72b473f3ed..f6e57bebbc6b 100644 + */ + if (boot_cpu_data.x86 >= 0x16 && boot_cpu_data.x86 <= 0x18) + perf_ibs_fetch.fetch_count_reset_broken = 1; ++ ++ if (boot_cpu_data.x86 == 0x19 && boot_cpu_data.x86_model < 0x10) ++ perf_ibs_fetch.fetch_ignore_if_zero_rip = 1; + perf_ibs_pmu_init(&perf_ibs_fetch, "ibs_fetch"); @@ -19201,6 +22826,18 @@ index b28200dea715..2bbf3fba8097 100644 { struct amd_iommu_event_desc *event = container_of(attr, struct amd_iommu_event_desc, attr); +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index c26cca506f64..c20df6a3540c 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -2075,6 +2075,7 @@ static int x86_pmu_event_init(struct perf_event *event) + if (err) { + if (event->destroy) + event->destroy(event); ++ event->destroy = NULL; + } + + if (ACCESS_ONCE(x86_pmu.attr_rdpmc)) diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c index 72d09340c24d..88ba013d08d4 100644 --- a/arch/x86/events/intel/cstate.c @@ -19347,6 +22984,44 @@ index ad986c1e29bc..f699783114ee 100644 __ATTR(_name, 0444, __uncore_##_var##_show, NULL) static inline unsigned uncore_pci_box_ctl(struct intel_uncore_box *box) +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 686dd4339370..e94d547e9d24 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -3363,6 +3363,9 @@ static int skx_cha_hw_config(struct intel_uncore_box *box, struct perf_event *ev + struct hw_perf_event_extra *reg1 = &event->hw.extra_reg; + struct extra_reg *er; + int idx = 0; ++ /* Any of the CHA events may be filtered by Thread/Core-ID.*/ ++ if (event->hw.config & SNBEP_CBO_PMON_CTL_TID_EN) ++ idx = SKX_CHA_MSR_PMON_BOX_FILTER_TID; + + for (er = skx_uncore_cha_extra_regs; er->msr; er++) { + if (er->event != (event->hw.config & er->config_mask)) +@@ -3430,6 +3433,7 @@ static struct event_constraint skx_uncore_iio_constraints[] = { + UNCORE_EVENT_CONSTRAINT(0xc0, 0xc), + UNCORE_EVENT_CONSTRAINT(0xc5, 0xc), + UNCORE_EVENT_CONSTRAINT(0xd4, 0xc), ++ UNCORE_EVENT_CONSTRAINT(0xd5, 0xc), + EVENT_CONSTRAINT_END + }; + +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h +index c42c9d50c8ee..8095c7169e8a 100644 +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -771,9 +771,10 @@ void x86_pmu_stop(struct perf_event *event, int flags); + + static inline void x86_pmu_disable_event(struct perf_event *event) + { ++ u64 disable_mask = __this_cpu_read(cpu_hw_events.perf_ctr_virt_mask); + struct hw_perf_event *hwc = &event->hw; + +- wrmsrl(hwc->config_base, hwc->config); ++ wrmsrl(hwc->config_base, hwc->config & ~disable_mask); + } + + void x86_pmu_enable_event(struct perf_event *event); diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h index f39fd349cef6..a6d034257b7b 100644 --- a/arch/x86/include/asm/apic.h @@ -19580,7 +23255,7 @@ index 2cd5d12a842c..8ceb7a8a249c 100644 #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */ #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */ diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h -index 21d6fa27b4a9..ebda4718eb8f 100644 +index 21d6fa27b4a9..793c04cba0de 100644 --- a/arch/x86/include/asm/fpu/internal.h +++ b/arch/x86/include/asm/fpu/internal.h @@ -94,6 +94,7 @@ static inline void fpstate_init_fxstate(struct fxregs_state *fx) @@ -19610,7 +23285,22 @@ index 21d6fa27b4a9..ebda4718eb8f 100644 : "0"(0), input); \ err; \ }) -@@ -227,16 +228,20 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) +@@ -220,6 +221,14 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) + } + } + ++static inline void fxsave(struct fxregs_state *fx) ++{ ++ if (IS_ENABLED(CONFIG_X86_32)) ++ asm volatile( "fxsave %[fx]" : [fx] "=m" (*fx)); ++ else ++ asm volatile("fxsaveq %[fx]" : [fx] "=m" (*fx)); ++} ++ + /* These macros all use (%edi)/(%rdi) as the single memory argument. */ + #define XSAVE ".byte " REX_PREFIX "0x0f,0xae,0x27" + #define XSAVEOPT ".byte " REX_PREFIX "0x0f,0xae,0x37" +@@ -227,16 +236,20 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) #define XRSTOR ".byte " REX_PREFIX "0x0f,0xae,0x2f" #define XRSTORS ".byte " REX_PREFIX "0x0f,0xc7,0x1f" @@ -19634,6 +23324,35 @@ index 21d6fa27b4a9..ebda4718eb8f 100644 : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \ : "memory") +@@ -289,28 +302,6 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) + : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \ + : "memory") + +-/* +- * This function is called only during boot time when x86 caps are not set +- * up and alternative can not be used yet. +- */ +-static inline void copy_xregs_to_kernel_booting(struct xregs_state *xstate) +-{ +- u64 mask = -1; +- u32 lmask = mask; +- u32 hmask = mask >> 32; +- int err; +- +- WARN_ON(system_state != SYSTEM_BOOTING); +- +- if (static_cpu_has(X86_FEATURE_XSAVES)) +- XSTATE_OP(XSAVES, xstate, lmask, hmask, err); +- else +- XSTATE_OP(XSAVE, xstate, lmask, hmask, err); +- +- /* We should never fault when copying to a kernel buffer: */ +- WARN_ON_FPU(err); +-} +- + /* + * This function is called only during boot time when x86 caps are not set + * up and alternative can not be used yet. diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h index c2c01f84df75..3e0e18d376d2 100644 --- a/arch/x86/include/asm/insn.h @@ -19702,6 +23421,19 @@ index 8d56d701b5f7..204a5ce65afd 100644 { if (static_branch_likely(&mds_user_clear)) mds_clear_cpu_buffers(); +diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h +index 390fdd39e0e2..5a69eee67353 100644 +--- a/arch/x86/include/asm/page_64_types.h ++++ b/arch/x86/include/asm/page_64_types.h +@@ -19,7 +19,7 @@ + #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER) + #define CURRENT_MASK (~(THREAD_SIZE - 1)) + +-#define EXCEPTION_STACK_ORDER (0 + KASAN_STACK_ORDER) ++#define EXCEPTION_STACK_ORDER (1 + KASAN_STACK_ORDER) + #define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER) + + #define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1) diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h index 2cb5d0f13641..f7745ef149c0 100644 --- a/arch/x86/include/asm/percpu.h @@ -19715,6 +23447,32 @@ index 2cb5d0f13641..f7745ef149c0 100644 CC_SET(c) : CC_OUT(c) (oldbit) : "m" (*(unsigned long __percpu *)addr), "Ir" (nr)); +diff --git a/arch/x86/include/asm/pgtable-3level_types.h b/arch/x86/include/asm/pgtable-3level_types.h +index bcc89625ebe5..f3f719d59e61 100644 +--- a/arch/x86/include/asm/pgtable-3level_types.h ++++ b/arch/x86/include/asm/pgtable-3level_types.h +@@ -42,5 +42,6 @@ typedef union { + */ + #define PTRS_PER_PTE 512 + ++#define MAX_POSSIBLE_PHYSMEM_BITS 36 + + #endif /* _ASM_X86_PGTABLE_3LEVEL_DEFS_H */ +diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h +index e638e3bc3cb8..6c40afcfe5b1 100644 +--- a/arch/x86/include/asm/pgtable.h ++++ b/arch/x86/include/asm/pgtable.h +@@ -1028,8 +1028,8 @@ static inline pte_t pte_swp_clear_soft_dirty(pte_t pte) + } + #endif + +-#define PKRU_AD_BIT 0x1 +-#define PKRU_WD_BIT 0x2 ++#define PKRU_AD_BIT 0x1u ++#define PKRU_WD_BIT 0x2u + #define PKRU_BITS_PER_PKEY 2 + + static inline bool __pkru_allows_read(u32 pkru, u16 pkey) diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h index c50d6dcf4a22..4e7273e176cb 100644 --- a/arch/x86/include/asm/pkeys.h @@ -19751,6 +23509,32 @@ index 7aa9a9bd9d98..f606ef598917 100644 /* * Set IOPL bits in EFLAGS from given mask */ +diff --git a/arch/x86/include/asm/proto.h b/arch/x86/include/asm/proto.h +index 9b9b30b19441..36a7a3f11839 100644 +--- a/arch/x86/include/asm/proto.h ++++ b/arch/x86/include/asm/proto.h +@@ -3,6 +3,8 @@ + + #include + ++struct task_struct; ++ + /* misc architecture specific prototypes */ + + void syscall_init(void); +diff --git a/arch/x86/include/asm/svm.h b/arch/x86/include/asm/svm.h +index 14824fc78f7e..509b9f3307e4 100644 +--- a/arch/x86/include/asm/svm.h ++++ b/arch/x86/include/asm/svm.h +@@ -113,6 +113,8 @@ struct __attribute__ ((__packed__)) vmcb_control_area { + #define V_IGN_TPR_SHIFT 20 + #define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT) + ++#define V_IRQ_INJECTION_BITS_MASK (V_IRQ_MASK | V_INTR_PRIO_MASK | V_IGN_TPR_MASK) ++ + #define V_INTR_MASKING_SHIFT 24 + #define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT) + diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h index 34191cf1594b..a5eb6474b3e2 100644 --- a/arch/x86/include/asm/thread_info.h @@ -20306,10 +24090,70 @@ index 769831d9fd11..07b0ebd49576 100644 if (use_xsave()) { struct _fpx_sw_bytes fx_sw_user; diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c -index e9d7f461b7fa..dbd396c91348 100644 +index e9d7f461b7fa..02ad98ec5149 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c -@@ -871,8 +871,6 @@ const void *get_xsave_field_ptr(int xsave_state) +@@ -407,6 +407,24 @@ static void __init print_xstate_offset_size(void) + } + } + ++/* ++ * All supported features have either init state all zeros or are ++ * handled in setup_init_fpu() individually. This is an explicit ++ * feature list and does not use XFEATURE_MASK*SUPPORTED to catch ++ * newly added supported features at build time and make people ++ * actually look at the init state for the new feature. ++ */ ++#define XFEATURES_INIT_FPSTATE_HANDLED \ ++ (XFEATURE_MASK_FP | \ ++ XFEATURE_MASK_SSE | \ ++ XFEATURE_MASK_YMM | \ ++ XFEATURE_MASK_OPMASK | \ ++ XFEATURE_MASK_ZMM_Hi256 | \ ++ XFEATURE_MASK_Hi16_ZMM | \ ++ XFEATURE_MASK_PKRU | \ ++ XFEATURE_MASK_BNDREGS | \ ++ XFEATURE_MASK_BNDCSR) ++ + /* + * setup the xstate image representing the init state + */ +@@ -414,6 +432,8 @@ static void __init setup_init_fpu_buf(void) + { + static int on_boot_cpu __initdata = 1; + ++ BUILD_BUG_ON(XCNTXT_MASK != XFEATURES_INIT_FPSTATE_HANDLED); ++ + WARN_ON_FPU(!on_boot_cpu); + on_boot_cpu = 0; + +@@ -432,10 +452,22 @@ static void __init setup_init_fpu_buf(void) + copy_kernel_to_xregs_booting(&init_fpstate.xsave); + + /* +- * Dump the init state again. This is to identify the init state +- * of any feature which is not represented by all zero's. ++ * All components are now in init state. Read the state back so ++ * that init_fpstate contains all non-zero init state. This only ++ * works with XSAVE, but not with XSAVEOPT and XSAVES because ++ * those use the init optimization which skips writing data for ++ * components in init state. ++ * ++ * XSAVE could be used, but that would require to reshuffle the ++ * data when XSAVES is available because XSAVES uses xstate ++ * compaction. But doing so is a pointless exercise because most ++ * components have an all zeros init state except for the legacy ++ * ones (FP and SSE). Those can be saved with FXSAVE into the ++ * legacy area. Adding new features requires to ensure that init ++ * state is all zeroes or if not to add the necessary handling ++ * here. + */ +- copy_xregs_to_kernel_booting(&init_fpstate.xsave); ++ fxsave(&init_fpstate.fxsave); + } + + static int xfeature_uncompacted_offset(int xfeature_nr) +@@ -871,8 +903,6 @@ const void *get_xsave_field_ptr(int xsave_state) #ifdef CONFIG_ARCH_HAS_PKEYS @@ -20318,7 +24162,7 @@ index e9d7f461b7fa..dbd396c91348 100644 /* * This will go out and modify PKRU register to set the access * rights for @pkey to @init_val. -@@ -891,6 +889,13 @@ int arch_set_user_pkey_access(struct task_struct *tsk, int pkey, +@@ -891,6 +921,13 @@ int arch_set_user_pkey_access(struct task_struct *tsk, int pkey, if (!boot_cpu_has(X86_FEATURE_OSPKE)) return -EINVAL; @@ -20345,6 +24189,22 @@ index 26d5451b6b42..32e459ecff7a 100644 "spurious 8259A interrupt: IRQ%d.\n", irq); spurious_irq_mask |= irqmask; } +diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c +index c6f0ef1d9ab7..a1aecdc305da 100644 +--- a/arch/x86/kernel/irq.c ++++ b/arch/x86/kernel/irq.c +@@ -284,8 +284,10 @@ void kvm_set_posted_intr_wakeup_handler(void (*handler)(void)) + { + if (handler) + kvm_posted_intr_wakeup_handler = handler; +- else ++ else { + kvm_posted_intr_wakeup_handler = dummy_handler; ++ synchronize_rcu(); ++ } + } + EXPORT_SYMBOL_GPL(kvm_set_posted_intr_wakeup_handler); + diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c index 167ecc270ca5..316c05b8b728 100644 --- a/arch/x86/kernel/kexec-bzimage64.c @@ -20479,7 +24339,7 @@ index 898e97cf6629..320ab978fb1f 100644 * in the TIF_WORK_CTXSW masks. */ diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index c55b11fe8e9f..75a1fd8b0e90 100644 +index c55b11fe8e9f..77e45db89d11 100644 --- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c @@ -198,6 +198,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = { @@ -20497,7 +24357,20 @@ index c55b11fe8e9f..75a1fd8b0e90 100644 { /* Handle problems with rebooting on Apple MacBookPro5 */ .callback = set_pci_reboot, .ident = "Apple MacBookPro5", -@@ -470,6 +478,15 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = { +@@ -381,10 +389,11 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = { + }, + { /* Handle problems with rebooting on the OptiPlex 990. */ + .callback = set_pci_reboot, +- .ident = "Dell OptiPlex 990", ++ .ident = "Dell OptiPlex 990 BIOS A0x", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"), ++ DMI_MATCH(DMI_BIOS_VERSION, "A0"), + }, + }, + { /* Handle problems with rebooting on Dell 300's */ +@@ -470,6 +479,15 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = { }, }, @@ -20513,7 +24386,7 @@ index c55b11fe8e9f..75a1fd8b0e90 100644 /* Sony */ { /* Handle problems with rebooting on Sony VGN-Z540N */ .callback = set_bios_reboot, -@@ -531,29 +548,20 @@ static void emergency_vmx_disable_all(void) +@@ -531,29 +549,20 @@ static void emergency_vmx_disable_all(void) local_irq_disable(); /* @@ -20740,7 +24613,7 @@ index 3988e26af3b5..bfed29a4c2ce 100644 return; diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index 3a281a2decde..5cbc6591fa1d 100644 +index 3a281a2decde..c16d24ad8356 100644 --- a/arch/x86/kvm/mmu.c +++ b/arch/x86/kvm/mmu.c @@ -3849,7 +3849,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu *vcpu, @@ -20752,7 +24625,25 @@ index 3a281a2decde..5cbc6591fa1d 100644 rsvd_bits(maxphyaddr, 51); rsvd_check->rsvd_bits_mask[0][1] = exb_bit_rsvd | rsvd_bits(maxphyaddr, 51); -@@ -5321,6 +5321,7 @@ static void kvm_recover_nx_lpages(struct kvm *kvm) +@@ -3927,7 +3927,16 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu, + void + reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context) + { +- bool uses_nx = context->nx || context->base_role.smep_andnot_wp; ++ /* ++ * KVM uses NX when TDP is disabled to handle a variety of scenarios, ++ * notably for huge SPTEs if iTLB multi-hit mitigation is enabled and ++ * to generate correct permissions for CR0.WP=0/CR4.SMEP=1/EFER.NX=0. ++ * The iTLB multi-hit workaround can be toggled at any time, so assume ++ * NX can be used by any non-nested shadow MMU to avoid having to reset ++ * MMU contexts. Note, KVM forces EFER.NX=1 when TDP is disabled. ++ */ ++ bool uses_nx = context->nx || !tdp_enabled || ++ context->base_role.smep_andnot_wp; + + /* + * Passing "true" to the last argument is okay; it adds a check +@@ -5321,6 +5330,7 @@ static void kvm_recover_nx_lpages(struct kvm *kvm) cond_resched_lock(&kvm->mmu_lock); } } @@ -20787,7 +24678,7 @@ index 84ae4dd261ca..cafdaabf062f 100644 /* mapping between fixed pmc index and intel_arch_events array */ diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 1079228e4fef..cbc7f177bbd8 100644 +index 1079228e4fef..03fdeab057d2 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -2734,7 +2734,7 @@ static inline void copy_vmcb_control_area(struct vmcb *dst_vmcb, struct vmcb *fr @@ -20799,7 +24690,20 @@ index 1079228e4fef..cbc7f177bbd8 100644 dst->tlb_ctl = from->tlb_ctl; dst->int_ctl = from->int_ctl; dst->int_vector = from->int_vector; -@@ -3412,7 +3412,7 @@ static int cr_interception(struct vcpu_svm *svm) +@@ -3048,7 +3048,11 @@ static bool nested_svm_vmrun(struct vcpu_svm *svm) + svm->nested.intercept = nested_vmcb->control.intercept; + + svm_flush_tlb(&svm->vcpu); +- svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl | V_INTR_MASKING_MASK; ++ svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl & ++ (V_TPR_MASK | V_IRQ_INJECTION_BITS_MASK); ++ ++ svm->vmcb->control.int_ctl |= V_INTR_MASKING_MASK; ++ + if (nested_vmcb->control.int_ctl & V_INTR_MASKING_MASK) + svm->vcpu.arch.hflags |= HF_VINTR_MASK; + else +@@ -3412,7 +3416,7 @@ static int cr_interception(struct vcpu_svm *svm) err = 0; if (cr >= 16) { /* mov to cr */ cr -= 16; @@ -20808,7 +24712,7 @@ index 1079228e4fef..cbc7f177bbd8 100644 switch (cr) { case 0: if (!check_selective_cr0_intercepted(svm, val)) -@@ -3457,7 +3457,7 @@ static int cr_interception(struct vcpu_svm *svm) +@@ -3457,7 +3461,7 @@ static int cr_interception(struct vcpu_svm *svm) kvm_queue_exception(&svm->vcpu, UD_VECTOR); return 1; } @@ -20817,7 +24721,7 @@ index 1079228e4fef..cbc7f177bbd8 100644 } kvm_complete_insn_gp(&svm->vcpu, err); -@@ -3489,13 +3489,13 @@ static int dr_interception(struct vcpu_svm *svm) +@@ -3489,13 +3493,13 @@ static int dr_interception(struct vcpu_svm *svm) if (dr >= 16) { /* mov to DRn */ if (!kvm_require_dr(&svm->vcpu, dr - 16)) return 1; @@ -20855,7 +24759,7 @@ index 003c5a599f6d..da44308d1b55 100644 vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV; diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 0f66f7dd8938..c959720c7593 100644 +index 0f66f7dd8938..c0f7e746722d 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -97,6 +97,7 @@ static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE); @@ -20875,7 +24779,18 @@ index 0f66f7dd8938..c959720c7593 100644 return kvm_x2apic_msr_write(vcpu, msr, data); case MSR_IA32_TSCDEADLINE: kvm_set_lapic_tscdeadline_msr(vcpu, data); -@@ -2576,7 +2577,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) +@@ -2314,6 +2315,10 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + if (!msr_info->host_initiated) { + s64 adj = data - vcpu->arch.ia32_tsc_adjust_msr; + adjust_tsc_offset_guest(vcpu, adj); ++ /* Before back to guest, tsc_timestamp must be adjusted ++ * as well, otherwise guest's percpu pvclock time could jump. ++ */ ++ kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu); + } + vcpu->arch.ia32_tsc_adjust_msr = data; + } +@@ -2576,7 +2581,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) case MSR_IA32_APICBASE: msr_info->data = kvm_get_apic_base(vcpu); break; @@ -20884,7 +24799,7 @@ index 0f66f7dd8938..c959720c7593 100644 return kvm_x2apic_msr_read(vcpu, msr_info->index, &msr_info->data); break; case MSR_IA32_TSCDEADLINE: -@@ -3199,6 +3200,10 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu, +@@ -3199,6 +3204,10 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu, struct kvm_vcpu_events *events) { process_nmi(vcpu); @@ -20895,7 +24810,7 @@ index 0f66f7dd8938..c959720c7593 100644 events->exception.injected = vcpu->arch.exception.pending && !kvm_exception_is_soft(vcpu->arch.exception.nr); -@@ -4263,10 +4268,13 @@ long kvm_arch_vm_ioctl(struct file *filp, +@@ -4263,10 +4272,13 @@ long kvm_arch_vm_ioctl(struct file *filp, r = -EFAULT; if (copy_from_user(&u.ps, argp, sizeof u.ps)) goto out; @@ -20910,7 +24825,7 @@ index 0f66f7dd8938..c959720c7593 100644 break; } case KVM_GET_PIT2: { -@@ -4286,10 +4294,13 @@ long kvm_arch_vm_ioctl(struct file *filp, +@@ -4286,10 +4298,13 @@ long kvm_arch_vm_ioctl(struct file *filp, r = -EFAULT; if (copy_from_user(&u.ps2, argp, sizeof(u.ps2))) goto out; @@ -20925,7 +24840,7 @@ index 0f66f7dd8938..c959720c7593 100644 break; } case KVM_REINJECT_CONTROL: { -@@ -6257,6 +6268,7 @@ void kvm_arch_exit(void) +@@ -6257,6 +6272,7 @@ void kvm_arch_exit(void) cpuhp_remove_state_nocalls(CPUHP_AP_X86_KVM_CLK_ONLINE); #ifdef CONFIG_X86_64 pvclock_gtod_unregister_notifier(&pvclock_gtod_notifier); @@ -20933,7 +24848,7 @@ index 0f66f7dd8938..c959720c7593 100644 #endif kvm_x86_ops = NULL; kvm_mmu_module_exit(); -@@ -7032,6 +7044,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) +@@ -7032,6 +7048,8 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) set_debugreg(vcpu->arch.eff_db[3], 3); set_debugreg(vcpu->arch.dr6, 6); vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD; @@ -20990,6 +24905,35 @@ index ce092a62fc5d..bc2455c2fcab 100644 } for (i = 0; i < num; i++) { +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index d35d0e4bbf99..bd6905ce590f 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -1126,21 +1126,21 @@ int kern_addr_valid(unsigned long addr) + return 0; + + pud = pud_offset(pgd, addr); +- if (pud_none(*pud)) ++ if (!pud_present(*pud)) + return 0; + + if (pud_large(*pud)) + return pfn_valid(pud_pfn(*pud)); + + pmd = pmd_offset(pud, addr); +- if (pmd_none(*pmd)) ++ if (!pmd_present(*pmd)) + return 0; + + if (pmd_large(*pmd)) + return pfn_valid(pmd_pfn(*pmd)); + + pte = pte_offset_kernel(pmd, addr); +- if (pte_none(*pte)) ++ if (!pte_present(*pte)) + return 0; + + return pfn_valid(pte_pfn(*pte)); diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c index 08e0380414a9..b68b102f6774 100644 --- a/arch/x86/mm/pgtable.c @@ -21040,6 +24984,18 @@ index 62950ef7f84e..68e86d7cc94d 100644 /* * Device [1022:7914] +diff --git a/arch/x86/tools/chkobjdump.awk b/arch/x86/tools/chkobjdump.awk +index fd1ab80be0de..a4cf678cf5c8 100644 +--- a/arch/x86/tools/chkobjdump.awk ++++ b/arch/x86/tools/chkobjdump.awk +@@ -10,6 +10,7 @@ BEGIN { + + /^GNU objdump/ { + verstr = "" ++ gsub(/\(.*\)/, ""); + for (i = 3; i <= NF; i++) + if (match($(i), "^[0-9]")) { + verstr = $(i); diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c index 5b6c8486a0be..d1c3f82c7882 100644 --- a/arch/x86/tools/relocs.c @@ -21072,10 +25028,97 @@ index 5b6c8486a0be..d1c3f82c7882 100644 */ break; +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index db7cf8727e1c..5c3a3227cb2b 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -872,8 +872,8 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g) + preempt_enable(); + } + +-static void xen_convert_trap_info(const struct desc_ptr *desc, +- struct trap_info *traps) ++static unsigned xen_convert_trap_info(const struct desc_ptr *desc, ++ struct trap_info *traps, bool full) + { + unsigned in, out, count; + +@@ -883,17 +883,18 @@ static void xen_convert_trap_info(const struct desc_ptr *desc, + for (in = out = 0; in < count; in++) { + gate_desc *entry = (gate_desc*)(desc->address) + in; + +- if (cvt_gate_to_trap(in, entry, &traps[out])) ++ if (cvt_gate_to_trap(in, entry, &traps[out]) || full) + out++; + } +- traps[out].address = 0; ++ ++ return out; + } + + void xen_copy_trap_info(struct trap_info *traps) + { + const struct desc_ptr *desc = this_cpu_ptr(&idt_desc); + +- xen_convert_trap_info(desc, traps); ++ xen_convert_trap_info(desc, traps, true); + } + + /* Load a new IDT into Xen. In principle this can be per-CPU, so we +@@ -903,6 +904,7 @@ static void xen_load_idt(const struct desc_ptr *desc) + { + static DEFINE_SPINLOCK(lock); + static struct trap_info traps[257]; ++ unsigned out; + + trace_xen_cpu_load_idt(desc); + +@@ -910,7 +912,8 @@ static void xen_load_idt(const struct desc_ptr *desc) + + memcpy(this_cpu_ptr(&idt_desc), desc, sizeof(idt_desc)); + +- xen_convert_trap_info(desc, traps); ++ out = xen_convert_trap_info(desc, traps, false); ++ memset(&traps[out], 0, sizeof(traps[0])); + + xen_mc_flush(); + if (HYPERVISOR_set_trap_table(traps)) +@@ -1576,6 +1579,11 @@ static int xen_cpuhp_setup(void) + return rc >= 0 ? 0 : rc; + } + ++static void __init xen_domu_set_legacy_features(void) ++{ ++ x86_platform.legacy.rtc = 0; ++} ++ + /* First C function to be called on Xen boot */ + asmlinkage __visible void __init xen_start_kernel(void) + { +@@ -1741,6 +1749,8 @@ asmlinkage __visible void __init xen_start_kernel(void) + add_preferred_console("hvc", 0, NULL); + if (pci_xen) + x86_init.pci.arch_init = pci_xen_init; ++ x86_platform.set_legacy_features = ++ xen_domu_set_legacy_features; + } else { + const struct dom0_vga_console_info *info = + (void *)((char *)xen_start_info + diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c -index 37129db76d33..d6ed664c1e39 100644 +index 37129db76d33..3d2015011ca9 100644 --- a/arch/x86/xen/p2m.c +++ b/arch/x86/xen/p2m.c +@@ -623,8 +623,8 @@ int xen_alloc_p2m_entry(unsigned long pfn) + } + + /* Expanded the p2m? */ +- if (pfn > xen_p2m_last_pfn) { +- xen_p2m_last_pfn = pfn; ++ if (pfn >= xen_p2m_last_pfn) { ++ xen_p2m_last_pfn = ALIGN(pfn + 1, P2M_PER_PAGE); + HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn; + } + @@ -723,9 +723,12 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops, for (i = 0; i < count; i++) { @@ -21189,6 +25232,32 @@ index 8d2c6f071dcc..44bf8a22c97b 100644 per_cpu(lock_kicker_irq, cpu) = -1; kfree(per_cpu(irq_name, cpu)); per_cpu(irq_name, cpu) = NULL; +diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig +index f61058617ada..ff45491c64e0 100644 +--- a/arch/xtensa/Kconfig ++++ b/arch/xtensa/Kconfig +@@ -17,7 +17,7 @@ config XTENSA + select HAVE_DMA_API_DEBUG + select HAVE_EXIT_THREAD + select HAVE_FUNCTION_TRACER +- select HAVE_FUTEX_CMPXCHG if !MMU ++ select HAVE_FUTEX_CMPXCHG if !MMU && FUTEX + select HAVE_HW_BREAKPOINT if PERF_EVENTS + select HAVE_IRQ_TIME_ACCOUNTING + select HAVE_MEMBLOCK +diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c +index 441694464b1e..fbbc24b914e3 100644 +--- a/arch/xtensa/kernel/irq.c ++++ b/arch/xtensa/kernel/irq.c +@@ -144,7 +144,7 @@ unsigned xtensa_get_ext_irq_no(unsigned irq) + + void __init init_IRQ(void) + { +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + irqchip_init(); + #else + #ifdef CONFIG_HAVE_SMP diff --git a/arch/xtensa/kernel/perf_event.c b/arch/xtensa/kernel/perf_event.c index 0fecc8a2c0b5..f6dd8e148be8 100644 --- a/arch/xtensa/kernel/perf_event.c @@ -21324,6 +25393,43 @@ index 3c75c4e597da..7aaedeebb35d 100644 } memcpy(dst, src, len); +diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c +index c68f1e6158aa..a2d93a7c7ff2 100644 +--- a/arch/xtensa/platforms/iss/console.c ++++ b/arch/xtensa/platforms/iss/console.c +@@ -182,9 +182,13 @@ static const struct tty_operations serial_ops = { + + int __init rs_init(void) + { +- tty_port_init(&serial_port); ++ int ret; + + serial_driver = alloc_tty_driver(SERIAL_MAX_NUM_LINES); ++ if (!serial_driver) ++ return -ENOMEM; ++ ++ tty_port_init(&serial_port); + + printk ("%s %s\n", serial_name, serial_version); + +@@ -204,8 +208,15 @@ int __init rs_init(void) + tty_set_operations(serial_driver, &serial_ops); + tty_port_link_device(&serial_port, serial_driver, 0); + +- if (tty_register_driver(serial_driver)) +- panic("Couldn't register serial driver\n"); ++ ret = tty_register_driver(serial_driver); ++ if (ret) { ++ pr_err("Couldn't register serial driver\n"); ++ tty_driver_kref_put(serial_driver); ++ tty_port_destroy(&serial_port); ++ ++ return ret; ++ } ++ + return 0; + } + diff --git a/arch/xtensa/platforms/iss/simdisk.c b/arch/xtensa/platforms/iss/simdisk.c index ede04cca30dd..82fb5102d824 100644 --- a/arch/xtensa/platforms/iss/simdisk.c @@ -21336,6 +25442,40 @@ index ede04cca30dd..82fb5102d824 100644 #define SIMDISK_MINORS 1 #define MAX_SIMDISK_COUNT 10 +diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c +index 42285f35d313..db5122765f16 100644 +--- a/arch/xtensa/platforms/xtfpga/setup.c ++++ b/arch/xtensa/platforms/xtfpga/setup.c +@@ -54,8 +54,12 @@ void platform_power_off(void) + + void platform_restart(void) + { +- /* Flush and reset the mmu, simulate a processor reset, and +- * jump to the reset vector. */ ++ /* Try software reset first. */ ++ WRITE_ONCE(*(u32 *)XTFPGA_SWRST_VADDR, 0xdead); ++ ++ /* If software reset did not work, flush and reset the mmu, ++ * simulate a processor reset, and jump to the reset vector. ++ */ + cpu_reset(); + /* control never gets here */ + } +@@ -85,7 +89,7 @@ void __init platform_calibrate_ccount(void) + + #endif + +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + + static void __init xtfpga_clk_setup(struct device_node *np) + { +@@ -303,4 +307,4 @@ static int __init xtavnet_init(void) + */ + arch_initcall(xtavnet_init); + +-#endif /* CONFIG_OF */ ++#endif /* CONFIG_USE_OF */ diff --git a/block/blk-mq.c b/block/blk-mq.c index 098279a84549..76b1acad2da1 100644 --- a/block/blk-mq.c @@ -21392,6 +25532,18 @@ index 724febdf2282..088a5084b52f 100755 /* Discard alignment and granularity */ if (b->discard_granularity) { alignment = queue_limit_discard_alignment(b, start); +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 3a4c9a3c1427..6435dc25be0a 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -1584,6 +1584,7 @@ int blk_throtl_init(struct request_queue *q) + void blk_throtl_exit(struct request_queue *q) + { + BUG_ON(!q->td); ++ del_timer_sync(&q->td->service_queue.pending_timer); + throtl_shutdown_wq(q); + blkcg_deactivate_policy(q, &blkcg_policy_throtl); + kfree(q->td); diff --git a/block/genhd.c b/block/genhd.c index 6ad0fd0dfd2d..7829807814c4 100644 --- a/block/genhd.c @@ -21417,6 +25569,27 @@ index 6ad0fd0dfd2d..7829807814c4 100644 piter->idx += inc; break; } +diff --git a/block/ioprio.c b/block/ioprio.c +index 01b8116298a1..284bdfa3aacf 100644 +--- a/block/ioprio.c ++++ b/block/ioprio.c +@@ -202,6 +202,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who) + pgrp = task_pgrp(current); + else + pgrp = find_vpid(who); ++ read_lock(&tasklist_lock); + do_each_pid_thread(pgrp, PIDTYPE_PGID, p) { + tmpio = get_task_ioprio(p); + if (tmpio < 0) +@@ -211,6 +212,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which, int, who) + else + ret = ioprio_best(ret, tmpio); + } while_each_pid_thread(pgrp, PIDTYPE_PGID, p); ++ read_unlock(&tasklist_lock); ++ + break; + case IOPRIO_WHO_USER: + uid = make_kuid(current_user_ns(), who); diff --git a/build.config.aarch64 b/build.config.aarch64 index 523bbc0449f7..357db0220511 100644 --- a/build.config.aarch64 @@ -21429,6 +25602,30 @@ index 523bbc0449f7..357db0220511 100644 arch/arm64/boot/Image.gz vmlinux System.map +diff --git a/certs/Makefile b/certs/Makefile +index 9d89b992eee6..f82be3690250 100644 +--- a/certs/Makefile ++++ b/certs/Makefile +@@ -43,11 +43,19 @@ endif + redirect_openssl = 2>&1 + quiet_redirect_openssl = 2>&1 + silent_redirect_openssl = 2>/dev/null ++openssl_available = $(shell openssl help 2>/dev/null && echo yes) + + # We do it this way rather than having a boolean option for enabling an + # external private key, because 'make randconfig' might enable such a + # boolean option and we unfortunately can't make it depend on !RANDCONFIG. + ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") ++ ++ifeq ($(openssl_available),yes) ++X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null) ++ ++$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem")) ++endif ++ + $(obj)/signing_key.pem: $(obj)/x509.genkey + @$(kecho) "###" + @$(kecho) "### Now generating an X.509 key pair to be used for signing modules." diff --git a/crypto/af_alg.c b/crypto/af_alg.c index cf3975ee4fd8..9fcd7f5adf74 100644 --- a/crypto/af_alg.c @@ -21633,6 +25830,44 @@ index 3cd8a2414e60..de43ffb53840 100644 ptr = ecdh_unpack_data(¶ms->curve_id, ptr, sizeof(params->curve_id)); ptr = ecdh_unpack_data(¶ms->key_size, ptr, sizeof(params->key_size)); if (secret.len != crypto_ecdh_key_len(params)) +diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c +index 85082574c515..62e11835f220 100644 +--- a/crypto/pcrypt.c ++++ b/crypto/pcrypt.c +@@ -138,12 +138,14 @@ static void pcrypt_aead_enc(struct padata_priv *padata) + { + struct pcrypt_request *preq = pcrypt_padata_request(padata); + struct aead_request *req = pcrypt_request_ctx(preq); ++ int ret; + +- padata->info = crypto_aead_encrypt(req); ++ ret = crypto_aead_encrypt(req); + +- if (padata->info == -EINPROGRESS) ++ if (ret == -EINPROGRESS) + return; + ++ padata->info = ret; + padata_do_serial(padata); + } + +@@ -180,12 +182,14 @@ static void pcrypt_aead_dec(struct padata_priv *padata) + { + struct pcrypt_request *preq = pcrypt_padata_request(padata); + struct aead_request *req = pcrypt_request_ctx(preq); ++ int ret; + +- padata->info = crypto_aead_decrypt(req); ++ ret = crypto_aead_decrypt(req); + +- if (padata->info == -EINPROGRESS) ++ if (ret == -EINPROGRESS) + return; + ++ padata->info = ret; + padata_do_serial(padata); + } + diff --git a/crypto/shash.c b/crypto/shash.c index a1c7609578ea..7eebf3cde7b7 100644 --- a/crypto/shash.c @@ -21756,6 +25991,19 @@ index 67d97c0090a2..5d72baf60ac8 100644 if (memcmp(idstr, list_id, 3)) return false; +diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h +index 750fa824d42c..a04bb91d56ca 100644 +--- a/drivers/acpi/acpica/acglobal.h ++++ b/drivers/acpi/acpica/acglobal.h +@@ -259,6 +259,8 @@ extern struct acpi_bit_register_info + + ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a); + ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b); ++ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a_s0); ++ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b_s0); + + /***************************************************************************** + * diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c index aed8d3459220..c2c391d5c5a1 100644 --- a/drivers/acpi/acpica/exprep.c @@ -21771,6 +26019,85 @@ index aed8d3459220..c2c391d5c5a1 100644 ACPI_DEBUG_PRINT((ACPI_DB_BFIELD, "RegionField: BitOff %X, Off %X, Gran %X, Region %p\n", obj_desc->field.start_field_bit_offset, +diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c +index 3f2fb4b31fdc..7e2f9b0e66ee 100644 +--- a/drivers/acpi/acpica/hwesleep.c ++++ b/drivers/acpi/acpica/hwesleep.c +@@ -184,17 +184,13 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state) + + acpi_status acpi_hw_extended_wake_prep(u8 sleep_state) + { +- acpi_status status; + u8 sleep_type_value; + + ACPI_FUNCTION_TRACE(hw_extended_wake_prep); + +- status = acpi_get_sleep_type_data(ACPI_STATE_S0, +- &acpi_gbl_sleep_type_a, +- &acpi_gbl_sleep_type_b); +- if (ACPI_SUCCESS(status)) { ++ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) { + sleep_type_value = +- ((acpi_gbl_sleep_type_a << ACPI_X_SLEEP_TYPE_POSITION) & ++ ((acpi_gbl_sleep_type_a_s0 << ACPI_X_SLEEP_TYPE_POSITION) & + ACPI_X_SLEEP_TYPE_MASK); + + (void)acpi_write((u64)(sleep_type_value | ACPI_X_SLEEP_ENABLE), +diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c +index d00c9810845b..ddf198de8729 100644 +--- a/drivers/acpi/acpica/hwsleep.c ++++ b/drivers/acpi/acpica/hwsleep.c +@@ -217,7 +217,7 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state) + + acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state) + { +- acpi_status status; ++ acpi_status status = AE_OK; + struct acpi_bit_register_info *sleep_type_reg_info; + struct acpi_bit_register_info *sleep_enable_reg_info; + u32 pm1a_control; +@@ -230,10 +230,7 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state) + * This is unclear from the ACPI Spec, but it is required + * by some machines. + */ +- status = acpi_get_sleep_type_data(ACPI_STATE_S0, +- &acpi_gbl_sleep_type_a, +- &acpi_gbl_sleep_type_b); +- if (ACPI_SUCCESS(status)) { ++ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) { + sleep_type_reg_info = + acpi_hw_get_bit_register_info(ACPI_BITREG_SLEEP_TYPE); + sleep_enable_reg_info = +@@ -254,9 +251,9 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state) + + /* Insert the SLP_TYP bits */ + +- pm1a_control |= (acpi_gbl_sleep_type_a << ++ pm1a_control |= (acpi_gbl_sleep_type_a_s0 << + sleep_type_reg_info->bit_position); +- pm1b_control |= (acpi_gbl_sleep_type_b << ++ pm1b_control |= (acpi_gbl_sleep_type_b_s0 << + sleep_type_reg_info->bit_position); + + /* Write the control registers and ignore any errors */ +diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c +index f76e0eab32b8..53f9f4c35957 100644 +--- a/drivers/acpi/acpica/hwxfsleep.c ++++ b/drivers/acpi/acpica/hwxfsleep.c +@@ -315,6 +315,13 @@ acpi_status acpi_enter_sleep_state_prep(u8 sleep_state) + return_ACPI_STATUS(status); + } + ++ status = acpi_get_sleep_type_data(ACPI_STATE_S0, ++ &acpi_gbl_sleep_type_a_s0, ++ &acpi_gbl_sleep_type_b_s0); ++ if (ACPI_FAILURE(status)) { ++ acpi_gbl_sleep_type_a_s0 = ACPI_SLEEP_TYPE_INVALID; ++ } ++ + /* Execute the _PTS method (Prepare To Sleep) */ + + arg_list.count = 1; diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c index 529d6c38ea7c..03a2282ceb9c 100644 --- a/drivers/acpi/acpica/utdelete.c @@ -21795,6 +26122,19 @@ index 529d6c38ea7c..03a2282ceb9c 100644 case ACPI_TYPE_REGION: default: +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 93ecae55fe6a..69c6f02f16b5 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -187,7 +187,7 @@ static int acpi_battery_is_charged(struct acpi_battery *battery) + return 1; + + /* fallback to using design values for broken batteries */ +- if (battery->design_capacity == battery->capacity_now) ++ if (battery->design_capacity <= battery->capacity_now) + return 1; + + /* we don't do any sort of metric based on percentages */ diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index 6b2c9d68d810..1c13e5fe10d9 100644 --- a/drivers/acpi/bus.c @@ -22016,7 +26356,7 @@ index b012e94b7d9f..56c429ea6aaf 100644 }; diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c -index 31a07609f7a2..b7fd8e00b346 100644 +index 31a07609f7a2..4dddf579560f 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -1219,7 +1219,7 @@ static ssize_t format1_show(struct device *dev, @@ -22028,6 +26368,80 @@ index 31a07609f7a2..b7fd8e00b346 100644 break; } mutex_unlock(&acpi_desc->init_mutex); +@@ -2258,6 +2258,9 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc, + struct acpi_nfit_memory_map *memdev = nfit_memdev->memdev; + struct nd_mapping_desc *mapping; + ++ /* range index 0 == unmapped in SPA or invalid-SPA */ ++ if (memdev->range_index == 0 || spa->range_index == 0) ++ continue; + if (memdev->range_index != spa->range_index) + continue; + if (count >= ND_MAX_MAPPINGS) { +diff --git a/drivers/acpi/pmic/intel_pmic.c b/drivers/acpi/pmic/intel_pmic.c +index ca18e0d23df9..db63d3463617 100644 +--- a/drivers/acpi/pmic/intel_pmic.c ++++ b/drivers/acpi/pmic/intel_pmic.c +@@ -216,31 +216,36 @@ static acpi_status intel_pmic_regs_handler(u32 function, + void *handler_context, void *region_context) + { + struct intel_pmic_opregion *opregion = region_context; +- int result = 0; ++ int result = -EINVAL; ++ ++ if (function == ACPI_WRITE) { ++ switch (address) { ++ case 0: ++ return AE_OK; ++ case 1: ++ opregion->ctx.addr |= (*value64 & 0xff) << 8; ++ return AE_OK; ++ case 2: ++ opregion->ctx.addr |= *value64 & 0xff; ++ return AE_OK; ++ case 3: ++ opregion->ctx.val = *value64 & 0xff; ++ return AE_OK; ++ case 4: ++ if (*value64) { ++ result = regmap_write(opregion->regmap, opregion->ctx.addr, ++ opregion->ctx.val); ++ } else { ++ result = regmap_read(opregion->regmap, opregion->ctx.addr, ++ &opregion->ctx.val); ++ } ++ opregion->ctx.addr = 0; ++ } ++ } + +- switch (address) { +- case 0: +- return AE_OK; +- case 1: +- opregion->ctx.addr |= (*value64 & 0xff) << 8; ++ if (function == ACPI_READ && address == 3) { ++ *value64 = opregion->ctx.val; + return AE_OK; +- case 2: +- opregion->ctx.addr |= *value64 & 0xff; +- return AE_OK; +- case 3: +- opregion->ctx.val = *value64 & 0xff; +- return AE_OK; +- case 4: +- if (*value64) { +- result = regmap_write(opregion->regmap, opregion->ctx.addr, +- opregion->ctx.val); +- } else { +- result = regmap_read(opregion->regmap, opregion->ctx.addr, +- &opregion->ctx.val); +- if (result == 0) +- *value64 = opregion->ctx.val; +- } +- memset(&opregion->ctx, 0x00, sizeof(opregion->ctx)); + } + + if (result < 0) { diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c index 2237d3f24f0e..8242e16f57c6 100644 --- a/drivers/acpi/processor_idle.c @@ -22490,7 +26904,7 @@ index 25f02f5fe0fd..ec2f77a47150 100644 /* Non win8 machines which need native backlight nevertheless */ { diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c -index 93888ccb4e26..5bc8d588d146 100644 +index 93888ccb4e26..22bf8133fd2a 100644 --- a/drivers/amba/bus.c +++ b/drivers/amba/bus.c @@ -280,10 +280,11 @@ static int amba_remove(struct device *dev) @@ -22537,24 +26951,83 @@ index 93888ccb4e26..5bc8d588d146 100644 return driver_register(&drv->drv); } +@@ -352,9 +356,6 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent) + void __iomem *tmp; + int i, ret; + +- WARN_ON(dev->irq[0] == (unsigned int)-1); +- WARN_ON(dev->irq[1] == (unsigned int)-1); +- + ret = request_resource(parent, &dev->res); + if (ret) + goto err_out; diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 51bef2482149..14351aeddcd2 100644 +index 51bef2482149..0d8e3de1c662 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c -@@ -3116,6 +3116,12 @@ static void binder_transaction(struct binder_proc *proc, +@@ -503,6 +503,9 @@ struct binder_priority { + * @files files_struct for process + * (protected by @files_lock) + * @files_lock mutex to protect @files ++ * @cred struct cred associated with the `struct file` ++ * in binder_open() ++ * (invariant after initialized) + * @deferred_work_node: element for binder_deferred_list + * (protected by binder_deferred_lock) + * @deferred_work: bitmap of deferred work to perform +@@ -550,6 +553,7 @@ struct binder_proc { + struct task_struct *tsk; + struct files_struct *files; + struct mutex files_lock; ++ const struct cred *cred; + struct hlist_node deferred_work_node; + int deferred_work; + bool is_dead; +@@ -2581,7 +2585,7 @@ static int binder_translate_binder(struct flat_binder_object *fp, + ret = -EINVAL; + goto done; + } +- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) { ++ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { + ret = -EPERM; + goto done; + } +@@ -2627,7 +2631,7 @@ static int binder_translate_handle(struct flat_binder_object *fp, + proc->pid, thread->pid, fp->handle); + return -EINVAL; + } +- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) { ++ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { + ret = -EPERM; + goto done; + } +@@ -2711,7 +2715,7 @@ static int binder_translate_fd(int fd, + ret = -EBADF; + goto err_fget; + } +- ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file); ++ ret = security_binder_transfer_file(proc->cred, target_proc->cred, file); + if (ret < 0) { + ret = -EPERM; + goto err_security; +@@ -3116,8 +3120,14 @@ static void binder_transaction(struct binder_proc *proc, goto err_dead_binder; } e->to_node = target_node->debug_id; +- if (security_binder_transaction(proc->tsk, +- target_proc->tsk) < 0) { + if (WARN_ON(proc == target_proc)) { + return_error = BR_FAILED_REPLY; + return_error_param = -EINVAL; + return_error_line = __LINE__; + goto err_invalid_target_handle; + } - if (security_binder_transaction(proc->tsk, - target_proc->tsk) < 0) { ++ if (security_binder_transaction(proc->cred, ++ target_proc->cred) < 0) { return_error = BR_FAILED_REPLY; -@@ -3694,10 +3700,17 @@ static int binder_thread_write(struct binder_proc *proc, + return_error_param = -EPERM; + return_error_line = __LINE__; +@@ -3694,10 +3704,17 @@ static int binder_thread_write(struct binder_proc *proc, struct binder_node *ctx_mgr_node; mutex_lock(&context->context_mgr_node_lock); ctx_mgr_node = context->binder_context_mgr_node; @@ -22573,7 +27046,7 @@ index 51bef2482149..14351aeddcd2 100644 mutex_unlock(&context->context_mgr_node_lock); } if (ret) -@@ -4293,7 +4306,7 @@ static int binder_thread_read(struct binder_proc *proc, +@@ -4293,7 +4310,7 @@ static int binder_thread_read(struct binder_proc *proc, e->cmd = BR_OK; ptr += sizeof(uint32_t); @@ -22582,6 +27055,64 @@ index 51bef2482149..14351aeddcd2 100644 } break; case BINDER_WORK_TRANSACTION_COMPLETE: { binder_inner_proc_unlock(proc); +@@ -4685,6 +4702,7 @@ static void binder_free_proc(struct binder_proc *proc) + BUG_ON(!list_empty(&proc->delivered_death)); + binder_alloc_deferred_release(&proc->alloc); + put_task_struct(proc->tsk); ++ put_cred(proc->cred); + binder_stats_deleted(BINDER_STAT_PROC); + kfree(proc); + } +@@ -4756,23 +4774,20 @@ static int binder_thread_release(struct binder_proc *proc, + } + + /* +- * If this thread used poll, make sure we remove the waitqueue +- * from any epoll data structures holding it with POLLFREE. +- * waitqueue_active() is safe to use here because we're holding +- * the inner lock. ++ * If this thread used poll, make sure we remove the waitqueue from any ++ * poll data structures holding it. + */ +- if ((thread->looper & BINDER_LOOPER_STATE_POLL) && +- waitqueue_active(&thread->wait)) { +- wake_up_poll(&thread->wait, POLLHUP | POLLFREE); +- } ++ if (thread->looper & BINDER_LOOPER_STATE_POLL) ++ wake_up_pollfree(&thread->wait); + + binder_inner_proc_unlock(thread->proc); + + /* +- * This is needed to avoid races between wake_up_poll() above and +- * and ep_remove_waitqueue() called for other reasons (eg the epoll file +- * descriptor being closed); ep_remove_waitqueue() holds an RCU read +- * lock, so we can be sure it's done after calling synchronize_rcu(). ++ * This is needed to avoid races between wake_up_pollfree() above and ++ * someone else removing the last entry from the queue for other reasons ++ * (e.g. ep_remove_wait_queue() being called due to an epoll file ++ * descriptor being closed). Such other users hold an RCU read lock, so ++ * we can be sure they're done after we call synchronize_rcu(). + */ + if (thread->looper & BINDER_LOOPER_STATE_POLL) + synchronize_rcu(); +@@ -4890,7 +4905,7 @@ static int binder_ioctl_set_ctx_mgr(struct file *filp, + ret = -EBUSY; + goto out; + } +- ret = security_binder_set_context_mgr(proc->tsk); ++ ret = security_binder_set_context_mgr(proc->cred); + if (ret < 0) + goto out; + if (uid_valid(context->binder_context_mgr_uid)) { +@@ -5212,6 +5227,7 @@ static int binder_open(struct inode *nodp, struct file *filp) + get_task_struct(current->group_leader); + proc->tsk = current->group_leader; + mutex_init(&proc->files_lock); ++ proc->cred = get_cred(filp->f_cred); + INIT_LIST_HEAD(&proc->todo); + if (binder_supported_policy(current->policy)) { + proc->default_priority.sched_policy = current->policy; diff --git a/drivers/ata/acard-ahci.c b/drivers/ata/acard-ahci.c index ed6a30cd681a..98581ae397c1 100644 --- a/drivers/ata/acard-ahci.c @@ -22730,7 +27261,7 @@ index 0b80502bc1c5..bfa2e5eec263 100644 hpriv->irq = irq; diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index ba0cffbd0bb6..228a4cfb0e7d 100644 +index ba0cffbd0bb6..a92cbe1aa72a 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -57,7 +57,6 @@ @@ -22741,7 +27272,56 @@ index ba0cffbd0bb6..228a4cfb0e7d 100644 #include #include #include -@@ -4372,9 +4371,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { +@@ -2158,6 +2157,25 @@ static void ata_dev_config_ncq_non_data(struct ata_device *dev) + } + } + ++static bool ata_dev_check_adapter(struct ata_device *dev, ++ unsigned short vendor_id) ++{ ++ struct pci_dev *pcidev = NULL; ++ struct device *parent_dev = NULL; ++ ++ for (parent_dev = dev->tdev.parent; parent_dev != NULL; ++ parent_dev = parent_dev->parent) { ++ if (dev_is_pci(parent_dev)) { ++ pcidev = to_pci_dev(parent_dev); ++ if (pcidev->vendor == vendor_id) ++ return true; ++ break; ++ } ++ } ++ ++ return false; ++} ++ + static int ata_dev_config_ncq(struct ata_device *dev, + char *desc, size_t desc_sz) + { +@@ -2174,6 +2192,13 @@ static int ata_dev_config_ncq(struct ata_device *dev, + snprintf(desc, desc_sz, "NCQ (not used)"); + return 0; + } ++ ++ if (dev->horkage & ATA_HORKAGE_NO_NCQ_ON_ATI && ++ ata_dev_check_adapter(dev, PCI_VENDOR_ID_ATI)) { ++ snprintf(desc, desc_sz, "NCQ (not used)"); ++ return 0; ++ } ++ + if (ap->flags & ATA_FLAG_NCQ) { + hdepth = min(ap->scsi_host->can_queue, ATA_MAX_QUEUE - 1); + dev->flags |= ATA_DFLAG_NCQ; +@@ -4307,6 +4332,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "VRFDFC22048UCHC-TE*", NULL, ATA_HORKAGE_NODMA }, + /* Odd clown on sil3726/4726 PMPs */ + { "Config Disk", NULL, ATA_HORKAGE_DISABLE }, ++ /* Similar story with ASMedia 1092 */ ++ { "ASMT109x- Config", NULL, ATA_HORKAGE_DISABLE }, + + /* Weird ATAPI devices */ + { "TORiSAN DVD-ROM DRD-N216", NULL, ATA_HORKAGE_MAX_SEC_128 }, +@@ -4372,9 +4399,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */ { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, }, @@ -22753,7 +27333,20 @@ index ba0cffbd0bb6..228a4cfb0e7d 100644 /* devices which puke on READ_NATIVE_MAX */ { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, }, -@@ -4897,7 +4895,10 @@ int ata_std_qc_defer(struct ata_queued_cmd *qc) +@@ -4449,6 +4475,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Samsung SSD 860*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NO_NCQ_ON_ATI, }, ++ { "Samsung SSD 870*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NO_NCQ_ON_ATI, }, + { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + +@@ -4897,7 +4929,10 @@ int ata_std_qc_defer(struct ata_queued_cmd *qc) return ATA_DEFER_LINK; } @@ -22765,7 +27358,7 @@ index ba0cffbd0bb6..228a4cfb0e7d 100644 /** * ata_sg_init - Associate command with scatter-gather table. -@@ -5315,7 +5316,9 @@ void ata_qc_issue(struct ata_queued_cmd *qc) +@@ -5315,7 +5350,9 @@ void ata_qc_issue(struct ata_queued_cmd *qc) return; } @@ -22776,7 +27369,16 @@ index ba0cffbd0bb6..228a4cfb0e7d 100644 trace_ata_qc_issue(qc); qc->err_mask |= ap->ops->qc_issue(qc); if (unlikely(qc->err_mask)) -@@ -6410,7 +6413,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht) +@@ -6210,7 +6247,7 @@ int ata_host_start(struct ata_host *host) + have_stop = 1; + } + +- if (host->ops->host_stop) ++ if (host->ops && host->ops->host_stop) + have_stop = 1; + + if (have_stop) { +@@ -6410,7 +6447,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht) /* perform each probe asynchronously */ for (i = 0; i < host->n_ports; i++) { struct ata_port *ap = host->ports[i]; @@ -22785,7 +27387,7 @@ index ba0cffbd0bb6..228a4cfb0e7d 100644 } return 0; -@@ -6550,11 +6553,11 @@ void ata_host_detach(struct ata_host *host) +@@ -6550,11 +6587,11 @@ void ata_host_detach(struct ata_host *host) { int i; @@ -22801,6 +27403,41 @@ index ba0cffbd0bb6..228a4cfb0e7d 100644 /* the host is dead now, dissociate ACPI */ ata_acpi_dissociate(host); +@@ -6727,6 +6764,8 @@ static int __init ata_parse_force_one(char **cur, + { "ncq", .horkage_off = ATA_HORKAGE_NONCQ }, + { "noncqtrim", .horkage_on = ATA_HORKAGE_NO_NCQ_TRIM }, + { "ncqtrim", .horkage_off = ATA_HORKAGE_NO_NCQ_TRIM }, ++ { "noncqati", .horkage_on = ATA_HORKAGE_NO_NCQ_ON_ATI }, ++ { "ncqati", .horkage_off = ATA_HORKAGE_NO_NCQ_ON_ATI }, + { "dump_id", .horkage_on = ATA_HORKAGE_DUMP_ID }, + { "pio0", .xfer_mask = 1 << (ATA_SHIFT_PIO + 0) }, + { "pio1", .xfer_mask = 1 << (ATA_SHIFT_PIO + 1) }, +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 16f8fda89981..07f96a032149 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -114,6 +114,12 @@ static const unsigned long ata_eh_identify_timeouts[] = { + ULONG_MAX, + }; + ++static const unsigned long ata_eh_revalidate_timeouts[] = { ++ 15000, /* Some drives are slow to read log pages when waking-up */ ++ 15000, /* combined time till here is enough even for media access */ ++ ULONG_MAX, ++}; ++ + static const unsigned long ata_eh_flush_timeouts[] = { + 15000, /* be generous with flush */ + 15000, /* ditto */ +@@ -150,6 +156,8 @@ static const struct ata_eh_cmd_timeout_ent + ata_eh_cmd_timeout_table[ATA_EH_CMD_TIMEOUT_TABLE_SIZE] = { + { .commands = CMDS(ATA_CMD_ID_ATA, ATA_CMD_ID_ATAPI), + .timeouts = ata_eh_identify_timeouts, }, ++ { .commands = CMDS(ATA_CMD_READ_LOG_EXT, ATA_CMD_READ_LOG_DMA_EXT), ++ .timeouts = ata_eh_revalidate_timeouts, }, + { .commands = CMDS(ATA_CMD_READ_NATIVE_MAX, ATA_CMD_READ_NATIVE_MAX_EXT), + .timeouts = ata_eh_other_timeouts, }, + { .commands = CMDS(ATA_CMD_SET_MAX, ATA_CMD_SET_MAX_EXT), diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index c4f2b563c9f0..76ba83e245c2 100644 --- a/drivers/ata/libata-scsi.c @@ -22956,6 +27593,30 @@ index abda44183512..fb8d1f68f36f 100644 /* Setup expansion bus chip selects */ *data->cs0_cfg = data->cs0_bits; +diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c +index bce2a8ca4678..55fcdb798002 100644 +--- a/drivers/ata/pata_legacy.c ++++ b/drivers/ata/pata_legacy.c +@@ -328,7 +328,8 @@ static unsigned int pdc_data_xfer_vlb(struct ata_device *dev, + iowrite32_rep(ap->ioaddr.data_addr, buf, buflen >> 2); + + if (unlikely(slop)) { +- __le32 pad; ++ __le32 pad = 0; ++ + if (rw == READ) { + pad = cpu_to_le32(ioread32(ap->ioaddr.data_addr)); + memcpy(buf + buflen - slop, &pad, slop); +@@ -716,7 +717,8 @@ static unsigned int vlb32_data_xfer(struct ata_device *adev, unsigned char *buf, + ioread32_rep(ap->ioaddr.data_addr, buf, buflen >> 2); + + if (unlikely(slop)) { +- __le32 pad; ++ __le32 pad = 0; ++ + if (rw == WRITE) { + memcpy(&pad, buf + buflen - slop, slop); + iowrite32(le32_to_cpu(pad), ap->ioaddr.data_addr); diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c index e347e7acd8ed..d8000bbd1e11 100644 --- a/drivers/ata/pata_macio.c @@ -23098,8 +27759,41 @@ index 64d682c6ee57..11da13bea2c9 100644 } static inline void adma_packet_start(struct ata_queued_cmd *qc) +diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c +index e0939bd5ea73..6797871f8bc6 100644 +--- a/drivers/ata/sata_dwc_460ex.c ++++ b/drivers/ata/sata_dwc_460ex.c +@@ -1253,24 +1253,20 @@ static int sata_dwc_probe(struct platform_device *ofdev) + irq = irq_of_parse_and_map(np, 0); + if (irq == NO_IRQ) { + dev_err(&ofdev->dev, "no SATA DMA irq\n"); +- err = -ENODEV; +- goto error_out; ++ return -ENODEV; + } + + #ifdef CONFIG_SATA_DWC_OLD_DMA + if (!of_find_property(np, "dmas", NULL)) { + err = sata_dwc_dma_init_old(ofdev, hsdev); + if (err) +- goto error_out; ++ return err; + } + #endif + + hsdev->phy = devm_phy_optional_get(hsdev->dev, "sata-phy"); +- if (IS_ERR(hsdev->phy)) { +- err = PTR_ERR(hsdev->phy); +- hsdev->phy = NULL; +- goto error_out; +- } ++ if (IS_ERR(hsdev->phy)) ++ return PTR_ERR(hsdev->phy); + + err = phy_init(hsdev->phy); + if (err) diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c -index a723ae929783..100b5a3621ef 100644 +index a723ae929783..6d2e54209ae6 100644 --- a/drivers/ata/sata_fsl.c +++ b/drivers/ata/sata_fsl.c @@ -513,7 +513,7 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc, @@ -23120,6 +27814,54 @@ index a723ae929783..100b5a3621ef 100644 } static unsigned int sata_fsl_qc_issue(struct ata_queued_cmd *qc) +@@ -1404,6 +1406,14 @@ static int sata_fsl_init_controller(struct ata_host *host) + return 0; + } + ++static void sata_fsl_host_stop(struct ata_host *host) ++{ ++ struct sata_fsl_host_priv *host_priv = host->private_data; ++ ++ iounmap(host_priv->hcr_base); ++ kfree(host_priv); ++} ++ + /* + * scsi mid-layer and libata interface structures + */ +@@ -1436,6 +1446,8 @@ static struct ata_port_operations sata_fsl_ops = { + .port_start = sata_fsl_port_start, + .port_stop = sata_fsl_port_stop, + ++ .host_stop = sata_fsl_host_stop, ++ + .pmp_attach = sata_fsl_pmp_attach, + .pmp_detach = sata_fsl_pmp_detach, + }; +@@ -1490,9 +1502,9 @@ static int sata_fsl_probe(struct platform_device *ofdev) + host_priv->ssr_base = ssr_base; + host_priv->csr_base = csr_base; + +- irq = irq_of_parse_and_map(ofdev->dev.of_node, 0); +- if (!irq) { +- dev_err(&ofdev->dev, "invalid irq from platform\n"); ++ irq = platform_get_irq(ofdev, 0); ++ if (irq < 0) { ++ retval = irq; + goto error_exit_with_cleanup; + } + host_priv->irq = irq; +@@ -1569,10 +1581,6 @@ static int sata_fsl_remove(struct platform_device *ofdev) + + ata_host_detach(host); + +- irq_dispose_mapping(host_priv->irq); +- iounmap(host_priv->hcr_base); +- kfree(host_priv); +- + return 0; + } + diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c index aafb8cc03523..13f339f07f2a 100644 --- a/drivers/ata/sata_highbank.c @@ -23162,7 +27904,7 @@ index e81a8217f1ff..349a175f0267 100644 static unsigned int inic_qc_issue(struct ata_queued_cmd *qc) diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c -index 2f32782cea6d..ded3a66049d2 100644 +index 2f32782cea6d..6007ebb80f88 100644 --- a/drivers/ata/sata_mv.c +++ b/drivers/ata/sata_mv.c @@ -605,8 +605,8 @@ static int mv5_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val) @@ -23265,6 +28007,17 @@ index 2f32782cea6d..ded3a66049d2 100644 } /** +@@ -3905,8 +3907,8 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx) + break; + + default: +- dev_err(host->dev, "BUG: invalid board index %u\n", board_idx); +- return 1; ++ dev_alert(host->dev, "BUG: invalid board index %u\n", board_idx); ++ return -EINVAL; + } + + hpriv->hp_flags = hp_flags; @@ -4110,6 +4112,10 @@ static int mv_platform_probe(struct platform_device *pdev) n_ports = mv_platform_data->n_ports; irq = platform_get_irq(pdev, 0); @@ -23758,11 +28511,40 @@ index 5120a96b3a89..b2f4e8df1591 100644 return -ENOMEM; spin_lock_init(&PRIV(dev)->lock); memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats)); +diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c +index 6e8eaa7fe7a6..b5f849d2f762 100644 +--- a/drivers/auxdisplay/img-ascii-lcd.c ++++ b/drivers/auxdisplay/img-ascii-lcd.c +@@ -283,6 +283,16 @@ static int img_ascii_lcd_display(struct img_ascii_lcd_ctx *ctx, + if (msg[count - 1] == '\n') + count--; + ++ if (!count) { ++ /* clear the LCD */ ++ devm_kfree(&ctx->pdev->dev, ctx->message); ++ ctx->message = NULL; ++ ctx->message_len = 0; ++ memset(ctx->curr, ' ', ctx->cfg->num_chars); ++ ctx->cfg->update(ctx); ++ return 0; ++ } ++ + new_msg = devm_kmalloc(&ctx->pdev->dev, count + 1, GFP_KERNEL); + if (!new_msg) + return -ENOMEM; diff --git a/drivers/base/core.c b/drivers/base/core.c -index ee783abc1c96..94f23dd7e2d9 100644 +index ee783abc1c96..5192521a9c33 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c -@@ -2302,9 +2302,10 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode) +@@ -715,6 +715,7 @@ void device_initialize(struct device *dev) + device_pm_init(dev); + set_dev_node(dev, -1); + #ifdef CONFIG_GENERIC_MSI_IRQ ++ raw_spin_lock_init(&dev->msi_lock); + INIT_LIST_HEAD(&dev->msi_list); + #endif + } +@@ -2302,9 +2303,10 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode) */ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) { @@ -23775,7 +28557,7 @@ index ee783abc1c96..94f23dd7e2d9 100644 if (fwnode_is_primary(fn)) fn = fn->secondary; -@@ -2314,8 +2315,13 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) +@@ -2314,8 +2316,13 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) } dev->fwnode = fwnode; } else { @@ -23855,6 +28637,68 @@ index 76373148385c..79d7d7b44809 100644 if (pm_wakeup_pending()) { pm_get_active_wakeup_sources(suspend_abort, +diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c +index feba1b211898..8c05e7a5e777 100644 +--- a/drivers/base/power/wakeirq.c ++++ b/drivers/base/power/wakeirq.c +@@ -319,8 +319,13 @@ void dev_pm_arm_wake_irq(struct wake_irq *wirq) + if (!wirq) + return; + +- if (device_may_wakeup(wirq->dev)) ++ if (device_may_wakeup(wirq->dev)) { ++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED && ++ !pm_runtime_status_suspended(wirq->dev)) ++ enable_irq(wirq->irq); ++ + enable_irq_wake(wirq->irq); ++ } + } + + /** +@@ -335,6 +340,11 @@ void dev_pm_disarm_wake_irq(struct wake_irq *wirq) + if (!wirq) + return; + +- if (device_may_wakeup(wirq->dev)) ++ if (device_may_wakeup(wirq->dev)) { + disable_irq_wake(wirq->irq); ++ ++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED && ++ !pm_runtime_status_suspended(wirq->dev)) ++ disable_irq_nosync(wirq->irq); ++ } + } +diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c +index b11af3f2c1db..c0fdbb392758 100644 +--- a/drivers/base/regmap/regcache-rbtree.c ++++ b/drivers/base/regmap/regcache-rbtree.c +@@ -296,14 +296,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, + if (!blk) + return -ENOMEM; + ++ rbnode->block = blk; ++ + if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { + present = krealloc(rbnode->cache_present, + BITS_TO_LONGS(blklen) * sizeof(*present), + GFP_KERNEL); +- if (!present) { +- kfree(blk); ++ if (!present) + return -ENOMEM; +- } + + memset(present + BITS_TO_LONGS(rbnode->blklen), 0, + (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen)) +@@ -320,7 +320,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, + } + + /* update the rbnode block, its size and the base register */ +- rbnode->block = blk; + rbnode->blklen = blklen; + rbnode->base_reg = base_reg; + rbnode->cache_present = present; diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c index 1559070d6060..05bc4c1b1d61 100644 --- a/drivers/base/regmap/regmap-debugfs.c @@ -23880,7 +28724,7 @@ index 1559070d6060..05bc4c1b1d61 100644 if (!buf) return -ENOMEM; diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c -index fcb76ca848d3..35e780db86a5 100644 +index fcb76ca848d3..3e3ca0495fff 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -1239,7 +1239,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data) @@ -23892,10 +28736,71 @@ index fcb76ca848d3..35e780db86a5 100644 else return 1; } +@@ -1375,7 +1375,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg, + if (ret) { + dev_err(map->dev, + "Error in caching of register: %x ret: %d\n", +- reg + i, ret); ++ reg + regmap_get_offset(map, i), ret); + return ret; + } + } +diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c +index 38688236b3cd..be551f01f7f0 100644 +--- a/drivers/bcma/main.c ++++ b/drivers/bcma/main.c +@@ -239,6 +239,7 @@ EXPORT_SYMBOL(bcma_core_irq); + + void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core) + { ++ device_initialize(&core->dev); + core->dev.release = bcma_release_core_dev; + core->dev.bus = &bcma_bus_type; + dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index); +@@ -302,11 +303,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core) + { + int err; + +- err = device_register(&core->dev); ++ err = device_add(&core->dev); + if (err) { + bcma_err(bus, "Could not register dev for core 0x%03X\n", + core->id.id); +- put_device(&core->dev); + return; + } + core->dev_registered = true; +@@ -397,7 +397,7 @@ void bcma_unregister_cores(struct bcma_bus *bus) + /* Now noone uses internally-handled cores, we can free them */ + list_for_each_entry_safe(core, tmp, &bus->cores, list) { + list_del(&core->list); +- kfree(core); ++ put_device(&core->dev); + } + } + diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig -index 64d95c9514a0..d3b789814155 100644 +index 64d95c9514a0..b74733686da1 100644 --- a/drivers/block/Kconfig +++ b/drivers/block/Kconfig +@@ -257,7 +257,7 @@ config BLK_DEV_LOOP_MIN_COUNT + dynamically allocated with the /dev/loop-control interface. + + config BLK_DEV_CRYPTOLOOP +- tristate "Cryptoloop Support" ++ tristate "Cryptoloop Support (DEPRECATED)" + select CRYPTO + select CRYPTO_CBC + depends on BLK_DEV_LOOP +@@ -269,7 +269,7 @@ config BLK_DEV_CRYPTOLOOP + WARNING: This device is not safe for journaled file systems like + ext3 or Reiserfs. Please use the Device Mapper crypto module + instead, which can be configured to be on-disk compatible with the +- cryptoloop device. ++ cryptoloop device. cryptoloop support will be removed in Linux 5.16. + + source "drivers/block/drbd/Kconfig" + @@ -530,6 +530,7 @@ config BLK_DEV_RBD config BLK_DEV_RSXX tristate "IBM Flash Adapter 900GB Full Height PCIe Device Driver" @@ -23916,6 +28821,19 @@ index 7e35574a17df..9d81ac8b4512 100644 #define PAGE_SECTORS_SHIFT (PAGE_SHIFT - SECTOR_SHIFT) #define PAGE_SECTORS (1 << PAGE_SECTORS_SHIFT) +diff --git a/drivers/block/cryptoloop.c b/drivers/block/cryptoloop.c +index 3d31761c0ed0..adbfd3e2a60f 100644 +--- a/drivers/block/cryptoloop.c ++++ b/drivers/block/cryptoloop.c +@@ -203,6 +203,8 @@ init_cryptoloop(void) + + if (rc) + printk(KERN_ERR "cryptoloop: loop_register_transfer failed\n"); ++ else ++ pr_warn("the cryptoloop driver has been deprecated and will be removed in in Linux 5.16\n"); + return rc; + } + diff --git a/drivers/block/drbd/drbd_bitmap.c b/drivers/block/drbd/drbd_bitmap.c index ab62b81c2ca7..dece26f119d4 100644 --- a/drivers/block/drbd/drbd_bitmap.c @@ -23929,48 +28847,8 @@ index ab62b81c2ca7..dece26f119d4 100644 }; if (!get_ldev_if_state(device, D_ATTACHING)) { /* put is in drbd_bm_aio_ctx_destroy() */ -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index 4496e7a49235..64a3dae5381e 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -4067,21 +4067,22 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) - if (UFDCS->rawcmd == 1) - UFDCS->rawcmd = 2; - -- if (!(mode & FMODE_NDELAY)) { -- if (mode & (FMODE_READ|FMODE_WRITE)) { -- UDRS->last_checked = 0; -- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -- check_disk_change(bdev); -- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -- goto out; -- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) -- goto out; -- } -- res = -EROFS; -- if ((mode & FMODE_WRITE) && -- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) -+ if (mode & (FMODE_READ|FMODE_WRITE)) { -+ UDRS->last_checked = 0; -+ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -+ check_disk_change(bdev); -+ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -+ goto out; -+ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) - goto out; - } -+ -+ res = -EROFS; -+ -+ if ((mode & FMODE_WRITE) && -+ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) -+ goto out; -+ - mutex_unlock(&open_lock); - mutex_unlock(&floppy_mutex); - return 0; diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index eb5f703b00df..8ceaec2613f0 100644 +index eb5f703b00df..4ce4961e3659 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -222,24 +222,35 @@ static void __loop_update_dio(struct loop_device *lo, bool dio) @@ -24150,31 +29028,29 @@ index eb5f703b00df..8ceaec2613f0 100644 if (!file) goto out; -@@ -915,37 +1027,42 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, +@@ -915,37 +1027,40 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, mapping = file->f_mapping; inode = mapping->host; - if (!(file->f_mode & FMODE_WRITE) || !(mode & FMODE_WRITE) || - !file->f_op->write_iter) - lo_flags |= LO_FLAGS_READ_ONLY; -+ size = get_loop_size(lo, file); - -- lo_blocksize = S_ISBLK(inode->i_mode) ? -- inode->i_bdev->bd_block_size : PAGE_SIZE; + if ((config->info.lo_flags & ~LOOP_CONFIGURE_SETTABLE_FLAGS) != 0) { + error = -EINVAL; + goto out_putf; + } -- error = -EFBIG; -- size = get_loop_size(lo, file); -- if ((loff_t)(sector_t)size != size) +- lo_blocksize = S_ISBLK(inode->i_mode) ? +- inode->i_bdev->bd_block_size : PAGE_SIZE; + if (config->block_size) { + error = loop_validate_block_size(config->block_size); + if (error) + goto out_putf; + } -+ + +- error = -EFBIG; +- size = get_loop_size(lo, file); +- if ((loff_t)(sector_t)size != size) + error = loop_set_status_from_info(lo, &config->info); + if (error) goto out_putf; @@ -24209,7 +29085,7 @@ index eb5f703b00df..8ceaec2613f0 100644 blk_queue_write_cache(lo->lo_queue, true, false); if (io_is_direct(lo->lo_backing_file) && inode->i_sb->s_bdev) { -@@ -957,13 +1074,17 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, +@@ -957,13 +1072,19 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, } loop_update_dio(lo); @@ -24218,9 +29094,11 @@ index eb5f703b00df..8ceaec2613f0 100644 loop_sysfs_init(lo); - /* let user-space know about the new size */ - kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); -+ loop_set_size(lo, size); - set_blocksize(bdev, lo_blocksize); ++ size = get_loop_size(lo, file); ++ loop_set_size(lo, size); ++ + if (config->block_size) + bsize = config->block_size; + else @@ -24806,6 +29684,308 @@ index 1d1f86657967..27c9d7a5b4de 100644 "%s/%s", dev->nodename, "physical-device"); if (err) goto fail; +diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c +index 6ee3e928ebf1..d420597b0d2b 100644 +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -78,6 +78,7 @@ enum blkif_state { + BLKIF_STATE_DISCONNECTED, + BLKIF_STATE_CONNECTED, + BLKIF_STATE_SUSPENDED, ++ BLKIF_STATE_ERROR, + }; + + struct grant { +@@ -87,6 +88,7 @@ struct grant { + }; + + enum blk_req_status { ++ REQ_PROCESSING, + REQ_WAITING, + REQ_DONE, + REQ_ERROR, +@@ -529,10 +531,10 @@ static unsigned long blkif_ring_get_request(struct blkfront_ring_info *rinfo, + + id = get_id_from_freelist(rinfo); + rinfo->shadow[id].request = req; +- rinfo->shadow[id].status = REQ_WAITING; ++ rinfo->shadow[id].status = REQ_PROCESSING; + rinfo->shadow[id].associated_id = NO_ASSOCIATED_ID; + +- (*ring_req)->u.rw.id = id; ++ rinfo->shadow[id].req.u.rw.id = id; + + return id; + } +@@ -540,11 +542,12 @@ static unsigned long blkif_ring_get_request(struct blkfront_ring_info *rinfo, + static int blkif_queue_discard_req(struct request *req, struct blkfront_ring_info *rinfo) + { + struct blkfront_info *info = rinfo->dev_info; +- struct blkif_request *ring_req; ++ struct blkif_request *ring_req, *final_ring_req; + unsigned long id; + + /* Fill out a communications ring structure. */ +- id = blkif_ring_get_request(rinfo, req, &ring_req); ++ id = blkif_ring_get_request(rinfo, req, &final_ring_req); ++ ring_req = &rinfo->shadow[id].req; + + ring_req->operation = BLKIF_OP_DISCARD; + ring_req->u.discard.nr_sectors = blk_rq_sectors(req); +@@ -555,8 +558,9 @@ static int blkif_queue_discard_req(struct request *req, struct blkfront_ring_inf + else + ring_req->u.discard.flag = 0; + +- /* Keep a private copy so we can reissue requests when recovering. */ +- rinfo->shadow[id].req = *ring_req; ++ /* Copy the request to the ring page. */ ++ *final_ring_req = *ring_req; ++ rinfo->shadow[id].status = REQ_WAITING; + + return 0; + } +@@ -689,6 +693,7 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri + { + struct blkfront_info *info = rinfo->dev_info; + struct blkif_request *ring_req, *extra_ring_req = NULL; ++ struct blkif_request *final_ring_req, *final_extra_ring_req = NULL; + unsigned long id, extra_id = NO_ASSOCIATED_ID; + bool require_extra_req = false; + int i; +@@ -730,7 +735,8 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri + } + + /* Fill out a communications ring structure. */ +- id = blkif_ring_get_request(rinfo, req, &ring_req); ++ id = blkif_ring_get_request(rinfo, req, &final_ring_req); ++ ring_req = &rinfo->shadow[id].req; + + num_sg = blk_rq_map_sg(req->q, req, rinfo->shadow[id].sg); + num_grant = 0; +@@ -781,7 +787,9 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri + ring_req->u.rw.nr_segments = num_grant; + if (unlikely(require_extra_req)) { + extra_id = blkif_ring_get_request(rinfo, req, +- &extra_ring_req); ++ &final_extra_ring_req); ++ extra_ring_req = &rinfo->shadow[extra_id].req; ++ + /* + * Only the first request contains the scatter-gather + * list. +@@ -823,10 +831,13 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri + if (setup.segments) + kunmap_atomic(setup.segments); + +- /* Keep a private copy so we can reissue requests when recovering. */ +- rinfo->shadow[id].req = *ring_req; +- if (unlikely(require_extra_req)) +- rinfo->shadow[extra_id].req = *extra_ring_req; ++ /* Copy request(s) to the ring page. */ ++ *final_ring_req = *ring_req; ++ rinfo->shadow[id].status = REQ_WAITING; ++ if (unlikely(require_extra_req)) { ++ *final_extra_ring_req = *extra_ring_req; ++ rinfo->shadow[extra_id].status = REQ_WAITING; ++ } + + if (max_grefs > 0) + gnttab_free_grant_references(setup.gref_head); +@@ -1396,8 +1407,8 @@ static enum blk_req_status blkif_rsp_to_req_status(int rsp) + static int blkif_get_final_status(enum blk_req_status s1, + enum blk_req_status s2) + { +- BUG_ON(s1 == REQ_WAITING); +- BUG_ON(s2 == REQ_WAITING); ++ BUG_ON(s1 < REQ_DONE); ++ BUG_ON(s2 < REQ_DONE); + + if (s1 == REQ_ERROR || s2 == REQ_ERROR) + return BLKIF_RSP_ERROR; +@@ -1430,7 +1441,7 @@ static bool blkif_completion(unsigned long *id, + s->status = blkif_rsp_to_req_status(bret->status); + + /* Wait the second response if not yet here. */ +- if (s2->status == REQ_WAITING) ++ if (s2->status < REQ_DONE) + return 0; + + bret->status = blkif_get_final_status(s->status, +@@ -1538,62 +1549,89 @@ static bool blkif_completion(unsigned long *id, + static irqreturn_t blkif_interrupt(int irq, void *dev_id) + { + struct request *req; +- struct blkif_response *bret; ++ struct blkif_response bret; + RING_IDX i, rp; + unsigned long flags; + struct blkfront_ring_info *rinfo = (struct blkfront_ring_info *)dev_id; + struct blkfront_info *info = rinfo->dev_info; + int error; ++ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS; + +- if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) ++ if (unlikely(info->connected != BLKIF_STATE_CONNECTED)) { ++ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS); + return IRQ_HANDLED; ++ } + + spin_lock_irqsave(&rinfo->ring_lock, flags); + again: +- rp = rinfo->ring.sring->rsp_prod; +- rmb(); /* Ensure we see queued responses up to 'rp'. */ ++ rp = READ_ONCE(rinfo->ring.sring->rsp_prod); ++ virt_rmb(); /* Ensure we see queued responses up to 'rp'. */ ++ if (RING_RESPONSE_PROD_OVERFLOW(&rinfo->ring, rp)) { ++ pr_alert("%s: illegal number of responses %u\n", ++ info->gd->disk_name, rp - rinfo->ring.rsp_cons); ++ goto err; ++ } + + for (i = rinfo->ring.rsp_cons; i != rp; i++) { + unsigned long id; ++ unsigned int op; ++ ++ eoiflag = 0; ++ ++ RING_COPY_RESPONSE(&rinfo->ring, i, &bret); ++ id = bret.id; + +- bret = RING_GET_RESPONSE(&rinfo->ring, i); +- id = bret->id; + /* + * The backend has messed up and given us an id that we would + * never have given to it (we stamp it up to BLK_RING_SIZE - + * look in get_id_from_freelist. + */ + if (id >= BLK_RING_SIZE(info)) { +- WARN(1, "%s: response to %s has incorrect id (%ld)\n", +- info->gd->disk_name, op_name(bret->operation), id); +- /* We can't safely get the 'struct request' as +- * the id is busted. */ +- continue; ++ pr_alert("%s: response has incorrect id (%ld)\n", ++ info->gd->disk_name, id); ++ goto err; + } ++ if (rinfo->shadow[id].status != REQ_WAITING) { ++ pr_alert("%s: response references no pending request\n", ++ info->gd->disk_name); ++ goto err; ++ } ++ ++ rinfo->shadow[id].status = REQ_PROCESSING; + req = rinfo->shadow[id].request; + +- if (bret->operation != BLKIF_OP_DISCARD) { ++ op = rinfo->shadow[id].req.operation; ++ if (op == BLKIF_OP_INDIRECT) ++ op = rinfo->shadow[id].req.u.indirect.indirect_op; ++ if (bret.operation != op) { ++ pr_alert("%s: response has wrong operation (%u instead of %u)\n", ++ info->gd->disk_name, bret.operation, op); ++ goto err; ++ } ++ ++ if (bret.operation != BLKIF_OP_DISCARD) { + /* + * We may need to wait for an extra response if the + * I/O request is split in 2 + */ +- if (!blkif_completion(&id, rinfo, bret)) ++ if (!blkif_completion(&id, rinfo, &bret)) + continue; + } + + if (add_id_to_freelist(rinfo, id)) { + WARN(1, "%s: response to %s (id %ld) couldn't be recycled!\n", +- info->gd->disk_name, op_name(bret->operation), id); ++ info->gd->disk_name, op_name(bret.operation), id); + continue; + } + +- error = (bret->status == BLKIF_RSP_OKAY) ? 0 : -EIO; +- switch (bret->operation) { ++ error = (bret.status == BLKIF_RSP_OKAY) ? 0 : -EIO; ++ switch (bret.operation) { + case BLKIF_OP_DISCARD: +- if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) { ++ if (unlikely(bret.status == BLKIF_RSP_EOPNOTSUPP)) { + struct request_queue *rq = info->rq; +- printk(KERN_WARNING "blkfront: %s: %s op failed\n", +- info->gd->disk_name, op_name(bret->operation)); ++ ++ pr_warn_ratelimited("blkfront: %s: %s op failed\n", ++ info->gd->disk_name, op_name(bret.operation)); + error = -EOPNOTSUPP; + info->feature_discard = 0; + info->feature_secdiscard = 0; +@@ -1604,15 +1642,15 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) + break; + case BLKIF_OP_FLUSH_DISKCACHE: + case BLKIF_OP_WRITE_BARRIER: +- if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) { +- printk(KERN_WARNING "blkfront: %s: %s op failed\n", +- info->gd->disk_name, op_name(bret->operation)); ++ if (unlikely(bret.status == BLKIF_RSP_EOPNOTSUPP)) { ++ pr_warn_ratelimited("blkfront: %s: %s op failed\n", ++ info->gd->disk_name, op_name(bret.operation)); + error = -EOPNOTSUPP; + } +- if (unlikely(bret->status == BLKIF_RSP_ERROR && ++ if (unlikely(bret.status == BLKIF_RSP_ERROR && + rinfo->shadow[id].req.u.rw.nr_segments == 0)) { +- printk(KERN_WARNING "blkfront: %s: empty %s op failed\n", +- info->gd->disk_name, op_name(bret->operation)); ++ pr_warn_ratelimited("blkfront: %s: empty %s op failed\n", ++ info->gd->disk_name, op_name(bret.operation)); + error = -EOPNOTSUPP; + } + if (unlikely(error)) { +@@ -1625,9 +1663,10 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) + /* fall through */ + case BLKIF_OP_READ: + case BLKIF_OP_WRITE: +- if (unlikely(bret->status != BLKIF_RSP_OKAY)) +- dev_dbg(&info->xbdev->dev, "Bad return from blkdev data " +- "request: %x\n", bret->status); ++ if (unlikely(bret.status != BLKIF_RSP_OKAY)) ++ dev_dbg_ratelimited(&info->xbdev->dev, ++ "Bad return from blkdev data request: %#x\n", ++ bret.status); + + blk_mq_complete_request(req, error); + break; +@@ -1650,6 +1689,18 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) + + spin_unlock_irqrestore(&rinfo->ring_lock, flags); + ++ xen_irq_lateeoi(irq, eoiflag); ++ ++ return IRQ_HANDLED; ++ ++ err: ++ info->connected = BLKIF_STATE_ERROR; ++ ++ spin_unlock_irqrestore(&rinfo->ring_lock, flags); ++ ++ /* No EOI in order to avoid further interrupts. */ ++ ++ pr_alert("%s disabled for further use\n", info->gd->disk_name); + return IRQ_HANDLED; + } + +@@ -1688,8 +1739,8 @@ static int setup_blkring(struct xenbus_device *dev, + if (err) + goto fail; + +- err = bind_evtchn_to_irqhandler(rinfo->evtchn, blkif_interrupt, 0, +- "blkif", rinfo); ++ err = bind_evtchn_to_irqhandler_lateeoi(rinfo->evtchn, blkif_interrupt, ++ 0, "blkif", rinfo); + if (err <= 0) { + xenbus_dev_fatal(dev, err, + "bind_evtchn_to_irqhandler failed"); diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 853b63108346..63802dc228fe 100644 --- a/drivers/block/zram/zram_drv.c @@ -25194,6 +30374,37 @@ index a7cc5b7be598..667882e996ec 100644 if (intel_private.i9xx_flush_page) writel(1, intel_private.i9xx_flush_page); } +diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c +index 15f2e7025b78..1d5510cb6db4 100644 +--- a/drivers/char/agp/parisc-agp.c ++++ b/drivers/char/agp/parisc-agp.c +@@ -285,7 +285,7 @@ agp_ioc_init(void __iomem *ioc_regs) + return 0; + } + +-static int ++static int __init + lba_find_capability(int cap) + { + struct _parisc_agp_info *info = &parisc_agp_info; +@@ -370,7 +370,7 @@ parisc_agp_setup(void __iomem *ioc_hpa, void __iomem *lba_hpa) + return error; + } + +-static int ++static int __init + find_quicksilver(struct device *dev, void *data) + { + struct parisc_device **lba = data; +@@ -382,7 +382,7 @@ find_quicksilver(struct device *dev, void *data) + return 0; + } + +-static int ++static int __init + parisc_agp_init(void) + { + extern struct sba_device *sba_list; diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index ba07d791c5b9..cb9f4e46607e 100644 --- a/drivers/char/diag/diag_dci.c @@ -26371,6 +31582,18 @@ index 612d65ede10a..5370514959e1 100644 static int armada_3700_xtal_clock_probe(struct platform_device *pdev) { +diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c +index 890ebf623261..38612cd9092e 100644 +--- a/drivers/clk/mvebu/kirkwood.c ++++ b/drivers/clk/mvebu/kirkwood.c +@@ -254,6 +254,7 @@ static const char *powersave_parents[] = { + static const struct clk_muxing_soc_desc kirkwood_mux_desc[] __initconst = { + { "powersave", powersave_parents, ARRAY_SIZE(powersave_parents), + 11, 1, 0 }, ++ { } + }; + + static struct clk *clk_muxing_get_src( diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c index 8dd71345b5d0..55430c8f1bc2 100644 --- a/drivers/clk/qcom/gcc-msm8916.c @@ -26844,6 +32067,20 @@ index 1ee3674a99bb..3bd816cf4a7d 100644 cpumask_clear(policy->cpus); cpumask_set_cpu(cpu, policy->cpus); cpumask_copy(data->freqdomain_cpus, +diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c +index 52841f807a7e..45fdf30cade3 100644 +--- a/drivers/cpufreq/cpufreq_governor_attr_set.c ++++ b/drivers/cpufreq/cpufreq_governor_attr_set.c +@@ -77,8 +77,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l + if (count) + return count; + +- kobject_put(&attr_set->kobj); + mutex_destroy(&attr_set->update_lock); ++ kobject_put(&attr_set->kobj); + return 0; + } + EXPORT_SYMBOL_GPL(gov_attr_set_put); diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c index 1608f7105c9f..ad743f2f31e7 100644 --- a/drivers/cpufreq/highbank-cpufreq.c @@ -27011,36 +32248,45 @@ index b366e6d830ea..c7f0b2df15cd 100644 MODULE_AUTHOR("Ajitpal Singh "); MODULE_AUTHOR("Lee Jones "); diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c -index 9e98a5fbbc1d..e7e92ed34f0c 100644 +index 9e98a5fbbc1d..34c4a61a954f 100644 --- a/drivers/cpuidle/sysfs.c +++ b/drivers/cpuidle/sysfs.c -@@ -412,7 +412,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device) +@@ -412,6 +412,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device) ret = kobject_init_and_add(&kobj->kobj, &ktype_state_cpuidle, &kdev->kobj, "state%d", i); if (ret) { -- kfree(kobj); + kobject_put(&kobj->kobj); + kfree(kobj); goto error_state; } - kobject_uevent(&kobj->kobj, KOBJ_ADD); -@@ -542,7 +542,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev) +@@ -542,6 +543,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev) ret = kobject_init_and_add(&kdrv->kobj, &ktype_driver_cpuidle, &kdev->kobj, "driver"); if (ret) { -- kfree(kdrv); + kobject_put(&kdrv->kobj); + kfree(kdrv); return ret; } +@@ -629,17 +631,18 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev) + if (!kdev) + return -ENOMEM; + kdev->dev = dev; +- dev->kobj_dev = kdev; + + init_completion(&kdev->kobj_unregister); -@@ -636,7 +636,7 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev) error = kobject_init_and_add(&kdev->kobj, &ktype_cpuidle, &cpu_dev->kobj, "cpuidle"); if (error) { -- kfree(kdev); + kobject_put(&kdev->kobj); + kfree(kdev); return error; } ++ dev->kobj_dev = kdev; + kobject_uevent(&kdev->kobj, KOBJ_ADD); + + return 0; diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h index cfe21d033745..56c8c9ba12bc 100644 --- a/drivers/crypto/ccp/ccp-dev.h @@ -27208,6 +32454,179 @@ index b54af97a20bb..81b61e256f7c 100644 crypt_virt, crypt_phys); } return; +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index 34839b539207..0e14a6642de4 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -167,15 +167,19 @@ static struct dcp *global_sdcp; + + static int mxs_dcp_start_dma(struct dcp_async_ctx *actx) + { ++ int dma_err; + struct dcp *sdcp = global_sdcp; + const int chan = actx->chan; + uint32_t stat; + unsigned long ret; + struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; +- + dma_addr_t desc_phys = dma_map_single(sdcp->dev, desc, sizeof(*desc), + DMA_TO_DEVICE); + ++ dma_err = dma_mapping_error(sdcp->dev, desc_phys); ++ if (dma_err) ++ return dma_err; ++ + reinit_completion(&sdcp->completion[chan]); + + /* Clear status register. */ +@@ -213,18 +217,29 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx) + static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, + struct ablkcipher_request *req, int init) + { ++ dma_addr_t key_phys, src_phys, dst_phys; + struct dcp *sdcp = global_sdcp; + struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; + struct dcp_aes_req_ctx *rctx = ablkcipher_request_ctx(req); + int ret; + +- dma_addr_t key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key, +- 2 * AES_KEYSIZE_128, +- DMA_TO_DEVICE); +- dma_addr_t src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf, +- DCP_BUF_SZ, DMA_TO_DEVICE); +- dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf, +- DCP_BUF_SZ, DMA_FROM_DEVICE); ++ key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key, ++ 2 * AES_KEYSIZE_128, DMA_TO_DEVICE); ++ ret = dma_mapping_error(sdcp->dev, key_phys); ++ if (ret) ++ return ret; ++ ++ src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf, ++ DCP_BUF_SZ, DMA_TO_DEVICE); ++ ret = dma_mapping_error(sdcp->dev, src_phys); ++ if (ret) ++ goto err_src; ++ ++ dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf, ++ DCP_BUF_SZ, DMA_FROM_DEVICE); ++ ret = dma_mapping_error(sdcp->dev, dst_phys); ++ if (ret) ++ goto err_dst; + + if (actx->fill % AES_BLOCK_SIZE) { + dev_err(sdcp->dev, "Invalid block size!\n"); +@@ -262,10 +277,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, + ret = mxs_dcp_start_dma(actx); + + aes_done_run: ++ dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE); ++err_dst: ++ dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE); ++err_src: + dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128, + DMA_TO_DEVICE); +- dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE); +- dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE); + + return ret; + } +@@ -280,21 +297,20 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + + struct scatterlist *dst = req->dst; + struct scatterlist *src = req->src; +- const int nents = sg_nents(req->src); ++ int dst_nents = sg_nents(dst); + + const int out_off = DCP_BUF_SZ; + uint8_t *in_buf = sdcp->coh->aes_in_buf; + uint8_t *out_buf = sdcp->coh->aes_out_buf; + +- uint8_t *out_tmp, *src_buf, *dst_buf = NULL; + uint32_t dst_off = 0; ++ uint8_t *src_buf = NULL; + uint32_t last_out_len = 0; + + uint8_t *key = sdcp->coh->aes_key; + + int ret = 0; +- int split = 0; +- unsigned int i, len, clen, rem = 0, tlen = 0; ++ unsigned int i, len, clen, tlen = 0; + int init = 0; + bool limit_hit = false; + +@@ -312,7 +328,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128); + } + +- for_each_sg(req->src, src, nents, i) { ++ for_each_sg(req->src, src, sg_nents(src), i) { + src_buf = sg_virt(src); + len = sg_dma_len(src); + tlen += len; +@@ -337,34 +353,17 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + * submit the buffer. + */ + if (actx->fill == out_off || sg_is_last(src) || +- limit_hit) { ++ limit_hit) { + ret = mxs_dcp_run_aes(actx, req, init); + if (ret) + return ret; + init = 0; + +- out_tmp = out_buf; ++ sg_pcopy_from_buffer(dst, dst_nents, out_buf, ++ actx->fill, dst_off); ++ dst_off += actx->fill; + last_out_len = actx->fill; +- while (dst && actx->fill) { +- if (!split) { +- dst_buf = sg_virt(dst); +- dst_off = 0; +- } +- rem = min(sg_dma_len(dst) - dst_off, +- actx->fill); +- +- memcpy(dst_buf + dst_off, out_tmp, rem); +- out_tmp += rem; +- dst_off += rem; +- actx->fill -= rem; +- +- if (dst_off == sg_dma_len(dst)) { +- dst = sg_next(dst); +- split = 0; +- } else { +- split = 1; +- } +- } ++ actx->fill = 0; + } + } while (len); + +@@ -565,6 +564,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req) + dma_addr_t buf_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_in_buf, + DCP_BUF_SZ, DMA_TO_DEVICE); + ++ ret = dma_mapping_error(sdcp->dev, buf_phys); ++ if (ret) ++ return ret; ++ + /* Fill in the DMA descriptor. */ + desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE | + MXS_DCP_CONTROL0_INTERRUPT | +@@ -597,6 +600,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req) + if (rctx->fini) { + digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf, + DCP_SHA_PAY_SZ, DMA_FROM_DEVICE); ++ ret = dma_mapping_error(sdcp->dev, digest_phys); ++ if (ret) ++ goto done_run; ++ + desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM; + desc->payload = digest_phys; + } diff --git a/drivers/crypto/nx/nx-842-pseries.c b/drivers/crypto/nx/nx-842-pseries.c index cddc6d8b55d9..1b8c87770645 100644 --- a/drivers/crypto/nx/nx-842-pseries.c @@ -27269,7 +32688,7 @@ index fe32dd95ae4f..a2d5ba0a0d5a 100644 err_res: dd = NULL; diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c -index ff6ac4e824b5..4adcf89add25 100644 +index ff6ac4e824b5..801ae958b0ad 100644 --- a/drivers/crypto/omap-sham.c +++ b/drivers/crypto/omap-sham.c @@ -167,8 +167,6 @@ struct omap_sham_hmac_ctx { @@ -27390,6 +32809,15 @@ index ff6ac4e824b5..4adcf89add25 100644 memcpy(bctx->opad, bctx->ipad, bs); for (i = 0; i < bs; i++) { +@@ -1750,7 +1745,7 @@ static void omap_sham_done_task(unsigned long data) + if (test_and_clear_bit(FLAGS_OUTPUT_READY, &dd->flags)) + goto finish; + } else if (test_bit(FLAGS_DMA_READY, &dd->flags)) { +- if (test_and_clear_bit(FLAGS_DMA_ACTIVE, &dd->flags)) { ++ if (test_bit(FLAGS_DMA_ACTIVE, &dd->flags)) { + omap_sham_update_dma_stop(dd); + if (dd->err) { + err = dd->err; @@ -2072,6 +2067,7 @@ static int omap_sham_probe(struct platform_device *pdev) } @@ -27421,6 +32849,23 @@ index ff6ac4e824b5..4adcf89add25 100644 tasklet_kill(&dd->done_task); pm_runtime_disable(&pdev->dev); +diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c +index d2d0ae445fd8..7c7d49a8a403 100644 +--- a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c ++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c +@@ -123,10 +123,10 @@ void adf_init_hw_data_c3xxxiov(struct adf_hw_device_data *hw_data) + hw_data->enable_error_correction = adf_vf_void_noop; + hw_data->init_admin_comms = adf_vf_int_noop; + hw_data->exit_admin_comms = adf_vf_void_noop; +- hw_data->send_admin_init = adf_vf2pf_init; ++ hw_data->send_admin_init = adf_vf2pf_notify_init; + hw_data->init_arb = adf_vf_int_noop; + hw_data->exit_arb = adf_vf_void_noop; +- hw_data->disable_iov = adf_vf2pf_shutdown; ++ hw_data->disable_iov = adf_vf2pf_notify_shutdown; + hw_data->get_accel_mask = get_accel_mask; + hw_data->get_ae_mask = get_ae_mask; + hw_data->get_num_accels = get_num_accels; diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c index 0dd8d2dc2ec1..26931325dfa2 100644 --- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c @@ -27440,6 +32885,23 @@ index 0dd8d2dc2ec1..26931325dfa2 100644 ret = adf_dev_start(accel_dev); if (ret) goto out_err_dev_stop; +diff --git a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c +index 38e4bc04f407..90e8a7564756 100644 +--- a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c ++++ b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c +@@ -123,10 +123,10 @@ void adf_init_hw_data_c62xiov(struct adf_hw_device_data *hw_data) + hw_data->enable_error_correction = adf_vf_void_noop; + hw_data->init_admin_comms = adf_vf_int_noop; + hw_data->exit_admin_comms = adf_vf_void_noop; +- hw_data->send_admin_init = adf_vf2pf_init; ++ hw_data->send_admin_init = adf_vf2pf_notify_init; + hw_data->init_arb = adf_vf_int_noop; + hw_data->exit_arb = adf_vf_void_noop; +- hw_data->disable_iov = adf_vf2pf_shutdown; ++ hw_data->disable_iov = adf_vf2pf_notify_shutdown; + hw_data->get_accel_mask = get_accel_mask; + hw_data->get_ae_mask = get_ae_mask; + hw_data->get_num_accels = get_num_accels; diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c index cd9e63468b18..722a06aac9fa 100644 --- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c @@ -27459,11 +32921,93 @@ index cd9e63468b18..722a06aac9fa 100644 ret = adf_dev_start(accel_dev); if (ret) goto out_err_dev_stop; +diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h +index 0d596a99f564..88c8831503e4 100644 +--- a/drivers/crypto/qat/qat_common/adf_common_drv.h ++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h +@@ -239,8 +239,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev, + void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev); + void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev); + +-int adf_vf2pf_init(struct adf_accel_dev *accel_dev); +-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev); ++int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev); ++void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev); + int adf_init_pf_wq(void); + void adf_exit_pf_wq(void); + int adf_init_vf_wq(void); +@@ -263,12 +263,12 @@ static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev) + { + } + +-static inline int adf_vf2pf_init(struct adf_accel_dev *accel_dev) ++static inline int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev) + { + return 0; + } + +-static inline void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev) ++static inline void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev) + { + } + +diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c +index 888c6675e7e5..03856cc604b6 100644 +--- a/drivers/crypto/qat/qat_common/adf_init.c ++++ b/drivers/crypto/qat/qat_common/adf_init.c +@@ -101,6 +101,7 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) + struct service_hndl *service; + struct list_head *list_itr; + struct adf_hw_device_data *hw_data = accel_dev->hw_device; ++ int ret; + + if (!hw_data) { + dev_err(&GET_DEV(accel_dev), +@@ -167,9 +168,9 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) + } + + hw_data->enable_error_correction(accel_dev); +- hw_data->enable_vf2pf_comms(accel_dev); ++ ret = hw_data->enable_vf2pf_comms(accel_dev); + +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(adf_dev_init); + diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c -index 06d49017a52b..2c0be14309cf 100644 +index 06d49017a52b..7877ba677220 100644 --- a/drivers/crypto/qat/qat_common/adf_isr.c +++ b/drivers/crypto/qat/qat_common/adf_isr.c -@@ -330,19 +330,32 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev) +@@ -59,6 +59,8 @@ + #include "adf_transport_access_macros.h" + #include "adf_transport_internal.h" + ++#define ADF_MAX_NUM_VFS 32 ++ + static int adf_enable_msix(struct adf_accel_dev *accel_dev) + { + struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev; +@@ -111,7 +113,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr) + struct adf_bar *pmisc = + &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)]; + void __iomem *pmisc_bar_addr = pmisc->virt_addr; +- u32 vf_mask; ++ unsigned long vf_mask; + + /* Get the interrupt sources triggered by VFs */ + vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) & +@@ -132,8 +134,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr) + * unless the VF is malicious and is attempting to + * flood the host OS with VF2PF interrupts. + */ +- for_each_set_bit(i, (const unsigned long *)&vf_mask, +- (sizeof(vf_mask) * BITS_PER_BYTE)) { ++ for_each_set_bit(i, &vf_mask, ADF_MAX_NUM_VFS) { + vf_info = accel_dev->pf.vf_info + i; + + if (!__ratelimit(&vf_info->vf2pf_ratelimit)) { +@@ -330,19 +331,32 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev) ret = adf_isr_alloc_msix_entry_table(accel_dev); if (ret) @@ -27504,6 +33048,61 @@ index 06d49017a52b..2c0be14309cf 100644 + return ret; } EXPORT_SYMBOL_GPL(adf_isr_resource_alloc); +diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +index b3875fdf6cd7..180016e15777 100644 +--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c ++++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +@@ -195,6 +195,13 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr) + val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset); + } while ((val & int_bit) && (count++ < ADF_IOV_MSG_ACK_MAX_RETRY)); + ++ if (val != msg) { ++ dev_dbg(&GET_DEV(accel_dev), ++ "Collision - PFVF CSR overwritten by remote function\n"); ++ ret = -EIO; ++ goto out; ++ } ++ + if (val & int_bit) { + dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n"); + val &= ~int_bit; +@@ -231,7 +238,6 @@ int adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr) + + return ret; + } +-EXPORT_SYMBOL_GPL(adf_iov_putmsg); + + void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info) + { +@@ -244,6 +250,11 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info) + + /* Read message from the VF */ + msg = ADF_CSR_RD(pmisc_addr, hw_data->get_pf2vf_offset(vf_nr)); ++ if (!(msg & ADF_VF2PF_INT)) { ++ dev_info(&GET_DEV(accel_dev), ++ "Spurious VF2PF interrupt, msg %X. Ignored\n", msg); ++ goto out; ++ } + + /* To ACK, clear the VF2PFINT bit */ + msg &= ~ADF_VF2PF_INT; +@@ -327,6 +338,7 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info) + if (resp && adf_iov_putmsg(accel_dev, resp, vf_nr)) + dev_err(&GET_DEV(accel_dev), "Failed to send response to VF\n"); + ++out: + /* re-enable interrupt on PF from this VF */ + adf_enable_vf2pf_interrupts(accel_dev, (1 << vf_nr)); + return; +@@ -361,6 +373,8 @@ static int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev) + msg |= ADF_PFVF_COMPATIBILITY_VERSION << ADF_VF2PF_COMPAT_VER_REQ_SHIFT; + BUILD_BUG_ON(ADF_PFVF_COMPATIBILITY_VERSION > 255); + ++ reinit_completion(&accel_dev->vf.iov_msg_completion); ++ + /* Send request from VF to PF */ + ret = adf_iov_putmsg(accel_dev, msg, 0); + if (ret) { diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c index 57d2622728a5..4c0067f8c079 100644 --- a/drivers/crypto/qat/qat_common/adf_transport.c @@ -27516,11 +33115,109 @@ index 57d2622728a5..4c0067f8c079 100644 return -EFAULT; } +diff --git a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c +index cd5f37dffe8a..1830194567e8 100644 +--- a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c ++++ b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c +@@ -49,14 +49,14 @@ + #include "adf_pf2vf_msg.h" + + /** +- * adf_vf2pf_init() - send init msg to PF ++ * adf_vf2pf_notify_init() - send init msg to PF + * @accel_dev: Pointer to acceleration VF device. + * + * Function sends an init messge from the VF to a PF + * + * Return: 0 on success, error code otherwise. + */ +-int adf_vf2pf_init(struct adf_accel_dev *accel_dev) ++int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev) + { + u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | + (ADF_VF2PF_MSGTYPE_INIT << ADF_VF2PF_MSGTYPE_SHIFT)); +@@ -69,17 +69,17 @@ int adf_vf2pf_init(struct adf_accel_dev *accel_dev) + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); + return 0; + } +-EXPORT_SYMBOL_GPL(adf_vf2pf_init); ++EXPORT_SYMBOL_GPL(adf_vf2pf_notify_init); + + /** +- * adf_vf2pf_shutdown() - send shutdown msg to PF ++ * adf_vf2pf_notify_shutdown() - send shutdown msg to PF + * @accel_dev: Pointer to acceleration VF device. + * + * Function sends a shutdown messge from the VF to a PF + * + * Return: void + */ +-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev) ++void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev) + { + u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | + (ADF_VF2PF_MSGTYPE_SHUTDOWN << ADF_VF2PF_MSGTYPE_SHIFT)); +@@ -89,4 +89,4 @@ void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev) + dev_err(&GET_DEV(accel_dev), + "Failed to send Shutdown event to PF\n"); + } +-EXPORT_SYMBOL_GPL(adf_vf2pf_shutdown); ++EXPORT_SYMBOL_GPL(adf_vf2pf_notify_shutdown); diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c -index bf99e11a3403..4c1217ba83ae 100644 +index bf99e11a3403..6fa1447d0582 100644 --- a/drivers/crypto/qat/qat_common/adf_vf_isr.c +++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c -@@ -304,17 +304,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev) +@@ -123,6 +123,11 @@ static void adf_pf2vf_bh_handler(void *data) + + /* Read the message from PF */ + msg = ADF_CSR_RD(pmisc_bar_addr, hw_data->get_pf2vf_offset(0)); ++ if (!(msg & ADF_PF2VF_INT)) { ++ dev_info(&GET_DEV(accel_dev), ++ "Spurious PF2VF interrupt, msg %X. Ignored\n", msg); ++ goto out; ++ } + + if (!(msg & ADF_PF2VF_MSGORIGIN_SYSTEM)) + /* Ignore legacy non-system (non-kernel) PF2VF messages */ +@@ -171,6 +176,7 @@ static void adf_pf2vf_bh_handler(void *data) + msg &= ~BIT(0); + ADF_CSR_WR(pmisc_bar_addr, hw_data->get_pf2vf_offset(0), msg); + ++out: + /* Re-enable PF2VF interrupts */ + adf_enable_pf2vf_interrupts(accel_dev); + return; +@@ -203,6 +209,7 @@ static irqreturn_t adf_isr(int irq, void *privdata) + struct adf_bar *pmisc = + &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)]; + void __iomem *pmisc_bar_addr = pmisc->virt_addr; ++ bool handled = false; + u32 v_int; + + /* Read VF INT source CSR to determine the source of VF interrupt */ +@@ -215,7 +222,7 @@ static irqreturn_t adf_isr(int irq, void *privdata) + + /* Schedule tasklet to handle interrupt BH */ + tasklet_hi_schedule(&accel_dev->vf.pf2vf_bh_tasklet); +- return IRQ_HANDLED; ++ handled = true; + } + + /* Check bundle interrupt */ +@@ -227,10 +234,10 @@ static irqreturn_t adf_isr(int irq, void *privdata) + WRITE_CSR_INT_FLAG_AND_COL(bank->csr_addr, bank->bank_number, + 0); + tasklet_hi_schedule(&bank->resp_handler); +- return IRQ_HANDLED; ++ handled = true; + } + +- return IRQ_NONE; ++ return handled ? IRQ_HANDLED : IRQ_NONE; + } + + static int adf_request_msi_irq(struct adf_accel_dev *accel_dev) +@@ -304,17 +311,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev) goto err_out; if (adf_setup_pf2vf_bh(accel_dev)) @@ -27636,6 +33333,23 @@ index e2454d90d949..a8e3191e5185 100644 static int qat_uclo_init_ae_memory(struct icp_qat_fw_loader_handle *handle, struct icp_qat_uof_initmem *init_mem) { +diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c +index a3b4dd8099a7..3a8361c83f0b 100644 +--- a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c ++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c +@@ -123,10 +123,10 @@ void adf_init_hw_data_dh895xcciov(struct adf_hw_device_data *hw_data) + hw_data->enable_error_correction = adf_vf_void_noop; + hw_data->init_admin_comms = adf_vf_int_noop; + hw_data->exit_admin_comms = adf_vf_void_noop; +- hw_data->send_admin_init = adf_vf2pf_init; ++ hw_data->send_admin_init = adf_vf2pf_notify_init; + hw_data->init_arb = adf_vf_int_noop; + hw_data->exit_arb = adf_vf_void_noop; +- hw_data->disable_iov = adf_vf2pf_shutdown; ++ hw_data->disable_iov = adf_vf2pf_notify_shutdown; + hw_data->get_accel_mask = get_accel_mask; + hw_data->get_ae_mask = get_ae_mask; + hw_data->get_num_accels = get_num_accels; diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c index 15de9cbed3bf..cc3f5171a523 100644 --- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c @@ -27656,7 +33370,7 @@ index 15de9cbed3bf..cc3f5171a523 100644 if (ret) goto out_err_dev_stop; diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c -index 8b383d3d21c2..f4a6be76468d 100644 +index 8b383d3d21c2..ef9515e9f213 100644 --- a/drivers/crypto/talitos.c +++ b/drivers/crypto/talitos.c @@ -447,7 +447,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE) @@ -27684,7 +33398,19 @@ index 8b383d3d21c2..f4a6be76468d 100644 switch (desc_hdr & DESC_HDR_SEL0_MASK) { case DESC_HDR_SEL0_AFEU: -@@ -2636,7 +2636,6 @@ static struct talitos_alg_template driver_algs[] = { +@@ -816,7 +816,11 @@ static void talitos_unregister_rng(struct device *dev) + * HMAC_SNOOP_NO_AFEA (HSNA) instead of type IPSEC_ESP + */ + #define TALITOS_CRA_PRIORITY_AEAD_HSNA (TALITOS_CRA_PRIORITY - 1) ++#ifdef CONFIG_CRYPTO_DEV_TALITOS2 + #define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA512_BLOCK_SIZE) ++#else ++#define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA256_BLOCK_SIZE) ++#endif + #define TALITOS_MAX_IV_LENGTH 16 /* max of AES_BLOCK_SIZE, DES3_EDE_BLOCK_SIZE */ + + struct talitos_ctx { +@@ -2636,7 +2640,6 @@ static struct talitos_alg_template driver_algs[] = { .cra_ablkcipher = { .min_keysize = AES_MIN_KEY_SIZE, .max_keysize = AES_MAX_KEY_SIZE, @@ -27692,7 +33418,7 @@ index 8b383d3d21c2..f4a6be76468d 100644 } }, .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU | -@@ -2670,6 +2669,7 @@ static struct talitos_alg_template driver_algs[] = { +@@ -2670,6 +2673,7 @@ static struct talitos_alg_template driver_algs[] = { .cra_ablkcipher = { .min_keysize = AES_MIN_KEY_SIZE, .max_keysize = AES_MAX_KEY_SIZE, @@ -27734,6 +33460,41 @@ index fe9dce0245bf..a20267d93f8a 100644 { 1200000, 750000 }, { 1100000, 600000 }, { 1000000, 500000 }, +diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig +index de06728a81b2..e783a467e468 100644 +--- a/drivers/dma/Kconfig ++++ b/drivers/dma/Kconfig +@@ -238,7 +238,7 @@ config INTEL_IDMA64 + + config INTEL_IOATDMA + tristate "Intel I/OAT DMA support" +- depends on PCI && X86_64 ++ depends on PCI && X86_64 && !UML + select DMA_ENGINE + select DMA_ENGINE_RAID + select DCA +diff --git a/drivers/dma/acpi-dma.c b/drivers/dma/acpi-dma.c +index 4a748c3435d7..02149742b334 100644 +--- a/drivers/dma/acpi-dma.c ++++ b/drivers/dma/acpi-dma.c +@@ -72,10 +72,14 @@ static int acpi_dma_parse_resource_group(const struct acpi_csrt_group *grp, + + si = (const struct acpi_csrt_shared_info *)&grp[1]; + +- /* Match device by MMIO and IRQ */ ++ /* Match device by MMIO */ + if (si->mmio_base_low != lower_32_bits(mem) || +- si->mmio_base_high != upper_32_bits(mem) || +- si->gsi_interrupt != irq) ++ si->mmio_base_high != upper_32_bits(mem)) ++ return 0; ++ ++ /* Match device by Linux vIRQ */ ++ ret = acpi_register_gsi(NULL, si->gsi_interrupt, si->interrupt_mode, si->interrupt_polarity); ++ if (ret != irq) + return 0; + + dev_dbg(&adev->dev, "matches with %.4s%04X (rev %u)\n", diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c index a32cd71f94bb..cb72b8c915c7 100644 --- a/drivers/dma/at_hdmac.c @@ -27747,6 +33508,19 @@ index a32cd71f94bb..cb72b8c915c7 100644 dma_cap_zero(mask); dma_cap_set(DMA_SLAVE, mask); +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index 12d904829324..a505be9ef96d 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -156,7 +156,7 @@ + #define AT_XDMAC_CC_WRIP (0x1 << 23) /* Write in Progress (read only) */ + #define AT_XDMAC_CC_WRIP_DONE (0x0 << 23) + #define AT_XDMAC_CC_WRIP_IN_PROGRESS (0x1 << 23) +-#define AT_XDMAC_CC_PERID(i) (0x7f & (i) << 24) /* Channel Peripheral Identifier */ ++#define AT_XDMAC_CC_PERID(i) ((0x7f & (i)) << 24) /* Channel Peripheral Identifier */ + #define AT_XDMAC_CDS_MSP 0x2C /* Channel Data Stride Memory Set Pattern */ + #define AT_XDMAC_CSUS 0x30 /* Channel Source Microblock Stride */ + #define AT_XDMAC_CDUS 0x34 /* Channel Destination Microblock Stride */ diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c index aca2d6fd92d5..e1b6787f0e68 100644 --- a/drivers/dma/dma-jz4780.c @@ -27774,6 +33548,19 @@ index aca2d6fd92d5..e1b6787f0e68 100644 spin_unlock_irqrestore(&jzchan->vchan.lock, flags); return status; } +diff --git a/drivers/dma/dmaengine.h b/drivers/dma/dmaengine.h +index 882ff9448c3b..6537b8ec0393 100644 +--- a/drivers/dma/dmaengine.h ++++ b/drivers/dma/dmaengine.h +@@ -167,7 +167,7 @@ dmaengine_desc_get_callback_invoke(struct dma_async_tx_descriptor *tx, + static inline bool + dmaengine_desc_callback_valid(struct dmaengine_desc_callback *cb) + { +- return (cb->callback) ? true : false; ++ return cb->callback || cb->callback_result; + } + + #endif diff --git a/drivers/dma/dw/Kconfig b/drivers/dma/dw/Kconfig index e00c9b022964..6ea3e95c287b 100644 --- a/drivers/dma/dw/Kconfig @@ -27880,12 +33667,22 @@ index a9bc1a15b0d1..b0152288983b 100644 struct ioatdma_device *ioat_dma; dma_addr_t completion_dma; diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c -index faae0bfe1109..757cf48c1c5e 100644 +index faae0bfe1109..441f37b41abd 100644 --- a/drivers/dma/of-dma.c +++ b/drivers/dma/of-dma.c -@@ -72,12 +72,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, +@@ -68,18 +68,23 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, return NULL; + ofdma_target = of_dma_find_controller(&dma_spec_target); +- if (!ofdma_target) +- return NULL; ++ if (!ofdma_target) { ++ ofdma->dma_router->route_free(ofdma->dma_router->dev, ++ route_data); ++ chan = ERR_PTR(-EPROBE_DEFER); ++ goto err; ++ } + chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target); - if (chan) { - chan->router = ofdma->dma_router; @@ -27899,7 +33696,10 @@ index faae0bfe1109..757cf48c1c5e 100644 + chan->route_data = route_data; } ++err: /* + * Need to put the node back since the ofdma->of_dma_route_allocate + * has taken it for generating the new, translated dma_spec diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c index 57b375d0de29..d8997dafb876 100644 --- a/drivers/dma/pl330.c @@ -27984,6 +33784,20 @@ index 82f36e466083..143ea7cad756 100644 platform_driver_register(&hidma_mgmt_driver); return 0; +diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c +index 6682b3eec2b6..ec15ded640f6 100644 +--- a/drivers/dma/sh/usb-dmac.c ++++ b/drivers/dma/sh/usb-dmac.c +@@ -861,8 +861,8 @@ static int usb_dmac_probe(struct platform_device *pdev) + + error: + of_dma_controller_free(pdev->dev.of_node); +- pm_runtime_put(&pdev->dev); + error_pm: ++ pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + return ret; + } diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c index 68b41daab3a8..bf7105814ee7 100644 --- a/drivers/dma/ste_dma40.c @@ -28037,7 +33851,7 @@ index c16c06b3dd2f..54296e262dea 100644 ret = tegra_adma_init(tdma); if (ret) diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c -index cd271f782605..f00652585ee3 100644 +index cd271f782605..d88c53ff7bb6 100644 --- a/drivers/dma/xilinx/xilinx_dma.c +++ b/drivers/dma/xilinx/xilinx_dma.c @@ -420,8 +420,8 @@ struct xilinx_dma_device { @@ -28060,6 +33874,15 @@ index cd271f782605..f00652585ee3 100644 if (of_device_is_compatible(node, "xlnx,axi-vdma-mm2s-channel") || of_device_is_compatible(node, "xlnx,axi-dma-mm2s-channel") || +@@ -2578,7 +2578,7 @@ static int xilinx_dma_probe(struct platform_device *pdev) + xdev->ext_addr = false; + + /* Set the dma mask bits */ +- dma_set_mask(xdev->dev, DMA_BIT_MASK(addr_width)); ++ dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width)); + + /* Initialize the DMA engine */ + xdev->common.dev = &pdev->dev; @@ -2630,7 +2630,11 @@ static int xilinx_dma_probe(struct platform_device *pdev) } @@ -28314,6 +34137,32 @@ index 1c88d9707495..3438b98e6094 100644 } module_init(ie31200_init); +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index e9391950a843..94194ead7363 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1009,7 +1009,7 @@ static u64 haswell_get_tohm(struct sbridge_pvt *pvt) + pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOHM_1, ®); + rc = ((reg << 6) | rc) << 26; + +- return rc | 0x1ffffff; ++ return rc | 0x3ffffff; + } + + static u64 knl_get_tolm(struct sbridge_pvt *pvt) +diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c +index fc153aea2f6c..091f03852dca 100644 +--- a/drivers/edac/synopsys_edac.c ++++ b/drivers/edac/synopsys_edac.c +@@ -371,7 +371,7 @@ static int synps_edac_init_csrows(struct mem_ctl_info *mci) + + for (j = 0; j < csi->nr_channels; j++) { + dimm = csi->channels[j]->dimm; +- dimm->edac_mode = EDAC_FLAG_SECDED; ++ dimm->edac_mode = EDAC_SECDED; + dimm->mtype = synps_edac_get_mtype(priv->baseaddr); + dimm->nr_pages = (size >> PAGE_SHIFT) / csi->nr_channels; + dimm->grain = SYNPS_EDAC_ERR_GRAIN; diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c index bc538708c753..cdee6d6d5453 100644 --- a/drivers/extcon/extcon-adc-jack.c @@ -28493,10 +34342,19 @@ index c981be17d3c0..8ebc6f8bf9b9 100644 config UEFI_CPER diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c -index c0e54396f250..dc8d2603612e 100644 +index c0e54396f250..91dbc6ae56cf 100644 --- a/drivers/firmware/efi/cper.c +++ b/drivers/firmware/efi/cper.c -@@ -257,8 +257,7 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg) +@@ -35,8 +35,6 @@ + + #define INDENT_SP " " + +-static char rcd_decode_str[CPER_REC_LEN]; +- + /* + * CPER record ID need to be unique even after reboot, because record + * ID is used as index for ERST storage, while CPER records from +@@ -257,8 +255,7 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg) if (!msg || !(mem->validation_bits & CPER_MEM_VALID_MODULE_HANDLE)) return 0; @@ -28506,7 +34364,7 @@ index c0e54396f250..dc8d2603612e 100644 dmi_memdev_name(mem->mem_dev_handle, &bank, &device); if (bank && device) n = snprintf(msg, len, "DIMM location: %s %s ", bank, device); -@@ -267,7 +266,6 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg) +@@ -267,7 +264,6 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg) "DIMM location: not present. DMI handle: 0x%.4x ", mem->mem_dev_handle); @@ -28514,6 +34372,22 @@ index c0e54396f250..dc8d2603612e 100644 return n; } +@@ -295,6 +291,7 @@ const char *cper_mem_err_unpack(struct trace_seq *p, + struct cper_mem_err_compact *cmem) + { + const char *ret = trace_seq_buffer_ptr(p); ++ char rcd_decode_str[CPER_REC_LEN]; + + if (cper_mem_err_location(cmem, rcd_decode_str)) + trace_seq_printf(p, "%s", rcd_decode_str); +@@ -309,6 +306,7 @@ static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem, + int len) + { + struct cper_mem_err_compact cmem; ++ char rcd_decode_str[CPER_REC_LEN]; + + /* Don't trust UEFI 2.1/2.2 structure with bad validation bits */ + if (len == sizeof(struct cper_sec_mem_err_old) && diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index d89457d62a24..6e6a590b8388 100644 --- a/drivers/firmware/efi/efi.c @@ -28572,6 +34446,19 @@ index 9faa09e7c31f..c2b991b9fa9e 100644 if (PAGE_SIZE > EFI_PAGE_SIZE && (!PAGE_ALIGNED(in->phys_addr) || !PAGE_ALIGNED(in->num_pages << EFI_PAGE_SHIFT))) { +diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c +index dd7f63354ca0..60a32440daff 100644 +--- a/drivers/firmware/efi/runtime-wrappers.c ++++ b/drivers/firmware/efi/runtime-wrappers.c +@@ -259,7 +259,7 @@ static void virt_efi_reset_system(int reset_type, + unsigned long data_size, + efi_char16_t *data) + { +- if (down_interruptible(&efi_runtime_lock)) { ++ if (down_trylock(&efi_runtime_lock)) { + pr_warn("failed to invoke the reset_system() runtime service:\n" + "could not get exclusive access to the firmware\n"); + return; diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c index 0e2011636fbb..595bf12e7653 100644 --- a/drivers/firmware/qemu_fw_cfg.c @@ -28595,6 +34482,34 @@ index 0e2011636fbb..595bf12e7653 100644 .attr = { .name = "rev", .mode = S_IRUSR }, .show = fw_cfg_showrev, }; +diff --git a/drivers/firmware/scpi_pm_domain.c b/drivers/firmware/scpi_pm_domain.c +index f395dec27113..a6e62a793fbe 100644 +--- a/drivers/firmware/scpi_pm_domain.c ++++ b/drivers/firmware/scpi_pm_domain.c +@@ -27,7 +27,6 @@ struct scpi_pm_domain { + struct generic_pm_domain genpd; + struct scpi_ops *ops; + u32 domain; +- char name[30]; + }; + + /* +@@ -121,8 +120,13 @@ static int scpi_pm_domain_probe(struct platform_device *pdev) + + scpi_pd->domain = i; + scpi_pd->ops = scpi_ops; +- sprintf(scpi_pd->name, "%s.%d", np->name, i); +- scpi_pd->genpd.name = scpi_pd->name; ++ scpi_pd->genpd.name = devm_kasprintf(dev, GFP_KERNEL, ++ "%s.%d", np->name, i); ++ if (!scpi_pd->genpd.name) { ++ dev_err(dev, "Failed to allocate genpd name:%s.%d\n", ++ np->name, i); ++ continue; ++ } + scpi_pd->genpd.power_off = scpi_pd_power_off; + scpi_pd->genpd.power_on = scpi_pd_power_on; + diff --git a/drivers/gpio/gpio-pcf857x.c b/drivers/gpio/gpio-pcf857x.c index d168410e2338..2e6081e5ad0b 100644 --- a/drivers/gpio/gpio-pcf857x.c @@ -28651,8 +34566,48 @@ index b863386be911..9e40914c0984 100644 return ERR_PTR(ret); } +diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig +index 78591eab134a..ff26805261bf 100644 +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -35,6 +35,13 @@ config DRM_DP_AUX_CHARDEV + read and write values to arbitrary DPCD registers on the DP aux + channel. + ++config DRM_CLIENT_BOOTSPLASH ++ bool "DRM Bootsplash" ++ help ++ Choose this option to enable DRM bootsplash. This option needs to be ++ selected only if UEFI bootsplash is disabled. Choosing this option ++ will render splash logo in display panel during boot up. ++ + config DRM_KMS_HELPER + tristate + depends on DRM +diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile +index 4a7766c18b82..a1fd7377ea2a 100644 +--- a/drivers/gpu/drm/Makefile ++++ b/drivers/gpu/drm/Makefile +@@ -15,7 +15,8 @@ drm-y := drm_auth.o drm_bufs.o drm_cache.o \ + drm_modeset_lock.o drm_atomic.o drm_bridge.o \ + drm_framebuffer.o drm_connector.o drm_blend.o \ + drm_encoder.o drm_mode_object.o drm_property.o \ +- drm_plane.o drm_color_mgmt.o ++ drm_plane.o drm_color_mgmt.o drm_client.o \ ++ drm_client_modeset.o + + drm-$(CONFIG_COMPAT) += drm_ioc32.o + drm-$(CONFIG_DRM_GEM_CMA_HELPER) += drm_gem_cma_helper.o +@@ -23,6 +24,7 @@ drm-$(CONFIG_PCI) += ati_pcigart.o + drm-$(CONFIG_DRM_PANEL) += drm_panel.o + drm-$(CONFIG_OF) += drm_of.o + drm-$(CONFIG_AGP) += drm_agpsupport.o ++drm-$(CONFIG_DRM_CLIENT_BOOTSPLASH) += drm_bootsplash.o + + drm_kms_helper-y := drm_crtc_helper.o drm_dp_helper.o drm_probe_helper.o \ + drm_plane_helper.o drm_dp_mst_topology.o drm_atomic_helper.o \ diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -index e9311eb7b8d9..694f631d9c90 100644 +index e9311eb7b8d9..eb79d0d3d34f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c @@ -734,8 +734,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) @@ -28667,7 +34622,15 @@ index e9311eb7b8d9..694f631d9c90 100644 } if (encoder) { -@@ -872,8 +874,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) +@@ -842,6 +844,7 @@ static int amdgpu_connector_vga_get_modes(struct drm_connector *connector) + + amdgpu_connector_get_edid(connector); + ret = amdgpu_connector_ddc_get_modes(connector); ++ amdgpu_get_native_mode(connector); + + return ret; + } +@@ -872,8 +875,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) if (!drm_kms_helper_is_poll_worker()) { r = pm_runtime_get_sync(connector->dev->dev); @@ -28679,7 +34642,7 @@ index e9311eb7b8d9..694f631d9c90 100644 } encoder = amdgpu_connector_best_single_encoder(connector); -@@ -996,8 +1000,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) +@@ -996,8 +1001,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) if (!drm_kms_helper_is_poll_worker()) { r = pm_runtime_get_sync(connector->dev->dev); @@ -28691,7 +34654,7 @@ index e9311eb7b8d9..694f631d9c90 100644 } if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { -@@ -1371,8 +1377,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) +@@ -1371,8 +1378,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) if (!drm_kms_helper_is_poll_worker()) { r = pm_runtime_get_sync(connector->dev->dev); @@ -28742,6 +34705,19 @@ index e0890deccb2f..7cae10fec78d 100644 pm_runtime_put_autosuspend(dev->dev); return ret; } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c +index 91d367399956..a334eb7dbff4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c +@@ -339,7 +339,7 @@ static void amdgpu_i2c_put_byte(struct amdgpu_i2c_chan *i2c_bus, + void + amdgpu_i2c_router_select_ddc_port(const struct amdgpu_connector *amdgpu_connector) + { +- u8 val; ++ u8 val = 0; + + if (!amdgpu_connector->router.ddc_valid) + return; diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c index 24941a7b659f..96fc1566f28e 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c @@ -28921,8 +34897,30 @@ index 8c6e47c5507f..74221e096855 100644 sys_props.kobj_nodes = kobject_create_and_add("nodes", sys_props.kobj_topology); +diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c +index f34b4e8455a6..0ed81dab3461 100644 +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -2421,7 +2421,7 @@ int __drm_atomic_helper_set_config(struct drm_mode_set *set, + primary_state->crtc_h = vdisplay; + primary_state->src_x = set->x << 16; + primary_state->src_y = set->y << 16; +- if (primary_state->rotation & (DRM_ROTATE_90 | DRM_ROTATE_270)) { ++ if (primary_state->rotation & (DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_270)) { + primary_state->src_w = vdisplay << 16; + primary_state->src_h = hdisplay << 16; + } else { +@@ -3106,7 +3106,7 @@ void drm_atomic_helper_plane_reset(struct drm_plane *plane) + + if (plane->state) { + plane->state->plane = plane; +- plane->state->rotation = DRM_ROTATE_0; ++ plane->state->rotation = DRM_MODE_ROTATE_0; + } + } + EXPORT_SYMBOL(drm_atomic_helper_plane_reset); diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c -index 56b2dd9a5b68..315d51ac14b8 100644 +index 56b2dd9a5b68..73ca66c8f198 100644 --- a/drivers/gpu/drm/drm_auth.c +++ b/drivers/gpu/drm/drm_auth.c @@ -244,9 +244,10 @@ int drm_master_open(struct drm_file *file_priv) @@ -28937,11 +34935,2139 @@ index 56b2dd9a5b68..315d51ac14b8 100644 if (file_priv->magic) idr_remove(&file_priv->master->magic_map, file_priv->magic); +@@ -334,3 +335,23 @@ void drm_master_put(struct drm_master **master) + *master = NULL; + } + EXPORT_SYMBOL(drm_master_put); ++ ++/* Used by drm_client and drm_fb_helper */ ++bool drm_master_internal_acquire(struct drm_device *dev) ++{ ++ mutex_lock(&dev->master_mutex); ++ if (dev->master) { ++ mutex_unlock(&dev->master_mutex); ++ return false; ++ } ++ ++ return true; ++} ++EXPORT_SYMBOL(drm_master_internal_acquire); ++ ++/* Used by drm_client and drm_fb_helper */ ++void drm_master_internal_release(struct drm_device *dev) ++{ ++ mutex_unlock(&dev->master_mutex); ++} ++EXPORT_SYMBOL(drm_master_internal_release); +diff --git a/drivers/gpu/drm/drm_blend.c b/drivers/gpu/drm/drm_blend.c +index 85172a977bf3..1dea495c2c8a 100644 +--- a/drivers/gpu/drm/drm_blend.c ++++ b/drivers/gpu/drm/drm_blend.c +@@ -126,15 +126,15 @@ + * drm_property_create_bitmask()) called "rotation" and has the following + * bitmask enumaration values: + * +- * DRM_ROTATE_0: ++ * DRM_MODE_ROTATE_0: + * "rotate-0" +- * DRM_ROTATE_90: ++ * DRM_MODE_ROTATE_90: + * "rotate-90" +- * DRM_ROTATE_180: ++ * DRM_MODE_ROTATE_180: + * "rotate-180" +- * DRM_ROTATE_270: ++ * DRM_MODE_ROTATE_270: + * "rotate-270" +- * DRM_REFLECT_X: ++ * DRM_MODE_REFLECT_X: + * "reflect-x" + * DRM_REFELCT_Y: + * "reflect-y" +@@ -148,12 +148,12 @@ struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev, + unsigned int supported_rotations) + { + static const struct drm_prop_enum_list props[] = { +- { __builtin_ffs(DRM_ROTATE_0) - 1, "rotate-0" }, +- { __builtin_ffs(DRM_ROTATE_90) - 1, "rotate-90" }, +- { __builtin_ffs(DRM_ROTATE_180) - 1, "rotate-180" }, +- { __builtin_ffs(DRM_ROTATE_270) - 1, "rotate-270" }, +- { __builtin_ffs(DRM_REFLECT_X) - 1, "reflect-x" }, +- { __builtin_ffs(DRM_REFLECT_Y) - 1, "reflect-y" }, ++ { __builtin_ffs(DRM_MODE_ROTATE_0) - 1, "rotate-0" }, ++ { __builtin_ffs(DRM_MODE_ROTATE_90) - 1, "rotate-90" }, ++ { __builtin_ffs(DRM_MODE_ROTATE_180) - 1, "rotate-180" }, ++ { __builtin_ffs(DRM_MODE_ROTATE_270) - 1, "rotate-270" }, ++ { __builtin_ffs(DRM_MODE_REFLECT_X) - 1, "reflect-x" }, ++ { __builtin_ffs(DRM_MODE_REFLECT_Y) - 1, "reflect-y" }, + }; + + return drm_property_create_bitmask(dev, 0, "rotation", +@@ -168,14 +168,14 @@ EXPORT_SYMBOL(drm_mode_create_rotation_property); + * @supported_rotations: Supported rotations + * + * Attempt to simplify the rotation to a form that is supported. +- * Eg. if the hardware supports everything except DRM_REFLECT_X ++ * Eg. if the hardware supports everything except DRM_MODE_REFLECT_X + * one could call this function like this: + * +- * drm_rotation_simplify(rotation, DRM_ROTATE_0 | +- * DRM_ROTATE_90 | DRM_ROTATE_180 | +- * DRM_ROTATE_270 | DRM_REFLECT_Y); ++ * drm_rotation_simplify(rotation, DRM_MODE_ROTATE_0 | ++ * DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 | ++ * DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_Y); + * +- * to eliminate the DRM_ROTATE_X flag. Depending on what kind of ++ * to eliminate the DRM_MODE_ROTATE_X flag. Depending on what kind of + * transforms the hardware supports, this function may not + * be able to produce a supported transform, so the caller should + * check the result afterwards. +@@ -184,9 +184,9 @@ unsigned int drm_rotation_simplify(unsigned int rotation, + unsigned int supported_rotations) + { + if (rotation & ~supported_rotations) { +- rotation ^= DRM_REFLECT_X | DRM_REFLECT_Y; +- rotation = (rotation & DRM_REFLECT_MASK) | +- BIT((ffs(rotation & DRM_ROTATE_MASK) + 1) % 4); ++ rotation ^= DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y; ++ rotation = (rotation & DRM_MODE_REFLECT_MASK) | ++ BIT((ffs(rotation & DRM_MODE_ROTATE_MASK) + 1) % 4); + } + + return rotation; +diff --git a/drivers/gpu/drm/drm_bootsplash.c b/drivers/gpu/drm/drm_bootsplash.c +new file mode 100644 +index 000000000000..27b12f0c401b +--- /dev/null ++++ b/drivers/gpu/drm/drm_bootsplash.c +@@ -0,0 +1,337 @@ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include "drm_internal.h" ++#include "drm_splash.h" ++ ++static bool drm_bootsplash_enabled; ++module_param_named(bootsplash_enabled, drm_bootsplash_enabled, bool, 0664); ++ ++static void drm_bootsplash_client_unregister(struct drm_client_dev *client); ++static int drm_bootsplash_client_hotplug(struct drm_client_dev *client); ++ ++struct drm_bootsplash { ++ struct drm_client_dev client; ++ struct mutex lock; ++ struct drm_client_display *display; ++ struct drm_client_buffer *buffer; ++ struct work_struct worker; ++ struct completion xref; ++ bool started; ++ bool stop; ++}; ++ ++static void is_drm_bootsplash_enabled(struct device *dev) ++{ ++ drm_bootsplash_enabled = of_property_read_bool(dev->of_node, ++ "qcom,sde-drm-fb-splash-logo-enabled"); ++} ++ ++static void drm_bootsplash_buffer_delete(struct drm_bootsplash *splash) ++{ ++ if (!IS_ERR_OR_NULL(splash->buffer)) ++ drm_client_framebuffer_delete(splash->buffer); ++ splash->buffer = NULL; ++} ++ ++static int drm_bootsplash_buffer_create( ++ struct drm_bootsplash *splash, u32 width, u32 height) ++{ ++ splash->buffer = ++ drm_client_framebuffer_create(&splash->client, ++ width, height, SPLASH_IMAGE_FORMAT); ++ if (IS_ERR(splash->buffer)) { ++ drm_bootsplash_buffer_delete(splash); ++ return PTR_ERR(splash->buffer); ++ } ++ ++ splash->buffer->vaddr = ++ drm_client_buffer_vmap(splash->buffer); ++ if (!(splash->buffer->vaddr)) ++ DRM_ERROR("drm_client_buffer_vmap fail\n"); ++ ++ return 0; ++} ++ ++static int drm_bootsplash_display_probe(struct drm_bootsplash *splash) ++{ ++ struct drm_client_dev *client = &splash->client; ++ unsigned int width = 0, height = 0; ++ unsigned int num_non_tiled = 0, i; ++ unsigned int modeset_mask = 0; ++ struct drm_mode_set *modeset; ++ bool tiled = false; ++ int ret; ++ ++ ret = drm_client_modeset_probe(client, 1920, 1080); ++ if (ret) ++ return ret; ++ ++ mutex_lock(&client->modeset_mutex); ++ ++ drm_client_for_each_modeset(modeset, client) { ++ if (!modeset->mode) ++ continue; ++ ++ if (modeset->connectors[0]->has_tile) ++ tiled = true; ++ else ++ num_non_tiled++; ++ } ++ ++ if (!tiled && !num_non_tiled) { ++ drm_bootsplash_buffer_delete(splash); ++ ret = -ENOENT; ++ goto out; ++ } ++ ++ /* Assume only one tiled monitor is possible */ ++ if (tiled) { ++ int hdisplay = 0, vdisplay = 0; ++ ++ i = 0; ++ drm_client_for_each_modeset(modeset, client) { ++ i++; ++ if (!modeset->connectors[0]->has_tile) ++ continue; ++ ++ if (!modeset->y) ++ hdisplay += modeset->mode->hdisplay; ++ if (!modeset->x) ++ vdisplay += modeset->mode->vdisplay; ++ modeset_mask |= BIT(i - 1); ++ } ++ ++ width = hdisplay; ++ height = vdisplay; ++ ++ goto trim; ++ } ++ ++ /* The rest have one display per modeset, pick the largest */ ++ i = 0; ++ drm_client_for_each_modeset(modeset, client) { ++ i++; ++ if (!modeset->mode || modeset->connectors[0]->has_tile) ++ continue; ++ ++ if (modeset->mode->hdisplay * ++ modeset->mode->vdisplay > width * height) { ++ width = modeset->mode->hdisplay; ++ height = modeset->mode->vdisplay; ++ modeset_mask = BIT(i - 1); ++ } ++ } ++ ++trim: ++ i = 0; ++ drm_client_for_each_modeset(modeset, client) { ++ unsigned int j; ++ ++ if (modeset_mask & BIT(i++)) ++ continue; ++ drm_mode_destroy(client->dev, modeset->mode); ++ modeset->mode = NULL; ++ ++ for (j = 0; j < modeset->num_connectors; j++) { ++ drm_connector_unreference(modeset->connectors[j]); ++ modeset->connectors[j] = NULL; ++ } ++ modeset->num_connectors = 0; ++ } ++ ++ if (!splash->buffer || ++ splash->buffer->fb->width != width || ++ splash->buffer->fb->height != height) { ++ drm_bootsplash_buffer_delete(splash); ++ ret = drm_bootsplash_buffer_create(splash, width, height); ++ } ++ ++out: ++ mutex_unlock(&client->modeset_mutex); ++ ++ return ret; ++} ++ ++static int drm_bootsplash_display_commit_buffer( ++ struct drm_bootsplash *splash) ++{ ++ struct drm_client_dev *client = &splash->client; ++ struct drm_mode_set *modeset; ++ ++ mutex_lock(&client->modeset_mutex); ++ drm_client_for_each_modeset(modeset, client) { ++ if (modeset->mode) ++ modeset->fb = splash->buffer->fb; ++ } ++ mutex_unlock(&client->modeset_mutex); ++ ++ return drm_client_modeset_commit(client); ++} ++ ++/* Draw a box for copying the image */ ++static void drm_bootsplash_draw_box(struct drm_client_buffer *buffer) ++{ ++ unsigned int width = buffer->fb->width; ++ unsigned int height = buffer->fb->height; ++ unsigned int x, y, z; ++ u32 *pix; ++ ++ pix = buffer->vaddr; ++ pix += ((height / 2) - 50) * width; ++ pix += (width / 2) - 50; ++ ++ z = 0; ++ for (y = 0; y < SPLASH_IMAGE_HEIGHT; y++) { ++ for (x = 0; x < SPLASH_IMAGE_WIDTH; x++) ++ *pix++ = splash_bgr888_image[z++]; ++ pix += width - SPLASH_IMAGE_WIDTH; ++ } ++} ++ ++static int drm_bootsplash_draw(struct drm_bootsplash *splash) ++{ ++ if (!splash->buffer) ++ return -ENOENT; ++ ++ drm_bootsplash_draw_box(splash->buffer); ++ ++ return drm_bootsplash_display_commit_buffer(splash); ++} ++ ++static void drm_bootsplash_worker(struct work_struct *work) ++{ ++ struct drm_bootsplash *splash = ++ container_of(work, struct drm_bootsplash, worker); ++ struct drm_client_dev *client = &splash->client; ++ struct drm_device *dev = client->dev; ++ bool stop = false; ++ int ret = 0; ++ ++ mutex_lock(&splash->lock); ++ ++ stop = splash->stop; ++ ++ ret = drm_bootsplash_draw(splash); ++ ++ mutex_unlock(&splash->lock); ++ ++ if (stop || ret == -ENOENT || ret == -EBUSY) ++ goto skip; ++ ++ ++ msleep(5000); ++ splash->stop = true; ++ ++skip: ++ drm_lastclose(dev); ++ drm_bootsplash_buffer_delete(splash); ++ ++ DRM_DEBUG("Bootsplash has stopped (start=%u, stop=%u, ret=%d).\n", ++ splash->started, splash->stop, ret); ++ ++ complete(&splash->xref); ++} ++ ++static int drm_bootsplash_client_hotplug(struct drm_client_dev *client) ++{ ++ struct drm_bootsplash *splash = ++ container_of(client, struct drm_bootsplash, client); ++ int ret = 0, retval; ++ ++ if (splash->stop) ++ goto out_unlock; ++ ++ ret = drm_bootsplash_display_probe(splash); ++ if (ret < 0) { ++ if (splash->started && ret == -ENOENT) ++ splash->stop = true; ++ goto out_unlock; ++ } ++ ++ if (!splash->started) { ++ splash->started = true; ++ reinit_completion(&splash->xref); ++ schedule_work(&splash->worker); ++ retval = wait_for_completion_interruptible(&splash->xref); ++ if (retval < 0) ++ DRM_ERROR("wait for bootsplash worker failed\n"); ++ } ++ ++out_unlock: ++ return ret; ++} ++ ++static const struct drm_client_funcs drm_bootsplash_client_funcs = { ++ .owner = THIS_MODULE, ++ .unregister = drm_bootsplash_client_unregister, ++ .hotplug = drm_bootsplash_client_hotplug, ++}; ++ ++static void drm_bootsplash_client_unregister(struct drm_client_dev *client) ++{ ++ struct drm_bootsplash *splash = ++ container_of(client, struct drm_bootsplash, client); ++ ++ mutex_lock(&splash->lock); ++ splash->stop = true; ++ mutex_unlock(&splash->lock); ++ ++ flush_work(&splash->worker); ++ ++ drm_client_release(client); ++ kfree(splash); ++} ++ ++void drm_bootsplash_client_register(struct drm_device *dev) ++{ ++ struct drm_bootsplash *splash; ++ int ret; ++ ++ is_drm_bootsplash_enabled(dev->dev); ++ ++ if (!drm_bootsplash_enabled) ++ return; ++ ++ splash = kzalloc(sizeof(*splash), GFP_KERNEL); ++ if (!splash) ++ return; ++ ++ ret = drm_client_init(dev, &splash->client, "bootsplash", ++ &drm_bootsplash_client_funcs); ++ if (ret) { ++ DRM_DEV_ERROR(dev->dev, "Fail to create client, ret=%d\n", ret); ++ kfree(splash); ++ return; ++ } ++ ++ /* For this simple example only allow the first */ ++ drm_bootsplash_enabled = false; ++ ++ mutex_init(&splash->lock); ++ ++ INIT_WORK(&splash->worker, drm_bootsplash_worker); ++ init_completion(&splash->xref); ++ ++ ret = drm_bootsplash_client_hotplug(&splash->client); ++ if (ret) ++ DRM_DEV_ERROR(dev->dev, "client hotplug ret=%d\n", ret); ++ ++ drm_client_register(&splash->client); ++} ++ ++MODULE_DESCRIPTION("bootsplash"); +diff --git a/drivers/gpu/drm/drm_client.c b/drivers/gpu/drm/drm_client.c +new file mode 100644 +index 000000000000..103742db04a6 +--- /dev/null ++++ b/drivers/gpu/drm/drm_client.c +@@ -0,0 +1,477 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Copyright 2018 Noralf Trønnes ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++ ++#include ++#include "drm_crtc_internal.h" ++#include "drm_internal.h" ++ ++/** ++ * DOC: overview ++ * ++ * This library provides support for clients running in the kernel like fbdev and bootsplash. ++ * ++ * GEM drivers which provide a GEM based dumb buffer with a virtual address are supported. ++ */ ++ ++static int drm_client_open(struct drm_client_dev *client) ++{ ++ struct drm_device *dev = client->dev; ++ struct drm_file *file; ++ ++ file = drm_file_alloc(dev->primary); ++ if (IS_ERR(file)) ++ return PTR_ERR(file); ++ ++ mutex_lock(&dev->filelist_mutex); ++ list_add(&file->lhead, &dev->filelist_internal); ++ mutex_unlock(&dev->filelist_mutex); ++ ++ client->file = file; ++ ++ return 0; ++} ++ ++static void drm_client_close(struct drm_client_dev *client) ++{ ++ struct drm_device *dev = client->dev; ++ ++ mutex_lock(&dev->filelist_mutex); ++ list_del(&client->file->lhead); ++ mutex_unlock(&dev->filelist_mutex); ++ ++ drm_file_free(client->file); ++} ++ ++/** ++ * drm_client_init - Initialise a DRM client ++ * @dev: DRM device ++ * @client: DRM client ++ * @name: Client name ++ * @funcs: DRM client functions (optional) ++ * ++ * This initialises the client and opens a &drm_file. ++ * Use drm_client_register() to complete the process. ++ * The caller needs to hold a reference on @dev before calling this function. ++ * The client is freed when the &drm_device is unregistered. See drm_client_release(). ++ * ++ * Returns: ++ * Zero on success or negative error code on failure. ++ */ ++int drm_client_init(struct drm_device *dev, struct drm_client_dev *client, ++ const char *name, const struct drm_client_funcs *funcs) ++{ ++ int ret; ++ ++ if (!drm_core_check_feature(dev, DRIVER_MODESET) || ++ !dev->driver->dumb_create || !dev->driver->gem_prime_vmap) ++ return -ENOTSUPP; ++ ++ if (funcs && !try_module_get(funcs->owner)) ++ return -ENODEV; ++ ++ client->dev = dev; ++ client->name = name; ++ client->funcs = funcs; ++ ++ ret = drm_client_modeset_create(client); ++ if (ret) ++ goto err_put_module; ++ ++ ret = drm_client_open(client); ++ if (ret) ++ goto err_free; ++ ++ drm_dev_ref(dev); ++ ++ return 0; ++ ++err_free: ++ drm_client_modeset_free(client); ++err_put_module: ++ if (funcs) ++ module_put(funcs->owner); ++ ++ return ret; ++} ++EXPORT_SYMBOL(drm_client_init); ++ ++/** ++ * drm_client_register - Register client ++ * @client: DRM client ++ * ++ * Add the client to the &drm_device client list to activate its callbacks. ++ * @client must be initialized by a call to drm_client_init(). After ++ * drm_client_register() it is no longer permissible to call drm_client_release() ++ * directly (outside the unregister callback), instead cleanup will happen ++ * automatically on driver unload. ++ */ ++void drm_client_register(struct drm_client_dev *client) ++{ ++ struct drm_device *dev = client->dev; ++ ++ mutex_lock(&dev->clientlist_mutex); ++ list_add(&client->list, &dev->clientlist); ++ mutex_unlock(&dev->clientlist_mutex); ++} ++EXPORT_SYMBOL(drm_client_register); ++ ++/** ++ * drm_client_release - Release DRM client resources ++ * @client: DRM client ++ * ++ * Releases resources by closing the &drm_file that was opened by drm_client_init(). ++ * It is called automatically if the &drm_client_funcs.unregister callback is _not_ set. ++ * ++ * This function should only be called from the unregister callback. An exception ++ * is fbdev which cannot free the buffer if userspace has open file descriptors. ++ * ++ * Note: ++ * Clients cannot initiate a release by themselves. This is done to keep the code simple. ++ * The driver has to be unloaded before the client can be unloaded. ++ */ ++void drm_client_release(struct drm_client_dev *client) ++{ ++ struct drm_device *dev = client->dev; ++ ++ DRM_DEV_DEBUG_KMS(dev->dev, "%s\n", client->name); ++ ++ drm_client_modeset_free(client); ++ drm_client_close(client); ++ drm_dev_unref(dev); ++ if (client->funcs) ++ module_put(client->funcs->owner); ++} ++EXPORT_SYMBOL(drm_client_release); ++ ++void drm_client_dev_register(struct drm_device *dev) ++{ ++#ifdef CONFIG_DRM_CLIENT_BOOTSPLASH ++ drm_bootsplash_client_register(dev); ++#endif ++} ++ ++void drm_client_dev_unregister(struct drm_device *dev) ++{ ++ struct drm_client_dev *client, *tmp; ++ ++ if (!drm_core_check_feature(dev, DRIVER_MODESET)) ++ return; ++ ++ mutex_lock(&dev->clientlist_mutex); ++ list_for_each_entry_safe(client, tmp, &dev->clientlist, list) { ++ list_del(&client->list); ++ if (client->funcs && client->funcs->unregister) { ++ client->funcs->unregister(client); ++ } else { ++ drm_client_release(client); ++ kfree(client); ++ } ++ } ++ mutex_unlock(&dev->clientlist_mutex); ++} ++EXPORT_SYMBOL(drm_client_dev_unregister); ++ ++/** ++ * drm_client_dev_hotplug - Send hotplug event to clients ++ * @dev: DRM device ++ * ++ * This function calls the &drm_client_funcs.hotplug callback on the attached clients. ++ * ++ * drm_kms_helper_hotplug_event() calls this function, so drivers that use it ++ * don't need to call this function themselves. ++ */ ++void drm_client_dev_hotplug(struct drm_device *dev) ++{ ++ struct drm_client_dev *client; ++ int ret; ++ ++ if (!drm_core_check_feature(dev, DRIVER_MODESET)) ++ return; ++ ++ mutex_lock(&dev->clientlist_mutex); ++ list_for_each_entry(client, &dev->clientlist, list) { ++ if (!client->funcs || !client->funcs->hotplug) ++ continue; ++ ++ ret = client->funcs->hotplug(client); ++ DRM_DEV_DEBUG_KMS(dev->dev, "%s: ret=%d\n", client->name, ret); ++ } ++ mutex_unlock(&dev->clientlist_mutex); ++} ++EXPORT_SYMBOL(drm_client_dev_hotplug); ++ ++void drm_client_dev_restore(struct drm_device *dev) ++{ ++ struct drm_client_dev *client; ++ int ret; ++ ++ if (!drm_core_check_feature(dev, DRIVER_MODESET)) ++ return; ++ ++ mutex_lock(&dev->clientlist_mutex); ++ list_for_each_entry(client, &dev->clientlist, list) { ++ if (!client->funcs || !client->funcs->restore) ++ continue; ++ ++ ret = client->funcs->restore(client); ++ DRM_DEV_DEBUG_KMS(dev->dev, "%s: ret=%d\n", client->name, ret); ++ if (!ret) /* The first one to return zero gets the privilege to restore */ ++ break; ++ } ++ mutex_unlock(&dev->clientlist_mutex); ++} ++ ++static void drm_client_buffer_delete(struct drm_client_buffer *buffer) ++{ ++ struct drm_device *dev = buffer->client->dev; ++ ++ if (buffer->vaddr && dev->driver->gem_prime_vunmap) ++ dev->driver->gem_prime_vunmap(buffer->gem, buffer->vaddr); ++ ++ if (buffer->gem) ++ drm_gem_object_unreference_unlocked(buffer->gem); ++ ++ if (buffer->handle) ++ drm_mode_destroy_dumb(dev, buffer->handle, buffer->client->file); ++ kfree(buffer); ++} ++ ++static struct drm_client_buffer * ++drm_client_buffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format) ++{ ++ struct drm_mode_create_dumb dumb_args = { }; ++ struct drm_device *dev = client->dev; ++ struct drm_client_buffer *buffer; ++ struct drm_gem_object *obj; ++ int ret; ++ ++ buffer = kzalloc(sizeof(*buffer), GFP_KERNEL); ++ if (!buffer) ++ return ERR_PTR(-ENOMEM); ++ ++ buffer->client = client; ++ ++ dumb_args.width = width; ++ dumb_args.height = height; ++ dumb_args.bpp = drm_format_plane_cpp(format, 0) * 8; ++ ret = drm_mode_create_dumb(dev, &dumb_args, client->file); ++ if (ret) ++ goto err_delete; ++ ++ buffer->handle = dumb_args.handle; ++ buffer->pitch = dumb_args.pitch; ++ ++ obj = drm_gem_object_lookup(client->file, dumb_args.handle); ++ if (!obj) { ++ ret = -ENOENT; ++ goto err_delete; ++ } ++ ++ buffer->gem = obj; ++ ++ return buffer; ++ ++err_delete: ++ drm_client_buffer_delete(buffer); ++ ++ return ERR_PTR(ret); ++} ++ ++/** ++ * drm_client_buffer_vmap - Map DRM client buffer into address space ++ * @buffer: DRM client buffer ++ * ++ * This function maps a client buffer into kernel address space. If the ++ * buffer is already mapped, it returns the mapping's address. ++ * ++ * Client buffer mappings are not ref'counted. Each call to ++ * drm_client_buffer_vmap() should be followed by a call to ++ * drm_client_buffer_vunmap(); or the client buffer should be mapped ++ * throughout its lifetime. The latter is the default. ++ * ++ * Returns: ++ * The mapped memory's address ++ */ ++void *drm_client_buffer_vmap(struct drm_client_buffer *buffer) ++{ ++ struct drm_device *dev = buffer->client->dev; ++ void *vaddr; ++ ++ if (buffer->vaddr) ++ return buffer->vaddr; ++ ++ if (!dev->driver->gem_prime_vmap) ++ return ERR_PTR(-ENOTSUPP); ++ ++ /* ++ * FIXME: The dependency on GEM here isn't required, we could ++ * convert the driver handle to a dma-buf instead and use the ++ * backend-agnostic dma-buf vmap support instead. This would ++ * require that the handle2fd prime ioctl is reworked to pull the ++ * fd_install step out of the driver backend hooks, to make that ++ * final step optional for internal users. ++ */ ++ vaddr = dev->driver->gem_prime_vmap(buffer->gem); ++ if (IS_ERR(vaddr)) ++ return vaddr; ++ ++ buffer->vaddr = vaddr; ++ ++ return vaddr; ++} ++EXPORT_SYMBOL(drm_client_buffer_vmap); ++/** ++ * drm_client_buffer_vunmap - Unmap DRM client buffer ++ * @buffer: DRM client buffer ++ * ++ * This function removes a client buffer's memory mapping. This ++ * function is only required by clients that manage their buffers ++ * by themselves. By default, DRM client buffers are mapped throughout ++ * their entire lifetime. ++ */ ++void drm_client_buffer_vunmap(struct drm_client_buffer *buffer) ++{ ++ struct drm_device *dev = buffer->client->dev; ++ ++ if (buffer->vaddr && dev->driver->gem_prime_vunmap) ++ dev->driver->gem_prime_vunmap(buffer->gem, buffer->vaddr); ++ buffer->vaddr = NULL; ++} ++EXPORT_SYMBOL(drm_client_buffer_vunmap); ++ ++static void drm_client_buffer_rmfb(struct drm_client_buffer *buffer) ++{ ++ int ret; ++ u32 id = 0; ++ ++ if (!buffer->fb) ++ return; ++ ++ id = buffer->fb->base.id; ++ ret = drm_mode_rmfb(buffer->client->dev, id, buffer->client->file); ++ if (ret) ++ DRM_DEV_ERROR(buffer->client->dev->dev, ++ "Error removing FB:%u (%d)\n", buffer->fb->base.id, ret); ++ ++ buffer->fb = NULL; ++} ++ ++static int drm_client_buffer_addfb(struct drm_client_buffer *buffer, ++ u32 width, u32 height, u32 format) ++{ ++ struct drm_client_dev *client = buffer->client; ++ struct drm_mode_fb_cmd fb_req = { }; ++ unsigned int depth, bpp; ++ int ret; ++ ++ drm_fb_get_bpp_depth(format, &depth, &bpp); ++ fb_req.bpp = bpp; ++ fb_req.depth = depth; ++ fb_req.width = width; ++ fb_req.height = height; ++ fb_req.handle = buffer->handle; ++ fb_req.pitch = buffer->pitch; ++ ++ ret = drm_mode_addfb(client->dev, &fb_req, client->file); ++ if (ret) ++ return ret; ++ ++ buffer->fb = drm_framebuffer_lookup(client->dev, fb_req.fb_id); ++ if (WARN_ON(!buffer->fb)) ++ return -ENOENT; ++ ++ /* drop the reference we picked up in framebuffer lookup */ ++ drm_framebuffer_unreference(buffer->fb); ++ ++ strscpy(buffer->fb->comm, client->name, TASK_COMM_LEN); ++ ++ return 0; ++} ++ ++/** ++ * drm_client_framebuffer_create - Create a client framebuffer ++ * @client: DRM client ++ * @width: Framebuffer width ++ * @height: Framebuffer height ++ * @format: Buffer format ++ * ++ * This function creates a &drm_client_buffer which consists of a ++ * &drm_framebuffer backed by a dumb buffer. ++ * Call drm_client_framebuffer_delete() to free the buffer. ++ * ++ * Returns: ++ * Pointer to a client buffer or an error pointer on failure. ++ */ ++struct drm_client_buffer * ++drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format) ++{ ++ struct drm_client_buffer *buffer; ++ int ret; ++ ++ buffer = drm_client_buffer_create(client, width, height, format); ++ if (IS_ERR(buffer)) ++ return buffer; ++ ++ ret = drm_client_buffer_addfb(buffer, width, height, format); ++ if (ret) { ++ drm_client_buffer_delete(buffer); ++ return ERR_PTR(ret); ++ } ++ ++ return buffer; ++} ++EXPORT_SYMBOL(drm_client_framebuffer_create); ++ ++/** ++ * drm_client_framebuffer_delete - Delete a client framebuffer ++ * @buffer: DRM client buffer (can be NULL) ++ */ ++void drm_client_framebuffer_delete(struct drm_client_buffer *buffer) ++{ ++ if (!buffer) ++ return; ++ ++ drm_client_buffer_rmfb(buffer); ++ drm_client_buffer_delete(buffer); ++} ++EXPORT_SYMBOL(drm_client_framebuffer_delete); ++ ++#ifdef CONFIG_DEBUG_FS ++static int drm_client_debugfs_internal_clients(struct seq_file *m, void *data) ++{ ++ struct drm_info_node *node = m->private; ++ struct drm_device *dev = node->minor->dev; ++ struct drm_client_dev *client; ++ ++ mutex_lock(&dev->clientlist_mutex); ++ list_for_each_entry(client, &dev->clientlist, list) ++ seq_printf(m, "%s\n", client->name); ++ mutex_unlock(&dev->clientlist_mutex); ++ ++ return 0; ++} ++ ++static const struct drm_info_list drm_client_debugfs_list[] = { ++ { "internal_clients", drm_client_debugfs_internal_clients, 0 }, ++}; ++ ++int drm_client_debugfs_init(struct drm_minor *minor) ++{ ++ return drm_debugfs_create_files(drm_client_debugfs_list, ++ ARRAY_SIZE(drm_client_debugfs_list), ++ minor->debugfs_root, minor); ++} ++#endif +diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c +new file mode 100644 +index 000000000000..d7a0883f48a3 +--- /dev/null ++++ b/drivers/gpu/drm/drm_client_modeset.c +@@ -0,0 +1,1020 @@ ++// SPDX-License-Identifier: MIT ++/* ++ * Copyright 2018 Noralf Trønnes ++ * Copyright (c) 2006-2009 Red Hat Inc. ++ * Copyright (c) 2006-2008 Intel Corporation ++ * Jesse Barnes ++ * Copyright (c) 2007 Dave Airlie ++ */ ++ ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include "drm_crtc_internal.h" ++#include "drm_internal.h" ++ ++#define DRM_CLIENT_MAX_CLONED_CONNECTORS 8 ++ ++struct drm_client_offset { ++ int x, y; ++}; ++ ++int drm_client_modeset_create(struct drm_client_dev *client) ++{ ++ struct drm_device *dev = client->dev; ++ unsigned int num_crtc = dev->mode_config.num_crtc; ++ unsigned int max_connector_count = 1; ++ struct drm_mode_set *modeset; ++ struct drm_crtc *crtc; ++ unsigned int i = 0; ++ ++ /* Add terminating zero entry to enable index less iteration */ ++ client->modesets = kcalloc(num_crtc + 1, sizeof(*client->modesets), GFP_KERNEL); ++ if (!client->modesets) ++ return -ENOMEM; ++ ++ mutex_init(&client->modeset_mutex); ++ ++ drm_for_each_crtc(crtc, dev) ++ client->modesets[i++].crtc = crtc; ++ ++ /* Cloning is only supported in the single crtc case. */ ++ if (num_crtc == 1) ++ max_connector_count = DRM_CLIENT_MAX_CLONED_CONNECTORS; ++ ++ for (modeset = client->modesets; modeset->crtc; modeset++) { ++ modeset->connectors = kcalloc(max_connector_count, ++ sizeof(*modeset->connectors), GFP_KERNEL); ++ if (!modeset->connectors) ++ goto err_free; ++ } ++ ++ return 0; ++ ++err_free: ++ drm_client_modeset_free(client); ++ ++ return -ENOMEM; ++} ++ ++static void drm_client_modeset_release(struct drm_client_dev *client) ++{ ++ struct drm_mode_set *modeset; ++ unsigned int i; ++ ++ drm_client_for_each_modeset(modeset, client) { ++ drm_mode_destroy(client->dev, modeset->mode); ++ modeset->mode = NULL; ++ modeset->fb = NULL; ++ ++ for (i = 0; i < modeset->num_connectors; i++) { ++ drm_connector_unreference(modeset->connectors[i]); ++ modeset->connectors[i] = NULL; ++ } ++ modeset->num_connectors = 0; ++ } ++} ++ ++void drm_client_modeset_free(struct drm_client_dev *client) ++{ ++ struct drm_mode_set *modeset; ++ ++ mutex_lock(&client->modeset_mutex); ++ ++ drm_client_modeset_release(client); ++ ++ drm_client_for_each_modeset(modeset, client) ++ kfree(modeset->connectors); ++ ++ mutex_unlock(&client->modeset_mutex); ++ ++ mutex_destroy(&client->modeset_mutex); ++ kfree(client->modesets); ++} ++ ++static struct drm_mode_set * ++drm_client_find_modeset(struct drm_client_dev *client, struct drm_crtc *crtc) ++{ ++ struct drm_mode_set *modeset; ++ ++ drm_client_for_each_modeset(modeset, client) ++ if (modeset->crtc == crtc) ++ return modeset; ++ ++ return NULL; ++} ++ ++static struct drm_display_mode * ++drm_connector_has_preferred_mode(struct drm_connector *connector, int width, int height) ++{ ++ struct drm_display_mode *mode; ++ ++ list_for_each_entry(mode, &connector->modes, head) { ++ if (mode->hdisplay > width || ++ mode->vdisplay > height) ++ continue; ++ if (mode->type & DRM_MODE_TYPE_PREFERRED) ++ return mode; ++ } ++ return NULL; ++} ++ ++static struct drm_display_mode * ++drm_connector_pick_cmdline_mode(struct drm_connector *connector) ++{ ++ struct drm_cmdline_mode *cmdline_mode; ++ struct drm_display_mode *mode; ++ bool prefer_non_interlace; ++ ++ cmdline_mode = &connector->cmdline_mode; ++ if (cmdline_mode->specified == false) ++ return NULL; ++ ++ /* attempt to find a matching mode in the list of modes ++ * we have gotten so far, if not add a CVT mode that conforms ++ */ ++ if (cmdline_mode->rb || cmdline_mode->margins) ++ goto create_mode; ++ ++ prefer_non_interlace = !cmdline_mode->interlace; ++again: ++ list_for_each_entry(mode, &connector->modes, head) { ++ /* Check (optional) mode name first */ ++ if (!strcmp(mode->name, cmdline_mode->name)) ++ return mode; ++ ++ /* check width/height */ ++ if (mode->hdisplay != cmdline_mode->xres || ++ mode->vdisplay != cmdline_mode->yres) ++ continue; ++ ++ if (cmdline_mode->refresh_specified) { ++ if (mode->vrefresh != cmdline_mode->refresh) ++ continue; ++ } ++ ++ if (cmdline_mode->interlace) { ++ if (!(mode->flags & DRM_MODE_FLAG_INTERLACE)) ++ continue; ++ } else if (prefer_non_interlace) { ++ if (mode->flags & DRM_MODE_FLAG_INTERLACE) ++ continue; ++ } ++ return mode; ++ } ++ ++ if (prefer_non_interlace) { ++ prefer_non_interlace = false; ++ goto again; ++ } ++ ++create_mode: ++ mode = drm_mode_create_from_cmdline_mode(connector->dev, cmdline_mode); ++ if (mode) ++ list_add(&mode->head, &connector->modes); ++ ++ return mode; ++} ++ ++static bool drm_connector_enabled(struct drm_connector *connector, bool strict) ++{ ++ bool enable; ++ ++ if (strict) ++ enable = connector->status == connector_status_connected; ++ else ++ enable = connector->status != connector_status_disconnected; ++ ++ return enable; ++} ++ ++static void drm_client_connectors_enabled(struct drm_connector **connectors, ++ unsigned int connector_count, ++ bool *enabled) ++{ ++ bool any_enabled = false; ++ struct drm_connector *connector; ++ int i = 0; ++ ++ for (i = 0; i < connector_count; i++) { ++ connector = connectors[i]; ++ enabled[i] = drm_connector_enabled(connector, true); ++ DRM_DEBUG_KMS("connector %d enabled? %s\n", connector->base.id, ++ enabled[i] ? "yes" : "no"); ++ ++ any_enabled |= enabled[i]; ++ } ++ ++ if (any_enabled) ++ return; ++ ++ for (i = 0; i < connector_count; i++) ++ enabled[i] = drm_connector_enabled(connectors[i], false); ++} ++ ++static bool drm_client_target_cloned(struct drm_device *dev, ++ struct drm_connector **connectors, ++ unsigned int connector_count, ++ struct drm_display_mode **modes, ++ struct drm_client_offset *offsets, ++ bool *enabled, int width, int height) ++{ ++ int count, i, j; ++ bool can_clone = false; ++ struct drm_display_mode *dmt_mode, *mode; ++ ++ /* only contemplate cloning in the single crtc case */ ++ if (dev->mode_config.num_crtc > 1) ++ return false; ++ ++ count = 0; ++ for (i = 0; i < connector_count; i++) { ++ if (enabled[i]) ++ count++; ++ } ++ ++ /* only contemplate cloning if more than one connector is enabled */ ++ if (count <= 1) ++ return false; ++ ++ /* check the command line or if nothing common pick 1024x768 */ ++ can_clone = true; ++ for (i = 0; i < connector_count; i++) { ++ if (!enabled[i]) ++ continue; ++ modes[i] = drm_connector_pick_cmdline_mode(connectors[i]); ++ if (!modes[i]) { ++ can_clone = false; ++ break; ++ } ++ for (j = 0; j < i; j++) { ++ if (!enabled[j]) ++ continue; ++ if (!drm_mode_match(modes[j], modes[i], ++ DRM_MODE_MATCH_TIMINGS | ++ DRM_MODE_MATCH_CLOCK | ++ DRM_MODE_MATCH_FLAGS | ++ DRM_MODE_MATCH_3D_FLAGS)) ++ can_clone = false; ++ } ++ } ++ ++ if (can_clone) { ++ DRM_DEBUG_KMS("can clone using command line\n"); ++ return true; ++ } ++ ++ /* try and find a 1024x768 mode on each connector */ ++ can_clone = true; ++ dmt_mode = drm_mode_find_dmt(dev, 1024, 768, 60, false); ++ ++ for (i = 0; i < connector_count; i++) { ++ if (!enabled[i]) ++ continue; ++ ++ list_for_each_entry(mode, &connectors[i]->modes, head) { ++ if (drm_mode_match(mode, dmt_mode, ++ DRM_MODE_MATCH_TIMINGS | ++ DRM_MODE_MATCH_CLOCK | ++ DRM_MODE_MATCH_FLAGS | ++ DRM_MODE_MATCH_3D_FLAGS)) ++ modes[i] = mode; ++ } ++ if (!modes[i]) ++ can_clone = false; ++ } ++ ++ if (can_clone) { ++ DRM_DEBUG_KMS("can clone using 1024x768\n"); ++ return true; ++ } ++ DRM_INFO("kms: can't enable cloning when we probably wanted to.\n"); ++ return false; ++} ++ ++static int drm_client_get_tile_offsets(struct drm_connector **connectors, ++ unsigned int connector_count, ++ struct drm_display_mode **modes, ++ struct drm_client_offset *offsets, ++ int idx, ++ int h_idx, int v_idx) ++{ ++ struct drm_connector *connector; ++ int i; ++ int hoffset = 0, voffset = 0; ++ ++ for (i = 0; i < connector_count; i++) { ++ connector = connectors[i]; ++ if (!connector->has_tile) ++ continue; ++ ++ if (!modes[i] && (h_idx || v_idx)) { ++ DRM_DEBUG_KMS("no modes for connector tiled %d %d\n", i, ++ connector->base.id); ++ continue; ++ } ++ if (connector->tile_h_loc < h_idx) ++ hoffset += modes[i]->hdisplay; ++ ++ if (connector->tile_v_loc < v_idx) ++ voffset += modes[i]->vdisplay; ++ } ++ offsets[idx].x = hoffset; ++ offsets[idx].y = voffset; ++ DRM_DEBUG_KMS("returned %d %d for %d %d\n", hoffset, voffset, h_idx, v_idx); ++ return 0; ++} ++ ++static bool drm_client_target_preferred(struct drm_connector **connectors, ++ unsigned int connector_count, ++ struct drm_display_mode **modes, ++ struct drm_client_offset *offsets, ++ bool *enabled, int width, int height) ++{ ++ const u64 mask = BIT_ULL(connector_count) - 1; ++ struct drm_connector *connector; ++ u64 conn_configured = 0; ++ int tile_pass = 0; ++ int i; ++ ++retry: ++ for (i = 0; i < connector_count; i++) { ++ connector = connectors[i]; ++ ++ if (conn_configured & BIT_ULL(i)) ++ continue; ++ ++ if (enabled[i] == false) { ++ conn_configured |= BIT_ULL(i); ++ continue; ++ } ++ ++ /* first pass over all the untiled connectors */ ++ if (tile_pass == 0 && connector->has_tile) ++ continue; ++ ++ if (tile_pass == 1) { ++ if (connector->tile_h_loc != 0 || ++ connector->tile_v_loc != 0) ++ continue; ++ ++ } else { ++ if (connector->tile_h_loc != tile_pass - 1 && ++ connector->tile_v_loc != tile_pass - 1) ++ /* if this tile_pass doesn't cover any of the tiles - keep going */ ++ continue; ++ ++ /* ++ * find the tile offsets for this pass - need to find ++ * all tiles left and above ++ */ ++ drm_client_get_tile_offsets(connectors, connector_count, modes, offsets, i, ++ connector->tile_h_loc, connector->tile_v_loc); ++ } ++ DRM_DEBUG_KMS("looking for cmdline mode on connector %d\n", ++ connector->base.id); ++ ++ /* got for command line mode first */ ++ modes[i] = drm_connector_pick_cmdline_mode(connector); ++ if (!modes[i]) { ++ DRM_DEBUG_KMS("looking for preferred mode on connector %d %d\n", ++ connector->base.id, connector->tile_group ? connector->tile_group->id : 0); ++ modes[i] = drm_connector_has_preferred_mode(connector, width, height); ++ } ++ /* No preferred modes, pick one off the list */ ++ if (!modes[i] && !list_empty(&connector->modes)) { ++ list_for_each_entry(modes[i], &connector->modes, head) ++ break; ++ } ++ DRM_DEBUG_KMS("found mode %s\n", modes[i] ? modes[i]->name : ++ "none"); ++ conn_configured |= BIT_ULL(i); ++ } ++ ++ if ((conn_configured & mask) != mask) { ++ tile_pass++; ++ goto retry; ++ } ++ return true; ++} ++ ++static bool connector_has_possible_crtc(struct drm_connector *connector, ++ struct drm_crtc *crtc) ++{ ++ struct drm_encoder *encoder; ++ int i; ++ ++ drm_connector_for_each_possible_encoder(connector, encoder, i) { ++ if (encoder->possible_crtcs & drm_crtc_mask(crtc)) ++ return true; ++ } ++ ++ return false; ++} ++ ++static int drm_client_pick_crtcs(struct drm_client_dev *client, ++ struct drm_connector **connectors, ++ unsigned int connector_count, ++ struct drm_crtc **best_crtcs, ++ struct drm_display_mode **modes, ++ int n, int width, int height) ++{ ++ struct drm_device *dev = client->dev; ++ struct drm_connector *connector; ++ int my_score, best_score, score; ++ struct drm_crtc **crtcs, *crtc; ++ struct drm_mode_set *modeset; ++ int o; ++ ++ if (n == connector_count) ++ return 0; ++ ++ connector = connectors[n]; ++ ++ best_crtcs[n] = NULL; ++ best_score = drm_client_pick_crtcs(client, connectors, connector_count, ++ best_crtcs, modes, n + 1, width, height); ++ if (modes[n] == NULL) ++ return best_score; ++ ++ crtcs = kcalloc(connector_count, sizeof(*crtcs), GFP_KERNEL); ++ if (!crtcs) ++ return best_score; ++ ++ my_score = 1; ++ if (connector->status == connector_status_connected) ++ my_score++; ++ if (connector->cmdline_mode.specified) ++ my_score++; ++ if (drm_connector_has_preferred_mode(connector, width, height)) ++ my_score++; ++ ++ /* ++ * select a crtc for this connector and then attempt to configure ++ * remaining connectors ++ */ ++ drm_client_for_each_modeset(modeset, client) { ++ crtc = modeset->crtc; ++ ++ if (!connector_has_possible_crtc(connector, crtc)) ++ continue; ++ ++ for (o = 0; o < n; o++) ++ if (best_crtcs[o] == crtc) ++ break; ++ ++ if (o < n) { ++ /* ignore cloning unless only a single crtc */ ++ if (dev->mode_config.num_crtc > 1) ++ continue; ++ ++ if (!drm_mode_equal(modes[o], modes[n])) ++ continue; ++ } ++ ++ crtcs[n] = crtc; ++ memcpy(crtcs, best_crtcs, n * sizeof(*crtcs)); ++ score = my_score + drm_client_pick_crtcs(client, connectors, connector_count, ++ crtcs, modes, n + 1, width, height); ++ if (score > best_score) { ++ best_score = score; ++ memcpy(best_crtcs, crtcs, connector_count * sizeof(*crtcs)); ++ } ++ } ++ ++ kfree(crtcs); ++ return best_score; ++} ++ ++/* Try to read the BIOS display configuration and use it for the initial config */ ++static bool drm_client_firmware_config(struct drm_client_dev *client, ++ struct drm_connector **connectors, ++ unsigned int connector_count, ++ struct drm_crtc **crtcs, ++ struct drm_display_mode **modes, ++ struct drm_client_offset *offsets, ++ bool *enabled, int width, int height) ++{ ++ unsigned int count = min_t(unsigned int, connector_count, BITS_PER_LONG); ++ unsigned long conn_configured, conn_seq, mask; ++ struct drm_device *dev = client->dev; ++ int i, j; ++ bool *save_enabled; ++ bool fallback = true, ret = true; ++ int num_connectors_enabled = 0; ++ int num_connectors_detected = 0; ++ struct drm_modeset_acquire_ctx ctx; ++ ++ if (!drm_drv_uses_atomic_modeset(dev)) ++ return false; ++ ++ save_enabled = kcalloc(count, sizeof(bool), GFP_KERNEL); ++ if (!save_enabled) ++ return false; ++ ++ drm_modeset_acquire_init(&ctx, 0); ++ ++ while (drm_modeset_lock_all_ctx(dev, &ctx) != 0) ++ drm_modeset_backoff(&ctx); ++ ++ memcpy(save_enabled, enabled, count); ++ mask = GENMASK(count - 1, 0); ++ conn_configured = 0; ++retry: ++ conn_seq = conn_configured; ++ for (i = 0; i < count; i++) { ++ struct drm_connector *connector; ++ struct drm_encoder *encoder; ++ struct drm_crtc *new_crtc; ++ ++ connector = connectors[i]; ++ ++ if (conn_configured & BIT(i)) ++ continue; ++ ++ if (conn_seq == 0 && !connector->has_tile) ++ continue; ++ ++ if (connector->status == connector_status_connected) ++ num_connectors_detected++; ++ ++ if (!enabled[i]) { ++ DRM_DEBUG_KMS("connector %s not enabled, skipping\n", ++ connector->name); ++ conn_configured |= BIT(i); ++ continue; ++ } ++ ++ if (connector->force == DRM_FORCE_OFF) { ++ DRM_DEBUG_KMS("connector %s is disabled by user, skipping\n", ++ connector->name); ++ enabled[i] = false; ++ continue; ++ } ++ ++ encoder = connector->state->best_encoder; ++ if (!encoder || WARN_ON(!connector->state->crtc)) { ++ if (connector->force > DRM_FORCE_OFF) ++ goto bail; ++ ++ DRM_DEBUG_KMS("connector %s has no encoder or crtc, skipping\n", ++ connector->name); ++ enabled[i] = false; ++ conn_configured |= BIT(i); ++ continue; ++ } ++ ++ num_connectors_enabled++; ++ ++ new_crtc = connector->state->crtc; ++ ++ /* ++ * Make sure we're not trying to drive multiple connectors ++ * with a single CRTC, since our cloning support may not ++ * match the BIOS. ++ */ ++ for (j = 0; j < count; j++) { ++ if (crtcs[j] == new_crtc) { ++ DRM_DEBUG_KMS("fallback: cloned configuration\n"); ++ goto bail; ++ } ++ } ++ ++ DRM_DEBUG_KMS("looking for cmdline mode on connector %s\n", ++ connector->name); ++ ++ /* go for command line mode first */ ++ modes[i] = drm_connector_pick_cmdline_mode(connector); ++ ++ /* try for preferred next */ ++ if (!modes[i]) { ++ DRM_DEBUG_KMS("looking for preferred mode on connector %s %d\n", ++ connector->name, connector->has_tile); ++ modes[i] = drm_connector_has_preferred_mode(connector, width, height); ++ } ++ ++ /* No preferred mode marked by the EDID? Are there any modes? */ ++ if (!modes[i] && !list_empty(&connector->modes)) { ++ DRM_DEBUG_KMS("using first mode listed on connector %s\n", ++ connector->name); ++ modes[i] = list_first_entry(&connector->modes, ++ struct drm_display_mode, ++ head); ++ } ++ ++ /* last resort: use current mode */ ++ if (!modes[i]) { ++ /* ++ * IMPORTANT: We want to use the adjusted mode (i.e. ++ * after the panel fitter upscaling) as the initial ++ * config, not the input mode, which is what crtc->mode ++ * usually contains. But since our current ++ * code puts a mode derived from the post-pfit timings ++ * into crtc->mode this works out correctly. ++ * ++ * This is crtc->mode and not crtc->state->mode for the ++ * fastboot check to work correctly. ++ */ ++ DRM_DEBUG_KMS("looking for current mode on connector %s\n", ++ connector->name); ++ modes[i] = &connector->state->crtc->mode; ++ } ++ crtcs[i] = new_crtc; ++ ++ DRM_DEBUG_KMS("connector %s on [CRTC:%d:%s]: %dx%d%s\n", ++ connector->name, ++ connector->state->crtc->base.id, ++ connector->state->crtc->name, ++ modes[i]->hdisplay, modes[i]->vdisplay, ++ modes[i]->flags & DRM_MODE_FLAG_INTERLACE ? "i" : ""); ++ ++ fallback = false; ++ conn_configured |= BIT(i); ++ } ++ ++ if ((conn_configured & mask) != mask && conn_configured != conn_seq) ++ goto retry; ++ ++ /* ++ * If the BIOS didn't enable everything it could, fall back to have the ++ * same user experiencing of lighting up as much as possible like the ++ * fbdev helper library. ++ */ ++ if (num_connectors_enabled != num_connectors_detected && ++ num_connectors_enabled < dev->mode_config.num_crtc) { ++ DRM_DEBUG_KMS("fallback: Not all outputs enabled\n"); ++ DRM_DEBUG_KMS("Enabled: %i, detected: %i\n", num_connectors_enabled, ++ num_connectors_detected); ++ fallback = true; ++ } ++ ++ if (fallback) { ++bail: ++ DRM_DEBUG_KMS("Not using firmware configuration\n"); ++ memcpy(enabled, save_enabled, count); ++ ret = false; ++ } ++ ++ drm_modeset_drop_locks(&ctx); ++ drm_modeset_acquire_fini(&ctx); ++ ++ kfree(save_enabled); ++ return ret; ++} ++ ++/** ++ * drm_client_modeset_probe() - Probe for displays ++ * @client: DRM client ++ * @width: Maximum display mode width (optional) ++ * @height: Maximum display mode height (optional) ++ * ++ * This function sets up display pipelines for enabled connectors and stores the ++ * config in the client's modeset array. ++ * ++ * Returns: ++ * Zero on success or negative error code on failure. ++ */ ++int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, unsigned int height) ++{ ++ struct drm_connector *connector, **connectors = NULL; ++ struct drm_device *dev = client->dev; ++ unsigned int total_modes_count = 0; ++ struct drm_client_offset *offsets; ++ unsigned int connector_count = 0; ++ struct drm_display_mode **modes; ++ struct drm_crtc **crtcs; ++ int i, ret = 0; ++ bool *enabled; ++ ++ DRM_DEBUG_KMS("\n"); ++ ++ if (!width) ++ width = dev->mode_config.max_width; ++ if (!height) ++ height = dev->mode_config.max_height; ++ ++ mutex_lock(&dev->mode_config.mutex); ++ drm_for_each_connector(connector, dev) { ++ if (connector->connector_type != DRM_MODE_CONNECTOR_VIRTUAL) { ++ struct drm_connector **tmp; ++ ++ tmp = krealloc(connectors, (connector_count + 1) * sizeof(*connectors), GFP_KERNEL); ++ if (!tmp) { ++ ret = -ENOMEM; ++ goto free_connectors; ++ } ++ ++ connectors = tmp; ++ drm_connector_reference(connector); ++ connectors[connector_count++] = connector; ++ } ++ } ++ mutex_unlock(&dev->mode_config.mutex); ++ ++ if (!connector_count) ++ return 0; ++ ++ crtcs = kcalloc(connector_count, sizeof(*crtcs), GFP_KERNEL); ++ modes = kcalloc(connector_count, sizeof(*modes), GFP_KERNEL); ++ offsets = kcalloc(connector_count, sizeof(*offsets), GFP_KERNEL); ++ enabled = kcalloc(connector_count, sizeof(bool), GFP_KERNEL); ++ if (!crtcs || !modes || !enabled || !offsets) { ++ DRM_ERROR("Memory allocation failed\n"); ++ ret = -ENOMEM; ++ goto out; ++ } ++ ++ mutex_lock(&client->modeset_mutex); ++ ++ mutex_lock(&dev->mode_config.mutex); ++ for (i = 0; i < connector_count; i++) ++ total_modes_count += connectors[i]->funcs->fill_modes(connectors[i], width, height); ++ if (!total_modes_count) ++ DRM_DEBUG_KMS("No connectors reported connected with modes\n"); ++ drm_client_connectors_enabled(connectors, connector_count, enabled); ++ ++ if (!drm_client_firmware_config(client, connectors, connector_count, crtcs, ++ modes, offsets, enabled, width, height)) { ++ memset(modes, 0, connector_count * sizeof(*modes)); ++ memset(crtcs, 0, connector_count * sizeof(*crtcs)); ++ memset(offsets, 0, connector_count * sizeof(*offsets)); ++ ++ if (!drm_client_target_cloned(dev, connectors, connector_count, modes, ++ offsets, enabled, width, height) && ++ !drm_client_target_preferred(connectors, connector_count, modes, ++ offsets, enabled, width, height)) ++ DRM_ERROR("Unable to find initial modes\n"); ++ ++ DRM_DEBUG_KMS("picking CRTCs for %dx%d config\n", ++ width, height); ++ ++ drm_client_pick_crtcs(client, connectors, connector_count, ++ crtcs, modes, 0, width, height); ++ } ++ mutex_unlock(&dev->mode_config.mutex); ++ ++ drm_client_modeset_release(client); ++ ++ for (i = 0; i < connector_count; i++) { ++ struct drm_display_mode *mode = modes[i]; ++ struct drm_crtc *crtc = crtcs[i]; ++ struct drm_client_offset *offset = &offsets[i]; ++ ++ if (mode && crtc) { ++ struct drm_mode_set *modeset = drm_client_find_modeset(client, crtc); ++ struct drm_connector *connector = connectors[i]; ++ ++ DRM_DEBUG_KMS("desired mode %s set on crtc %d (%d,%d)\n", ++ mode->name, crtc->base.id, offset->x, offset->y); ++ ++ if (WARN_ON_ONCE(modeset->num_connectors == DRM_CLIENT_MAX_CLONED_CONNECTORS || ++ (dev->mode_config.num_crtc > 1 && modeset->num_connectors == 1))) { ++ ret = -EINVAL; ++ break; ++ } ++ ++ modeset->mode = drm_mode_duplicate(dev, mode); ++ drm_connector_reference(connector); ++ modeset->connectors[modeset->num_connectors++] = connector; ++ modeset->x = offset->x; ++ modeset->y = offset->y; ++ } ++ } ++ ++ mutex_unlock(&client->modeset_mutex); ++out: ++ kfree(crtcs); ++ kfree(modes); ++ kfree(offsets); ++ kfree(enabled); ++free_connectors: ++ for (i = 0; i < connector_count; i++) ++ drm_connector_unreference(connectors[i]); ++ kfree(connectors); ++ ++ return ret; ++} ++EXPORT_SYMBOL(drm_client_modeset_probe); ++ ++static int drm_client_modeset_commit_atomic(struct drm_client_dev *client, bool active) ++{ ++ struct drm_device *dev = client->dev; ++ struct drm_plane *plane; ++ struct drm_atomic_state *state; ++ struct drm_modeset_acquire_ctx ctx; ++ struct drm_mode_set *mode_set; ++ int ret; ++ ++ drm_modeset_acquire_init(&ctx, 0); ++ ++ state = drm_atomic_state_alloc(dev); ++ if (!state) { ++ ret = -ENOMEM; ++ goto out_ctx; ++ } ++ ++ state->acquire_ctx = &ctx; ++retry: ++ drm_for_each_plane(plane, dev) { ++ struct drm_plane_state *plane_state; ++ ++ plane_state = drm_atomic_get_plane_state(state, plane); ++ if (IS_ERR(plane_state)) { ++ ret = PTR_ERR(plane_state); ++ goto out_state; ++ } ++ ++ plane_state->rotation = DRM_MODE_ROTATE_0; ++ ++ /* disable non-primary: */ ++ if (plane->type == DRM_PLANE_TYPE_PRIMARY) ++ continue; ++ ++ ret = __drm_atomic_helper_disable_plane(plane, plane_state); ++ if (ret != 0) ++ goto out_state; ++ } ++ ++ drm_client_for_each_modeset(mode_set, client) { ++ ret = __drm_atomic_helper_set_config(mode_set, state); ++ if (ret != 0) ++ goto out_state; ++ ++ /* ++ * __drm_atomic_helper_set_config() sets active when a ++ * mode is set, unconditionally clear it if we force DPMS off ++ */ ++ if (!active) { ++ struct drm_crtc *crtc = mode_set->crtc; ++ struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc); ++ ++ crtc_state->active = false; ++ } ++ } ++ ++ ret = drm_atomic_commit(state); ++ ++out_state: ++ if (ret == -EDEADLK) ++ goto backoff; ++ ++out_ctx: ++ drm_modeset_drop_locks(&ctx); ++ drm_modeset_acquire_fini(&ctx); ++ ++ return ret; ++ ++backoff: ++ drm_atomic_state_clear(state); ++ drm_modeset_backoff(&ctx); ++ ++ goto retry; ++} ++ ++static int drm_client_modeset_commit_legacy(struct drm_client_dev *client) ++{ ++ struct drm_device *dev = client->dev; ++ struct drm_mode_set *mode_set; ++ struct drm_plane *plane; ++ int ret = 0; ++ ++ drm_modeset_lock_all(dev); ++ drm_for_each_plane(plane, dev) { ++ if (plane->type != DRM_PLANE_TYPE_PRIMARY) ++ drm_plane_force_disable(plane); ++ } ++ ++ drm_client_for_each_modeset(mode_set, client) { ++ struct drm_crtc *crtc = mode_set->crtc; ++ ++ if (crtc->funcs->cursor_set2) { ++ ret = crtc->funcs->cursor_set2(crtc, NULL, 0, 0, 0, 0, 0); ++ if (ret) ++ goto out; ++ } else if (crtc->funcs->cursor_set) { ++ ret = crtc->funcs->cursor_set(crtc, NULL, 0, 0, 0); ++ if (ret) ++ goto out; ++ } ++ ++ ret = drm_mode_set_config_internal(mode_set); ++ if (ret) ++ goto out; ++ } ++out: ++ drm_modeset_unlock_all(dev); ++ ++ return ret; ++} ++ ++/** ++ * drm_client_modeset_commit_force() - Force commit CRTC configuration ++ * @client: DRM client ++ * ++ * Commit modeset configuration to crtcs without checking if there is a DRM master. ++ * ++ * Returns: ++ * Zero on success or negative error code on failure. ++ */ ++int drm_client_modeset_commit_force(struct drm_client_dev *client) ++{ ++ struct drm_device *dev = client->dev; ++ int ret; ++ ++ mutex_lock(&client->modeset_mutex); ++ if (drm_drv_uses_atomic_modeset(dev)) ++ ret = drm_client_modeset_commit_atomic(client, true); ++ else ++ ret = drm_client_modeset_commit_legacy(client); ++ mutex_unlock(&client->modeset_mutex); ++ ++ return ret; ++} ++EXPORT_SYMBOL(drm_client_modeset_commit_force); ++ ++/** ++ * drm_client_modeset_commit() - Commit CRTC configuration ++ * @client: DRM client ++ * ++ * Commit modeset configuration to crtcs. ++ * ++ * Returns: ++ * Zero on success or negative error code on failure. ++ */ ++int drm_client_modeset_commit(struct drm_client_dev *client) ++{ ++ struct drm_device *dev = client->dev; ++ int ret; ++ ++ if (!drm_master_internal_acquire(dev)) ++ return -EBUSY; ++ ++ ret = drm_client_modeset_commit_force(client); ++ ++ drm_master_internal_release(dev); ++ ++ return ret; ++} ++EXPORT_SYMBOL(drm_client_modeset_commit); ++ ++static void drm_client_modeset_dpms_legacy(struct drm_client_dev *client, int dpms_mode) ++{ ++ struct drm_device *dev = client->dev; ++ struct drm_connector *connector; ++ struct drm_mode_set *modeset; ++ int j; ++ ++ drm_modeset_lock_all(dev); ++ drm_client_for_each_modeset(modeset, client) { ++ if (!modeset->crtc->enabled) ++ continue; ++ ++ for (j = 0; j < modeset->num_connectors; j++) { ++ connector = modeset->connectors[j]; ++ connector->funcs->dpms(connector, dpms_mode); ++ drm_object_property_set_value(&connector->base, ++ dev->mode_config.dpms_property, dpms_mode); ++ } ++ } ++ drm_modeset_unlock_all(dev); ++} ++ ++/** ++ * drm_client_modeset_dpms() - Set DPMS mode ++ * @client: DRM client ++ * @mode: DPMS mode ++ * ++ * Note: For atomic drivers @mode is reduced to on/off. ++ * ++ * Returns: ++ * Zero on success or negative error code on failure. ++ */ ++int drm_client_modeset_dpms(struct drm_client_dev *client, int mode) ++{ ++ struct drm_device *dev = client->dev; ++ int ret = 0; ++ ++ if (!drm_master_internal_acquire(dev)) ++ return -EBUSY; ++ ++ mutex_lock(&client->modeset_mutex); ++ if (drm_drv_uses_atomic_modeset(dev)) ++ ret = drm_client_modeset_commit_atomic(client, mode == DRM_MODE_DPMS_ON); ++ else ++ drm_client_modeset_dpms_legacy(client, mode); ++ mutex_unlock(&client->modeset_mutex); ++ ++ drm_master_internal_release(dev); ++ ++ return ret; ++} ++EXPORT_SYMBOL(drm_client_modeset_dpms); +diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c +index 0e934a9ac63c..e36b94a2d45e 100644 +--- a/drivers/gpu/drm/drm_connector.c ++++ b/drivers/gpu/drm/drm_connector.c +@@ -147,8 +147,9 @@ static void drm_connector_get_cmdline_mode(struct drm_connector *connector) + connector->force = mode->force; + } + +- DRM_DEBUG_KMS("cmdline mode for connector %s %dx%d@%dHz%s%s%s\n", ++ DRM_DEBUG_KMS("cmdline mode for connector %s %s %dx%d@%dHz%s%s%s\n", + connector->name, ++ mode->name, + mode->xres, mode->yres, + mode->refresh_specified ? mode->refresh : 60, + mode->rb ? " reduced blanking" : "", +@@ -1049,9 +1050,8 @@ int drm_mode_getconnector(struct drm_device *dev, void *data, + goto out_unlock; + } + +- for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) +- if (connector->encoder_ids[i] != 0) +- encoders_count++; ++ drm_connector_for_each_possible_encoder(connector, encoder, i) ++ encoders_count++; + + if (out_resp->count_modes == 0) { + connector->funcs->fill_modes(connector, +@@ -1111,15 +1111,12 @@ int drm_mode_getconnector(struct drm_device *dev, void *data, + if ((out_resp->count_encoders >= encoders_count) && encoders_count) { + copied = 0; + encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr); +- for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) { +- if (connector->encoder_ids[i] != 0) { +- if (put_user(connector->encoder_ids[i], +- encoder_ptr + copied)) { +- ret = -EFAULT; +- goto out; +- } +- copied++; ++ drm_connector_for_each_possible_encoder(connector, encoder, i) { ++ if (put_user(encoder->base.id, encoder_ptr + copied)) { ++ ret = -EFAULT; ++ goto out; + } ++ copied++; + } + } + out_resp->count_encoders = encoders_count; +diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c +index 79b3d521c388..9710751a032e 100644 +--- a/drivers/gpu/drm/drm_crtc.c ++++ b/drivers/gpu/drm/drm_crtc.c +@@ -763,8 +763,8 @@ int drm_crtc_check_viewport(const struct drm_crtc *crtc, + drm_crtc_get_hv_timing(mode, &hdisplay, &vdisplay); + + if (crtc->state && +- crtc->primary->state->rotation & (DRM_ROTATE_90 | +- DRM_ROTATE_270)) ++ crtc->primary->state->rotation & (DRM_MODE_ROTATE_90 | ++ DRM_MODE_ROTATE_270)) + swap(hdisplay, vdisplay); + + return drm_framebuffer_check_src_coords(x << 16, y << 16, +@@ -1025,10 +1025,10 @@ EXPORT_SYMBOL(drm_mode_config_reset); + * Returns: + * Zero on success, negative errno on failure. + */ +-int drm_mode_create_dumb_ioctl(struct drm_device *dev, +- void *data, struct drm_file *file_priv) ++int drm_mode_create_dumb(struct drm_device *dev, ++ struct drm_mode_create_dumb *args, ++ struct drm_file *file_priv) + { +- struct drm_mode_create_dumb *args = data; + u32 cpp, stride, size; + + if (!dev->driver->dumb_create) +@@ -1063,6 +1063,12 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, + return dev->driver->dumb_create(file_priv, dev, args); + } + ++int drm_mode_create_dumb_ioctl(struct drm_device *dev, ++ void *data, struct drm_file *file_priv) ++{ ++ return drm_mode_create_dumb(dev, data, file_priv); ++} ++ + /** + * drm_mode_mmap_dumb_ioctl - create an mmap offset for a dumb backing storage buffer + * @dev: DRM device +@@ -1104,15 +1110,21 @@ int drm_mode_mmap_dumb_ioctl(struct drm_device *dev, + * Returns: + * Zero on success, negative errno on failure. + */ ++int drm_mode_destroy_dumb(struct drm_device *dev, u32 handle, ++ struct drm_file *file_priv) ++{ ++ if (!dev->driver->dumb_destroy) ++ return -ENOSYS; ++ ++ return dev->driver->dumb_destroy(file_priv, dev, handle); ++} ++ + int drm_mode_destroy_dumb_ioctl(struct drm_device *dev, + void *data, struct drm_file *file_priv) + { + struct drm_mode_destroy_dumb *args = data; + +- if (!dev->driver->dumb_destroy) +- return -ENOSYS; +- +- return dev->driver->dumb_destroy(file_priv, dev, args->handle); ++ return drm_mode_destroy_dumb(dev, args->handle, file_priv); + } + + /** +diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h +index df2b51a4f75e..b25ceefe7c72 100644 +--- a/drivers/gpu/drm/drm_crtc_internal.h ++++ b/drivers/gpu/drm/drm_crtc_internal.h +@@ -45,6 +45,17 @@ struct fence *drm_crtc_create_fence(struct drm_crtc *crtc); + + void drm_fb_release(struct drm_file *file_priv); + ++int drm_mode_create_dumb(struct drm_device *dev, ++ struct drm_mode_create_dumb *args, ++ struct drm_file *file_priv); ++int drm_mode_destroy_dumb(struct drm_device *dev, u32 handle, ++ struct drm_file *file_priv); ++ ++int drm_mode_addfb(struct drm_device *dev, struct drm_mode_fb_cmd *or, ++ struct drm_file *file_priv); ++int drm_mode_rmfb(struct drm_device *dev, u32 fb_id, ++ struct drm_file *file_priv); ++ + /* dumb buffer support IOCTLs */ + int drm_mode_create_dumb_ioctl(struct drm_device *dev, + void *data, struct drm_file *file_priv); +@@ -151,11 +162,11 @@ int drm_framebuffer_check_src_coords(uint32_t src_x, uint32_t src_y, + const struct drm_framebuffer *fb); + + /* IOCTL */ +-int drm_mode_addfb(struct drm_device *dev, ++int drm_mode_addfb_ioctl(struct drm_device *dev, + void *data, struct drm_file *file_priv); + int drm_mode_addfb2(struct drm_device *dev, + void *data, struct drm_file *file_priv); +-int drm_mode_rmfb(struct drm_device *dev, ++int drm_mode_rmfb_ioctl(struct drm_device *dev, + void *data, struct drm_file *file_priv); + int drm_mode_getfb(struct drm_device *dev, + void *data, struct drm_file *file_priv); diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c -index 1205790ed960..5ffe4b664cfb 100644 +index 1205790ed960..4bd727006393 100644 --- a/drivers/gpu/drm/drm_debugfs.c +++ b/drivers/gpu/drm/drm_debugfs.c -@@ -287,13 +287,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf, +@@ -37,6 +37,7 @@ + #include + #include + #include "drm_internal.h" ++#include + + #if defined(CONFIG_DEBUG_FS) + +@@ -163,6 +164,14 @@ int drm_debugfs_init(struct drm_minor *minor, int minor_id, + return ret; + } + ++ if (drm_core_check_feature(dev, DRIVER_MODESET)) { ++ ret = drm_client_debugfs_init(minor); ++ if (ret) { ++ DRM_ERROR("Failed to create client debugfs file\n"); ++ return ret; ++ } ++ } ++ + if (dev->driver->debugfs_init) { + ret = dev->driver->debugfs_init(minor); + if (ret) { +@@ -287,13 +296,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf, buf[len] = '\0'; @@ -29057,6 +37183,55 @@ index 41e67e983a7f..bb70c5272fe8 100644 } EXPORT_SYMBOL(drm_dp_check_act_status); +diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c +index 80a903bd317d..542f32364c91 100644 +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -33,10 +33,10 @@ + #include + #include + #include ++#include + #include "drm_crtc_internal.h" + #include "drm_legacy.h" + #include "drm_internal.h" +-#include "drm_crtc_internal.h" + + /* + * drm_debug: Enable debug output. +@@ -503,6 +503,8 @@ int drm_dev_init(struct drm_device *dev, + dev->driver = driver; + + INIT_LIST_HEAD(&dev->filelist); ++ INIT_LIST_HEAD(&dev->filelist_internal); ++ INIT_LIST_HEAD(&dev->clientlist); + INIT_LIST_HEAD(&dev->ctxlist); + INIT_LIST_HEAD(&dev->vmalist); + INIT_LIST_HEAD(&dev->maplist); +@@ -512,6 +514,7 @@ int drm_dev_init(struct drm_device *dev, + spin_lock_init(&dev->event_lock); + mutex_init(&dev->struct_mutex); + mutex_init(&dev->filelist_mutex); ++ mutex_init(&dev->clientlist_mutex); + mutex_init(&dev->ctxlist_mutex); + mutex_init(&dev->master_mutex); + +@@ -573,6 +576,7 @@ int drm_dev_init(struct drm_device *dev, + drm_fs_inode_free(dev->anon_inode); + err_free: + mutex_destroy(&dev->master_mutex); ++ mutex_destroy(&dev->clientlist_mutex); + return ret; + } + EXPORT_SYMBOL(drm_dev_init); +@@ -635,6 +639,7 @@ static void drm_dev_release(struct kref *ref) + drm_minor_free(dev, DRM_MINOR_CONTROL); + + mutex_destroy(&dev->master_mutex); ++ mutex_destroy(&dev->clientlist_mutex); + kfree(dev->unique); + kfree(dev); + } diff --git a/drivers/gpu/drm/drm_encoder_slave.c b/drivers/gpu/drm/drm_encoder_slave.c index 4484785cd9ac..95d5a5949753 100644 --- a/drivers/gpu/drm/drm_encoder_slave.c @@ -29082,6 +37257,482 @@ index 4484785cd9ac..95d5a5949753 100644 fail: return err; } +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index 2e85e609f125..053721cabaee 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -342,7 +342,7 @@ static int restore_fbdev_mode_atomic(struct drm_fb_helper *fb_helper) + goto fail; + } + +- plane_state->rotation = DRM_ROTATE_0; ++ plane_state->rotation = DRM_MODE_ROTATE_0; + + plane->old_fb = plane->fb; + plane_mask |= 1 << drm_plane_index(plane); +@@ -402,7 +402,7 @@ static int restore_fbdev_mode(struct drm_fb_helper *fb_helper) + if (dev->mode_config.rotation_property) { + drm_mode_plane_set_obj_prop(plane, + dev->mode_config.rotation_property, +- DRM_ROTATE_0); ++ DRM_MODE_ROTATE_0); + } + } + +diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c +index 246f818d0885..42191f10d037 100644 +--- a/drivers/gpu/drm/drm_fops.c ++++ b/drivers/gpu/drm/drm_fops.c +@@ -41,6 +41,7 @@ + #include "drm_legacy.h" + #include "drm_internal.h" + #include "drm_crtc_internal.h" ++#include + + /* from BKL pushdown */ + DEFINE_MUTEX(drm_global_mutex); +@@ -89,6 +90,158 @@ DEFINE_MUTEX(drm_global_mutex); + + static int drm_open_helper(struct file *filp, struct drm_minor *minor); + ++/** ++ * drm_file_alloc - allocate file context ++ * @minor: minor to allocate on ++ * ++ * This allocates a new DRM file context. It is not linked into any context and ++ * can be used by the caller freely. Note that the context keeps a pointer to ++ * @minor, so it must be freed before @minor is. ++ * ++ * RETURNS: ++ * Pointer to newly allocated context, ERR_PTR on failure. ++ */ ++struct drm_file *drm_file_alloc(struct drm_minor *minor) ++{ ++ struct drm_device *dev = minor->dev; ++ struct drm_file *file; ++ int ret; ++ ++ file = kzalloc(sizeof(*file), GFP_KERNEL); ++ if (!file) ++ return ERR_PTR(-ENOMEM); ++ ++ file->pid = get_pid(task_pid(current)); ++ file->minor = minor; ++ ++ /* for compatibility root is always authenticated */ ++ file->authenticated = capable(CAP_SYS_ADMIN); ++ file->lock_count = 0; ++ ++ INIT_LIST_HEAD(&file->lhead); ++ INIT_LIST_HEAD(&file->fbs); ++ mutex_init(&file->fbs_lock); ++ INIT_LIST_HEAD(&file->blobs); ++ INIT_LIST_HEAD(&file->pending_event_list); ++ INIT_LIST_HEAD(&file->event_list); ++ init_waitqueue_head(&file->event_wait); ++ file->event_space = 4096; /* set aside 4k for event buffer */ ++ ++ mutex_init(&file->event_read_lock); ++ ++ if (drm_core_check_feature(dev, DRIVER_GEM)) ++ drm_gem_open(dev, file); ++ ++ if (drm_core_check_feature(dev, DRIVER_PRIME)) ++ drm_prime_init_file_private(&file->prime); ++ ++ if (dev->driver->open) { ++ ret = dev->driver->open(dev, file); ++ if (ret < 0) ++ goto out_prime_destroy; ++ } ++ ++ return file; ++ ++out_prime_destroy: ++ if (drm_core_check_feature(dev, DRIVER_PRIME)) ++ drm_prime_destroy_file_private(&file->prime); ++ if (drm_core_check_feature(dev, DRIVER_GEM)) ++ drm_gem_release(dev, file); ++ put_pid(file->pid); ++ kfree(file); ++ ++ return ERR_PTR(ret); ++} ++ ++static void drm_events_release(struct drm_file *file_priv) ++{ ++ struct drm_device *dev = file_priv->minor->dev; ++ struct drm_pending_event *e, *et; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&dev->event_lock, flags); ++ ++ /* Unlink pending events */ ++ list_for_each_entry_safe(e, et, &file_priv->pending_event_list, ++ pending_link) { ++ list_del(&e->pending_link); ++ e->file_priv = NULL; ++ } ++ ++ /* Remove unconsumed events */ ++ list_for_each_entry_safe(e, et, &file_priv->event_list, link) { ++ list_del(&e->link); ++ kfree(e); ++ } ++ ++ spin_unlock_irqrestore(&dev->event_lock, flags); ++} ++ ++/** ++ * drm_file_free - free file context ++ * @file: context to free, or NULL ++ * ++ * This destroys and deallocates a DRM file context previously allocated via ++ * drm_file_alloc(). The caller must make sure to unlink it from any contexts ++ * before calling this. ++ * ++ * If NULL is passed, this is a no-op. ++ * ++ * RETURNS: ++ * 0 on success, or error code on failure. ++ */ ++void drm_file_free(struct drm_file *file) ++{ ++ struct drm_device *dev; ++ ++ if (!file) ++ return; ++ ++ dev = file->minor->dev; ++ ++ DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n", ++ task_pid_nr(current), ++ (long)old_encode_dev(file->minor->kdev->devt), ++ dev->open_count); ++ ++ if (drm_core_check_feature(dev, DRIVER_LEGACY) && ++ dev->driver->preclose) ++ dev->driver->preclose(dev, file); ++ ++ if (drm_core_check_feature(dev, DRIVER_LEGACY)) ++ drm_legacy_lock_release(dev, file->filp); ++ ++ if (drm_core_check_feature(dev, DRIVER_HAVE_DMA)) ++ drm_legacy_reclaim_buffers(dev, file); ++ ++ drm_events_release(file); ++ ++ if (drm_core_check_feature(dev, DRIVER_MODESET)) { ++ drm_fb_release(file); ++ drm_property_destroy_user_blobs(dev, file); ++ } ++ ++ if (drm_core_check_feature(dev, DRIVER_GEM)) ++ drm_gem_release(dev, file); ++ ++ drm_legacy_ctxbitmap_flush(dev, file); ++ ++ if (drm_is_primary_client(file)) ++ drm_master_release(file); ++ ++ if (dev->driver->postclose) ++ dev->driver->postclose(dev, file); ++ ++ if (drm_core_check_feature(dev, DRIVER_PRIME)) ++ drm_prime_destroy_file_private(&file->prime); ++ ++ WARN_ON(!list_empty(&file->event_list)); ++ ++ put_pid(file->pid); ++ kfree(file); ++} ++ + static int drm_setup(struct drm_device * dev) + { + int ret; +@@ -189,7 +342,7 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor) + { + struct drm_device *dev = minor->dev; + struct drm_file *priv; +- int ret; ++ int ret = 0; + + if (filp->f_flags & O_EXCL) + return -EBUSY; /* No exclusive opens */ +@@ -200,49 +353,22 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor) + + DRM_DEBUG("pid = %d, minor = %d\n", task_pid_nr(current), minor->index); + +- priv = kzalloc(sizeof(*priv), GFP_KERNEL); +- if (!priv) +- return -ENOMEM; +- +- filp->private_data = priv; +- filp->f_mode |= FMODE_UNSIGNED_OFFSET; +- priv->filp = filp; +- priv->pid = get_pid(task_pid(current)); +- priv->minor = minor; +- +- /* for compatibility root is always authenticated */ +- priv->authenticated = capable(CAP_SYS_ADMIN); +- priv->lock_count = 0; +- +- INIT_LIST_HEAD(&priv->lhead); +- INIT_LIST_HEAD(&priv->fbs); +- mutex_init(&priv->fbs_lock); +- INIT_LIST_HEAD(&priv->blobs); +- INIT_LIST_HEAD(&priv->pending_event_list); +- INIT_LIST_HEAD(&priv->event_list); +- init_waitqueue_head(&priv->event_wait); +- priv->event_space = 4096; /* set aside 4k for event buffer */ +- +- mutex_init(&priv->event_read_lock); +- +- if (drm_core_check_feature(dev, DRIVER_GEM)) +- drm_gem_open(dev, priv); +- +- if (drm_core_check_feature(dev, DRIVER_PRIME)) +- drm_prime_init_file_private(&priv->prime); +- +- if (dev->driver->open) { +- ret = dev->driver->open(dev, priv); +- if (ret < 0) +- goto out_prime_destroy; +- } ++ priv = drm_file_alloc(minor); ++ if (IS_ERR(priv)) ++ return PTR_ERR(priv); + + if (drm_is_primary_client(priv)) { + ret = drm_master_open(priv); +- if (ret) +- goto out_close; ++ if (ret) { ++ drm_file_free(priv); ++ return ret; ++ } + } + ++ filp->private_data = priv; ++ filp->f_mode |= FMODE_UNSIGNED_OFFSET; ++ priv->filp = filp; ++ + mutex_lock(&dev->filelist_mutex); + list_add(&priv->lhead, &dev->filelist); + mutex_unlock(&dev->filelist_mutex); +@@ -268,43 +394,6 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor) + #endif + + return 0; +- +-out_close: +- if (dev->driver->postclose) +- dev->driver->postclose(dev, priv); +-out_prime_destroy: +- if (drm_core_check_feature(dev, DRIVER_PRIME)) +- drm_prime_destroy_file_private(&priv->prime); +- if (drm_core_check_feature(dev, DRIVER_GEM)) +- drm_gem_release(dev, priv); +- put_pid(priv->pid); +- kfree(priv); +- filp->private_data = NULL; +- return ret; +-} +- +-static void drm_events_release(struct drm_file *file_priv) +-{ +- struct drm_device *dev = file_priv->minor->dev; +- struct drm_pending_event *e, *et; +- unsigned long flags; +- +- spin_lock_irqsave(&dev->event_lock, flags); +- +- /* Unlink pending events */ +- list_for_each_entry_safe(e, et, &file_priv->pending_event_list, +- pending_link) { +- list_del(&e->pending_link); +- e->file_priv = NULL; +- } +- +- /* Remove unconsumed events */ +- list_for_each_entry_safe(e, et, &file_priv->event_list, link) { +- list_del(&e->link); +- kfree(e); +- } +- +- spin_unlock_irqrestore(&dev->event_lock, flags); + } + + /* +@@ -355,6 +444,8 @@ void drm_lastclose(struct drm_device * dev) + + if (drm_core_check_feature(dev, DRIVER_LEGACY)) + drm_legacy_dev_reinit(dev); ++ ++ drm_client_dev_restore(dev); + } + + /** +@@ -384,53 +475,7 @@ int drm_release(struct inode *inode, struct file *filp) + list_del(&file_priv->lhead); + mutex_unlock(&dev->filelist_mutex); + +- if (dev->driver->preclose) +- dev->driver->preclose(dev, file_priv); +- +- /* ======================================================== +- * Begin inline drm_release +- */ +- +- DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n", +- task_pid_nr(current), +- (long)old_encode_dev(file_priv->minor->kdev->devt), +- dev->open_count); +- +- if (drm_core_check_feature(dev, DRIVER_LEGACY)) +- drm_legacy_lock_release(dev, filp); +- +- if (drm_core_check_feature(dev, DRIVER_HAVE_DMA)) +- drm_legacy_reclaim_buffers(dev, file_priv); +- +- drm_events_release(file_priv); +- +- if (drm_core_check_feature(dev, DRIVER_MODESET)) { +- drm_fb_release(file_priv); +- drm_property_destroy_user_blobs(dev, file_priv); +- } +- +- if (drm_core_check_feature(dev, DRIVER_GEM)) +- drm_gem_release(dev, file_priv); +- +- drm_legacy_ctxbitmap_flush(dev, file_priv); +- +- if (drm_is_primary_client(file_priv)) +- drm_master_release(file_priv); +- +- if (dev->driver->postclose) +- dev->driver->postclose(dev, file_priv); +- +- if (drm_core_check_feature(dev, DRIVER_PRIME)) +- drm_prime_destroy_file_private(&file_priv->prime); +- +- WARN_ON(!list_empty(&file_priv->event_list)); +- +- put_pid(file_priv->pid); +- kfree(file_priv); +- +- /* ======================================================== +- * End inline drm_release +- */ ++ drm_file_free(file_priv); + + if (!--dev->open_count) { + drm_lastclose(dev); +diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c +index f1aff9c644f8..e9cb7f09b0b2 100644 +--- a/drivers/gpu/drm/drm_framebuffer.c ++++ b/drivers/gpu/drm/drm_framebuffer.c +@@ -91,21 +91,20 @@ int drm_framebuffer_check_src_coords(uint32_t src_x, uint32_t src_y, + /** + * drm_mode_addfb - add an FB to the graphics configuration + * @dev: drm device for the ioctl +- * @data: data pointer for the ioctl +- * @file_priv: drm file for the ioctl call ++ * @or: pointer to request structure ++ * @file_priv: drm file + * + * Add a new FB to the specified CRTC, given a user request. This is the + * original addfb ioctl which only supported RGB formats. + * +- * Called by the user via ioctl. ++ * Called by the user via ioctl, or by an in-kernel client. + * + * Returns: + * Zero on success, negative errno on failure. + */ +-int drm_mode_addfb(struct drm_device *dev, +- void *data, struct drm_file *file_priv) ++int drm_mode_addfb(struct drm_device *dev, struct drm_mode_fb_cmd *or, ++ struct drm_file *file_priv) + { +- struct drm_mode_fb_cmd *or = data; + struct drm_mode_fb_cmd2 r = {}; + int ret; + +@@ -126,6 +125,12 @@ int drm_mode_addfb(struct drm_device *dev, + return 0; + } + ++int drm_mode_addfb_ioctl(struct drm_device *dev, ++ void *data, struct drm_file *file_priv) ++{ ++ return drm_mode_addfb(dev, data, file_priv); ++} ++ + static int format_check(const struct drm_mode_fb_cmd2 *r) + { + uint32_t format = r->pixel_format & ~DRM_FORMAT_BIG_ENDIAN; +@@ -406,29 +411,28 @@ static void drm_mode_rmfb_work_fn(struct work_struct *w) + + /** + * drm_mode_rmfb - remove an FB from the configuration +- * @dev: drm device for the ioctl +- * @data: data pointer for the ioctl +- * @file_priv: drm file for the ioctl call ++ * @dev: drm device ++ * @fb_id: id of framebuffer to remove ++ * @file_priv: drm file + * +- * Remove the FB specified by the user. ++ * Remove the specified FB. + * +- * Called by the user via ioctl. ++ * Called by the user via ioctl, or by an in-kernel client. + * + * Returns: + * Zero on success, negative errno on failure. + */ +-int drm_mode_rmfb(struct drm_device *dev, +- void *data, struct drm_file *file_priv) ++int drm_mode_rmfb(struct drm_device *dev, u32 fb_id, ++ struct drm_file *file_priv) + { + struct drm_framebuffer *fb = NULL; + struct drm_framebuffer *fbl = NULL; +- uint32_t *id = data; + int found = 0; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EINVAL; + +- fb = drm_framebuffer_lookup(dev, *id); ++ fb = drm_framebuffer_lookup(dev, fb_id); + if (!fb) + return -ENOENT; + +@@ -474,6 +478,14 @@ int drm_mode_rmfb(struct drm_device *dev, + return -ENOENT; + } + ++int drm_mode_rmfb_ioctl(struct drm_device *dev, ++ void *data, struct drm_file *file_priv) ++{ ++ uint32_t *fb_id = data; ++ ++ return drm_mode_rmfb(dev, *fb_id, file_priv); ++} ++ + /** + * drm_mode_getfb - get FB info + * @dev: drm device for the ioctl +@@ -705,6 +717,7 @@ int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb, + INIT_LIST_HEAD(&fb->filp_head); + fb->dev = dev; + fb->funcs = funcs; ++ strlcpy(fb->comm, current->comm, TASK_COMM_LEN); + + ret = drm_mode_object_get_reg(dev, &fb->base, DRM_MODE_OBJECT_FB, + false, drm_framebuffer_free); diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index ae5c0952a7a3..3133aa6e89c1 100644 --- a/drivers/gpu/drm/drm_gem.c @@ -29115,6 +37766,45 @@ index ae5c0952a7a3..3133aa6e89c1 100644 } /** +diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h +index 74fe334668de..8bf5728dd306 100644 +--- a/drivers/gpu/drm/drm_internal.h ++++ b/drivers/gpu/drm/drm_internal.h +@@ -29,6 +29,8 @@ extern unsigned int drm_timestamp_monotonic; + + /* drm_fops.c */ + extern struct mutex drm_global_mutex; ++struct drm_file *drm_file_alloc(struct drm_minor *minor); ++void drm_file_free(struct drm_file *file); + void drm_lastclose(struct drm_device *dev); + + /* drm_pci.c */ +@@ -68,7 +70,8 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data, + struct drm_file *file_priv); + int drm_master_open(struct drm_file *file_priv); + void drm_master_release(struct drm_file *file_priv); +- ++bool drm_master_internal_acquire(struct drm_device *dev); ++void drm_master_internal_release(struct drm_device *dev); + /* drm_sysfs.c */ + extern struct class *drm_class; + +diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c +index 04b26ca06180..c86f1ea85e81 100644 +--- a/drivers/gpu/drm/drm_ioctl.c ++++ b/drivers/gpu/drm/drm_ioctl.c +@@ -616,9 +616,9 @@ static const struct drm_ioctl_desc drm_ioctls[] = { + DRM_IOCTL_DEF(DRM_IOCTL_MODE_SETPROPERTY, drm_mode_connector_property_set_ioctl, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED), + DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETPROPBLOB, drm_mode_getblob_ioctl, DRM_CONTROL_ALLOW|DRM_UNLOCKED), + DRM_IOCTL_DEF(DRM_IOCTL_MODE_GETFB, drm_mode_getfb, DRM_CONTROL_ALLOW|DRM_UNLOCKED), +- DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB, drm_mode_addfb, DRM_CONTROL_ALLOW|DRM_UNLOCKED), ++ DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB, drm_mode_addfb_ioctl, DRM_CONTROL_ALLOW|DRM_UNLOCKED), + DRM_IOCTL_DEF(DRM_IOCTL_MODE_ADDFB2, drm_mode_addfb2, DRM_CONTROL_ALLOW|DRM_UNLOCKED), +- DRM_IOCTL_DEF(DRM_IOCTL_MODE_RMFB, drm_mode_rmfb, DRM_CONTROL_ALLOW|DRM_UNLOCKED), ++ DRM_IOCTL_DEF(DRM_IOCTL_MODE_RMFB, drm_mode_rmfb_ioctl, DRM_CONTROL_ALLOW|DRM_UNLOCKED), + DRM_IOCTL_DEF(DRM_IOCTL_MODE_PAGE_FLIP, drm_mode_page_flip_ioctl, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED), + DRM_IOCTL_DEF(DRM_IOCTL_MODE_DIRTYFB, drm_mode_dirtyfb_ioctl, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED), + DRM_IOCTL_DEF(DRM_IOCTL_MODE_CREATE_DUMB, drm_mode_create_dumb_ioctl, DRM_CONTROL_ALLOW|DRM_UNLOCKED), diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c index 161f36132f98..b53ffb65569f 100644 --- a/drivers/gpu/drm/drm_mipi_dsi.c @@ -29134,6 +37824,3859 @@ index 161f36132f98..b53ffb65569f 100644 if (err < 0) return err; +diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c +index 615c85ad56cd..5c0c30a2f9fd 100644 +--- a/drivers/gpu/drm/drm_modes.c ++++ b/drivers/gpu/drm/drm_modes.c +@@ -922,17 +922,68 @@ struct drm_display_mode *drm_mode_duplicate(struct drm_device *dev, + } + EXPORT_SYMBOL(drm_mode_duplicate); + ++static bool drm_mode_match_timings(const struct drm_display_mode *mode1, ++ const struct drm_display_mode *mode2) ++{ ++ return mode1->hdisplay == mode2->hdisplay && ++ mode1->hsync_start == mode2->hsync_start && ++ mode1->hsync_end == mode2->hsync_end && ++ mode1->htotal == mode2->htotal && ++ mode1->hskew == mode2->hskew && ++ mode1->vdisplay == mode2->vdisplay && ++ mode1->vsync_start == mode2->vsync_start && ++ mode1->vsync_end == mode2->vsync_end && ++ mode1->vtotal == mode2->vtotal && ++ mode1->vscan == mode2->vscan; ++} ++ ++static bool drm_mode_match_clock(const struct drm_display_mode *mode1, ++ const struct drm_display_mode *mode2) ++{ ++ /* ++ * do clock check convert to PICOS ++ * so fb modes get matched the same ++ */ ++ if (mode1->clock && mode2->clock) ++ return KHZ2PICOS(mode1->clock) == KHZ2PICOS(mode2->clock); ++ else ++ return mode1->clock == mode2->clock; ++} ++ ++static bool drm_mode_match_flags(const struct drm_display_mode *mode1, ++ const struct drm_display_mode *mode2) ++{ ++ return (mode1->flags & ~DRM_MODE_FLAG_3D_MASK) == ++ (mode2->flags & ~DRM_MODE_FLAG_3D_MASK); ++} ++ ++static bool drm_mode_match_3d_flags(const struct drm_display_mode *mode1, ++ const struct drm_display_mode *mode2) ++{ ++ return (mode1->flags & DRM_MODE_FLAG_3D_MASK) == ++ (mode2->flags & DRM_MODE_FLAG_3D_MASK); ++} ++ ++static bool drm_mode_match_aspect_ratio(const struct drm_display_mode *mode1, ++ const struct drm_display_mode *mode2) ++{ ++ return mode1->picture_aspect_ratio == mode2->picture_aspect_ratio; ++} ++ + /** +- * drm_mode_equal - test modes for equality ++ * drm_mode_match - test modes for (partial) equality + * @mode1: first mode + * @mode2: second mode ++ * @match_flags: which parts need to match (DRM_MODE_MATCH_*) + * + * Check to see if @mode1 and @mode2 are equivalent. + * + * Returns: +- * True if the modes are equal, false otherwise. ++ * True if the modes are (partially) equal, false otherwise. + */ +-bool drm_mode_equal(const struct drm_display_mode *mode1, const struct drm_display_mode *mode2) ++bool drm_mode_match(const struct drm_display_mode *mode1, ++ const struct drm_display_mode *mode2, ++ unsigned int match_flags) + { + if (!mode1 && !mode2) + return true; +@@ -940,15 +991,48 @@ bool drm_mode_equal(const struct drm_display_mode *mode1, const struct drm_displ + if (!mode1 || !mode2) + return false; + +- /* do clock check convert to PICOS so fb modes get matched +- * the same */ +- if (mode1->clock && mode2->clock) { +- if (KHZ2PICOS(mode1->clock) != KHZ2PICOS(mode2->clock)) +- return false; +- } else if (mode1->clock != mode2->clock) ++ if (match_flags & DRM_MODE_MATCH_TIMINGS && ++ !drm_mode_match_timings(mode1, mode2)) ++ return false; ++ ++ if (match_flags & DRM_MODE_MATCH_CLOCK && ++ !drm_mode_match_clock(mode1, mode2)) ++ return false; ++ ++ if (match_flags & DRM_MODE_MATCH_FLAGS && ++ !drm_mode_match_flags(mode1, mode2)) ++ return false; ++ ++ if (match_flags & DRM_MODE_MATCH_3D_FLAGS && ++ !drm_mode_match_3d_flags(mode1, mode2)) + return false; + +- return drm_mode_equal_no_clocks(mode1, mode2); ++ if (match_flags & DRM_MODE_MATCH_ASPECT_RATIO && ++ !drm_mode_match_aspect_ratio(mode1, mode2)) ++ return false; ++ ++ return true; ++} ++EXPORT_SYMBOL(drm_mode_match); ++ ++/** ++ * drm_mode_equal - test modes for equality ++ * @mode1: first mode ++ * @mode2: second mode ++ * ++ * Check to see if @mode1 and @mode2 are equivalent. ++ * ++ * Returns: ++ * True if the modes are equal, false otherwise. ++ */ ++bool drm_mode_equal(const struct drm_display_mode *mode1, ++ const struct drm_display_mode *mode2) ++{ ++ return drm_mode_match(mode1, mode2, ++ DRM_MODE_MATCH_TIMINGS | ++ DRM_MODE_MATCH_CLOCK | ++ DRM_MODE_MATCH_FLAGS | ++ DRM_MODE_MATCH_3D_FLAGS); + } + EXPORT_SYMBOL(drm_mode_equal); + +@@ -963,13 +1047,13 @@ EXPORT_SYMBOL(drm_mode_equal); + * Returns: + * True if the modes are equal, false otherwise. + */ +-bool drm_mode_equal_no_clocks(const struct drm_display_mode *mode1, const struct drm_display_mode *mode2) ++bool drm_mode_equal_no_clocks(const struct drm_display_mode *mode1, ++ const struct drm_display_mode *mode2) + { +- if ((mode1->flags & DRM_MODE_FLAG_3D_MASK) != +- (mode2->flags & DRM_MODE_FLAG_3D_MASK)) +- return false; +- +- return drm_mode_equal_no_clocks_no_stereo(mode1, mode2); ++ return drm_mode_match(mode1, mode2, ++ DRM_MODE_MATCH_TIMINGS | ++ DRM_MODE_MATCH_FLAGS | ++ DRM_MODE_MATCH_3D_FLAGS); + } + EXPORT_SYMBOL(drm_mode_equal_no_clocks); + +@@ -987,22 +1071,9 @@ EXPORT_SYMBOL(drm_mode_equal_no_clocks); + bool drm_mode_equal_no_clocks_no_stereo(const struct drm_display_mode *mode1, + const struct drm_display_mode *mode2) + { +- if (mode1->hdisplay == mode2->hdisplay && +- mode1->hsync_start == mode2->hsync_start && +- mode1->hsync_end == mode2->hsync_end && +- mode1->htotal == mode2->htotal && +- mode1->hskew == mode2->hskew && +- mode1->vdisplay == mode2->vdisplay && +- mode1->vsync_start == mode2->vsync_start && +- mode1->vsync_end == mode2->vsync_end && +- mode1->vtotal == mode2->vtotal && +- mode1->vscan == mode2->vscan && +- mode1->picture_aspect_ratio == mode2->picture_aspect_ratio && +- (mode1->flags & ~DRM_MODE_FLAG_3D_MASK) == +- (mode2->flags & ~DRM_MODE_FLAG_3D_MASK)) +- return true; +- +- return false; ++ return drm_mode_match(mode1, mode2, ++ DRM_MODE_MATCH_TIMINGS | ++ DRM_MODE_MATCH_FLAGS); + } + EXPORT_SYMBOL(drm_mode_equal_no_clocks_no_stereo); + +diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c +index 7899fc1dcdb0..62d459753424 100644 +--- a/drivers/gpu/drm/drm_plane_helper.c ++++ b/drivers/gpu/drm/drm_plane_helper.c +@@ -246,7 +246,6 @@ int drm_plane_helper_check_update(struct drm_plane *plane, + .crtc_w = drm_rect_width(dst), + .crtc_h = drm_rect_height(dst), + .rotation = rotation, +- .visible = *visible, + }; + int ret; + +@@ -337,7 +336,7 @@ int drm_primary_helper_update(struct drm_plane *plane, struct drm_crtc *crtc, + + ret = drm_plane_helper_check_update(plane, crtc, fb, + &src, &dest, &clip, +- DRM_ROTATE_0, ++ DRM_MODE_ROTATE_0, + DRM_PLANE_HELPER_NO_SCALING, + DRM_PLANE_HELPER_NO_SCALING, + false, false, &visible); +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index b33d39d9dd14..5a6331b60a94 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + + /** + * DOC: output probing helper overview +@@ -376,6 +377,8 @@ void drm_kms_helper_hotplug_event(struct drm_device *dev) + drm_sysfs_hotplug_event(dev); + if (dev->mode_config.funcs->output_poll_changed) + dev->mode_config.funcs->output_poll_changed(dev); ++ ++ drm_client_dev_hotplug(dev); + } + EXPORT_SYMBOL(drm_kms_helper_hotplug_event); + +diff --git a/drivers/gpu/drm/drm_rect.c b/drivers/gpu/drm/drm_rect.c +index 73e53a8d1b37..168fe20c440b 100644 +--- a/drivers/gpu/drm/drm_rect.c ++++ b/drivers/gpu/drm/drm_rect.c +@@ -317,38 +317,38 @@ void drm_rect_rotate(struct drm_rect *r, + { + struct drm_rect tmp; + +- if (rotation & (DRM_REFLECT_X | DRM_REFLECT_Y)) { ++ if (rotation & (DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y)) { + tmp = *r; + +- if (rotation & DRM_REFLECT_X) { ++ if (rotation & DRM_MODE_REFLECT_X) { + r->x1 = width - tmp.x2; + r->x2 = width - tmp.x1; + } + +- if (rotation & DRM_REFLECT_Y) { ++ if (rotation & DRM_MODE_REFLECT_Y) { + r->y1 = height - tmp.y2; + r->y2 = height - tmp.y1; + } + } + +- switch (rotation & DRM_ROTATE_MASK) { +- case DRM_ROTATE_0: ++ switch (rotation & DRM_MODE_ROTATE_MASK) { ++ case DRM_MODE_ROTATE_0: + break; +- case DRM_ROTATE_90: ++ case DRM_MODE_ROTATE_90: + tmp = *r; + r->x1 = tmp.y1; + r->x2 = tmp.y2; + r->y1 = width - tmp.x2; + r->y2 = width - tmp.x1; + break; +- case DRM_ROTATE_180: ++ case DRM_MODE_ROTATE_180: + tmp = *r; + r->x1 = width - tmp.x2; + r->x2 = width - tmp.x1; + r->y1 = height - tmp.y2; + r->y2 = height - tmp.y1; + break; +- case DRM_ROTATE_270: ++ case DRM_MODE_ROTATE_270: + tmp = *r; + r->x1 = height - tmp.y2; + r->x2 = height - tmp.y1; +@@ -391,24 +391,24 @@ void drm_rect_rotate_inv(struct drm_rect *r, + { + struct drm_rect tmp; + +- switch (rotation & DRM_ROTATE_MASK) { +- case DRM_ROTATE_0: ++ switch (rotation & DRM_MODE_ROTATE_MASK) { ++ case DRM_MODE_ROTATE_0: + break; +- case DRM_ROTATE_90: ++ case DRM_MODE_ROTATE_90: + tmp = *r; + r->x1 = width - tmp.y2; + r->x2 = width - tmp.y1; + r->y1 = tmp.x1; + r->y2 = tmp.x2; + break; +- case DRM_ROTATE_180: ++ case DRM_MODE_ROTATE_180: + tmp = *r; + r->x1 = width - tmp.x2; + r->x2 = width - tmp.x1; + r->y1 = height - tmp.y2; + r->y2 = height - tmp.y1; + break; +- case DRM_ROTATE_270: ++ case DRM_MODE_ROTATE_270: + tmp = *r; + r->x1 = tmp.y1; + r->x2 = tmp.y2; +@@ -419,15 +419,15 @@ void drm_rect_rotate_inv(struct drm_rect *r, + break; + } + +- if (rotation & (DRM_REFLECT_X | DRM_REFLECT_Y)) { ++ if (rotation & (DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y)) { + tmp = *r; + +- if (rotation & DRM_REFLECT_X) { ++ if (rotation & DRM_MODE_REFLECT_X) { + r->x1 = width - tmp.x2; + r->x2 = width - tmp.x1; + } + +- if (rotation & DRM_REFLECT_Y) { ++ if (rotation & DRM_MODE_REFLECT_Y) { + r->y1 = height - tmp.y2; + r->y2 = height - tmp.y1; + } +diff --git a/drivers/gpu/drm/drm_splash.h b/drivers/gpu/drm/drm_splash.h +new file mode 100644 +index 000000000000..0d72a06167a3 +--- /dev/null ++++ b/drivers/gpu/drm/drm_splash.h +@@ -0,0 +1,3527 @@ ++/* Copyright (c) 2013, 2018, 2021, The Linux Foundation. All rights reserved. ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 and ++ * only version 2 as published by the Free Software Foundation. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ */ ++ ++#ifndef __SPLASH_H_ ++#define __SPLASH_H_ ++ ++#define SPLASH_IMAGE_WIDTH 113 ++#define SPLASH_IMAGE_HEIGHT 124 ++#define SPLASH_IMAGE_FORMAT DRM_FORMAT_XBGR8888 ++ ++static u32 splash_bgr888_image[] = { ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00192910, 0x00293131, 0x00293131, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00100808, 0x00293131, 0x004A524A, ++ 0x00735A6B, 0x004A524A, 0x00192910, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00100808, 0x00293131, ++ 0x00735A6B, 0x00737B6B, 0x004A5A6B, 0x00293131, ++ 0x0021103A, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00100808, 0x00000000, ++ 0x00000000, 0x00100808, 0x00002110, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000000, 0x00100808, ++ 0x00293131, 0x004A5A6B, 0x00735A6B, 0x004A313A, ++ 0x00293131, 0x00192910, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00100808, 0x00293131, 0x004A313A, 0x00293131, ++ 0x00192910, 0x00100808, 0x00100808, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00100808, 0x00002110, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00100808, 0x00100808, 0x00100808, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00100808, 0x00000000, ++ 0x00000008, 0x00000000, 0x00100808, 0x00000000, ++ 0x00000008, 0x00000000, 0x00002110, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00002110, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00100808, 0x00000000, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00002110, 0x00100808, ++ 0x00100808, 0x00192910, 0x00192910, 0x00100808, ++ 0x00000000, 0x00000000, 0x00100808, 0x00000008, ++ 0x00000000, 0x00100808, 0x00000000, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000008, 0x00100808, ++ 0x004A524A, 0x00100808, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00100808, ++ 0x00000000, 0x00000008, 0x00000008, 0x00100808, ++ 0x00293131, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00192910, 0x004A524A, 0x004A313A, ++ 0x00000008, 0x00100808, 0x004A524A, 0x00000008, ++ 0x00000000, 0x00100808, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x004A524A, 0x0094A59C, 0x00947B9C, ++ 0x00100808, 0x00100808, 0x00192910, 0x00000000, ++ 0x00000008, 0x00000000, 0x00100808, 0x00002110, ++ 0x00100808, 0x00737B6B, 0x00947B9C, 0x0094A59C, ++ 0x00ADADCE, 0x00B5B5A5, 0x00293131, 0x00100808, ++ 0x00192910, 0x00000008, 0x00000000, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x004A524A, 0x00AD9CA5, 0x00ADADCE, ++ 0x00CEDECE, 0x00947B9C, 0x00192910, 0x0000083A, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00100808, 0x00947B9C, 0x0094A59C, 0x00B5B5A5, ++ 0x00B5B5A5, 0x00CEDECE, 0x00D6ADC5, 0x0094A59C, ++ 0x0021103A, 0x00000000, 0x00100808, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00100808, 0x00947B9C, 0x00ADADCE, ++ 0x00EFE6CE, 0x00EFE6CE, 0x00DEDEE6, 0x00AD9CA5, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00735A6B, 0x00CEDECE, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00CEDECE, 0x00737B6B, 0x00000000, 0x00000000, ++ 0x00000000, 0x00002110, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00192910, 0x00E6F7EF, ++ 0x00FFF7EF, 0x0094A59C, 0x00CEDECE, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00002110, 0x00CEDECE, 0x00FFF7FF, ++ 0x00FFF7FF, 0x0094A59C, 0x00000000, 0x00293131, ++ 0x00E6F7EF, 0x00FFF7FF, 0x00EFDEEF, 0x00100808, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000008, 0x004A524A, ++ 0x00FFF7FF, 0x00192910, 0x00100808, 0x004A524A, ++ 0x00ADADCE, 0x00FFFFFF, 0x004A524A, 0x00100808, ++ 0x00000000, 0x00100808, 0x00100808, 0x00ADADCE, ++ 0x00FFF7EF, 0x00CEDECE, 0x00000000, 0x00100808, ++ 0x00947B9C, 0x00293131, 0x00E6F7EF, 0x00FFFFFF, ++ 0x004A524A, 0x00000000, 0x00000008, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00735A6B, 0x00E6F7EF, 0x00000000, 0x00000008, ++ 0x00737B6B, 0x00100808, 0x00FFFFFF, 0x00737B6B, ++ 0x00100808, 0x00293131, 0x004A524A, 0x00100808, ++ 0x00CEDECE, 0x00FFFFFF, 0x00192910, 0x00000000, ++ 0x00000000, 0x00293131, 0x004A524A, 0x00B5B5A5, ++ 0x00FFFFFF, 0x00947B9C, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x004A524A, 0x00DEDEE6, 0x00100808, ++ 0x00000000, 0x00293131, 0x00100808, 0x00FFFFFF, ++ 0x004A524A, 0x00000008, 0x00100808, 0x00000000, ++ 0x00100808, 0x00947B9C, 0x00FFFFFF, 0x0021103A, ++ 0x00000008, 0x00000000, 0x00100808, 0x00100808, ++ 0x00735A6B, 0x00FFFFFF, 0x00B5B5A5, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x004A524A, 0x00FFF7EF, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00DEDEE6, 0x005A3108, 0x009C7B10, 0x009C7B10, ++ 0x009C7B10, 0x007B5210, 0x00293131, 0x00FFF7EF, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x0094A59C, 0x00FFFFFF, 0x00AD9CA5, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00002110, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00100808, ++ 0x00FFF7FF, 0x004A524A, 0x00000000, 0x00000000, ++ 0x005A3108, 0x00BD8400, 0x00D6AD08, 0x00EFBD00, ++ 0x00EFBD00, 0x00D69C00, 0x00ADA508, 0x00D6AD08, ++ 0x00CECE10, 0x009C7B6B, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00FFF7EF, 0x00FFFFFF, ++ 0x004A5A6B, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000008, 0x00CEDECE, 0x00FFF7FF, 0x00192910, ++ 0x009C5A10, 0x00D69C00, 0x00CE9419, 0x00F7BD00, ++ 0x00EFC510, 0x00D6AD08, 0x00D6AD08, 0x00D6AD08, ++ 0x00D6AD08, 0x00EFC510, 0x00EFBD00, 0x00ADA508, ++ 0x005A3108, 0x00192910, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00DEDEE6, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000000, 0x00100808, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00735A6B, 0x00E6F7EF, ++ 0x00BD7B19, 0x00BD7B19, 0x00D6AD08, 0x00EFBD00, ++ 0x00EFC510, 0x00EFBD00, 0x00EFC510, 0x00EFC510, ++ 0x00EFDE3A, 0x00F7BD19, 0x00EFDE3A, 0x00EFDE3A, ++ 0x00EFC510, 0x00EFC510, 0x00D6AD08, 0x00CE9419, ++ 0x00B5B5A5, 0x00735A4A, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00100808, ++ 0x009C7B10, 0x00BD8400, 0x00D6AD08, 0x00D6AD08, ++ 0x00EFAD08, 0x00EFC510, 0x00D6AD08, 0x00EFC510, ++ 0x00EFE610, 0x00F7BD19, 0x00EFDE3A, 0x00EFDE3A, ++ 0x00EFC510, 0x00EFE610, 0x00EFE610, 0x00EFC510, ++ 0x00EFE610, 0x00F7BD19, 0x00D6AD08, 0x003A3108, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00100808, ++ 0x009C7B10, 0x00BD8400, 0x00CE9419, 0x00D69C00, ++ 0x00EFC510, 0x00EFAD08, 0x00EFC510, 0x00EFC510, ++ 0x00EFC510, 0x00EFC510, 0x00EFE66B, 0x00EFDE3A, ++ 0x00EFE610, 0x00EFE610, 0x00EFC510, 0x00EFE610, ++ 0x00EFC510, 0x00EFE610, 0x00EFC510, 0x00F7BD19, ++ 0x00BD7B19, 0x00000000, 0x00002110, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x005A3108, 0x00BD8400, 0x00BD8400, 0x00D69C00, ++ 0x00EFAD08, 0x00EFAD08, 0x00EFC510, 0x00EFBD00, ++ 0x00EFC510, 0x00EFC510, 0x00EFE610, 0x00EFDE3A, ++ 0x00F7BD19, 0x00F7BD19, 0x00EFE610, 0x00EFC510, ++ 0x00EFE610, 0x00F7BD19, 0x00BD8400, 0x009C7B10, ++ 0x00EFBD00, 0x007B7310, 0x00000000, 0x00000000, ++ 0x00000000, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x007B5210, 0x00BD7B19, 0x00D69C00, ++ 0x00CE9419, 0x00EFAD08, 0x00EFAD08, 0x00EFC510, ++ 0x00D6AD08, 0x00EFE610, 0x00F7BD19, 0x00EFE66B, ++ 0x00F7BD19, 0x00EFE610, 0x00EFE610, 0x00EFE610, ++ 0x00EFC510, 0x00D69C00, 0x00BD8400, 0x00D69C00, ++ 0x00CE9419, 0x00D69C00, 0x007B5210, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00100808, 0x005A3108, ++ 0x00ADA508, 0x00EFAD08, 0x00EFBD00, 0x00EFC510, ++ 0x00EFC510, 0x00EFC510, 0x00EFC510, 0x00EFE610, ++ 0x00F7BD19, 0x00EFE610, 0x00EFC510, 0x00EFC510, ++ 0x00F7BD19, 0x009C7B10, 0x00BD8400, 0x00CE9419, ++ 0x00D6AD08, 0x00D69C00, 0x00CE9419, 0x003A3108, ++ 0x00000000, 0x00000000, 0x00100808, 0x00293131, ++ 0x00000000, 0x00000000, 0x00100808, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x003A3108, 0x007B5210, 0x009C7B10, 0x00EFAD08, ++ 0x00EFAD08, 0x00EFC510, 0x00EFC510, 0x00EFDE3A, ++ 0x00EFE610, 0x00EFC510, 0x00EFE610, 0x00D6AD08, ++ 0x009C5A10, 0x009C5A10, 0x00D69C00, 0x00CE9419, ++ 0x00D69C00, 0x00D69C00, 0x00BD7B19, 0x00BD7B19, ++ 0x00100808, 0x00000000, 0x00000000, 0x00100808, ++ 0x00737B9C, 0x00735A6B, 0x00192910, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00100808, 0x00ADA573, 0x007B5210, ++ 0x007B5210, 0x00BD8400, 0x00ADA508, 0x00D6AD08, ++ 0x00CE9419, 0x00BD8400, 0x007B7310, 0x009C5A10, ++ 0x00BD8400, 0x00D69C00, 0x00D69C00, 0x00D69C00, ++ 0x00D69C00, 0x00BD8400, 0x00CEA53A, 0x00ADADCE, ++ 0x00CEDECE, 0x00735A6B, 0x00000000, 0x00000000, ++ 0x00000000, 0x004A524A, 0x009C7B6B, 0x00737B9C, ++ 0x00293131, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00293131, 0x00D6ADC5, ++ 0x00A5A552, 0x009C5A10, 0x009C7B10, 0x00CE9419, ++ 0x00D6AD08, 0x00D6AD08, 0x00CE9419, 0x00D69C00, ++ 0x00D69C00, 0x00BD8400, 0x00BD8400, 0x00CE9419, ++ 0x00BD8400, 0x00BD7B19, 0x00ADADCE, 0x00CEDECE, ++ 0x00CEDECE, 0x00B5B5A5, 0x00B5B5A5, 0x00000000, ++ 0x00000000, 0x00000000, 0x00002110, 0x00737B6B, ++ 0x00947B9C, 0x00737B6B, 0x00100808, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00100808, 0x004A524A, ++ 0x00ADD6A5, 0x00D6ADC5, 0x009C7B4A, 0x009C5A10, ++ 0x00BD8400, 0x00D69C00, 0x00BD8400, 0x00D69C00, ++ 0x00CE9419, 0x00BD8400, 0x00CE9419, 0x00BD8400, ++ 0x00BD7B19, 0x00ADA573, 0x00B5B5A5, 0x00D6ADC5, ++ 0x00B5B5A5, 0x00DEDEE6, 0x00CEDECE, 0x00ADADCE, ++ 0x00192910, 0x00000008, 0x00000000, 0x00000000, ++ 0x004A524A, 0x00737B6B, 0x00293131, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x004A313A, 0x00ADADCE, 0x00CEDECE, 0x00B5B5A5, ++ 0x00ADA573, 0x007B7310, 0x009C5A10, 0x009C7B10, ++ 0x00BD5A10, 0x009C7B10, 0x009C5A10, 0x009C5A10, ++ 0x00BD7B19, 0x00B5B5A5, 0x00B5B5A5, 0x00D6ADC5, ++ 0x00ADD6A5, 0x00EFDEEF, 0x00E6F7EF, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00AD9CA5, 0x00100808, 0x00000008, ++ 0x00000000, 0x00000008, 0x00100808, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000008, 0x004A524A, 0x00DEDEE6, 0x00D6ADC5, ++ 0x00B5B5A5, 0x00ADADCE, 0x00CEAD9C, 0x00A5A552, ++ 0x009C5A10, 0x009C7B10, 0x009C5A10, 0x00A5A552, ++ 0x00ADA573, 0x00D6ADC5, 0x00B5B5A5, 0x00CEDECE, ++ 0x00CEDECE, 0x00EFDEEF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7FF, 0x00FFF7EF, 0x00E6F7EF, 0x00100808, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00E6F7EF, 0x00E6F7EF, ++ 0x00CEDECE, 0x00CEDECE, 0x00B5B5A5, 0x00CEDECE, ++ 0x00ADADCE, 0x00CEDECE, 0x00B5B5A5, 0x00CEDECE, ++ 0x00ADADCE, 0x00D6ADC5, 0x00ADD6A5, 0x00ADADCE, ++ 0x00CEDECE, 0x00DEDEE6, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00B5B5A5, 0x00100808, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00100808, 0x00000000, ++ 0x00000000, 0x00000008, 0x00100808, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00100808, ++ 0x00002110, 0x00000000, 0x0094A59C, 0x00FFF7FF, ++ 0x00FFF7FF, 0x00E6F7EF, 0x00D6ADC5, 0x00B5B5A5, ++ 0x00ADADCE, 0x00D6ADC5, 0x00B5B5A5, 0x00ADADCE, ++ 0x00D6ADC5, 0x00ADD6A5, 0x00D6ADC5, 0x00CEDECE, ++ 0x00EFDEEF, 0x00E6F7EF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00293131, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00100808, ++ 0x00100808, 0x00100808, 0x00192910, 0x00EFDEEF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00D6ADC5, 0x00ADD6A5, 0x00B5B5A5, 0x00CEDECE, ++ 0x00B5B5A5, 0x00CEDECE, 0x00ADADCE, 0x00CEDECE, ++ 0x00E6F7EF, 0x00FFF7EF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00DEDEE6, ++ 0x00100808, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00002110, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000008, 0x00000008, 0x00DEDEE6, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00DEDEE6, 0x00ADADCE, 0x00D6ADC5, ++ 0x00B5B5A5, 0x00ADADCE, 0x00CEDECE, 0x00EFE6CE, ++ 0x00FFF7FF, 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00000000, 0x00000000, 0x00100808, ++ 0x00000000, 0x00000008, 0x00100808, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x004A524A, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00E6F7EF, ++ 0x00DEDEE6, 0x00E6F7EF, 0x00EFE6CE, 0x00FFF7FF, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00AD9CA5, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000008, 0x00000000, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00DEDEE6, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x004A524A, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00100808, 0x00CEDECE, 0x00EFDEEF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFF7EF, 0x00293131, 0x00000000, ++ 0x00000008, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00100808, 0x00ADADCE, 0x00E6F7EF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00E6F7EF, 0x00EFDEEF, 0x00E6F7EF, 0x0094A59C, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00002110, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00293131, 0x00B5B5A5, ++ 0x00CEDECE, 0x00E6F7EF, 0x00FFF7EF, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00E6F7EF, ++ 0x00EFDEEF, 0x00E6F7EF, 0x00DEDEE6, 0x00EFE6CE, ++ 0x00FFF7FF, 0x00E6F7EF, 0x00FFF7FF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFF7EF, 0x00E6F7EF, ++ 0x00E6F7EF, 0x00EFDEEF, 0x00EFE6CE, 0x00DEDEE6, ++ 0x00DEDEE6, 0x00CEDECE, 0x00CEDECE, 0x00DEDEE6, ++ 0x00ADADCE, 0x00100808, 0x00000000, 0x00002110, ++ 0x00000000, 0x00100808, 0x00000000, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00100808, 0x004A5A6B, ++ 0x00ADA573, 0x00ADADCE, 0x00D6ADC5, 0x00DEDEE6, ++ 0x00DEDEE6, 0x00FFF7FF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00EFDEEF, 0x00CEDECE, 0x00EFDEEF, ++ 0x00E6F7EF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, 0x00EFDEEF, ++ 0x00CEDECE, 0x00D6ADC5, 0x00CEDECE, 0x00ADADCE, ++ 0x00CEDECE, 0x00B5B5A5, 0x00D6ADC5, 0x00B5B5A5, ++ 0x00D6ADC5, 0x00FFF7EF, 0x004A524A, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00100808, 0x00000000, 0x00192910, ++ 0x00735A6B, 0x00ADADCE, 0x00CEDECE, 0x00CEDECE, ++ 0x00E6F7EF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00EFDEEF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7FF, 0x00E6F7EF, 0x00DEDEE6, ++ 0x00CEDECE, 0x00D6ADC5, 0x00CEDECE, 0x00ADADCE, ++ 0x00CEDECE, 0x00B5B5A5, 0x00CEDECE, 0x00FFF7FF, ++ 0x00293131, 0x00000000, 0x00000008, 0x004A524A, ++ 0x00293131, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000008, ++ 0x00100808, 0x00AD9CA5, 0x00CEDECE, 0x00EFE6CE, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFF7FF, 0x00E6F7EF, ++ 0x00E6F7EF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00EFE6CE, ++ 0x00DEDEE6, 0x00CEDECE, 0x00D6ADC5, 0x00ADADCE, ++ 0x00DEDEE6, 0x00FFF7FF, 0x00100808, 0x00000000, ++ 0x00000000, 0x00100808, 0x00293131, 0x0021103A, ++ 0x00000008, 0x00000000, 0x00000000, 0x00100808, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00100808, 0x00293131, 0x00000000, ++ 0x00002110, 0x00735A6B, 0x00CEDECE, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00CEDECE, ++ 0x00CEDECE, 0x00CEAD9C, 0x00E6F7EF, 0x00AD9CA5, ++ 0x00000000, 0x00000000, 0x00000000, 0x00100808, ++ 0x004A313A, 0x00192910, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x004A524A, 0x00000000, ++ 0x00000000, 0x00100808, 0x00DEDEE6, 0x00E6F7EF, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFF7FF, 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFF7FF, ++ 0x00FFF7EF, 0x00EFDEEF, 0x00ADE6CE, 0x00D6ADC5, ++ 0x00FFFFFF, 0x00192910, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00293131, 0x00100808, ++ 0x00000000, 0x00002110, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00192910, 0x00100808, ++ 0x00000008, 0x00000000, 0x00735A6B, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00EFDEEF, ++ 0x00CEDECE, 0x00CEDECE, 0x00ADADCE, 0x00000000, ++ 0x00000000, 0x00002110, 0x00100808, 0x00100808, ++ 0x004A524A, 0x00000000, 0x00000000, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000008, 0x004A524A, ++ 0x00000008, 0x00000008, 0x00000000, 0x00E6F7EF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00EFDEEF, 0x00CEDECE, 0x00FFF7EF, ++ 0x00100808, 0x00000000, 0x0021103A, 0x00293131, ++ 0x00293131, 0x00100808, 0x00192910, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00192910, ++ 0x0021103A, 0x00000000, 0x00000000, 0x00947B9C, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7FF, ++ 0x00FFFFFF, 0x004A524A, 0x00000000, 0x00192910, ++ 0x004A524A, 0x00293131, 0x00100808, 0x004A313A, ++ 0x00100808, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x004A524A, 0x00000000, 0x00000000, 0x00100808, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00CEDECE, 0x0021103A, ++ 0x00192910, 0x004A313A, 0x0021103A, 0x00002110, ++ 0x00100808, 0x00293131, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00100808, 0x0021103A, 0x00000000, 0x00000000, ++ 0x00947B9C, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00DEDEE6, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00000000, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x004A524A, 0x00100808, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x004A524A, 0x00000000, 0x00000000, ++ 0x00100808, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00EFE6CE, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFF7FF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x0021103A, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00293131, ++ 0x00100808, 0x00000008, 0x00000000, 0x00100808, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00293131, 0x00000000, ++ 0x00000000, 0x004A524A, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7FF, 0x00DEDEE6, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x004A524A, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00100808, 0x00293131, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00293131, 0x00100808, ++ 0x00000000, 0x00000000, 0x00DEDEE6, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00DEDEE6, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7FF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7FF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00947B9C, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000008, 0x00100808, 0x00192910, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x004A524A, ++ 0x00000000, 0x00000000, 0x00192910, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00EFE6CE, 0x00FFFFFF, 0x00FFF7FF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00B5B5A5, 0x00000000, 0x00000000, 0x00000008, ++ 0x00100808, 0x00000000, 0x00100808, 0x0021103A, ++ 0x00000000, 0x00000000, 0x00000000, 0x00002110, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00293131, 0x00000000, 0x00000000, 0x004A524A, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7FF, 0x00E6F7EF, 0x00DEDEE6, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFF7FF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00CEDECE, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000008, 0x00192910, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00100808, 0x00293131, 0x00100808, 0x00000000, ++ 0x00ADADCE, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00EFDEEF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000008, ++ 0x00192910, 0x00000008, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00002110, 0x004A313A, 0x00000000, ++ 0x00000000, 0x00EFE6CE, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00FFF7FF, 0x00EFE6CE, ++ 0x00DEDEE6, 0x00FFF7EF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x004A313A, 0x00100808, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000008, 0x00000000, 0x00100808, 0x004A524A, ++ 0x00000000, 0x00000008, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00DEDEE6, 0x00DEDEE6, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x004A524A, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x0021103A, ++ 0x004A524A, 0x00000000, 0x00100808, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00EFE6CE, 0x00DEDEE6, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000008, 0x00192910, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00100808, ++ 0x004A313A, 0x00737B6B, 0x00000008, 0x00192910, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00DEDEE6, 0x00E6F7EF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7FF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00192910, ++ 0x00100808, 0x00000008, 0x00000000, 0x00000008, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00192910, 0x00735A6B, 0x00000008, ++ 0x00192910, 0x00FFF7FF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00DEDEE6, ++ 0x00DEDEE6, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00000000, 0x00000008, 0x00000000, 0x00100808, ++ 0x00293131, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00293131, ++ 0x00000008, 0x00293131, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7FF, 0x00FFF7EF, ++ 0x00DEDEE6, 0x00E6F7EF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00DEDEE6, 0x00000000, 0x00000000, 0x00000000, ++ 0x00100808, 0x00192910, 0x00100808, 0x00000008, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x004A313A, 0x00293131, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7FF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00DEDEE6, 0x00EFE6CE, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFF7EF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00B5B5A5, 0x00000000, 0x00002110, ++ 0x004A313A, 0x00192910, 0x0000083A, 0x00100808, ++ 0x00100808, 0x00293131, 0x00293131, 0x00192910, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00100808, 0x009C7B10, 0x00EFC510, 0x00EFC510, ++ 0x009C7B10, 0x00000000, 0x00000000, 0x004A524A, ++ 0x00E6F7EF, 0x00FFF7FF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFF7FF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00DEDEE6, 0x00E6F7EF, ++ 0x00FFF7FF, 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x004A5A6B, 0x00100808, ++ 0x00100808, 0x00000008, 0x00000008, 0x00100808, ++ 0x00000000, 0x00000008, 0x00100808, 0x00000000, ++ 0x0021103A, 0x00735A6B, 0x00192910, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00CE9419, 0x00EFAD08, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00D6AD08, 0x00000000, ++ 0x00000000, 0x00735A4A, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00DEDEE6, ++ 0x00EFDEEF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFF7EF, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00EFE6CE, 0x00EFE6CE, 0x00EFE6CE, 0x00421008, ++ 0x00192910, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00293131, 0x004A524A, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00BD7B19, 0x00D69C00, 0x00EFC510, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00D69C00, 0x00000008, 0x00000008, 0x004A524A, ++ 0x00EFDEEF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00DEDEE6, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFF7EF, ++ 0x00D6AD08, 0x00F7BD19, 0x00EFBD00, 0x00EFC510, ++ 0x00EFC510, 0x00100808, 0x00100808, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00100808, 0x00293131, ++ 0x00192910, 0x0021103A, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00BD8400, 0x00D6AD08, ++ 0x00EFAD08, 0x00EFAD08, 0x00EFC510, 0x00F7BD00, ++ 0x00EFC510, 0x00F7BD00, 0x00BD7B19, 0x00000000, ++ 0x00000000, 0x00293131, 0x00DEDEE6, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00EFE6CE, 0x00E6F7EF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00EFE6CE, 0x00EFAD08, 0x00F7BD00, 0x00EFE610, ++ 0x00EFC510, 0x00EFE610, 0x00100808, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000008, 0x00192910, ++ 0x00192910, 0x00000000, 0x00BD8400, 0x00EFE610, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00BD7B19, 0x00D69C00, ++ 0x00EFAD08, 0x00EFC510, 0x00F7BD19, 0x00F7BD00, ++ 0x00EFAD08, 0x00F7BD19, 0x00EFBD00, 0x00EFC510, ++ 0x009C5A10, 0x00000000, 0x00000000, 0x00192910, ++ 0x00CEDECE, 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00DEDEE6, 0x00EFDEEF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00EFE6CE, 0x00D69C00, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFC510, 0x00D6AD08, 0x00100808, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000008, 0x00100808, ++ 0x00000008, 0x00100808, 0x003A3108, 0x00EFC510, ++ 0x00EFC510, 0x00EFC510, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00BD8400, 0x00CE9419, ++ 0x00EFAD08, 0x00EFAD08, 0x00EFAD08, 0x00EFBD00, ++ 0x00F7BD19, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFC510, 0x00EFBD00, 0x003A3108, 0x00000008, ++ 0x00000000, 0x00000000, 0x0094A59C, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00E6F7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00EFE6CE, 0x00D6AD08, ++ 0x00EFBD00, 0x00F7BD19, 0x00EFBD00, 0x00CE9419, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00CE9419, ++ 0x00EFC510, 0x00EFBD00, 0x00EFC510, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00BD8400, 0x00BD8400, 0x00CE9419, 0x00EFAD08, ++ 0x00BD8400, 0x00CE9419, 0x00BD8400, 0x00D6AD08, ++ 0x00D69C00, 0x00EFAD08, 0x00EFC510, 0x00F7BD19, ++ 0x00F7BD19, 0x00F7BD00, 0x00EFBD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD00, 0x00EFC510, 0x00D6AD08, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x004A524A, 0x00FFF7FF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00EFDEEF, 0x00D6DE9C, ++ 0x00EFAD08, 0x00EFAD08, 0x00EFC510, 0x00EFAD08, ++ 0x00BD8400, 0x003A3108, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00002110, ++ 0x00000000, 0x00000008, 0x00000008, 0x009C5A10, ++ 0x00D6AD08, 0x00EFBD00, 0x00EFC510, 0x00EFC510, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00CE9419, 0x00EFAD08, 0x00D6AD08, ++ 0x00EFAD08, 0x00EFAD08, 0x00EFAD08, 0x00EFAD08, ++ 0x00EFAD08, 0x00EFAD08, 0x00EFC510, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFC510, 0x00F7BD00, 0x00F7BD19, 0x00EFC510, ++ 0x00F7BD00, 0x00BD7B19, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00293131, 0x00EFE6CE, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00EFE6CE, 0x00ADADCE, ++ 0x00CEAD9C, 0x00CE9419, 0x00EFAD08, 0x00EFBD00, ++ 0x00CE9419, 0x00D69C00, 0x009C5A10, 0x00100808, ++ 0x00000000, 0x00100808, 0x00000000, 0x00000000, ++ 0x00100808, 0x00000000, 0x00100808, 0x007B7310, ++ 0x00D69C00, 0x00EFBD00, 0x00EFC510, 0x00EFAD08, ++ 0x00F7BD00, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00BD8400, 0x00D69C00, 0x00EFAD08, ++ 0x00EFC510, 0x00EFAD08, 0x00EFC510, 0x00EFAD08, ++ 0x00EFC510, 0x00F7BD19, 0x00F7BD19, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFC510, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD00, 0x00EFC510, 0x00EFAD08, ++ 0x00F7BD19, 0x00EFBD00, 0x00CECE10, 0x003A3108, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x00100808, 0x00CEDECE, 0x00FFF7FF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7FF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFF7FF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00D6ADC5, ++ 0x00CEDECE, 0x00CEAD9C, 0x00D6AD08, 0x00EFAD08, ++ 0x00EFAD08, 0x00EFAD08, 0x00D69C00, 0x00BD7B19, ++ 0x009C7B10, 0x005A3108, 0x003A3108, 0x00100808, ++ 0x003A3108, 0x003A3108, 0x009C5A10, 0x00BD8400, ++ 0x00D69C00, 0x00CE9419, 0x00EFBD00, 0x00EFAD08, ++ 0x00EFC510, 0x00F7BD19, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00BD7B19, 0x00CE9419, ++ 0x00EFAD08, 0x00EFAD08, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFC510, 0x00F7BD00, 0x00EFC510, 0x00F7BD00, ++ 0x00EFBD00, 0x00F7BD19, 0x00EFAD08, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD00, 0x00EFC510, 0x00F7BD00, ++ 0x00CE9419, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000008, 0x00000000, 0x00000000, 0x00947B9C, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7FF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00B5B5A5, 0x00CEDECE, 0x00CEAD9C, 0x00CE9419, ++ 0x00D6AD08, 0x00EFC510, 0x00D6AD08, 0x00D69C00, ++ 0x00D69C00, 0x00BD8400, 0x00BD8400, 0x00BD8400, ++ 0x00BD8400, 0x00BD7B19, 0x00BD8400, 0x00BD8400, ++ 0x00BD8400, 0x00EFAD08, 0x00EFAD08, 0x00EFC510, ++ 0x00F7BD19, 0x00EFAD08, 0x00EFBD00, 0x00EFAD08, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00BD8400, ++ 0x00D6AD08, 0x00EFAD08, 0x00EFC510, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFAD08, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, 0x00EFC510, ++ 0x00EFAD08, 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00EFC510, 0x00EFBD00, 0x007B5210, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x00737B6B, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00E6F7EF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00ADADCE, 0x00CEDECE, 0x00B5B5A5, ++ 0x00D69C00, 0x00EFAD08, 0x00EFAD08, 0x00EFAD08, ++ 0x00CE9419, 0x00D69C00, 0x00CE9419, 0x00BD8400, ++ 0x00CE9419, 0x00BD8400, 0x00BD8400, 0x00BD8400, ++ 0x00CE9419, 0x00EFAD08, 0x00EFAD08, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD00, 0x00F7BD19, 0x00EFC510, ++ 0x00EFC510, 0x00CE9419, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00BD7B19, 0x00CE9419, 0x00EFAD08, 0x00EFAD08, ++ 0x00EFC510, 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD00, 0x00EFAD08, 0x00EFC510, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFC510, 0x00EFC510, 0x00D6AD08, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00CEDECE, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7FF, 0x00FFF7EF, 0x00CEDECE, 0x00D6ADC5, ++ 0x00B5B5A5, 0x00CE9419, 0x00D69C00, 0x00D6AD08, ++ 0x00EFAD08, 0x00EFAD08, 0x00EFAD08, 0x00D69C00, ++ 0x00D69C00, 0x00D69C00, 0x00D69C00, 0x00CE9419, ++ 0x00EFAD08, 0x00D6AD08, 0x00EFAD08, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00EFC510, 0x00F7BD00, ++ 0x00EFC510, 0x00EFAD08, 0x00EFAD08, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00BD8400, 0x00D69C00, 0x00D6AD08, ++ 0x00EFAD08, 0x00F7BD19, 0x00F7BD19, 0x00EFBD00, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFC510, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD19, 0x00F7BD00, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00BD7B19, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00735A6B, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00CEDECE, ++ 0x00B5B5A5, 0x00CEAD9C, 0x00BD8400, 0x00D69C00, ++ 0x00EFAD08, 0x00EFC510, 0x00EFAD08, 0x00D6AD08, ++ 0x00EFAD08, 0x00CE9419, 0x00EFAD08, 0x00CE9419, ++ 0x00EFAD08, 0x00D6AD08, 0x00EFAD08, 0x00EFBD00, ++ 0x00EFC510, 0x00F7BD00, 0x00F7BD19, 0x00EFAD08, ++ 0x00F7BD19, 0x00F7BD00, 0x00EFC510, 0x00EFAD08, ++ 0x00D6AD08, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00E67B10, ++ 0x00D6AD08, 0x00EFAD08, 0x00EFBD00, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD00, 0x00EFAD08, 0x00EFC510, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFAD08, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00EFC510, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFC510, 0x00EFE610, 0x00EFBD00, 0x003A3108, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x004A524A, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7FF, ++ 0x00DEDEE6, 0x00D6ADC5, 0x004A5A29, 0x00BD8400, ++ 0x00CE9419, 0x00D6AD08, 0x00EFAD08, 0x00EFC510, ++ 0x00EFAD08, 0x00EFBD00, 0x00EFAD08, 0x00EFAD08, ++ 0x00D6AD08, 0x00EFAD08, 0x00EFAD08, 0x00EFAD08, ++ 0x00F7BD19, 0x00EFAD08, 0x00EFBD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD19, 0x00EFBD00, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00CE9419, 0x00D6AD08, 0x00EFAD08, 0x00F7BD19, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00EFC510, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFC510, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00EFC510, 0x00EFAD08, 0x00F7BD00, 0x00EFC510, ++ 0x00D6AD08, 0x00100808, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x0094A59C, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFF7FF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFF7FF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFF7FF, ++ 0x00FFF7EF, 0x00CEDECE, 0x004A524A, 0x005A3108, ++ 0x00BD8400, 0x00D69C00, 0x00EFAD08, 0x00EFAD08, ++ 0x00F7BD19, 0x00EFC510, 0x00EFAD08, 0x00EFC510, ++ 0x00EFAD08, 0x00EFBD00, 0x00EFC510, 0x00EFAD08, ++ 0x00EFBD00, 0x00EFC510, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD00, 0x00EFC510, ++ 0x00EFAD08, 0x00EFAD08, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00D69C00, 0x00CE9419, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00EFAD08, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00EFC510, 0x00F7BD00, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00EFAD08, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFC510, 0x00EFC510, 0x009C5A10, 0x00000000, ++ 0x00000000, 0x00000000, 0x00947B9C, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFF7FF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x004A524A, 0x00000008, ++ 0x005A3108, 0x00BD8400, 0x00CE9419, 0x00EFAD08, ++ 0x00EFC510, 0x00EFAD08, 0x00F7BD19, 0x00EFBD00, ++ 0x00F7BD19, 0x00EFC510, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00EFAD08, 0x00EFC510, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFAD08, 0x00EFC510, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, 0x00F7BD19, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00CE9419, 0x00D69C00, ++ 0x00EFAD08, 0x00EFC510, 0x00F7BD19, 0x00EFBD00, ++ 0x00F7BD19, 0x00F7BD00, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFC510, 0x00EFAD08, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, 0x00EFC510, ++ 0x00EFAD08, 0x00F7BD00, 0x00EFC510, 0x00D6AD08, ++ 0x007B7310, 0x00DEDEE6, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00293131, 0x00000000, ++ 0x00000000, 0x007B5210, 0x00BD8400, 0x00D6AD08, ++ 0x00EFAD08, 0x00EFAD08, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFAD08, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00EFBD00, 0x00EFAD08, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00BD8400, ++ 0x00D69C00, 0x00EFC510, 0x00F7BD00, 0x00EFAD08, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, 0x00EFC510, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFC510, 0x00D6AD08, ++ 0x00EFC510, 0x00CE9419, 0x00CEAD9C, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFF7FF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00EFDEEF, 0x00100808, 0x00000000, ++ 0x00000000, 0x00000000, 0x007B5210, 0x00BD8400, ++ 0x00CE9419, 0x00EFAD08, 0x00EFAD08, 0x00EFC510, ++ 0x00F7BD00, 0x00EFAD08, 0x00EFC510, 0x00F7BD00, ++ 0x00F7BD00, 0x00EFC510, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD00, 0x00EFC510, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFAD08, 0x00EFC510, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFAD08, 0x00EFC510, 0x00F7BD00, ++ 0x00EFC510, 0x00EFAD08, 0x00EFAD08, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00BD8400, ++ 0x00BD8400, 0x00EFAD08, 0x00EFAD08, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, ++ 0x00EFAD08, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00F7BD19, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD00, 0x00EFC510, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFC510, 0x00D6AD08, 0x009C7B10, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFF7EF, 0x00E6F7EF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x0094A59C, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00100808, 0x007B5210, ++ 0x00BD8400, 0x00D6AD08, 0x00EFBD00, 0x00EFC510, ++ 0x00EFAD08, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFC510, 0x00EFAD08, 0x00F7BD19, ++ 0x00EFAD08, 0x00F7BD19, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00EFAD08, 0x00CE9419, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00BD8400, 0x00CE9419, 0x00EFAD08, 0x00EFAD08, ++ 0x00EFBD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00F7BD00, 0x00F7BD19, 0x00EFAD08, ++ 0x00EFC510, 0x00EFBD00, 0x00EFC510, 0x00D6AD08, ++ 0x00BD8400, 0x007B5210, 0x00E6F7EF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFF7EF, 0x00FFF7FF, ++ 0x00FFF7EF, 0x00FFF7FF, 0x00FFFFFF, 0x00FFF7FF, ++ 0x00CEDECE, 0x00100808, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x007B5210, 0x00BD8400, 0x00CE9419, 0x00EFAD08, ++ 0x00EFAD08, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD00, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00D6AD08, 0x00D69C00, 0x00BD7B19, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00BD8400, 0x00CE9419, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD00, ++ 0x00EFC510, 0x00F7BD00, 0x00EFC510, 0x00EFAD08, ++ 0x00F7BD19, 0x00F7BD00, 0x00EFC510, 0x00EFAD08, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD19, 0x00F7BD00, ++ 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, ++ 0x00D6AD08, 0x00D6AD08, 0x007B5210, 0x004A313A, ++ 0x00E6F7EF, 0x00E6F7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFF7EF, 0x00FFFFFF, 0x00E6F7EF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00E6F7EF, 0x00FFFFFF, 0x00FFFFFF, 0x00CEDECE, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00100808, ++ 0x00100808, 0x007B5210, 0x00BD8400, 0x00D69C00, ++ 0x00EFC510, 0x00EFAD08, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, 0x00EFBD00, ++ 0x00F7BD19, 0x00F7BD00, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00EFAD08, ++ 0x00EFAD08, 0x00CE9419, 0x00CE9419, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00BD7B19, 0x00BD8400, 0x00EFAD08, ++ 0x00EFC510, 0x00EFBD00, 0x00EFAD08, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFAD08, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00EFC510, ++ 0x00F7BD00, 0x00EFC510, 0x00F7BD00, 0x00EFC510, ++ 0x00EFAD08, 0x00D6AD08, 0x00D69C00, 0x009C7B10, ++ 0x005A3108, 0x00000000, 0x00735A4A, 0x00CEDECE, ++ 0x00E6F7EF, 0x00FFF7FF, 0x00FFFFFF, 0x00FFFFFF, ++ 0x00FFFFFF, 0x00FFFFFF, 0x00E6F7EF, 0x00FFF7EF, ++ 0x00E6F7EF, 0x00B5B5A5, 0x00735A6B, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x003A3108, 0x007B5210, 0x00BD7B19, ++ 0x00D69C00, 0x00EFAD08, 0x00EFC510, 0x00F7BD19, ++ 0x00EFAD08, 0x00EFC510, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00EFC510, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00EFC510, 0x00EFAD08, 0x00EFAD08, ++ 0x00CE9419, 0x00D69C00, 0x00BD7B19, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00BD8400, 0x00D69C00, ++ 0x00CE9419, 0x00EFAD08, 0x00EFAD08, 0x00EFC510, ++ 0x00EFAD08, 0x00F7BD00, 0x00EFC510, 0x00EFAD08, ++ 0x00F7BD00, 0x00EFC510, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD00, 0x00EFC510, 0x00EFAD08, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00F7BD19, 0x00EFAD08, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFAD08, 0x00D6AD08, 0x00CE9419, ++ 0x00BD8400, 0x007B5210, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00100808, 0x00192910, ++ 0x00293131, 0x00293131, 0x00100808, 0x00100808, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x003A3108, 0x007B5210, ++ 0x00BD8400, 0x00D69C00, 0x00EFAD08, 0x00EFC510, ++ 0x00EFAD08, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFBD00, 0x00F7BD19, 0x00EFAD08, 0x00EFC510, ++ 0x00EFAD08, 0x00EFC510, 0x00EFAD08, 0x00BD8400, ++ 0x00CE9419, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00BD8400, ++ 0x00CE9419, 0x00D69C00, 0x00D69C00, 0x00EFAD08, ++ 0x00D6AD08, 0x00EFAD08, 0x00EFAD08, 0x00EFAD08, ++ 0x00EFAD08, 0x00F7BD19, 0x00EFAD08, 0x00EFAD08, ++ 0x00F7BD19, 0x00EFAD08, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00F7BD19, 0x00F7BD00, 0x00F7BD00, ++ 0x00F7BD19, 0x00EFC510, 0x00EFAD08, 0x00EFAD08, ++ 0x00D69C00, 0x009C5A10, 0x007B5210, 0x003A3108, ++ 0x00000000, 0x00000000, 0x00000008, 0x00100808, ++ 0x00000008, 0x00100808, 0x00000000, 0x00000008, ++ 0x00000008, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x00000000, 0x005A3108, ++ 0x009C5A10, 0x00BD8400, 0x00CE9419, 0x00EFAD08, ++ 0x00EFAD08, 0x00F7BD00, 0x00F7BD00, 0x00F7BD19, ++ 0x00F7BD00, 0x00EFC510, 0x00F7BD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00EFC510, 0x00EFBD00, 0x00EFAD08, ++ 0x00EFAD08, 0x00CE9419, 0x00D69C00, 0x00BD8400, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x009C7B10, 0x00BD8400, 0x00BD8400, 0x00CE9419, ++ 0x00BD8400, 0x00CE9419, 0x00D69C00, 0x00CE9419, ++ 0x00D69C00, 0x00D6AD08, 0x00EFAD08, 0x00D6AD08, ++ 0x00EFAD08, 0x00EFAD08, 0x00EFC510, 0x00EFAD08, ++ 0x00EFC510, 0x00EFAD08, 0x00F7BD19, 0x00F7BD00, ++ 0x00EFBD00, 0x00F7BD19, 0x00EFBD00, 0x00EFC510, ++ 0x00F7BD19, 0x00EFAD08, 0x00F7BD00, 0x00D6AD08, ++ 0x00CE9419, 0x00BD8400, 0x009C7B10, 0x007B5210, ++ 0x005A3108, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000008, 0x00000000, ++ 0x003A3108, 0x007B5210, 0x00BD8400, 0x00BD8400, ++ 0x00D6AD08, 0x00EFAD08, 0x00F7BD19, 0x00EFC510, ++ 0x00F7BD00, 0x00EFC510, 0x00EFAD08, 0x00F7BD19, ++ 0x00EFAD08, 0x00F7BD00, 0x00EFAD08, 0x00CE9419, ++ 0x00D6AD08, 0x00D69C00, 0x00D69C00, 0x009C5A10, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x009C5A10, ++ 0x009C5A10, 0x009C5A10, 0x00BD8400, 0x00BD7B19, ++ 0x00BD8400, 0x00BD8400, 0x00CE9419, 0x00BD8400, ++ 0x00CE9419, 0x00D69C00, 0x00CE9419, 0x00EFAD08, ++ 0x00CE9419, 0x00EFAD08, 0x00EFC510, 0x00EFAD08, ++ 0x00EFBD00, 0x00F7BD19, 0x00EFBD00, 0x00F7BD19, ++ 0x00EFAD08, 0x00F7BD00, 0x00EFC510, 0x00EFAD08, ++ 0x00EFAD08, 0x00BD8400, 0x00BD8400, 0x009C5A10, ++ 0x007B5210, 0x003A3108, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00100808, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000008, 0x00000000, 0x00000000, ++ 0x00000000, 0x005A3108, 0x007B5210, 0x00BD8400, ++ 0x00BD8400, 0x00CE9419, 0x00D6AD08, 0x00EFAD08, ++ 0x00F7BD19, 0x00EFAD08, 0x00EFAD08, 0x00EFC510, ++ 0x00EFAD08, 0x00EFBD00, 0x00EFAD08, 0x00CE9419, ++ 0x00EFAD08, 0x00BD8400, 0x00BD8400, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x007B7310, 0x009C5A10, 0x009C7B10, 0x00BD5A10, ++ 0x00BD8400, 0x009C7B10, 0x00BD8400, 0x00BD8400, ++ 0x00BD8400, 0x00BD8400, 0x00BD8400, 0x00CE9419, ++ 0x00D69C00, 0x00EFAD08, 0x00EFAD08, 0x00EFAD08, ++ 0x00EFC510, 0x00EFAD08, 0x00EFAD08, 0x00EFAD08, ++ 0x00D6AD08, 0x00CE9419, 0x00BD8400, 0x009C5A10, ++ 0x007B5210, 0x007B5210, 0x003A3108, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000008, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000008, 0x00000000, 0x00000008, 0x00000000, ++ 0x00002110, 0x00100808, 0x00000000, 0x00000000, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000008, ++ 0x00000000, 0x00000000, 0x003A3108, 0x007B5210, ++ 0x009C5A10, 0x00BD8400, 0x00BD8400, 0x00EFAD08, ++ 0x00D6AD08, 0x00EFAD08, 0x00EFAD08, 0x00EFC510, ++ 0x00EFAD08, 0x00EFAD08, 0x00CE9419, 0x00D69C00, ++ 0x00BD8400, 0x00BD7B19, 0x009C5A10, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x009C5A10, 0x007B5210, 0x009C5A10, ++ 0x009C5A10, 0x009C5A10, 0x009C5A10, 0x009C7B10, ++ 0x00BD8400, 0x00BD8400, 0x00CE9419, 0x00D69C00, ++ 0x00CE9419, 0x00D69C00, 0x00EFAD08, 0x00D6AD08, ++ 0x00CE9419, 0x00BD8400, 0x00BD8400, 0x009C5A10, ++ 0x007B5210, 0x007B5210, 0x005A3108, 0x00100808, ++ 0x00100808, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x003A3108, ++ 0x005A3108, 0x009C5A10, 0x009C5A10, 0x00BD7B19, ++ 0x00BD8400, 0x00D69C00, 0x00D6AD08, 0x00CE9419, ++ 0x00D69C00, 0x00CE9419, 0x00D69C00, 0x00BD8400, ++ 0x00BD8400, 0x00BD8400, 0x009C5A10, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x007B5210, 0x007B5210, ++ 0x009C5A10, 0x009C5A10, 0x009C5A10, 0x009C5A10, ++ 0x009C7B10, 0x00BD8400, 0x00BD7B19, 0x00BD8400, ++ 0x00BD7B19, 0x00BD8400, 0x00BD8400, 0x009C5A10, ++ 0x007B5210, 0x007B5210, 0x005A3108, 0x005A3108, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x005A3108, 0x009C5A10, 0x009C7B10, ++ 0x00BD8400, 0x00BD8400, 0x00BD7B19, 0x00BD8400, ++ 0x00BD8400, 0x00BD8400, 0x00BD8400, 0x00BD7B19, ++ 0x009C7B10, 0x009C5A10, 0x007B5210, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x005A3108, ++ 0x007B5210, 0x007B5210, 0x009C5A10, 0x007B7310, ++ 0x009C5A10, 0x009C5A10, 0x009C5A10, 0x007B5210, ++ 0x007B5210, 0x007B5210, 0x005A3108, 0x003A3108, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x005A3108, 0x005A3108, ++ 0x007B5210, 0x009C5A10, 0x009C5A10, 0x009C7B10, ++ 0x009C5A10, 0x00BD8400, 0x00BD8400, 0x009C7B10, ++ 0x009C5A10, 0x009C5A10, 0x005A3108, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x005A3108, 0x007B5210, ++ 0x005A3108, 0x007B5210, 0x007B5210, 0x005A3108, ++ 0x007B5210, 0x005A3108, 0x005A3108, 0x003A3108, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x005A3108, 0x005A3108, 0x007B5210, 0x009C5A10, ++ 0x009C5A10, 0x009C5A10, 0x009C5A10, 0x009C5A10, ++ 0x007B5210, 0x007B5210, 0x005A3108, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x005A3108, 0x005A3108, ++ 0x005A3108, 0x005A3108, 0x005A3108, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x003A3108, ++ 0x005A3108, 0x005A3108, 0x007B5210, 0x005A3108, ++ 0x005A3108, 0x003A3108, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++ 0x00000000, 0x00000000, 0x00000000, 0x00000000, ++}; ++ ++#endif diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c b/drivers/gpu/drm/gma500/cdv_intel_display.c index 17db4b4749d5..2e8479744ca4 100644 --- a/drivers/gpu/drm/gma500/cdv_intel_display.c @@ -29446,6 +41989,90 @@ index 286587607931..0f8f9a784b1b 100644 return ret; } +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index eed9eff8da13..331d6ade2454 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -22,6 +22,7 @@ + #include + #include + ++#include + #include "sde_connector.h" + + #include "msm_drv.h" +@@ -98,6 +99,8 @@ static const struct of_device_id dp_dt_match[] = { + {} + }; + ++static void dp_display_update_hdcp_info(struct dp_display_private *dp); ++ + static bool dp_display_framework_ready(struct dp_display_private *dp) + { + return dp->dp_display.post_open ? false : true; +@@ -143,6 +146,13 @@ static void dp_display_hdcp_cb_work(struct work_struct *work) + + dp = container_of(dw, struct dp_display_private, hdcp_cb_work); + ++ dp_display_update_hdcp_info(dp); ++ ++ if (!dp_display_is_hdcp_enabled(dp)) ++ return; ++ ++ dp->link->hdcp_status.hdcp_state = HDCP_STATE_AUTHENTICATING; ++ + rc = dp->catalog->ctrl.read_hdcp_status(&dp->catalog->ctrl); + if (rc >= 0) { + hdcp_auth_state = (rc >> 20) & 0x3; +@@ -467,8 +477,14 @@ static int dp_display_send_hpd_notification(struct dp_display_private *dp, + + dp->dp_display.is_connected = hpd; + +- if (!dp_display_framework_ready(dp)) ++ if (!dp_display_framework_ready(dp)) { ++ pr_err("%s: dp display framework not ready\n", __func__); ++ if (!dp->dp_display.is_bootsplash_en) { ++ dp->dp_display.is_bootsplash_en = true; ++ drm_client_dev_register(dp->dp_display.drm_dev); ++ } + return ret; ++ } + + dp->aux->state |= DP_STATE_NOTIFICATION_SENT; + +@@ -1142,12 +1158,9 @@ static int dp_display_post_enable(struct dp_display *dp_display) + dp->audio_status = dp->audio->on(dp->audio); + } + +- dp_display_update_hdcp_info(dp); +- +- if (dp_display_is_hdcp_enabled(dp)) { ++ if (dp->hdcp.feature_enabled && 0) { /* bootsplash check */ + cancel_delayed_work_sync(&dp->hdcp_cb_work); + +- dp->link->hdcp_status.hdcp_state = HDCP_STATE_AUTHENTICATING; + queue_delayed_work(dp->wq, &dp->hdcp_cb_work, HZ / 2); + } + +diff --git a/drivers/gpu/drm/msm/dp/dp_display.h b/drivers/gpu/drm/msm/dp/dp_display.h +index 3229987f4559..c980d9dbf5f2 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.h ++++ b/drivers/gpu/drm/msm/dp/dp_display.h +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2017-2020, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -28,6 +28,7 @@ struct dp_display { + bool is_primary; + u32 max_pclk_khz; + bool yuv_support; ++ bool is_bootsplash_en; + + int (*enable)(struct dp_display *dp_display); + int (*post_enable)(struct dp_display *dp_display); diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c index 4b006c59fee3..43f011de5113 100644 --- a/drivers/gpu/drm/msm/dp/dp_panel.c @@ -29595,6 +42222,44 @@ index 3dcc26e98822..cbdf2a4bedf1 100644 cmd[i].msg.ctrl = 0; cmd[i].post_wait_ms = cmd[i].msg.wait_ms = data[4]; cmd[i].msg.tx_len = ((data[5] << 8) | (data[6])); +diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c +index e457322f6df3..377332273c91 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -36,8 +36,10 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) + } + + phy_pdev = of_find_device_by_node(phy_node); +- if (phy_pdev) ++ if (phy_pdev) { + msm_dsi->phy = platform_get_drvdata(phy_pdev); ++ msm_dsi->phy_dev = &phy_pdev->dev; ++ } + + of_node_put(phy_node); + +@@ -46,8 +48,6 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) + return -EPROBE_DEFER; + } + +- msm_dsi->phy_dev = get_device(&phy_pdev->dev); +- + return 0; + } + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index e49b414c012c..246336a9f47d 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -439,7 +439,7 @@ static int dsi_bus_clk_enable(struct msm_dsi_host *msm_host) + + return 0; + err: +- for (; i > 0; i--) ++ while (--i >= 0) + clk_disable_unprepare(msm_host->bus_clks[i]); + + return ret; diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c index c757e2070cac..636e9df3d118 100644 --- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c @@ -29608,6 +42273,27 @@ index c757e2070cac..636e9df3d118 100644 .num_dsi_phy = 2, }; +diff --git a/drivers/gpu/drm/msm/edp/edp_ctrl.c b/drivers/gpu/drm/msm/edp/edp_ctrl.c +index 149bfe7ddd82..090ce0a46f06 100644 +--- a/drivers/gpu/drm/msm/edp/edp_ctrl.c ++++ b/drivers/gpu/drm/msm/edp/edp_ctrl.c +@@ -1090,7 +1090,7 @@ void msm_edp_ctrl_power(struct edp_ctrl *ctrl, bool on) + int msm_edp_ctrl_init(struct msm_edp *edp) + { + struct edp_ctrl *ctrl = NULL; +- struct device *dev = &edp->pdev->dev; ++ struct device *dev; + int ret; + + if (!edp) { +@@ -1098,6 +1098,7 @@ int msm_edp_ctrl_init(struct msm_edp *edp) + return -EINVAL; + } + ++ dev = &edp->pdev->dev; + ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL); + if (!ctrl) + return -ENOMEM; diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c index c627ab6d0061..8ac54b9dcd39 100644 --- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c @@ -29646,7 +42332,7 @@ index 46b60b132372..7ebf833e6823 100644 } diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c -index ff8c1cd9aba8..9e2f08c89d78 100755 +index ff8c1cd9aba8..2dd43dd3722a 100755 --- a/drivers/gpu/drm/msm/msm_drv.c +++ b/drivers/gpu/drm/msm/msm_drv.c @@ -1,5 +1,5 @@ @@ -29665,13 +42351,23 @@ index ff8c1cd9aba8..9e2f08c89d78 100755 static void msm_fb_output_poll_changed(struct drm_device *dev) { struct msm_drm_private *priv = NULL; -@@ -1420,13 +1422,25 @@ void msm_mode_object_event_notify(struct drm_mode_object *obj, +@@ -277,6 +279,7 @@ static int msm_drm_uninit(struct device *dev) + drm_vblank_cleanup(ddev); + + if (priv->registered) { ++ drm_client_dev_unregister(ddev); + drm_dev_unregister(ddev); + priv->registered = false; + } +@@ -1419,14 +1422,27 @@ void msm_mode_object_event_notify(struct drm_mode_object *obj, + static int msm_release(struct inode *inode, struct file *filp) { - struct drm_file *file_priv = filp->private_data; +- struct drm_file *file_priv = filp->private_data; - struct drm_minor *minor = file_priv->minor; - struct drm_device *dev = minor->dev; - struct msm_drm_private *priv = dev->dev_private; ++ struct drm_file *file_priv; + struct drm_minor *minor; + struct drm_device *dev; + struct msm_drm_private *priv; @@ -29683,6 +42379,7 @@ index ff8c1cd9aba8..9e2f08c89d78 100755 + + mutex_lock(&msm_release_lock); + ++ file_priv = filp->private_data; + if (!file_priv) { + ret = -EINVAL; + goto end; @@ -29694,7 +42391,7 @@ index ff8c1cd9aba8..9e2f08c89d78 100755 spin_lock_irqsave(&dev->event_lock, flags); list_for_each_entry_safe(node, temp, &priv->client_event_list, -@@ -1454,7 +1468,11 @@ static int msm_release(struct inode *inode, struct file *filp) +@@ -1454,7 +1470,11 @@ static int msm_release(struct inode *inode, struct file *filp) kfree(node); } @@ -29707,6 +42404,25 @@ index ff8c1cd9aba8..9e2f08c89d78 100755 } /** +diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h +index 3855c124ee6b..6a7a84b6d226 100644 +--- a/drivers/gpu/drm/msm/msm_drv.h ++++ b/drivers/gpu/drm/msm/msm_drv.h +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2016-2019, 2021, The Linux Foundation. All rights reserved. + * Copyright (C) 2013 Red Hat + * Author: Rob Clark + * +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + + #include "sde_power_handle.h" + diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c index a9b9b1c95a2e..9dbd17be51f7 100644 --- a/drivers/gpu/drm/msm/msm_fence.c @@ -29720,6 +42436,28 @@ index a9b9b1c95a2e..9dbd17be51f7 100644 fctx->name, fence, fctx->last_fence); return -EINVAL; } +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index 1b34dd4a1544..f828299cc604 100755 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -1027,7 +1027,7 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev, + + ret = msm_gem_new_impl(dev, size, flags, NULL, &obj); + if (ret) +- goto fail; ++ return ERR_PTR(ret); + + if (use_pages(obj)) { + ret = drm_gem_object_init(dev, obj, size); +@@ -1067,7 +1067,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev, + ret = msm_gem_new_impl(dev, size, MSM_BO_WC, dmabuf->resv, &obj); + mutex_unlock(&dev->struct_mutex); + if (ret) +- goto fail; ++ return ERR_PTR(ret); + + drm_gem_private_object_init(dev, obj, size); + diff --git a/drivers/gpu/drm/msm/sde/sde_connector.c b/drivers/gpu/drm/msm/sde/sde_connector.c index 3459e1be0019..4e31f98a3867 100644 --- a/drivers/gpu/drm/msm/sde/sde_connector.c @@ -29745,6 +42483,108 @@ index 3459e1be0019..4e31f98a3867 100644 return rc; } +diff --git a/drivers/gpu/drm/msm/sde/sde_crtc.c b/drivers/gpu/drm/msm/sde/sde_crtc.c +index e1346143343d..d93fe00a451d 100644 +--- a/drivers/gpu/drm/msm/sde/sde_crtc.c ++++ b/drivers/gpu/drm/msm/sde/sde_crtc.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2014-2019 The Linux Foundation. All rights reserved. ++ * Copyright (c) 2014-2019,2021 The Linux Foundation. All rights reserved. + * Copyright (C) 2013 Red Hat + * Author: Rob Clark + * +@@ -2381,7 +2381,8 @@ static void sde_crtc_vblank_cb(void *data) + sde_crtc->vblank_cb_count++; + + sde_crtc->vblank_last_cb_time = ktime_get(); +- sysfs_notify_dirent(sde_crtc->vsync_event_sf); ++ if (sde_crtc->vsync_event_sf) ++ sysfs_notify_dirent(sde_crtc->vsync_event_sf); + + drm_crtc_handle_vblank(crtc); + DRM_DEBUG_VBL("crtc%d\n", crtc->base.id); +diff --git a/drivers/gpu/drm/msm/sde/sde_plane.c b/drivers/gpu/drm/msm/sde/sde_plane.c +index cbcac5822ded..a8758b01453c 100644 +--- a/drivers/gpu/drm/msm/sde/sde_plane.c ++++ b/drivers/gpu/drm/msm/sde/sde_plane.c +@@ -253,7 +253,7 @@ static inline int _sde_plane_calc_fill_level(struct drm_plane *plane, + src_width = max_t(u32, src_width, tmp->pipe_cfg.src_rect.w); + } + +- if ((rstate->out_rotation & DRM_REFLECT_X) && ++ if ((rstate->out_rotation & DRM_MODE_REFLECT_X) && + SDE_FORMAT_IS_LINEAR(fmt)) + hflip_bytes = (src_width + 32) * fmt->bpp; + else +@@ -2012,13 +2012,13 @@ static int sde_plane_rot_submit_command(struct drm_plane *plane, + rstate->out_src_h = drm_rect_height(&rstate->out_src_rect); + + if (rot_cmd->rot90) +- rstate->out_rotation &= ~DRM_ROTATE_90; ++ rstate->out_rotation &= ~DRM_MODE_ROTATE_90; + + if (rot_cmd->hflip) +- rstate->out_rotation &= ~DRM_REFLECT_X; ++ rstate->out_rotation &= ~DRM_MODE_REFLECT_X; + + if (rot_cmd->vflip) +- rstate->out_rotation &= ~DRM_REFLECT_Y; ++ rstate->out_rotation &= ~DRM_MODE_REFLECT_Y; + + SDE_DEBUG( + "plane%d.%d rot:%d/%c%c%c%c/%dx%d/%4.4s/%llx/%dx%d+%d+%d\n", +@@ -2317,11 +2317,11 @@ static int sde_plane_rot_atomic_check(struct drm_plane *plane, + + rstate->in_rotation = drm_rotation_simplify( + sde_plane_get_property(pstate, PLANE_PROP_ROTATION), +- DRM_ROTATE_0 | DRM_ROTATE_90 | +- DRM_REFLECT_X | DRM_REFLECT_Y); +- rstate->rot90 = rstate->in_rotation & DRM_ROTATE_90 ? true : false; +- rstate->hflip = rstate->in_rotation & DRM_REFLECT_X ? true : false; +- rstate->vflip = rstate->in_rotation & DRM_REFLECT_Y ? true : false; ++ DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | ++ DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y); ++ rstate->rot90 = rstate->in_rotation & DRM_MODE_ROTATE_90 ? true : false; ++ rstate->hflip = rstate->in_rotation & DRM_MODE_REFLECT_X ? true : false; ++ rstate->vflip = rstate->in_rotation & DRM_MODE_REFLECT_Y ? true : false; + rstate->out_sbuf = psde->sbuf_mode || rstate->rot90; + + if (sde_plane_enabled(state) && rstate->out_sbuf) { +@@ -2798,8 +2798,8 @@ static void sde_plane_rot_install_properties(struct drm_plane *plane, + struct sde_mdss_cfg *catalog) + { + struct sde_plane *psde = to_sde_plane(plane); +- unsigned long supported_rotations = DRM_ROTATE_0 | DRM_REFLECT_X | +- DRM_REFLECT_Y; ++ unsigned long supported_rotations = DRM_MODE_ROTATE_0 | DRM_MODE_REFLECT_X | ++ DRM_MODE_REFLECT_Y; + + if (!plane || !psde) { + SDE_ERROR("invalid plane\n"); +@@ -2810,8 +2810,8 @@ static void sde_plane_rot_install_properties(struct drm_plane *plane, + } + + if ((psde->features & BIT(SDE_SSPP_SBUF)) && catalog->rot_count) +- supported_rotations |= DRM_ROTATE_0 | DRM_ROTATE_90 | +- DRM_ROTATE_180 | DRM_ROTATE_270; ++ supported_rotations |= DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | ++ DRM_MODE_ROTATE_180 | DRM_MODE_ROTATE_270; + + msm_property_install_rotation(&psde->property_info, + supported_rotations, PLANE_PROP_ROTATION); +@@ -4000,9 +4000,9 @@ static int sde_plane_sspp_atomic_update(struct drm_plane *plane, + psde->pipe_hw->ops.setup_format) { + src_flags = 0x0; + SDE_DEBUG_PLANE(psde, "rotation 0x%X\n", rstate->out_rotation); +- if (rstate->out_rotation & DRM_REFLECT_X) ++ if (rstate->out_rotation & DRM_MODE_REFLECT_X) + src_flags |= SDE_SSPP_FLIP_LR; +- if (rstate->out_rotation & DRM_REFLECT_Y) ++ if (rstate->out_rotation & DRM_MODE_REFLECT_Y) + src_flags |= SDE_SSPP_FLIP_UD; + + /* update format */ diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index a2e6a81669e7..94b7798bdea4 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -29783,6 +42623,18 @@ index 5bfae1f972c7..0061deca290a 100644 } nv_encoder = nouveau_connector_ddc_detect(connector); +diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +index 411c12cdb249..bb516eb12421 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c ++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +@@ -178,6 +178,7 @@ static const struct file_operations nouveau_pstate_fops = { + .open = nouveau_debugfs_pstate_open, + .read = seq_read, + .write = nouveau_debugfs_pstate_set, ++ .release = single_release, + }; + + static struct drm_info_list nouveau_debugfs_list[] = { diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c index 42829a942e33..4e12d3d59651 100644 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c @@ -29851,6 +42703,19 @@ index 505dca48b9f8..be6672da33a6 100644 if (gem->import_attach) drm_prime_gem_destroy(gem, nvbo->bo.sg); +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c +index b0ece71aefde..ce774579c89d 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c +@@ -57,7 +57,7 @@ nvkm_control_mthd_pstate_info(struct nvkm_control *ctrl, void *data, u32 size) + args->v0.count = 0; + args->v0.ustate_ac = NVIF_CONTROL_PSTATE_INFO_V0_USTATE_DISABLE; + args->v0.ustate_dc = NVIF_CONTROL_PSTATE_INFO_V0_USTATE_DISABLE; +- args->v0.pwrsrc = -ENOSYS; ++ args->v0.pwrsrc = -ENODEV; + args->v0.pstate = NVIF_CONTROL_PSTATE_INFO_V0_PSTATE_UNKNOWN; + } + diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c index 7deb81b6dbac..4b571cc6bc70 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c @@ -30270,6 +43135,32 @@ index 2134bb20fbe9..2836154dbb12 100644 drm_display_mode_from_videomode(&vm, mode); mode->type = DRM_MODE_TYPE_DRIVER; +diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c +index d2f57c52f7db..c001ed8e7dd9 100644 +--- a/drivers/gpu/drm/udl/udl_connector.c ++++ b/drivers/gpu/drm/udl/udl_connector.c +@@ -37,7 +37,7 @@ static u8 *udl_get_edid(struct udl_device *udl) + ret = usb_control_msg(udl->udev, + usb_rcvctrlpipe(udl->udev, 0), (0x02), + (0x80 | (0x02 << 5)), i << 8, 0xA1, rbuf, 2, +- HZ); ++ 1000); + if (ret < 1) { + DRM_ERROR("Read EDID byte %d failed err %x\n", i, ret); + goto error; +diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c +index d53e805d392f..64fc99cf54d5 100644 +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -198,7 +198,7 @@ struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size) + + bo = kzalloc(sizeof(*bo), GFP_KERNEL); + if (!bo) +- return ERR_PTR(-ENOMEM); ++ return NULL; + + mutex_lock(&vc4->bo_lock); + vc4->bo_stats.num_allocated++; diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c index 036b0fbae0fb..6058bdab5fb8 100644 --- a/drivers/gpu/drm/virtio/virtgpu_kms.c @@ -30675,10 +43566,24 @@ index d5da56261d39..c7cfa51c3f0a 100644 /* Allocate mem for storing preemption switch record */ FOR_EACH_RINGBUFFER(adreno_dev, rb, i) { diff --git a/drivers/gpu/msm/adreno_a6xx.c b/drivers/gpu/msm/adreno_a6xx.c -index 313b086128ca..ff45e0cdb79d 100644 +index 313b086128ca..300361744cb4 100644 --- a/drivers/gpu/msm/adreno_a6xx.c +++ b/drivers/gpu/msm/adreno_a6xx.c -@@ -1066,7 +1066,7 @@ static int a6xx_post_start(struct adreno_device *adreno_dev) +@@ -1,4 +1,4 @@ +-/* Copyright (c) 2017-2018,2020 The Linux Foundation. All rights reserved. ++/* Copyright (c) 2017-2018,2020-2021, The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -277,6 +277,7 @@ static struct a6xx_protected_regs { + { 0x8D0, 0x23, 0 }, + { 0x980, 0x4, 0 }, + { 0xA630, 0x0, 1 }, ++ { 0x1b400, 0x1fff, 1 }, + }; + + /* IFPC & Preemption static powerup restore list */ +@@ -1066,7 +1067,7 @@ static int a6xx_post_start(struct adreno_device *adreno_dev) rb->_wptr = rb->_wptr - (42 - (cmds - start)); @@ -30687,7 +43592,7 @@ index 313b086128ca..ff45e0cdb79d 100644 if (ret) adreno_spin_idle_debug(adreno_dev, "hw preemption initialization failed to idle\n"); -@@ -1173,7 +1173,7 @@ static int _load_firmware(struct kgsl_device *device, const char *fwfile, +@@ -1173,7 +1174,7 @@ static int _load_firmware(struct kgsl_device *device, const char *fwfile, if (!ret) { memcpy(firmware->memdesc.hostptr, &fw->data[4], fw->size - 4); firmware->size = (fw->size - 4) / sizeof(uint32_t); @@ -30696,7 +43601,7 @@ index 313b086128ca..ff45e0cdb79d 100644 } release_firmware(fw); -@@ -1413,6 +1413,9 @@ static int a6xx_gmu_start(struct kgsl_device *device) +@@ -1413,6 +1414,9 @@ static int a6xx_gmu_start(struct kgsl_device *device) /* Bring GMU out of reset */ kgsl_gmu_regwrite(device, A6XX_GMU_CM3_SYSRESET, 0); @@ -30706,7 +43611,7 @@ index 313b086128ca..ff45e0cdb79d 100644 if (timed_poll_check(device, A6XX_GMU_CM3_FW_INIT_RESULT, 0xBABEFACE, -@@ -1608,6 +1611,18 @@ static bool a6xx_gx_is_on(struct adreno_device *adreno_dev) +@@ -1608,6 +1612,18 @@ static bool a6xx_gx_is_on(struct adreno_device *adreno_dev) return is_on(val); } @@ -30725,7 +43630,7 @@ index 313b086128ca..ff45e0cdb79d 100644 /* * a6xx_sptprac_is_on() - Check if SPTP is on using pwr status register * @adreno_dev - Pointer to adreno_device -@@ -1882,6 +1897,13 @@ static int a6xx_gmu_fw_start(struct kgsl_device *device, +@@ -1882,6 +1898,13 @@ static int a6xx_gmu_fw_start(struct kgsl_device *device, kgsl_gmu_regwrite(device, A6XX_GMU_AHB_FENCE_RANGE_0, FENCE_RANGE_MASK); @@ -30739,7 +43644,7 @@ index 313b086128ca..ff45e0cdb79d 100644 /* Pass chipid to GMU FW, must happen before starting GMU */ /* Keep Core and Major bitfields unchanged */ -@@ -2373,11 +2395,15 @@ static int a6xx_reset(struct kgsl_device *device, int fault) +@@ -2373,11 +2396,15 @@ static int a6xx_reset(struct kgsl_device *device, int fault) struct adreno_device *adreno_dev = ADRENO_DEVICE(device); int ret = -EINVAL; int i = 0; @@ -30755,7 +43660,7 @@ index 313b086128ca..ff45e0cdb79d 100644 /* Transition from ACTIVE to RESET state */ kgsl_pwrctrl_change_state(device, KGSL_STATE_RESET); -@@ -2429,6 +2455,8 @@ static int a6xx_reset(struct kgsl_device *device, int fault) +@@ -2429,6 +2456,8 @@ static int a6xx_reset(struct kgsl_device *device, int fault) clear_bit(ADRENO_DEVICE_HARD_RESET, &adreno_dev->priv); @@ -30764,7 +43669,7 @@ index 313b086128ca..ff45e0cdb79d 100644 if (ret) return ret; -@@ -3911,6 +3939,7 @@ struct adreno_gpudev adreno_a6xx_gpudev = { +@@ -3911,6 +3940,7 @@ struct adreno_gpudev adreno_a6xx_gpudev = { .preemption_context_init = a6xx_preemption_context_init, .preemption_context_destroy = a6xx_preemption_context_destroy, .gx_is_on = a6xx_gx_is_on, @@ -31533,6 +44438,70 @@ index 2a6e60883637..02e811f6eb0d 100644 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and +diff --git a/drivers/gpu/msm/kgsl_drawobj.c b/drivers/gpu/msm/kgsl_drawobj.c +index 1bfc9050bb47..b0dd4ac598b3 100644 +--- a/drivers/gpu/msm/kgsl_drawobj.c ++++ b/drivers/gpu/msm/kgsl_drawobj.c +@@ -1,4 +1,4 @@ +-/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved. ++/* Copyright (c) 2016-2019,2021, The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -569,6 +569,7 @@ static void add_profiling_buffer(struct kgsl_device *device, + { + struct kgsl_mem_entry *entry; + struct kgsl_drawobj *drawobj = DRAWOBJ(cmdobj); ++ u64 start; + + if (!(drawobj->flags & KGSL_DRAWOBJ_PROFILING)) + return; +@@ -585,7 +586,14 @@ static void add_profiling_buffer(struct kgsl_device *device, + gpuaddr); + + if (entry != NULL) { +- if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size)) { ++ start = id ? (entry->memdesc.gpuaddr + offset) : gpuaddr; ++ /* ++ * Make sure there is enough room in the object to store the ++ * entire profiling buffer object ++ */ ++ if (!kgsl_gpuaddr_in_memdesc(&entry->memdesc, gpuaddr, size) || ++ !kgsl_gpuaddr_in_memdesc(&entry->memdesc, start, ++ sizeof(struct kgsl_drawobj_profiling_buffer))) { + kgsl_mem_entry_put(entry); + entry = NULL; + } +@@ -598,28 +606,7 @@ static void add_profiling_buffer(struct kgsl_device *device, + return; + } + +- +- if (!id) { +- cmdobj->profiling_buffer_gpuaddr = gpuaddr; +- } else { +- u64 off = offset + sizeof(struct kgsl_drawobj_profiling_buffer); +- +- /* +- * Make sure there is enough room in the object to store the +- * entire profiling buffer object +- */ +- if (off < offset || off >= entry->memdesc.size) { +- dev_err(device->dev, +- "ignore invalid profile offset ctxt %d id %d offset %lld gpuaddr %llx size %lld\n", +- drawobj->context->id, id, offset, gpuaddr, size); +- kgsl_mem_entry_put(entry); +- return; +- } +- +- cmdobj->profiling_buffer_gpuaddr = +- entry->memdesc.gpuaddr + offset; +- } +- ++ cmdobj->profiling_buffer_gpuaddr = start; + cmdobj->profiling_buf_entry = entry; + } + diff --git a/drivers/gpu/msm/kgsl_gmu.c b/drivers/gpu/msm/kgsl_gmu.c index 3e080eedddf1..31692bae847e 100644 --- a/drivers/gpu/msm/kgsl_gmu.c @@ -31870,6 +44839,54 @@ index b40a16122e86..9b925721aa1a 100644 ) ); +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 7e4923942732..849f5a359e30 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -176,14 +176,14 @@ config HID_CHERRY + + config HID_CHICONY + tristate "Chicony devices" +- depends on HID ++ depends on USB_HID + default !EXPERT + ---help--- + Support for Chicony Tactical pad and special keys on Chicony keyboards. + + config HID_CORSAIR + tristate "Corsair devices" +- depends on HID && USB && LEDS_CLASS ++ depends on USB_HID && LEDS_CLASS + ---help--- + Support for Corsair devices that are not fully compliant with the + HID standard. +@@ -194,7 +194,7 @@ config HID_CORSAIR + + config HID_PRODIKEYS + tristate "Prodikeys PC-MIDI Keyboard support" +- depends on HID && SND ++ depends on USB_HID && SND + select SND_RAWMIDI + ---help--- + Support for Prodikeys PC-MIDI Keyboard device support. +@@ -421,7 +421,7 @@ config HID_LENOVO + + config HID_LOGITECH + tristate "Logitech devices" +- depends on HID ++ depends on USB_HID + default !EXPERT + ---help--- + Support for Logitech devices that are not fully compliant with HID standard. +@@ -741,7 +741,7 @@ config HID_SAITEK + + config HID_SAMSUNG + tristate "Samsung InfraRed remote control or keyboards" +- depends on HID ++ depends on USB_HID + ---help--- + Support for Samsung InfraRed remote control or keyboards. + diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c index ed9c0ea5b026..1bc6ad0339d2 100644 --- a/drivers/hid/hid-alps.c @@ -31883,7 +44900,7 @@ index ed9c0ea5b026..1bc6ad0339d2 100644 } } diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c -index 0a3efa74be35..f7cd50e15e5c 100644 +index 0a3efa74be35..f03bb68ca9f8 100644 --- a/drivers/hid/hid-apple.c +++ b/drivers/hid/hid-apple.c @@ -55,6 +55,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") @@ -31894,7 +44911,27 @@ index 0a3efa74be35..f7cd50e15e5c 100644 DECLARE_BITMAP(pressed_numlock, KEY_CNT); }; -@@ -340,12 +341,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, +@@ -301,12 +302,19 @@ static int apple_event(struct hid_device *hdev, struct hid_field *field, + + /* + * MacBook JIS keyboard has wrong logical maximum ++ * Magic Keyboard JIS has wrong logical maximum + */ + static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { + struct apple_sc *asc = hid_get_drvdata(hdev); + ++ if(*rsize >=71 && rdesc[70] == 0x65 && rdesc[64] == 0x65) { ++ hid_info(hdev, ++ "fixing up Magic Keyboard JIS report descriptor\n"); ++ rdesc[64] = rdesc[70] = 0xe7; ++ } ++ + if ((asc->quirks & APPLE_RDESC_JIS) && *rsize >= 60 && + rdesc[53] == 0x65 && rdesc[59] == 0x65) { + hid_info(hdev, +@@ -340,12 +348,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, struct hid_field *field, struct hid_usage *usage, unsigned long **bit, int *max) { @@ -31910,7 +44947,7 @@ index 0a3efa74be35..f7cd50e15e5c 100644 apple_setup_input(hi->input); return 1; } -@@ -372,6 +376,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi, +@@ -372,6 +383,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi, return 0; } @@ -31930,7 +44967,7 @@ index 0a3efa74be35..f7cd50e15e5c 100644 static int apple_probe(struct hid_device *hdev, const struct hid_device_id *id) { -@@ -596,6 +613,7 @@ static struct hid_driver apple_driver = { +@@ -596,6 +620,7 @@ static struct hid_driver apple_driver = { .event = apple_event, .input_mapping = apple_input_mapping, .input_mapped = apple_input_mapped, @@ -31938,6 +44975,55 @@ index 0a3efa74be35..f7cd50e15e5c 100644 }; module_hid_driver(apple_driver); +diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c +index 69cfc8dc6af1..9b60efe6ec44 100644 +--- a/drivers/hid/hid-betopff.c ++++ b/drivers/hid/hid-betopff.c +@@ -59,15 +59,22 @@ static int betopff_init(struct hid_device *hid) + { + struct betopff_device *betopff; + struct hid_report *report; +- struct hid_input *hidinput = +- list_first_entry(&hid->inputs, struct hid_input, list); ++ struct hid_input *hidinput; + struct list_head *report_list = + &hid->report_enum[HID_OUTPUT_REPORT].report_list; +- struct input_dev *dev = hidinput->input; ++ struct input_dev *dev; + int field_count = 0; + int error; + int i, j; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ ++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); ++ dev = hidinput->input; ++ + if (list_empty(report_list)) { + hid_err(hid, "no output reports found\n"); + return -ENODEV; +diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c +index f04ed9aabc3f..f11948ddf642 100644 +--- a/drivers/hid/hid-chicony.c ++++ b/drivers/hid/hid-chicony.c +@@ -61,8 +61,12 @@ static int ch_input_mapping(struct hid_device *hdev, struct hid_input *hi, + static __u8 *ch_switch12_report_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { +- struct usb_interface *intf = to_usb_interface(hdev->dev.parent); +- ++ struct usb_interface *intf; ++ ++ if (!hid_is_usb(hdev)) ++ return rdesc; ++ ++ intf = to_usb_interface(hdev->dev.parent); + if (intf->cur_altsetting->desc.bInterfaceNumber == 1) { + /* Change usage maximum and logical maximum from 0x7fff to + * 0x2fff, so they don't exceed HID_MAX_USAGES */ diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 5717f6f94ed7..9a037ea46a90 100644 --- a/drivers/hid/hid-core.c @@ -31998,6 +45084,24 @@ index 5717f6f94ed7..9a037ea46a90 100644 default: bus = ""; } +diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c +index 9ba5d98a1180..d8cf08b6b31c 100644 +--- a/drivers/hid/hid-corsair.c ++++ b/drivers/hid/hid-corsair.c +@@ -553,7 +553,12 @@ static int corsair_probe(struct hid_device *dev, const struct hid_device_id *id) + int ret; + unsigned long quirks = id->driver_data; + struct corsair_drvdata *drvdata; +- struct usb_interface *usbif = to_usb_interface(dev->dev.parent); ++ struct usb_interface *usbif; ++ ++ if (!hid_is_usb(dev)) ++ return -EINVAL; ++ ++ usbif = to_usb_interface(dev->dev.parent); + + drvdata = devm_kzalloc(&dev->dev, sizeof(struct corsair_drvdata), + GFP_KERNEL); diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c index 1689568b597d..12c5d7c96527 100644 --- a/drivers/hid/hid-cypress.c @@ -32075,6 +45179,20 @@ index 1689568b597d..12c5d7c96527 100644 { } }; MODULE_DEVICE_TABLE(hid, cp_devices); +diff --git a/drivers/hid/hid-elo.c b/drivers/hid/hid-elo.c +index 5eea6fe0d7bd..c3ecac13e620 100644 +--- a/drivers/hid/hid-elo.c ++++ b/drivers/hid/hid-elo.c +@@ -230,6 +230,9 @@ static int elo_probe(struct hid_device *hdev, const struct hid_device_id *id) + struct elo_priv *priv; + int ret; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + priv = kzalloc(sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; diff --git a/drivers/hid/hid-gt683r.c b/drivers/hid/hid-gt683r.c index a298fbd8db6b..8ca4c1baeda8 100644 --- a/drivers/hid/hid-gt683r.c @@ -32087,6 +45205,72 @@ index a298fbd8db6b..8ca4c1baeda8 100644 static void gt683r_brightness_set(struct led_classdev *led_cdev, enum led_brightness brightness) +diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c +index ab9da597106f..2f8eb6639744 100644 +--- a/drivers/hid/hid-holtek-kbd.c ++++ b/drivers/hid/hid-holtek-kbd.c +@@ -143,12 +143,17 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type, + static int holtek_kbd_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { +- struct usb_interface *intf = to_usb_interface(hdev->dev.parent); +- int ret = hid_parse(hdev); ++ struct usb_interface *intf; ++ int ret; ++ ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; + ++ ret = hid_parse(hdev); + if (!ret) + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); + ++ intf = to_usb_interface(hdev->dev.parent); + if (!ret && intf->cur_altsetting->desc.bInterfaceNumber == 1) { + struct hid_input *hidinput; + list_for_each_entry(hidinput, &hdev->inputs, list) { +diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c +index 78b3a0c76775..96db7e96fcea 100644 +--- a/drivers/hid/hid-holtek-mouse.c ++++ b/drivers/hid/hid-holtek-mouse.c +@@ -65,6 +65,29 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc, + return rdesc; + } + ++static int holtek_mouse_probe(struct hid_device *hdev, ++ const struct hid_device_id *id) ++{ ++ int ret; ++ ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ ++ ret = hid_parse(hdev); ++ if (ret) { ++ hid_err(hdev, "hid parse failed: %d\n", ret); ++ return ret; ++ } ++ ++ ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); ++ if (ret) { ++ hid_err(hdev, "hw start failed: %d\n", ret); ++ return ret; ++ } ++ ++ return 0; ++} ++ + static const struct hid_device_id holtek_mouse_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, + USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A067) }, +@@ -86,6 +109,7 @@ static struct hid_driver holtek_mouse_driver = { + .name = "holtek_mouse", + .id_table = holtek_mouse_devices, + .report_fixup = holtek_mouse_report_fixup, ++ .probe = holtek_mouse_probe, + }; + + module_hid_driver(holtek_mouse_driver); diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h index 0215d34bc51e..9f706e79c764 100644 --- a/drivers/hid/hid-ids.h @@ -32123,6 +45307,31 @@ index 5dbb05961cb5..d45820271510 100644 if (device->driver->input_mapped && device->driver->input_mapped(device, hidinput, field, usage, &bit, &max) < 0) { +diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c +index 7e55d3f755dd..f8d1d481c838 100644 +--- a/drivers/hid/hid-lg.c ++++ b/drivers/hid/hid-lg.c +@@ -714,12 +714,18 @@ static int lg_raw_event(struct hid_device *hdev, struct hid_report *report, + + static int lg_probe(struct hid_device *hdev, const struct hid_device_id *id) + { +- struct usb_interface *iface = to_usb_interface(hdev->dev.parent); +- __u8 iface_num = iface->cur_altsetting->desc.bInterfaceNumber; ++ struct usb_interface *iface; ++ __u8 iface_num; + unsigned int connect_mask = HID_CONNECT_DEFAULT; + struct lg_drv_data *drv_data; + int ret; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ ++ iface = to_usb_interface(hdev->dev.parent); ++ iface_num = iface->cur_altsetting->desc.bInterfaceNumber; ++ + /* G29 only work with the 1st interface */ + if ((hdev->product == USB_DEVICE_ID_LOGITECH_G29_WHEEL) && + (iface_num != 0)) { diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c index 42ed887ba0be..78e37bb25aee 100644 --- a/drivers/hid/hid-magicmouse.c @@ -32276,8 +45485,61 @@ index 584b10d3fc3d..460711c1124a 100644 .probe = plantronics_probe, }; module_hid_driver(plantronics_driver); +diff --git a/drivers/hid/hid-prodikeys.c b/drivers/hid/hid-prodikeys.c +index 762f33817dd0..7c3e42efbc56 100644 +--- a/drivers/hid/hid-prodikeys.c ++++ b/drivers/hid/hid-prodikeys.c +@@ -803,12 +803,18 @@ static int pk_raw_event(struct hid_device *hdev, struct hid_report *report, + static int pk_probe(struct hid_device *hdev, const struct hid_device_id *id) + { + int ret; +- struct usb_interface *intf = to_usb_interface(hdev->dev.parent); +- unsigned short ifnum = intf->cur_altsetting->desc.bInterfaceNumber; ++ struct usb_interface *intf; ++ unsigned short ifnum; + unsigned long quirks = id->driver_data; + struct pk_device *pk; + struct pcmidi_snd *pm = NULL; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ ++ intf = to_usb_interface(hdev->dev.parent); ++ ifnum = intf->cur_altsetting->desc.bInterfaceNumber; ++ + pk = kzalloc(sizeof(*pk), GFP_KERNEL); + if (pk == NULL) { + hid_err(hdev, "can't alloc descriptor\n"); +diff --git a/drivers/hid/hid-roccat-arvo.c b/drivers/hid/hid-roccat-arvo.c +index 329c5d1270f9..fb545a11214f 100644 +--- a/drivers/hid/hid-roccat-arvo.c ++++ b/drivers/hid/hid-roccat-arvo.c +@@ -347,6 +347,9 @@ static int arvo_probe(struct hid_device *hdev, + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +diff --git a/drivers/hid/hid-roccat-isku.c b/drivers/hid/hid-roccat-isku.c +index 02db537f8f3e..c07a7ea8a687 100644 +--- a/drivers/hid/hid-roccat-isku.c ++++ b/drivers/hid/hid-roccat-isku.c +@@ -327,6 +327,9 @@ static int isku_probe(struct hid_device *hdev, + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c -index bf4675a27396..9be8c31f613f 100644 +index bf4675a27396..ef978586ff2f 100644 --- a/drivers/hid/hid-roccat-kone.c +++ b/drivers/hid/hid-roccat-kone.c @@ -297,31 +297,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj, @@ -32328,6 +45590,128 @@ index bf4675a27396..9be8c31f613f 100644 return sizeof(struct kone_settings); } static BIN_ATTR(settings, 0660, kone_sysfs_read_settings, +@@ -743,6 +752,9 @@ static int kone_probe(struct hid_device *hdev, const struct hid_device_id *id) + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c +index 09e8fc72aa1d..b63de4c5b5dd 100644 +--- a/drivers/hid/hid-roccat-koneplus.c ++++ b/drivers/hid/hid-roccat-koneplus.c +@@ -434,6 +434,9 @@ static int koneplus_probe(struct hid_device *hdev, + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +diff --git a/drivers/hid/hid-roccat-konepure.c b/drivers/hid/hid-roccat-konepure.c +index 07de2f9014c6..ef9508822e5f 100644 +--- a/drivers/hid/hid-roccat-konepure.c ++++ b/drivers/hid/hid-roccat-konepure.c +@@ -136,6 +136,9 @@ static int konepure_probe(struct hid_device *hdev, + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c +index 317c9c2c0a7c..6256c211398a 100644 +--- a/drivers/hid/hid-roccat-kovaplus.c ++++ b/drivers/hid/hid-roccat-kovaplus.c +@@ -504,6 +504,9 @@ static int kovaplus_probe(struct hid_device *hdev, + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +diff --git a/drivers/hid/hid-roccat-lua.c b/drivers/hid/hid-roccat-lua.c +index ac1a7313e259..13ae2a7d176d 100644 +--- a/drivers/hid/hid-roccat-lua.c ++++ b/drivers/hid/hid-roccat-lua.c +@@ -163,6 +163,9 @@ static int lua_probe(struct hid_device *hdev, + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c +index b30aa7b82bf8..027aa9d0ec1f 100644 +--- a/drivers/hid/hid-roccat-pyra.c ++++ b/drivers/hid/hid-roccat-pyra.c +@@ -452,6 +452,9 @@ static int pyra_probe(struct hid_device *hdev, const struct hid_device_id *id) + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +diff --git a/drivers/hid/hid-roccat-ryos.c b/drivers/hid/hid-roccat-ryos.c +index 47cc8f30ff6d..fda4a396a12e 100644 +--- a/drivers/hid/hid-roccat-ryos.c ++++ b/drivers/hid/hid-roccat-ryos.c +@@ -144,6 +144,9 @@ static int ryos_probe(struct hid_device *hdev, + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +diff --git a/drivers/hid/hid-roccat-savu.c b/drivers/hid/hid-roccat-savu.c +index 6dbf6e04dce7..0230fb54f08a 100644 +--- a/drivers/hid/hid-roccat-savu.c ++++ b/drivers/hid/hid-roccat-savu.c +@@ -116,6 +116,9 @@ static int savu_probe(struct hid_device *hdev, + { + int retval; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + retval = hid_parse(hdev); + if (retval) { + hid_err(hdev, "parse failed\n"); +diff --git a/drivers/hid/hid-samsung.c b/drivers/hid/hid-samsung.c +index 7cbb067d4a9e..89bb2260367f 100644 +--- a/drivers/hid/hid-samsung.c ++++ b/drivers/hid/hid-samsung.c +@@ -157,6 +157,9 @@ static int samsung_probe(struct hid_device *hdev, + int ret; + unsigned int cmask = HID_CONNECT_DEFAULT; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + ret = hid_parse(hdev); + if (ret) { + hid_err(hdev, "parse failed\n"); diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c index 4ef73374a8f9..4ea18f07c65b 100644 --- a/drivers/hid/hid-sensor-hub.c @@ -32368,8 +45752,22 @@ index 4ef73374a8f9..4ea18f07c65b 100644 spin_lock_irqsave(&pdata->lock, flags); +diff --git a/drivers/hid/hid-uclogic.c b/drivers/hid/hid-uclogic.c +index 1509d7287ff3..b3f2e40b1c5b 100644 +--- a/drivers/hid/hid-uclogic.c ++++ b/drivers/hid/hid-uclogic.c +@@ -791,6 +791,9 @@ static int uclogic_tablet_enable(struct hid_device *hdev) + __u8 *p; + s32 v; + ++ if (!hid_is_usb(hdev)) ++ return -EINVAL; ++ + /* + * Read string descriptor containing tablet parameters. The specific + * string descriptor and data were discovered by sniffing the Windows diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c -index 850527d5fab1..800c477dd076 100644 +index 850527d5fab1..518ccf15188e 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -407,6 +407,19 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state) @@ -32408,7 +45806,24 @@ index 850527d5fab1..800c477dd076 100644 i2c_hid_dbg(ihid, "resetting...\n"); ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0); -@@ -1153,8 +1157,8 @@ static int i2c_hid_probe(struct i2c_client *client, +@@ -871,7 +875,7 @@ static int i2c_hid_power(struct hid_device *hid, int lvl) + return 0; + } + +-static struct hid_ll_driver i2c_hid_ll_driver = { ++struct hid_ll_driver i2c_hid_ll_driver = { + .parse = i2c_hid_parse, + .start = i2c_hid_start, + .stop = i2c_hid_stop, +@@ -881,6 +885,7 @@ static struct hid_ll_driver i2c_hid_ll_driver = { + .output_report = i2c_hid_output_report, + .raw_request = i2c_hid_raw_request, + }; ++EXPORT_SYMBOL_GPL(i2c_hid_ll_driver); + + static int i2c_hid_init_irq(struct i2c_client *client) + { +@@ -1153,8 +1158,8 @@ static int i2c_hid_probe(struct i2c_client *client, hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID); hid->product = le16_to_cpu(ihid->hdesc.wProductID); @@ -32453,8 +45868,29 @@ index 681ac9bc68b3..58a753ef2717 100644 { } /* Terminate list */ }; +diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c +index 7a136847c8b2..5e6d32251d09 100644 +--- a/drivers/hid/uhid.c ++++ b/drivers/hid/uhid.c +@@ -374,7 +374,7 @@ static int uhid_hid_output_report(struct hid_device *hid, __u8 *buf, + return uhid_hid_output_raw(hid, buf, count, HID_OUTPUT_REPORT); + } + +-static struct hid_ll_driver uhid_hid_driver = { ++struct hid_ll_driver uhid_hid_driver = { + .start = uhid_hid_start, + .stop = uhid_hid_stop, + .open = uhid_hid_open, +@@ -383,6 +383,7 @@ static struct hid_ll_driver uhid_hid_driver = { + .raw_request = uhid_hid_raw_request, + .output_report = uhid_hid_output_report, + }; ++EXPORT_SYMBOL_GPL(uhid_hid_driver); + + #ifdef CONFIG_COMPAT + diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c -index 7838343eb37c..b6600329a272 100644 +index 7838343eb37c..cb57ccff31c2 100644 --- a/drivers/hid/usbhid/hid-core.c +++ b/drivers/hid/usbhid/hid-core.c @@ -372,7 +372,7 @@ static int hid_submit_ctrl(struct hid_device *hid) @@ -32466,6 +45902,53 @@ index 7838343eb37c..b6600329a272 100644 if (dir == USB_DIR_OUT) { usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0); usbhid->urbctrl->transfer_buffer_length = len; +@@ -500,7 +500,7 @@ static void hid_ctrl(struct urb *urb) + + if (unplug) { + usbhid->ctrltail = usbhid->ctrlhead; +- } else { ++ } else if (usbhid->ctrlhead != usbhid->ctrltail) { + usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1); + + if (usbhid->ctrlhead != usbhid->ctrltail && +@@ -1185,9 +1185,20 @@ static void usbhid_stop(struct hid_device *hid) + usbhid->intf->needs_remote_wakeup = 0; + + clear_bit(HID_STARTED, &usbhid->iofl); ++ + spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */ + set_bit(HID_DISCONNECTED, &usbhid->iofl); ++ while (usbhid->ctrltail != usbhid->ctrlhead) { ++ if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) { ++ kfree(usbhid->ctrl[usbhid->ctrltail].raw_report); ++ usbhid->ctrl[usbhid->ctrltail].raw_report = NULL; ++ } ++ ++ usbhid->ctrltail = (usbhid->ctrltail + 1) & ++ (HID_CONTROL_FIFO_SIZE - 1); ++ } + spin_unlock_irq(&usbhid->lock); ++ + usb_kill_urb(usbhid->urbin); + usb_kill_urb(usbhid->urbout); + usb_kill_urb(usbhid->urbctrl); +@@ -1261,7 +1272,7 @@ static int usbhid_idle(struct hid_device *hid, int report, int idle, + return hid_set_idle(dev, ifnum, report, idle); + } + +-static struct hid_ll_driver usb_hid_driver = { ++struct hid_ll_driver usb_hid_driver = { + .parse = usbhid_parse, + .start = usbhid_start, + .stop = usbhid_stop, +@@ -1274,6 +1285,7 @@ static struct hid_ll_driver usb_hid_driver = { + .output_report = usbhid_output_report, + .idle = usbhid_idle, + }; ++EXPORT_SYMBOL_GPL(usb_hid_driver); + + static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *id) + { diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c index 08174d341f4a..bc75f1efa0f4 100644 --- a/drivers/hid/usbhid/hid-pidff.c @@ -32499,6 +45982,55 @@ index dbdd265075da..7bce23a43907 100644 field->value[uref->usage_index] = uref->value; goto goodreturn; +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index e8b90b534f08..b74fcda49a22 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -506,7 +506,7 @@ static void wacom_retrieve_hid_descriptor(struct hid_device *hdev, + * Skip the query for this type and modify defaults based on + * interface number. + */ +- if (features->type == WIRELESS) { ++ if (features->type == WIRELESS && intf) { + if (intf->cur_altsetting->desc.bInterfaceNumber == 0) + features->device_type = WACOM_DEVICETYPE_WL_MONITOR; + else +@@ -2115,6 +2115,9 @@ static void wacom_wireless_work(struct work_struct *work) + + wacom_destroy_battery(wacom); + ++ if (!usbdev) ++ return; ++ + /* Stylus interface */ + hdev1 = usb_get_intfdata(usbdev->config->interface[1]); + wacom1 = hid_get_drvdata(hdev1); +@@ -2354,8 +2357,6 @@ static void wacom_remote_work(struct work_struct *work) + static int wacom_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { +- struct usb_interface *intf = to_usb_interface(hdev->dev.parent); +- struct usb_device *dev = interface_to_usbdev(intf); + struct wacom *wacom; + struct wacom_wac *wacom_wac; + struct wacom_features *features; +@@ -2388,8 +2389,14 @@ static int wacom_probe(struct hid_device *hdev, + wacom_wac->hid_data.inputmode = -1; + wacom_wac->mode_report = -1; + +- wacom->usbdev = dev; +- wacom->intf = intf; ++ if (hid_is_usb(hdev)) { ++ struct usb_interface *intf = to_usb_interface(hdev->dev.parent); ++ struct usb_device *dev = interface_to_usbdev(intf); ++ ++ wacom->usbdev = dev; ++ wacom->intf = intf; ++ } ++ + mutex_init(&wacom->lock); + INIT_WORK(&wacom->wireless_work, wacom_wireless_work); + INIT_WORK(&wacom->battery_work, wacom_battery_work); diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c index 9a29b34ed2c8..22cd7169011d 100644 --- a/drivers/hsi/controllers/omap_ssi_core.c @@ -32599,6 +46131,18 @@ index 9360cdce740e..60c122b355ea 100644 /* * We're crashing and already got the UNLOAD_RESPONSE, cleanup all * maybe-pending messages on all CPUs to be able to receive new +diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h +index 8d7f865c1133..9d3605df1f48 100644 +--- a/drivers/hv/hyperv_vmbus.h ++++ b/drivers/hv/hyperv_vmbus.h +@@ -26,6 +26,7 @@ + #define _HYPERV_VMBUS_H + + #include ++#include + #include + #include + #include diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c index e27f7e12c05b..9b4ad6c74041 100644 --- a/drivers/hwmon/acpi_power_meter.c @@ -32708,6 +46252,31 @@ index 0af7fd311979..587fc5c686b3 100644 } static ssize_t applesmc_key_at_index_read_show(struct device *dev, +diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c +index 34704b0451b4..d19ad92eede9 100644 +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -578,15 +578,18 @@ static const struct file_operations i8k_fops = { + .unlocked_ioctl = i8k_ioctl, + }; + ++static struct proc_dir_entry *entry; ++ + static void __init i8k_init_procfs(void) + { + /* Register the proc entry */ +- proc_create("i8k", 0, NULL, &i8k_fops); ++ entry = proc_create("i8k", 0, NULL, &i8k_fops); + } + + static void __exit i8k_exit_procfs(void) + { +- remove_proc_entry("i8k", NULL); ++ if (entry) ++ remove_proc_entry("i8k", NULL); + } + + #else diff --git a/drivers/hwmon/emc2103.c b/drivers/hwmon/emc2103.c index 24e395c5907d..7204ebf32351 100644 --- a/drivers/hwmon/emc2103.c @@ -32721,6 +46290,23 @@ index 24e395c5907d..7204ebf32351 100644 count = result; goto err; } +diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c +index e0a1a118514f..8b11d2fdf80a 100644 +--- a/drivers/hwmon/hwmon.c ++++ b/drivers/hwmon/hwmon.c +@@ -592,8 +592,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, + dev_set_drvdata(hdev, drvdata); + dev_set_name(hdev, HWMON_ID_FORMAT, id); + err = device_register(hdev); +- if (err) +- goto free_hwmon; ++ if (err) { ++ put_device(hdev); ++ goto ida_remove; ++ } + + if (chip && chip->ops->is_visible && chip->ops->read && + chip->info[0]->type == hwmon_chip && diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c index be60bd5bab78..ee6d499edc1b 100644 --- a/drivers/hwmon/lm80.c @@ -32751,7 +46337,7 @@ index be60bd5bab78..ee6d499edc1b 100644 hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, data, lm80_groups); diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c -index 841f2428e84a..293d1184976b 100644 +index 841f2428e84a..1e9f029a328a 100644 --- a/drivers/hwmon/lm90.c +++ b/drivers/hwmon/lm90.c @@ -186,6 +186,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, @@ -32762,7 +46348,15 @@ index 841f2428e84a..293d1184976b 100644 /* LM90 status */ #define LM90_STATUS_LTHRM (1 << 0) /* local THERM limit tripped */ -@@ -286,6 +287,7 @@ static const struct lm90_params lm90_params[] = { +@@ -195,6 +196,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + #define LM90_STATUS_RHIGH (1 << 4) /* remote high temp limit tripped */ + #define LM90_STATUS_LLOW (1 << 5) /* local low temp limit tripped */ + #define LM90_STATUS_LHIGH (1 << 6) /* local high temp limit tripped */ ++#define LM90_STATUS_BUSY (1 << 7) /* conversion is ongoing */ + + #define MAX6696_STATUS2_R2THRM (1 << 1) /* remote2 THERM limit tripped */ + #define MAX6696_STATUS2_R2OPEN (1 << 2) /* remote2 is an open circuit */ +@@ -286,6 +288,7 @@ static const struct lm90_params lm90_params[] = { .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, }, [max6657] = { @@ -32770,7 +46364,7 @@ index 841f2428e84a..293d1184976b 100644 .alert_alarms = 0x7c, .max_convrate = 8, .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, -@@ -486,6 +488,38 @@ static inline int lm90_select_remote_channel(struct i2c_client *client, +@@ -486,6 +489,38 @@ static inline int lm90_select_remote_channel(struct i2c_client *client, return 0; } @@ -32809,7 +46403,7 @@ index 841f2428e84a..293d1184976b 100644 /* * Set conversion rate. * client->update_lock must be held when calling this function (unless we are -@@ -506,7 +540,7 @@ static int lm90_set_convrate(struct i2c_client *client, struct lm90_data *data, +@@ -506,7 +541,7 @@ static int lm90_set_convrate(struct i2c_client *client, struct lm90_data *data, if (interval >= update_interval * 3 / 4) break; @@ -32818,6 +46412,30 @@ index 841f2428e84a..293d1184976b 100644 data->update_interval = DIV_ROUND_CLOSEST(update_interval, 64); return err; } +@@ -658,7 +693,7 @@ static int lm90_update_device(struct device *dev) + val = lm90_read_reg(client, LM90_REG_R_STATUS); + if (val < 0) + return val; +- data->alarms = val; /* lower 8 bit of alarms */ ++ data->alarms = val & ~LM90_STATUS_BUSY; + + if (data->kind == max6696) { + val = lm90_select_remote_channel(client, data, 1); +@@ -1311,12 +1346,11 @@ static int lm90_detect(struct i2c_client *client, + if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0) + return -ENODEV; + +- if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) { ++ if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) { + config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2); + if (config2 < 0) + return -ENODEV; +- } else +- config2 = 0; /* Make compiler happy */ ++ } + + if ((address == 0x4C || address == 0x4D) + && man_id == 0x01) { /* National Semiconductor */ @@ -1512,8 +1546,7 @@ static void lm90_restore_conf(void *_data) struct i2c_client *client = data->client; @@ -32919,6 +46537,184 @@ index f03a71722849..d4bb3d6aaf18 100644 if (ret < 0) return ret; +diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c +index a3d912cd3b8d..5081fd7e8fdd 100644 +--- a/drivers/hwmon/pmbus/lm25066.c ++++ b/drivers/hwmon/pmbus/lm25066.c +@@ -69,22 +69,27 @@ static struct __coeff lm25066_coeff[5][PSC_NUM_CLASSES + 2] = { + [lm25056] = { + [PSC_VOLTAGE_IN] = { + .m = 16296, ++ .b = 1343, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13797, ++ .b = -1833, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6726, ++ .b = -537, + .R = -2, + }, + [PSC_POWER] = { + .m = 5501, ++ .b = -2908, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 26882, ++ .b = -5646, + .R = -4, + }, + [PSC_TEMPERATURE] = { +@@ -96,26 +101,32 @@ static struct __coeff lm25066_coeff[5][PSC_NUM_CLASSES + 2] = { + [lm25066] = { + [PSC_VOLTAGE_IN] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 22070, ++ .b = -1800, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 13661, ++ .b = -5200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 6852, ++ .b = -3100, + .R = -2, + }, + [PSC_POWER] = { + .m = 736, ++ .b = -3300, + .R = -2, + }, + [PSC_POWER_L] = { + .m = 369, ++ .b = -1900, + .R = -2, + }, + [PSC_TEMPERATURE] = { +@@ -155,26 +166,32 @@ static struct __coeff lm25066_coeff[5][PSC_NUM_CLASSES + 2] = { + [lm5064] = { + [PSC_VOLTAGE_IN] = { + .m = 4611, ++ .b = -642, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4621, ++ .b = 423, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10742, ++ .b = 1552, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5456, ++ .b = 2118, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = 8524, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 612, ++ .b = 11202, + .R = -3, + }, + [PSC_TEMPERATURE] = { +@@ -184,26 +201,32 @@ static struct __coeff lm25066_coeff[5][PSC_NUM_CLASSES + 2] = { + [lm5066] = { + [PSC_VOLTAGE_IN] = { + .m = 4587, ++ .b = -1200, + .R = -2, + }, + [PSC_VOLTAGE_OUT] = { + .m = 4587, ++ .b = -2400, + .R = -2, + }, + [PSC_CURRENT_IN] = { + .m = 10753, ++ .b = -1200, + .R = -2, + }, + [PSC_CURRENT_IN_L] = { + .m = 5405, ++ .b = -600, + .R = -2, + }, + [PSC_POWER] = { + .m = 1204, ++ .b = -6000, + .R = -3, + }, + [PSC_POWER_L] = { + .m = 605, ++ .b = -8000, + .R = -3, + }, + [PSC_TEMPERATURE] = { +diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c +index bfb98b96c781..324e7aaeb0b1 100644 +--- a/drivers/hwmon/tmp421.c ++++ b/drivers/hwmon/tmp421.c +@@ -83,23 +83,17 @@ struct tmp421_data { + s16 temp[4]; + }; + +-static int temp_from_s16(s16 reg) ++static int temp_from_raw(u16 reg, bool extended) + { + /* Mask out status bits */ + int temp = reg & ~0xf; + +- return (temp * 1000 + 128) / 256; +-} +- +-static int temp_from_u16(u16 reg) +-{ +- /* Mask out status bits */ +- int temp = reg & ~0xf; +- +- /* Add offset for extended temperature range. */ +- temp -= 64 * 256; ++ if (extended) ++ temp = temp - 64 * 256; ++ else ++ temp = (s16)temp; + +- return (temp * 1000 + 128) / 256; ++ return DIV_ROUND_CLOSEST(temp * 1000, 256); + } + + static struct tmp421_data *tmp421_update_device(struct device *dev) +@@ -136,10 +130,8 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type, + + switch (attr) { + case hwmon_temp_input: +- if (tmp421->config & TMP421_CONFIG_RANGE) +- *val = temp_from_u16(tmp421->temp[channel]); +- else +- *val = temp_from_s16(tmp421->temp[channel]); ++ *val = temp_from_raw(tmp421->temp[channel], ++ tmp421->config & TMP421_CONFIG_RANGE); + return 0; + case hwmon_temp_fault: + /* diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c index 98a4cb5d4993..9c236c88bc7b 100644 --- a/drivers/hwtracing/intel_th/gth.c @@ -33142,6 +46938,19 @@ index 0218ba6eb26a..ad33c1e3a30f 100644 ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0, "em_i2c", priv); if (ret) +diff --git a/drivers/i2c/busses/i2c-highlander.c b/drivers/i2c/busses/i2c-highlander.c +index 56dc69e7349f..9ad031ea3300 100644 +--- a/drivers/i2c/busses/i2c-highlander.c ++++ b/drivers/i2c/busses/i2c-highlander.c +@@ -382,7 +382,7 @@ static int highlander_i2c_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, dev); + + dev->irq = platform_get_irq(pdev, 0); +- if (iic_force_poll) ++ if (dev->irq < 0 || iic_force_poll) + dev->irq = 0; + + if (dev->irq) { diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c index 26f1691f67ab..0e04b27e3158 100644 --- a/drivers/i2c/busses/i2c-i801.c @@ -33369,6 +47178,29 @@ index 9c1be9378dfd..b91ad668202e 100644 clk_disable_unprepare(i2c_imx->clk); pm_runtime_put_noidle(&pdev->dev); +diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c +index 85cbe4b55578..d4fe7ccccb22 100644 +--- a/drivers/i2c/busses/i2c-iop3xx.c ++++ b/drivers/i2c/busses/i2c-iop3xx.c +@@ -456,16 +456,14 @@ iop3xx_i2c_probe(struct platform_device *pdev) + + irq = platform_get_irq(pdev, 0); + if (irq < 0) { +- ret = -ENXIO; ++ ret = irq; + goto unmap; + } + ret = request_irq(irq, iop3xx_i2c_irq_handler, 0, + pdev->name, adapter_data); + +- if (ret) { +- ret = -EIO; ++ if (ret) + goto unmap; +- } + + memcpy(new_adapter->name, pdev->name, strlen(pdev->name)); + new_adapter->owner = THIS_MODULE; diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c index 41ca9ff7b5da..4dd800c0db14 100644 --- a/drivers/i2c/busses/i2c-jz4780.c @@ -33554,6 +47386,19 @@ index 565a49a0c564..90e4f839eb1c 100644 result = i2c_add_adapter(&i2c->adap); if (result < 0) +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 4a7d9bc2142b..0f905f8387f2 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -708,7 +708,7 @@ static int mtk_i2c_probe(struct platform_device *pdev) + return PTR_ERR(i2c->pdmabase); + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) ++ if (irq < 0) + return irq; + + init_completion(&i2c->msg_complete); diff --git a/drivers/i2c/busses/i2c-octeon-core.c b/drivers/i2c/busses/i2c-octeon-core.c index 5e63b17f935d..e5ad3f9cd372 100644 --- a/drivers/i2c/busses/i2c-octeon-core.c @@ -33689,6 +47534,21 @@ index 93b8069041bb..6be02da2ccc4 100644 rcar_i2c_write(priv, ICSCR, SIE | SDBS); return 0; +diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c +index df220666d627..b4f8cd7dc8b7 100644 +--- a/drivers/i2c/busses/i2c-rk3x.c ++++ b/drivers/i2c/busses/i2c-rk3x.c +@@ -424,8 +424,8 @@ static void rk3x_i2c_handle_read(struct rk3x_i2c *i2c, unsigned int ipd) + if (!(ipd & REG_INT_MBRF)) + return; + +- /* ack interrupt */ +- i2c_writel(i2c, REG_INT_MBRF, REG_IPD); ++ /* ack interrupt (read also produces a spurious START flag, clear it too) */ ++ i2c_writel(i2c, REG_INT_MBRF | REG_INT_START, REG_IPD); + + /* Can only handle a maximum of 32 bytes at a time */ + if (len > 32) diff --git a/drivers/i2c/busses/i2c-robotfuzz-osif.c b/drivers/i2c/busses/i2c-robotfuzz-osif.c index 89d8b41b6668..032e8535e860 100644 --- a/drivers/i2c/busses/i2c-robotfuzz-osif.c @@ -33712,7 +47572,7 @@ index 89d8b41b6668..032e8535e860 100644 if (ret) { dev_err(&interface->dev, "failure sending bit rate"); diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c -index 499af26e736e..acccdfb95420 100644 +index 499af26e736e..3814c160ff17 100644 --- a/drivers/i2c/busses/i2c-s3c2410.c +++ b/drivers/i2c/busses/i2c-s3c2410.c @@ -495,7 +495,10 @@ static int i2c_s3c_irq_nextbyte(struct s3c24xx_i2c *i2c, unsigned long iicstat) @@ -33726,6 +47586,15 @@ index 499af26e736e..acccdfb95420 100644 } goto retry_write; +@@ -1178,7 +1181,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) + */ + if (!(i2c->quirks & QUIRK_POLL)) { + i2c->irq = ret = platform_get_irq(pdev, 0); +- if (ret <= 0) { ++ if (ret < 0) { + dev_err(&pdev->dev, "cannot find IRQ\n"); + clk_unprepare(i2c->clk); + return ret; diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c index c2005c789d2b..319d1fa617c8 100644 --- a/drivers/i2c/busses/i2c-sh7760.c @@ -33742,6 +47611,27 @@ index c2005c789d2b..319d1fa617c8 100644 id->adap.nr = pdev->id; id->adap.algo = &sh7760_i2c_algo; +diff --git a/drivers/i2c/busses/i2c-xlr.c b/drivers/i2c/busses/i2c-xlr.c +index ad17d88d8573..63f47e07345c 100644 +--- a/drivers/i2c/busses/i2c-xlr.c ++++ b/drivers/i2c/busses/i2c-xlr.c +@@ -434,11 +434,15 @@ static int xlr_i2c_probe(struct platform_device *pdev) + i2c_set_adapdata(&priv->adap, priv); + ret = i2c_add_numbered_adapter(&priv->adap); + if (ret < 0) +- return ret; ++ goto err_unprepare_clk; + + platform_set_drvdata(pdev, priv); + dev_info(&priv->adap.dev, "Added I2C Bus.\n"); + return 0; ++ ++err_unprepare_clk: ++ clk_unprepare(clk); ++ return ret; + } + + static int xlr_i2c_remove(struct platform_device *pdev) diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c index 80d82c6792d8..67e44e990777 100644 --- a/drivers/i2c/i2c-core.c @@ -33773,6 +47663,29 @@ index 80d82c6792d8..67e44e990777 100644 if (adap->nr < __i2c_first_dynamic_bus_num) i2c_scan_static_board_info(adap); +diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c +index c4066276eb7b..b7f9fb00f695 100644 +--- a/drivers/i2c/i2c-dev.c ++++ b/drivers/i2c/i2c-dev.c +@@ -148,7 +148,7 @@ static ssize_t i2cdev_read(struct file *file, char __user *buf, size_t count, + if (count > 8192) + count = 8192; + +- tmp = kmalloc(count, GFP_KERNEL); ++ tmp = kzalloc(count, GFP_KERNEL); + if (tmp == NULL) + return -ENOMEM; + +@@ -157,7 +157,8 @@ static ssize_t i2cdev_read(struct file *file, char __user *buf, size_t count, + + ret = i2c_master_recv(client, tmp, count); + if (ret >= 0) +- ret = copy_to_user(buf, tmp, count) ? -EFAULT : ret; ++ if (copy_to_user(buf, tmp, ret)) ++ ret = -EFAULT; + kfree(tmp); + return ret; + } diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c index 9c4ac26c014e..6f673b0cc803 100644 --- a/drivers/i2c/muxes/i2c-mux-pca954x.c @@ -34063,7 +47976,7 @@ index b6254ce9ab3b..86fe94f9511f 100644 tstamp += sample_period; } diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c -index 780f886ccbfe..626a605a0c0e 100644 +index 780f886ccbfe..799457aa3602 100644 --- a/drivers/iio/accel/kxcjk-1013.c +++ b/drivers/iio/accel/kxcjk-1013.c @@ -91,12 +91,28 @@ enum kx_chipset { @@ -34163,11 +48076,31 @@ index 780f886ccbfe..626a605a0c0e 100644 ret = devm_request_threaded_irq(&client->dev, client->irq, kxcjk1013_data_rdy_trig_poll, kxcjk1013_event_handler, +@@ -1281,8 +1290,7 @@ static int kxcjk1013_probe(struct i2c_client *client, + return 0; + + err_buffer_cleanup: +- if (data->dready_trig) +- iio_triggered_buffer_cleanup(indio_dev); ++ iio_triggered_buffer_cleanup(indio_dev); + err_trigger_unregister: + if (data->dready_trig) + iio_trigger_unregister(data->dready_trig); +@@ -1305,8 +1313,8 @@ static int kxcjk1013_remove(struct i2c_client *client) + pm_runtime_set_suspended(&client->dev); + pm_runtime_put_noidle(&client->dev); + ++ iio_triggered_buffer_cleanup(indio_dev); + if (data->dready_trig) { +- iio_triggered_buffer_cleanup(indio_dev); + iio_trigger_unregister(data->dready_trig); + iio_trigger_unregister(data->motion_trig); + } diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c -index 9af60ac70738..1bda730a71c0 100644 +index 9af60ac70738..c3ac798083f4 100644 --- a/drivers/iio/accel/kxsd9.c +++ b/drivers/iio/accel/kxsd9.c -@@ -212,14 +212,20 @@ static irqreturn_t kxsd9_trigger_handler(int irq, void *p) +@@ -212,23 +212,29 @@ static irqreturn_t kxsd9_trigger_handler(int irq, void *p) const struct iio_poll_func *pf = p; struct iio_dev *indio_dev = pf->indio_dev; struct kxsd9_state *st = iio_priv(indio_dev); @@ -34190,17 +48123,21 @@ index 9af60ac70738..1bda730a71c0 100644 + hw_values.chan, + sizeof(hw_values.chan)); if (ret) { - dev_err(st->dev, - "error reading data\n"); -@@ -227,7 +233,7 @@ static irqreturn_t kxsd9_trigger_handler(int irq, void *p) +- dev_err(st->dev, +- "error reading data\n"); +- return ret; ++ dev_err(st->dev, "error reading data: %d\n", ret); ++ goto out; } iio_push_to_buffers_with_timestamp(indio_dev, - hw_values, + &hw_values, iio_get_time_ns(indio_dev)); ++out: iio_trigger_notify_done(indio_dev->trig); + return IRQ_HANDLED; diff --git a/drivers/iio/accel/mma7455_core.c b/drivers/iio/accel/mma7455_core.c index 6551085bedd7..f7804e56cc27 100644 --- a/drivers/iio/accel/mma7455_core.c @@ -34245,7 +48182,7 @@ index 6551085bedd7..f7804e56cc27 100644 done: diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c -index d41e1b588e68..90d4179e8c3d 100644 +index d41e1b588e68..0346c37b1e28 100644 --- a/drivers/iio/accel/mma8452.c +++ b/drivers/iio/accel/mma8452.c @@ -105,6 +105,12 @@ struct mma8452_data { @@ -34278,6 +48215,15 @@ index d41e1b588e68..90d4179e8c3d 100644 iio_get_time_ns(indio_dev)); done: +@@ -1384,7 +1389,7 @@ static int mma8452_trigger_setup(struct iio_dev *indio_dev) + if (ret) + return ret; + +- indio_dev->trig = trig; ++ indio_dev->trig = iio_trigger_get(trig); + + return 0; + } @@ -1576,10 +1581,13 @@ static int mma8452_probe(struct i2c_client *client, ret = mma8452_set_freefall_mode(data, false); @@ -34481,6 +48427,21 @@ index 254135e07792..6cc6666180eb 100644 } static int mcp3422_read_raw(struct iio_dev *iio, +diff --git a/drivers/iio/adc/palmas_gpadc.c b/drivers/iio/adc/palmas_gpadc.c +index 7d61b566e148..f5218461ae25 100644 +--- a/drivers/iio/adc/palmas_gpadc.c ++++ b/drivers/iio/adc/palmas_gpadc.c +@@ -660,8 +660,8 @@ static int palmas_adc_wakeup_configure(struct palmas_gpadc *adc) + + adc_period = adc->auto_conversion_period; + for (i = 0; i < 16; ++i) { +- if (((1000 * (1 << i)) / 32) < adc_period) +- continue; ++ if (((1000 * (1 << i)) / 32) >= adc_period) ++ break; + } + if (i > 0) + i--; diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c index 85d701291654..7e72dab45932 100644 --- a/drivers/iio/adc/rockchip_saradc.c @@ -34580,6 +48541,24 @@ index 072f03bfe6a0..1410a41782cc 100644 iio_get_time_ns(indio_dev)); out: mutex_unlock(&adc->lock); +diff --git a/drivers/iio/adc/ti-adc128s052.c b/drivers/iio/adc/ti-adc128s052.c +index 89dfbd31be5c..b7c7cba2dc09 100644 +--- a/drivers/iio/adc/ti-adc128s052.c ++++ b/drivers/iio/adc/ti-adc128s052.c +@@ -169,7 +169,13 @@ static int adc128_probe(struct spi_device *spi) + mutex_init(&adc->lock); + + ret = iio_device_register(indio_dev); ++ if (ret) ++ goto err_disable_regulator; + ++ return 0; ++ ++err_disable_regulator: ++ regulator_disable(adc->reg); + return ret; + } + diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c index af05e20c986b..d892c0fe5c31 100644 --- a/drivers/iio/adc/ti-ads1015.c @@ -34667,6 +48646,73 @@ index d1bde6d2721e..2a14800e6514 100644 iio_get_time_ns(indio_dev)); iio_trigger_notify_done(indio_dev->trig); } else +diff --git a/drivers/iio/common/ssp_sensors/ssp_spi.c b/drivers/iio/common/ssp_sensors/ssp_spi.c +index 704284a475ae..645749b90ec0 100644 +--- a/drivers/iio/common/ssp_sensors/ssp_spi.c ++++ b/drivers/iio/common/ssp_sensors/ssp_spi.c +@@ -147,7 +147,7 @@ static int ssp_print_mcu_debug(char *data_frame, int *data_index, + if (length > received_len - *data_index || length <= 0) { + ssp_dbg("[SSP]: MSG From MCU-invalid debug length(%d/%d)\n", + length, received_len); +- return length ? length : -EPROTO; ++ return -EPROTO; + } + + ssp_dbg("[SSP]: MSG From MCU - %s\n", &data_frame[*data_index]); +@@ -286,6 +286,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) + for (idx = 0; idx < len;) { + switch (dataframe[idx++]) { + case SSP_MSG2AP_INST_BYPASS_DATA: ++ if (idx >= len) ++ return -EPROTO; + sd = dataframe[idx++]; + if (sd < 0 || sd >= SSP_SENSOR_MAX) { + dev_err(SSP_DEV, +@@ -295,10 +297,13 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) + + if (indio_devs[sd]) { + spd = iio_priv(indio_devs[sd]); +- if (spd->process_data) ++ if (spd->process_data) { ++ if (idx >= len) ++ return -EPROTO; + spd->process_data(indio_devs[sd], + &dataframe[idx], + data->timestamp); ++ } + } else { + dev_err(SSP_DEV, "no client for frame\n"); + } +@@ -306,6 +311,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) + idx += ssp_offset_map[sd]; + break; + case SSP_MSG2AP_INST_DEBUG_DATA: ++ if (idx >= len) ++ return -EPROTO; + sd = ssp_print_mcu_debug(dataframe, &idx, len); + if (sd) { + dev_err(SSP_DEV, +diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c +index b555552a0d80..d3a3d62869d8 100644 +--- a/drivers/iio/dac/ad5446.c ++++ b/drivers/iio/dac/ad5446.c +@@ -510,8 +510,15 @@ static int ad5622_write(struct ad5446_state *st, unsigned val) + { + struct i2c_client *client = to_i2c_client(st->dev); + __be16 data = cpu_to_be16(val); ++ int ret; ++ ++ ret = i2c_master_send(client, (char *)&data, sizeof(data)); ++ if (ret < 0) ++ return ret; ++ if (ret != sizeof(data)) ++ return -EIO; + +- return i2c_master_send(client, (char *)&data, sizeof(data)); ++ return 0; + } + + /** diff --git a/drivers/iio/dac/ad5504.c b/drivers/iio/dac/ad5504.c index 788b3d6fd1cc..b15a02f502df 100644 --- a/drivers/iio/dac/ad5504.c @@ -34705,6 +48751,42 @@ index 69bde5909854..5c998ac8c840 100644 } unlock: +diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c +index 5489ec43b95d..e5cefdb674f8 100644 +--- a/drivers/iio/dac/ad5624r_spi.c ++++ b/drivers/iio/dac/ad5624r_spi.c +@@ -231,7 +231,7 @@ static int ad5624r_probe(struct spi_device *spi) + if (!indio_dev) + return -ENOMEM; + st = iio_priv(indio_dev); +- st->reg = devm_regulator_get(&spi->dev, "vcc"); ++ st->reg = devm_regulator_get_optional(&spi->dev, "vref"); + if (!IS_ERR(st->reg)) { + ret = regulator_enable(st->reg); + if (ret) +@@ -242,6 +242,22 @@ static int ad5624r_probe(struct spi_device *spi) + goto error_disable_reg; + + voltage_uv = ret; ++ } else { ++ if (PTR_ERR(st->reg) != -ENODEV) ++ return PTR_ERR(st->reg); ++ /* Backwards compatibility. This naming is not correct */ ++ st->reg = devm_regulator_get_optional(&spi->dev, "vcc"); ++ if (!IS_ERR(st->reg)) { ++ ret = regulator_enable(st->reg); ++ if (ret) ++ return ret; ++ ++ ret = regulator_get_voltage(st->reg); ++ if (ret < 0) ++ goto error_disable_reg; ++ ++ voltage_uv = ret; ++ } + } + + spi_set_drvdata(spi, indio_dev); diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c index b5a5517e3ce1..ec2830c16433 100644 --- a/drivers/iio/gyro/bmg160_core.c @@ -34738,10 +48820,10 @@ index b5a5517e3ce1..ec2830c16433 100644 err: iio_trigger_notify_done(indio_dev->trig); diff --git a/drivers/iio/gyro/itg3200_buffer.c b/drivers/iio/gyro/itg3200_buffer.c -index eef50e91f17c..e04483254b28 100644 +index eef50e91f17c..7157b1a731a6 100644 --- a/drivers/iio/gyro/itg3200_buffer.c +++ b/drivers/iio/gyro/itg3200_buffer.c -@@ -49,13 +49,20 @@ static irqreturn_t itg3200_trigger_handler(int irq, void *p) +@@ -49,17 +49,24 @@ static irqreturn_t itg3200_trigger_handler(int irq, void *p) struct iio_poll_func *pf = p; struct iio_dev *indio_dev = pf->indio_dev; struct itg3200 *st = iio_priv(indio_dev); @@ -34764,8 +48846,13 @@ index eef50e91f17c..e04483254b28 100644 - iio_push_to_buffers_with_timestamp(indio_dev, buf, pf->timestamp); + iio_push_to_buffers_with_timestamp(indio_dev, &scan, pf->timestamp); ++error_ret: iio_trigger_notify_done(indio_dev->trig); +-error_ret: + return IRQ_HANDLED; + } + diff --git a/drivers/iio/health/afe4403.c b/drivers/iio/health/afe4403.c index 6bb23a49e81e..2f07c4d1398c 100644 --- a/drivers/iio/health/afe4403.c @@ -35089,7 +49176,7 @@ index 1d2c0c8a1d4f..207b856cef8c 100644 done: diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c -index c298fd86ed86..414fe857fa9d 100644 +index c298fd86ed86..5e3cbb694a75 100644 --- a/drivers/iio/light/ltr501.c +++ b/drivers/iio/light/ltr501.c @@ -35,9 +35,12 @@ @@ -35156,9 +49243,12 @@ index c298fd86ed86..414fe857fa9d 100644 /* figure out which data needs to be ready */ if (test_bit(0, indio_dev->active_scan_mask) || -@@ -1243,9 +1250,9 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p) +@@ -1241,11 +1248,11 @@ static irqreturn_t ltr501_trigger_handler(int irq, void *p) + ret = regmap_bulk_read(data->regmap, LTR501_ALS_DATA1, + (u8 *)als_buf, sizeof(als_buf)); if (ret < 0) - return ret; +- return ret; ++ goto done; if (test_bit(0, indio_dev->active_scan_mask)) - buf[j++] = le16_to_cpu(als_buf[1]); + scan.channels[j++] = le16_to_cpu(als_buf[1]); @@ -35239,6 +49329,30 @@ index a8ffa432bf0d..87662c88fbeb 100644 iio_get_time_ns(indio_dev)); iio_trigger_notify_done(indio_dev->trig); return IRQ_HANDLED; +diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c +index be55477de2ac..0a0e52c95ff2 100644 +--- a/drivers/iio/light/opt3001.c ++++ b/drivers/iio/light/opt3001.c +@@ -283,6 +283,8 @@ static int opt3001_get_lux(struct opt3001 *opt, int *val, int *val2) + ret = wait_event_timeout(opt->result_ready_queue, + opt->result_ready, + msecs_to_jiffies(OPT3001_RESULT_READY_LONG)); ++ if (ret == 0) ++ return -ETIMEDOUT; + } else { + /* Sleep for result ready time */ + timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ? +@@ -319,9 +321,7 @@ static int opt3001_get_lux(struct opt3001 *opt, int *val, int *val2) + /* Disallow IRQ to access the device while lock is active */ + opt->ok_to_ignore_lock = false; + +- if (ret == 0) +- return -ETIMEDOUT; +- else if (ret < 0) ++ if (ret < 0) + return ret; + + if (opt->use_irq) { diff --git a/drivers/iio/light/si1145.c b/drivers/iio/light/si1145.c index 096034c126a4..c292d9816118 100644 --- a/drivers/iio/light/si1145.c @@ -35297,6 +49411,30 @@ index 096034c126a4..c292d9816118 100644 iio_get_time_ns(indio_dev)); done: +diff --git a/drivers/iio/light/stk3310.c b/drivers/iio/light/stk3310.c +index 45cf8b0a4363..ed9cf1ffec7b 100644 +--- a/drivers/iio/light/stk3310.c ++++ b/drivers/iio/light/stk3310.c +@@ -546,9 +546,8 @@ static irqreturn_t stk3310_irq_event_handler(int irq, void *private) + mutex_lock(&data->lock); + ret = regmap_field_read(data->reg_flag_nf, &dir); + if (ret < 0) { +- dev_err(&data->client->dev, "register read failed\n"); +- mutex_unlock(&data->lock); +- return ret; ++ dev_err(&data->client->dev, "register read failed: %d\n", ret); ++ goto out; + } + event = IIO_UNMOD_EVENT_CODE(IIO_PROXIMITY, 1, + IIO_EV_TYPE_THRESH, +@@ -560,6 +559,7 @@ static irqreturn_t stk3310_irq_event_handler(int irq, void *private) + ret = regmap_field_write(data->reg_flag_psint, 0); + if (ret < 0) + dev_err(&data->client->dev, "failed to reset interrupts\n"); ++out: + mutex_unlock(&data->lock); + + return IRQ_HANDLED; diff --git a/drivers/iio/light/tcs3414.c b/drivers/iio/light/tcs3414.c index a795afb7667b..b51cd43ef824 100644 --- a/drivers/iio/light/tcs3414.c @@ -35875,6 +50013,47 @@ index bb45eb22ba1f..87bc7b0db892 100644 init_attr->cap.max_inline_data = T4_MAX_SEND_INLINE; init_attr->sq_sig_type = qhp->sq_sig_all ? IB_SIGNAL_ALL_WR : 0; return 0; +diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c +index 9dc8cf096e2e..93ace2609bdd 100644 +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -955,7 +955,7 @@ void hfi1_free_ctxtdata(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd) + kfree(rcd->egrbufs.rcvtids); + + for (e = 0; e < rcd->egrbufs.alloced; e++) { +- if (rcd->egrbufs.buffers[e].dma) ++ if (rcd->egrbufs.buffers[e].addr) + dma_free_coherent(&dd->pcidev->dev, + rcd->egrbufs.buffers[e].len, + rcd->egrbufs.buffers[e].addr, +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index 76e63c88a87a..e9313e6f4b0e 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -3028,6 +3028,7 @@ static void __sdma_process_event(struct sdma_engine *sde, + static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + { + int i; ++ struct sdma_desc *descp; + + /* Handle last descriptor */ + if (unlikely((tx->num_desc == (MAX_DESC - 1)))) { +@@ -3048,12 +3049,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + if (unlikely(tx->num_desc == MAX_DESC)) + goto enomem; + +- tx->descp = kmalloc_array( +- MAX_DESC, +- sizeof(struct sdma_desc), +- GFP_ATOMIC); +- if (!tx->descp) ++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC); ++ if (!descp) + goto enomem; ++ tx->descp = descp; + + /* reserve last descriptor for coalescing */ + tx->desc_limit = MAX_DESC - 1; diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c index 20ec34761b39..29cd059c01f1 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c @@ -36128,6 +50307,22 @@ index 35141f451e5c..91c89ef6ce04 100644 struct workqueue_struct *ud_wq; spinlock_t ud_lock; atomic64_t subnet_prefix; +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 7284a9176844..718d81726579 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -773,8 +773,10 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd, + if (dev->steering_support == + MLX4_STEERING_MODE_DEVICE_MANAGED) + qp->flags |= MLX4_IB_QP_NETIF; +- else ++ else { ++ err = -EINVAL; + goto err; ++ } + } + + memcpy(&backup_cap, &init_attr->cap, sizeof(backup_cap)); diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c index a6531ffe29a6..098653b8157e 100644 --- a/drivers/infiniband/hw/mthca/mthca_cq.c @@ -36191,6 +50386,138 @@ index f937873e93df..b95f1457c407 100644 if (page_size > PAGE_SIZE) { DP_ERR(dev, "Kernel PAGE_SIZE is %ld which is smaller than minimum page size (%d) required by qedr\n", +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 7603a1641c7d..38c651f1a606 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -2015,15 +2015,18 @@ int qedr_query_qp(struct ib_qp *ibqp, + int rc = 0; + + memset(¶ms, 0, sizeof(params)); +- +- rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms); +- if (rc) +- goto err; +- + memset(qp_attr, 0, sizeof(*qp_attr)); + memset(qp_init_attr, 0, sizeof(*qp_init_attr)); + +- qp_attr->qp_state = qedr_get_ibqp_state(params.state); ++ if (qp->qp_type != IB_QPT_GSI) { ++ rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms); ++ if (rc) ++ goto err; ++ qp_attr->qp_state = qedr_get_ibqp_state(params.state); ++ } else { ++ qp_attr->qp_state = qedr_get_ibqp_state(QED_ROCE_QP_STATE_RTS); ++ } ++ + qp_attr->cur_qp_state = qedr_get_ibqp_state(params.state); + qp_attr->path_mtu = iboe_get_mtu(params.mtu); + qp_attr->path_mig_state = IB_MIG_MIGRATED; +diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c +index 3e0677c51276..2d0b992579d6 100644 +--- a/drivers/infiniband/hw/qib/qib_user_sdma.c ++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c +@@ -41,6 +41,7 @@ + #include + #include + #include ++#include + + #include "qib.h" + #include "qib_user_sdma.h" +@@ -606,7 +607,7 @@ static int qib_user_sdma_coalesce(const struct qib_devdata *dd, + /* + * How many pages in this iovec element? + */ +-static int qib_user_sdma_num_pages(const struct iovec *iov) ++static size_t qib_user_sdma_num_pages(const struct iovec *iov) + { + const unsigned long addr = (unsigned long) iov->iov_base; + const unsigned long len = iov->iov_len; +@@ -662,7 +663,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev, + static int qib_user_sdma_pin_pages(const struct qib_devdata *dd, + struct qib_user_sdma_queue *pq, + struct qib_user_sdma_pkt *pkt, +- unsigned long addr, int tlen, int npages) ++ unsigned long addr, int tlen, size_t npages) + { + struct page *pages[8]; + int i, j; +@@ -726,7 +727,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd, + unsigned long idx; + + for (idx = 0; idx < niov; idx++) { +- const int npages = qib_user_sdma_num_pages(iov + idx); ++ const size_t npages = qib_user_sdma_num_pages(iov + idx); + const unsigned long addr = (unsigned long) iov[idx].iov_base; + + ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr, +@@ -828,8 +829,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, + unsigned pktnw; + unsigned pktnwc; + int nfrags = 0; +- int npages = 0; +- int bytes_togo = 0; ++ size_t npages = 0; ++ size_t bytes_togo = 0; + int tiddma = 0; + int cfur; + +@@ -889,7 +890,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, + + npages += qib_user_sdma_num_pages(&iov[idx]); + +- bytes_togo += slen; ++ if (check_add_overflow(bytes_togo, slen, &bytes_togo) || ++ bytes_togo > type_max(typeof(pkt->bytes_togo))) { ++ ret = -EINVAL; ++ goto free_pbc; ++ } + pktnwc += slen >> 2; + idx++; + nfrags++; +@@ -908,10 +913,10 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, + } + + if (frag_size) { +- int pktsize, tidsmsize, n; ++ size_t tidsmsize, n, pktsize, sz, addrlimit; + + n = npages*((2*PAGE_SIZE/frag_size)+1); +- pktsize = sizeof(*pkt) + sizeof(pkt->addr[0])*n; ++ pktsize = struct_size(pkt, addr, n); + + /* + * Determine if this is tid-sdma or just sdma. +@@ -926,14 +931,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, + else + tidsmsize = 0; + +- pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL); ++ if (check_add_overflow(pktsize, tidsmsize, &sz)) { ++ ret = -EINVAL; ++ goto free_pbc; ++ } ++ pkt = kmalloc(sz, GFP_KERNEL); + if (!pkt) { + ret = -ENOMEM; + goto free_pbc; + } + pkt->largepkt = 1; + pkt->frag_size = frag_size; +- pkt->addrlimit = n + ARRAY_SIZE(pkt->addr); ++ if (check_add_overflow(n, ARRAY_SIZE(pkt->addr), ++ &addrlimit) || ++ addrlimit > type_max(typeof(pkt->addrlimit))) { ++ ret = -EINVAL; ++ goto free_pkt; ++ } ++ pkt->addrlimit = addrlimit; + + if (tiddma) { + char *tidsm = (char *)pkt + pktsize; diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c index cacb720f44a0..2896808545f4 100644 --- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c @@ -36481,6 +50808,19 @@ index d19e003e8381..f431cecd8b56 100644 if (IS_ERR(recv_sockets.sk6)) { recv_sockets.sk6 = NULL; pr_err("Failed to create IPv6 UDP tunnel\n"); +diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h +index 13ed2cc6eaa2..9f7817e12775 100644 +--- a/drivers/infiniband/sw/rxe/rxe_param.h ++++ b/drivers/infiniband/sw/rxe/rxe_param.h +@@ -144,7 +144,7 @@ enum rxe_port_param { + RXE_PORT_MAX_MTU = IB_MTU_4096, + RXE_PORT_ACTIVE_MTU = IB_MTU_256, + RXE_PORT_GID_TBL_LEN = 1024, +- RXE_PORT_PORT_CAP_FLAGS = RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP, ++ RXE_PORT_PORT_CAP_FLAGS = IB_PORT_CM_SUP, + RXE_PORT_MAX_MSG_SZ = 0x800000, + RXE_PORT_BAD_PKEY_CNTR = 0, + RXE_PORT_QKEY_VIOL_CNTR = 0, diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c index d6672127808b..5fa1442fd4f1 100644 --- a/drivers/infiniband/sw/rxe/rxe_qp.c @@ -36787,7 +51127,7 @@ index f3135ae22df4..39a7abe4b48c 100644 out: kfree(keypam); diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index 54a6691d7d87..4168ed0ef187 100644 +index 54a6691d7d87..f8f6bd92e314 100644 --- a/drivers/input/joystick/xpad.c +++ b/drivers/input/joystick/xpad.c @@ -232,9 +232,17 @@ static const struct xpad_device { @@ -36828,7 +51168,15 @@ index 54a6691d7d87..4168ed0ef187 100644 { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 }, { 0x24c6, 0x5303, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, -@@ -435,6 +448,7 @@ static const struct usb_device_id xpad_table[] = { +@@ -335,6 +348,7 @@ static const struct xpad_device { + { 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 }, + { 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + { 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, ++ { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 }, + { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, + { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, + { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN } +@@ -435,6 +449,7 @@ static const struct usb_device_id xpad_table[] = { XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */ XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */ XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */ @@ -36836,7 +51184,7 @@ index 54a6691d7d87..4168ed0ef187 100644 XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */ XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */ XPAD_XBOX360_VENDOR(0x146b), /* BigBen Interactive Controllers */ -@@ -444,8 +458,12 @@ static const struct usb_device_id xpad_table[] = { +@@ -444,8 +459,13 @@ static const struct usb_device_id xpad_table[] = { XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */ XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ XPAD_XBOX360_VENDOR(0x1bad), /* Harminix Rock Band Guitar and Drums */ @@ -36846,6 +51194,7 @@ index 54a6691d7d87..4168ed0ef187 100644 XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA Controllers */ + XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Duke X-Box One pad */ + XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */ ++ XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */ { } }; @@ -37211,6 +51560,30 @@ index 016397850b1b..9c1f10491ab1 100644 cmd.head.report_id = PIP_APP_CMD_REPORT_ID; cmd.head.cmd_code = PIP_RETRIEVE_DATA_STRUCTURE; put_unaligned_le16(read_offset, &cmd.read_offset); +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 15be3ee6cc50..4aba40c881a7 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -431,6 +431,19 @@ static void elantech_report_trackpoint(struct psmouse *psmouse, + case 0x16008020U: + case 0x26800010U: + case 0x36808000U: ++ ++ /* ++ * This firmware misreport coordinates for trackpoint ++ * occasionally. Discard packets outside of [-127, 127] range ++ * to prevent cursor jumps. ++ */ ++ if (packet[4] == 0x80 || packet[5] == 0x80 || ++ packet[1] >> 7 == packet[4] >> 7 || ++ packet[2] >> 7 == packet[5] >> 7) { ++ elantech_debug("discarding packet [%6ph]\n", packet); ++ break; ++ ++ } + x = packet[4] - (int)((packet[1]^0x80) << 1); + y = (int)((packet[2]^0x80) << 1) - packet[5]; + diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c index 5cbf17aa8443..597ecae02c40 100644 --- a/drivers/input/mouse/psmouse-base.c @@ -37334,7 +51707,7 @@ index d50f0678bf47..078cbe6522a2 100644 static int __init hp_sdc_mlc_init(void) diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index fd1e79013cf8..3049bccf2422 100644 +index fd1e79013cf8..323b86b38b3a 100644 --- a/drivers/input/serio/i8042-x86ia64io.h +++ b/drivers/input/serio/i8042-x86ia64io.h @@ -224,6 +224,12 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { @@ -37350,7 +51723,21 @@ index fd1e79013cf8..3049bccf2422 100644 { } }; -@@ -429,6 +435,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { +@@ -270,6 +276,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"), + }, + }, ++ { ++ /* Fujitsu Lifebook T725 laptop */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"), ++ }, ++ }, + { + /* Fujitsu Lifebook U745 */ + .matches = { +@@ -429,6 +442,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "076804U"), }, }, @@ -37364,7 +51751,7 @@ index fd1e79013cf8..3049bccf2422 100644 { .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -@@ -545,6 +558,14 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { +@@ -545,6 +565,14 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"), }, }, @@ -37379,7 +51766,7 @@ index fd1e79013cf8..3049bccf2422 100644 { } }; -@@ -558,6 +579,11 @@ static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = { +@@ -558,6 +586,11 @@ static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = { DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"), }, @@ -37391,7 +51778,7 @@ index fd1e79013cf8..3049bccf2422 100644 }, { } }; -@@ -668,6 +694,48 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { +@@ -668,6 +701,48 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "AOA150"), }, }, @@ -37440,7 +51827,7 @@ index fd1e79013cf8..3049bccf2422 100644 { /* Advent 4211 */ .matches = { -@@ -745,6 +813,14 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { +@@ -745,6 +820,14 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"), }, }, @@ -37455,7 +51842,7 @@ index fd1e79013cf8..3049bccf2422 100644 { } }; -@@ -774,6 +850,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = { +@@ -774,6 +857,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = { DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"), }, }, @@ -37469,6 +51856,20 @@ index fd1e79013cf8..3049bccf2422 100644 { } }; +@@ -833,6 +923,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"), + }, + }, ++ { ++ /* Fujitsu Lifebook T725 laptop */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"), ++ }, ++ }, + { + /* Fujitsu U574 laptop */ + /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c index c84c685056b9..37f84ba11f05 100644 --- a/drivers/input/serio/i8042.c @@ -37673,6 +52074,49 @@ index 8275267eac25..4be7ddc04af0 100644 out: mutex_unlock(&input_dev->mutex); return retval; +diff --git a/drivers/input/touchscreen/of_touchscreen.c b/drivers/input/touchscreen/of_touchscreen.c +index 8d7f9c8f2771..db499ef6ccff 100644 +--- a/drivers/input/touchscreen/of_touchscreen.c ++++ b/drivers/input/touchscreen/of_touchscreen.c +@@ -79,8 +79,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch, + data_present = touchscreen_get_prop_u32(dev, "touchscreen-size-x", + input_abs_get_max(input, + axis) + 1, +- &maximum) | +- touchscreen_get_prop_u32(dev, "touchscreen-fuzz-x", ++ &maximum); ++ data_present |= touchscreen_get_prop_u32(dev, "touchscreen-fuzz-x", + input_abs_get_fuzz(input, axis), + &fuzz); + if (data_present) +@@ -90,8 +90,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch, + data_present = touchscreen_get_prop_u32(dev, "touchscreen-size-y", + input_abs_get_max(input, + axis) + 1, +- &maximum) | +- touchscreen_get_prop_u32(dev, "touchscreen-fuzz-y", ++ &maximum); ++ data_present |= touchscreen_get_prop_u32(dev, "touchscreen-fuzz-y", + input_abs_get_fuzz(input, axis), + &fuzz); + if (data_present) +@@ -101,11 +101,11 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch, + data_present = touchscreen_get_prop_u32(dev, + "touchscreen-max-pressure", + input_abs_get_max(input, axis), +- &maximum) | +- touchscreen_get_prop_u32(dev, +- "touchscreen-fuzz-pressure", +- input_abs_get_fuzz(input, axis), +- &fuzz); ++ &maximum); ++ data_present |= touchscreen_get_prop_u32(dev, ++ "touchscreen-fuzz-pressure", ++ input_abs_get_fuzz(input, axis), ++ &fuzz); + if (data_present) + touchscreen_set_params(input, axis, maximum, fuzz); + diff --git a/drivers/input/touchscreen/raydium_i2c_ts.c b/drivers/input/touchscreen/raydium_i2c_ts.c index 1f5b6b5b1018..4b9b11ebf29d 100644 --- a/drivers/input/touchscreen/raydium_i2c_ts.c @@ -37810,7 +52254,7 @@ index 499402a975b3..c5d34a782372 100644 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 0, 0, NULL, 0, USB_CTRL_SET_TIMEOUT); diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index bb0448c91f67..8377bd388d67 100644 +index bb0448c91f67..14e9b06829d5 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -1331,24 +1331,26 @@ static void increase_address_space(struct protection_domain *domain, @@ -37819,7 +52263,7 @@ index bb0448c91f67..8377bd388d67 100644 + pte = (void *)get_zeroed_page(gfp); + if (!pte) -+ goto out; ++ return; + spin_lock_irqsave(&domain->lock, flags); @@ -38058,22 +52502,264 @@ index 505548aafeff..cec33e90e399 100644 kfree(buf); diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c -index 9b23843dcad4..7ba1a94497f5 100644 +index 9b23843dcad4..4294523bede5 100644 --- a/drivers/ipack/carriers/tpci200.c +++ b/drivers/ipack/carriers/tpci200.c -@@ -591,8 +591,11 @@ static int tpci200_pci_probe(struct pci_dev *pdev, +@@ -94,16 +94,13 @@ static void tpci200_unregister(struct tpci200_board *tpci200) + free_irq(tpci200->info->pdev->irq, (void *) tpci200); - out_err_bus_register: + pci_iounmap(tpci200->info->pdev, tpci200->info->interface_regs); +- pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs); + + pci_release_region(tpci200->info->pdev, TPCI200_IP_INTERFACE_BAR); + pci_release_region(tpci200->info->pdev, TPCI200_IO_ID_INT_SPACES_BAR); + pci_release_region(tpci200->info->pdev, TPCI200_MEM16_SPACE_BAR); + pci_release_region(tpci200->info->pdev, TPCI200_MEM8_SPACE_BAR); +- pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR); + + pci_disable_device(tpci200->info->pdev); +- pci_dev_put(tpci200->info->pdev); + } + + static void tpci200_enable_irq(struct tpci200_board *tpci200, +@@ -524,7 +521,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + tpci200->info = kzalloc(sizeof(struct tpci200_infos), GFP_KERNEL); + if (!tpci200->info) { + ret = -ENOMEM; +- goto out_err_info; ++ goto err_tpci200; + } + + pci_dev_get(pdev); +@@ -535,7 +532,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + if (ret) { + dev_err(&pdev->dev, "Failed to allocate PCI Configuration Memory"); + ret = -EBUSY; +- goto out_err_pci_request; ++ goto err_tpci200_info; + } + tpci200->info->cfg_regs = ioremap_nocache( + pci_resource_start(pdev, TPCI200_CFG_MEM_BAR), +@@ -543,7 +540,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + if (!tpci200->info->cfg_regs) { + dev_err(&pdev->dev, "Failed to map PCI Configuration Memory"); + ret = -EFAULT; +- goto out_err_ioremap; ++ goto err_request_region; + } + + /* Disable byte swapping for 16 bit IP module access. This will ensure +@@ -566,7 +563,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + if (ret) { + dev_err(&pdev->dev, "error during tpci200 install\n"); + ret = -ENODEV; +- goto out_err_install; ++ goto err_cfg_regs; + } + + /* Register the carrier in the industry pack bus driver */ +@@ -578,7 +575,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, + "error registering the carrier on ipack driver\n"); + ret = -EFAULT; +- goto out_err_bus_register; ++ goto err_tpci200_install; + } + + /* save the bus number given by ipack to logging purpose */ +@@ -589,16 +586,16 @@ static int tpci200_pci_probe(struct pci_dev *pdev, + tpci200_create_device(tpci200, i); + return 0; + +-out_err_bus_register: ++err_tpci200_install: tpci200_uninstall(tpci200); -+ /* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */ -+ tpci200->info->cfg_regs = NULL; - out_err_install: +-out_err_install: - iounmap(tpci200->info->cfg_regs); -+ if (tpci200->info->cfg_regs) -+ iounmap(tpci200->info->cfg_regs); - out_err_ioremap: +-out_err_ioremap: ++err_cfg_regs: ++ pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs); ++err_request_region: pci_release_region(pdev, TPCI200_CFG_MEM_BAR); - out_err_pci_request: +-out_err_pci_request: +- pci_dev_put(pdev); ++err_tpci200_info: + kfree(tpci200->info); +-out_err_info: ++ pci_dev_put(pdev); ++err_tpci200: + kfree(tpci200); + return ret; + } +@@ -608,6 +605,12 @@ static void __tpci200_pci_remove(struct tpci200_board *tpci200) + ipack_bus_unregister(tpci200->info->ipack_bus); + tpci200_uninstall(tpci200); + ++ pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs); ++ ++ pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR); ++ ++ pci_dev_put(tpci200->info->pdev); ++ + kfree(tpci200->info); + kfree(tpci200); + } +diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c +index 75dd15d66df6..f558aeb8f888 100644 +--- a/drivers/ipack/devices/ipoctal.c ++++ b/drivers/ipack/devices/ipoctal.c +@@ -38,6 +38,7 @@ struct ipoctal_channel { + unsigned int pointer_read; + unsigned int pointer_write; + struct tty_port tty_port; ++ bool tty_registered; + union scc2698_channel __iomem *regs; + union scc2698_block __iomem *block_regs; + unsigned int board_id; +@@ -86,22 +87,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty) + return 0; + } + +-static int ipoctal_open(struct tty_struct *tty, struct file *file) ++static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty) + { + struct ipoctal_channel *channel = dev_get_drvdata(tty->dev); + struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index); +- int err; +- +- tty->driver_data = channel; ++ int res; + + if (!ipack_get_carrier(ipoctal->dev)) + return -EBUSY; + +- err = tty_port_open(&channel->tty_port, tty, file); +- if (err) +- ipack_put_carrier(ipoctal->dev); ++ res = tty_standard_install(driver, tty); ++ if (res) ++ goto err_put_carrier; ++ ++ tty->driver_data = channel; ++ ++ return 0; ++ ++err_put_carrier: ++ ipack_put_carrier(ipoctal->dev); ++ ++ return res; ++} ++ ++static int ipoctal_open(struct tty_struct *tty, struct file *file) ++{ ++ struct ipoctal_channel *channel = tty->driver_data; + +- return err; ++ return tty_port_open(&channel->tty_port, tty, file); + } + + static void ipoctal_reset_stats(struct ipoctal_stats *stats) +@@ -269,7 +282,6 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + int res; + int i; + struct tty_driver *tty; +- char name[20]; + struct ipoctal_channel *channel; + struct ipack_region *region; + void __iomem *addr; +@@ -360,8 +372,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + /* Fill struct tty_driver with ipoctal data */ + tty->owner = THIS_MODULE; + tty->driver_name = KBUILD_MODNAME; +- sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot); +- tty->name = name; ++ tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot); ++ if (!tty->name) { ++ res = -ENOMEM; ++ goto err_put_driver; ++ } + tty->major = 0; + + tty->minor_start = 0; +@@ -377,8 +392,7 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + res = tty_register_driver(tty); + if (res) { + dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n"); +- put_tty_driver(tty); +- return res; ++ goto err_free_name; + } + + /* Save struct tty_driver for use it when uninstalling the device */ +@@ -389,7 +403,9 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + + channel = &ipoctal->channel[i]; + tty_port_init(&channel->tty_port); +- tty_port_alloc_xmit_buf(&channel->tty_port); ++ res = tty_port_alloc_xmit_buf(&channel->tty_port); ++ if (res) ++ continue; + channel->tty_port.ops = &ipoctal_tty_port_ops; + + ipoctal_reset_stats(&channel->stats); +@@ -397,13 +413,15 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + spin_lock_init(&channel->lock); + channel->pointer_read = 0; + channel->pointer_write = 0; +- tty_dev = tty_port_register_device(&channel->tty_port, tty, i, NULL); ++ tty_dev = tty_port_register_device_attr(&channel->tty_port, tty, ++ i, NULL, channel, NULL); + if (IS_ERR(tty_dev)) { + dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n"); ++ tty_port_free_xmit_buf(&channel->tty_port); + tty_port_destroy(&channel->tty_port); + continue; + } +- dev_set_drvdata(tty_dev, channel); ++ channel->tty_registered = true; + } + + /* +@@ -415,6 +433,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + ipoctal_irq_handler, ipoctal); + + return 0; ++ ++err_free_name: ++ kfree(tty->name); ++err_put_driver: ++ put_tty_driver(tty); ++ ++ return res; + } + + static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel, +@@ -655,6 +680,7 @@ static void ipoctal_cleanup(struct tty_struct *tty) + + static const struct tty_operations ipoctal_fops = { + .ioctl = NULL, ++ .install = ipoctal_install, + .open = ipoctal_open, + .close = ipoctal_close, + .write = ipoctal_write_tty, +@@ -697,12 +723,17 @@ static void __ipoctal_remove(struct ipoctal *ipoctal) + + for (i = 0; i < NR_CHANNELS; i++) { + struct ipoctal_channel *channel = &ipoctal->channel[i]; ++ ++ if (!channel->tty_registered) ++ continue; ++ + tty_unregister_device(ipoctal->tty_drv, i); + tty_port_free_xmit_buf(&channel->tty_port); + tty_port_destroy(&channel->tty_port); + } + + tty_unregister_driver(ipoctal->tty_drv); ++ kfree(ipoctal->tty_drv->name); + put_tty_driver(ipoctal->tty_drv); + kfree(ipoctal); + } diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c index 63d980995d17..ac431697ebe1 100644 --- a/drivers/irqchip/irq-alpine-msi.c @@ -38088,6 +52774,75 @@ index 63d980995d17..ac431697ebe1 100644 alpine_msix_free_sgi(priv, sgi, nr_irqs); return err; } +diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c +index 8bcee65a0b8c..ace01a626b09 100644 +--- a/drivers/irqchip/irq-armada-370-xp.c ++++ b/drivers/irqchip/irq-armada-370-xp.c +@@ -153,16 +153,12 @@ static int armada_370_xp_msi_alloc(struct irq_domain *domain, unsigned int virq, + int hwirq, i; + + mutex_lock(&msi_used_lock); ++ hwirq = bitmap_find_free_region(msi_used, PCI_MSI_DOORBELL_NR, ++ order_base_2(nr_irqs)); ++ mutex_unlock(&msi_used_lock); + +- hwirq = bitmap_find_next_zero_area(msi_used, PCI_MSI_DOORBELL_NR, +- 0, nr_irqs, 0); +- if (hwirq >= PCI_MSI_DOORBELL_NR) { +- mutex_unlock(&msi_used_lock); ++ if (hwirq < 0) + return -ENOSPC; +- } +- +- bitmap_set(msi_used, hwirq, nr_irqs); +- mutex_unlock(&msi_used_lock); + + for (i = 0; i < nr_irqs; i++) { + irq_domain_set_info(domain, virq + i, hwirq + i, +@@ -171,7 +167,7 @@ static int armada_370_xp_msi_alloc(struct irq_domain *domain, unsigned int virq, + NULL, NULL); + } + +- return hwirq; ++ return 0; + } + + static void armada_370_xp_msi_free(struct irq_domain *domain, +@@ -180,7 +176,7 @@ static void armada_370_xp_msi_free(struct irq_domain *domain, + struct irq_data *d = irq_domain_get_irq_data(domain, virq); + + mutex_lock(&msi_used_lock); +- bitmap_clear(msi_used, d->hwirq, nr_irqs); ++ bitmap_release_region(msi_used, d->hwirq, order_base_2(nr_irqs)); + mutex_unlock(&msi_used_lock); + } + +diff --git a/drivers/irqchip/irq-bcm6345-l1.c b/drivers/irqchip/irq-bcm6345-l1.c +index daa4ae89e466..7ed976d436b2 100644 +--- a/drivers/irqchip/irq-bcm6345-l1.c ++++ b/drivers/irqchip/irq-bcm6345-l1.c +@@ -143,7 +143,7 @@ static void bcm6345_l1_irq_handle(struct irq_desc *desc) + for_each_set_bit(hwirq, &pending, IRQS_PER_WORD) { + irq = irq_linear_revmap(intc->domain, base + hwirq); + if (irq) +- do_IRQ(irq); ++ generic_handle_irq(irq); + else + spurious_interrupt(); + } +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index d1efbb8dadc5..a964e381cbb8 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -369,7 +369,7 @@ static struct its_collection *its_build_invall_cmd(struct its_cmd_block *cmd, + + its_fixup_cmd(cmd); + +- return NULL; ++ return desc->its_invall_cmd.col; + } + + static u64 its_cmd_ptr_to_offset(struct its_node *its, diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c old mode 100644 new mode 100755 @@ -38121,11 +52876,70 @@ index 8f3aa54ee873..4e0952290bd1 return IRQ_SET_MASK_OK_DONE; } +diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c +index b1777104fd9f..9694529b709d 100644 +--- a/drivers/irqchip/irq-nvic.c ++++ b/drivers/irqchip/irq-nvic.c +@@ -29,7 +29,7 @@ + + #define NVIC_ISER 0x000 + #define NVIC_ICER 0x080 +-#define NVIC_IPR 0x300 ++#define NVIC_IPR 0x400 + + #define NVIC_MAX_BANKS 16 + /* +diff --git a/drivers/irqchip/irq-s3c24xx.c b/drivers/irqchip/irq-s3c24xx.c +index c25ce5af091a..e92ab62cc87d 100644 +--- a/drivers/irqchip/irq-s3c24xx.c ++++ b/drivers/irqchip/irq-s3c24xx.c +@@ -368,11 +368,25 @@ static inline int s3c24xx_handle_intc(struct s3c_irq_intc *intc, + asmlinkage void __exception_irq_entry s3c24xx_handle_irq(struct pt_regs *regs) + { + do { +- if (likely(s3c_intc[0])) +- if (s3c24xx_handle_intc(s3c_intc[0], regs, 0)) +- continue; ++ /* ++ * For platform based machines, neither ERR nor NULL can happen here. ++ * The s3c24xx_handle_irq() will be set as IRQ handler iff this succeeds: ++ * ++ * s3c_intc[0] = s3c24xx_init_intc() ++ * ++ * If this fails, the next calls to s3c24xx_init_intc() won't be executed. ++ * ++ * For DT machine, s3c_init_intc_of() could set the IRQ handler without ++ * setting s3c_intc[0] only if it was called with num_ctrl=0. There is no ++ * such code path, so again the s3c_intc[0] will have a valid pointer if ++ * set_handle_irq() is called. ++ * ++ * Therefore in s3c24xx_handle_irq(), the s3c_intc[0] is always something. ++ */ ++ if (s3c24xx_handle_intc(s3c_intc[0], regs, 0)) ++ continue; + +- if (s3c_intc[2]) ++ if (!IS_ERR_OR_NULL(s3c_intc[2])) + if (s3c24xx_handle_intc(s3c_intc[2], regs, 64)) + continue; + diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c -index d15347de415a..9de62c3b8bf9 100644 +index d15347de415a..658e116d8fe6 100644 --- a/drivers/isdn/capi/kcapi.c +++ b/drivers/isdn/capi/kcapi.c -@@ -845,7 +845,7 @@ EXPORT_SYMBOL(capi20_put_message); +@@ -564,6 +564,11 @@ int detach_capi_ctr(struct capi_ctr *ctr) + + ctr_down(ctr, CAPI_CTR_DETACHED); + ++ if (ctr->cnr < 1 || ctr->cnr - 1 >= CAPI_MAXCONTR) { ++ err = -EINVAL; ++ goto unlock_out; ++ } ++ + if (capi_controller[ctr->cnr - 1] != ctr) { + err = -EINVAL; + goto unlock_out; +@@ -845,7 +850,7 @@ EXPORT_SYMBOL(capi20_put_message); * Return value: CAPI result code */ @@ -38134,7 +52948,7 @@ index d15347de415a..9de62c3b8bf9 100644 { struct capi_ctr *ctr; u16 ret; -@@ -915,7 +915,7 @@ EXPORT_SYMBOL(capi20_get_version); +@@ -915,7 +920,7 @@ EXPORT_SYMBOL(capi20_get_version); * Return value: CAPI result code */ @@ -38228,9 +53042,19 @@ index 8d338ba366d0..01a1afde5d3c 100644 if (isac->dch.timer.function != NULL) { del_timer(&isac->dch.timer); diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c -index e9fcae4569af..6656fcf502aa 100644 +index e9fcae4569af..f8945eddb957 100644 --- a/drivers/isdn/hardware/mISDN/netjet.c +++ b/drivers/isdn/hardware/mISDN/netjet.c +@@ -963,8 +963,8 @@ nj_release(struct tiger_hw *card) + nj_disable_hwirq(card); + mode_tiger(&card->bc[0], ISDN_P_NONE); + mode_tiger(&card->bc[1], ISDN_P_NONE); +- card->isac.release(&card->isac); + spin_unlock_irqrestore(&card->lock, flags); ++ card->isac.release(&card->isac); + release_region(card->base, card->base_s); + card->base_s = 0; + } @@ -1114,7 +1114,6 @@ nj_probe(struct pci_dev *pdev, const struct pci_device_id *ent) card->typ = NETJET_S_TJ300; @@ -38639,6 +53463,38 @@ index 96d16fca68b2..24e7152cd2bf 100644 return 0; } +diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c +index 921a5d2a802b..96801137a144 100644 +--- a/drivers/mcb/mcb-core.c ++++ b/drivers/mcb/mcb-core.c +@@ -280,8 +280,8 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier) + + bus_nr = ida_simple_get(&mcb_ida, 0, 0, GFP_KERNEL); + if (bus_nr < 0) { +- rc = bus_nr; +- goto err_free; ++ kfree(bus); ++ return ERR_PTR(bus_nr); + } + + bus->bus_nr = bus_nr; +@@ -296,12 +296,12 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier) + dev_set_name(&bus->dev, "mcb:%d", bus_nr); + rc = device_add(&bus->dev); + if (rc) +- goto err_free; ++ goto err_put; + + return bus; +-err_free: +- put_device(carrier); +- kfree(bus); ++ ++err_put: ++ put_device(&bus->dev); + return ERR_PTR(rc); + } + EXPORT_SYMBOL_GPL(mcb_alloc_bus); diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h index 7fe7df56fa33..f0939fc1cfe5 100644 --- a/drivers/md/bcache/bcache.h @@ -39597,9 +54453,20 @@ index a240990a7f33..5673f8eb5f88 100644 /* diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index eff04fa23dfa..9e4d1212f4c1 100644 +index eff04fa23dfa..63f2baed3c8a 100644 --- a/drivers/md/persistent-data/dm-btree-remove.c +++ b/drivers/md/persistent-data/dm-btree-remove.c +@@ -423,9 +423,9 @@ static int rebalance_children(struct shadow_spine *s, + + memcpy(n, dm_block_data(child), + dm_bm_block_size(dm_tm_get_bm(info->tm))); +- dm_tm_unlock(info->tm, child); + + dm_tm_dec(info->tm, dm_block_location(child)); ++ dm_tm_unlock(info->tm, child); + return 0; + } + @@ -549,7 +549,8 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root, delete_at(n, index); } @@ -41030,6 +55897,62 @@ index acb804bceccb..e1736777e6cc 100644 return ret; } +diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c +index 237737fec09c..e6159faff45a 100644 +--- a/drivers/media/i2c/mt9p031.c ++++ b/drivers/media/i2c/mt9p031.c +@@ -81,7 +81,9 @@ + #define MT9P031_PIXEL_CLOCK_INVERT (1 << 15) + #define MT9P031_PIXEL_CLOCK_SHIFT(n) ((n) << 8) + #define MT9P031_PIXEL_CLOCK_DIVIDE(n) ((n) << 0) +-#define MT9P031_FRAME_RESTART 0x0b ++#define MT9P031_RESTART 0x0b ++#define MT9P031_FRAME_PAUSE_RESTART (1 << 1) ++#define MT9P031_FRAME_RESTART (1 << 0) + #define MT9P031_SHUTTER_DELAY 0x0c + #define MT9P031_RST 0x0d + #define MT9P031_RST_ENABLE 1 +@@ -448,9 +450,23 @@ static int mt9p031_set_params(struct mt9p031 *mt9p031) + static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable) + { + struct mt9p031 *mt9p031 = to_mt9p031(subdev); ++ struct i2c_client *client = v4l2_get_subdevdata(subdev); ++ int val; + int ret; + + if (!enable) { ++ /* enable pause restart */ ++ val = MT9P031_FRAME_PAUSE_RESTART; ++ ret = mt9p031_write(client, MT9P031_RESTART, val); ++ if (ret < 0) ++ return ret; ++ ++ /* enable restart + keep pause restart set */ ++ val |= MT9P031_FRAME_RESTART; ++ ret = mt9p031_write(client, MT9P031_RESTART, val); ++ if (ret < 0) ++ return ret; ++ + /* Stop sensor readout */ + ret = mt9p031_set_output_control(mt9p031, + MT9P031_OUTPUT_CONTROL_CEN, 0); +@@ -470,6 +486,16 @@ static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable) + if (ret < 0) + return ret; + ++ /* ++ * - clear pause restart ++ * - don't clear restart as clearing restart manually can cause ++ * undefined behavior ++ */ ++ val = MT9P031_FRAME_RESTART; ++ ret = mt9p031_write(client, MT9P031_RESTART, val); ++ if (ret < 0) ++ return ret; ++ + return mt9p031_pll_enable(mt9p031); + } + diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c index 3844853ab0a0..9d55abfe070f 100644 --- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c @@ -41204,9 +56127,18 @@ index 4b615b4b0463..4d92aac279dc 100644 return 0; diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c -index 7ebcb9473956..c799071be66f 100644 +index 7ebcb9473956..45996c51a301 100644 --- a/drivers/media/i2c/tc358743.c +++ b/drivers/media/i2c/tc358743.c +@@ -237,7 +237,7 @@ static void i2c_wr16(struct v4l2_subdev *sd, u16 reg, u16 val) + + static void i2c_wr16_and_or(struct v4l2_subdev *sd, u16 reg, u16 mask, u16 val) + { +- i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2); ++ i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 1) & mask) | val, 1); + } + + static u32 i2c_rd32(struct v4l2_subdev *sd, u16 reg) @@ -1321,7 +1321,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled) static irqreturn_t tc358743_irq_handler(int irq, void *dev_id) { @@ -41352,6 +56284,46 @@ index 0d4cacb93664..d58c58e61bde 100644 if (NULL == risc->cpu) { cpu = pci_zalloc_consistent(pci, size, &dma); if (NULL == cpu) +diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +index b078ac2a682c..48e1f4a12801 100644 +--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c ++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +@@ -266,19 +266,24 @@ static irqreturn_t netup_unidvb_isr(int irq, void *dev_id) + if ((reg40 & AVL_IRQ_ASSERTED) != 0) { + /* IRQ is being signaled */ + reg_isr = readw(ndev->bmmio0 + REG_ISR); +- if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) { +- iret = netup_i2c_interrupt(&ndev->i2c[0]); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) { +- iret = netup_i2c_interrupt(&ndev->i2c[1]); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_SPI) { ++ if (reg_isr & NETUP_UNIDVB_IRQ_SPI) + iret = netup_spi_interrupt(ndev->spi); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) { +- iret = netup_dma_interrupt(&ndev->dma[0]); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) { +- iret = netup_dma_interrupt(&ndev->dma[1]); +- } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) { +- iret = netup_ci_interrupt(ndev); ++ else if (!ndev->old_fw) { ++ if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) { ++ iret = netup_i2c_interrupt(&ndev->i2c[0]); ++ } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) { ++ iret = netup_i2c_interrupt(&ndev->i2c[1]); ++ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) { ++ iret = netup_dma_interrupt(&ndev->dma[0]); ++ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) { ++ iret = netup_dma_interrupt(&ndev->dma[1]); ++ } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) { ++ iret = netup_ci_interrupt(ndev); ++ } else { ++ goto err; ++ } + } else { ++err: + dev_err(&pci_dev->dev, + "%s(): unknown interrupt 0x%x\n", + __func__, reg_isr); diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c b/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c index f33c0de3e849..019bbc18cede 100644 --- a/drivers/media/pci/netup_unidvb/netup_unidvb_spi.c @@ -41762,8 +56734,54 @@ index befd9fc0adc4..dc87c9cfa52f 100644 } mutex_lock(&state->lock); +diff --git a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_core_common.c b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_core_common.c +index 6d699cf965eb..9341c8861ba8 100644 +--- a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_core_common.c ++++ b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_core_common.c +@@ -230,35 +230,34 @@ int cam_cdm_stream_ops_internal(void *hw_priv, + return -EINVAL; + + core = (struct cam_cdm *)cdm_hw->core_info; ++ mutex_lock(&cdm_hw->hw_mutex); + client_idx = CAM_CDM_GET_CLIENT_IDX(*handle); + client = core->clients[client_idx]; + if (!client) { + CAM_ERR(CAM_CDM, "Invalid client %pK hdl=%x", client, *handle); ++ mutex_unlock(&cdm_hw->hw_mutex); + return -EINVAL; + } + cam_cdm_get_client_refcount(client); + if (*handle != client->handle) { + CAM_ERR(CAM_CDM, "client id given handle=%x invalid", *handle); +- cam_cdm_put_client_refcount(client); +- return -EINVAL; ++ rc = -EINVAL; ++ goto end; + } + if (operation == true) { + if (true == client->stream_on) { + CAM_ERR(CAM_CDM, + "Invalid CDM client is already streamed ON"); +- cam_cdm_put_client_refcount(client); +- return rc; ++ goto end; + } + } else { + if (client->stream_on == false) { + CAM_ERR(CAM_CDM, + "Invalid CDM client is already streamed Off"); +- cam_cdm_put_client_refcount(client); +- return rc; ++ goto end; + } + } + +- mutex_lock(&cdm_hw->hw_mutex); + if (operation == true) { + if (!cdm_hw->open_count) { + struct cam_ahb_vote ahb_vote; diff --git a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c -index b00486412ebd..6d82bab53d9e 100644 +index b00486412ebd..342b02f783a4 100644 --- a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c +++ b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c @@ -1,4 +1,4 @@ @@ -42005,7 +57023,23 @@ index b00486412ebd..6d82bab53d9e 100644 hw_update_entries = config_args->hw_update_entries; CAM_DBG(CAM_JPEG, "ctx_data = %pK req_id = %lld %zd", ctx_data, request_id, (uintptr_t)config_args->priv); -@@ -768,6 +834,7 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv, +@@ -721,10 +787,11 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv, + } + + if ((packet->num_cmd_buf > 5) || !packet->num_patches || +- !packet->num_io_configs) { +- CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u", +- packet->num_cmd_buf, +- packet->num_patches); ++ !packet->num_io_configs || ++ (packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) { ++ CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u %u", ++ packet->num_cmd_buf, packet->num_patches, ++ packet->num_io_configs); + return -EINVAL; + } + +@@ -768,6 +835,7 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv, i, io_cfg_ptr[i].direction, io_cfg_ptr[i].fence); } @@ -42754,6 +57788,68 @@ index dade2e377038..09571a2e604c 100644 CONFIGURED_COMBO_MODE, }; +diff --git a/drivers/media/platform/msm/camera_v3/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c b/drivers/media/platform/msm/camera_v3/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c +index 317b443655f6..cb0a0f27e4b0 100644 +--- a/drivers/media/platform/msm/camera_v3/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c ++++ b/drivers/media/platform/msm/camera_v3/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c +@@ -803,10 +803,11 @@ static int cam_jpeg_mgr_prepare_hw_update(void *hw_mgr_priv, + } + + if ((packet->num_cmd_buf > 5) || !packet->num_patches || +- !packet->num_io_configs) { +- CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u", +- packet->num_cmd_buf, +- packet->num_patches); ++ !packet->num_io_configs || ++ (packet->num_io_configs > CAM_JPEG_IMAGE_MAX)) { ++ CAM_ERR(CAM_JPEG, "wrong number of cmd/patch info: %u %u %u", ++ packet->num_cmd_buf, packet->num_patches, ++ packet->num_io_configs); + return -EINVAL; + } + +diff --git a/drivers/media/platform/msm/camera_v3/cam_req_mgr/cam_req_mgr_util.c b/drivers/media/platform/msm/camera_v3/cam_req_mgr/cam_req_mgr_util.c +index feee331287d4..f52500ac782d 100644 +--- a/drivers/media/platform/msm/camera_v3/cam_req_mgr/cam_req_mgr_util.c ++++ b/drivers/media/platform/msm/camera_v3/cam_req_mgr/cam_req_mgr_util.c +@@ -128,21 +128,6 @@ static int32_t cam_get_free_handle_index(void) + return idx; + } + +-void cam_dump_tbl_info(void) +-{ +- int i; +- +- for (i = 0; i < CAM_REQ_MGR_MAX_HANDLES_V2; i++) +- CAM_INFO(CAM_CRM, "session_hdl=%x hdl_value=%x\n" +- "type=%d state=%d dev_id=%lld", +- hdl_tbl->hdl[i].session_hdl, +- hdl_tbl->hdl[i].hdl_value, +- hdl_tbl->hdl[i].type, +- hdl_tbl->hdl[i].state, +- hdl_tbl->hdl[i].dev_id); +- +-} +- + int32_t cam_create_session_hdl(void *priv) + { + int idx; +@@ -159,7 +144,6 @@ int32_t cam_create_session_hdl(void *priv) + idx = cam_get_free_handle_index(); + if (idx < 0) { + CAM_ERR(CAM_CRM, "Unable to create session handle"); +- cam_dump_tbl_info(); + spin_unlock_bh(&hdl_tbl_lock); + return idx; + } +@@ -193,7 +177,6 @@ int32_t cam_create_device_hdl(struct cam_create_dev_hdl *hdl_data) + idx = cam_get_free_handle_index(); + if (idx < 0) { + CAM_ERR(CAM_CRM, "Unable to create device handle"); +- cam_dump_tbl_info(); + spin_unlock_bh(&hdl_tbl_lock); + return idx; + } diff --git a/drivers/media/platform/msm/camera_v3/cam_sensor_module/cam_cci/cam_cci_core.c b/drivers/media/platform/msm/camera_v3/cam_sensor_module/cam_cci/cam_cci_core.c index a06a4c6c6339..2c946bb37836 100644 --- a/drivers/media/platform/msm/camera_v3/cam_sensor_module/cam_cci/cam_cci_core.c @@ -43143,6 +58239,29 @@ index 2cb7e315c448..91c046bb2b7d 100644 #endif pm_qos_add_request(&device->qos, PM_QOS_CPU_DMA_LATENCY, device->res->pm_qos_latency_us); +diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c +index 04b8b8764fae..4d7e470c1715 100644 +--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c ++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c +@@ -802,7 +802,8 @@ static int mtk_vpu_probe(struct platform_device *pdev) + vpu->wdt.wq = create_singlethread_workqueue("vpu_wdt"); + if (!vpu->wdt.wq) { + dev_err(dev, "initialize wdt workqueue failed\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto clk_unprepare; + } + INIT_WORK(&vpu->wdt.ws, vpu_wdt_reset_func); + mutex_init(&vpu->vpu_mutex); +@@ -901,6 +902,8 @@ static int mtk_vpu_probe(struct platform_device *pdev) + vpu_clock_disable(vpu); + workqueue_destroy: + destroy_workqueue(vpu->wdt.wq); ++clk_unprepare: ++ clk_unprepare(vpu->clk); + + return ret; + } diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c index ce651d3ca1b8..a56863b09014 100644 --- a/drivers/media/platform/omap3isp/isp.c @@ -43277,6 +58396,19 @@ index 5f6ccf492111..8f083f28dcf3 100644 v4l2_ctrl_handler_free(&ctx->ctrl_handler); v4l2_fh_del(&ctx->fh); v4l2_fh_exit(&ctx->fh); +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c +index 8051c1345692..0ff972b8d967 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c +@@ -1160,7 +1160,7 @@ static int s5p_mfc_probe(struct platform_device *pdev) + spin_lock_init(&dev->condlock); + dev->plat_dev = pdev; + if (!dev->plat_dev) { +- dev_err(&pdev->dev, "No platform data specified\n"); ++ mfc_err("No platform data specified\n"); + return -ENODEV; + } + diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c index d88c9ba401b5..bec4278401b2 100644 --- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c @@ -43421,6 +58553,32 @@ index 4ac1ff482a0b..8d50a9a9f73d 100644 return ret; } +diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c +index 8f3086773db4..6162aa575842 100644 +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -24,7 +24,7 @@ + + /* driver definitions */ + #define DRIVER_AUTHOR "Joonyoung Shim "; +-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" ++#define DRIVER_CARD "Silicon Labs Si470x FM Radio" + #define DRIVER_DESC "I2C radio driver for Si470x FM Radio Receivers" + #define DRIVER_VERSION "1.0.2" + +diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c +index 1d045a8c29e2..a8a0ff9a1f83 100644 +--- a/drivers/media/radio/si470x/radio-si470x-usb.c ++++ b/drivers/media/radio/si470x/radio-si470x-usb.c +@@ -29,7 +29,7 @@ + + /* driver definitions */ + #define DRIVER_AUTHOR "Tobias Lorenz " +-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" ++#define DRIVER_CARD "Silicon Labs Si470x FM Radio" + #define DRIVER_DESC "USB radio driver for Si470x FM Radio Receivers" + #define DRIVER_VERSION "1.0.10" + diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c index 9f5b59706741..7f98db4bc027 100644 --- a/drivers/media/rc/ati_remote.c @@ -43437,10 +58595,10 @@ index 9f5b59706741..7f98db4bc027 100644 ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL); rc_dev = rc_allocate_device(); diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c -index 63165d324fff..7d3e50d94d86 100644 +index 63165d324fff..e8bc02ce9b2f 100644 --- a/drivers/media/rc/ite-cir.c +++ b/drivers/media/rc/ite-cir.c -@@ -292,8 +292,14 @@ static irqreturn_t ite_cir_isr(int irq, void *data) +@@ -292,6 +292,12 @@ static irqreturn_t ite_cir_isr(int irq, void *data) /* read the interrupt flags */ iflags = dev->params.get_irq_causes(dev); @@ -43451,11 +58609,33 @@ index 63165d324fff..7d3e50d94d86 100644 + } + /* check for the receive interrupt */ -- if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) { -+ if (iflags & ITE_IRQ_RX_FIFO) { + if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) { /* read the FIFO bytes */ - rx_bytes = - dev->params.get_rx_bytes(dev, rx_buf, +diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c +index d9f88a4a96bd..b78d70685b1c 100644 +--- a/drivers/media/rc/mceusb.c ++++ b/drivers/media/rc/mceusb.c +@@ -1090,6 +1090,7 @@ static void mceusb_dev_recv(struct urb *urb) + case -ECONNRESET: + case -ENOENT: + case -EILSEQ: ++ case -EPROTO: + case -ESHUTDOWN: + usb_unlink_urb(urb); + return; +diff --git a/drivers/media/rc/rc-loopback.c b/drivers/media/rc/rc-loopback.c +index 63dace8198b0..b3810b85e7d5 100644 +--- a/drivers/media/rc/rc-loopback.c ++++ b/drivers/media/rc/rc-loopback.c +@@ -55,7 +55,7 @@ static int loop_set_tx_mask(struct rc_dev *dev, u32 mask) + + if ((mask & (RXMASK_REGULAR | RXMASK_LEARNING)) != mask) { + dprintk("invalid tx mask: %u\n", mask); +- return -EINVAL; ++ return 2; + } + + dprintk("setting tx mask: %u\n", mask); diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c index eaadc081760a..3256bf46a376 100644 --- a/drivers/media/rc/sunxi-cir.c @@ -43636,6 +58816,40 @@ index 5c4aa247d650..ca4ed2af5320 100644 lme_int->lme_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; +diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c +index c583c638e468..328a447ce972 100644 +--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c ++++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c +@@ -50,7 +50,16 @@ static int rtl28xxu_ctrl_msg(struct dvb_usb_device *d, struct rtl28xxu_req *req) + } else { + /* read */ + requesttype = (USB_TYPE_VENDOR | USB_DIR_IN); +- pipe = usb_rcvctrlpipe(d->udev, 0); ++ ++ /* ++ * Zero-length transfers must use usb_sndctrlpipe() and ++ * rtl28xxu_identify_state() uses a zero-length i2c read ++ * command to determine the chip type. ++ */ ++ if (req->size) ++ pipe = usb_rcvctrlpipe(d->udev, 0); ++ else ++ pipe = usb_sndctrlpipe(d->udev, 0); + } + + ret = usb_control_msg(d->udev, pipe, 0, requesttype, req->value, +diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c +index 2e711362847e..382c8075ef52 100644 +--- a/drivers/media/usb/dvb-usb/az6027.c ++++ b/drivers/media/usb/dvb-usb/az6027.c +@@ -394,6 +394,7 @@ static struct rc_map_table rc_map_az6027_table[] = { + /* remote control stuff (does not work with my box) */ + static int az6027_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + { ++ *state = REMOTE_NO_KEY_PRESSED; + return 0; + } + diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c index 2b7a1b569db0..184a9b827d56 100644 --- a/drivers/media/usb/dvb-usb/cxusb.c @@ -43649,6 +58863,19 @@ index 2b7a1b569db0..184a9b827d56 100644 .adapter = { { .num_frontends = 1, +diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c +index bcacb0f22028..3e45642ae186 100644 +--- a/drivers/media/usb/dvb-usb/dibusb-common.c ++++ b/drivers/media/usb/dvb-usb/dibusb-common.c +@@ -226,7 +226,7 @@ int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val) + u8 *buf; + int rc; + +- buf = kmalloc(2, GFP_KERNEL); ++ buf = kzalloc(2, GFP_KERNEL); + if (!buf) + return -ENOMEM; + diff --git a/drivers/media/usb/dvb-usb/dibusb-mb.c b/drivers/media/usb/dvb-usb/dibusb-mb.c index a0057641cc86..c55180912c3a 100644 --- a/drivers/media/usb/dvb-usb/dibusb-mb.c @@ -43816,6 +59043,60 @@ index 993bb7a72985..170a177653c9 100644 int gp_product_id = le16_to_cpu(d->udev->descriptor.idProduct); if (onoff) { +diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c +index 1babd3341910..016a6d1ad279 100644 +--- a/drivers/media/usb/dvb-usb/nova-t-usb2.c ++++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c +@@ -133,7 +133,7 @@ static int nova_t_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + + static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6]) + { +- int i; ++ int i, ret; + u8 b; + + mac[0] = 0x00; +@@ -142,7 +142,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6]) + + /* this is a complete guess, but works for my box */ + for (i = 136; i < 139; i++) { +- dibusb_read_eeprom_byte(d,i, &b); ++ ret = dibusb_read_eeprom_byte(d, i, &b); ++ if (ret) ++ return ret; + + mac[5 - (i - 136)] = b; + } +diff --git a/drivers/media/usb/dvb-usb/vp702x.c b/drivers/media/usb/dvb-usb/vp702x.c +index 40de33de90a7..5c3b0a7ca27e 100644 +--- a/drivers/media/usb/dvb-usb/vp702x.c ++++ b/drivers/media/usb/dvb-usb/vp702x.c +@@ -294,16 +294,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state) + static int vp702x_read_mac_addr(struct dvb_usb_device *d,u8 mac[6]) + { + u8 i, *buf; ++ int ret; + struct vp702x_device_state *st = d->priv; + + mutex_lock(&st->buf_mutex); + buf = st->buf; +- for (i = 6; i < 12; i++) +- vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, &buf[i - 6], 1); ++ for (i = 6; i < 12; i++) { ++ ret = vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, ++ &buf[i - 6], 1); ++ if (ret < 0) ++ goto err; ++ } + + memcpy(mac, buf, 6); ++err: + mutex_unlock(&st->buf_mutex); +- return 0; ++ return ret; + } + + static int vp702x_frontend_attach(struct dvb_usb_adapter *adap) diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c index b0aea48907b7..7e259be47252 100644 --- a/drivers/media/usb/em28xx/em28xx-dvb.c @@ -43828,6 +59109,60 @@ index b0aea48907b7..7e259be47252 100644 kfree(dvb); dev->dvb = NULL; goto ret; +diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c +index 05b1126f263e..d861d7225f49 100644 +--- a/drivers/media/usb/go7007/go7007-driver.c ++++ b/drivers/media/usb/go7007/go7007-driver.c +@@ -698,49 +698,23 @@ struct go7007 *go7007_alloc(const struct go7007_board_info *board, + struct device *dev) + { + struct go7007 *go; +- int i; + + go = kzalloc(sizeof(struct go7007), GFP_KERNEL); + if (go == NULL) + return NULL; + go->dev = dev; + go->board_info = board; +- go->board_id = 0; + go->tuner_type = -1; +- go->channel_number = 0; +- go->name[0] = 0; + mutex_init(&go->hw_lock); + init_waitqueue_head(&go->frame_waitq); + spin_lock_init(&go->spinlock); + go->status = STATUS_INIT; +- memset(&go->i2c_adapter, 0, sizeof(go->i2c_adapter)); +- go->i2c_adapter_online = 0; +- go->interrupt_available = 0; + init_waitqueue_head(&go->interrupt_waitq); +- go->input = 0; + go7007_update_board(go); +- go->encoder_h_halve = 0; +- go->encoder_v_halve = 0; +- go->encoder_subsample = 0; + go->format = V4L2_PIX_FMT_MJPEG; + go->bitrate = 1500000; + go->fps_scale = 1; +- go->pali = 0; + go->aspect_ratio = GO7007_RATIO_1_1; +- go->gop_size = 0; +- go->ipb = 0; +- go->closed_gop = 0; +- go->repeat_seqhead = 0; +- go->seq_header_enable = 0; +- go->gop_header_enable = 0; +- go->dvd_mode = 0; +- go->interlace_coding = 0; +- for (i = 0; i < 4; ++i) +- go->modet[i].enable = 0; +- for (i = 0; i < 1624; ++i) +- go->modet_map[i] = 0; +- go->audio_deliver = NULL; +- go->audio_enabled = 0; + + return go; + } diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c index ed9bcaf08d5e..ddfaabd4c081 100644 --- a/drivers/media/usb/go7007/go7007-usb.c @@ -44085,6 +59420,33 @@ index ff489645e070..0cb8dd585235 100644 LOCK_TAKE(hdw->ctl_lock); pvr2_hdw_remove_usb_stuff(hdw); LOCK_GIVE(hdw->ctl_lock); +diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c +index f9844f87467b..969a80855518 100644 +--- a/drivers/media/usb/stkwebcam/stk-webcam.c ++++ b/drivers/media/usb/stkwebcam/stk-webcam.c +@@ -1362,7 +1362,7 @@ static int stk_camera_probe(struct usb_interface *interface, + if (!dev->isoc_ep) { + STK_ERROR("Could not find isoc-in endpoint"); + err = -ENODEV; +- goto error; ++ goto error_put; + } + dev->vsettings.palette = V4L2_PIX_FMT_RGB565; + dev->vsettings.mode = MODE_VGA; +@@ -1375,10 +1375,12 @@ static int stk_camera_probe(struct usb_interface *interface, + + err = stk_register_video_device(dev); + if (err) +- goto error; ++ goto error_put; + + return 0; + ++error_put: ++ usb_put_intf(interface); + error: + v4l2_ctrl_handler_free(hdl); + v4l2_device_unregister(&dev->v4l2_dev); diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c index 185c8079d0f9..14f3e8388f35 100644 --- a/drivers/media/usb/tm6000/tm6000-dvb.c @@ -44153,7 +59515,7 @@ index 94acf7ca452d..dda7111251f8 100644 entity->bNrInPins = num_inputs; diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c -index 05eed4be25df..6a19cf94705b 100644 +index 05eed4be25df..2b1e06e825f0 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -257,11 +257,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream, @@ -44198,6 +59560,88 @@ index 05eed4be25df..6a19cf94705b 100644 fmt->fmt.pix.colorspace = format->colorspace; fmt->fmt.pix.priv = 0; +@@ -421,10 +451,13 @@ static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream, + uvc_simplify_fraction(&timeperframe.numerator, + &timeperframe.denominator, 8, 333); + +- if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) ++ if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) { + parm->parm.capture.timeperframe = timeperframe; +- else ++ parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME; ++ } else { + parm->parm.output.timeperframe = timeperframe; ++ parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME; ++ } + + return 0; + } +@@ -851,8 +884,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) + { + struct uvc_fh *handle = fh; + struct uvc_video_chain *chain = handle->chain; ++ u8 *buf; + int ret; +- u8 i; + + if (chain->selector == NULL || + (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) { +@@ -860,22 +893,27 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) + return 0; + } + ++ buf = kmalloc(1, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ + ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id, + chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, +- &i, 1); +- if (ret < 0) +- return ret; ++ buf, 1); ++ if (!ret) ++ *input = *buf - 1; + +- *input = i - 1; +- return 0; ++ kfree(buf); ++ ++ return ret; + } + + static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) + { + struct uvc_fh *handle = fh; + struct uvc_video_chain *chain = handle->chain; ++ u8 *buf; + int ret; +- u32 i; + + ret = uvc_acquire_privileges(handle); + if (ret < 0) +@@ -891,10 +929,17 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) + if (input >= chain->selector->bNrInPins) + return -EINVAL; + +- i = input + 1; +- return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id, +- chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, +- &i, 1); ++ buf = kmalloc(1, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ *buf = input + 1; ++ ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id, ++ chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, ++ buf, 1); ++ kfree(buf); ++ ++ return ret; + } + + static int uvc_ioctl_queryctrl(struct file *file, void *fh, diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c index dcca723f7155..1d724e86f378 100644 --- a/drivers/media/usb/uvc/uvc_video.c @@ -44319,6 +59763,45 @@ index 9b98d9794c43..114a30411293 100644 kfree(mbuf); return err; } +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index b1a4d4e2341b..3ac9f7260e72 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1370,6 +1370,7 @@ static int vb2_start_streaming(struct vb2_queue *q) + int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + { + struct vb2_buffer *vb; ++ enum vb2_buffer_state orig_state; + int ret; + + if (q->error) { +@@ -1399,6 +1400,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + * Add to the queued buffers list, a buffer will stay on it until + * dequeued in dqbuf. + */ ++ orig_state = vb->state; + list_add_tail(&vb->queued_entry, &q->queued_list); + q->queued_count++; + q->waiting_for_buffers = false; +@@ -1429,8 +1431,17 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + if (q->streaming && !q->start_streaming_called && + q->queued_count >= q->min_buffers_needed) { + ret = vb2_start_streaming(q); +- if (ret) ++ if (ret) { ++ /* ++ * Since vb2_core_qbuf will return with an error, ++ * we should return it to state DEQUEUED since ++ * the error indicates that the buffer wasn't queued. ++ */ ++ list_del(&vb->queued_entry); ++ q->queued_count--; ++ vb->state = orig_state; + return ret; ++ } + } + + dprintk(1, "qbuf of buffer %d succeeded\n", vb->index); diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c index 04644e7b42b1..88c32b8dc88a 100644 --- a/drivers/memory/emif.c @@ -44382,7 +59865,7 @@ index 662d050243be..2fbf8d09af36 100644 ret = devm_request_irq(&pdev->dev, irq, ccf_irq, 0, pdev->name, ccf); if (ret) { diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c -index 1b182b117f9c..38b945eb410f 100644 +index 1b182b117f9c..9c0e70b047c3 100644 --- a/drivers/memory/fsl_ifc.c +++ b/drivers/memory/fsl_ifc.c @@ -109,7 +109,6 @@ static int fsl_ifc_ctrl_remove(struct platform_device *dev) @@ -44413,8 +59896,43 @@ index 1b182b117f9c..38b945eb410f 100644 } if (of_property_read_bool(dev->dev.of_node, "little-endian")) { -@@ -308,6 +307,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) +@@ -277,7 +276,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + + ret = fsl_ifc_ctrl_init(fsl_ifc_ctrl_dev); + if (ret < 0) +- goto err; ++ goto err_unmap_nandirq; + + init_waitqueue_head(&fsl_ifc_ctrl_dev->nand_wait); + +@@ -286,7 +285,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + if (ret != 0) { + dev_err(&dev->dev, "failed to install irq (%d)\n", + fsl_ifc_ctrl_dev->irq); +- goto err_irq; ++ goto err_unmap_nandirq; + } + + if (fsl_ifc_ctrl_dev->nand_irq) { +@@ -295,19 +294,19 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + if (ret != 0) { + dev_err(&dev->dev, "failed to install irq (%d)\n", + fsl_ifc_ctrl_dev->nand_irq); +- goto err_nandirq; ++ goto err_free_irq; + } + } + + return 0; + +-err_nandirq: +- free_irq(fsl_ifc_ctrl_dev->nand_irq, fsl_ifc_ctrl_dev); +- irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq); +-err_irq: ++err_free_irq: free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev); ++err_unmap_nandirq: ++ irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq); irq_dispose_mapping(fsl_ifc_ctrl_dev->irq); err: + iounmap(fsl_ifc_ctrl_dev->gregs); @@ -44476,8 +59994,34 @@ index 1041eb7a6167..2cae85a7ca6d 100644 host->card = NULL; } } else +diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c +index aacf584f2a42..45136b700d2c 100644 +--- a/drivers/memstick/core/ms_block.c ++++ b/drivers/memstick/core/ms_block.c +@@ -1730,7 +1730,7 @@ static int msb_init_card(struct memstick_dev *card) + msb->pages_in_block = boot_block->attr.block_size * 2; + msb->block_size = msb->page_size * msb->pages_in_block; + +- if (msb->page_size > PAGE_SIZE) { ++ if ((size_t)msb->page_size > PAGE_SIZE) { + /* this isn't supported by linux at all, anyway*/ + dbg("device page %d size isn't supported", msb->page_size); + return -EINVAL; +diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c +index 08fa6400d255..ba6cd576e997 100644 +--- a/drivers/memstick/host/jmb38x_ms.c ++++ b/drivers/memstick/host/jmb38x_ms.c +@@ -905,7 +905,7 @@ static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt) + + iounmap(host->addr); + err_out_free: +- kfree(msh); ++ memstick_free_host(msh); + return NULL; + } + diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c -index d5cfb503b9d6..2539984c1db1 100644 +index d5cfb503b9d6..256634ec58b6 100644 --- a/drivers/memstick/host/r592.c +++ b/drivers/memstick/host/r592.c @@ -762,8 +762,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id) @@ -44510,6 +60054,26 @@ index d5cfb503b9d6..2539984c1db1 100644 goto error7; message("driver successfully loaded"); +@@ -837,15 +841,15 @@ static void r592_remove(struct pci_dev *pdev) + } + memstick_remove_host(dev->host); + ++ if (dev->dummy_dma_page) ++ dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page, ++ dev->dummy_dma_page_physical_address); ++ + free_irq(dev->irq, dev); + iounmap(dev->mmio); + pci_release_regions(pdev); + pci_disable_device(pdev); + memstick_free_host(dev->host); +- +- if (dev->dummy_dma_page) +- dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page, +- dev->dummy_dma_page_physical_address); + } + + #ifdef CONFIG_PM_SLEEP diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c index 6c9fc11efb87..32083759b93d 100644 --- a/drivers/message/fusion/mptscsih.c @@ -44564,6 +60128,19 @@ index 6c9fc11efb87..32083759b93d 100644 /* Log SMART data (asc = 0x5D, non-IM case only) if required. */ +diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c +index 2f212bdc187a..83484c43b1dc 100644 +--- a/drivers/mfd/ab8500-core.c ++++ b/drivers/mfd/ab8500-core.c +@@ -489,7 +489,7 @@ static int ab8500_handle_hierarchical_line(struct ab8500 *ab8500, + if (line == AB8540_INT_GPIO43F || line == AB8540_INT_GPIO44F) + line += 1; + +- handle_nested_irq(irq_create_mapping(ab8500->domain, line)); ++ handle_nested_irq(irq_find_mapping(ab8500->domain, line)); + } + + return 0; diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c index 1f0c2b594654..3382845d4b67 100644 --- a/drivers/mfd/arizona-core.c @@ -44709,6 +60286,41 @@ index 863c39a3353c..d284df25c76b 100644 static struct i2c_driver stmpe_i2c_driver = { .driver = { +diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c +index b0c7bcdaf5df..61fb4873c061 100644 +--- a/drivers/mfd/stmpe.c ++++ b/drivers/mfd/stmpe.c +@@ -1033,7 +1033,7 @@ static irqreturn_t stmpe_irq(int irq, void *data) + + if (variant->id_val == STMPE801_ID || + variant->id_val == STMPE1600_ID) { +- int base = irq_create_mapping(stmpe->domain, 0); ++ int base = irq_find_mapping(stmpe->domain, 0); + + handle_nested_irq(base); + return IRQ_HANDLED; +@@ -1061,7 +1061,7 @@ static irqreturn_t stmpe_irq(int irq, void *data) + while (status) { + int bit = __ffs(status); + int line = bank * 8 + bit; +- int nestedirq = irq_create_mapping(stmpe->domain, line); ++ int nestedirq = irq_find_mapping(stmpe->domain, line); + + handle_nested_irq(nestedirq); + status &= ~(1 << bit); +diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c +index 274bf39968aa..96187c1e5f8f 100644 +--- a/drivers/mfd/tc3589x.c ++++ b/drivers/mfd/tc3589x.c +@@ -187,7 +187,7 @@ static irqreturn_t tc3589x_irq(int irq, void *data) + + while (status) { + int bit = __ffs(status); +- int virq = irq_create_mapping(tc3589x->domain, bit); ++ int virq = irq_find_mapping(tc3589x->domain, bit); + + handle_nested_irq(virq); + status &= ~(1 << bit); diff --git a/drivers/mfd/wm831x-auxadc.c b/drivers/mfd/wm831x-auxadc.c index fd789d2eb0f5..9f7ae1e1ebcd 100644 --- a/drivers/mfd/wm831x-auxadc.c @@ -44735,6 +60347,19 @@ index 8588dbad3301..925c1828ec28 100644 MODULE_LICENSE("GPL"); MODULE_AUTHOR("Mark Brown "); +MODULE_SOFTDEP("pre: wm8994_regulator"); +diff --git a/drivers/mfd/wm8994-irq.c b/drivers/mfd/wm8994-irq.c +index 18710f3b5c53..2c58d9b99a39 100644 +--- a/drivers/mfd/wm8994-irq.c ++++ b/drivers/mfd/wm8994-irq.c +@@ -159,7 +159,7 @@ static irqreturn_t wm8994_edge_irq(int irq, void *data) + struct wm8994 *wm8994 = data; + + while (gpio_get_value_cansleep(wm8994->pdata.irq_gpio)) +- handle_nested_irq(irq_create_mapping(wm8994->edge_irq, 0)); ++ handle_nested_irq(irq_find_mapping(wm8994->edge_irq, 0)); + + return IRQ_HANDLED; + } diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c index 3a6e4ec21c87..8c9a444d61d3 100644 --- a/drivers/misc/atmel-ssc.c @@ -44829,6 +60454,19 @@ index 3a6e4ec21c87..8c9a444d61d3 100644 return 0; } +diff --git a/drivers/misc/cb710/sgbuf2.c b/drivers/misc/cb710/sgbuf2.c +index 2a40d0efdff5..4d2a72a537d4 100644 +--- a/drivers/misc/cb710/sgbuf2.c ++++ b/drivers/misc/cb710/sgbuf2.c +@@ -50,7 +50,7 @@ static inline bool needs_unaligned_copy(const void *ptr) + #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + return false; + #else +- return ((ptr - NULL) & 3) != 0; ++ return ((uintptr_t)ptr & 3) != 0; + #endif + } + diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c index a8b6d6a635e9..e97b3b26805d 100644 --- a/drivers/misc/cxl/sysfs.c @@ -45319,7 +60957,7 @@ index 189b32519748..9ac3659a5537 100644 dev_err(&pdev->dev, "%s: Insufficient memory\n", __func__); return -ENOMEM; diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c -index 5927db046a87..9c8887d3a4b9 100644 +index 5927db046a87..67863ec9231e 100644 --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c @@ -639,6 +639,9 @@ static struct vmci_queue *qp_host_alloc_queue(u64 size) @@ -45365,6 +61003,26 @@ index 5927db046a87..9c8887d3a4b9 100644 qp_release_pages(produce_q->kernel_if->u.h.header_page, produce_q->kernel_if->num_pages, false); err = VMCI_ERROR_NO_MEM; +@@ -2339,7 +2344,8 @@ int vmci_qp_broker_map(struct vmci_handle handle, + is_local = entry->qp.flags & VMCI_QPFLAG_LOCAL; + result = VMCI_SUCCESS; + +- if (context_id != VMCI_HOST_CONTEXT_ID) { ++ if (context_id != VMCI_HOST_CONTEXT_ID && ++ !QPBROKERSTATE_HAS_MEM(entry)) { + struct vmci_qp_page_store page_store; + + page_store.pages = guest_mem; +@@ -2449,7 +2455,8 @@ int vmci_qp_broker_unmap(struct vmci_handle handle, + + is_local = entry->qp.flags & VMCI_QPFLAG_LOCAL; + +- if (context_id != VMCI_HOST_CONTEXT_ID) { ++ if (context_id != VMCI_HOST_CONTEXT_ID && ++ QPBROKERSTATE_HAS_MEM(entry)) { + qp_acquire_queue_mutex(entry->produce_q); + result = qp_save_headers(entry); + if (result < VMCI_SUCCESS) diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c index b352749a2177..629ffd21e649 100644 --- a/drivers/mmc/core/core.c @@ -45521,6 +61179,150 @@ index 5d7f1986c481..1abb8712dd7a 100644 /* warn about unknown tuples */ pr_warn_ratelimited("%s: queuing unknown" " CIS tuple 0x%02x (%u bytes)\n", +diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig +index dff6631da367..93248b4dcad2 100644 +--- a/drivers/mmc/host/Kconfig ++++ b/drivers/mmc/host/Kconfig +@@ -367,7 +367,7 @@ config MMC_OMAP_HS + + config MMC_WBSD + tristate "Winbond W83L51xD SD/MMC Card Interface support" +- depends on ISA_DMA_API ++ depends on ISA_DMA_API && !M68K + help + This selects the Winbond(R) W83L51xD Secure digital and + Multimedia card Interface. +diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c +index 7ab3d749b5ae..48aed0dc84a5 100644 +--- a/drivers/mmc/host/dw_mmc-exynos.c ++++ b/drivers/mmc/host/dw_mmc-exynos.c +@@ -440,6 +440,18 @@ static s8 dw_mci_exynos_get_best_clksmpl(u8 candiates) + } + } + ++ /* ++ * If there is no cadiates value, then it needs to return -EIO. ++ * If there are candiates values and don't find bset clk sample value, ++ * then use a first candiates clock sample value. ++ */ ++ for (i = 0; i < iter; i++) { ++ __c = ror8(candiates, i); ++ if ((__c & 0x1) == 0x1) { ++ loc = i; ++ goto out; ++ } ++ } + out: + return loc; + } +@@ -470,6 +482,8 @@ static int dw_mci_exynos_execute_tuning(struct dw_mci_slot *slot, u32 opcode) + priv->tuned_sample = found; + } else { + ret = -EIO; ++ dev_warn(&mmc->class_dev, ++ "There is no candiates value about clksmpl!\n"); + } + + return ret; +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index d9c7fd0cabaf..1c80717af333 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -380,7 +380,7 @@ static void dw_mci_start_command(struct dw_mci *host, + + static inline void send_stop_abort(struct dw_mci *host, struct mmc_data *data) + { +- struct mmc_command *stop = data->stop ? data->stop : &host->stop_abort; ++ struct mmc_command *stop = &host->stop_abort; + + dw_mci_start_command(host, stop, host->stop_cmdr); + } +@@ -762,6 +762,7 @@ static int dw_mci_edmac_start_dma(struct dw_mci *host, + int ret = 0; + + /* Set external dma config: burst size, burst width */ ++ memset(&cfg, 0, sizeof(cfg)); + cfg.dst_addr = host->phy_regs + fifo_offset; + cfg.src_addr = cfg.dst_addr; + cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +@@ -1280,10 +1281,7 @@ static void __dw_mci_start_request(struct dw_mci *host, + spin_unlock_irqrestore(&host->irq_lock, irqflags); + } + +- if (mrq->stop) +- host->stop_cmdr = dw_mci_prepare_command(slot->mmc, mrq->stop); +- else +- host->stop_cmdr = dw_mci_prep_stop_abort(host, cmd); ++ host->stop_cmdr = dw_mci_prep_stop_abort(host, cmd); + } + + static void dw_mci_start_request(struct dw_mci *host, +@@ -1864,13 +1862,14 @@ static void dw_mci_tasklet_func(unsigned long priv) + * delayed. Allowing the transfer to take place + * avoids races and keeps things simple. + */ +- if (err != -ETIMEDOUT) { ++ if (err != -ETIMEDOUT && ++ host->dir_status == DW_MCI_RECV_STATUS) { + state = STATE_SENDING_DATA; + continue; + } + +- dw_mci_stop_dma(host); + send_stop_abort(host, data); ++ dw_mci_stop_dma(host); + state = STATE_SENDING_STOP; + break; + } +@@ -1894,11 +1893,10 @@ static void dw_mci_tasklet_func(unsigned long priv) + */ + if (test_and_clear_bit(EVENT_DATA_ERROR, + &host->pending_events)) { +- dw_mci_stop_dma(host); +- if (data->stop || +- !(host->data_status & (SDMMC_INT_DRTO | ++ if (!(host->data_status & (SDMMC_INT_DRTO | + SDMMC_INT_EBE))) + send_stop_abort(host, data); ++ dw_mci_stop_dma(host); + state = STATE_DATA_ERROR; + break; + } +@@ -1931,11 +1929,10 @@ static void dw_mci_tasklet_func(unsigned long priv) + */ + if (test_and_clear_bit(EVENT_DATA_ERROR, + &host->pending_events)) { +- dw_mci_stop_dma(host); +- if (data->stop || +- !(host->data_status & (SDMMC_INT_DRTO | ++ if (!(host->data_status & (SDMMC_INT_DRTO | + SDMMC_INT_EBE))) + send_stop_abort(host, data); ++ dw_mci_stop_dma(host); + state = STATE_DATA_ERROR; + break; + } +@@ -2009,7 +2006,7 @@ static void dw_mci_tasklet_func(unsigned long priv) + host->cmd = NULL; + host->data = NULL; + +- if (mrq->stop) ++ if (!mrq->sbc && mrq->stop) + dw_mci_command_complete(host, mrq->stop); + else + host->cmd_status = 0; +diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c +index bbad309679cf..41a5493cb68d 100644 +--- a/drivers/mmc/host/moxart-mmc.c ++++ b/drivers/mmc/host/moxart-mmc.c +@@ -633,6 +633,7 @@ static int moxart_probe(struct platform_device *pdev) + host->dma_chan_tx, host->dma_chan_rx); + host->have_dma = true; + ++ memset(&cfg, 0, sizeof(cfg)); + cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; + cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; + diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c index 7fc6ce381142..125c06a10455 100644 --- a/drivers/mmc/host/mtk-sd.c @@ -45580,10 +61382,34 @@ index 7fc6ce381142..125c06a10455 100644 if (check_data || (stop && stop->error)) { dev_dbg(host->dev, "DMA status: 0x%8X\n", diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c -index c8b8ac66ff7e..687fd68fbbcd 100644 +index c8b8ac66ff7e..77a03301b2a5 100644 --- a/drivers/mmc/host/mxs-mmc.c +++ b/drivers/mmc/host/mxs-mmc.c -@@ -651,7 +651,7 @@ static int mxs_mmc_probe(struct platform_device *pdev) +@@ -571,6 +571,11 @@ static const struct of_device_id mxs_mmc_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, mxs_mmc_dt_ids); + ++static void mxs_mmc_regulator_disable(void *regulator) ++{ ++ regulator_disable(regulator); ++} ++ + static int mxs_mmc_probe(struct platform_device *pdev) + { + const struct of_device_id *of_id = +@@ -614,6 +619,11 @@ static int mxs_mmc_probe(struct platform_device *pdev) + "Failed to enable vmmc regulator: %d\n", ret); + goto out_mmc_free; + } ++ ++ ret = devm_add_action_or_reset(&pdev->dev, mxs_mmc_regulator_disable, ++ reg_vmmc); ++ if (ret) ++ goto out_mmc_free; + } + + ssp->clk = devm_clk_get(&pdev->dev, NULL); +@@ -651,7 +661,7 @@ static int mxs_mmc_probe(struct platform_device *pdev) ret = mmc_of_parse(mmc); if (ret) @@ -45592,6 +61418,66 @@ index c8b8ac66ff7e..687fd68fbbcd 100644 mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34; +diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c +index 3ccaa1415f33..efd995e3cb0b 100644 +--- a/drivers/mmc/host/rtsx_pci_sdmmc.c ++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c +@@ -552,9 +552,22 @@ static int sd_write_long_data(struct realtek_pci_sdmmc *host, + return 0; + } + ++static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host) ++{ ++ rtsx_pci_write_register(host->pcr, SD_CFG1, ++ SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_128); ++} ++ ++static inline void sd_disable_initial_mode(struct realtek_pci_sdmmc *host) ++{ ++ rtsx_pci_write_register(host->pcr, SD_CFG1, ++ SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_0); ++} ++ + static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq) + { + struct mmc_data *data = mrq->data; ++ int err; + + if (host->sg_count < 0) { + data->error = host->sg_count; +@@ -563,22 +576,19 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq) + return data->error; + } + +- if (data->flags & MMC_DATA_READ) +- return sd_read_long_data(host, mrq); ++ if (data->flags & MMC_DATA_READ) { ++ if (host->initial_mode) ++ sd_disable_initial_mode(host); + +- return sd_write_long_data(host, mrq); +-} ++ err = sd_read_long_data(host, mrq); + +-static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host) +-{ +- rtsx_pci_write_register(host->pcr, SD_CFG1, +- SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_128); +-} ++ if (host->initial_mode) ++ sd_enable_initial_mode(host); + +-static inline void sd_disable_initial_mode(struct realtek_pci_sdmmc *host) +-{ +- rtsx_pci_write_register(host->pcr, SD_CFG1, +- SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_0); ++ return err; ++ } ++ ++ return sd_write_long_data(host, mrq); + } + + static void sd_normal_rw(struct realtek_pci_sdmmc *host, diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c index 445fc47dc3e7..9e52886b5928 100644 --- a/drivers/mmc/host/sdhci-esdhc-imx.c @@ -45618,7 +61504,7 @@ index 445fc47dc3e7..9e52886b5928 100644 pm_runtime_put_noidle(&pdev->dev); diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 1ef8bf9f4b1a..f150a502b20f 100644 +index 1ef8bf9f4b1a..ed83d541bf47 100644 --- a/drivers/mmc/host/sdhci.c +++ b/drivers/mmc/host/sdhci.c @@ -1386,6 +1386,10 @@ static u16 sdhci_get_preset_value(struct sdhci_host *host) @@ -45632,6 +61518,19 @@ index 1ef8bf9f4b1a..f150a502b20f 100644 case MMC_TIMING_UHS_SDR12: preset = sdhci_readw(host, SDHCI_PRESET_FOR_SDR12); break; +@@ -1589,6 +1593,12 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode, + break; + case MMC_VDD_32_33: + case MMC_VDD_33_34: ++ /* ++ * 3.4 ~ 3.6V are valid only for those platforms where it's ++ * known that the voltage range is supported by hardware. ++ */ ++ case MMC_VDD_34_35: ++ case MMC_VDD_35_36: + pwr = SDHCI_POWER_330; + break; + default: diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h index 2b67d0a616db..beea93b10a89 100644 --- a/drivers/mmc/host/sdhci.h @@ -45700,10 +61599,68 @@ index 63fac78b3d46..a3472127bea3 100644 pci_save_state(pcidev); pci_enable_wake(pcidev, pci_choose_state(pcidev, state), 0); diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c -index bb3e0d1dd355..a3e4288e5391 100644 +index bb3e0d1dd355..875e438ab973 100644 --- a/drivers/mmc/host/vub300.c +++ b/drivers/mmc/host/vub300.c -@@ -2292,7 +2292,7 @@ static int vub300_probe(struct usb_interface *interface, +@@ -579,7 +579,7 @@ static void check_vub300_port_status(struct vub300_mmc_host *vub300) + GET_SYSTEM_PORT_STATUS, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0x0000, 0x0000, &vub300->system_port_status, +- sizeof(vub300->system_port_status), HZ); ++ sizeof(vub300->system_port_status), 1000); + if (sizeof(vub300->system_port_status) == retval) + new_system_port_status(vub300); + } +@@ -1245,7 +1245,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300, + SET_INTERRUPT_PSEUDOCODE, + USB_DIR_OUT | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, 0x0000, 0x0000, +- xfer_buffer, xfer_length, HZ); ++ xfer_buffer, xfer_length, 1000); + kfree(xfer_buffer); + if (retval < 0) { + strncpy(vub300->vub_name, +@@ -1292,7 +1292,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300, + SET_TRANSFER_PSEUDOCODE, + USB_DIR_OUT | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, 0x0000, 0x0000, +- xfer_buffer, xfer_length, HZ); ++ xfer_buffer, xfer_length, 1000); + kfree(xfer_buffer); + if (retval < 0) { + strncpy(vub300->vub_name, +@@ -1998,7 +1998,7 @@ static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8], + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_CLOCK_SPEED, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x00, 0x00, buf, buf_array_size, HZ); ++ 0x00, 0x00, buf, buf_array_size, 1000); + if (retval != 8) { + dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED" + " %dkHz failed with retval=%d\n", kHzClock, retval); +@@ -2020,14 +2020,14 @@ static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_SD_POWER, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x0000, 0x0000, NULL, 0, HZ); ++ 0x0000, 0x0000, NULL, 0, 1000); + /* must wait for the VUB300 u-proc to boot up */ + msleep(600); + } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) { + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_SD_POWER, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x0001, 0x0000, NULL, 0, HZ); ++ 0x0001, 0x0000, NULL, 0, 1000); + msleep(600); + vub300->card_powered = 1; + } else if (ios->power_mode == MMC_POWER_ON) { +@@ -2288,14 +2288,14 @@ static int vub300_probe(struct usb_interface *interface, + GET_HC_INF0, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0x0000, 0x0000, &vub300->hc_info, +- sizeof(vub300->hc_info), HZ); ++ sizeof(vub300->hc_info), 1000); if (retval < 0) goto error5; retval = @@ -45711,7 +61668,20 @@ index bb3e0d1dd355..a3e4288e5391 100644 + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), SET_ROM_WAIT_STATES, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - firmware_rom_wait_states, 0x0000, NULL, 0, HZ); +- firmware_rom_wait_states, 0x0000, NULL, 0, HZ); ++ firmware_rom_wait_states, 0x0000, NULL, 0, 1000); + if (retval < 0) + goto error5; + dev_info(&vub300->udev->dev, +@@ -2310,7 +2310,7 @@ static int vub300_probe(struct usb_interface *interface, + GET_SYSTEM_PORT_STATUS, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0x0000, 0x0000, &vub300->system_port_status, +- sizeof(vub300->system_port_status), HZ); ++ sizeof(vub300->system_port_status), 1000); + if (retval < 0) { + goto error4; + } else if (sizeof(vub300->system_port_status) == retval) { diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c index 00ba09fa6f16..3c4819a05bf0 100644 --- a/drivers/mtd/chips/cfi_cmdset_0002.c @@ -46187,12 +62157,14 @@ index 78e12cc8bac2..02ec2d183607 100644 gpio_free_array(_mandatory_gpio, ARRAY_SIZE(_mandatory_gpio)); gpio_free(AMS_DELTA_GPIO_PIN_NAND_RB); diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c -index 68b9160108c9..45495bc1a70e 100644 +index 68b9160108c9..bcae07e60574 100644 --- a/drivers/mtd/nand/atmel_nand.c +++ b/drivers/mtd/nand/atmel_nand.c -@@ -2336,7 +2336,7 @@ static int atmel_nand_remove(struct platform_device *pdev) +@@ -2334,9 +2334,8 @@ static int atmel_nand_probe(struct platform_device *pdev) + static int atmel_nand_remove(struct platform_device *pdev) + { struct atmel_nand_host *host = platform_get_drvdata(pdev); - struct mtd_info *mtd = nand_to_mtd(&host->nand_chip); +- struct mtd_info *mtd = nand_to_mtd(&host->nand_chip); - nand_release(mtd); + nand_release(&host->nand_chip); @@ -46283,10 +62255,28 @@ index ef9a6b22c9fa..40fdc9d267b9 100644 clk_disable_unprepare(ctrl->clk); diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c -index 0b0c93702abb..c16e740c01c3 100644 +index 0b0c93702abb..894d771c87aa 100644 --- a/drivers/mtd/nand/cafe_nand.c +++ b/drivers/mtd/nand/cafe_nand.c -@@ -825,7 +825,7 @@ static void cafe_nand_remove(struct pci_dev *pdev) +@@ -700,7 +700,7 @@ static int cafe_nand_probe(struct pci_dev *pdev, + "CAFE NAND", mtd); + if (err) { + dev_warn(&pdev->dev, "Could not register IRQ %d\n", pdev->irq); +- goto out_ior; ++ goto out_free_rs; + } + + /* Disable master reset, enable NAND clock */ +@@ -808,6 +808,8 @@ static int cafe_nand_probe(struct pci_dev *pdev, + /* Disable NAND IRQ in global IRQ mask register */ + cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK); + free_irq(pdev->irq, mtd); ++ out_free_rs: ++ free_rs(cafe->rs); + out_ior: + pci_iounmap(pdev, cafe->mmio); + out_free_mtd: +@@ -825,7 +827,7 @@ static void cafe_nand_remove(struct pci_dev *pdev) /* Disable NAND IRQ in global IRQ mask register */ cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK); free_irq(pdev->irq, mtd); @@ -47055,7 +63045,7 @@ index d489fbd07c12..92de2b408734 100644 if (dummy_clk / 8) { reg |= (1 << CQSPI_REG_RD_INSTR_MODE_EN_LSB); diff --git a/drivers/mtd/spi-nor/hisi-sfc.c b/drivers/mtd/spi-nor/hisi-sfc.c -index 20378b0d55e9..68be79ba571d 100644 +index 20378b0d55e9..a0c2101f0b48 100644 --- a/drivers/mtd/spi-nor/hisi-sfc.c +++ b/drivers/mtd/spi-nor/hisi-sfc.c @@ -393,8 +393,10 @@ static int hisi_spi_nor_register_all(struct hifmc_host *host) @@ -47070,6 +63060,14 @@ index 20378b0d55e9..68be79ba571d 100644 if (host->num_chip == HIFMC_MAX_CHIP_NUM) { dev_warn(dev, "Flash device number exceeds the maximum chipselect number\n"); +@@ -465,7 +467,6 @@ static int hisi_spi_nor_remove(struct platform_device *pdev) + + hisi_spi_nor_unregister_all(host); + mutex_destroy(&host->lock); +- clk_disable_unprepare(host->clk); + return 0; + } + diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index 5c0332e31138..52c108378831 100644 --- a/drivers/mtd/ubi/wl.c @@ -47293,11 +63291,46 @@ index d52fd842ef1f..2b721ed392ad 100644 if (ecmd->duplex == DUPLEX_UNKNOWN && slave->duplex != DUPLEX_UNKNOWN) ecmd->duplex = slave->duplex; +diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c +index 258cb3999b0e..5c6a96236309 100644 +--- a/drivers/net/bonding/bond_options.c ++++ b/drivers/net/bonding/bond_options.c +@@ -1408,7 +1408,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond, + mac = (u8 *)&newval->value; + } + +- if (!is_valid_ether_addr(mac)) ++ if (is_multicast_ether_addr(mac)) + goto err; + + netdev_info(bond->dev, "Setting ad_actor_system to %pM\n", mac); diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c -index 3f756fa2f603..68bbac4715c3 100644 +index 3f756fa2f603..1e1e77a40f18 100644 --- a/drivers/net/bonding/bond_sysfs_slave.c +++ b/drivers/net/bonding/bond_sysfs_slave.c -@@ -125,7 +125,6 @@ static const struct slave_attribute *slave_attrs[] = { +@@ -112,20 +112,19 @@ static ssize_t ad_partner_oper_port_state_show(struct slave *slave, char *buf) + } + static SLAVE_ATTR_RO(ad_partner_oper_port_state); + +-static const struct slave_attribute *slave_attrs[] = { +- &slave_attr_state, +- &slave_attr_mii_status, +- &slave_attr_link_failure_count, +- &slave_attr_perm_hwaddr, +- &slave_attr_queue_id, +- &slave_attr_ad_aggregator_id, +- &slave_attr_ad_actor_oper_port_state, +- &slave_attr_ad_partner_oper_port_state, ++static const struct attribute *slave_attrs[] = { ++ &slave_attr_state.attr, ++ &slave_attr_mii_status.attr, ++ &slave_attr_link_failure_count.attr, ++ &slave_attr_perm_hwaddr.attr, ++ &slave_attr_queue_id.attr, ++ &slave_attr_ad_aggregator_id.attr, ++ &slave_attr_ad_actor_oper_port_state.attr, ++ &slave_attr_ad_partner_oper_port_state.attr, + NULL }; #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr) @@ -47305,7 +63338,7 @@ index 3f756fa2f603..68bbac4715c3 100644 static ssize_t slave_show(struct kobject *kobj, struct attribute *attr, char *buf) -@@ -136,28 +135,15 @@ static ssize_t slave_show(struct kobject *kobj, +@@ -136,45 +135,16 @@ static ssize_t slave_show(struct kobject *kobj, return slave_attr->show(slave, buf); } @@ -47322,9 +63355,9 @@ index 3f756fa2f603..68bbac4715c3 100644 - int bond_sysfs_slave_add(struct slave *slave) { - const struct slave_attribute **a; - int err; - +- const struct slave_attribute **a; +- int err; +- - err = kobject_init_and_add(&slave->kobj, &slave_ktype, - &(slave->dev->dev.kobj), "bonding_slave"); - if (err) { @@ -47332,15 +63365,27 @@ index 3f756fa2f603..68bbac4715c3 100644 - return err; - } - - for (a = slave_attrs; *a; ++a) { - err = sysfs_create_file(&slave->kobj, &((*a)->attr)); - if (err) { -@@ -175,6 +161,4 @@ void bond_sysfs_slave_del(struct slave *slave) +- for (a = slave_attrs; *a; ++a) { +- err = sysfs_create_file(&slave->kobj, &((*a)->attr)); +- if (err) { +- kobject_put(&slave->kobj); +- return err; +- } +- } +- +- return 0; ++ return sysfs_create_files(&slave->kobj, slave_attrs); + } - for (a = slave_attrs; *a; ++a) - sysfs_remove_file(&slave->kobj, &((*a)->attr)); + void bond_sysfs_slave_del(struct slave *slave) + { +- const struct slave_attribute **a; +- +- for (a = slave_attrs; *a; ++a) +- sysfs_remove_file(&slave->kobj, &((*a)->attr)); - - kobject_put(&slave->kobj); ++ sysfs_remove_files(&slave->kobj, slave_attrs); } diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c index c2dea4916e5d..1243c2e5a86a 100644 @@ -47620,6 +63665,111 @@ index 195f15edb32e..197c27d8f584 100644 /* error warning state */ cf->can_id |= CAN_ERR_CRTL; cf->data[1] = (bec.txerr > bec.rxerr) ? +diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c +index c1317889d3d8..ced11ea89269 100644 +--- a/drivers/net/can/pch_can.c ++++ b/drivers/net/can/pch_can.c +@@ -703,11 +703,11 @@ static int pch_can_rx_normal(struct net_device *ndev, u32 obj_num, int quota) + cf->data[i + 1] = data_reg >> 8; + } + +- netif_receive_skb(skb); + rcv_pkts++; + stats->rx_packets++; + quota--; + stats->rx_bytes += cf->can_dlc; ++ netif_receive_skb(skb); + + pch_fifo_thresh(priv, obj_num); + obj_num++; +diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c +index 9b2c3bd00f8b..2ac33ee1067e 100644 +--- a/drivers/net/can/rcar/rcar_can.c ++++ b/drivers/net/can/rcar/rcar_can.c +@@ -858,10 +858,12 @@ static int __maybe_unused rcar_can_suspend(struct device *dev) + struct rcar_can_priv *priv = netdev_priv(ndev); + u16 ctlr; + +- if (netif_running(ndev)) { +- netif_stop_queue(ndev); +- netif_device_detach(ndev); +- } ++ if (!netif_running(ndev)) ++ return 0; ++ ++ netif_stop_queue(ndev); ++ netif_device_detach(ndev); ++ + ctlr = readw(&priv->regs->ctlr); + ctlr |= RCAR_CAN_CTLR_CANM_HALT; + writew(ctlr, &priv->regs->ctlr); +@@ -880,6 +882,9 @@ static int __maybe_unused rcar_can_resume(struct device *dev) + u16 ctlr; + int err; + ++ if (!netif_running(ndev)) ++ return 0; ++ + err = clk_enable(priv->clk); + if (err) { + netdev_err(ndev, "clk_enable() failed, error %d\n", err); +@@ -893,10 +898,9 @@ static int __maybe_unused rcar_can_resume(struct device *dev) + writew(ctlr, &priv->regs->ctlr); + priv->can.state = CAN_STATE_ERROR_ACTIVE; + +- if (netif_running(ndev)) { +- netif_device_attach(ndev); +- netif_start_queue(ndev); +- } ++ netif_device_attach(ndev); ++ netif_start_queue(ndev); ++ + return 0; + } + +diff --git a/drivers/net/can/sja1000/ems_pcmcia.c b/drivers/net/can/sja1000/ems_pcmcia.c +index 381de998d2f1..fef5c59c0f4c 100644 +--- a/drivers/net/can/sja1000/ems_pcmcia.c ++++ b/drivers/net/can/sja1000/ems_pcmcia.c +@@ -243,7 +243,12 @@ static int ems_pcmcia_add_card(struct pcmcia_device *pdev, unsigned long base) + free_sja1000dev(dev); + } + +- err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, ++ if (!card->channels) { ++ err = -ENODEV; ++ goto failure_cleanup; ++ } ++ ++ err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, + DRV_NAME, card); + if (!err) + return 0; +diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c +index 131026fbc2d7..e12fc5d88382 100644 +--- a/drivers/net/can/sja1000/peak_pci.c ++++ b/drivers/net/can/sja1000/peak_pci.c +@@ -736,16 +736,15 @@ static void peak_pci_remove(struct pci_dev *pdev) + struct net_device *prev_dev = chan->prev_dev; + + dev_info(&pdev->dev, "removing device %s\n", dev->name); ++ /* do that only for first channel */ ++ if (!prev_dev && chan->pciec_card) ++ peak_pciec_remove(chan->pciec_card); + unregister_sja1000dev(dev); + free_sja1000dev(dev); + dev = prev_dev; + +- if (!dev) { +- /* do that only for first channel */ +- if (chan->pciec_card) +- peak_pciec_remove(chan->pciec_card); ++ if (!dev) + break; +- } + priv = netdev_priv(dev); + chan = priv->priv; + } diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c index 7621f91a8a20..fd48770ba792 100644 --- a/drivers/net/can/softing/softing_main.c @@ -47641,10 +63791,66 @@ index 7621f91a8a20..fd48770ba792 100644 } diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c -index d0846ae9e0e4..022a9b3c7d4e 100644 +index d0846ae9e0e4..d62d61d734ea 100644 --- a/drivers/net/can/usb/ems_usb.c +++ b/drivers/net/can/usb/ems_usb.c -@@ -1064,7 +1064,6 @@ static void ems_usb_disconnect(struct usb_interface *intf) +@@ -267,6 +267,8 @@ struct ems_usb { + unsigned int free_slots; /* remember number of available slots */ + + struct ems_cpc_msg active_params; /* active controller parameters */ ++ void *rxbuf[MAX_RX_URBS]; ++ dma_addr_t rxbuf_dma[MAX_RX_URBS]; + }; + + static void ems_usb_read_interrupt_callback(struct urb *urb) +@@ -598,6 +600,7 @@ static int ems_usb_start(struct ems_usb *dev) + for (i = 0; i < MAX_RX_URBS; i++) { + struct urb *urb = NULL; + u8 *buf = NULL; ++ dma_addr_t buf_dma; + + /* create a URB, and a buffer for it */ + urb = usb_alloc_urb(0, GFP_KERNEL); +@@ -607,7 +610,7 @@ static int ems_usb_start(struct ems_usb *dev) + } + + buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL, +- &urb->transfer_dma); ++ &buf_dma); + if (!buf) { + netdev_err(netdev, "No memory left for USB buffer\n"); + usb_free_urb(urb); +@@ -615,6 +618,8 @@ static int ems_usb_start(struct ems_usb *dev) + break; + } + ++ urb->transfer_dma = buf_dma; ++ + usb_fill_bulk_urb(urb, dev->udev, usb_rcvbulkpipe(dev->udev, 2), + buf, RX_BUFFER_SIZE, + ems_usb_read_bulk_callback, dev); +@@ -630,6 +635,9 @@ static int ems_usb_start(struct ems_usb *dev) + break; + } + ++ dev->rxbuf[i] = buf; ++ dev->rxbuf_dma[i] = buf_dma; ++ + /* Drop reference, USB core will take care of freeing it */ + usb_free_urb(urb); + } +@@ -695,6 +703,10 @@ static void unlink_all_urbs(struct ems_usb *dev) + + usb_kill_anchored_urbs(&dev->rx_submitted); + ++ for (i = 0; i < MAX_RX_URBS; ++i) ++ usb_free_coherent(dev->udev, RX_BUFFER_SIZE, ++ dev->rxbuf[i], dev->rxbuf_dma[i]); ++ + usb_kill_anchored_urbs(&dev->tx_submitted); + atomic_set(&dev->active_tx_urbs, 0); + +@@ -1064,7 +1076,6 @@ static void ems_usb_disconnect(struct usb_interface *intf) if (dev) { unregister_netdev(dev->netdev); @@ -47652,7 +63858,7 @@ index d0846ae9e0e4..022a9b3c7d4e 100644 unlink_all_urbs(dev); -@@ -1072,6 +1071,8 @@ static void ems_usb_disconnect(struct usb_interface *intf) +@@ -1072,6 +1083,8 @@ static void ems_usb_disconnect(struct usb_interface *intf) kfree(dev->intr_in_buffer); kfree(dev->tx_msg_buffer); @@ -47661,6 +63867,81 @@ index d0846ae9e0e4..022a9b3c7d4e 100644 } } +diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c +index c6dcf93675c0..fbe1173b2651 100644 +--- a/drivers/net/can/usb/esd_usb2.c ++++ b/drivers/net/can/usb/esd_usb2.c +@@ -207,6 +207,8 @@ struct esd_usb2 { + int net_count; + u32 version; + int rxinitdone; ++ void *rxbuf[MAX_RX_URBS]; ++ dma_addr_t rxbuf_dma[MAX_RX_URBS]; + }; + + struct esd_usb2_net_priv { +@@ -234,8 +236,8 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, + if (id == ESD_EV_CAN_ERROR_EXT) { + u8 state = msg->msg.rx.data[0]; + u8 ecc = msg->msg.rx.data[1]; +- u8 txerr = msg->msg.rx.data[2]; +- u8 rxerr = msg->msg.rx.data[3]; ++ u8 rxerr = msg->msg.rx.data[2]; ++ u8 txerr = msg->msg.rx.data[3]; + + skb = alloc_can_err_skb(priv->netdev, &cf); + if (skb == NULL) { +@@ -556,6 +558,7 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev) + for (i = 0; i < MAX_RX_URBS; i++) { + struct urb *urb = NULL; + u8 *buf = NULL; ++ dma_addr_t buf_dma; + + /* create a URB, and a buffer for it */ + urb = usb_alloc_urb(0, GFP_KERNEL); +@@ -565,7 +568,7 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev) + } + + buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL, +- &urb->transfer_dma); ++ &buf_dma); + if (!buf) { + dev_warn(dev->udev->dev.parent, + "No memory left for USB buffer\n"); +@@ -573,6 +576,8 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev) + goto freeurb; + } + ++ urb->transfer_dma = buf_dma; ++ + usb_fill_bulk_urb(urb, dev->udev, + usb_rcvbulkpipe(dev->udev, 1), + buf, RX_BUFFER_SIZE, +@@ -585,8 +590,12 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev) + usb_unanchor_urb(urb); + usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf, + urb->transfer_dma); ++ goto freeurb; + } + ++ dev->rxbuf[i] = buf; ++ dev->rxbuf_dma[i] = buf_dma; ++ + freeurb: + /* Drop reference, USB core will take care of freeing it */ + usb_free_urb(urb); +@@ -674,6 +683,11 @@ static void unlink_all_urbs(struct esd_usb2 *dev) + int i, j; + + usb_kill_anchored_urbs(&dev->rx_submitted); ++ ++ for (i = 0; i < MAX_RX_URBS; ++i) ++ usb_free_coherent(dev->udev, RX_BUFFER_SIZE, ++ dev->rxbuf[i], dev->rxbuf_dma[i]); ++ + for (i = 0; i < dev->net_count; i++) { + priv = dev->nets[i]; + if (priv) { diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c index a65203e6ea5f..d21c68882e86 100644 --- a/drivers/net/can/usb/gs_usb.c @@ -47944,10 +64225,89 @@ index a65203e6ea5f..d21c68882e86 100644 /* send host config */ rc = usb_control_msg(interface_to_usbdev(intf), diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c -index 3a75352f632b..792a1afabf5d 100644 +index 3a75352f632b..5ab088d02fba 100644 --- a/drivers/net/can/usb/kvaser_usb.c +++ b/drivers/net/can/usb/kvaser_usb.c -@@ -791,7 +791,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv, +@@ -31,7 +31,10 @@ + #define USB_SEND_TIMEOUT 1000 /* msecs */ + #define USB_RECV_TIMEOUT 1000 /* msecs */ + #define RX_BUFFER_SIZE 3072 +-#define CAN_USB_CLOCK 8000000 ++#define KVASER_USB_CAN_CLOCK_8MHZ 8000000 ++#define KVASER_USB_CAN_CLOCK_16MHZ 16000000 ++#define KVASER_USB_CAN_CLOCK_24MHZ 24000000 ++#define KVASER_USB_CAN_CLOCK_32MHZ 32000000 + #define MAX_NET_DEVICES 3 + #define MAX_USBCAN_NET_DEVICES 2 + +@@ -142,6 +145,12 @@ static inline bool kvaser_is_usbcan(const struct usb_device_id *id) + #define CMD_LEAF_USB_THROTTLE 77 + #define CMD_LEAF_LOG_MESSAGE 106 + ++/* Leaf frequency options */ ++#define KVASER_USB_LEAF_SWOPTION_FREQ_MASK 0x60 ++#define KVASER_USB_LEAF_SWOPTION_FREQ_16_MHZ_CLK 0 ++#define KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK BIT(5) ++#define KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK BIT(6) ++ + /* error factors */ + #define M16C_EF_ACKE BIT(0) + #define M16C_EF_CRCE BIT(1) +@@ -472,6 +481,8 @@ struct kvaser_usb { + bool rxinitdone; + void *rxbuf[MAX_RX_URBS]; + dma_addr_t rxbuf_dma[MAX_RX_URBS]; ++ ++ struct can_clock clock; + }; + + struct kvaser_usb_net_priv { +@@ -652,6 +663,27 @@ static int kvaser_usb_send_simple_msg(const struct kvaser_usb *dev, + return rc; + } + ++static void kvaser_usb_get_software_info_leaf(struct kvaser_usb *dev, ++ const struct leaf_msg_softinfo *softinfo) ++{ ++ u32 sw_options = le32_to_cpu(softinfo->sw_options); ++ ++ dev->fw_version = le32_to_cpu(softinfo->fw_version); ++ dev->max_tx_urbs = le16_to_cpu(softinfo->max_outstanding_tx); ++ ++ switch (sw_options & KVASER_USB_LEAF_SWOPTION_FREQ_MASK) { ++ case KVASER_USB_LEAF_SWOPTION_FREQ_16_MHZ_CLK: ++ dev->clock.freq = KVASER_USB_CAN_CLOCK_16MHZ; ++ break; ++ case KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK: ++ dev->clock.freq = KVASER_USB_CAN_CLOCK_24MHZ; ++ break; ++ case KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK: ++ dev->clock.freq = KVASER_USB_CAN_CLOCK_32MHZ; ++ break; ++ } ++} ++ + static int kvaser_usb_get_software_info(struct kvaser_usb *dev) + { + struct kvaser_msg msg; +@@ -667,14 +699,13 @@ static int kvaser_usb_get_software_info(struct kvaser_usb *dev) + + switch (dev->family) { + case KVASER_LEAF: +- dev->fw_version = le32_to_cpu(msg.u.leaf.softinfo.fw_version); +- dev->max_tx_urbs = +- le16_to_cpu(msg.u.leaf.softinfo.max_outstanding_tx); ++ kvaser_usb_get_software_info_leaf(dev, &msg.u.leaf.softinfo); + break; + case KVASER_USBCAN: + dev->fw_version = le32_to_cpu(msg.u.usbcan.softinfo.fw_version); + dev->max_tx_urbs = + le16_to_cpu(msg.u.usbcan.softinfo.max_outstanding_tx); ++ dev->clock.freq = KVASER_USB_CAN_CLOCK_8MHZ; + break; + } + +@@ -791,7 +822,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv, if (!urb) return -ENOMEM; @@ -47956,7 +64316,7 @@ index 3a75352f632b..792a1afabf5d 100644 if (!buf) { usb_free_urb(urb); return -ENOMEM; -@@ -1459,7 +1459,7 @@ static int kvaser_usb_set_opt_mode(const struct kvaser_usb_net_priv *priv) +@@ -1459,7 +1490,7 @@ static int kvaser_usb_set_opt_mode(const struct kvaser_usb_net_priv *priv) struct kvaser_msg *msg; int rc; @@ -47965,7 +64325,7 @@ index 3a75352f632b..792a1afabf5d 100644 if (!msg) return -ENOMEM; -@@ -1592,7 +1592,7 @@ static int kvaser_usb_flush_queue(struct kvaser_usb_net_priv *priv) +@@ -1592,7 +1623,7 @@ static int kvaser_usb_flush_queue(struct kvaser_usb_net_priv *priv) struct kvaser_msg *msg; int rc; @@ -47974,6 +64334,15 @@ index 3a75352f632b..792a1afabf5d 100644 if (!msg) return -ENOMEM; +@@ -1926,7 +1957,7 @@ static int kvaser_usb_init_one(struct usb_interface *intf, + kvaser_usb_reset_tx_urb_contexts(priv); + + priv->can.state = CAN_STATE_STOPPED; +- priv->can.clock.freq = CAN_USB_CLOCK; ++ priv->can.clock.freq = dev->clock.freq; + priv->can.bittiming_const = &kvaser_usb_bittiming_const; + priv->can.do_set_bittiming = kvaser_usb_set_bittiming; + priv->can.do_set_mode = kvaser_usb_set_mode; diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c index 6cd4317fe94d..c8502bd8e3dc 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c @@ -48060,7 +64429,7 @@ index 6cd4317fe94d..c8502bd8e3dc 100644 unregister_candev(netdev); diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -index 40647b837b31..d314e73f3d06 100644 +index 40647b837b31..e7ffc073fbd6 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c @@ -475,12 +475,18 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if, @@ -48110,7 +64479,21 @@ index 40647b837b31..d314e73f3d06 100644 /* nothing should be sent while in BUS_OFF state */ if (dev->can.state == CAN_STATE_BUS_OFF) return 0; -@@ -588,9 +600,14 @@ static int pcan_usb_fd_decode_error(struct pcan_usb_fd_if *usb_if, +@@ -547,11 +559,10 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if, + } else if (sm->channel_p_w_b & PUCAN_BUS_WARNING) { + new_state = CAN_STATE_ERROR_WARNING; + } else { +- /* no error bit (so, no error skb, back to active state) */ +- dev->can.state = CAN_STATE_ERROR_ACTIVE; ++ /* back to (or still in) ERROR_ACTIVE state */ ++ new_state = CAN_STATE_ERROR_ACTIVE; + pdev->bec.txerr = 0; + pdev->bec.rxerr = 0; +- return 0; + } + + /* state hasn't changed */ +@@ -588,9 +599,14 @@ static int pcan_usb_fd_decode_error(struct pcan_usb_fd_if *usb_if, struct pucan_msg *rx_msg) { struct pucan_error_msg *er = (struct pucan_error_msg *)rx_msg; @@ -48128,7 +64511,7 @@ index 40647b837b31..d314e73f3d06 100644 /* keep a trace of tx and rx error counters for later use */ pdev->bec.txerr = er->tx_err_cnt; -@@ -604,11 +621,17 @@ static int pcan_usb_fd_decode_overrun(struct pcan_usb_fd_if *usb_if, +@@ -604,11 +620,17 @@ static int pcan_usb_fd_decode_overrun(struct pcan_usb_fd_if *usb_if, struct pucan_msg *rx_msg) { struct pcan_ufd_ovr_msg *ov = (struct pcan_ufd_ovr_msg *)rx_msg; @@ -48148,7 +64531,7 @@ index 40647b837b31..d314e73f3d06 100644 /* allocate an skb to store the error frame */ skb = alloc_can_err_skb(netdev, &cf); if (!skb) -@@ -726,6 +749,9 @@ static int pcan_usb_fd_encode_msg(struct peak_usb_device *dev, +@@ -726,6 +748,9 @@ static int pcan_usb_fd_encode_msg(struct peak_usb_device *dev, u16 tx_msg_size, tx_msg_flags; u8 can_dlc; @@ -48158,8 +64541,69 @@ index 40647b837b31..d314e73f3d06 100644 tx_msg_size = ALIGN(sizeof(struct pucan_tx_msg) + cfd->len, 4); tx_msg->size = cpu_to_le16(tx_msg_size); tx_msg->type = cpu_to_le16(PUCAN_MSG_CAN_TX); +diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c +index 3e4416473607..df99354ec12a 100644 +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -148,7 +148,8 @@ struct usb_8dev_priv { + u8 *cmd_msg_buffer; + + struct mutex usb_8dev_cmd_lock; +- ++ void *rxbuf[MAX_RX_URBS]; ++ dma_addr_t rxbuf_dma[MAX_RX_URBS]; + }; + + /* tx frame */ +@@ -744,6 +745,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv) + for (i = 0; i < MAX_RX_URBS; i++) { + struct urb *urb = NULL; + u8 *buf; ++ dma_addr_t buf_dma; + + /* create a URB, and a buffer for it */ + urb = usb_alloc_urb(0, GFP_KERNEL); +@@ -753,7 +755,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv) + } + + buf = usb_alloc_coherent(priv->udev, RX_BUFFER_SIZE, GFP_KERNEL, +- &urb->transfer_dma); ++ &buf_dma); + if (!buf) { + netdev_err(netdev, "No memory left for USB buffer\n"); + usb_free_urb(urb); +@@ -761,6 +763,8 @@ static int usb_8dev_start(struct usb_8dev_priv *priv) + break; + } + ++ urb->transfer_dma = buf_dma; ++ + usb_fill_bulk_urb(urb, priv->udev, + usb_rcvbulkpipe(priv->udev, + USB_8DEV_ENDP_DATA_RX), +@@ -778,6 +782,9 @@ static int usb_8dev_start(struct usb_8dev_priv *priv) + break; + } + ++ priv->rxbuf[i] = buf; ++ priv->rxbuf_dma[i] = buf_dma; ++ + /* Drop reference, USB core will take care of freeing it */ + usb_free_urb(urb); + } +@@ -847,6 +854,10 @@ static void unlink_all_urbs(struct usb_8dev_priv *priv) + + usb_kill_anchored_urbs(&priv->rx_submitted); + ++ for (i = 0; i < MAX_RX_URBS; ++i) ++ usb_free_coherent(priv->udev, RX_BUFFER_SIZE, ++ priv->rxbuf[i], priv->rxbuf_dma[i]); ++ + usb_kill_anchored_urbs(&priv->tx_submitted); + atomic_set(&priv->active_tx_urbs, 0); + diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index 060f9b176929..b6867a8915da 100644 +index 060f9b176929..4b8f95ecd056 100644 --- a/drivers/net/dsa/b53/b53_common.c +++ b/drivers/net/dsa/b53/b53_common.c @@ -502,6 +502,19 @@ static void b53_imp_vlan_setup(struct dsa_switch *ds, int cpu_port) @@ -48235,6 +64679,17 @@ index 060f9b176929..b6867a8915da 100644 } static void b53_br_set_stp_state(struct dsa_switch *ds, int port, u8 state) +@@ -1776,9 +1798,8 @@ static int b53_switch_init(struct b53_device *dev) + dev->cpu_port = 5; + } + +- /* cpu port is always last */ +- dev->num_ports = dev->cpu_port + 1; + dev->enabled_ports |= BIT(dev->cpu_port); ++ dev->num_ports = fls(dev->enabled_ports); + + dev->ports = devm_kzalloc(dev->dev, + sizeof(struct b53_port) * dev->num_ports, diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h index 3cf246c6bdcc..aed70e76006d 100644 --- a/drivers/net/dsa/b53/b53_regs.h @@ -48320,6 +64775,18 @@ index 838fe373cd6f..ca1d1f2e1161 100644 #define CORE_SFT_LRN_CTRL 0x000f8 #define SW_LEARN_CNTL(x) (1 << (x)) +diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig +index 8cc7467b6c1f..8c80ca4b8ae1 100644 +--- a/drivers/net/ethernet/Kconfig ++++ b/drivers/net/ethernet/Kconfig +@@ -96,6 +96,7 @@ config JME + config KORINA + tristate "Korina (IDT RC32434) Ethernet support" + depends on MIKROTIK_RB532 ++ select CRC32 + ---help--- + If you have a Mikrotik RouterBoard 500 or IDT RC32434 + based system say Y. Otherwise say N. diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c index f8df8248035e..31e02ca56572 100644 --- a/drivers/net/ethernet/aeroflex/greth.c @@ -48392,6 +64859,33 @@ index 6ffdff68bfc4..3dc101f7d6bd 100644 iounmap(db->membase); free_netdev(ndev); +diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c +index e306342506f1..e02b99f77b1c 100644 +--- a/drivers/net/ethernet/altera/altera_tse_main.c ++++ b/drivers/net/ethernet/altera/altera_tse_main.c +@@ -1361,16 +1361,19 @@ static int altera_tse_probe(struct platform_device *pdev) + priv->rxdescmem_busaddr = dma_res->start; + + } else { ++ ret = -ENODEV; + goto err_free_netdev; + } + +- if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask))) ++ if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask))) { + dma_set_coherent_mask(priv->device, + DMA_BIT_MASK(priv->dmaops->dmamask)); +- else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32))) ++ } else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32))) { + dma_set_coherent_mask(priv->device, DMA_BIT_MASK(32)); +- else ++ } else { ++ ret = -EIO; + goto err_free_netdev; ++ } + + /* MAC address space */ + ret = request_and_map(pdev, "control_port", &control_port, diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c index 905911f78693..e95f19e573a7 100644 --- a/drivers/net/ethernet/amazon/ena/ena_com.c @@ -48475,6 +64969,18 @@ index c22bf52d3320..c3887ac3d04d 100644 if (!request_region(ioaddr, PCNET32_TOTAL_SIZE, "pcnet32_probe_pci")) { if (pcnet32_debug & NETIF_MSG_PROBE) pr_err("io address range already allocated\n"); +diff --git a/drivers/net/ethernet/arc/Kconfig b/drivers/net/ethernet/arc/Kconfig +index 689045186064..ef4988716cf4 100644 +--- a/drivers/net/ethernet/arc/Kconfig ++++ b/drivers/net/ethernet/arc/Kconfig +@@ -19,6 +19,7 @@ config ARC_EMAC_CORE + tristate + select MII + select PHYLIB ++ select CRC32 + + config ARC_EMAC + tristate "ARC EMAC support" diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c index a22403c688c9..337cfce78aef 100644 --- a/drivers/net/ethernet/arc/emac_mdio.c @@ -48558,6 +65064,44 @@ index d95dec595786..9a9f6c12f89a 100644 dev_err(sdev->dev, "Required 30BIT DMA mask unsupported by the system\n"); goto err_out_powerdown; +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 5d67dbdd943d..98392a069f2b 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -90,9 +90,13 @@ static inline void tdma_port_write_desc_addr(struct bcm_sysport_priv *priv, + struct dma_desc *desc, + unsigned int port) + { ++ unsigned long desc_flags; ++ + /* Ports are latched, so write upper address first */ ++ spin_lock_irqsave(&priv->desc_lock, desc_flags); + tdma_writel(priv, desc->addr_status_len, TDMA_WRITE_PORT_HI(port)); + tdma_writel(priv, desc->addr_lo, TDMA_WRITE_PORT_LO(port)); ++ spin_unlock_irqrestore(&priv->desc_lock, desc_flags); + } + + /* Ethtool operations */ +@@ -1587,6 +1591,7 @@ static int bcm_sysport_open(struct net_device *dev) + } + + /* Initialize both hardware and software ring */ ++ spin_lock_init(&priv->desc_lock); + for (i = 0; i < dev->num_tx_queues; i++) { + ret = bcm_sysport_init_tx_ring(priv, i); + if (ret) { +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h +index 0d3444f1d78a..1cf5af2b11e1 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.h ++++ b/drivers/net/ethernet/broadcom/bcmsysport.h +@@ -660,6 +660,7 @@ struct bcm_sysport_priv { + int wol_irq; + + /* Transmit rings */ ++ spinlock_t desc_lock; + struct bcm_sysport_tx_ring tx_rings[TDMA_NUM_RINGS]; + + /* Receive queue */ diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c index 1f7034d739b0..e15e487c14dd 100644 --- a/drivers/net/ethernet/broadcom/bnx2.c @@ -48573,8 +65117,41 @@ index 1f7034d739b0..e15e487c14dd 100644 goto err_out_unmap; } +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 46a7dcf2ff4a..9d7f491931ce 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -2672,7 +2672,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode) + } + + /* Allocated memory for FW statistics */ +- if (bnx2x_alloc_fw_stats_mem(bp)) ++ rc = bnx2x_alloc_fw_stats_mem(bp); ++ if (rc) + LOAD_ERROR_EXIT(bp, load_error0); + + /* request pf to initialize status blocks */ +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +index 1835d2e451c0..fc7fce642666 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +@@ -635,11 +635,13 @@ static int bnx2x_ilt_client_mem_op(struct bnx2x *bp, int cli_num, + { + int i, rc; + struct bnx2x_ilt *ilt = BP_ILT(bp); +- struct ilt_client_info *ilt_cli = &ilt->clients[cli_num]; ++ struct ilt_client_info *ilt_cli; + + if (!ilt || !ilt->lines) + return -1; + ++ ilt_cli = &ilt->clients[cli_num]; ++ + if (ilt_cli->flags & (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM)) + return 0; + diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -index e8a09d0afe1c..545b59ff5d7e 100644 +index e8a09d0afe1c..2f2e60f9b884 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c @@ -1240,8 +1240,10 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param, @@ -48583,7 +65160,7 @@ index e8a09d0afe1c..545b59ff5d7e 100644 /* SR-IOV capability was enabled but there are no VFs*/ - if (iov->total == 0) + if (iov->total == 0) { -+ err = -EINVAL; ++ err = 0; goto failed; + } @@ -49007,6 +65584,18 @@ index 747ef0882976..8f3d544bec0c 100644 (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) | (rq->cont_qs_rbdr_idx << 8) | (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx); +diff --git a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c +index f5f1b0b51ebd..79eb2257a30e 100644 +--- a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c ++++ b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c +@@ -1133,6 +1133,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + if (!adapter->registered_device_map) { + pr_err("%s: could not register any net devices\n", + pci_name(pdev)); ++ err = -EINVAL; + goto out_release_adapter_res; + } + diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c index e4b5b057f417..f012649891da 100644 --- a/drivers/net/ethernet/chelsio/cxgb3/sge.c @@ -49576,6 +66165,97 @@ index cadcee645f74..11ce50a05799 100644 #define DE_TX_RING_SIZE 64 #define DE_RING_BYTES \ ((sizeof(struct de_desc) * DE_RX_RING_SIZE) + \ +diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c +index 005c79b5b3f0..a5a291b848b0 100644 +--- a/drivers/net/ethernet/dec/tulip/de4x5.c ++++ b/drivers/net/ethernet/dec/tulip/de4x5.c +@@ -4704,6 +4704,10 @@ type3_infoblock(struct net_device *dev, u_char count, u_char *p) + lp->ibn = 3; + lp->active = *p++; + if (MOTO_SROM_BUG) lp->active = 0; ++ /* if (MOTO_SROM_BUG) statement indicates lp->active could ++ * be 8 (i.e. the size of array lp->phy) */ ++ if (WARN_ON(lp->active >= ARRAY_SIZE(lp->phy))) ++ return -EINVAL; + lp->phy[lp->active].gep = (*p ? p : NULL); p += (2 * (*p) + 1); + lp->phy[lp->active].rst = (*p ? p : NULL); p += (2 * (*p) + 1); + lp->phy[lp->active].mc = get_unaligned_le16(p); p += 2; +@@ -4995,19 +4999,23 @@ mii_get_phy(struct net_device *dev) + } + if ((j == limit) && (i < DE4X5_MAX_MII)) { + for (k=0; k < DE4X5_MAX_PHY && lp->phy[k].id; k++); +- lp->phy[k].addr = i; +- lp->phy[k].id = id; +- lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */ +- lp->phy[k].spd.mask = GENERIC_MASK; /* 100Mb/s technologies */ +- lp->phy[k].spd.value = GENERIC_VALUE; /* TX & T4, H/F Duplex */ +- lp->mii_cnt++; +- lp->active++; +- printk("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n", dev->name); +- j = de4x5_debug; +- de4x5_debug |= DEBUG_MII; +- de4x5_dbg_mii(dev, k); +- de4x5_debug = j; +- printk("\n"); ++ if (k < DE4X5_MAX_PHY) { ++ lp->phy[k].addr = i; ++ lp->phy[k].id = id; ++ lp->phy[k].spd.reg = GENERIC_REG; /* ANLPA register */ ++ lp->phy[k].spd.mask = GENERIC_MASK; /* 100Mb/s technologies */ ++ lp->phy[k].spd.value = GENERIC_VALUE; /* TX & T4, H/F Duplex */ ++ lp->mii_cnt++; ++ lp->active++; ++ printk("%s: Using generic MII device control. If the board doesn't operate,\nplease mail the following dump to the author:\n", dev->name); ++ j = de4x5_debug; ++ de4x5_debug |= DEBUG_MII; ++ de4x5_dbg_mii(dev, k); ++ de4x5_debug = j; ++ printk("\n"); ++ } else { ++ goto purgatory; ++ } + } + } + purgatory: +diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c +index 1f62b9423851..31dfb695eded 100644 +--- a/drivers/net/ethernet/dec/tulip/winbond-840.c ++++ b/drivers/net/ethernet/dec/tulip/winbond-840.c +@@ -368,7 +368,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + int i, option = find_cnt < MAX_UNITS ? options[find_cnt] : 0; + void __iomem *ioaddr; + +- i = pci_enable_device(pdev); ++ i = pcim_enable_device(pdev); + if (i) return i; + + pci_set_master(pdev); +@@ -390,7 +390,7 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + + ioaddr = pci_iomap(pdev, TULIP_BAR, netdev_res_size); + if (!ioaddr) +- goto err_out_free_res; ++ goto err_out_netdev; + + for (i = 0; i < 3; i++) + ((__le16 *)dev->dev_addr)[i] = cpu_to_le16(eeprom_read(ioaddr, i)); +@@ -469,8 +469,6 @@ static int w840_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + + err_out_cleardev: + pci_iounmap(pdev, ioaddr); +-err_out_free_res: +- pci_release_regions(pdev); + err_out_netdev: + free_netdev (dev); + return -ENODEV; +@@ -1537,7 +1535,6 @@ static void w840_remove1(struct pci_dev *pdev) + if (dev) { + struct netdev_private *np = netdev_priv(dev); + unregister_netdev(dev); +- pci_release_regions(pdev); + pci_iounmap(pdev, np->base_addr); + free_netdev(dev); + } diff --git a/drivers/net/ethernet/ec_bhf.c b/drivers/net/ethernet/ec_bhf.c index f7b42483921c..0ade0c6d81ee 100644 --- a/drivers/net/ethernet/ec_bhf.c @@ -49672,10 +66352,33 @@ index 0437149f5939..65859ecf5c32 100644 unregister_netdev(netdev); ftgmac100_destroy_mdio(netdev); +diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h +index 5ea740b4cf14..b4e23ab10852 100644 +--- a/drivers/net/ethernet/freescale/fec.h ++++ b/drivers/net/ethernet/freescale/fec.h +@@ -371,6 +371,9 @@ struct bufdesc_ex { + #define FEC_ENET_WAKEUP ((uint)0x00020000) /* Wakeup request */ + #define FEC_ENET_TXF (FEC_ENET_TXF_0 | FEC_ENET_TXF_1 | FEC_ENET_TXF_2) + #define FEC_ENET_RXF (FEC_ENET_RXF_0 | FEC_ENET_RXF_1 | FEC_ENET_RXF_2) ++#define FEC_ENET_RXF_GET(X) (((X) == 0) ? FEC_ENET_RXF_0 : \ ++ (((X) == 1) ? FEC_ENET_RXF_1 : \ ++ FEC_ENET_RXF_2)) + #define FEC_ENET_TS_AVAIL ((uint)0x00010000) + #define FEC_ENET_TS_TIMER ((uint)0x00008000) + diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 8df32398d343..9b3ea0406e0d 100644 +index 8df32398d343..c06ac5f66a17 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -1380,7 +1380,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id) + break; + pkt_received++; + +- writel(FEC_ENET_RXF, fep->hwp + FEC_IEVENT); ++ writel(FEC_ENET_RXF_GET(queue_id), fep->hwp + FEC_IEVENT); + + /* Check for errors. */ + status ^= BD_ENET_RX_LAST; @@ -3505,11 +3505,11 @@ fec_probe(struct platform_device *pdev) failed_irq: failed_init: @@ -49690,6 +66393,21 @@ index 8df32398d343..9b3ea0406e0d 100644 failed_regulator: failed_clk_ipg: fec_enet_clk_enable(ndev, false); +@@ -3546,13 +3546,13 @@ fec_drv_remove(struct platform_device *pdev) + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(fep->phy_node); +- free_netdev(ndev); + + clk_disable_unprepare(fep->clk_ahb); + clk_disable_unprepare(fep->clk_ipg); + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); + ++ free_netdev(ndev); + return 0; + } + diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c index f9e74461bdc0..031d4b3a544c 100644 --- a/drivers/net/ethernet/freescale/fec_ptp.c @@ -49966,6 +66684,21 @@ index 399cfd217288..cfda55bfa811 100644 pcmcia_map_mem_page(link, link->resource[2], 0); /* +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c +index 67accce1d33d..e89a62c6f230 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c +@@ -312,6 +312,10 @@ static void hns_dsaf_ge_srst_by_port(struct dsaf_device *dsaf_dev, u32 port, + return; + + if (!HNS_DSAF_IS_DEBUG(dsaf_dev)) { ++ /* DSAF_MAX_PORT_NUM is 6, but DSAF_GE_NUM is 8. ++ We need check to prevent array overflow */ ++ if (port >= DSAF_MAX_PORT_NUM) ++ return; + reg_val_1 = 0x1 << port; + port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off; + /* there is difference between V1 and V2 in register.*/ diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c index 24a815997ec5..796f81106b43 100644 --- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c @@ -50008,6 +66741,19 @@ index f38848c4f69d..62143ccfd5fb 100644 skb = new_skb; check_ok = 0; +diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c +index ce235b776793..299628931bdb 100644 +--- a/drivers/net/ethernet/i825xx/82596.c ++++ b/drivers/net/ethernet/i825xx/82596.c +@@ -1155,7 +1155,7 @@ struct net_device * __init i82596_probe(int unit) + err = -ENODEV; + goto out; + } +- memcpy(eth_addr, (void *) 0xfffc1f2c, ETH_ALEN); /* YUCK! Get addr from NOVRAM */ ++ memcpy(eth_addr, absolute_pointer(0xfffc1f2c), ETH_ALEN); /* YUCK! Get addr from NOVRAM */ + dev->base_addr = MVME_I596_BASE; + dev->irq = (unsigned) MVME16x_IRQ_I596; + goto found; diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c index 3692adb8902d..6c70cba92df0 100644 --- a/drivers/net/ethernet/ibm/ehea/ehea_main.c @@ -50180,7 +66926,7 @@ index 897a87ae8655..f23559a2b2bd 100644 crq->cur = 0; diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c -index 93c29094ceff..9035cb5fc70d 100644 +index 93c29094ceff..aa556e4f9051 100644 --- a/drivers/net/ethernet/intel/e100.c +++ b/drivers/net/ethernet/intel/e100.c @@ -1423,7 +1423,7 @@ static int e100_phy_check_without_mii(struct nic *nic) @@ -50214,7 +66960,49 @@ index 93c29094ceff..9035cb5fc70d 100644 } static int e100_up(struct nic *nic) -@@ -2952,7 +2952,7 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent) +@@ -2462,11 +2462,15 @@ static void e100_get_drvinfo(struct net_device *netdev, + sizeof(info->bus_info)); + } + +-#define E100_PHY_REGS 0x1C ++#define E100_PHY_REGS 0x1D + static int e100_get_regs_len(struct net_device *netdev) + { + struct nic *nic = netdev_priv(netdev); +- return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf); ++ ++ /* We know the number of registers, and the size of the dump buffer. ++ * Calculate the total size in bytes. ++ */ ++ return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf); + } + + static void e100_get_regs(struct net_device *netdev, +@@ -2480,14 +2484,18 @@ static void e100_get_regs(struct net_device *netdev, + buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 | + ioread8(&nic->csr->scb.cmd_lo) << 16 | + ioread16(&nic->csr->scb.status); +- for (i = E100_PHY_REGS; i >= 0; i--) +- buff[1 + E100_PHY_REGS - i] = +- mdio_read(netdev, nic->mii.phy_id, i); ++ for (i = 0; i < E100_PHY_REGS; i++) ++ /* Note that we read the registers in reverse order. This ++ * ordering is the ABI apparently used by ethtool and other ++ * applications. ++ */ ++ buff[1 + i] = mdio_read(netdev, nic->mii.phy_id, ++ E100_PHY_REGS - 1 - i); + memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf)); + e100_exec_cb(nic, NULL, e100_dump); + msleep(10); +- memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf, +- sizeof(nic->mem->dump_buf)); ++ memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf, ++ sizeof(nic->mem->dump_buf)); + } + + static void e100_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol) +@@ -2952,7 +2960,7 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent) /* Wol magic packet can be enabled from eeprom */ if ((nic->mac >= mac_82558_D101_A4) && @@ -50305,6 +67093,54 @@ index 879cca47b021..62675938cb59 100644 void __ew32(struct e1000_hw *hw, unsigned long reg, u32 val); #define ew32(reg, val) __ew32(hw, E1000_##reg, (val)) +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index 625008e8cb0d..500016209ae0 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1010,6 +1010,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + { + u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | + link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; ++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ ++ u16 lat_enc_d = 0; /* latency decoded */ + u16 lat_enc = 0; /* latency encoded */ + + if (link) { +@@ -1063,7 +1065,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop); + max_ltr_enc = max_t(u16, max_snoop, max_nosnoop); + +- if (lat_enc > max_ltr_enc) ++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((lat_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ if (lat_enc_d > max_ltr_enc_d) + lat_enc = max_ltr_enc; + } + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h +index 6374c8fc76a8..9957a4ffdc6d 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h +@@ -291,8 +291,11 @@ + + /* Latency Tolerance Reporting */ + #define E1000_LTRV 0x000F8 ++#define E1000_LTRV_VALUE_MASK 0x000003FF + #define E1000_LTRV_SCALE_MAX 5 + #define E1000_LTRV_SCALE_FACTOR 5 ++#define E1000_LTRV_SCALE_SHIFT 10 ++#define E1000_LTRV_SCALE_MASK 0x00001C00 + #define E1000_LTRV_REQ_SHIFT 15 + #define E1000_LTRV_NOSNOOP_SHIFT 16 + #define E1000_LTRV_SEND (1 << 30) diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c index a0f97c5ab6ef..5d7967c03554 100644 --- a/drivers/net/ethernet/intel/e1000e/netdev.c @@ -50507,7 +67343,7 @@ index 2154a34c1dd8..09b47088dcc2 100644 cmd->vlan_tag = cpu_to_le16(vid | I40E_AQC_SET_VSI_VLAN_VALID); diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 043b69b5843b..832fffed4a1f 100644 +index 043b69b5843b..e7585f6c4665 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -5478,6 +5478,8 @@ int i40e_vsi_open(struct i40e_vsi *vsi) @@ -50519,6 +67355,15 @@ index 043b69b5843b..832fffed4a1f 100644 } else { err = -EINVAL; +@@ -6644,7 +6646,7 @@ static int i40e_get_capabilities(struct i40e_pf *pf) + if (pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOMEM) { + /* retry with a larger buffer */ + buf_len = data_size; +- } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK) { ++ } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK || err) { + dev_info(&pf->pdev->dev, + "capability discovery failed, err %s aq_err %s\n", + i40e_stat_str(&pf->hw, err), @@ -8504,6 +8506,7 @@ static int i40e_sw_init(struct i40e_pf *pf) { int err = 0; @@ -50710,9 +67555,18 @@ index 7484ad3c955d..e3e02ec8f149 100644 /** diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c -index 14372810fc27..537776a3e5de 100644 +index 14372810fc27..9ba36425a3dd 100644 --- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c +++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +@@ -1889,7 +1889,7 @@ static void i40evf_adminq_task(struct work_struct *work) + + /* check for error indications */ + val = rd32(hw, hw->aq.arq.len); +- if (val == 0xdeadbeef) /* indicates device in reset */ ++ if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */ + goto freedom; + oldval = val; + if (val & I40E_VF_ARQLEN1_ARQVFE_MASK) { @@ -2641,6 +2641,7 @@ static int i40evf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err_ioremap: free_netdev(netdev); @@ -50798,6 +67652,18 @@ index 90eab0521be1..6bede6774486 100644 ack |= TSINTR_SYS_WRAP; } +diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c +index 5428e39fa4e5..7587a8f98619 100644 +--- a/drivers/net/ethernet/intel/igbvf/netdev.c ++++ b/drivers/net/ethernet/intel/igbvf/netdev.c +@@ -2846,6 +2846,7 @@ static int igbvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + return 0; + + err_hw_init: ++ netif_napi_del(&adapter->rx_ring->napi); + kfree(adapter->tx_ring); + kfree(adapter->rx_ring); + err_sw_init: diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h index b06e32d0d22a..293ff8cc6994 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h @@ -50897,6 +67763,20 @@ index a92277683a64..a93a1b3bb8e4 100644 /** * ixgbe_ptp_tx_hwtstamp - utility function which checks for TX time stamp * @adapter: the private adapter struct +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c +index 8466f3874a28..5029db8835d7 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c +@@ -2597,6 +2597,9 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw) + /* flush pending Tx transactions */ + ixgbe_clear_tx_pending(hw); + ++ /* set MDIO speed before talking to the PHY in case it's the 1st time */ ++ ixgbe_set_mdio_speed(hw); ++ + /* PHY ops must be identified and initialized prior to reset */ + + /* Identify PHY and related function pointers */ diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c index c051987aab83..4cf1fc89df3c 100644 --- a/drivers/net/ethernet/korina.c @@ -50927,6 +67807,19 @@ index c051987aab83..4cf1fc89df3c 100644 unregister_netdev(bif->dev); free_netdev(bif->dev); +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index bb6bc84995a2..ccacdcfb5932 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -100,7 +100,7 @@ + #define MVNETA_DESC_SWAP BIT(6) + #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22) + #define MVNETA_PORT_STATUS 0x2444 +-#define MVNETA_TX_IN_PRGRS BIT(1) ++#define MVNETA_TX_IN_PRGRS BIT(0) + #define MVNETA_TX_FIFO_EMPTY BIT(8) + #define MVNETA_RX_MIN_FRAME_SIZE 0x247c + #define MVNETA_SERDES_CFG 0x24A0 diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c index 5d5000c8edf1..09cb0ac701e1 100644 --- a/drivers/net/ethernet/marvell/pxa168_eth.c @@ -50980,7 +67873,7 @@ index 99b1c8e9f16f..2e7ccd8261c3 100644 /* QDMA descriptor rxd3 */ #define RX_DMA_VID(_x) ((_x) & 0xfff) diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c -index 6068e7c4fc7e..410a36c98241 100644 +index 6068e7c4fc7e..1569300844f0 100644 --- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c @@ -47,7 +47,7 @@ @@ -50992,6 +67885,27 @@ index 6068e7c4fc7e..410a36c98241 100644 { int i; int err = 0; +@@ -620,7 +620,7 @@ void __init mlx4_en_init_ptys2ethtool_map(void) + MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_1000BASE_T, SPEED_1000, + ETHTOOL_LINK_MODE_1000baseT_Full_BIT); + MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_1000BASE_CX_SGMII, SPEED_1000, +- ETHTOOL_LINK_MODE_1000baseKX_Full_BIT); ++ ETHTOOL_LINK_MODE_1000baseX_Full_BIT); + MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_1000BASE_KX, SPEED_1000, + ETHTOOL_LINK_MODE_1000baseKX_Full_BIT); + MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_T, SPEED_10000, +@@ -632,9 +632,9 @@ void __init mlx4_en_init_ptys2ethtool_map(void) + MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_KR, SPEED_10000, + ETHTOOL_LINK_MODE_10000baseKR_Full_BIT); + MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_CR, SPEED_10000, +- ETHTOOL_LINK_MODE_10000baseKR_Full_BIT); ++ ETHTOOL_LINK_MODE_10000baseCR_Full_BIT); + MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_SR, SPEED_10000, +- ETHTOOL_LINK_MODE_10000baseKR_Full_BIT); ++ ETHTOOL_LINK_MODE_10000baseSR_Full_BIT); + MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_20GBASE_KR2, SPEED_20000, + ETHTOOL_LINK_MODE_20000baseMLD2_Full_BIT, + ETHTOOL_LINK_MODE_20000baseKR2_Full_BIT); @@ -1931,8 +1931,6 @@ static int mlx4_en_set_tunable(struct net_device *dev, return ret; } @@ -51011,10 +67925,20 @@ index 6068e7c4fc7e..410a36c98241 100644 default: return -ENOSYS; diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -index 0160c93de6d3..543f30dec4a0 100644 +index 0160c93de6d3..dbb65145b35e 100644 --- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c -@@ -1311,8 +1311,10 @@ static void mlx4_en_tx_timeout(struct net_device *dev) +@@ -309,6 +309,9 @@ mlx4_en_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb, + int nhoff = skb_network_offset(skb); + int ret = 0; + ++ if (skb->encapsulation) ++ return -EPROTONOSUPPORT; ++ + if (skb->protocol != htons(ETH_P_IP)) + return -EPROTONOSUPPORT; + +@@ -1311,8 +1314,10 @@ static void mlx4_en_tx_timeout(struct net_device *dev) } priv->port_stats.tx_timeout++; @@ -51027,7 +67951,7 @@ index 0160c93de6d3..543f30dec4a0 100644 } -@@ -1746,6 +1748,7 @@ int mlx4_en_start_port(struct net_device *dev) +@@ -1746,6 +1751,7 @@ int mlx4_en_start_port(struct net_device *dev) local_bh_enable(); } @@ -51035,7 +67959,7 @@ index 0160c93de6d3..543f30dec4a0 100644 netif_tx_start_all_queues(dev); netif_device_attach(dev); -@@ -1900,7 +1903,7 @@ void mlx4_en_stop_port(struct net_device *dev, int detach) +@@ -1900,7 +1906,7 @@ void mlx4_en_stop_port(struct net_device *dev, int detach) static void mlx4_en_restart(struct work_struct *work) { struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv, @@ -51044,7 +67968,7 @@ index 0160c93de6d3..543f30dec4a0 100644 struct mlx4_en_dev *mdev = priv->mdev; struct net_device *dev = priv->dev; -@@ -2220,7 +2223,7 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu) +@@ -2220,7 +2226,7 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu) if (netif_running(dev)) { mutex_lock(&mdev->state_lock); if (!mdev->device_up) { @@ -51053,7 +67977,7 @@ index 0160c93de6d3..543f30dec4a0 100644 * the port */ en_dbg(DRV, priv, "Change MTU called with card down!?\n"); } else { -@@ -2229,7 +2232,9 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu) +@@ -2229,7 +2235,9 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu) if (err) { en_err(priv, "Failed restarting port:%d\n", priv->port); @@ -51064,7 +67988,7 @@ index 0160c93de6d3..543f30dec4a0 100644 } } mutex_unlock(&mdev->state_lock); -@@ -2701,7 +2706,8 @@ static int mlx4_xdp_set(struct net_device *dev, struct bpf_prog *prog) +@@ -2701,7 +2709,8 @@ static int mlx4_xdp_set(struct net_device *dev, struct bpf_prog *prog) if (err) { en_err(priv, "Failed starting port %d for XDP change\n", priv->port); @@ -51074,7 +67998,7 @@ index 0160c93de6d3..543f30dec4a0 100644 } } -@@ -3080,7 +3086,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, +@@ -3080,7 +3089,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, priv->counter_index = MLX4_SINK_COUNTER_INDEX(mdev->dev); spin_lock_init(&priv->stats_lock); INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode); @@ -51083,7 +68007,7 @@ index 0160c93de6d3..543f30dec4a0 100644 INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate); INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats); INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task); -@@ -3453,6 +3459,8 @@ int mlx4_en_reset_config(struct net_device *dev, +@@ -3453,6 +3462,8 @@ int mlx4_en_reset_config(struct net_device *dev, en_err(priv, "Failed starting port\n"); } @@ -51130,10 +68054,18 @@ index 5343a0599253..b30a5a9b9777 100644 u8 log_num_qps; u8 log_num_srqs; diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c -index 751aac54f2d5..9b6a96074df8 100644 +index 751aac54f2d5..78b04f271344 100644 --- a/drivers/net/ethernet/mellanox/mlx4/main.c +++ b/drivers/net/ethernet/mellanox/mlx4/main.c -@@ -4176,12 +4176,14 @@ static void mlx4_pci_resume(struct pci_dev *pdev) +@@ -3445,6 +3445,7 @@ static int mlx4_load_one(struct pci_dev *pdev, int pci_dev_data, + + if (!SRIOV_VALID_STATE(dev->flags)) { + mlx4_err(dev, "Invalid SRIOV state\n"); ++ err = -EINVAL; + goto err_close; + } + } +@@ -4176,12 +4177,14 @@ static void mlx4_pci_resume(struct pci_dev *pdev) static void mlx4_shutdown(struct pci_dev *pdev) { struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev); @@ -51384,6 +68316,42 @@ index b210c171a380..f3d3ad25f05e 100644 return -EOPNOTSUPP; switch (attr->id) { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 13dfc197bdd8..6c092dc41c82 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -701,17 +701,19 @@ static int connect_fwd_rules(struct mlx5_core_dev *dev, + static int connect_flow_table(struct mlx5_core_dev *dev, struct mlx5_flow_table *ft, + struct fs_prio *prio) + { +- struct mlx5_flow_table *next_ft; ++ struct mlx5_flow_table *next_ft, *first_ft; + int err = 0; + + /* Connect_prev_fts and update_root_ft_create are mutually exclusive */ + +- if (list_empty(&prio->node.children)) { ++ first_ft = list_first_entry_or_null(&prio->node.children, ++ struct mlx5_flow_table, node.list); ++ if (!first_ft || first_ft->level > ft->level) { + err = connect_prev_fts(dev, ft, prio); + if (err) + return err; + +- next_ft = find_next_chained_ft(prio); ++ next_ft = first_ft ? first_ft : find_next_chained_ft(prio); + err = connect_fwd_rules(dev, ft, next_ft); + if (err) + return err; +@@ -1357,7 +1359,7 @@ static int disconnect_flow_table(struct mlx5_flow_table *ft) + node.list) == ft)) + return 0; + +- next_ft = find_next_chained_ft(prio); ++ next_ft = find_next_ft(ft); + err = connect_fwd_rules(dev, next_ft, ft); + if (err) + return err; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c index a57d5a81eb05..858c99864047 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c @@ -51491,6 +68459,66 @@ index cb0102dd7f70..d691c33dffc6 100644 if (!request_mem_region(iomem->start, resource_size(iomem), DRV_NAME)) goto err_mem_region; +diff --git a/drivers/net/ethernet/microchip/encx24j600-regmap.c b/drivers/net/ethernet/microchip/encx24j600-regmap.c +index f3bb9055a292..b5de665ce718 100644 +--- a/drivers/net/ethernet/microchip/encx24j600-regmap.c ++++ b/drivers/net/ethernet/microchip/encx24j600-regmap.c +@@ -500,13 +500,19 @@ static struct regmap_bus phymap_encx24j600 = { + .reg_read = regmap_encx24j600_phy_reg_read, + }; + +-void devm_regmap_init_encx24j600(struct device *dev, +- struct encx24j600_context *ctx) ++int devm_regmap_init_encx24j600(struct device *dev, ++ struct encx24j600_context *ctx) + { + mutex_init(&ctx->mutex); + regcfg.lock_arg = ctx; + ctx->regmap = devm_regmap_init(dev, ®map_encx24j600, ctx, ®cfg); ++ if (IS_ERR(ctx->regmap)) ++ return PTR_ERR(ctx->regmap); + ctx->phymap = devm_regmap_init(dev, &phymap_encx24j600, ctx, &phycfg); ++ if (IS_ERR(ctx->phymap)) ++ return PTR_ERR(ctx->phymap); ++ ++ return 0; + } + EXPORT_SYMBOL_GPL(devm_regmap_init_encx24j600); + +diff --git a/drivers/net/ethernet/microchip/encx24j600.c b/drivers/net/ethernet/microchip/encx24j600.c +index ad661d1979c7..906751f78ef6 100644 +--- a/drivers/net/ethernet/microchip/encx24j600.c ++++ b/drivers/net/ethernet/microchip/encx24j600.c +@@ -1015,10 +1015,13 @@ static int encx24j600_spi_probe(struct spi_device *spi) + priv->speed = SPEED_100; + + priv->ctx.spi = spi; +- devm_regmap_init_encx24j600(&spi->dev, &priv->ctx); + ndev->irq = spi->irq; + ndev->netdev_ops = &encx24j600_netdev_ops; + ++ ret = devm_regmap_init_encx24j600(&spi->dev, &priv->ctx); ++ if (ret) ++ goto out_free; ++ + mutex_init(&priv->lock); + + /* Reset device and check if it is connected */ +diff --git a/drivers/net/ethernet/microchip/encx24j600_hw.h b/drivers/net/ethernet/microchip/encx24j600_hw.h +index 4be73d5553f8..c9b17ccf749c 100644 +--- a/drivers/net/ethernet/microchip/encx24j600_hw.h ++++ b/drivers/net/ethernet/microchip/encx24j600_hw.h +@@ -14,8 +14,8 @@ struct encx24j600_context { + int bank; + }; + +-void devm_regmap_init_encx24j600(struct device *dev, +- struct encx24j600_context *ctx); ++int devm_regmap_init_encx24j600(struct device *dev, ++ struct encx24j600_context *ctx); + + /* Single-byte instructions */ + #define BANK_SELECT(bank) (0xC0 | ((bank & (BANK_MASK >> BANK_SHIFT)) << 1)) diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c index 6fe61d9343cb..7f782aec3c48 100644 --- a/drivers/net/ethernet/moxa/moxart_ether.c @@ -51519,8 +68547,95 @@ index 02ec326cb129..5eeba263b5f8 100644 goto abort_with_ioremap; } memcpy_fromio(mgp->eeprom_strings, +diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c +index ed89029ff75b..c0e128e17321 100644 +--- a/drivers/net/ethernet/natsemi/natsemi.c ++++ b/drivers/net/ethernet/natsemi/natsemi.c +@@ -817,7 +817,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + printk(version); + #endif + +- i = pci_enable_device(pdev); ++ i = pcim_enable_device(pdev); + if (i) return i; + + /* natsemi has a non-standard PM control register +@@ -850,7 +850,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + ioaddr = ioremap(iostart, iosize); + if (!ioaddr) { + i = -ENOMEM; +- goto err_ioremap; ++ goto err_pci_request_regions; + } + + /* Work around the dropped serial bit. */ +@@ -968,9 +968,6 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + err_register_netdev: + iounmap(ioaddr); + +- err_ioremap: +- pci_release_regions(pdev); +- + err_pci_request_regions: + free_netdev(dev); + return i; +@@ -3228,7 +3225,6 @@ static void natsemi_remove1(struct pci_dev *pdev) + + NATSEMI_REMOVE_FILE(pdev, dspcfg_workaround); + unregister_netdev (dev); +- pci_release_regions (pdev); + iounmap(ioaddr); + free_netdev (dev); + } +diff --git a/drivers/net/ethernet/natsemi/xtsonic.c b/drivers/net/ethernet/natsemi/xtsonic.c +index 7007d212f3e4..9b041848b389 100644 +--- a/drivers/net/ethernet/natsemi/xtsonic.c ++++ b/drivers/net/ethernet/natsemi/xtsonic.c +@@ -128,7 +128,7 @@ static const struct net_device_ops xtsonic_netdev_ops = { + .ndo_set_mac_address = eth_mac_addr, + }; + +-static int __init sonic_probe1(struct net_device *dev) ++static int sonic_probe1(struct net_device *dev) + { + static unsigned version_printed = 0; + unsigned int silicon_revision; +diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c +index eaa37c079a7c..a1447d7ff48b 100644 +--- a/drivers/net/ethernet/neterion/s2io.c ++++ b/drivers/net/ethernet/neterion/s2io.c +@@ -8618,7 +8618,7 @@ static void s2io_io_resume(struct pci_dev *pdev) + return; + } + +- if (s2io_set_mac_addr(netdev, netdev->dev_addr) == FAILURE) { ++ if (do_s2io_prog_unicast(netdev, netdev->dev_addr) == FAILURE) { + s2io_card_down(sp); + pr_err("Can't restore mac addr after reset.\n"); + return; +diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c +index e0993eba5df3..c6950e580883 100644 +--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c ++++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c +@@ -3539,13 +3539,13 @@ static void vxge_device_unregister(struct __vxge_hw_device *hldev) + + kfree(vdev->vpaths); + +- /* we are safe to free it now */ +- free_netdev(dev); +- + vxge_debug_init(vdev->level_trace, "%s: ethernet device unregistered", + buf); + vxge_debug_entryexit(vdev->level_trace, "%s: %s:%d Exiting...", buf, + __func__, __LINE__); ++ ++ /* we are safe to free it now */ ++ free_netdev(dev); + } + + /* diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c -index 9fcaf1910633..9b98ec3dcb82 100644 +index 9fcaf1910633..ad7b9772a4b2 100644 --- a/drivers/net/ethernet/nxp/lpc_eth.c +++ b/drivers/net/ethernet/nxp/lpc_eth.c @@ -845,7 +845,8 @@ static int lpc_mii_init(struct netdata_local *pldat) @@ -51532,6 +68647,25 @@ index 9fcaf1910633..9b98ec3dcb82 100644 + if (err) goto err_out_unregister_bus; + return 0; +@@ -1038,9 +1039,6 @@ static int lpc_eth_close(struct net_device *ndev) + napi_disable(&pldat->napi); + netif_stop_queue(ndev); + +- if (ndev->phydev) +- phy_stop(ndev->phydev); +- + spin_lock_irqsave(&pldat->lock, flags); + __lpc_eth_reset(pldat); + netif_carrier_off(ndev); +@@ -1048,6 +1046,8 @@ static int lpc_eth_close(struct net_device *ndev) + writel(0, LPC_ENET_MAC2(pldat->net_base)); + spin_unlock_irqrestore(&pldat->lock, flags); + ++ if (ndev->phydev) ++ phy_stop(ndev->phydev); + clk_disable_unprepare(pldat->clk); + return 0; diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c index 3cd87a41ac92..cd59577a0c92 100644 @@ -51715,6 +68849,24 @@ index fd19372db2f8..6e1d38041d0a 100644 } else { DP_VERBOSE(p_hwfn, NETIF_MSG_INTR, "MFW indication [deassertion]\n"); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index 708117fc6f73..7669d36151c6 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -374,7 +374,12 @@ static int qed_enable_msix(struct qed_dev *cdev, + rc = cnt; + } + +- if (rc > 0) { ++ /* For VFs, we should return with an error in case we didn't get the ++ * exact number of msix vectors as we requested. ++ * Not doing that will lead to a crash when starting queues for ++ * this VF. ++ */ ++ if ((IS_PF(cdev) && rc > 0) || (IS_VF(cdev) && rc == cnt)) { + /* MSI-x configuration was achieved */ + int_params->out.int_mode = QED_INT_MODE_MSIX; + int_params->out.num_vectors = rc; diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c index cf34908ec8e1..170243d3276b 100644 --- a/drivers/net/ethernet/qlogic/qed/qed_vf.c @@ -51762,8 +68914,28 @@ index cf34908ec8e1..170243d3276b 100644 } if (!*done) { +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index 9b1920b58594..d21a73bc4cde 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -3145,6 +3145,7 @@ static void qede_sync_free_irqs(struct qede_dev *edev) + } + + edev->int_info.used_cnt = 0; ++ edev->int_info.msix_cnt = 0; + } + + static int qede_req_msix_irqs(struct qede_dev *edev) +@@ -3644,7 +3645,6 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode) + + err4: + qede_sync_free_irqs(edev); +- memset(&edev->int_info.msix_cnt, 0, sizeof(struct qed_int_info)); + err3: + qede_napi_disable_remove(edev); + err2: diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c -index f2cb77c3b199..192950a112c9 100644 +index f2cb77c3b199..147effc16316 100644 --- a/drivers/net/ethernet/qlogic/qla3xxx.c +++ b/drivers/net/ethernet/qlogic/qla3xxx.c @@ -115,7 +115,7 @@ static int ql_sem_spinlock(struct ql3_adapter *qdev, @@ -51775,6 +68947,96 @@ index f2cb77c3b199..192950a112c9 100644 } while (--seconds); return -1; } +@@ -155,7 +155,7 @@ static int ql_wait_for_drvr_lock(struct ql3_adapter *qdev) + "driver lock acquired\n"); + return 1; + } +- ssleep(1); ++ mdelay(1000); + } while (++i < 10); + + netdev_err(qdev->ndev, "Timed out waiting for driver lock...\n"); +@@ -3287,7 +3287,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev) + if ((value & ISP_CONTROL_SR) == 0) + break; + +- ssleep(1); ++ mdelay(1000); + } while ((--max_wait_time)); + + /* +@@ -3323,7 +3323,7 @@ static int ql_adapter_reset(struct ql3_adapter *qdev) + ispControlStatus); + if ((value & ISP_CONTROL_FSR) == 0) + break; +- ssleep(1); ++ mdelay(1000); + } while ((--max_wait_time)); + } + if (max_wait_time == 0) +@@ -3491,20 +3491,19 @@ static int ql_adapter_up(struct ql3_adapter *qdev) + + spin_lock_irqsave(&qdev->hw_lock, hw_flags); + +- err = ql_wait_for_drvr_lock(qdev); +- if (err) { +- err = ql_adapter_initialize(qdev); +- if (err) { +- netdev_err(ndev, "Unable to initialize adapter\n"); +- goto err_init; +- } +- netdev_err(ndev, "Releasing driver lock\n"); +- ql_sem_unlock(qdev, QL_DRVR_SEM_MASK); +- } else { ++ if (!ql_wait_for_drvr_lock(qdev)) { + netdev_err(ndev, "Could not acquire driver lock\n"); ++ err = -ENODEV; + goto err_lock; + } + ++ err = ql_adapter_initialize(qdev); ++ if (err) { ++ netdev_err(ndev, "Unable to initialize adapter\n"); ++ goto err_init; ++ } ++ ql_sem_unlock(qdev, QL_DRVR_SEM_MASK); ++ + spin_unlock_irqrestore(&qdev->hw_lock, hw_flags); + + set_bit(QL_ADAPTER_UP, &qdev->flags); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +index 5d2de48b77a0..59b77bb89147 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -1078,8 +1078,14 @@ static int qlcnic_83xx_add_rings(struct qlcnic_adapter *adapter) + sds_mbx_size = sizeof(struct qlcnic_sds_mbx); + context_id = recv_ctx->context_id; + num_sds = adapter->drv_sds_rings - QLCNIC_MAX_SDS_RINGS; +- ahw->hw_ops->alloc_mbx_args(&cmd, adapter, +- QLCNIC_CMD_ADD_RCV_RINGS); ++ err = ahw->hw_ops->alloc_mbx_args(&cmd, adapter, ++ QLCNIC_CMD_ADD_RCV_RINGS); ++ if (err) { ++ dev_err(&adapter->pdev->dev, ++ "Failed to alloc mbx args %d\n", err); ++ return err; ++ } ++ + cmd.req.arg[1] = 0 | (num_sds << 8) | (context_id << 16); + + /* set up status rings, mbx 2-81 */ +@@ -3157,8 +3163,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr, + + indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr); + ret = QLCRD32(adapter, indirect_addr, &err); +- if (err == -EIO) ++ if (err == -EIO) { ++ qlcnic_83xx_unlock_flash(adapter); + return err; ++ } + + word = ret; + *(u32 *)p_data = word; diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c index cda5b0a9e948..10286215092f 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c @@ -51810,6 +69072,18 @@ index 63ebc491057b..99fc0121da93 100644 dev_err(&adapter->pdev->dev, "LB Test: failed, TX[%d], RX[%d]\n", i, cnt); if (mode != QLCNIC_ILB_MODE) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c +index be41e4c77b65..eff587c6e9be 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c +@@ -440,7 +440,6 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter) + QLCWR32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c, 1); + msleep(20); + +- qlcnic_rom_unlock(adapter); + /* big hammer don't reset CAM block on reset */ + QLCWR32(adapter, QLCNIC_ROMUSB_GLB_SW_RESET, 0xfeffffff); + diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c index ebf5ead16939..19dca845042e 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c @@ -51851,6 +69125,79 @@ index 5174e0bd75d1..625336264a44 100644 hdr->drv_cap_mask = 0x1f; fw_dump->cap_mask = 0x1f; dev_info(&pdev->dev, +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h +index 5f327659efa7..85b688f60b87 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h +@@ -202,7 +202,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *, + struct qlcnic_info *, u16); + int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8); + void qlcnic_sriov_free_vlans(struct qlcnic_adapter *); +-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); ++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); + bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *); + void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *, + struct qlcnic_vf_info *, u16); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +index c58180f40844..44caa7c2077e 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -433,7 +433,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, + struct qlcnic_cmd_args *cmd) + { + struct qlcnic_sriov *sriov = adapter->ahw->sriov; +- int i, num_vlans; ++ int i, num_vlans, ret; + u16 *vlans; + + if (sriov->allowed_vlans) +@@ -444,7 +444,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, + dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n", + sriov->num_allowed_vlans); + +- qlcnic_sriov_alloc_vlans(adapter); ++ ret = qlcnic_sriov_alloc_vlans(adapter); ++ if (ret) ++ return ret; + + if (!sriov->any_vlan) + return 0; +@@ -2164,7 +2166,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter) + return err; + } + +-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) ++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) + { + struct qlcnic_sriov *sriov = adapter->ahw->sriov; + struct qlcnic_vf_info *vf; +@@ -2174,7 +2176,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) + vf = &sriov->vf_info[i]; + vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans, + sizeof(*vf->sriov_vlans), GFP_KERNEL); ++ if (!vf->sriov_vlans) ++ return -ENOMEM; + } ++ ++ return 0; + } + + void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c +index 50eaafa3eaba..c9f2cd246223 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c +@@ -598,7 +598,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, + if (err) + goto del_flr_queue; + +- qlcnic_sriov_alloc_vlans(adapter); ++ err = qlcnic_sriov_alloc_vlans(adapter); ++ if (err) ++ goto del_flr_queue; + + return err; + diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c index 9d223ff65071..882f2b7ec6d1 100644 --- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c @@ -51922,6 +69269,41 @@ index 57b35aeac51a..971aea538acd 100644 return 0; } +diff --git a/drivers/net/ethernet/rdc/r6040.c b/drivers/net/ethernet/rdc/r6040.c +index 5ef5d728c250..065a63123863 100644 +--- a/drivers/net/ethernet/rdc/r6040.c ++++ b/drivers/net/ethernet/rdc/r6040.c +@@ -133,6 +133,8 @@ + #define PHY_ST 0x8A /* PHY status register */ + #define MAC_SM 0xAC /* MAC status machine */ + #define MAC_SM_RST 0x0002 /* MAC status machine reset */ ++#define MD_CSC 0xb6 /* MDC speed control register */ ++#define MD_CSC_DEFAULT 0x0030 + #define MAC_ID 0xBE /* Identifier register */ + + #define TX_DCNT 0x80 /* TX descriptor count */ +@@ -368,8 +370,9 @@ static void r6040_reset_mac(struct r6040_private *lp) + { + void __iomem *ioaddr = lp->base; + int limit = MAC_DEF_TIMEOUT; +- u16 cmd; ++ u16 cmd, md_csc; + ++ md_csc = ioread16(ioaddr + MD_CSC); + iowrite16(MAC_RST, ioaddr + MCR1); + while (limit--) { + cmd = ioread16(ioaddr + MCR1); +@@ -381,6 +384,10 @@ static void r6040_reset_mac(struct r6040_private *lp) + iowrite16(MAC_SM_RST, ioaddr + MAC_SM); + iowrite16(0, ioaddr + MAC_SM); + mdelay(5); ++ ++ /* Restore MDIO clock frequency */ ++ if (md_csc != MD_CSC_DEFAULT) ++ iowrite16(md_csc, ioaddr + MD_CSC); + } + + static void r6040_init_mac_regs(struct net_device *dev) diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c index 7a4393ffe98e..f321b115719a 100644 --- a/drivers/net/ethernet/realtek/r8169.c @@ -52136,7 +69518,7 @@ index 545cb6262cff..5452fe4bf12a 100644 return copy_to_user(req->ifr_data, &config, sizeof(config)) ? -EFAULT : 0; diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 6f8d4810ce97..468f02beccee 100644 +index 6f8d4810ce97..3bfae675b43a 100644 --- a/drivers/net/ethernet/renesas/sh_eth.c +++ b/drivers/net/ethernet/renesas/sh_eth.c @@ -526,6 +526,8 @@ static struct sh_eth_cpu_data r7s72100_data = { @@ -52157,7 +69539,15 @@ index 6f8d4810ce97..468f02beccee 100644 sizeof(sh_eth_gstrings_stats)); break; } -@@ -2411,10 +2413,10 @@ static int sh_eth_close(struct net_device *ndev) +@@ -2331,6 +2333,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev) + else + txdesc->status |= cpu_to_le32(TD_TACT); + ++ wmb(); /* cur_tx must be incremented after TACT bit was set */ + mdp->cur_tx++; + + if (!(sh_eth_read(ndev, EDTRR) & sh_eth_get_edtrr_trns(mdp))) +@@ -2411,10 +2414,10 @@ static int sh_eth_close(struct net_device *ndev) /* Free all the skbuffs in the Rx queue and the DMA buffer. */ sh_eth_ring_free(ndev); @@ -52250,6 +69640,96 @@ index a949b9d27329..bef23e19cbbd 100644 rc = efx_ef10_pci_sriov_disable(efx, true); if (rc) netif_dbg(efx, drv, efx->net_dev, +diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c +index 04cbff7f1b23..a48ff6fc66b4 100644 +--- a/drivers/net/ethernet/sfc/ptp.c ++++ b/drivers/net/ethernet/sfc/ptp.c +@@ -494,7 +494,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx) + } else if (rc == -EINVAL) { + fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS; + } else if (rc == -EPERM) { +- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); ++ pci_info(efx->pci_dev, "no PTP support\n"); + return rc; + } else { + efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf), +@@ -613,7 +613,7 @@ static int efx_ptp_disable(struct efx_nic *efx) + * should only have been called during probe. + */ + if (rc == -ENOSYS || rc == -EPERM) +- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); ++ pci_info(efx->pci_dev, "no PTP support\n"); + else if (rc) + efx_mcdi_display_error(efx, MC_CMD_PTP, + MC_CMD_PTP_IN_DISABLE_LEN, +diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c +index da7b94f34604..30d58f72725d 100644 +--- a/drivers/net/ethernet/sfc/siena_sriov.c ++++ b/drivers/net/ethernet/sfc/siena_sriov.c +@@ -1059,7 +1059,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx) + return; + + if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) { +- netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n"); ++ pci_info(efx->pci_dev, "no SR-IOV VFs probed\n"); + return; + } + if (count > 0 && count > max_vfs) +diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c +index ae9b983e8e5c..4a0e69a2d4f5 100644 +--- a/drivers/net/ethernet/sis/sis900.c ++++ b/drivers/net/ethernet/sis/sis900.c +@@ -442,7 +442,7 @@ static int sis900_probe(struct pci_dev *pci_dev, + #endif + + /* setup various bits in PCI command register */ +- ret = pci_enable_device(pci_dev); ++ ret = pcim_enable_device(pci_dev); + if(ret) return ret; + + i = pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32)); +@@ -468,7 +468,7 @@ static int sis900_probe(struct pci_dev *pci_dev, + ioaddr = pci_iomap(pci_dev, 0, 0); + if (!ioaddr) { + ret = -ENOMEM; +- goto err_out_cleardev; ++ goto err_out; + } + + sis_priv = netdev_priv(net_dev); +@@ -576,8 +576,6 @@ static int sis900_probe(struct pci_dev *pci_dev, + sis_priv->tx_ring_dma); + err_out_unmap: + pci_iounmap(pci_dev, ioaddr); +-err_out_cleardev: +- pci_release_regions(pci_dev); + err_out: + free_netdev(net_dev); + return ret; +@@ -2425,7 +2423,6 @@ static void sis900_remove(struct pci_dev *pci_dev) + sis_priv->tx_ring_dma); + pci_iounmap(pci_dev, sis_priv->ioaddr); + free_netdev(net_dev); +- pci_release_regions(pci_dev); + } + + #ifdef CONFIG_PM +diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c +index d0cf971aa4eb..4237bd311e0e 100644 +--- a/drivers/net/ethernet/smsc/smc911x.c ++++ b/drivers/net/ethernet/smsc/smc911x.c +@@ -2088,6 +2088,11 @@ static int smc911x_drv_probe(struct platform_device *pdev) + + ndev->dma = (unsigned char)-1; + ndev->irq = platform_get_irq(pdev, 0); ++ if (ndev->irq < 0) { ++ ret = ndev->irq; ++ goto release_both; ++ } ++ + lp = netdev_priv(ndev); + lp->netdev = ndev; + #ifdef SMC_DYNAMIC_BUS_CONFIG diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c index b0c72167bade..3c221ca2cc12 100644 --- a/drivers/net/ethernet/smsc/smc91x.c @@ -52273,10 +69753,44 @@ index b0c72167bade..3c221ca2cc12 100644 /* * Need to wait for optional EEPROM to load, max 750 us according diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -index bcc5d1e16ce2..f4ff43a1b5ba 100644 +index bcc5d1e16ce2..d8c40b68bc96 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -@@ -362,6 +362,9 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) +@@ -300,10 +300,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) + val &= ~NSS_COMMON_GMAC_CTL_PHY_IFACE_SEL; + break; + default: +- dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n", +- phy_modes(gmac->phy_mode)); +- err = -EINVAL; +- goto err_remove_config_dt; ++ goto err_unsupported_phy; + } + regmap_write(gmac->nss_common, NSS_COMMON_GMAC_CTL(gmac->id), val); + +@@ -320,10 +317,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) + NSS_COMMON_CLK_SRC_CTRL_OFFSET(gmac->id); + break; + default: +- dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n", +- phy_modes(gmac->phy_mode)); +- err = -EINVAL; +- goto err_remove_config_dt; ++ goto err_unsupported_phy; + } + regmap_write(gmac->nss_common, NSS_COMMON_CLK_SRC_CTRL, val); + +@@ -340,8 +334,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) + NSS_COMMON_CLK_GATE_GMII_TX_EN(gmac->id); + break; + default: +- /* We don't get here; the switch above will have errored out */ +- unreachable(); ++ goto err_unsupported_phy; + } + regmap_write(gmac->nss_common, NSS_COMMON_CLK_GATE, val); + +@@ -362,6 +355,9 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) plat_dat->has_gmac = true; plat_dat->bsp_priv = gmac; plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed; @@ -52286,6 +69800,18 @@ index bcc5d1e16ce2..f4ff43a1b5ba 100644 err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); if (err) +@@ -369,6 +365,11 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) + + return 0; + ++err_unsupported_phy: ++ dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n", ++ phy_modes(gmac->phy_mode)); ++ err = -EINVAL; ++ + err_remove_config_dt: + stmmac_remove_config_dt(pdev, plat_dat); + diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c index 6704d3e0392d..afc68cbca4e2 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c @@ -52404,9 +69930,18 @@ index 3519a8a589dd..c8673e231a88 100644 return 0; } diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 8c1a5361f661..dbd56fefa2f3 100644 +index 8c1a5361f661..0a7ff854d1c3 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -178,7 +178,7 @@ static void stmmac_clk_csr_set(struct stmmac_priv *priv) + priv->clk_csr = STMMAC_CSR_100_150M; + else if ((clk_rate >= CSR_F_150M) && (clk_rate < CSR_F_250M)) + priv->clk_csr = STMMAC_CSR_150_250M; +- else if ((clk_rate >= CSR_F_250M) && (clk_rate < CSR_F_300M)) ++ else if ((clk_rate >= CSR_F_250M) && (clk_rate <= CSR_F_300M)) + priv->clk_csr = STMMAC_CSR_250_300M; + } + } @@ -1901,9 +1901,6 @@ static int stmmac_release(struct net_device *dev) { struct stmmac_priv *priv = netdev_priv(dev); @@ -52442,7 +69977,7 @@ index 8c1a5361f661..dbd56fefa2f3 100644 priv->hw->dma->stop_tx(priv->ioaddr); priv->hw->dma->stop_rx(priv->ioaddr); diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c -index fe5b0ac8c631..306d5d08141e 100644 +index fe5b0ac8c631..f3aed26656a3 100644 --- a/drivers/net/ethernet/sun/niu.c +++ b/drivers/net/ethernet/sun/niu.c @@ -3948,8 +3948,6 @@ static void niu_xmac_interrupt(struct niu *np) @@ -52503,7 +70038,7 @@ index fe5b0ac8c631..306d5d08141e 100644 here = start + offset + 3; end = start + offset + err; -@@ -8211,9 +8211,12 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) +@@ -8211,9 +8211,13 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) offset += err; err = niu_pci_vpd_scan_props(np, here, end); @@ -52511,14 +70046,15 @@ index fe5b0ac8c631..306d5d08141e 100644 - return; + if (err < 0) + return err; ++ /* ret == 1 is not an error */ + if (err == 1) -+ return -EINVAL; ++ return 0; } + return 0; } /* ESPC_PIO_EN_ENABLE must be set */ -@@ -9306,8 +9309,11 @@ static int niu_get_invariants(struct niu *np) +@@ -9306,8 +9310,11 @@ static int niu_get_invariants(struct niu *np) offset = niu_pci_vpd_offset(np); netif_printk(np, probe, KERN_DEBUG, np->dev, "%s() VPD offset [%08x]\n", __func__, offset); @@ -52582,7 +70118,7 @@ index 7108c68f16d3..6ee7f8d2f2d1 100644 } SET_NETDEV_DEV(ndev, &pdev->dev); diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c -index 413cf14dbacd..8b7596fef42a 100644 +index 413cf14dbacd..37162492e263 100644 --- a/drivers/net/ethernet/ti/davinci_emac.c +++ b/drivers/net/ethernet/ti/davinci_emac.c @@ -183,11 +183,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1"; @@ -52599,6 +70135,29 @@ index 413cf14dbacd..8b7596fef42a 100644 #define EMAC_MACSTATUS_RXERRCH_SHIFT (8) /* EMAC RX register masks */ +@@ -426,8 +426,20 @@ static int emac_set_coalesce(struct net_device *ndev, + u32 int_ctrl, num_interrupts = 0; + u32 prescale = 0, addnl_dvdr = 1, coal_intvl = 0; + +- if (!coal->rx_coalesce_usecs) +- return -EINVAL; ++ if (!coal->rx_coalesce_usecs) { ++ priv->coal_intvl = 0; ++ ++ switch (priv->version) { ++ case EMAC_VERSION_2: ++ emac_ctrl_write(EMAC_DM646X_CMINTCTRL, 0); ++ break; ++ default: ++ emac_ctrl_write(EMAC_CTRL_EWINTTCNT, 0); ++ break; ++ } ++ ++ return 0; ++ } + + coal_intvl = coal->rx_coalesce_usecs; + diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c index 32516661f180..c17967b23d3c 100644 --- a/drivers/net/ethernet/ti/netcp_core.c @@ -52644,22 +70203,49 @@ index 108598794621..9507ca2e02ac 100644 } /** +diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c +index d2349a1bc6ba..ae357aecb1eb 100644 +--- a/drivers/net/ethernet/wiznet/w5100.c ++++ b/drivers/net/ethernet/wiznet/w5100.c +@@ -1060,6 +1060,8 @@ static int w5100_mmio_probe(struct platform_device *pdev) + mac_addr = data->mac_addr; + + mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!mem) ++ return -EINVAL; + if (resource_size(mem) < W5100_BUS_DIRECT_SIZE) + ops = &w5100_mmio_indirect_ops; + else diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c -index 545f60877bb7..9ba36c930ce3 100644 +index 545f60877bb7..af9a6a878b23 100644 --- a/drivers/net/ethernet/xilinx/ll_temac_main.c +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c -@@ -735,6 +735,11 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) +@@ -735,6 +735,9 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) /* Kick off the transfer */ lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */ -+ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) { -+ netdev_info(ndev, "%s -> netif_stop_queue\n", __func__); ++ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) + netif_stop_queue(ndev); -+ } + return NETDEV_TX_OK; } +diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +index 034b36442ee7..df3b3384984c 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c ++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +@@ -1179,9 +1179,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev) + } + + dev_info(dev, +- "Xilinx EmacLite at 0x%08X mapped to 0x%08X, irq=%d\n", +- (unsigned int __force)ndev->mem_start, +- (unsigned int __force)lp->base_addr, ndev->irq); ++ "Xilinx EmacLite at 0x%08X mapped to 0x%p, irq=%d\n", ++ (unsigned int __force)ndev->mem_start, lp->base_addr, ndev->irq); + return 0; + + error: diff --git a/drivers/net/fddi/Kconfig b/drivers/net/fddi/Kconfig index 3a424c864f4d..ecebeeb9b2a0 100644 --- a/drivers/net/fddi/Kconfig @@ -52778,10 +70364,10 @@ index b0de8ecd7fe8..bdcf4aa34566 100644 goto err_out_bh_region; } diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c -index 3511d40ba3f1..440047a239f5 100644 +index 3511d40ba3f1..26bb43a67513 100644 --- a/drivers/net/fjes/fjes_main.c +++ b/drivers/net/fjes/fjes_main.c -@@ -1212,6 +1212,10 @@ static int fjes_probe(struct platform_device *plat_dev) +@@ -1212,9 +1212,18 @@ static int fjes_probe(struct platform_device *plat_dev) adapter->interrupt_watch_enable = false; res = platform_get_resource(plat_dev, IORESOURCE_MEM, 0); @@ -52792,6 +70378,14 @@ index 3511d40ba3f1..440047a239f5 100644 hw->hw_res.start = res->start; hw->hw_res.size = resource_size(res); hw->hw_res.irq = platform_get_irq(plat_dev, 0); ++ if (hw->hw_res.irq < 0) { ++ err = hw->hw_res.irq; ++ goto err_free_control_wq; ++ } ++ + err = fjes_hw_init(&adapter->hw); + if (err) + goto err_free_control_wq; diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c index 35d8c636de12..d89995f4bd43 100644 --- a/drivers/net/geneve.c @@ -52923,14 +70517,53 @@ index fe844888e0ed..e513736ae0d5 100644 goto err_rt; } +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index 03c96a6cbafd..96fb2a2a59f0 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -68,9 +68,9 @@ + #define SIXP_DAMA_OFF 0 + + /* default level 2 parameters */ +-#define SIXP_TXDELAY (HZ/4) /* in 1 s */ ++#define SIXP_TXDELAY 25 /* 250 ms */ + #define SIXP_PERSIST 50 /* in 256ths */ +-#define SIXP_SLOTTIME (HZ/10) /* in 1 s */ ++#define SIXP_SLOTTIME 10 /* 100 ms */ + #define SIXP_INIT_RESYNC_TIMEOUT (3*HZ/2) /* in 1 s */ + #define SIXP_RESYNC_TIMEOUT 5*HZ /* in 1 s */ + +@@ -870,6 +870,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte) + return; + } + ++ if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) { ++ pr_err("6pack: cooked buffer overrun, data loss\n"); ++ sp->rx_count = 0; ++ return; ++ } ++ + buf = sp->raw_buf; + sp->cooked_buf[sp->rx_count_cooked++] = + buf[0] | ((buf[1] << 2) & 0xc0); diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c -index 088fe5d34f50..76340bc3cf44 100644 +index 088fe5d34f50..8d85cedb4bf5 100644 --- a/drivers/net/hamradio/mkiss.c +++ b/drivers/net/hamradio/mkiss.c -@@ -810,6 +810,7 @@ static void mkiss_close(struct tty_struct *tty) +@@ -803,13 +803,15 @@ static void mkiss_close(struct tty_struct *tty) + */ + netif_stop_queue(ax->dev); + +- /* Free all AX25 frame buffers. */ ++ unregister_netdev(ax->dev); ++ ++ /* Free all AX25 frame buffers after unreg. */ + kfree(ax->rbuff); + kfree(ax->xbuff); + ax->tty = NULL; - unregister_netdev(ax->dev); +- unregister_netdev(ax->dev); + free_netdev(ax->dev); } @@ -53139,6 +70772,19 @@ index 7e94526de51c..5649cc075ccb 100644 break; default: return -ERANGE; +diff --git a/drivers/net/phy/dp83640_reg.h b/drivers/net/phy/dp83640_reg.h +index e7fe41117003..f7ad94773d81 100644 +--- a/drivers/net/phy/dp83640_reg.h ++++ b/drivers/net/phy/dp83640_reg.h +@@ -4,7 +4,7 @@ + #ifndef HAVE_DP83640_REGISTERS + #define HAVE_DP83640_REGISTERS + +-#define PAGE0 0x0000 ++/* #define PAGE0 0x0000 */ + #define PHYCR2 0x001c /* PHY Control Register 2 */ + + #define PAGE4 0x0004 diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c index 8c73b2e771dd..e6ff731d753d 100644 --- a/drivers/net/phy/mdio-bcm-unimac.c @@ -53152,6 +70798,37 @@ index 8c73b2e771dd..e6ff731d753d 100644 /* Just ioremap, as this MDIO block is usually integrated into an * Ethernet MAC controller register range +diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c +index 599ce24c514f..456b64248e5d 100644 +--- a/drivers/net/phy/mdio-mux.c ++++ b/drivers/net/phy/mdio-mux.c +@@ -117,6 +117,7 @@ int mdio_mux_init(struct device *dev, + } else { + parent_bus_node = NULL; + parent_bus = mux_bus; ++ get_device(&parent_bus->dev); + } + + pb = devm_kzalloc(dev, sizeof(*pb), GFP_KERNEL); +@@ -182,9 +183,7 @@ int mdio_mux_init(struct device *dev, + + devm_kfree(dev, pb); + err_pb_kz: +- /* balance the reference of_mdio_find_bus() took */ +- if (!mux_bus) +- put_device(&parent_bus->dev); ++ put_device(&parent_bus->dev); + err_parent_bus: + of_node_put(parent_bus_node); + return ret_val; +@@ -202,7 +201,6 @@ void mdio_mux_uninit(void *mux_handle) + cb = cb->next; + } + +- /* balance the reference of_mdio_find_bus() in mdio_mux_init() took */ + put_device(&pb->mii_bus->dev); + } + EXPORT_SYMBOL_GPL(mdio_mux_uninit); diff --git a/drivers/net/phy/mdio-octeon.c b/drivers/net/phy/mdio-octeon.c index ab6914f8bd50..1da104150f44 100644 --- a/drivers/net/phy/mdio-octeon.c @@ -53185,10 +70862,24 @@ index 564616968cad..c0c922eff760 100644 } pci_set_drvdata(pdev, NULL); diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c -index a9bbdcec0bad..8cc7563ab103 100644 +index a9bbdcec0bad..92fb664b56fb 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c -@@ -362,7 +362,8 @@ void mdiobus_unregister(struct mii_bus *bus) +@@ -316,6 +316,13 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) + bus->dev.groups = NULL; + dev_set_name(&bus->dev, "%s", bus->id); + ++ /* We need to set state to MDIOBUS_UNREGISTERED to correctly release ++ * the device in mdiobus_free() ++ * ++ * State will be updated later in this function in case of success ++ */ ++ bus->state = MDIOBUS_UNREGISTERED; ++ + err = device_register(&bus->dev); + if (err) { + pr_err("mii_bus %s failed to register\n", bus->id); +@@ -362,7 +369,8 @@ void mdiobus_unregister(struct mii_bus *bus) struct mdio_device *mdiodev; int i; @@ -53198,6 +70889,51 @@ index a9bbdcec0bad..8cc7563ab103 100644 bus->state = MDIOBUS_UNREGISTERED; for (i = 0; i < PHY_MAX_ADDR; i++) { +diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c +index 9c88e6749b9a..34600b0061bb 100644 +--- a/drivers/net/phy/mdio_device.c ++++ b/drivers/net/phy/mdio_device.c +@@ -135,6 +135,16 @@ static int mdio_remove(struct device *dev) + return 0; + } + ++static void mdio_shutdown(struct device *dev) ++{ ++ struct mdio_device *mdiodev = to_mdio_device(dev); ++ struct device_driver *drv = mdiodev->dev.driver; ++ struct mdio_driver *mdiodrv = to_mdio_driver(drv); ++ ++ if (mdiodrv->shutdown) ++ mdiodrv->shutdown(mdiodev); ++} ++ + /** + * mdio_driver_register - register an mdio_driver with the MDIO layer + * @new_driver: new mdio_driver to register +@@ -149,6 +159,7 @@ int mdio_driver_register(struct mdio_driver *drv) + mdiodrv->driver.bus = &mdio_bus_type; + mdiodrv->driver.probe = mdio_probe; + mdiodrv->driver.remove = mdio_remove; ++ mdiodrv->driver.shutdown = mdio_shutdown; + + retval = driver_register(&mdiodrv->driver); + if (retval) { +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 270e0c443281..074c3ce1ff8e 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -1050,8 +1050,9 @@ static struct phy_driver ksphy_driver[] = { + .get_sset_count = kszphy_get_sset_count, + .get_strings = kszphy_get_strings, + .get_stats = kszphy_get_stats, +- .suspend = genphy_suspend, +- .resume = genphy_resume, ++ /* No suspend/resume callbacks because of errata DS80000700A, ++ * receiver error following software power down. ++ */ + }, { + .phy_id = PHY_ID_KSZ8041RNLI, + .phy_id_mask = MICREL_PHY_ID_MASK, diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 2f5587306022..a3ba95e96695 100644 --- a/drivers/net/phy/phy_device.c @@ -53212,6 +70948,62 @@ index 2f5587306022..a3ba95e96695 100644 /* If the device had no specific driver before (i.e. - it * was using the generic driver), we unbind the device +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index d209d5fe9c8e..28c778dbbd32 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -285,7 +285,7 @@ static struct channel *ppp_find_channel(struct ppp_net *pn, int unit); + static int ppp_connect_channel(struct channel *pch, int unit); + static int ppp_disconnect_channel(struct channel *pch); + static void ppp_destroy_channel(struct channel *pch); +-static int unit_get(struct idr *p, void *ptr); ++static int unit_get(struct idr *p, void *ptr, int min); + static int unit_set(struct idr *p, void *ptr, int n); + static void unit_put(struct idr *p, int n); + static void *unit_find(struct idr *p, int n); +@@ -976,9 +976,20 @@ static int ppp_unit_register(struct ppp *ppp, int unit, bool ifname_is_set) + mutex_lock(&pn->all_ppp_mutex); + + if (unit < 0) { +- ret = unit_get(&pn->units_idr, ppp); ++ ret = unit_get(&pn->units_idr, ppp, 0); + if (ret < 0) + goto err; ++ if (!ifname_is_set) { ++ while (1) { ++ snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ret); ++ if (!__dev_get_by_name(ppp->ppp_net, ppp->dev->name)) ++ break; ++ unit_put(&pn->units_idr, ret); ++ ret = unit_get(&pn->units_idr, ppp, ret + 1); ++ if (ret < 0) ++ goto err; ++ } ++ } + } else { + /* Caller asked for a specific unit number. Fail with -EEXIST + * if unavailable. For backward compatibility, return -EEXIST +@@ -1125,7 +1136,7 @@ static int ppp_nl_newlink(struct net *src_net, struct net_device *dev, + * the PPP unit identifer as suffix (i.e. ppp). This allows + * userspace to infer the device name using to the PPPIOCGUNIT ioctl. + */ +- if (!tb[IFLA_IFNAME]) ++ if (!tb[IFLA_IFNAME] || !nla_len(tb[IFLA_IFNAME]) || !*(char *)nla_data(tb[IFLA_IFNAME])) + conf.ifname_is_set = false; + + err = ppp_dev_configure(src_net, dev, &conf); +@@ -3313,9 +3324,9 @@ static int unit_set(struct idr *p, void *ptr, int n) + } + + /* get new free unit number and associate pointer with it */ +-static int unit_get(struct idr *p, void *ptr) ++static int unit_get(struct idr *p, void *ptr, int min) + { +- return idr_alloc(p, ptr, 0, 0, GFP_KERNEL); ++ return idr_alloc(p, ptr, min, 0, GFP_KERNEL); + } + + /* put unit number back to a pool */ diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index cea6d2eabe7e..001dea7aaba3 100644 --- a/drivers/net/team/team.c @@ -53234,7 +71026,7 @@ index cea6d2eabe7e..001dea7aaba3 100644 dev->mtu = port_dev->mtu; memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len); diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index fbd8ffe34e87..ac60322f7a5d 100644 +index fbd8ffe34e87..11b786687c71 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -72,6 +72,14 @@ @@ -53252,7 +71044,26 @@ index fbd8ffe34e87..ac60322f7a5d 100644 #include -@@ -2025,6 +2033,45 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr) +@@ -847,6 +855,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct tun_struct *tun = netdev_priv(dev); + int txq = skb->queue_mapping; ++ struct netdev_queue *queue; + struct tun_file *tfile; + u32 numqueues = 0; + +@@ -912,6 +921,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) + if (skb_array_produce(&tfile->tx_array, skb)) + goto drop; + ++ /* NETIF_F_LLTX requires to do our own update of trans_start */ ++ queue = netdev_get_tx_queue(dev, txq); ++ queue->trans_start = jiffies; ++ + /* Notify and wake up reader process */ + if (tfile->flags & TUN_FASYNC) + kill_fasync(&tfile->fasync, SIGIO, POLL_IN); +@@ -2025,6 +2038,45 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr) return ret; } @@ -53298,7 +71109,7 @@ index fbd8ffe34e87..ac60322f7a5d 100644 static long __tun_chr_ioctl(struct file *file, unsigned int cmd, unsigned long arg, int ifreq_len) { -@@ -2169,6 +2216,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, +@@ -2169,6 +2221,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, ret = -EBUSY; } else { tun->dev->type = (int) arg; @@ -53306,6 +71117,21 @@ index fbd8ffe34e87..ac60322f7a5d 100644 tun_debug(KERN_INFO, tun, "linktype set to %d\n", tun->dev->type); ret = 0; +diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig +index 3a7286256db0..9272d0f93819 100644 +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -98,6 +98,10 @@ config USB_RTL8150 + config USB_RTL8152 + tristate "Realtek RTL8152/RTL8153 Based USB Ethernet Adapters" + select MII ++ select CRC32 ++ select CRYPTO ++ select CRYPTO_HASH ++ select CRYPTO_SHA256 + help + This option adds support for Realtek RTL8152 based USB 2.0 + 10/100 Ethernet adapters and RTL8153 based USB 3.0 10/100/1000 diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c index 3dbb0646b024..541c06c884e5 100644 --- a/drivers/net/usb/asix_common.c @@ -53405,11 +71231,36 @@ index f7180f8db39e..9c15e1a1261b 100644 skb = skb2; done: +diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c +index 4c8baba72933..d86132d41416 100644 +--- a/drivers/net/usb/cdc_mbim.c ++++ b/drivers/net/usb/cdc_mbim.c +@@ -647,6 +647,11 @@ static const struct usb_device_id mbim_devs[] = { + .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, + }, + ++ /* Telit LN920 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1061, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, ++ }, ++ + /* default entry */ + { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&cdc_mbim_info_zlp, diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c -index be4e56826daf..5a5db2f09f78 100644 +index be4e56826daf..8ed525a063cf 100644 --- a/drivers/net/usb/cdc_ncm.c +++ b/drivers/net/usb/cdc_ncm.c -@@ -1128,7 +1128,10 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) +@@ -175,6 +175,8 @@ static u32 cdc_ncm_check_tx_max(struct usbnet *dev, u32 new_tx) + /* clamp new_tx to sane values */ + min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth16); + max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_TX, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize)); ++ if (max == 0) ++ max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */ + + /* some devices set dwNtbOutMaxSize too low for the above default */ + min = min(min, max); +@@ -1128,7 +1130,10 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) * accordingly. Otherwise, we should check here. */ if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) @@ -53421,7 +71272,7 @@ index be4e56826daf..5a5db2f09f78 100644 else delayed_ndp_size = 0; -@@ -1281,7 +1284,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) +@@ -1281,7 +1286,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) if (!(dev->driver_info->flags & FLAG_SEND_ZLP) && skb_out->len > ctx->min_tx_pkt) { padding_count = ctx->tx_max - skb_out->len; @@ -53431,7 +71282,7 @@ index be4e56826daf..5a5db2f09f78 100644 } else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0) { *skb_put(skb_out, 1) = 0; /* force short packet */ -@@ -1559,6 +1563,15 @@ cdc_ncm_speed_change(struct usbnet *dev, +@@ -1559,6 +1565,15 @@ cdc_ncm_speed_change(struct usbnet *dev, uint32_t rx_speed = le32_to_cpu(data->DLBitRRate); uint32_t tx_speed = le32_to_cpu(data->ULBitRate); @@ -53447,7 +71298,7 @@ index be4e56826daf..5a5db2f09f78 100644 /* * Currently the USB-NET API does not support reporting the actual * device speed. Do print it instead. -@@ -1602,10 +1615,8 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb) +@@ -1602,10 +1617,8 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb) * USB_CDC_NOTIFY_NETWORK_CONNECTION notification shall be * sent by device after USB_CDC_NOTIFY_SPEED_CHANGE. */ @@ -53460,7 +71311,7 @@ index be4e56826daf..5a5db2f09f78 100644 break; case USB_CDC_NOTIFY_SPEED_CHANGE: -@@ -1628,7 +1639,7 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb) +@@ -1628,7 +1641,7 @@ static void cdc_ncm_status(struct usbnet *dev, struct urb *urb) static const struct driver_info cdc_ncm_info = { .description = "CDC NCM", .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET @@ -53485,7 +71336,7 @@ index 0b4bdd39106b..fb18801d0fe7 100644 }; diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c -index 27fc699d8be5..5066b7bc67da 100644 +index 27fc699d8be5..a3a3d4b40a7c 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -626,7 +626,7 @@ static struct hso_serial *get_serial_by_index(unsigned index) @@ -53604,7 +71455,95 @@ index 27fc699d8be5..5066b7bc67da 100644 enabled ? 0x82 : 0x81, 0x40, 0, 0, NULL, 0, USB_CTRL_SET_TIMEOUT); mutex_unlock(&hso_dev->mutex); -@@ -2674,9 +2676,6 @@ static struct hso_device *hso_create_bulk_serial_device( +@@ -2510,7 +2512,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, + hso_net_init); + if (!net) { + dev_err(&interface->dev, "Unable to create ethernet device\n"); +- goto exit; ++ goto err_hso_dev; + } + + hso_net = netdev_priv(net); +@@ -2523,50 +2525,63 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, + USB_DIR_IN); + if (!hso_net->in_endp) { + dev_err(&interface->dev, "Can't find BULK IN endpoint\n"); +- goto exit; ++ goto err_net; + } + hso_net->out_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK, + USB_DIR_OUT); + if (!hso_net->out_endp) { + dev_err(&interface->dev, "Can't find BULK OUT endpoint\n"); +- goto exit; ++ goto err_net; + } + SET_NETDEV_DEV(net, &interface->dev); + SET_NETDEV_DEVTYPE(net, &hso_type); + +- /* registering our net device */ +- result = register_netdev(net); +- if (result) { +- dev_err(&interface->dev, "Failed to register device\n"); +- goto exit; +- } +- + /* start allocating */ + for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) { + hso_net->mux_bulk_rx_urb_pool[i] = usb_alloc_urb(0, GFP_KERNEL); + if (!hso_net->mux_bulk_rx_urb_pool[i]) +- goto exit; ++ goto err_mux_bulk_rx; + hso_net->mux_bulk_rx_buf_pool[i] = kzalloc(MUX_BULK_RX_BUF_SIZE, + GFP_KERNEL); + if (!hso_net->mux_bulk_rx_buf_pool[i]) +- goto exit; ++ goto err_mux_bulk_rx; + } + hso_net->mux_bulk_tx_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!hso_net->mux_bulk_tx_urb) +- goto exit; ++ goto err_mux_bulk_rx; + hso_net->mux_bulk_tx_buf = kzalloc(MUX_BULK_TX_BUF_SIZE, GFP_KERNEL); + if (!hso_net->mux_bulk_tx_buf) +- goto exit; ++ goto err_free_tx_urb; + + add_net_device(hso_dev); + ++ /* registering our net device */ ++ result = register_netdev(net); ++ if (result) { ++ dev_err(&interface->dev, "Failed to register device\n"); ++ goto err_free_tx_buf; ++ } ++ + hso_log_port(hso_dev); + + hso_create_rfkill(hso_dev, interface); + + return hso_dev; +-exit: +- hso_free_net_device(hso_dev); ++ ++err_free_tx_buf: ++ remove_net_device(hso_dev); ++ kfree(hso_net->mux_bulk_tx_buf); ++err_free_tx_urb: ++ usb_free_urb(hso_net->mux_bulk_tx_urb); ++err_mux_bulk_rx: ++ for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) { ++ usb_free_urb(hso_net->mux_bulk_rx_urb_pool[i]); ++ kfree(hso_net->mux_bulk_rx_buf_pool[i]); ++ } ++err_net: ++ free_netdev(net); ++err_hso_dev: ++ kfree(hso_dev); + return NULL; + } + +@@ -2674,9 +2689,6 @@ static struct hso_device *hso_create_bulk_serial_device( serial->write_data = hso_std_serial_write_data; @@ -53614,7 +71553,24 @@ index 27fc699d8be5..5066b7bc67da 100644 /* setup the proc dirs and files if needed */ hso_log_port(hso_dev); -@@ -2733,9 +2732,6 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface, +@@ -2716,14 +2728,14 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface, + + serial = kzalloc(sizeof(*serial), GFP_KERNEL); + if (!serial) +- goto exit; ++ goto err_free_dev; + + hso_dev->port_data.dev_serial = serial; + serial->parent = hso_dev; + + if (hso_serial_common_create + (serial, 1, CTRL_URB_RX_SIZE, CTRL_URB_TX_SIZE)) +- goto exit; ++ goto err_free_serial; + + serial->tx_data_length--; + serial->write_data = hso_mux_serial_write_data; +@@ -2733,20 +2745,15 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface, serial->shared_int->ref_count++; mutex_unlock(&serial->shared_int->shared_int_lock); @@ -53624,7 +71580,21 @@ index 27fc699d8be5..5066b7bc67da 100644 /* setup the proc dirs and files if needed */ hso_log_port(hso_dev); -@@ -3119,8 +3115,7 @@ static void hso_free_interface(struct usb_interface *interface) + /* done, return it */ + return hso_dev; + +-exit: +- if (serial) { +- tty_unregister_device(tty_drv, serial->minor); +- kfree(serial); +- } ++err_free_serial: ++ kfree(serial); ++err_free_dev: + kfree(hso_dev); + return NULL; + +@@ -3119,8 +3126,7 @@ static void hso_free_interface(struct usb_interface *interface) cancel_work_sync(&serial_table[i]->async_put_intf); cancel_work_sync(&serial_table[i]->async_get_intf); hso_serial_tty_unregister(serial); @@ -53648,10 +71618,19 @@ index 2b16a5fed9de..0cf5324d493e 100644 #define IPHETH_TX_TIMEOUT (5 * HZ) diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 075d7e50a52e..ab508c472ed1 100644 +index 075d7e50a52e..82c1f46349c7 100644 --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c -@@ -315,10 +315,6 @@ struct lan78xx_net { +@@ -67,6 +67,8 @@ + #define LAN7850_USB_PRODUCT_ID (0x7850) + #define LAN78XX_EEPROM_MAGIC (0x78A5) + #define LAN78XX_OTP_MAGIC (0x78F3) ++#define AT29M2AF_USB_VENDOR_ID (0x07C9) ++#define AT29M2AF_USB_PRODUCT_ID (0x0012) + + #define MII_READ 1 + #define MII_WRITE 0 +@@ -315,10 +317,6 @@ struct lan78xx_net { struct tasklet_struct bh; struct delayed_work wq; @@ -53662,7 +71641,25 @@ index 075d7e50a52e..ab508c472ed1 100644 int msg_enable; struct urb *urb_intr; -@@ -2560,78 +2556,12 @@ lan78xx_start_xmit(struct sk_buff *skb, struct net_device *net) +@@ -869,13 +867,10 @@ static int lan78xx_read_otp(struct lan78xx_net *dev, u32 offset, + ret = lan78xx_read_raw_otp(dev, 0, 1, &sig); + + if (ret == 0) { +- if (sig != OTP_INDICATOR_1) { +- if (sig == OTP_INDICATOR_2) +- offset += 0x100; +- else +- ret = -EINVAL; +- } +- ++ if (sig == OTP_INDICATOR_2) ++ offset += 0x100; ++ else if (sig != OTP_INDICATOR_1) ++ ret = -EINVAL; + if (!ret) + ret = lan78xx_read_raw_otp(dev, offset, length, data); + } +@@ -2560,78 +2555,12 @@ lan78xx_start_xmit(struct sk_buff *skb, struct net_device *net) return NETDEV_TX_OK; } @@ -53741,7 +71738,7 @@ index 075d7e50a52e..ab508c472ed1 100644 dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL); pdata = (struct lan78xx_priv *)(dev->data[0]); -@@ -3339,6 +3269,7 @@ static void lan78xx_stat_monitor(unsigned long param) +@@ -3339,6 +3268,7 @@ static void lan78xx_stat_monitor(unsigned long param) static int lan78xx_probe(struct usb_interface *intf, const struct usb_device_id *id) { @@ -53749,7 +71746,7 @@ index 075d7e50a52e..ab508c472ed1 100644 struct lan78xx_net *dev; struct net_device *netdev; struct usb_device *udev; -@@ -3389,6 +3320,34 @@ static int lan78xx_probe(struct usb_interface *intf, +@@ -3389,6 +3319,34 @@ static int lan78xx_probe(struct usb_interface *intf, mutex_init(&dev->stats.access_lock); @@ -53784,7 +71781,7 @@ index 075d7e50a52e..ab508c472ed1 100644 ret = lan78xx_bind(dev, intf); if (ret < 0) goto out2; -@@ -3398,18 +3357,7 @@ static int lan78xx_probe(struct usb_interface *intf, +@@ -3398,18 +3356,7 @@ static int lan78xx_probe(struct usb_interface *intf, netdev->mtu = dev->hard_mtu - netdev->hard_header_len; netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER); @@ -53804,7 +71801,7 @@ index 075d7e50a52e..ab508c472ed1 100644 maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0); buf = kmalloc(maxp, GFP_KERNEL); if (buf) { -@@ -3422,6 +3370,7 @@ static int lan78xx_probe(struct usb_interface *intf, +@@ -3422,11 +3369,18 @@ static int lan78xx_probe(struct usb_interface *intf, usb_fill_int_urb(dev->urb_intr, dev->udev, dev->pipe_intr, buf, maxp, intr_complete, dev, period); @@ -53812,6 +71809,71 @@ index 075d7e50a52e..ab508c472ed1 100644 } } + dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1); + ++ /* Reject broken descriptors. */ ++ if (dev->maxpacket == 0) { ++ ret = -ENODEV; ++ goto out3; ++ } ++ + /* driver requires remote-wakeup capability during autosuspend. */ + intf->needs_remote_wakeup = 1; + +@@ -3809,6 +3763,10 @@ static const struct usb_device_id products[] = { + /* LAN7850 USB Gigabit Ethernet Device */ + USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7850_USB_PRODUCT_ID), + }, ++ { ++ /* ATM2-AF USB Gigabit Ethernet Device */ ++ USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID), ++ }, + {}, + }; + MODULE_DEVICE_TABLE(usb, products); +diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c +index 5fe9f1273fe2..6cfc6faf9747 100644 +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -755,12 +755,16 @@ static inline void disable_net_traffic(pegasus_t *pegasus) + set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp); + } + +-static inline void get_interrupt_interval(pegasus_t *pegasus) ++static inline int get_interrupt_interval(pegasus_t *pegasus) + { + u16 data; + u8 interval; ++ int ret; ++ ++ ret = read_eprom_word(pegasus, 4, &data); ++ if (ret < 0) ++ return ret; + +- read_eprom_word(pegasus, 4, &data); + interval = data >> 8; + if (pegasus->usb->speed != USB_SPEED_HIGH) { + if (interval < 0x80) { +@@ -775,6 +779,8 @@ static inline void get_interrupt_interval(pegasus_t *pegasus) + } + } + pegasus->intr_interval = interval; ++ ++ return 0; + } + + static void set_carrier(struct net_device *net) +@@ -1191,7 +1197,9 @@ static int pegasus_probe(struct usb_interface *intf, + | NETIF_MSG_PROBE | NETIF_MSG_LINK); + + pegasus->features = usb_dev_id[dev_index].private; +- get_interrupt_interval(pegasus); ++ res = get_interrupt_interval(pegasus); ++ if (res) ++ goto out2; + if (reset_mac(pegasus)) { + dev_err(&intf->dev, "can't reset MAC\n"); + res = -EIO; diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c index 9a873616dd27..a8c960152a35 100644 --- a/drivers/net/usb/qmi_wwan.c @@ -53889,10 +71951,22 @@ index 9a873616dd27..a8c960152a35 100644 {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */ diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 6e74965d26a0..64fdea332886 100644 +index 6e74965d26a0..96f6edcb0062 100644 --- a/drivers/net/usb/r8152.c +++ b/drivers/net/usb/r8152.c -@@ -3938,7 +3938,7 @@ static void rtl8152_get_strings(struct net_device *dev, u32 stringset, u8 *data) +@@ -3347,9 +3347,10 @@ static int rtl8152_close(struct net_device *netdev) + tp->rtl_ops.down(tp); + + mutex_unlock(&tp->control); ++ } + ++ if (!res) + usb_autopm_put_interface(tp->intf); +- } + + free_all_mem(tp); + +@@ -3938,7 +3939,7 @@ static void rtl8152_get_strings(struct net_device *dev, u32 stringset, u8 *data) { switch (stringset) { case ETH_SS_STATS: @@ -54036,6 +72110,22 @@ index e719ecd69d01..3e6bf6bd0a68 100644 netif_dbg(dev, ifdown, dev->net, "free pdata\n"); kfree(pdata); pdata = NULL; +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 0b5fd1499ac0..6a004742ec71 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1740,6 +1740,11 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) + if (!dev->rx_urb_size) + dev->rx_urb_size = dev->hard_mtu; + dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1); ++ if (dev->maxpacket == 0) { ++ /* that is a broken device */ ++ status = -ENODEV; ++ goto out4; ++ } + + /* let userspace know we have a random address */ + if (ether_addr_equal(net->dev_addr, node_id)) diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c index 7118b8263760..a3447f8eaf66 100644 --- a/drivers/net/virtio_net.c @@ -54062,6 +72152,18 @@ index 7118b8263760..a3447f8eaf66 100644 return err; } +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index c999b10531c5..56a8031b56b3 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -3622,7 +3622,6 @@ vmxnet3_suspend(struct device *device) + vmxnet3_free_intr_resources(adapter); + + netif_device_detach(netdev); +- netif_tx_stop_all_queues(netdev); + + /* Create wake-up filters. */ + pmConf = adapter->pm_conf; diff --git a/drivers/net/vmxnet3/vmxnet3_ethtool.c b/drivers/net/vmxnet3/vmxnet3_ethtool.c index aabc6ef366b4..d63b83605748 100644 --- a/drivers/net/vmxnet3/vmxnet3_ethtool.c @@ -54075,6 +72177,26 @@ index aabc6ef366b4..d63b83605748 100644 while (n--) p[n] = rssConf->indTable[n]; return 0; +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 3b6e908d3164..9ac1dbf0a993 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -226,6 +226,7 @@ static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb, + /* strip the ethernet header added for pass through VRF device */ + __skb_pull(skb, skb_network_offset(skb)); + ++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + ret = vrf_ip6_local_out(net, skb->sk, skb); + if (unlikely(net_xmit_eval(ret))) + dev->stats.tx_errors++; +@@ -332,6 +333,7 @@ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb, + RT_SCOPE_LINK); + } + ++ memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + ret = vrf_ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb); + if (unlikely(net_xmit_eval(ret))) + vrf_dev->stats.tx_errors++; diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c index 58ddb6c90418..0bfadec8b79c 100644 --- a/drivers/net/vxlan.c @@ -54740,6 +72862,25 @@ index e492c7f0d311..9f4ee1d125b6 100644 AR5523_DEVICE_UG(0x157e, 0x3006), /* Umedia / AR5523_1 */ AR5523_DEVICE_UX(0x157e, 0x3205), /* Umedia / AR5523_2 */ AR5523_DEVICE_UG(0x157e, 0x3006), /* Umedia / TEW444UBEU */ +diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h +index da7a7c8dafb2..135600405dd0 100644 +--- a/drivers/net/wireless/ath/ath.h ++++ b/drivers/net/wireless/ath/ath.h +@@ -199,12 +199,13 @@ struct sk_buff *ath_rxbuf_alloc(struct ath_common *common, + bool ath_is_mybeacon(struct ath_common *common, struct ieee80211_hdr *hdr); + + void ath_hw_setbssidmask(struct ath_common *common); +-void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key); ++void ath_key_delete(struct ath_common *common, u8 hw_key_idx); + int ath_key_config(struct ath_common *common, + struct ieee80211_vif *vif, + struct ieee80211_sta *sta, + struct ieee80211_key_conf *key); + bool ath_hw_keyreset(struct ath_common *common, u16 entry); ++bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac); + void ath_hw_cycle_counters_update(struct ath_common *common); + int32_t ath_hw_get_listen_time(struct ath_common *common); + diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c index a3c218047597..381bff3a2103 100644 --- a/drivers/net/wireless/ath/ath10k/htt_rx.c @@ -54878,9 +73019,36 @@ index 6038b7486f1d..e04e0260035a 100644 #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1 #define TARGET_10_4_VOW_CONFIG 0 diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 2294ba311c47..314cac2ce087 100644 +index 2294ba311c47..41fb17cece62 100644 --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -980,7 +980,7 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id) + arg.channel.min_power = 0; + arg.channel.max_power = channel->max_power * 2; + arg.channel.max_reg_power = channel->max_reg_power * 2; +- arg.channel.max_antenna_gain = channel->max_antenna_gain * 2; ++ arg.channel.max_antenna_gain = channel->max_antenna_gain; + + reinit_completion(&ar->vdev_setup_done); + +@@ -1416,7 +1416,7 @@ static int ath10k_vdev_start_restart(struct ath10k_vif *arvif, + arg.channel.min_power = 0; + arg.channel.max_power = chandef->chan->max_power * 2; + arg.channel.max_reg_power = chandef->chan->max_reg_power * 2; +- arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2; ++ arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain; + + if (arvif->vdev_type == WMI_VDEV_TYPE_AP) { + arg.ssid = arvif->u.ap.ssid; +@@ -3019,7 +3019,7 @@ static int ath10k_update_channel_list(struct ath10k *ar) + ch->min_power = 0; + ch->max_power = channel->max_power * 2; + ch->max_reg_power = channel->max_reg_power * 2; +- ch->max_antenna_gain = channel->max_antenna_gain * 2; ++ ch->max_antenna_gain = channel->max_antenna_gain; + ch->reg_class_id = 0; /* FIXME */ + + /* FIXME: why use only legacy modes, why not any @@ -3452,23 +3452,16 @@ bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar) static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb) { @@ -54926,6 +73094,41 @@ index 2294ba311c47..314cac2ce087 100644 lockdep_assert_held(&ar->conf_mutex); +diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h +index cce028ea9b57..5f718210ce68 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -1802,7 +1802,9 @@ struct wmi_channel { + union { + __le32 reginfo1; + struct { ++ /* note: power unit is 1 dBm */ + u8 antenna_max; ++ /* note: power unit is 0.5 dBm */ + u8 max_tx_power; + } __packed; + } __packed; +@@ -1821,6 +1823,7 @@ struct wmi_channel_arg { + u32 min_power; + u32 max_power; + u32 max_reg_power; ++ /* note: power unit is 1 dBm */ + u32 max_antenna_gain; + u32 reg_class_id; + enum wmi_phy_mode mode; +diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c +index 16e052d02c94..0f4836fc3b7c 100644 +--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c ++++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c +@@ -522,7 +522,7 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + } + break; + case DISABLE_KEY: +- ath_key_delete(common, key); ++ ath_key_delete(common, key->hw_key_idx); + break; + default: + ret = -EINVAL; diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c index 1af3fed5a72c..1a6851827968 100644 --- a/drivers/net/wireless/ath/ath6kl/main.c @@ -54940,11 +73143,48 @@ index 1af3fed5a72c..1a6851827968 100644 if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) { struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) assoc_info; +diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c +index fc22c5f47927..3d0dfcf2c246 100644 +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb) + le16_to_cpu(endpoint->wMaxPacketSize), + endpoint->bInterval); + } ++ ++ /* Ignore broken descriptors. */ ++ if (usb_endpoint_maxp(endpoint) == 0) ++ continue; ++ + urbcount = 0; + + pipe_num = +@@ -907,7 +912,7 @@ static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb, + req, + USB_DIR_IN | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, value, index, buf, +- size, 2 * HZ); ++ size, 2000); + + if (ret < 0) { + ath6kl_warn("Failed to read usb control message: %d\n", ret); diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c -index 55609fc4e50e..73eab12cb3bd 100644 +index 55609fc4e50e..9c2d26b12b69 100644 --- a/drivers/net/wireless/ath/ath6kl/wmi.c +++ b/drivers/net/wireless/ath/ath6kl/wmi.c -@@ -2648,6 +2648,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class, +@@ -2513,8 +2513,10 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx) + goto free_data_skb; + + for (index = 0; index < num_pri_streams; index++) { +- if (WARN_ON(!data_sync_bufs[index].skb)) ++ if (WARN_ON(!data_sync_bufs[index].skb)) { ++ ret = -ENOMEM; + goto free_data_skb; ++ } + + ep_id = ath6kl_ac2_endpoint_id(wmi->parent_dev, + data_sync_bufs[index]. +@@ -2648,6 +2650,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class, return -EINVAL; } @@ -54956,6 +73196,20 @@ index 55609fc4e50e..73eab12cb3bd 100644 skb = ath6kl_wmi_get_new_buf(sizeof(*cmd)); if (!skb) return -ENOMEM; +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +index 7eff6f8023d8..969a2a581b0c 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +@@ -3346,7 +3346,8 @@ static int ar9300_eeprom_restore_internal(struct ath_hw *ah, + "Found block at %x: code=%d ref=%d length=%d major=%d minor=%d\n", + cptr, code, reference, length, major, minor); + if ((!AR_SREV_9485(ah) && length >= 1024) || +- (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485)) { ++ (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485) || ++ (length > cptr)) { + ath_dbg(common, EEPROM, "Skipping bad header\n"); + cptr -= COMP_HDR_LEN; + continue; diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h index 7bda18c61eb6..beaeb5d07c7e 100644 --- a/drivers/net/wireless/ath/ath9k/ath9k.h @@ -55293,6 +73547,19 @@ index b65c1b661ade..09d737f3461b 100644 ieee80211_free_hw(htc_handle->drv_priv->hw); } } +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c +index a553c91d41a1..7d670a71b7b8 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c +@@ -1460,7 +1460,7 @@ static int ath9k_htc_set_key(struct ieee80211_hw *hw, + } + break; + case DISABLE_KEY: +- ath_key_delete(common, key); ++ ath_key_delete(common, key->hw_key_idx); + break; + default: + ret = -EINVAL; diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index 52b42ecee621..6a9c9b4ef2c9 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -55367,7 +73634,7 @@ index fd85f996c554..625823e45d8f 100644 skb_pull(skb, sizeof(struct htc_frame_hdr)); diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c -index e7fca78cdd96..9d664398a41b 100644 +index e7fca78cdd96..b707c14dab6f 100644 --- a/drivers/net/wireless/ath/ath9k/hw.c +++ b/drivers/net/wireless/ath/ath9k/hw.c @@ -285,7 +285,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah) @@ -55379,8 +73646,50 @@ index e7fca78cdd96..9d664398a41b 100644 ath_err(ath9k_hw_common(ah), "Failed to read SREV register"); return false; +@@ -1595,7 +1595,6 @@ static void ath9k_hw_apply_gpio_override(struct ath_hw *ah) + ath9k_hw_gpio_request_out(ah, i, NULL, + AR_GPIO_OUTPUT_MUX_AS_OUTPUT); + ath9k_hw_set_gpio(ah, i, !!(ah->gpio_val & BIT(i))); +- ath9k_hw_gpio_free(ah, i); + } + } + +@@ -2702,14 +2701,17 @@ static void ath9k_hw_gpio_cfg_output_mux(struct ath_hw *ah, u32 gpio, u32 type) + static void ath9k_hw_gpio_cfg_soc(struct ath_hw *ah, u32 gpio, bool out, + const char *label) + { ++ int err; ++ + if (ah->caps.gpio_requested & BIT(gpio)) + return; + +- /* may be requested by BSP, free anyway */ +- gpio_free(gpio); +- +- if (gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label)) ++ err = gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label); ++ if (err) { ++ ath_err(ath9k_hw_common(ah), "request GPIO%d failed:%d\n", ++ gpio, err); + return; ++ } + + ah->caps.gpio_requested |= BIT(gpio); + } +diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h +index 9cbca1229bac..eec60abe3b96 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.h ++++ b/drivers/net/wireless/ath/ath9k/hw.h +@@ -815,6 +815,7 @@ struct ath_hw { + struct ath9k_pacal_info pacal_info; + struct ar5416Stats stats; + struct ath9k_tx_queue_info txq[ATH9K_NUM_TX_QUEUES]; ++ DECLARE_BITMAP(pending_del_keymap, ATH_KEYMAX); + + enum ath9k_int imask; + u32 imrs2_reg; diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index 58af2fe5be3c..454bf16d6b30 100644 +index 58af2fe5be3c..ca0877f0e639 100644 --- a/drivers/net/wireless/ath/ath9k/main.c +++ b/drivers/net/wireless/ath/ath9k/main.c @@ -302,6 +302,11 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan) @@ -55395,6 +73704,158 @@ index 58af2fe5be3c..454bf16d6b30 100644 if (!ath_prepare_reset(sc)) fastcc = false; +@@ -523,8 +528,10 @@ irqreturn_t ath_isr(int irq, void *dev) + ath9k_debug_sync_cause(sc, sync_cause); + status &= ah->imask; /* discard unasked-for bits */ + +- if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) ++ if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) { ++ ath9k_hw_kill_interrupts(sc->sc_ah); + return IRQ_HANDLED; ++ } + + /* + * If there are no status bits set, then this interrupt was not +@@ -816,12 +823,80 @@ static void ath9k_tx(struct ieee80211_hw *hw, + ieee80211_free_txskb(hw, skb); + } + ++static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix) ++{ ++ struct ath_buf *bf; ++ struct ieee80211_tx_info *txinfo; ++ struct ath_frame_info *fi; ++ ++ list_for_each_entry(bf, txq_list, list) { ++ if (bf->bf_state.stale || !bf->bf_mpdu) ++ continue; ++ ++ txinfo = IEEE80211_SKB_CB(bf->bf_mpdu); ++ fi = (struct ath_frame_info *)&txinfo->rate_driver_data[0]; ++ if (fi->keyix == keyix) ++ return true; ++ } ++ ++ return false; ++} ++ ++static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix) ++{ ++ struct ath_hw *ah = sc->sc_ah; ++ int i; ++ struct ath_txq *txq; ++ bool key_in_use = false; ++ ++ for (i = 0; !key_in_use && i < ATH9K_NUM_TX_QUEUES; i++) { ++ if (!ATH_TXQ_SETUP(sc, i)) ++ continue; ++ txq = &sc->tx.txq[i]; ++ if (!txq->axq_depth) ++ continue; ++ if (!ath9k_hw_numtxpending(ah, txq->axq_qnum)) ++ continue; ++ ++ ath_txq_lock(sc, txq); ++ key_in_use = ath9k_txq_list_has_key(&txq->axq_q, keyix); ++ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) { ++ int idx = txq->txq_tailidx; ++ ++ while (!key_in_use && ++ !list_empty(&txq->txq_fifo[idx])) { ++ key_in_use = ath9k_txq_list_has_key( ++ &txq->txq_fifo[idx], keyix); ++ INCR(idx, ATH_TXFIFO_DEPTH); ++ } ++ } ++ ath_txq_unlock(sc, txq); ++ } ++ ++ return key_in_use; ++} ++ ++static void ath9k_pending_key_del(struct ath_softc *sc, u8 keyix) ++{ ++ struct ath_hw *ah = sc->sc_ah; ++ struct ath_common *common = ath9k_hw_common(ah); ++ ++ if (!test_bit(keyix, ah->pending_del_keymap) || ++ ath9k_txq_has_key(sc, keyix)) ++ return; ++ ++ /* No more TXQ frames point to this key cache entry, so delete it. */ ++ clear_bit(keyix, ah->pending_del_keymap); ++ ath_key_delete(common, keyix); ++} ++ + static void ath9k_stop(struct ieee80211_hw *hw) + { + struct ath_softc *sc = hw->priv; + struct ath_hw *ah = sc->sc_ah; + struct ath_common *common = ath9k_hw_common(ah); + bool prev_idle; ++ int i; + + ath9k_deinit_channel_context(sc); + +@@ -889,6 +964,14 @@ static void ath9k_stop(struct ieee80211_hw *hw) + + spin_unlock_bh(&sc->sc_pcu_lock); + ++ for (i = 0; i < ATH_KEYMAX; i++) ++ ath9k_pending_key_del(sc, i); ++ ++ /* Clear key cache entries explicitly to get rid of any potentially ++ * remaining keys. ++ */ ++ ath9k_cmn_init_crypto(sc->sc_ah); ++ + ath9k_ps_restore(sc); + + sc->ps_idle = prev_idle; +@@ -1534,12 +1617,11 @@ static void ath9k_del_ps_key(struct ath_softc *sc, + { + struct ath_common *common = ath9k_hw_common(sc->sc_ah); + struct ath_node *an = (struct ath_node *) sta->drv_priv; +- struct ieee80211_key_conf ps_key = { .hw_key_idx = an->ps_key }; + + if (!an->ps_key) + return; + +- ath_key_delete(common, &ps_key); ++ ath_key_delete(common, an->ps_key); + an->ps_key = 0; + an->key_idx[0] = 0; + } +@@ -1701,6 +1783,12 @@ static int ath9k_set_key(struct ieee80211_hw *hw, + if (sta) + an = (struct ath_node *)sta->drv_priv; + ++ /* Delete pending key cache entries if no more frames are pointing to ++ * them in TXQs. ++ */ ++ for (i = 0; i < ATH_KEYMAX; i++) ++ ath9k_pending_key_del(sc, i); ++ + switch (cmd) { + case SET_KEY: + if (sta) +@@ -1730,7 +1818,15 @@ static int ath9k_set_key(struct ieee80211_hw *hw, + } + break; + case DISABLE_KEY: +- ath_key_delete(common, key); ++ if (ath9k_txq_has_key(sc, key->hw_key_idx)) { ++ /* Delay key cache entry deletion until there are no ++ * remaining TXQ frames pointing to this entry. ++ */ ++ set_bit(key->hw_key_idx, sc->sc_ah->pending_del_keymap); ++ ath_hw_keysetmac(common, key->hw_key_idx, NULL); ++ } else { ++ ath_key_delete(common, key->hw_key_idx); ++ } + if (an) { + for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) { + if (an->key_idx[i] != key->hw_key_idx) diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c index 9c16e2a6d185..f100533eb7ad 100644 --- a/drivers/net/wireless/ath/ath9k/wmi.c @@ -55546,11 +74007,118 @@ index ffb22a04beeb..202f421e0e37 100644 err = -EBUSY; rcu_read_unlock(); +diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c +index 78146607f16e..acd85e506934 100644 +--- a/drivers/net/wireless/ath/dfs_pattern_detector.c ++++ b/drivers/net/wireless/ath/dfs_pattern_detector.c +@@ -182,10 +182,12 @@ static void channel_detector_exit(struct dfs_pattern_detector *dpd, + if (cd == NULL) + return; + list_del(&cd->head); +- for (i = 0; i < dpd->num_radar_types; i++) { +- struct pri_detector *de = cd->detectors[i]; +- if (de != NULL) +- de->exit(de); ++ if (cd->detectors) { ++ for (i = 0; i < dpd->num_radar_types; i++) { ++ struct pri_detector *de = cd->detectors[i]; ++ if (de != NULL) ++ de->exit(de); ++ } + } + kfree(cd->detectors); + kfree(cd); +diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c +index 1816b4e7dc26..61b59a804e30 100644 +--- a/drivers/net/wireless/ath/key.c ++++ b/drivers/net/wireless/ath/key.c +@@ -84,8 +84,7 @@ bool ath_hw_keyreset(struct ath_common *common, u16 entry) + } + EXPORT_SYMBOL(ath_hw_keyreset); + +-static bool ath_hw_keysetmac(struct ath_common *common, +- u16 entry, const u8 *mac) ++bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac) + { + u32 macHi, macLo; + u32 unicast_flag = AR_KEYTABLE_VALID; +@@ -125,6 +124,7 @@ static bool ath_hw_keysetmac(struct ath_common *common, + + return true; + } ++EXPORT_SYMBOL(ath_hw_keysetmac); + + static bool ath_hw_set_keycache_entry(struct ath_common *common, u16 entry, + const struct ath_keyval *k, +@@ -581,29 +581,38 @@ EXPORT_SYMBOL(ath_key_config); + /* + * Delete Key. + */ +-void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key) ++void ath_key_delete(struct ath_common *common, u8 hw_key_idx) + { +- ath_hw_keyreset(common, key->hw_key_idx); +- if (key->hw_key_idx < IEEE80211_WEP_NKID) ++ /* Leave CCMP and TKIP (main key) configured to avoid disabling ++ * encryption for potentially pending frames already in a TXQ with the ++ * keyix pointing to this key entry. Instead, only clear the MAC address ++ * to prevent RX processing from using this key cache entry. ++ */ ++ if (test_bit(hw_key_idx, common->ccmp_keymap) || ++ test_bit(hw_key_idx, common->tkip_keymap)) ++ ath_hw_keysetmac(common, hw_key_idx, NULL); ++ else ++ ath_hw_keyreset(common, hw_key_idx); ++ if (hw_key_idx < IEEE80211_WEP_NKID) + return; + +- clear_bit(key->hw_key_idx, common->keymap); +- clear_bit(key->hw_key_idx, common->ccmp_keymap); +- if (key->cipher != WLAN_CIPHER_SUITE_TKIP) ++ clear_bit(hw_key_idx, common->keymap); ++ clear_bit(hw_key_idx, common->ccmp_keymap); ++ if (!test_bit(hw_key_idx, common->tkip_keymap)) + return; + +- clear_bit(key->hw_key_idx + 64, common->keymap); ++ clear_bit(hw_key_idx + 64, common->keymap); + +- clear_bit(key->hw_key_idx, common->tkip_keymap); +- clear_bit(key->hw_key_idx + 64, common->tkip_keymap); ++ clear_bit(hw_key_idx, common->tkip_keymap); ++ clear_bit(hw_key_idx + 64, common->tkip_keymap); + + if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) { +- ath_hw_keyreset(common, key->hw_key_idx + 32); +- clear_bit(key->hw_key_idx + 32, common->keymap); +- clear_bit(key->hw_key_idx + 64 + 32, common->keymap); ++ ath_hw_keyreset(common, hw_key_idx + 32); ++ clear_bit(hw_key_idx + 32, common->keymap); ++ clear_bit(hw_key_idx + 64 + 32, common->keymap); + +- clear_bit(key->hw_key_idx + 32, common->tkip_keymap); +- clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap); ++ clear_bit(hw_key_idx + 32, common->tkip_keymap); ++ clear_bit(hw_key_idx + 64 + 32, common->tkip_keymap); + } + } + EXPORT_SYMBOL(ath_key_delete); diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c -index ca8797c65312..86beadf0f249 100644 +index ca8797c65312..b5a885a8301c 100644 --- a/drivers/net/wireless/ath/wcn36xx/main.c +++ b/drivers/net/wireless/ath/wcn36xx/main.c -@@ -158,7 +158,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = { +@@ -129,7 +129,9 @@ static struct ieee80211_supported_band wcn_band_2ghz = { + .cap = IEEE80211_HT_CAP_GRN_FLD | + IEEE80211_HT_CAP_SGI_20 | + IEEE80211_HT_CAP_DSSSCCK40 | +- IEEE80211_HT_CAP_LSIG_TXOP_PROT, ++ IEEE80211_HT_CAP_LSIG_TXOP_PROT | ++ IEEE80211_HT_CAP_SGI_40 | ++ IEEE80211_HT_CAP_SUP_WIDTH_20_40, + .ht_supported = true, + .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, + .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, +@@ -158,7 +160,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = { .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, .mcs = { .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, @@ -55559,6 +74127,74 @@ index ca8797c65312..86beadf0f249 100644 .tx_params = IEEE80211_HT_MCS_TX_DEFINED, } } +diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c +index a443992320f2..914c210c9e60 100644 +--- a/drivers/net/wireless/ath/wcn36xx/smd.c ++++ b/drivers/net/wireless/ath/wcn36xx/smd.c +@@ -2081,30 +2081,52 @@ static int wcn36xx_smd_delete_sta_context_ind(struct wcn36xx *wcn, + size_t len) + { + struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf; +- struct wcn36xx_vif *tmp; ++ struct wcn36xx_vif *vif_priv; ++ struct ieee80211_vif *vif; ++ struct ieee80211_bss_conf *bss_conf; + struct ieee80211_sta *sta; ++ bool found = false; + + if (len != sizeof(*rsp)) { + wcn36xx_warn("Corrupted delete sta indication\n"); + return -EIO; + } + +- wcn36xx_dbg(WCN36XX_DBG_HAL, "delete station indication %pM index %d\n", +- rsp->addr2, rsp->sta_id); ++ wcn36xx_dbg(WCN36XX_DBG_HAL, ++ "delete station indication %pM index %d reason %d\n", ++ rsp->addr2, rsp->sta_id, rsp->reason_code); + +- list_for_each_entry(tmp, &wcn->vif_list, list) { ++ list_for_each_entry(vif_priv, &wcn->vif_list, list) { + rcu_read_lock(); +- sta = ieee80211_find_sta(wcn36xx_priv_to_vif(tmp), rsp->addr2); +- if (sta) +- ieee80211_report_low_ack(sta, 0); ++ vif = wcn36xx_priv_to_vif(vif_priv); ++ ++ if (vif->type == NL80211_IFTYPE_STATION) { ++ /* We could call ieee80211_find_sta too, but checking ++ * bss_conf is clearer. ++ */ ++ bss_conf = &vif->bss_conf; ++ if (vif_priv->sta_assoc && ++ !memcmp(bss_conf->bssid, rsp->addr2, ETH_ALEN)) { ++ found = true; ++ wcn36xx_dbg(WCN36XX_DBG_HAL, ++ "connection loss bss_index %d\n", ++ vif_priv->bss_index); ++ ieee80211_connection_loss(vif); ++ } ++ } else { ++ sta = ieee80211_find_sta(vif, rsp->addr2); ++ if (sta) { ++ found = true; ++ ieee80211_report_low_ack(sta, 0); ++ } ++ } ++ + rcu_read_unlock(); +- if (sta) ++ if (found) + return 0; + } + +- wcn36xx_warn("STA with addr %pM and index %d not found\n", +- rsp->addr2, +- rsp->sta_id); ++ wcn36xx_warn("BSS or STA with addr %pM not found\n", rsp->addr2); + return -ENOENT; + } + diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig index 2ab6c5951561..2d571fd709c2 100644 --- a/drivers/net/wireless/ath/wil6210/Kconfig @@ -55584,6 +74220,19 @@ index a635fc6b1722..e57a50cc1d87 100644 hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_AP) | BIT(NL80211_IFTYPE_MESH_POINT) | +diff --git a/drivers/net/wireless/broadcom/b43/phy_g.c b/drivers/net/wireless/broadcom/b43/phy_g.c +index 822dcaa8ace6..35ff139b1496 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_g.c ++++ b/drivers/net/wireless/broadcom/b43/phy_g.c +@@ -2310,7 +2310,7 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev) + b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF); + b43_set_all_gains(dev, 3, 8, 1); + +- start = (channel - 5 > 0) ? channel - 5 : 1; ++ start = (channel > 5) ? channel - 5 : 1; + end = (channel + 5 < 14) ? channel + 5 : 13; + + for (i = start; i <= end; i++) { diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c index a5557d70689f..d1afa74aa144 100644 --- a/drivers/net/wireless/broadcom/b43/phy_n.c @@ -55609,6 +74258,19 @@ index 9da8bd792702..fe658a9b53cb 100644 hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_AP) | +diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c +index 9501420340a9..5b1e8890305c 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/radio.c ++++ b/drivers/net/wireless/broadcom/b43legacy/radio.c +@@ -299,7 +299,7 @@ u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev) + & 0x7FFF); + b43legacy_set_all_gains(dev, 3, 8, 1); + +- start = (channel - 5 > 0) ? channel - 5 : 1; ++ start = (channel > 5) ? channel - 5 : 1; + end = (channel + 5 < 14) ? channel + 5 : 13; + + for (i = start; i <= end; i++) { diff --git a/drivers/net/wireless/broadcom/b43legacy/xmit.c b/drivers/net/wireless/broadcom/b43legacy/xmit.c index 35ccf400b02c..87045e30e585 100644 --- a/drivers/net/wireless/broadcom/b43legacy/xmit.c @@ -55781,6 +74443,20 @@ index 6d38eec3f9d3..a78aaf17116e 100644 INIT_WORK(&reprobe->work, iwl_mvm_reprobe_wk); schedule_work(&reprobe->work); } else if (mvm->cur_ucode == IWL_UCODE_REGULAR) { +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +index ff5ce1ed03c4..4746f4b096c5 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +@@ -913,6 +913,9 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm) + + lockdep_assert_held(&mvm->mutex); + ++ if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM) ++ return false; ++ + if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1) + return false; + diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c index e7b873018dca..71edbf7a42ed 100644 --- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c @@ -55937,6 +74613,26 @@ index 57ad56435dda..8bc0286b4f8c 100644 desc->len = cpu_to_le16(skb->len); desc->flags = 0; +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 9d147b11ee51..9f19fd5c18d0 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -292,6 +292,7 @@ static int if_usb_probe(struct usb_interface *intf, + if_usb_reset_device(cardp); + dealloc: + if_usb_free(cardp); ++ kfree(cardp); + + error: + return r; +@@ -318,6 +319,7 @@ static void if_usb_disconnect(struct usb_interface *intf) + + /* Unlink and free urb */ + if_usb_free(cardp); ++ kfree(cardp); + + usb_set_intfdata(intf, NULL); + usb_put_dev(interface_to_usbdev(intf)); diff --git a/drivers/net/wireless/marvell/libertas/mesh.c b/drivers/net/wireless/marvell/libertas/mesh.c index d0c881dd5846..f1e9cbcfdc16 100644 --- a/drivers/net/wireless/marvell/libertas/mesh.c @@ -56001,6 +74697,48 @@ index d0c881dd5846..f1e9cbcfdc16 100644 unregister_netdev(mesh_dev); priv->mesh_dev = NULL; kfree(mesh_dev->ieee80211_ptr); +diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +index 4b539209999b..aaba324dbc39 100644 +--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +@@ -234,6 +234,7 @@ static int if_usb_probe(struct usb_interface *intf, + + dealloc: + if_usb_free(cardp); ++ kfree(cardp); + error: + lbtf_deb_leave(LBTF_DEB_MAIN); + return -ENOMEM; +@@ -258,6 +259,7 @@ static void if_usb_disconnect(struct usb_interface *intf) + + /* Unlink and free urb */ + if_usb_free(cardp); ++ kfree(cardp); + + usb_set_intfdata(intf, NULL); + usb_put_dev(interface_to_usbdev(intf)); +diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c +index c174e79e6df2..b70eac7d2dd7 100644 +--- a/drivers/net/wireless/marvell/mwifiex/11n.c ++++ b/drivers/net/wireless/marvell/mwifiex/11n.c +@@ -630,14 +630,15 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac, + uint16_t del_ba_param_set; + + memset(&delba, 0, sizeof(delba)); +- delba.del_ba_param_set = cpu_to_le16(tid << DELBA_TID_POS); + +- del_ba_param_set = le16_to_cpu(delba.del_ba_param_set); ++ del_ba_param_set = tid << DELBA_TID_POS; ++ + if (initiator) + del_ba_param_set |= IEEE80211_DELBA_PARAM_INITIATOR_MASK; + else + del_ba_param_set &= ~IEEE80211_DELBA_PARAM_INITIATOR_MASK; + ++ delba.del_ba_param_set = cpu_to_le16(del_ba_param_set); + memcpy(&delba.peer_mac_addr, peer_mac, ETH_ALEN); + + /* We don't wait for the response of this command */ diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c index 94901b0041ce..c597af69f48f 100644 --- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c @@ -56033,10 +74771,41 @@ index 94901b0041ce..c597af69f48f 100644 ether_addr_copy(mac, node->mac_addr); return mwifiex_dump_station_info(priv, node, sinfo); } +diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c +index 53477280f39c..7c848852aa09 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c ++++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c +@@ -321,9 +321,9 @@ static int mwifiex_dnld_sleep_confirm_cmd(struct mwifiex_adapter *adapter) + + adapter->seq_num++; + sleep_cfm_buf->seq_num = +- cpu_to_le16((HostCmd_SET_SEQ_NO_BSS_INFO ++ cpu_to_le16(HostCmd_SET_SEQ_NO_BSS_INFO + (adapter->seq_num, priv->bss_num, +- priv->bss_type))); ++ priv->bss_type)); + + mwifiex_dbg(adapter, CMD, + "cmd: DNLD_CMD: %#x, act %#x, len %d, seqno %#x\n", diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h -index 395d6ece2cac..341f6ed5b355 100644 +index 395d6ece2cac..fccce1b4afcd 100644 --- a/drivers/net/wireless/marvell/mwifiex/fw.h +++ b/drivers/net/wireless/marvell/mwifiex/fw.h +@@ -482,10 +482,10 @@ enum mwifiex_channel_flags { + + #define RF_ANTENNA_AUTO 0xFFFF + +-#define HostCmd_SET_SEQ_NO_BSS_INFO(seq, num, type) { \ +- (((seq) & 0x00ff) | \ +- (((num) & 0x000f) << 8)) | \ +- (((type) & 0x000f) << 12); } ++#define HostCmd_SET_SEQ_NO_BSS_INFO(seq, num, type) \ ++ ((((seq) & 0x00ff) | \ ++ (((num) & 0x000f) << 8)) | \ ++ (((type) & 0x000f) << 12)) + + #define HostCmd_GET_SEQ_NO(seq) \ + ((seq) & HostCmd_SEQ_NUM_MASK) @@ -921,7 +921,7 @@ struct mwifiex_tkip_param { struct mwifiex_aes_param { u8 pn[WPA_PN_SIZE]; @@ -56059,6 +74828,25 @@ index b89596c18b41..313b5d9fd08e 100644 memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len); mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n", +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index d0743bd25ba9..aaabd8454794 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1265,6 +1265,14 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb, + ret = -1; + goto done_unmap; + } ++ ++ /* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card ++ * seems to crash randomly after setting the TX ring write pointer when ++ * ASPM powersaving is enabled. A workaround seems to be keeping the bus ++ * busy by reading a random register afterwards. ++ */ ++ mwifiex_read_reg(adapter, PCI_VENDOR_ID, &rx_val); ++ + if ((mwifiex_pcie_txbd_not_full(card)) && + tx_param->next_pkt_len) { + /* have more packets and TxBD still can hold more */ diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c index 5fde2e2f1fea..422a8d31ed7f 100644 --- a/drivers/net/wireless/marvell/mwifiex/scan.c @@ -56145,8 +74933,35 @@ index 8548027abf71..aa84fdb70983 100644 return 0; } +diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c +index 09185a1f7379..2c4225e57c39 100644 +--- a/drivers/net/wireless/marvell/mwifiex/usb.c ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c +@@ -473,6 +473,22 @@ static int mwifiex_usb_probe(struct usb_interface *intf, + } + } + ++ switch (card->usb_boot_state) { ++ case USB8XXX_FW_DNLD: ++ /* Reject broken descriptors. */ ++ if (!card->rx_cmd_ep || !card->tx_cmd_ep) ++ return -ENODEV; ++ if (card->bulk_out_maxpktsize == 0) ++ return -ENODEV; ++ break; ++ case USB8XXX_FW_READY: ++ /* Assume the driver can handle missing endpoints for now. */ ++ break; ++ default: ++ WARN_ON(1); ++ return -ENODEV; ++ } ++ + usb_set_intfdata(intf, card); + + ret = mwifiex_add_card(card, &add_remove_card_sem, &usb_ops, diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c -index b1b400b59d86..66cd38d4f199 100644 +index b1b400b59d86..c6f008796ff1 100644 --- a/drivers/net/wireless/marvell/mwl8k.c +++ b/drivers/net/wireless/marvell/mwl8k.c @@ -1459,6 +1459,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index) @@ -56157,6 +74972,16 @@ index b1b400b59d86..66cd38d4f199 100644 return -ENOMEM; } +@@ -5782,8 +5783,8 @@ static void mwl8k_fw_state_machine(const struct firmware *fw, void *context) + fail: + priv->fw_state = FW_STATE_ERROR; + complete(&priv->firmware_loading_complete); +- device_release_driver(&priv->pdev->dev); + mwl8k_release_firmware(priv); ++ device_release_driver(&priv->pdev->dev); + } + + #define MAX_RESTART_ATTEMPTS 1 diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c index 56cad16e70ca..1b68aef03fe2 100644 --- a/drivers/net/wireless/mediatek/mt7601u/dma.c @@ -56200,6 +75025,73 @@ index da6faea092d6..80d0f64205f8 100644 } static void +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c +index e6668ffb77e6..49fb8bba3d91 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c +@@ -31,7 +31,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + val = priv->io_dmabuf->bits8; + mutex_unlock(&priv->io_mutex); +@@ -48,7 +48,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + val = priv->io_dmabuf->bits16; + mutex_unlock(&priv->io_mutex); +@@ -65,7 +65,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), + RTL8187_REQ_GET_REG, RTL8187_REQT_READ, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + val = priv->io_dmabuf->bits32; + mutex_unlock(&priv->io_mutex); +@@ -82,7 +82,7 @@ void rtl818x_iowrite8_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits8, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -96,7 +96,7 @@ void rtl818x_iowrite16_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits16, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -110,7 +110,7 @@ void rtl818x_iowrite32_idx(struct rtl8187_priv *priv, + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + (unsigned long)addr, idx & 0x03, +- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); ++ &priv->io_dmabuf->bits32, sizeof(val), 500); + + mutex_unlock(&priv->io_mutex); + } +@@ -186,7 +186,7 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data) + usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), + RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, + addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data), +- HZ / 2); ++ 500); + + mutex_unlock(&priv->io_mutex); + diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c index 18d5984b78da..e73613b9f2f5 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c @@ -56342,6 +75234,19 @@ index 1f02461de261..e524573aa8a0 100644 if (unlikely(!_urb)) { RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Can't allocate urb. Drop skb!\n"); +diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c +index 974387ad1e8c..83cbaac877ea 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_usb.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c +@@ -42,7 +42,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter, + buf, + len, + &transfer, +- HZ * 5); ++ USB_CTRL_SET_TIMEOUT); + + if (status < 0) { + rsi_dbg(ERR_ZONE, diff --git a/drivers/net/wireless/st/cw1200/cw1200_sdio.c b/drivers/net/wireless/st/cw1200/cw1200_sdio.c index d3acc85932a5..de92107549ee 100644 --- a/drivers/net/wireless/st/cw1200/cw1200_sdio.c @@ -56738,7 +75643,7 @@ index 932f3f81e8cf..959844a10861 100644 else iwe.u.data.flags = IW_ENCODE_DISABLED; diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h -index 5b1d2e8402d9..347c796afd4e 100644 +index 5b1d2e8402d9..bfa3c6aaebe6 100644 --- a/drivers/net/xen-netback/common.h +++ b/drivers/net/xen-netback/common.h @@ -140,6 +140,20 @@ struct xenvif_queue { /* Per-queue data for xenvif */ @@ -56762,7 +75667,15 @@ index 5b1d2e8402d9..347c796afd4e 100644 /* Use NAPI for guest TX */ struct napi_struct napi; /* When feature-split-event-channels = 0, tx_irq = rx_irq. */ -@@ -356,6 +370,7 @@ int xenvif_dealloc_kthread(void *data); +@@ -189,6 +203,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */ + unsigned int rx_queue_max; + unsigned int rx_queue_len; + unsigned long last_rx_time; ++ unsigned int rx_slots_needed; + bool stalled; + + struct xenvif_copy_state rx_copy; +@@ -356,6 +371,7 @@ int xenvif_dealloc_kthread(void *data); irqreturn_t xenvif_ctrl_irq_fn(int irq, void *data); @@ -56894,7 +75807,7 @@ index 46008f284550..d9d06dc689ed 100644 queue->rx_irq_name, queue); if (err < 0) diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index a469fbe1abaf..f7fd8b5a6a8c 100644 +index a469fbe1abaf..3016869b4afd 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -162,6 +162,10 @@ void xenvif_napi_schedule_or_enable_events(struct xenvif_queue *queue) @@ -56908,6 +75821,15 @@ index a469fbe1abaf..f7fd8b5a6a8c 100644 } static void tx_add_credit(struct xenvif_queue *queue) +@@ -488,7 +492,7 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue, + * the header's copy failed, and they are + * sharing a slot, send an error + */ +- if (i == 0 && sharedslot) ++ if (i == 0 && !first_shinfo && sharedslot) + xenvif_idx_release(queue, pending_idx, + XEN_NETIF_RSP_ERROR); + else @@ -1329,7 +1333,15 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget) NULL, queue->pages_to_map, @@ -56942,37 +75864,134 @@ index a469fbe1abaf..f7fd8b5a6a8c 100644 return IRQ_HANDLED; } diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c -index b1cf7c6f407a..ddfb1cfa2dd9 100644 +index b1cf7c6f407a..29c7645f5780 100644 --- a/drivers/net/xen-netback/rx.c +++ b/drivers/net/xen-netback/rx.c -@@ -38,10 +38,15 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) - RING_IDX prod, cons; - struct sk_buff *skb; - int needed; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&queue->rx_queue.lock, flags); +@@ -33,22 +33,37 @@ + #include + #include - skb = skb_peek(&queue->rx_queue); -- if (!skb) -+ if (!skb) { -+ spin_unlock_irqrestore(&queue->rx_queue.lock, flags); - return false; ++/* ++ * Update the needed ring page slots for the first SKB queued. ++ * Note that any call sequence outside the RX thread calling this function ++ * needs to wake up the RX thread via a call of xenvif_kick_thread() ++ * afterwards in order to avoid a race with putting the thread to sleep. ++ */ ++static void xenvif_update_needed_slots(struct xenvif_queue *queue, ++ const struct sk_buff *skb) ++{ ++ unsigned int needed = 0; ++ ++ if (skb) { ++ needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE); ++ if (skb_is_gso(skb)) ++ needed++; ++ if (skb->sw_hash) ++ needed++; + } - - needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE); - if (skb_is_gso(skb)) -@@ -49,6 +54,8 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) - if (skb->sw_hash) - needed++; - -+ spin_unlock_irqrestore(&queue->rx_queue.lock, flags); + ++ WRITE_ONCE(queue->rx_slots_needed, needed); ++} ++ + static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue) + { + RING_IDX prod, cons; +- struct sk_buff *skb; +- int needed; ++ unsigned int needed; + +- skb = skb_peek(&queue->rx_queue); +- if (!skb) ++ needed = READ_ONCE(queue->rx_slots_needed); ++ if (!needed) + return false; + +- needed = DIV_ROUND_UP(skb->len, XEN_PAGE_SIZE); +- if (skb_is_gso(skb)) +- needed++; +- if (skb->sw_hash) +- needed++; +- do { prod = queue->rx.sring->req_prod; cons = queue->rx.req_cons; -@@ -490,13 +497,13 @@ static bool xenvif_rx_queue_ready(struct xenvif_queue *queue) - return queue->stalled && prod - cons >= 1; +@@ -73,13 +88,19 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb) + + spin_lock_irqsave(&queue->rx_queue.lock, flags); + +- __skb_queue_tail(&queue->rx_queue, skb); +- +- queue->rx_queue_len += skb->len; +- if (queue->rx_queue_len > queue->rx_queue_max) { ++ if (queue->rx_queue_len >= queue->rx_queue_max) { + struct net_device *dev = queue->vif->dev; + + netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id)); ++ kfree_skb(skb); ++ queue->vif->dev->stats.rx_dropped++; ++ } else { ++ if (skb_queue_empty(&queue->rx_queue)) ++ xenvif_update_needed_slots(queue, skb); ++ ++ __skb_queue_tail(&queue->rx_queue, skb); ++ ++ queue->rx_queue_len += skb->len; + } + + spin_unlock_irqrestore(&queue->rx_queue.lock, flags); +@@ -93,6 +114,8 @@ static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue) + + skb = __skb_dequeue(&queue->rx_queue); + if (skb) { ++ xenvif_update_needed_slots(queue, skb_peek(&queue->rx_queue)); ++ + queue->rx_queue_len -= skb->len; + if (queue->rx_queue_len < queue->rx_queue_max) { + struct netdev_queue *txq; +@@ -127,6 +150,7 @@ static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue) + break; + xenvif_rx_dequeue(queue); + kfree_skb(skb); ++ queue->vif->dev->stats.rx_dropped++; + } + } + +@@ -467,36 +491,40 @@ void xenvif_rx_action(struct xenvif_queue *queue) + xenvif_rx_copy_flush(queue); + } + +-static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue) ++static RING_IDX xenvif_rx_queue_slots(const struct xenvif_queue *queue) + { + RING_IDX prod, cons; + + prod = queue->rx.sring->req_prod; + cons = queue->rx.req_cons; + ++ return prod - cons; ++} ++ ++static bool xenvif_rx_queue_stalled(const struct xenvif_queue *queue) ++{ ++ unsigned int needed = READ_ONCE(queue->rx_slots_needed); ++ + return !queue->stalled && +- prod - cons < 1 && ++ xenvif_rx_queue_slots(queue) < needed && + time_after(jiffies, + queue->last_rx_time + queue->vif->stall_timeout); + } + + static bool xenvif_rx_queue_ready(struct xenvif_queue *queue) + { +- RING_IDX prod, cons; ++ unsigned int needed = READ_ONCE(queue->rx_slots_needed); + +- prod = queue->rx.sring->req_prod; +- cons = queue->rx.req_cons; +- +- return queue->stalled && prod - cons >= 1; ++ return queue->stalled && xenvif_rx_queue_slots(queue) >= needed; } -static bool xenvif_have_rx_work(struct xenvif_queue *queue) @@ -56987,7 +76006,7 @@ index b1cf7c6f407a..ddfb1cfa2dd9 100644 queue->vif->disabled; } -@@ -527,15 +534,20 @@ static void xenvif_wait_for_rx_work(struct xenvif_queue *queue) +@@ -527,15 +555,20 @@ static void xenvif_wait_for_rx_work(struct xenvif_queue *queue) { DEFINE_WAIT(wait); @@ -57050,7 +76069,7 @@ index b44f37fff890..e6646c8a7bdb 100644 netif_tx_wake_all_queues(be->vif->dev); diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 6d391a268469..ceaf6b30d683 100644 +index 6d391a268469..65a50bc5661d 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -62,6 +62,8 @@ module_param_named(max_queues, xennet_max_queues, uint, 0644); @@ -57062,7 +76081,711 @@ index 6d391a268469..ceaf6b30d683 100644 static const struct ethtool_ops xennet_ethtool_ops; struct netfront_cb { -@@ -1355,12 +1357,15 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) +@@ -118,21 +120,17 @@ struct netfront_queue { + + /* + * {tx,rx}_skbs store outstanding skbuffs. Free tx_skb entries +- * are linked from tx_skb_freelist through skb_entry.link. +- * +- * NB. Freelist index entries are always going to be less than +- * PAGE_OFFSET, whereas pointers to skbs will always be equal or +- * greater than PAGE_OFFSET: we use this property to distinguish +- * them. ++ * are linked from tx_skb_freelist through tx_link. + */ +- union skb_entry { +- struct sk_buff *skb; +- unsigned long link; +- } tx_skbs[NET_TX_RING_SIZE]; ++ struct sk_buff *tx_skbs[NET_TX_RING_SIZE]; ++ unsigned short tx_link[NET_TX_RING_SIZE]; ++#define TX_LINK_NONE 0xffff ++#define TX_PENDING 0xfffe + grant_ref_t gref_tx_head; + grant_ref_t grant_tx_ref[NET_TX_RING_SIZE]; + struct page *grant_tx_page[NET_TX_RING_SIZE]; + unsigned tx_skb_freelist; ++ unsigned int tx_pend_queue; + + spinlock_t rx_lock ____cacheline_aligned_in_smp; + struct xen_netif_rx_front_ring rx; +@@ -143,6 +141,9 @@ struct netfront_queue { + struct sk_buff *rx_skbs[NET_RX_RING_SIZE]; + grant_ref_t gref_rx_head; + grant_ref_t grant_rx_ref[NET_RX_RING_SIZE]; ++ ++ unsigned int rx_rsp_unconsumed; ++ spinlock_t rx_cons_lock; + }; + + struct netfront_info { +@@ -158,6 +159,9 @@ struct netfront_info { + struct netfront_stats __percpu *rx_stats; + struct netfront_stats __percpu *tx_stats; + ++ /* Is device behaving sane? */ ++ bool broken; ++ + atomic_t rx_gso_checksum_fixup; + }; + +@@ -166,33 +170,25 @@ struct netfront_rx_info { + struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX - 1]; + }; + +-static void skb_entry_set_link(union skb_entry *list, unsigned short id) +-{ +- list->link = id; +-} +- +-static int skb_entry_is_link(const union skb_entry *list) +-{ +- BUILD_BUG_ON(sizeof(list->skb) != sizeof(list->link)); +- return (unsigned long)list->skb < PAGE_OFFSET; +-} +- + /* + * Access macros for acquiring freeing slots in tx_skbs[]. + */ + +-static void add_id_to_freelist(unsigned *head, union skb_entry *list, +- unsigned short id) ++static void add_id_to_list(unsigned *head, unsigned short *list, ++ unsigned short id) + { +- skb_entry_set_link(&list[id], *head); ++ list[id] = *head; + *head = id; + } + +-static unsigned short get_id_from_freelist(unsigned *head, +- union skb_entry *list) ++static unsigned short get_id_from_list(unsigned *head, unsigned short *list) + { + unsigned int id = *head; +- *head = list[id].link; ++ ++ if (id != TX_LINK_NONE) { ++ *head = list[id]; ++ list[id] = TX_LINK_NONE; ++ } + return id; + } + +@@ -350,7 +346,7 @@ static int xennet_open(struct net_device *dev) + unsigned int i = 0; + struct netfront_queue *queue = NULL; + +- if (!np->queues) ++ if (!np->queues || np->broken) + return -ENODEV; + + for (i = 0; i < num_queues; ++i) { +@@ -372,33 +368,56 @@ static int xennet_open(struct net_device *dev) + return 0; + } + +-static void xennet_tx_buf_gc(struct netfront_queue *queue) ++static bool xennet_tx_buf_gc(struct netfront_queue *queue) + { + RING_IDX cons, prod; + unsigned short id; + struct sk_buff *skb; + bool more_to_do; ++ bool work_done = false; ++ const struct device *dev = &queue->info->netdev->dev; + + BUG_ON(!netif_carrier_ok(queue->info->netdev)); + + do { + prod = queue->tx.sring->rsp_prod; ++ if (RING_RESPONSE_PROD_OVERFLOW(&queue->tx, prod)) { ++ dev_alert(dev, "Illegal number of responses %u\n", ++ prod - queue->tx.rsp_cons); ++ goto err; ++ } + rmb(); /* Ensure we see responses up to 'rp'. */ + + for (cons = queue->tx.rsp_cons; cons != prod; cons++) { +- struct xen_netif_tx_response *txrsp; ++ struct xen_netif_tx_response txrsp; ++ ++ work_done = true; + +- txrsp = RING_GET_RESPONSE(&queue->tx, cons); +- if (txrsp->status == XEN_NETIF_RSP_NULL) ++ RING_COPY_RESPONSE(&queue->tx, cons, &txrsp); ++ if (txrsp.status == XEN_NETIF_RSP_NULL) + continue; + +- id = txrsp->id; +- skb = queue->tx_skbs[id].skb; ++ id = txrsp.id; ++ if (id >= RING_SIZE(&queue->tx)) { ++ dev_alert(dev, ++ "Response has incorrect id (%u)\n", ++ id); ++ goto err; ++ } ++ if (queue->tx_link[id] != TX_PENDING) { ++ dev_alert(dev, ++ "Response for inactive request\n"); ++ goto err; ++ } ++ ++ queue->tx_link[id] = TX_LINK_NONE; ++ skb = queue->tx_skbs[id]; ++ queue->tx_skbs[id] = NULL; + if (unlikely(gnttab_query_foreign_access( + queue->grant_tx_ref[id]) != 0)) { +- pr_alert("%s: warning -- grant still in use by backend domain\n", +- __func__); +- BUG(); ++ dev_alert(dev, ++ "Grant still in use by backend domain\n"); ++ goto err; + } + gnttab_end_foreign_access_ref( + queue->grant_tx_ref[id], GNTMAP_readonly); +@@ -406,7 +425,7 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue) + &queue->gref_tx_head, queue->grant_tx_ref[id]); + queue->grant_tx_ref[id] = GRANT_INVALID_REF; + queue->grant_tx_page[id] = NULL; +- add_id_to_freelist(&queue->tx_skb_freelist, queue->tx_skbs, id); ++ add_id_to_list(&queue->tx_skb_freelist, queue->tx_link, id); + dev_kfree_skb_irq(skb); + } + +@@ -416,13 +435,22 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue) + } while (more_to_do); + + xennet_maybe_wake_tx(queue); ++ ++ return work_done; ++ ++ err: ++ queue->info->broken = true; ++ dev_alert(dev, "Disabled for further use\n"); ++ ++ return work_done; + } + + struct xennet_gnttab_make_txreq { + struct netfront_queue *queue; + struct sk_buff *skb; + struct page *page; +- struct xen_netif_tx_request *tx; /* Last request */ ++ struct xen_netif_tx_request *tx; /* Last request on ring page */ ++ struct xen_netif_tx_request tx_local; /* Last request local copy*/ + unsigned int size; + }; + +@@ -438,7 +466,7 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset, + struct netfront_queue *queue = info->queue; + struct sk_buff *skb = info->skb; + +- id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs); ++ id = get_id_from_list(&queue->tx_skb_freelist, queue->tx_link); + tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++); + ref = gnttab_claim_grant_reference(&queue->gref_tx_head); + WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref)); +@@ -446,34 +474,37 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset, + gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id, + gfn, GNTMAP_readonly); + +- queue->tx_skbs[id].skb = skb; ++ queue->tx_skbs[id] = skb; + queue->grant_tx_page[id] = page; + queue->grant_tx_ref[id] = ref; + +- tx->id = id; +- tx->gref = ref; +- tx->offset = offset; +- tx->size = len; +- tx->flags = 0; ++ info->tx_local.id = id; ++ info->tx_local.gref = ref; ++ info->tx_local.offset = offset; ++ info->tx_local.size = len; ++ info->tx_local.flags = 0; ++ ++ *tx = info->tx_local; ++ ++ /* ++ * Put the request in the pending queue, it will be set to be pending ++ * when the producer index is about to be raised. ++ */ ++ add_id_to_list(&queue->tx_pend_queue, queue->tx_link, id); + + info->tx = tx; +- info->size += tx->size; ++ info->size += info->tx_local.size; + } + + static struct xen_netif_tx_request *xennet_make_first_txreq( +- struct netfront_queue *queue, struct sk_buff *skb, +- struct page *page, unsigned int offset, unsigned int len) ++ struct xennet_gnttab_make_txreq *info, ++ unsigned int offset, unsigned int len) + { +- struct xennet_gnttab_make_txreq info = { +- .queue = queue, +- .skb = skb, +- .page = page, +- .size = 0, +- }; ++ info->size = 0; + +- gnttab_for_one_grant(page, offset, len, xennet_tx_setup_grant, &info); ++ gnttab_for_one_grant(info->page, offset, len, xennet_tx_setup_grant, info); + +- return info.tx; ++ return info->tx; + } + + static void xennet_make_one_txreq(unsigned long gfn, unsigned int offset, +@@ -486,35 +517,27 @@ static void xennet_make_one_txreq(unsigned long gfn, unsigned int offset, + xennet_tx_setup_grant(gfn, offset, len, data); + } + +-static struct xen_netif_tx_request *xennet_make_txreqs( +- struct netfront_queue *queue, struct xen_netif_tx_request *tx, +- struct sk_buff *skb, struct page *page, ++static void xennet_make_txreqs( ++ struct xennet_gnttab_make_txreq *info, ++ struct page *page, + unsigned int offset, unsigned int len) + { +- struct xennet_gnttab_make_txreq info = { +- .queue = queue, +- .skb = skb, +- .tx = tx, +- }; +- + /* Skip unused frames from start of page */ + page += offset >> PAGE_SHIFT; + offset &= ~PAGE_MASK; + + while (len) { +- info.page = page; +- info.size = 0; ++ info->page = page; ++ info->size = 0; + + gnttab_foreach_grant_in_range(page, offset, len, + xennet_make_one_txreq, +- &info); ++ info); + + page++; + offset = 0; +- len -= info.size; ++ len -= info->size; + } +- +- return info.tx; + } + + /* +@@ -561,13 +584,22 @@ static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb, + return queue_idx; + } + ++static void xennet_mark_tx_pending(struct netfront_queue *queue) ++{ ++ unsigned int i; ++ ++ while ((i = get_id_from_list(&queue->tx_pend_queue, queue->tx_link)) != ++ TX_LINK_NONE) ++ queue->tx_link[i] = TX_PENDING; ++} ++ + #define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1) + + static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct netfront_info *np = netdev_priv(dev); + struct netfront_stats *tx_stats = this_cpu_ptr(np->tx_stats); +- struct xen_netif_tx_request *tx, *first_tx; ++ struct xen_netif_tx_request *first_tx; + unsigned int i; + int notify; + int slots; +@@ -576,6 +608,7 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) + unsigned int len; + unsigned long flags; + struct netfront_queue *queue = NULL; ++ struct xennet_gnttab_make_txreq info = { }; + unsigned int num_queues = dev->real_num_tx_queues; + u16 queue_index; + struct sk_buff *nskb; +@@ -583,6 +616,8 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) + /* Drop the packet if no queues are set up */ + if (num_queues < 1) + goto drop; ++ if (unlikely(np->broken)) ++ goto drop; + /* Determine which queue to transmit this SKB on */ + queue_index = skb_get_queue_mapping(skb); + queue = &np->queues[queue_index]; +@@ -633,21 +668,24 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) + } + + /* First request for the linear area. */ +- first_tx = tx = xennet_make_first_txreq(queue, skb, +- page, offset, len); +- offset += tx->size; ++ info.queue = queue; ++ info.skb = skb; ++ info.page = page; ++ first_tx = xennet_make_first_txreq(&info, offset, len); ++ offset += info.tx_local.size; + if (offset == PAGE_SIZE) { + page++; + offset = 0; + } +- len -= tx->size; ++ len -= info.tx_local.size; + + if (skb->ip_summed == CHECKSUM_PARTIAL) + /* local packet? */ +- tx->flags |= XEN_NETTXF_csum_blank | XEN_NETTXF_data_validated; ++ first_tx->flags |= XEN_NETTXF_csum_blank | ++ XEN_NETTXF_data_validated; + else if (skb->ip_summed == CHECKSUM_UNNECESSARY) + /* remote but checksummed. */ +- tx->flags |= XEN_NETTXF_data_validated; ++ first_tx->flags |= XEN_NETTXF_data_validated; + + /* Optional extra info after the first request. */ + if (skb_shinfo(skb)->gso_size) { +@@ -656,7 +694,7 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) + gso = (struct xen_netif_extra_info *) + RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++); + +- tx->flags |= XEN_NETTXF_extra_info; ++ first_tx->flags |= XEN_NETTXF_extra_info; + + gso->u.gso.size = skb_shinfo(skb)->gso_size; + gso->u.gso.type = (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) ? +@@ -670,19 +708,21 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) + } + + /* Requests for the rest of the linear area. */ +- tx = xennet_make_txreqs(queue, tx, skb, page, offset, len); ++ xennet_make_txreqs(&info, page, offset, len); + + /* Requests for all the frags. */ + for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) { + skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; +- tx = xennet_make_txreqs(queue, tx, skb, +- skb_frag_page(frag), frag->page_offset, ++ xennet_make_txreqs(&info, skb_frag_page(frag), ++ frag->page_offset, + skb_frag_size(frag)); + } + + /* First request has the packet length. */ + first_tx->size = skb->len; + ++ xennet_mark_tx_pending(queue); ++ + RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&queue->tx, notify); + if (notify) + notify_remote_via_irq(queue->tx_irq); +@@ -722,6 +762,16 @@ static int xennet_close(struct net_device *dev) + return 0; + } + ++static void xennet_set_rx_rsp_cons(struct netfront_queue *queue, RING_IDX val) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&queue->rx_cons_lock, flags); ++ queue->rx.rsp_cons = val; ++ queue->rx_rsp_unconsumed = RING_HAS_UNCONSUMED_RESPONSES(&queue->rx); ++ spin_unlock_irqrestore(&queue->rx_cons_lock, flags); ++} ++ + static void xennet_move_rx_slot(struct netfront_queue *queue, struct sk_buff *skb, + grant_ref_t ref) + { +@@ -740,7 +790,7 @@ static int xennet_get_extras(struct netfront_queue *queue, + RING_IDX rp) + + { +- struct xen_netif_extra_info *extra; ++ struct xen_netif_extra_info extra; + struct device *dev = &queue->info->netdev->dev; + RING_IDX cons = queue->rx.rsp_cons; + int err = 0; +@@ -756,26 +806,24 @@ static int xennet_get_extras(struct netfront_queue *queue, + break; + } + +- extra = (struct xen_netif_extra_info *) +- RING_GET_RESPONSE(&queue->rx, ++cons); ++ RING_COPY_RESPONSE(&queue->rx, ++cons, &extra); + +- if (unlikely(!extra->type || +- extra->type >= XEN_NETIF_EXTRA_TYPE_MAX)) { ++ if (unlikely(!extra.type || ++ extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) { + if (net_ratelimit()) + dev_warn(dev, "Invalid extra type: %d\n", +- extra->type); ++ extra.type); + err = -EINVAL; + } else { +- memcpy(&extras[extra->type - 1], extra, +- sizeof(*extra)); ++ extras[extra.type - 1] = extra; + } + + skb = xennet_get_rx_skb(queue, cons); + ref = xennet_get_rx_ref(queue, cons); + xennet_move_rx_slot(queue, skb, ref); +- } while (extra->flags & XEN_NETIF_EXTRA_FLAG_MORE); ++ } while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE); + +- queue->rx.rsp_cons = cons; ++ xennet_set_rx_rsp_cons(queue, cons); + return err; + } + +@@ -783,7 +831,7 @@ static int xennet_get_responses(struct netfront_queue *queue, + struct netfront_rx_info *rinfo, RING_IDX rp, + struct sk_buff_head *list) + { +- struct xen_netif_rx_response *rx = &rinfo->rx; ++ struct xen_netif_rx_response *rx = &rinfo->rx, rx_local; + struct xen_netif_extra_info *extras = rinfo->extras; + struct device *dev = &queue->info->netdev->dev; + RING_IDX cons = queue->rx.rsp_cons; +@@ -841,7 +889,8 @@ static int xennet_get_responses(struct netfront_queue *queue, + break; + } + +- rx = RING_GET_RESPONSE(&queue->rx, cons + slots); ++ RING_COPY_RESPONSE(&queue->rx, cons + slots, &rx_local); ++ rx = &rx_local; + skb = xennet_get_rx_skb(queue, cons + slots); + ref = xennet_get_rx_ref(queue, cons + slots); + slots++; +@@ -854,7 +903,7 @@ static int xennet_get_responses(struct netfront_queue *queue, + } + + if (unlikely(err)) +- queue->rx.rsp_cons = cons + slots; ++ xennet_set_rx_rsp_cons(queue, cons + slots); + + return err; + } +@@ -896,10 +945,11 @@ static int xennet_fill_frags(struct netfront_queue *queue, + struct sk_buff *nskb; + + while ((nskb = __skb_dequeue(list))) { +- struct xen_netif_rx_response *rx = +- RING_GET_RESPONSE(&queue->rx, ++cons); ++ struct xen_netif_rx_response rx; + skb_frag_t *nfrag = &skb_shinfo(nskb)->frags[0]; + ++ RING_COPY_RESPONSE(&queue->rx, ++cons, &rx); ++ + if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) { + unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to; + +@@ -907,20 +957,21 @@ static int xennet_fill_frags(struct netfront_queue *queue, + __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); + } + if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { +- queue->rx.rsp_cons = ++cons + skb_queue_len(list); ++ xennet_set_rx_rsp_cons(queue, ++ ++cons + skb_queue_len(list)); + kfree_skb(nskb); + return -ENOENT; + } + + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, + skb_frag_page(nfrag), +- rx->offset, rx->status, PAGE_SIZE); ++ rx.offset, rx.status, PAGE_SIZE); + + skb_shinfo(nskb)->nr_frags = 0; + kfree_skb(nskb); + } + +- queue->rx.rsp_cons = cons; ++ xennet_set_rx_rsp_cons(queue, cons); + + return 0; + } +@@ -1007,12 +1058,19 @@ static int xennet_poll(struct napi_struct *napi, int budget) + skb_queue_head_init(&tmpq); + + rp = queue->rx.sring->rsp_prod; ++ if (RING_RESPONSE_PROD_OVERFLOW(&queue->rx, rp)) { ++ dev_alert(&dev->dev, "Illegal number of responses %u\n", ++ rp - queue->rx.rsp_cons); ++ queue->info->broken = true; ++ spin_unlock(&queue->rx_lock); ++ return 0; ++ } + rmb(); /* Ensure we see queued responses up to 'rp'. */ + + i = queue->rx.rsp_cons; + work_done = 0; + while ((i != rp) && (work_done < budget)) { +- memcpy(rx, RING_GET_RESPONSE(&queue->rx, i), sizeof(*rx)); ++ RING_COPY_RESPONSE(&queue->rx, i, rx); + memset(extras, 0, sizeof(rinfo.extras)); + + err = xennet_get_responses(queue, &rinfo, rp, &tmpq); +@@ -1034,7 +1092,9 @@ static int xennet_poll(struct napi_struct *napi, int budget) + + if (unlikely(xennet_set_skb_gso(skb, gso))) { + __skb_queue_head(&tmpq, skb); +- queue->rx.rsp_cons += skb_queue_len(&tmpq); ++ xennet_set_rx_rsp_cons(queue, ++ queue->rx.rsp_cons + ++ skb_queue_len(&tmpq)); + goto err; + } + } +@@ -1058,7 +1118,8 @@ static int xennet_poll(struct napi_struct *napi, int budget) + + __skb_queue_tail(&rxq, skb); + +- i = ++queue->rx.rsp_cons; ++ i = queue->rx.rsp_cons + 1; ++ xennet_set_rx_rsp_cons(queue, i); + work_done++; + } + +@@ -1136,17 +1197,18 @@ static void xennet_release_tx_bufs(struct netfront_queue *queue) + + for (i = 0; i < NET_TX_RING_SIZE; i++) { + /* Skip over entries which are actually freelist references */ +- if (skb_entry_is_link(&queue->tx_skbs[i])) ++ if (!queue->tx_skbs[i]) + continue; + +- skb = queue->tx_skbs[i].skb; ++ skb = queue->tx_skbs[i]; ++ queue->tx_skbs[i] = NULL; + get_page(queue->grant_tx_page[i]); + gnttab_end_foreign_access(queue->grant_tx_ref[i], + GNTMAP_readonly, + (unsigned long)page_address(queue->grant_tx_page[i])); + queue->grant_tx_page[i] = NULL; + queue->grant_tx_ref[i] = GRANT_INVALID_REF; +- add_id_to_freelist(&queue->tx_skb_freelist, queue->tx_skbs, i); ++ add_id_to_list(&queue->tx_skb_freelist, queue->tx_link, i); + dev_kfree_skb_irq(skb); + } + } +@@ -1241,34 +1303,79 @@ static int xennet_set_features(struct net_device *dev, + return 0; + } + +-static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id) ++static bool xennet_handle_tx(struct netfront_queue *queue, unsigned int *eoi) + { +- struct netfront_queue *queue = dev_id; + unsigned long flags; + ++ if (unlikely(queue->info->broken)) ++ return false; ++ + spin_lock_irqsave(&queue->tx_lock, flags); +- xennet_tx_buf_gc(queue); ++ if (xennet_tx_buf_gc(queue)) ++ *eoi = 0; + spin_unlock_irqrestore(&queue->tx_lock, flags); + ++ return true; ++} ++ ++static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id) ++{ ++ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS; ++ ++ if (likely(xennet_handle_tx(dev_id, &eoiflag))) ++ xen_irq_lateeoi(irq, eoiflag); ++ + return IRQ_HANDLED; + } + +-static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id) ++static bool xennet_handle_rx(struct netfront_queue *queue, unsigned int *eoi) + { +- struct netfront_queue *queue = dev_id; +- struct net_device *dev = queue->info->netdev; ++ unsigned int work_queued; ++ unsigned long flags; + +- if (likely(netif_carrier_ok(dev) && +- RING_HAS_UNCONSUMED_RESPONSES(&queue->rx))) ++ if (unlikely(queue->info->broken)) ++ return false; ++ ++ spin_lock_irqsave(&queue->rx_cons_lock, flags); ++ work_queued = RING_HAS_UNCONSUMED_RESPONSES(&queue->rx); ++ if (work_queued > queue->rx_rsp_unconsumed) { ++ queue->rx_rsp_unconsumed = work_queued; ++ *eoi = 0; ++ } else if (unlikely(work_queued < queue->rx_rsp_unconsumed)) { ++ const struct device *dev = &queue->info->netdev->dev; ++ ++ spin_unlock_irqrestore(&queue->rx_cons_lock, flags); ++ dev_alert(dev, "RX producer index going backwards\n"); ++ dev_alert(dev, "Disabled for further use\n"); ++ queue->info->broken = true; ++ return false; ++ } ++ spin_unlock_irqrestore(&queue->rx_cons_lock, flags); ++ ++ if (likely(netif_carrier_ok(queue->info->netdev) && work_queued)) + napi_schedule(&queue->napi); + ++ return true; ++} ++ ++static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id) ++{ ++ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS; ++ ++ if (likely(xennet_handle_rx(dev_id, &eoiflag))) ++ xen_irq_lateeoi(irq, eoiflag); ++ + return IRQ_HANDLED; + } + + static irqreturn_t xennet_interrupt(int irq, void *dev_id) + { +- xennet_tx_interrupt(irq, dev_id); +- xennet_rx_interrupt(irq, dev_id); ++ unsigned int eoiflag = XEN_EOI_FLAG_SPURIOUS; ++ ++ if (xennet_handle_tx(dev_id, &eoiflag) && ++ xennet_handle_rx(dev_id, &eoiflag)) ++ xen_irq_lateeoi(irq, eoiflag); ++ + return IRQ_HANDLED; + } + +@@ -1279,6 +1386,10 @@ static void xennet_poll_controller(struct net_device *dev) + struct netfront_info *info = netdev_priv(dev); + unsigned int num_queues = dev->real_num_tx_queues; + unsigned int i; ++ ++ if (info->broken) ++ return; ++ + for (i = 0; i < num_queues; ++i) + xennet_interrupt(0, &info->queues[i]); + } +@@ -1355,12 +1466,15 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) netif_carrier_off(netdev); @@ -57084,7 +76807,104 @@ index 6d391a268469..ceaf6b30d683 100644 return netdev; exit: -@@ -2172,28 +2177,43 @@ static const struct attribute_group xennet_dev_group = { +@@ -1455,6 +1569,10 @@ static int netfront_resume(struct xenbus_device *dev) + + dev_dbg(&dev->dev, "%s\n", dev->nodename); + ++ netif_tx_lock_bh(info->netdev); ++ netif_device_detach(info->netdev); ++ netif_tx_unlock_bh(info->netdev); ++ + xennet_disconnect_backend(info); + return 0; + } +@@ -1489,9 +1607,10 @@ static int setup_netfront_single(struct netfront_queue *queue) + if (err < 0) + goto fail; + +- err = bind_evtchn_to_irqhandler(queue->tx_evtchn, +- xennet_interrupt, +- 0, queue->info->netdev->name, queue); ++ err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn, ++ xennet_interrupt, 0, ++ queue->info->netdev->name, ++ queue); + if (err < 0) + goto bind_fail; + queue->rx_evtchn = queue->tx_evtchn; +@@ -1519,18 +1638,18 @@ static int setup_netfront_split(struct netfront_queue *queue) + + snprintf(queue->tx_irq_name, sizeof(queue->tx_irq_name), + "%s-tx", queue->name); +- err = bind_evtchn_to_irqhandler(queue->tx_evtchn, +- xennet_tx_interrupt, +- 0, queue->tx_irq_name, queue); ++ err = bind_evtchn_to_irqhandler_lateeoi(queue->tx_evtchn, ++ xennet_tx_interrupt, 0, ++ queue->tx_irq_name, queue); + if (err < 0) + goto bind_tx_fail; + queue->tx_irq = err; + + snprintf(queue->rx_irq_name, sizeof(queue->rx_irq_name), + "%s-rx", queue->name); +- err = bind_evtchn_to_irqhandler(queue->rx_evtchn, +- xennet_rx_interrupt, +- 0, queue->rx_irq_name, queue); ++ err = bind_evtchn_to_irqhandler_lateeoi(queue->rx_evtchn, ++ xennet_rx_interrupt, 0, ++ queue->rx_irq_name, queue); + if (err < 0) + goto bind_rx_fail; + queue->rx_irq = err; +@@ -1632,6 +1751,7 @@ static int xennet_init_queue(struct netfront_queue *queue) + + spin_lock_init(&queue->tx_lock); + spin_lock_init(&queue->rx_lock); ++ spin_lock_init(&queue->rx_cons_lock); + + setup_timer(&queue->rx_refill_timer, rx_refill_timeout, + (unsigned long)queue); +@@ -1640,13 +1760,15 @@ static int xennet_init_queue(struct netfront_queue *queue) + snprintf(queue->name, sizeof(queue->name), "vif%s-q%u", + devid, queue->id); + +- /* Initialise tx_skbs as a free chain containing every entry. */ ++ /* Initialise tx_skb_freelist as a free chain containing every entry. */ + queue->tx_skb_freelist = 0; ++ queue->tx_pend_queue = TX_LINK_NONE; + for (i = 0; i < NET_TX_RING_SIZE; i++) { +- skb_entry_set_link(&queue->tx_skbs[i], i+1); ++ queue->tx_link[i] = i + 1; + queue->grant_tx_ref[i] = GRANT_INVALID_REF; + queue->grant_tx_page[i] = NULL; + } ++ queue->tx_link[NET_TX_RING_SIZE - 1] = TX_LINK_NONE; + + /* Clear out rx_skbs */ + for (i = 0; i < NET_RX_RING_SIZE; i++) { +@@ -1856,6 +1978,9 @@ static int talk_to_netback(struct xenbus_device *dev, + if (info->queues) + xennet_destroy_queues(info); + ++ /* For the case of a reconnect reset the "broken" indicator. */ ++ info->broken = false; ++ + err = xennet_create_queues(info, &num_queues); + if (err < 0) { + xenbus_dev_fatal(dev, err, "creating queues"); +@@ -2015,6 +2140,10 @@ static int xennet_connect(struct net_device *dev) + * domain a kick because we've probably just requeued some + * packets. + */ ++ netif_tx_lock_bh(np->netdev); ++ netif_device_attach(np->netdev); ++ netif_tx_unlock_bh(np->netdev); ++ + netif_carrier_on(np->netdev); + for (j = 0; j < num_queues; ++j) { + queue = &np->queues[j]; +@@ -2172,28 +2301,43 @@ static const struct attribute_group xennet_dev_group = { }; #endif /* CONFIG_SYSFS */ @@ -57144,8 +76964,22 @@ index 6d391a268469..ceaf6b30d683 100644 xennet_disconnect_backend(info); if (info->netdev->reg_state == NETREG_REGISTERED) +diff --git a/drivers/nfc/nfcsim.c b/drivers/nfc/nfcsim.c +index a466e7978466..11aa6a04ff46 100644 +--- a/drivers/nfc/nfcsim.c ++++ b/drivers/nfc/nfcsim.c +@@ -201,8 +201,7 @@ static void nfcsim_recv_wq(struct work_struct *work) + + if (!IS_ERR(skb)) + dev_kfree_skb(skb); +- +- skb = ERR_PTR(-ENODEV); ++ return; + } + + dev->cb(dev->nfc_digital_dev, dev->arg, skb); diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c -index d9c55830b2b2..6c495664d2cb 100644 +index d9c55830b2b2..806309ee4165 100644 --- a/drivers/nfc/pn533/pn533.c +++ b/drivers/nfc/pn533/pn533.c @@ -678,6 +678,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a, @@ -57158,6 +76992,51 @@ index d9c55830b2b2..6c495664d2cb 100644 return true; } +@@ -2072,7 +2075,7 @@ static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb) + frag = pn533_alloc_skb(dev, frag_size); + if (!frag) { + skb_queue_purge(&dev->fragment_skb); +- break; ++ return -ENOMEM; + } + + if (!dev->tgt_mode) { +@@ -2142,7 +2145,7 @@ static int pn533_transceive(struct nfc_dev *nfc_dev, + /* jumbo frame ? */ + if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) { + rc = pn533_fill_fragment_skbs(dev, skb); +- if (rc <= 0) ++ if (rc < 0) + goto error; + + skb = skb_dequeue(&dev->fragment_skb); +@@ -2214,7 +2217,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb) + /* let's split in multiple chunks if size's too big */ + if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) { + rc = pn533_fill_fragment_skbs(dev, skb); +- if (rc <= 0) ++ if (rc < 0) + goto error; + + /* get the first skb */ +diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c +index 151b220381f9..ed65993aae96 100644 +--- a/drivers/nfc/port100.c ++++ b/drivers/nfc/port100.c +@@ -1011,11 +1011,11 @@ static u64 port100_get_command_type_mask(struct port100 *dev) + + skb = port100_alloc_skb(dev, 0); + if (!skb) +- return -ENOMEM; ++ return 0; + + resp = port100_send_cmd_sync(dev, PORT100_CMD_GET_COMMAND_TYPE, skb); + if (IS_ERR(resp)) +- return PTR_ERR(resp); ++ return 0; + + if (resp->len < 8) + mask = 0; diff --git a/drivers/nfc/s3fwrn5/core.c b/drivers/nfc/s3fwrn5/core.c index 9d9c8d57a042..64b58455e620 100644 --- a/drivers/nfc/s3fwrn5/core.c @@ -57281,6 +77160,40 @@ index bd29e598bac1..2a820c1fdfcd 100644 INT_LBASIZE_ALIGNMENT = 64, }; +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index e2bce9385eda..c87f27d3ee31 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1927,7 +1927,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + result = nvme_dev_map(dev); + if (result) +- goto free; ++ goto put_pci; + + INIT_WORK(&dev->reset_work, nvme_reset_work); + INIT_WORK(&dev->remove_work, nvme_remove_dead_ctrl_work); +@@ -1938,7 +1938,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + result = nvme_setup_prp_pools(dev); + if (result) +- goto put_pci; ++ goto unmap; + + result = nvme_init_ctrl(&dev->ctrl, &pdev->dev, &nvme_pci_ctrl_ops, + id->driver_data); +@@ -1953,9 +1953,10 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + release_pools: + nvme_release_prp_pools(dev); ++ unmap: ++ nvme_dev_unmap(dev); + put_pci: + put_device(dev->dev); +- nvme_dev_unmap(dev); + free: + kfree(dev->queues); + kfree(dev); diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c index 96ea6c76be6e..fb2461cc3c69 100644 --- a/drivers/nvme/target/core.c @@ -57339,6 +77252,20 @@ index 96ea6c76be6e..fb2461cc3c69 100644 } static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl) +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index 0441be73c1d8..831e810561dd 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -729,7 +729,8 @@ static inline void nvmem_shift_read_buffer_in_place(struct nvmem_cell *cell, + *p-- = 0; + + /* clear msb bits if any leftover in the last byte */ +- *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0); ++ if (cell->nbits % BITS_PER_BYTE) ++ *p &= GENMASK((cell->nbits % BITS_PER_BYTE) - 1, 0); + } + + static int __nvmem_cell_read(struct nvmem_device *nvmem, diff --git a/drivers/of/address.c b/drivers/of/address.c index b87b3cdefc6d..b9c05daff9fe 100644 --- a/drivers/of/address.c @@ -57432,6 +77359,42 @@ index 4a1cab5b2121..2f72b86555bc 100644 if (this->base + this->size > next->base) { phys_addr_t this_end, next_end; +diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c +index d842ae5310f7..bbcff6ae61d6 100644 +--- a/drivers/parisc/dino.c ++++ b/drivers/parisc/dino.c +@@ -160,15 +160,6 @@ struct dino_device + (struct dino_device *)__pdata; }) + + +-/* Check if PCI device is behind a Card-mode Dino. */ +-static int pci_dev_is_behind_card_dino(struct pci_dev *dev) +-{ +- struct dino_device *dino_dev; +- +- dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge)); +- return is_card_dino(&dino_dev->hba.dev->id); +-} +- + /* + * Dino Configuration Space Accessor Functions + */ +@@ -452,6 +443,15 @@ static void quirk_cirrus_cardbus(struct pci_dev *dev) + DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_6832, quirk_cirrus_cardbus ); + + #ifdef CONFIG_TULIP ++/* Check if PCI device is behind a Card-mode Dino. */ ++static int pci_dev_is_behind_card_dino(struct pci_dev *dev) ++{ ++ struct dino_device *dino_dev; ++ ++ dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge)); ++ return is_card_dino(&dino_dev->hba.dev->id); ++} ++ + static void pci_fixup_tulip(struct pci_dev *dev) + { + if (!pci_dev_is_behind_card_dino(dev)) diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c index 188fab57d170..a7f542e784dd 100644 --- a/drivers/parisc/sba_iommu.c @@ -57445,6 +77408,19 @@ index 188fab57d170..a7f542e784dd 100644 iova_space_size = ~(READ_REG(ioc->ioc_hpa + IOC_IMASK) & 0xFFFFFFFFUL) + 1; if ((ioc->ibase < 0xfed00000UL) && ((ioc->ibase + iova_space_size) > 0xfee00000UL)) { +diff --git a/drivers/parport/ieee1284_ops.c b/drivers/parport/ieee1284_ops.c +index 2e21af43d91e..b6d808037045 100644 +--- a/drivers/parport/ieee1284_ops.c ++++ b/drivers/parport/ieee1284_ops.c +@@ -534,7 +534,7 @@ size_t parport_ieee1284_ecp_read_data (struct parport *port, + goto out; + + /* Yield the port for a while. */ +- if (count && dev->port->irq != PARPORT_IRQ_NONE) { ++ if (dev->port->irq != PARPORT_IRQ_NONE) { + parport_release (dev); + schedule_timeout_interruptible(msecs_to_jiffies(40)); + parport_claim_or_block (dev); diff --git a/drivers/pci/access.c b/drivers/pci/access.c index 7b5cf6d1181a..6f2a07567532 100644 --- a/drivers/pci/access.c @@ -57488,10 +77464,18 @@ index c288e5a52575..32001787cff3 100644 dev->is_added = 1; } diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c -index 1dbd09c91a7c..736d9f58438e 100644 +index 1dbd09c91a7c..08375e68f1c3 100644 --- a/drivers/pci/host/pci-aardvark.c +++ b/drivers/pci/host/pci-aardvark.c -@@ -363,10 +363,6 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) +@@ -110,6 +110,7 @@ + #define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58) + #define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C) + #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C) ++#define PCIE_MSI_DATA_MASK GENMASK(15, 0) + + /* PCIe window configuration */ + #define OB_WIN_BASE_ADDR 0x4c00 +@@ -363,10 +364,6 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) advk_pcie_wait_for_link(pcie); @@ -57502,6 +77486,29 @@ index 1dbd09c91a7c..736d9f58438e 100644 reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG); reg |= PCIE_CORE_CMD_MEM_ACCESS_EN | PCIE_CORE_CMD_IO_ACCESS_EN | +@@ -408,7 +405,7 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie) + else + str_posted = "Posted"; + +- dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n", ++ dev_dbg(dev, "%s PIO Response Status: %s, %#x @ %#x\n", + str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS)); + } + +@@ -789,8 +786,12 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie) + if (!(BIT(msi_idx) & msi_status)) + continue; + ++ /* ++ * msi_idx contains bits [4:0] of the msi_data and msi_data ++ * contains 16bit MSI interrupt number ++ */ + advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG); +- msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & 0xFF; ++ msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK; + generic_handle_irq(msi_data); + } + diff --git a/drivers/pci/host/pci-xgene-msi.c b/drivers/pci/host/pci-xgene-msi.c index a6456b578269..b6a099371ad2 100644 --- a/drivers/pci/host/pci-xgene-msi.c @@ -57635,6 +77642,303 @@ index a796301ea03f..ca9d832bd9f8 100644 rc = dlpar_remove_slot(drc_name); if (rc) +diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c +index 55ca14fbdd2a..161de28dc162 100644 +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -189,24 +189,25 @@ static inline __attribute_const__ u32 msi_mask(unsigned x) + * reliably as devices without an INTx disable bit will then generate a + * level IRQ which will never be cleared. + */ +-u32 __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag) ++void __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag) + { +- u32 mask_bits = desc->masked; ++ raw_spinlock_t *lock = &desc->dev->msi_lock; ++ unsigned long flags; + + if (pci_msi_ignore_mask || !desc->msi_attrib.maskbit) +- return 0; ++ return; + +- mask_bits &= ~mask; +- mask_bits |= flag; ++ raw_spin_lock_irqsave(lock, flags); ++ desc->masked &= ~mask; ++ desc->masked |= flag; + pci_write_config_dword(msi_desc_to_pci_dev(desc), desc->mask_pos, +- mask_bits); +- +- return mask_bits; ++ desc->masked); ++ raw_spin_unlock_irqrestore(lock, flags); + } + + static void msi_mask_irq(struct msi_desc *desc, u32 mask, u32 flag) + { +- desc->masked = __pci_msi_desc_mask_irq(desc, mask, flag); ++ __pci_msi_desc_mask_irq(desc, mask, flag); + } + + static void __iomem *pci_msix_desc_addr(struct msi_desc *desc) +@@ -321,10 +322,28 @@ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg) + /* Don't touch the hardware now */ + } else if (entry->msi_attrib.is_msix) { + void __iomem *base = pci_msix_desc_addr(entry); ++ bool unmasked = !(entry->masked & PCI_MSIX_ENTRY_CTRL_MASKBIT); ++ ++ /* ++ * The specification mandates that the entry is masked ++ * when the message is modified: ++ * ++ * "If software changes the Address or Data value of an ++ * entry while the entry is unmasked, the result is ++ * undefined." ++ */ ++ if (unmasked) ++ __pci_msix_desc_mask_irq(entry, PCI_MSIX_ENTRY_CTRL_MASKBIT); + + writel(msg->address_lo, base + PCI_MSIX_ENTRY_LOWER_ADDR); + writel(msg->address_hi, base + PCI_MSIX_ENTRY_UPPER_ADDR); + writel(msg->data, base + PCI_MSIX_ENTRY_DATA); ++ ++ if (unmasked) ++ __pci_msix_desc_mask_irq(entry, 0); ++ ++ /* Ensure that the writes are visible in the device */ ++ readl(base + PCI_MSIX_ENTRY_DATA); + } else { + int pos = dev->msi_cap; + u16 msgctl; +@@ -345,6 +364,8 @@ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg) + pci_write_config_word(dev, pos + PCI_MSI_DATA_32, + msg->data); + } ++ /* Ensure that the writes are visible in the device */ ++ pci_read_config_word(dev, pos + PCI_MSI_FLAGS, &msgctl); + } + entry->msg = *msg; + } +@@ -370,18 +391,6 @@ static void free_msi_irqs(struct pci_dev *dev) + for (i = 0; i < entry->nvec_used; i++) + BUG_ON(irq_has_action(entry->irq + i)); + +- pci_msi_teardown_msi_irqs(dev); +- +- list_for_each_entry_safe(entry, tmp, msi_list, list) { +- if (entry->msi_attrib.is_msix) { +- if (list_is_last(&entry->list, msi_list)) +- iounmap(entry->mask_base); +- } +- +- list_del(&entry->list); +- kfree(entry); +- } +- + if (dev->msi_irq_groups) { + sysfs_remove_groups(&dev->dev.kobj, dev->msi_irq_groups); + msi_attrs = dev->msi_irq_groups[0]->attrs; +@@ -397,6 +406,18 @@ static void free_msi_irqs(struct pci_dev *dev) + kfree(dev->msi_irq_groups); + dev->msi_irq_groups = NULL; + } ++ ++ pci_msi_teardown_msi_irqs(dev); ++ ++ list_for_each_entry_safe(entry, tmp, msi_list, list) { ++ if (entry->msi_attrib.is_msix) { ++ if (list_is_last(&entry->list, msi_list)) ++ iounmap(entry->mask_base); ++ } ++ ++ list_del(&entry->list); ++ free_msi_entry(entry); ++ } + } + + static void pci_intx_for_msi(struct pci_dev *dev, int enable) +@@ -639,21 +660,21 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, bool affinity) + /* Configure MSI capability structure */ + ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI); + if (ret) { +- msi_mask_irq(entry, mask, ~mask); ++ msi_mask_irq(entry, mask, 0); + free_msi_irqs(dev); + return ret; + } + + ret = msi_verify_entries(dev); + if (ret) { +- msi_mask_irq(entry, mask, ~mask); ++ msi_mask_irq(entry, mask, 0); + free_msi_irqs(dev); + return ret; + } + + ret = populate_msi_sysfs(dev); + if (ret) { +- msi_mask_irq(entry, mask, ~mask); ++ msi_mask_irq(entry, mask, 0); + free_msi_irqs(dev); + return ret; + } +@@ -694,6 +715,7 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base, + { + struct cpumask *curmsk, *masks = NULL; + struct msi_desc *entry; ++ void __iomem *addr; + int ret, i; + + if (affinity) { +@@ -716,6 +738,7 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base, + + entry->msi_attrib.is_msix = 1; + entry->msi_attrib.is_64 = 1; ++ + if (entries) + entry->msi_attrib.entry_nr = entries[i].entry; + else +@@ -723,6 +746,10 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base, + entry->msi_attrib.default_irq = dev->irq; + entry->mask_base = base; + ++ addr = pci_msix_desc_addr(entry); ++ if (addr) ++ entry->masked = readl(addr + PCI_MSIX_ENTRY_VECTOR_CTRL); ++ + list_add_tail(&entry->list, dev_to_msi_list(&dev->dev)); + if (masks) + curmsk++; +@@ -733,21 +760,30 @@ static int msix_setup_entries(struct pci_dev *dev, void __iomem *base, + return ret; + } + +-static void msix_program_entries(struct pci_dev *dev, +- struct msix_entry *entries) ++static void msix_update_entries(struct pci_dev *dev, struct msix_entry *entries) + { + struct msi_desc *entry; +- int i = 0; + + for_each_pci_msi_entry(entry, dev) { +- if (entries) +- entries[i++].vector = entry->irq; +- entry->masked = readl(pci_msix_desc_addr(entry) + +- PCI_MSIX_ENTRY_VECTOR_CTRL); +- msix_mask_irq(entry, 1); ++ if (entries) { ++ entries->vector = entry->irq; ++ entries++; ++ } + } + } + ++static void msix_mask_all(void __iomem *base, int tsize) ++{ ++ u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT; ++ int i; ++ ++ if (pci_msi_ignore_mask) ++ return; ++ ++ for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE) ++ writel(ctrl, base + PCI_MSIX_ENTRY_VECTOR_CTRL); ++} ++ + /** + * msix_capability_init - configure device's MSI-X capability + * @dev: pointer to the pci_dev data structure of MSI-X device function +@@ -762,22 +798,34 @@ static void msix_program_entries(struct pci_dev *dev, + static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + int nvec, bool affinity) + { +- int ret; +- u16 control; + void __iomem *base; ++ int ret, tsize; ++ u16 control; + +- /* Ensure MSI-X is disabled while it is set up */ +- pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0); ++ /* ++ * Some devices require MSI-X to be enabled before the MSI-X ++ * registers can be accessed. Mask all the vectors to prevent ++ * interrupts coming in before they're fully set up. ++ */ ++ pci_msix_clear_and_set_ctrl(dev, 0, PCI_MSIX_FLAGS_MASKALL | ++ PCI_MSIX_FLAGS_ENABLE); + + pci_read_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, &control); + /* Request & Map MSI-X table region */ ++ tsize = msix_table_size(control); ++ base = msix_map_region(dev, tsize); + base = msix_map_region(dev, msix_table_size(control)); +- if (!base) +- return -ENOMEM; ++ if (!base) { ++ ret = -ENOMEM; ++ goto out_disable; ++ } ++ ++ /* Ensure that all table entries are masked. */ ++ msix_mask_all(base, tsize); + + ret = msix_setup_entries(dev, base, entries, nvec, affinity); + if (ret) +- return ret; ++ goto out_disable; + + ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSIX); + if (ret) +@@ -788,15 +836,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + if (ret) + goto out_free; + +- /* +- * Some devices require MSI-X to be enabled before we can touch the +- * MSI-X registers. We need to mask all the vectors to prevent +- * interrupts coming in before they're fully set up. +- */ +- pci_msix_clear_and_set_ctrl(dev, 0, +- PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE); +- +- msix_program_entries(dev, entries); ++ msix_update_entries(dev, entries); + + ret = populate_msi_sysfs(dev); + if (ret) +@@ -830,6 +870,9 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries, + out_free: + free_msi_irqs(dev); + ++out_disable: ++ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0); ++ + return ret; + } + +@@ -917,8 +960,7 @@ void pci_msi_shutdown(struct pci_dev *dev) + + /* Return the device with MSI unmasked as initial states */ + mask = msi_mask(desc->msi_attrib.multi_cap); +- /* Keep cached state to be restored */ +- __pci_msi_desc_mask_irq(desc, mask, ~mask); ++ msi_mask_irq(desc, mask, 0); + + /* Restore dev->irq to its default pin-assertion irq */ + dev->irq = desc->msi_attrib.default_irq; +@@ -1019,10 +1061,8 @@ void pci_msix_shutdown(struct pci_dev *dev) + return; + + /* Return the device with MSI-X masked as initial states */ +- for_each_pci_msi_entry(entry, dev) { +- /* Keep cached states to be restored */ ++ for_each_pci_msi_entry(entry, dev) + __pci_msix_desc_mask_irq(entry, 1); +- } + + pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0); + pci_intx_for_msi(dev, 1); diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c index 51357377efbc..ac169cf0fa02 100644 --- a/drivers/pci/pci-label.c @@ -57648,6 +77952,39 @@ index 51357377efbc..ac169cf0fa02 100644 buf[len] = '\n'; } +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index e09653c73ab4..2cf13578fe75 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1384,11 +1384,7 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags) + * so that things like MSI message writing will behave as expected + * (e.g. if the device really is in D0 at enable time). + */ +- if (dev->pm_cap) { +- u16 pmcsr; +- pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr); +- dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK); +- } ++ pci_update_current_state(dev, dev->current_state); + + if (atomic_inc_return(&dev->enable_cnt) > 1) + return 0; /* already enabled */ +@@ -1926,7 +1922,14 @@ int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, + if (enable) { + int error; + +- if (pci_pme_capable(dev, state)) ++ /* ++ * Enable PME signaling if the device can signal PME from ++ * D3cold regardless of whether or not it can signal PME from ++ * the current target state, because that will allow it to ++ * signal PME when the hierarchy above it goes into D3cold and ++ * the device itself ends up in D3cold as a result of that. ++ */ ++ if (pci_pme_capable(dev, state) || pci_pme_capable(dev, PCI_D3cold)) + pci_pme_active(dev, true); + else + ret = 1; diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c index 02b96113ea87..51296c86fb7a 100644 --- a/drivers/pci/pcie/aspm.c @@ -57781,7 +78118,7 @@ index 16611cf3aba4..ddf5ba63b195 100644 kfree(dev); return NULL; diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 496296bc3581..096ba11ac105 100644 +index 496296bc3581..3ff2971102b6 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -2046,6 +2046,19 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s); @@ -57804,7 +78141,27 @@ index 496296bc3581..096ba11ac105 100644 /* * Some Pericom PCIe-to-PCI bridges in reverse mode need the PCIe Retrain * Link bit cleared after starting the link retrain process to allow this -@@ -3332,6 +3345,18 @@ static void quirk_no_bus_reset(struct pci_dev *dev) +@@ -2981,12 +2994,13 @@ static void fixup_mpss_256(struct pci_dev *dev) + { + dev->pcie_mpss = 1; /* 256 bytes */ + } +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, +- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, +- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, +- PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, ++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, ++ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, ++ PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_ASMEDIA, 0x0612, fixup_mpss_256); + + /* Intel 5000 and 5100 Memory controllers have an errata with read completion + * coalescing (which is enabled by default on some BIOSes) and MPS of 256B. +@@ -3332,6 +3346,18 @@ static void quirk_no_bus_reset(struct pci_dev *dev) dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET; } @@ -57823,10 +78180,12 @@ index 496296bc3581..096ba11ac105 100644 /* * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset. * The device will throw a Link Down error on AER-capable systems and -@@ -3345,6 +3370,16 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); +@@ -3344,6 +3370,17 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset); DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset); - ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003e, quirk_no_bus_reset); ++ +/* + * Some TI KeyStone C667X devices do not support bus/hot reset. The PCIESS + * automatically disables LTSSM when Secondary Bus Reset is received and @@ -57836,11 +78195,10 @@ index 496296bc3581..096ba11ac105 100644 + * https://e2e.ti.com/support/processors/f/791/t/954382 + */ +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, 0xb005, quirk_no_bus_reset); -+ + static void quirk_no_pm_reset(struct pci_dev *dev) { - /* -@@ -3898,6 +3933,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9182, +@@ -3898,6 +3935,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9182, /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c46 */ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0, quirk_dma_func1_alias); @@ -57887,19 +78245,25 @@ index 429d34c348b9..14d84d5a0f58 100644 goto out; } diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c -index b91c4da68365..7958250856d3 100644 +index b91c4da68365..f602176eb8b0 100644 --- a/drivers/pci/syscall.c +++ b/drivers/pci/syscall.c -@@ -21,7 +21,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn, +@@ -21,10 +21,12 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn, u16 word; u32 dword; long err; - long cfg_ret; + int cfg_ret; ++ err = -EPERM; ++ dev = NULL; if (!capable(CAP_SYS_ADMIN)) - return -EPERM; -@@ -47,7 +47,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn, +- return -EPERM; ++ goto error; + + err = -ENODEV; + dev = pci_get_bus_and_slot(bus, dfn); +@@ -47,7 +49,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn, } err = -EIO; @@ -57908,7 +78272,7 @@ index b91c4da68365..7958250856d3 100644 goto error; switch (len) { -@@ -105,7 +105,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, +@@ -105,7 +107,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, if (err) break; err = pci_user_write_config_byte(dev, off, byte); @@ -57917,7 +78281,7 @@ index b91c4da68365..7958250856d3 100644 err = -EIO; break; -@@ -114,7 +114,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, +@@ -114,7 +116,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, if (err) break; err = pci_user_write_config_word(dev, off, word); @@ -57926,7 +78290,7 @@ index b91c4da68365..7958250856d3 100644 err = -EIO; break; -@@ -123,7 +123,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, +@@ -123,7 +125,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, if (err) break; err = pci_user_write_config_dword(dev, off, dword); @@ -57935,6 +78299,18 @@ index b91c4da68365..7958250856d3 100644 err = -EIO; break; +diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c +index aae7e6df99cd..ba13e3c3d6b8 100644 +--- a/drivers/pcmcia/i82092.c ++++ b/drivers/pcmcia/i82092.c +@@ -105,6 +105,7 @@ static int i82092aa_pci_probe(struct pci_dev *dev, const struct pci_device_id *i + for (i = 0;ipctl_dev); } diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c -index bfdf720db270..8769a579ecb1 100644 +index bfdf720db270..01f42090cd03 100644 --- a/drivers/pinctrl/pinctrl-single.c +++ b/drivers/pinctrl/pinctrl-single.c @@ -1078,7 +1078,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np, @@ -58480,6 +78856,14 @@ index bfdf720db270..8769a579ecb1 100644 } else { *num_maps = 1; } +@@ -1332,6 +1335,7 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs, + + if (PCS_HAS_PINCONF) { + dev_err(pcs->dev, "pinconf not supported\n"); ++ res = -ENOTSUPP; + goto free_pingroups; + } + diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c index cef505bfaca2..7e9d5cdc9d88 100644 --- a/drivers/pinctrl/qcom/pinctrl-msm.c @@ -58575,6 +78959,26 @@ index e8aee6d88a40..6a23136bc813 100644 } static void exynos_pinctrl_resume(struct samsung_pinctrl_drv_data *drvdata) +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index d225a835a64c..c1879e40d718 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -183,6 +183,15 @@ static int cros_ec_host_command_proto_query(struct cros_ec_device *ec_dev, + msg->insize = sizeof(struct ec_response_get_protocol_info); + + ret = send_command(ec_dev, msg); ++ /* ++ * Send command once again when timeout occurred. ++ * Fingerprint MCU (FPMCU) is restarted during system boot which ++ * introduces small window in which FPMCU won't respond for any ++ * messages sent by kernel. There is no need to wait before next ++ * attempt because we waited at least EC_MSG_DEADLINE_MS. ++ */ ++ if (ret == -ETIMEDOUT) ++ ret = send_command(ec_dev, msg); + + if (ret < 0) { + dev_dbg(ec_dev->dev, diff --git a/drivers/platform/msm/ep_pcie/ep_pcie.c b/drivers/platform/msm/ep_pcie/ep_pcie.c index ecff4c4e32be..e7dfdc5911e8 100644 --- a/drivers/platform/msm/ep_pcie/ep_pcie.c @@ -60109,7 +80513,7 @@ index 92f566a0458a..984ab1740b4e 100644 * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c -index 1ab4934774e3..068e6ea471d7 100644 +index 1ab4934774e3..a920c20bc186 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c @@ -1,4 +1,4 @@ @@ -60128,6 +80532,57 @@ index 1ab4934774e3..068e6ea471d7 100644 if (ipahal_fltrt_allocate_hw_sys_tbl(&tbl_mem)) { IPAERR("fail to alloc sys tbl of size %d\n", tbl_mem.size); +@@ -982,7 +985,7 @@ static int __ipa_del_flt_rule(u32 rule_hdl) + + list_del(&entry->link); + entry->tbl->rule_cnt--; +- if (entry->rt_tbl) ++ if (entry->rt_tbl && !ipa3_check_idr_if_freed(entry->rt_tbl)) + entry->rt_tbl->ref_cnt--; + IPADBG("del flt rule rule_cnt=%d rule_id=%d\n", + entry->tbl->rule_cnt, entry->rule_id); +diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c b/drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c +index e4164561cb51..b74a49095ae7 100644 +--- a/drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c ++++ b/drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c +@@ -1,4 +1,4 @@ +-/* Copyright (c) 2012-2019 The Linux Foundation. All rights reserved. ++/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -62,7 +62,7 @@ static int ipa3_generate_hdr_hw_tbl(struct ipa_mem_buffer *mem) + } + + static int ipa3_hdr_proc_ctx_to_hw_format(struct ipa_mem_buffer *mem, +- u32 hdr_base_addr) ++ u64 hdr_base_addr) + { + struct ipa3_hdr_proc_ctx_entry *entry; + int ret; +@@ -97,7 +97,8 @@ static int ipa3_hdr_proc_ctx_to_hw_format(struct ipa_mem_buffer *mem, + hdr_base_addr, + entry->hdr->offset_entry, + &entry->l2tp_params, +- &entry->generic_params); ++ &entry->generic_params, ++ ipa3_ctx->use_64_bit_dma_mask); + if (ret) + return ret; + } +@@ -114,10 +115,10 @@ static int ipa3_hdr_proc_ctx_to_hw_format(struct ipa_mem_buffer *mem, + * + * Returns: 0 on success, negative on failure + */ +-static int ipa3_generate_hdr_proc_ctx_hw_tbl(u32 hdr_sys_addr, ++static int ipa3_generate_hdr_proc_ctx_hw_tbl(u64 hdr_sys_addr, + struct ipa_mem_buffer *mem, struct ipa_mem_buffer *aligned_mem) + { +- u32 hdr_base_addr; ++ u64 hdr_base_addr; + gfp_t flag = GFP_KERNEL; + + mem->size = (ipa3_ctx->hdr_proc_ctx_tbl.end) ? : 4; diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h index 83750e3d808f..3fabf5ba5e1f 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h @@ -60183,6 +80638,213 @@ index 22459d4a8fac..d5ae0940180f 100644 if (ipahal_fltrt_allocate_hw_sys_tbl(&tbl_mem)) { IPAERR_RL("fail to alloc sys tbl of size %d\n", tbl_mem.size); +diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c +index 1f245e702de7..642e00232f78 100644 +--- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c ++++ b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c +@@ -1,4 +1,4 @@ +-/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved. ++/* Copyright (c) 2016-2020, The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -1191,6 +1191,13 @@ static void ipahal_cp_hdr_to_hw_buff_v3(void *const base, u32 offset, + memcpy(base + offset, hdr, hdr_len); + } + ++/* Header address update logic. */ ++#define IPAHAL_CP_PROC_CTX_HEADER_UPDATE(hdr_lsb, hdr_msb, addr) \ ++ do { \ ++ hdr_lsb = lower_32_bits(addr); \ ++ hdr_msb = upper_32_bits(addr); \ ++ } while (0) ++ + /* + * ipahal_cp_proc_ctx_to_hw_buff_v3() - copy processing context to + * base address and offset given. +@@ -1205,26 +1212,33 @@ static void ipahal_cp_hdr_to_hw_buff_v3(void *const base, u32 offset, + * @offset_entry: offset from hdr_base_addr in table + * @l2tp_params: l2tp parameters + * @generic_params: generic proc_ctx params ++ * @is_64: Indicates whether header base address/dma base address is 64 bit. + */ + static int ipahal_cp_proc_ctx_to_hw_buff_v3(enum ipa_hdr_proc_type type, + void *const base, u32 offset, + u32 hdr_len, bool is_hdr_proc_ctx, +- dma_addr_t phys_base, u32 hdr_base_addr, ++ dma_addr_t phys_base, u64 hdr_base_addr, + struct ipa_hdr_offset_entry *offset_entry, + struct ipa_l2tp_hdr_proc_ctx_params *l2tp_params, +- struct ipa_eth_II_to_eth_II_ex_procparams *generic_params){ ++ struct ipa_eth_II_to_eth_II_ex_procparams *generic_params, ++ bool is_64) ++{ ++ u64 hdr_addr; ++ + if (type == IPA_HDR_PROC_NONE) { + struct ipa_hw_hdr_proc_ctx_add_hdr_seq *ctx; + + ctx = (struct ipa_hw_hdr_proc_ctx_add_hdr_seq *) + (base + offset); + ctx->hdr_add.tlv.type = IPA_PROC_CTX_TLV_TYPE_HDR_ADD; +- ctx->hdr_add.tlv.length = 1; ++ ctx->hdr_add.tlv.length = is_64 ? 2 : 1; + ctx->hdr_add.tlv.value = hdr_len; +- ctx->hdr_add.hdr_addr = is_hdr_proc_ctx ? phys_base : ++ hdr_addr = is_hdr_proc_ctx ? phys_base : + hdr_base_addr + offset_entry->offset; +- IPAHAL_DBG("header address 0x%x\n", +- ctx->hdr_add.hdr_addr); ++ IPAHAL_DBG("header address 0x%llx\n", ++ hdr_addr); ++ IPAHAL_CP_PROC_CTX_HEADER_UPDATE(ctx->hdr_add.hdr_addr, ++ ctx->hdr_add.hdr_addr_hi, hdr_addr); + ctx->end.type = IPA_PROC_CTX_TLV_TYPE_END; + ctx->end.length = 0; + ctx->end.value = 0; +@@ -1234,12 +1248,14 @@ static int ipahal_cp_proc_ctx_to_hw_buff_v3(enum ipa_hdr_proc_type type, + ctx = (struct ipa_hw_hdr_proc_ctx_add_l2tp_hdr_cmd_seq *) + (base + offset); + ctx->hdr_add.tlv.type = IPA_PROC_CTX_TLV_TYPE_HDR_ADD; +- ctx->hdr_add.tlv.length = 1; ++ ctx->hdr_add.tlv.length = is_64 ? 2 : 1; + ctx->hdr_add.tlv.value = hdr_len; +- ctx->hdr_add.hdr_addr = is_hdr_proc_ctx ? phys_base : ++ hdr_addr = is_hdr_proc_ctx ? phys_base : + hdr_base_addr + offset_entry->offset; +- IPAHAL_DBG("header address 0x%x\n", +- ctx->hdr_add.hdr_addr); ++ IPAHAL_DBG("header address 0x%llx\n", ++ hdr_addr); ++ IPAHAL_CP_PROC_CTX_HEADER_UPDATE(ctx->hdr_add.hdr_addr, ++ ctx->hdr_add.hdr_addr_hi, hdr_addr); + ctx->l2tp_params.tlv.type = IPA_PROC_CTX_TLV_TYPE_PROC_CMD; + ctx->l2tp_params.tlv.length = 1; + ctx->l2tp_params.tlv.value = +@@ -1261,12 +1277,14 @@ static int ipahal_cp_proc_ctx_to_hw_buff_v3(enum ipa_hdr_proc_type type, + ctx = (struct ipa_hw_hdr_proc_ctx_remove_l2tp_hdr_cmd_seq *) + (base + offset); + ctx->hdr_add.tlv.type = IPA_PROC_CTX_TLV_TYPE_HDR_ADD; +- ctx->hdr_add.tlv.length = 1; ++ ctx->hdr_add.tlv.length = is_64 ? 2 : 1; + ctx->hdr_add.tlv.value = hdr_len; +- ctx->hdr_add.hdr_addr = is_hdr_proc_ctx ? phys_base : ++ hdr_addr = is_hdr_proc_ctx ? phys_base : + hdr_base_addr + offset_entry->offset; +- IPAHAL_DBG("header address 0x%x length %d\n", +- ctx->hdr_add.hdr_addr, ctx->hdr_add.tlv.value); ++ IPAHAL_DBG("header address 0x%llx length %d\n", ++ hdr_addr, ctx->hdr_add.tlv.value); ++ IPAHAL_CP_PROC_CTX_HEADER_UPDATE(ctx->hdr_add.hdr_addr, ++ ctx->hdr_add.hdr_addr_hi, hdr_addr); + ctx->l2tp_params.tlv.type = IPA_PROC_CTX_TLV_TYPE_PROC_CMD; + ctx->l2tp_params.tlv.length = 1; + ctx->l2tp_params.tlv.value = +@@ -1324,12 +1342,14 @@ static int ipahal_cp_proc_ctx_to_hw_buff_v3(enum ipa_hdr_proc_type type, + ctx = (struct ipa_hw_hdr_proc_ctx_add_hdr_cmd_seq *) + (base + offset); + ctx->hdr_add.tlv.type = IPA_PROC_CTX_TLV_TYPE_HDR_ADD; +- ctx->hdr_add.tlv.length = 1; ++ ctx->hdr_add.tlv.length = is_64 ? 2 : 1; + ctx->hdr_add.tlv.value = hdr_len; +- ctx->hdr_add.hdr_addr = is_hdr_proc_ctx ? phys_base : ++ hdr_addr = is_hdr_proc_ctx ? phys_base : + hdr_base_addr + offset_entry->offset; +- IPAHAL_DBG("header address 0x%x\n", +- ctx->hdr_add.hdr_addr); ++ IPAHAL_DBG("header address 0x%llx\n", ++ hdr_addr); ++ IPAHAL_CP_PROC_CTX_HEADER_UPDATE(ctx->hdr_add.hdr_addr, ++ ctx->hdr_add.hdr_addr_hi, hdr_addr); + ctx->cmd.type = IPA_PROC_CTX_TLV_TYPE_PROC_CMD; + ctx->cmd.length = 0; + switch (type) { +@@ -1411,11 +1431,11 @@ struct ipahal_hdr_funcs { + int (*ipahal_cp_proc_ctx_to_hw_buff)(enum ipa_hdr_proc_type type, + void *const base, u32 offset, u32 hdr_len, + bool is_hdr_proc_ctx, dma_addr_t phys_base, +- u32 hdr_base_addr, ++ u64 hdr_base_addr, + struct ipa_hdr_offset_entry *offset_entry, + struct ipa_l2tp_hdr_proc_ctx_params *l2tp_params, + struct ipa_eth_II_to_eth_II_ex_procparams +- *generic_params); ++ *generic_params, bool is_64); + + int (*ipahal_get_proc_ctx_needed_len)(enum ipa_hdr_proc_type type); + }; +@@ -1482,18 +1502,20 @@ void ipahal_cp_hdr_to_hw_buff(void *base, u32 offset, u8 *const hdr, + * @offset_entry: offset from hdr_base_addr in table + * @l2tp_params: l2tp parameters + * @generic_params: generic proc_ctx params ++ * @is_64: Indicates whether header base address/dma base address is 64 bit. + */ + int ipahal_cp_proc_ctx_to_hw_buff(enum ipa_hdr_proc_type type, + void *const base, u32 offset, u32 hdr_len, + bool is_hdr_proc_ctx, dma_addr_t phys_base, +- u32 hdr_base_addr, struct ipa_hdr_offset_entry *offset_entry, ++ u64 hdr_base_addr, struct ipa_hdr_offset_entry *offset_entry, + struct ipa_l2tp_hdr_proc_ctx_params *l2tp_params, +- struct ipa_eth_II_to_eth_II_ex_procparams *generic_params) ++ struct ipa_eth_II_to_eth_II_ex_procparams *generic_params, ++ bool is_64) + { + IPAHAL_DBG( +- "type %d, base %p, offset %d, hdr_len %d, is_hdr_proc_ctx %d, hdr_base_addr %d, offset_entry %p\n" ++ "type %d, base %pK, offset %d, hdr_len %d, is_hdr_proc_ctx %d, hdr_base_addr %llu, offset_entry %pK, bool %d\n" + , type, base, offset, hdr_len, is_hdr_proc_ctx, +- hdr_base_addr, offset_entry); ++ hdr_base_addr, offset_entry, is_64); + + if (!base || + !hdr_len || +@@ -1501,7 +1523,7 @@ int ipahal_cp_proc_ctx_to_hw_buff(enum ipa_hdr_proc_type type, + (!is_hdr_proc_ctx && !offset_entry) || + (!is_hdr_proc_ctx && !hdr_base_addr)) { + IPAHAL_ERR( +- "invalid input: hdr_len:%u phys_base:%pad hdr_base_addr:%u is_hdr_proc_ctx:%d offset_entry:%pK\n" ++ "invalid input: hdr_len:%u phys_base:%pad hdr_base_addr:%llu is_hdr_proc_ctx:%d offset_entry:%pK\n" + , hdr_len, &phys_base, hdr_base_addr + , is_hdr_proc_ctx, offset_entry); + return -EINVAL; +@@ -1510,7 +1532,7 @@ int ipahal_cp_proc_ctx_to_hw_buff(enum ipa_hdr_proc_type type, + return hdr_funcs.ipahal_cp_proc_ctx_to_hw_buff(type, base, offset, + hdr_len, is_hdr_proc_ctx, phys_base, + hdr_base_addr, offset_entry, l2tp_params, +- generic_params); ++ generic_params, is_64); + } + + /* +diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.h b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.h +index f8720b0c4e14..ec214e39a5f1 100644 +--- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.h ++++ b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.h +@@ -1,4 +1,4 @@ +-/* Copyright (c) 2016-2017, 2019, The Linux Foundation. All rights reserved. ++/* Copyright (c) 2016-2020, The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -636,14 +636,16 @@ void ipahal_cp_hdr_to_hw_buff(void *base, u32 offset, u8 *hdr, u32 hdr_len); + * @offset_entry: offset from hdr_base_addr in table + * @l2tp_params: l2tp parameters + * @generic_params: generic proc_ctx params ++ * @is_64: Indicates whether header base address/dma base address is 64 bit. + */ + int ipahal_cp_proc_ctx_to_hw_buff(enum ipa_hdr_proc_type type, + void *base, u32 offset, u32 hdr_len, + bool is_hdr_proc_ctx, dma_addr_t phys_base, +- u32 hdr_base_addr, ++ u64 hdr_base_addr, + struct ipa_hdr_offset_entry *offset_entry, + struct ipa_l2tp_hdr_proc_ctx_params *l2tp_params, +- struct ipa_eth_II_to_eth_II_ex_procparams *generic_params); ++ struct ipa_eth_II_to_eth_II_ex_procparams *generic_params, ++ bool is_64); + + /* + * ipahal_get_proc_ctx_needed_len() - calculates the needed length for addition diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_fltrt.c b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_fltrt.c index 06bd062a612c..e99969aad0b3 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_fltrt.c @@ -60279,6 +80941,24 @@ index 645383a8f1cf..c419f15c8195 100644 /* +diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_i.h b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_i.h +index d7e1541555b5..eb97ee2b2481 100644 +--- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_i.h ++++ b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_i.h +@@ -1,4 +1,4 @@ +-/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved. ++/* Copyright (c) 2016-2020, The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -659,6 +659,7 @@ struct ipa_hw_hdr_proc_ctx_tlv { + struct ipa_hw_hdr_proc_ctx_hdr_add { + struct ipa_hw_hdr_proc_ctx_tlv tlv; + u32 hdr_addr; ++ u32 hdr_addr_hi; + }; + + /** diff --git a/drivers/platform/msm/mhi_dev/mhi.c b/drivers/platform/msm/mhi_dev/mhi.c index 1c5dcaf2670d..e01c1b16eca1 100644 --- a/drivers/platform/msm/mhi_dev/mhi.c @@ -60496,7 +81176,7 @@ index 1515c9480f89..ec3cbb7844bc 100644 if (ec_raw_mode) { if (ACPI_FAILURE(acer_wmi_enable_ec_raw())) { diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c -index abd9d83f6009..403d966223ee 100644 +index abd9d83f6009..76cb361b623c 100644 --- a/drivers/platform/x86/hp_accel.c +++ b/drivers/platform/x86/hp_accel.c @@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids); @@ -60517,7 +81197,19 @@ index abd9d83f6009..403d966223ee 100644 ret = lis3lv02d_init_device(&lis3_dev); if (ret) return ret; -@@ -413,11 +417,27 @@ static int lis3lv02d_suspend(struct device *dev) +@@ -378,9 +382,11 @@ static int lis3lv02d_add(struct acpi_device *device) + INIT_WORK(&hpled_led.work, delayed_set_status_worker); + ret = led_classdev_register(NULL, &hpled_led.led_classdev); + if (ret) { ++ i8042_remove_filter(hp_accel_i8042_filter); + lis3lv02d_joystick_disable(&lis3_dev); + lis3lv02d_poweroff(&lis3_dev); + flush_work(&hpled_led.work); ++ lis3lv02d_remove_fs(&lis3_dev); + return ret; + } + +@@ -413,11 +419,27 @@ static int lis3lv02d_suspend(struct device *dev) static int lis3lv02d_resume(struct device *dev) { @@ -60584,11 +81276,40 @@ index b7dfe06261f1..9865d11eda75 100644 static struct platform_driver intel_punit_ipc_driver = { .probe = intel_punit_ipc_probe, +diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c +index e81daff65f62..238ee4275f5c 100644 +--- a/drivers/platform/x86/intel_scu_ipc.c ++++ b/drivers/platform/x86/intel_scu_ipc.c +@@ -187,7 +187,7 @@ static inline int busy_loop(struct intel_scu_ipc_dev *scu) + return 0; + } + +-/* Wait till ipc ioc interrupt is received or timeout in 3 HZ */ ++/* Wait till ipc ioc interrupt is received or timeout in 10 HZ */ + static inline int ipc_wait_for_interrupt(struct intel_scu_ipc_dev *scu) + { + int status; diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c -index 60ee94e57242..c8a8bcda7b84 100644 +index 60ee94e57242..6ddb3a54c216 100644 --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c -@@ -2476,7 +2476,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn, +@@ -1169,15 +1169,6 @@ static int tpacpi_rfk_update_swstate(const struct tpacpi_rfk *tp_rfk) + return status; + } + +-/* Query FW and update rfkill sw state for all rfkill switches */ +-static void tpacpi_rfk_update_swstate_all(void) +-{ +- unsigned int i; +- +- for (i = 0; i < TPACPI_RFK_SW_MAX; i++) +- tpacpi_rfk_update_swstate(tpacpi_rfkill_switches[i]); +-} +- + /* + * Sync the HW-blocking state of all rfkill switches, + * do notice it causes the rfkill core to schedule uevents +@@ -2476,7 +2467,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn, */ static int hotkey_kthread(void *data) { @@ -60597,7 +81318,17 @@ index 60ee94e57242..c8a8bcda7b84 100644 u32 poll_mask, event_mask; unsigned int si, so; unsigned long t; -@@ -6044,6 +6044,7 @@ enum thermal_access_mode { +@@ -3029,9 +3020,6 @@ static void tpacpi_send_radiosw_update(void) + if (wlsw == TPACPI_RFK_RADIO_OFF) + tpacpi_rfk_update_hwblock_state(true); + +- /* Sync sw blocking state */ +- tpacpi_rfk_update_swstate_all(); +- + /* Sync hw blocking state last if it is hw-unblocked */ + if (wlsw == TPACPI_RFK_RADIO_ON) + tpacpi_rfk_update_hwblock_state(false); +@@ -6044,6 +6032,7 @@ enum thermal_access_mode { enum { /* TPACPI_THERMAL_TPEC_* */ TP_EC_THERMAL_TMP0 = 0x78, /* ACPI EC regs TMP 0..7 */ TP_EC_THERMAL_TMP8 = 0xC0, /* ACPI EC regs TMP 8..15 */ @@ -60605,7 +81336,7 @@ index 60ee94e57242..c8a8bcda7b84 100644 TP_EC_THERMAL_TMP_NA = -128, /* ACPI EC sensor not available */ TPACPI_THERMAL_SENSOR_NA = -128000, /* Sensor not available */ -@@ -6242,7 +6243,7 @@ static const struct attribute_group thermal_temp_input8_group = { +@@ -6242,7 +6231,7 @@ static const struct attribute_group thermal_temp_input8_group = { static int __init thermal_init(struct ibm_init_struct *iibm) { @@ -60614,7 +81345,7 @@ index 60ee94e57242..c8a8bcda7b84 100644 int i; int acpi_tmp7; int res; -@@ -6257,7 +6258,14 @@ static int __init thermal_init(struct ibm_init_struct *iibm) +@@ -6257,7 +6246,14 @@ static int __init thermal_init(struct ibm_init_struct *iibm) * 0x78-0x7F, 0xC0-0xC7. Registers return 0x00 for * non-implemented, thermal sensors return 0x80 when * not available @@ -60629,7 +81360,7 @@ index 60ee94e57242..c8a8bcda7b84 100644 ta1 = ta2 = 0; for (i = 0; i < 8; i++) { -@@ -6267,11 +6275,13 @@ static int __init thermal_init(struct ibm_init_struct *iibm) +@@ -6267,11 +6263,13 @@ static int __init thermal_init(struct ibm_init_struct *iibm) ta1 = 0; break; } @@ -60648,7 +81379,7 @@ index 60ee94e57242..c8a8bcda7b84 100644 } } if (ta1 == 0) { -@@ -6287,9 +6297,12 @@ static int __init thermal_init(struct ibm_init_struct *iibm) +@@ -6287,9 +6285,12 @@ static int __init thermal_init(struct ibm_init_struct *iibm) thermal_read_mode = TPACPI_THERMAL_NONE; } } else { @@ -60664,7 +81395,7 @@ index 60ee94e57242..c8a8bcda7b84 100644 } } else if (acpi_tmp7) { if (tpacpi_is_ibm() && -@@ -6640,8 +6653,10 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle) +@@ -6640,8 +6641,10 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle) list_for_each_entry(child, &device->children, node) { acpi_status status = acpi_evaluate_object(child->handle, "_BCL", NULL, &buffer); @@ -60676,6 +81407,15 @@ index 60ee94e57242..c8a8bcda7b84 100644 obj = (union acpi_object *)buffer.pointer; if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) { +@@ -8869,7 +8872,7 @@ static int fan_write_cmd_level(const char *cmd, int *rc) + + if (strlencmp(cmd, "level auto") == 0) + level = TP_EC_FAN_AUTO; +- else if ((strlencmp(cmd, "level disengaged") == 0) | ++ else if ((strlencmp(cmd, "level disengaged") == 0) || + (strlencmp(cmd, "level full-speed") == 0)) + level = TP_EC_FAN_FULLSPEED; + else if (sscanf(cmd, "level %d", &level) != 1) diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c index 79a228937072..90b17cf74e9f 100644 --- a/drivers/platform/x86/toshiba_acpi.c @@ -60705,6 +81445,26 @@ index 79a228937072..90b17cf74e9f 100644 goto err_remove_filter; } +diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c +index 00d82e8443bd..da06284c455d 100644 +--- a/drivers/platform/x86/wmi.c ++++ b/drivers/platform/x86/wmi.c +@@ -289,7 +289,14 @@ struct acpi_buffer *out) + * the WQxx method failed - we should disable collection anyway. + */ + if ((block->flags & ACPI_WMI_EXPENSIVE) && ACPI_SUCCESS(wc_status)) { +- status = acpi_execute_simple_method(handle, wc_method, 0); ++ /* ++ * Ignore whether this WCxx call succeeds or not since ++ * the previously executed WQxx method call might have ++ * succeeded, and returning the failing status code ++ * of this call would throw away the result of the WQxx ++ * call, potentially leaking memory. ++ */ ++ acpi_execute_simple_method(handle, wc_method, 0); + } + + return status; diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c index 04ca990e8f6c..dcfc7025f384 100644 --- a/drivers/power/reset/at91-sama5d2_shdwc.c @@ -60857,6 +81617,42 @@ index ea8c26a108f0..d6079e892e11 100644 static struct platform_driver ab8500_fg_driver = { .probe = ab8500_fg_probe, +diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c +index 089056cb8e73..85e6c9bacf06 100644 +--- a/drivers/power/supply/axp288_fuel_gauge.c ++++ b/drivers/power/supply/axp288_fuel_gauge.c +@@ -169,7 +169,7 @@ static int fuel_gauge_reg_readb(struct axp288_fg_info *info, int reg) + } + + if (ret < 0) { +- dev_err(&info->pdev->dev, "axp288 reg read err:%d\n", ret); ++ dev_err(&info->pdev->dev, "Error reading reg 0x%02x err: %d\n", reg, ret); + return ret; + } + +@@ -183,7 +183,7 @@ static int fuel_gauge_reg_writeb(struct axp288_fg_info *info, int reg, u8 val) + ret = regmap_write(info->regmap, reg, (unsigned int)val); + + if (ret < 0) +- dev_err(&info->pdev->dev, "axp288 reg write err:%d\n", ret); ++ dev_err(&info->pdev->dev, "Error writing reg 0x%02x err: %d\n", reg, ret); + + return ret; + } +diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c +index 5c5c3a6f9923..91fabe9e6efd 100644 +--- a/drivers/power/supply/bq27xxx_battery_i2c.c ++++ b/drivers/power/supply/bq27xxx_battery_i2c.c +@@ -115,7 +115,8 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client, + dev_err(&client->dev, + "Unable to register IRQ %d error %d\n", + client->irq, ret); +- return ret; ++ bq27xxx_battery_teardown(di); ++ goto err_failed; + } + } + diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c index 13f23c00538b..043836e6d347 100644 --- a/drivers/power/supply/charger-manager.c @@ -60933,6 +81729,55 @@ index cd614fe69d14..e800beff1f8f 100644 return 0; } +diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c +index da7a75f82489..01ca03c809d0 100644 +--- a/drivers/power/supply/max17042_battery.c ++++ b/drivers/power/supply/max17042_battery.c +@@ -246,7 +246,10 @@ static int max17042_get_property(struct power_supply *psy, + val->intval = data * 625 / 8; + break; + case POWER_SUPPLY_PROP_CAPACITY: +- ret = regmap_read(map, MAX17042_RepSOC, &data); ++ if (chip->pdata->enable_current_sense) ++ ret = regmap_read(map, MAX17042_RepSOC, &data); ++ else ++ ret = regmap_read(map, MAX17042_VFSOC, &data); + if (ret < 0) + return ret; + +@@ -644,7 +647,7 @@ static inline void max17042_override_por_values(struct max17042_chip *chip) + struct max17042_config_data *config = chip->pdata->config_data; + + max17042_override_por(map, MAX17042_TGAIN, config->tgain); +- max17042_override_por(map, MAx17042_TOFF, config->toff); ++ max17042_override_por(map, MAX17042_TOFF, config->toff); + max17042_override_por(map, MAX17042_CGAIN, config->cgain); + max17042_override_por(map, MAX17042_COFF, config->coff); + +@@ -752,7 +755,8 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off) + regmap_read(map, MAX17042_RepSOC, &soc); + soc >>= 8; + soc_tr = (soc + off) << 8; +- soc_tr |= (soc - off); ++ if (off < soc) ++ soc_tr |= soc - off; + regmap_write(map, MAX17042_SALRT_Th, soc_tr); + } + +@@ -760,8 +764,12 @@ static irqreturn_t max17042_thread_handler(int id, void *dev) + { + struct max17042_chip *chip = dev; + u32 val; ++ int ret; ++ ++ ret = regmap_read(chip->regmap, MAX17042_STATUS, &val); ++ if (ret) ++ return IRQ_HANDLED; + +- regmap_read(chip->regmap, MAX17042_STATUS, &val); + if ((val & STATUS_INTR_SOCMIN_BIT) || + (val & STATUS_INTR_SOCMAX_BIT)) { + dev_info(&chip->client->dev, "SOC threshold INTR\n"); diff --git a/drivers/power/supply/pm2301_charger.c b/drivers/power/supply/pm2301_charger.c index 78561b6884fc..9ef218d76aa9 100644 --- a/drivers/power/supply/pm2301_charger.c @@ -61112,9 +81957,18 @@ index 8b4fd41ff345..efbf1a431975 100644 +void orderly_poweroff(bool force); #endif /* __SMB2_CHARGER_H */ diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c -index bcdd83048492..9310b85f3405 100644 +index bcdd83048492..7eec7014086d 100644 --- a/drivers/power/supply/rt5033_battery.c +++ b/drivers/power/supply/rt5033_battery.c +@@ -63,7 +63,7 @@ static int rt5033_battery_get_watt_prop(struct i2c_client *client, + regmap_read(battery->regmap, regh, &msb); + regmap_read(battery->regmap, regl, &lsb); + +- ret = ((msb << 4) + (lsb >> 4)) * 1250 / 1000; ++ ret = ((msb << 4) + (lsb >> 4)) * 1250; + + return ret; + } @@ -167,9 +167,16 @@ static const struct i2c_device_id rt5033_battery_id[] = { }; MODULE_DEVICE_TABLE(i2c, rt5033_battery_id); @@ -61264,6 +82118,18 @@ index 8c3f5adf1bc6..2d7618375662 100644 dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n", __func__, __LINE__); error = -ENODEV; +diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c +index 3aa22ae4d94c..a911325fc0b4 100644 +--- a/drivers/ptp/ptp_pch.c ++++ b/drivers/ptp/ptp_pch.c +@@ -698,6 +698,7 @@ static const struct pci_device_id pch_ieee1588_pcidev_id[] = { + }, + {0} + }; ++MODULE_DEVICE_TABLE(pci, pch_ieee1588_pcidev_id); + + static struct pci_driver pch_driver = { + .name = KBUILD_MODNAME, diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c index 31b01035d0ab..8cfba3614e60 100644 --- a/drivers/pwm/pwm-bcm-iproc.c @@ -61291,6 +82157,33 @@ index 31b01035d0ab..8cfba3614e60 100644 value = readl(ip->base + IPROC_PWM_PRESCALE_OFFSET); prescale = value >> IPROC_PWM_PRESCALE_SHIFT(pwm->hwpwm); prescale &= IPROC_PWM_PRESCALE_MAX; +diff --git a/drivers/pwm/pwm-lpc32xx.c b/drivers/pwm/pwm-lpc32xx.c +index a9b3cff96aac..ed8e9406b4af 100644 +--- a/drivers/pwm/pwm-lpc32xx.c ++++ b/drivers/pwm/pwm-lpc32xx.c +@@ -124,17 +124,17 @@ static int lpc32xx_pwm_probe(struct platform_device *pdev) + lpc32xx->chip.npwm = 1; + lpc32xx->chip.base = -1; + ++ /* If PWM is disabled, configure the output to the default value */ ++ val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); ++ val &= ~PWM_PIN_LEVEL; ++ writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); ++ + ret = pwmchip_add(&lpc32xx->chip); + if (ret < 0) { + dev_err(&pdev->dev, "failed to add PWM chip, error %d\n", ret); + return ret; + } + +- /* When PWM is disable, configure the output to the default value */ +- val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); +- val &= ~PWM_PIN_LEVEL; +- writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); +- + platform_set_drvdata(pdev, lpc32xx); + + return 0; diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c index 744d56197286..1cc671797953 100644 --- a/drivers/pwm/pwm-rockchip.c @@ -61688,6 +82581,38 @@ index 9ececfef42d6..bd91c95f73e0 100644 break; } +diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c +index 27343e1c43ef..45fad246c27e 100644 +--- a/drivers/regulator/s5m8767.c ++++ b/drivers/regulator/s5m8767.c +@@ -845,18 +845,15 @@ static int s5m8767_pmic_probe(struct platform_device *pdev) + /* DS4 GPIO */ + gpio_direction_output(pdata->buck_ds[2], 0x0); + +- if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs || +- pdata->buck4_gpiodvs) { +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK2CTRL, 1 << 1, +- (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK3CTRL, 1 << 1, +- (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); +- regmap_update_bits(s5m8767->iodev->regmap_pmic, +- S5M8767_REG_BUCK4CTRL, 1 << 1, +- (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); +- } ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK2CTRL, 1 << 1, ++ (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK3CTRL, 1 << 1, ++ (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); ++ regmap_update_bits(s5m8767->iodev->regmap_pmic, ++ S5M8767_REG_BUCK4CTRL, 1 << 1, ++ (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); + + /* Initialize GPIO DVS registers */ + for (i = 0; i < 8; i++) { diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c index 6d17357b3a24..5f5f63eb8c76 100644 --- a/drivers/regulator/ti-abb-regulator.c @@ -61852,6 +82777,18 @@ index d08da371912c..93b1d8d9d2e9 100644 if (IS_ERR(rx8010->rtc)) { dev_err(&client->dev, "unable to register the class device\n"); +diff --git a/drivers/rtc/rtc-tps65910.c b/drivers/rtc/rtc-tps65910.c +index 5a3d53caa485..74ddd2ab3fce 100644 +--- a/drivers/rtc/rtc-tps65910.c ++++ b/drivers/rtc/rtc-tps65910.c +@@ -332,6 +332,6 @@ static struct platform_driver tps65910_rtc_driver = { + }; + + module_platform_driver(tps65910_rtc_driver); +-MODULE_ALIAS("platform:rtc-tps65910"); ++MODULE_ALIAS("platform:tps65910-rtc"); + MODULE_AUTHOR("Venu Byravarasu "); + MODULE_LICENSE("GPL"); diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c index 0da246505f70..b72d4243bfb9 100644 --- a/drivers/s390/block/dasd.c @@ -62073,7 +83010,7 @@ index 51152681aba6..c878c8796616 100644 QETH_CARD_TEXT_(card, 2, "BPsz%04x", qports->entry_length); return; diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c -index c7be7bb37209..b9b4491d732a 100644 +index c7be7bb37209..72a66f113017 100644 --- a/drivers/scsi/BusLogic.c +++ b/drivers/scsi/BusLogic.c @@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command, @@ -62091,6 +83028,24 @@ index c7be7bb37209..b9b4491d732a 100644 scsi_for_each_sg(command, sg, count, i) { ccb->sglist[i].segbytes = sg_dma_len(sg); +@@ -3597,7 +3597,7 @@ static void blogic_msg(enum blogic_msglevel msglevel, char *fmt, + if (buf[0] != '\n' || len > 1) + printk("%sscsi%d: %s", blogic_msglevelmap[msglevel], adapter->host_no, buf); + } else +- printk("%s", buf); ++ pr_cont("%s", buf); + } else { + if (begin) { + if (adapter != NULL && adapter->adapter_initd) +@@ -3605,7 +3605,7 @@ static void blogic_msg(enum blogic_msglevel msglevel, char *fmt, + else + printk("%s%s", blogic_msglevelmap[msglevel], buf); + } else +- printk("%s", buf); ++ pr_cont("%s", buf); + } + begin = (buf[len - 1] == '\n'); + } diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h index b53ec2f1e8cd..5c950a7a1b1c 100644 --- a/drivers/scsi/BusLogic.h @@ -62248,6 +83203,21 @@ index 065f11a1964d..39deea8601d6 100644 } dprintk((KERN_DEBUG "aac_write[cpu %d]: lba = %llu, t = %ld.\n", +diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c +index 24e57e770432..6efd17692a55 100644 +--- a/drivers/scsi/advansys.c ++++ b/drivers/scsi/advansys.c +@@ -3370,8 +3370,8 @@ static void asc_prt_adv_board_info(struct seq_file *m, struct Scsi_Host *shost) + shost->host_no); + + seq_printf(m, +- " iop_base 0x%lx, cable_detect: %X, err_code %u\n", +- (unsigned long)v->iop_base, ++ " iop_base 0x%p, cable_detect: %X, err_code %u\n", ++ v->iop_base, + AdvReadWordRegister(iop_base,IOPW_SCSI_CFG1) & CABLE_DETECT, + v->err_code); + diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c index def3208dd290..9b5832b46dec 100644 --- a/drivers/scsi/aic7xxx/aic7xxx_core.c @@ -62365,6 +83335,31 @@ index dab195f04da7..06ca0495f3e8 100644 goto bye; } +diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c +index 957767d38361..d1df694d9ed0 100644 +--- a/drivers/scsi/csiostor/csio_lnode.c ++++ b/drivers/scsi/csiostor/csio_lnode.c +@@ -611,7 +611,7 @@ csio_ln_vnp_read_cbfn(struct csio_hw *hw, struct csio_mb *mbp) + struct fc_els_csp *csp; + struct fc_els_cssp *clsp; + enum fw_retval retval; +- __be32 nport_id; ++ __be32 nport_id = 0; + + retval = FW_CMD_RETVAL_G(ntohl(rsp->alloc_to_len16)); + if (retval != FW_SUCCESS) { +diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c +index 830b2d2dcf20..8490d0ff04ca 100644 +--- a/drivers/scsi/dc395x.c ++++ b/drivers/scsi/dc395x.c +@@ -4809,6 +4809,7 @@ static int dc395x_init_one(struct pci_dev *dev, const struct pci_device_id *id) + /* initialise the adapter and everything we need */ + if (adapter_init(acb, io_port_base, io_port_len, irq)) { + dprintkl(KERN_INFO, "adapter init failed\n"); ++ acb = NULL; + goto fail; + } + diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c index 60c288526355..dce885276235 100644 --- a/drivers/scsi/device_handler/scsi_dh_alua.c @@ -62420,6 +83415,33 @@ index 60c288526355..dce885276235 100644 kfree(h); } +diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c +index 06fbd0b0c68a..6ddb3e9f21ba 100644 +--- a/drivers/scsi/device_handler/scsi_dh_rdac.c ++++ b/drivers/scsi/device_handler/scsi_dh_rdac.c +@@ -526,8 +526,8 @@ static int initialize_controller(struct scsi_device *sdev, + if (!h->ctlr) + err = SCSI_DH_RES_TEMP_UNAVAIL; + else { +- list_add_rcu(&h->node, &h->ctlr->dh_list); + h->sdev = sdev; ++ list_add_rcu(&h->node, &h->ctlr->dh_list); + } + spin_unlock(&list_lock); + } +@@ -852,11 +852,11 @@ static void rdac_bus_detach( struct scsi_device *sdev ) + spin_lock(&list_lock); + if (h->ctlr) { + list_del_rcu(&h->node); +- h->sdev = NULL; + kref_put(&h->ctlr->kref, release_controller); + } + spin_unlock(&list_lock); + sdev->handler_data = NULL; ++ synchronize_rcu(); + kfree(h); + } + diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c index 3c2f34db937b..f5f3a8113bc5 100644 --- a/drivers/scsi/fcoe/fcoe_ctlr.c @@ -63803,7 +84825,7 @@ index fefef2884d59..30b5f65b29d1 100644 } diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 1c34dc335549..0e7915ecb85a 100644 +index 1c34dc335549..5c847ef459cd 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -15252,7 +15252,6 @@ lpfc_sli4_seq_abort_rsp_cmpl(struct lpfc_hba *phba, @@ -63825,6 +84847,14 @@ index 1c34dc335549..0e7915ecb85a 100644 return first_iocbq; } +@@ -17271,6 +17274,7 @@ lpfc_drain_txq(struct lpfc_hba *phba) + fail_msg, + piocbq->iotag, piocbq->sli4_xritag); + list_add_tail(&piocbq->list, &completions); ++ fail_msg = NULL; + } + spin_unlock_irqrestore(&pring->ring_lock, iflags); + } diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c index e18bbc66e83b..77cb16d8dfd3 100644 --- a/drivers/scsi/lpfc/lpfc_vport.c @@ -63874,6 +84904,73 @@ index e18bbc66e83b..77cb16d8dfd3 100644 lpfc_free_vpi(phba, vport->vpi); vport->work_port_events = 0; +diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c +index 4cf9ed96414f..d61df49e4e1b 100644 +--- a/drivers/scsi/megaraid/megaraid_mm.c ++++ b/drivers/scsi/megaraid/megaraid_mm.c +@@ -250,7 +250,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) + mimd_t mimd; + uint32_t adapno; + int iterator; +- ++ bool is_found; + + if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) { + *rval = -EFAULT; +@@ -266,12 +266,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) + + adapter = NULL; + iterator = 0; ++ is_found = false; + + list_for_each_entry(adapter, &adapters_list_g, list) { +- if (iterator++ == adapno) break; ++ if (iterator++ == adapno) { ++ is_found = true; ++ break; ++ } + } + +- if (!adapter) { ++ if (!is_found) { + *rval = -ENODEV; + return NULL; + } +@@ -739,6 +743,7 @@ ioctl_done(uioc_t *kioc) + uint32_t adapno; + int iterator; + mraid_mmadp_t* adapter; ++ bool is_found; + + /* + * When the kioc returns from driver, make sure it still doesn't +@@ -761,19 +766,23 @@ ioctl_done(uioc_t *kioc) + iterator = 0; + adapter = NULL; + adapno = kioc->adapno; ++ is_found = false; + + con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed " + "ioctl that was timedout before\n")); + + list_for_each_entry(adapter, &adapters_list_g, list) { +- if (iterator++ == adapno) break; ++ if (iterator++ == adapno) { ++ is_found = true; ++ break; ++ } + } + + kioc->timedout = 0; + +- if (adapter) { ++ if (is_found) + mraid_mm_dealloc_kioc( adapter, kioc ); +- } ++ + } + else { + wake_up(&wait_q); diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c index 1753e42826dd..a880abf5abaa 100644 --- a/drivers/scsi/mesh.c @@ -63931,9 +85028,18 @@ index 7a340d597344..b583436c8e20 100644 if (r != 0) { pr_err(MPT3SAS_FMT "%s: handshake failed (r=%d)\n", diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index f0a3bb4961e5..e832a67bf638 100644 +index f0a3bb4961e5..ddfd2a1dfa54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -2927,7 +2927,7 @@ _scsih_ublock_io_device(struct MPT3SAS_ADAPTER *ioc, u64 sas_address) + + shost_for_each_device(sdev, ioc->shost) { + sas_device_priv_data = sdev->hostdata; +- if (!sas_device_priv_data) ++ if (!sas_device_priv_data || !sas_device_priv_data->sas_target) + continue; + if (sas_device_priv_data->sas_target->sas_address + != sas_address) @@ -5199,8 +5199,10 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) handle, parent_handle, (unsigned long long) sas_expander->sas_address, sas_expander->num_phys); @@ -64011,6 +85117,60 @@ index 33f4181ba9f7..591e2e89ae9f 100644 dma_free_coherent(&ha->pdev->dev, sizeof(*stats), stats, stats_dma); +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index 6ca00813c71f..4a1a16e6a820 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -115,7 +115,6 @@ extern int ql2xasynctmfenable; + extern int ql2xgffidenable; + extern int ql2xenabledif; + extern int ql2xenablehba_err_chk; +-extern int ql2xtargetreset; + extern int ql2xdontresethba; + extern uint64_t ql2xmaxlun; + extern int ql2xmdcapmask; +@@ -655,7 +654,6 @@ extern void qlafx00_abort_iocb(srb_t *, struct abort_iocb_entry_fx00 *); + extern void qlafx00_fxdisc_iocb(srb_t *, struct fxdisc_entry_fx00 *); + extern void qlafx00_timer_routine(scsi_qla_host_t *); + extern int qlafx00_rescan_isp(scsi_qla_host_t *); +-extern int qlafx00_loop_reset(scsi_qla_host_t *vha); + + /* qla82xx related functions */ + +diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c +index 15dff7099955..b72cc4b1287d 100644 +--- a/drivers/scsi/qla2xxx/qla_mr.c ++++ b/drivers/scsi/qla2xxx/qla_mr.c +@@ -738,29 +738,6 @@ qlafx00_lun_reset(fc_port_t *fcport, uint64_t l, int tag) + return qla2x00_async_tm_cmd(fcport, TCF_LUN_RESET, l, tag); + } + +-int +-qlafx00_loop_reset(scsi_qla_host_t *vha) +-{ +- int ret; +- struct fc_port *fcport; +- struct qla_hw_data *ha = vha->hw; +- +- if (ql2xtargetreset) { +- list_for_each_entry(fcport, &vha->vp_fcports, list) { +- if (fcport->port_type != FCT_TARGET) +- continue; +- +- ret = ha->isp_ops->target_reset(fcport, 0, 0); +- if (ret != QLA_SUCCESS) { +- ql_dbg(ql_dbg_taskm, vha, 0x803d, +- "Bus Reset failed: Reset=%d " +- "d_id=%x.\n", ret, fcport->d_id.b24); +- } +- } +- } +- return QLA_SUCCESS; +-} +- + int + qlafx00_iospace_config(struct qla_hw_data *ha) + { diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c index 104e13ae3428..9ec18463b452 100644 --- a/drivers/scsi/qla2xxx/qla_nx.c @@ -64025,6 +85185,53 @@ index 104e13ae3428..9ec18463b452 100644 goto done_write; qla82xx_wr_32(ha, QLA82XX_ROMUSB_ROM_WDATA, data); +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 65bbca715f57..274b61ddee04 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -180,12 +180,6 @@ MODULE_PARM_DESC(ql2xdbwr, + " 0 -- Regular doorbell.\n" + " 1 -- CAMRAM doorbell (faster).\n"); + +-int ql2xtargetreset = 1; +-module_param(ql2xtargetreset, int, S_IRUGO); +-MODULE_PARM_DESC(ql2xtargetreset, +- "Enable target reset." +- "Default is 1 - use hw defaults."); +- + int ql2xgffidenable; + module_param(ql2xgffidenable, int, S_IRUGO); + MODULE_PARM_DESC(ql2xgffidenable, +@@ -1401,27 +1395,10 @@ int + qla2x00_loop_reset(scsi_qla_host_t *vha) + { + int ret; +- struct fc_port *fcport; + struct qla_hw_data *ha = vha->hw; + +- if (IS_QLAFX00(ha)) { +- return qlafx00_loop_reset(vha); +- } +- +- if (ql2xtargetreset == 1 && ha->flags.enable_target_reset) { +- list_for_each_entry(fcport, &vha->vp_fcports, list) { +- if (fcport->port_type != FCT_TARGET) +- continue; +- +- ret = ha->isp_ops->target_reset(fcport, 0, 0); +- if (ret != QLA_SUCCESS) { +- ql_dbg(ql_dbg_taskm, vha, 0x802c, +- "Bus Reset failed: Reset=%d " +- "d_id=%x.\n", ret, fcport->d_id.b24); +- } +- } +- } +- ++ if (IS_QLAFX00(ha)) ++ return QLA_SUCCESS; + + if (ha->flags.enable_lip_full_login && !IS_CNA_CAPABLE(ha)) { + atomic_set(&vha->loop_state, LOOP_DOWN); diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c index b889caa556a0..6ef7a094ee51 100644 --- a/drivers/scsi/qla2xxx/qla_target.c @@ -64152,10 +85359,40 @@ index 3fda5836aac6..f10088a1d38c 100644 ql_iscsi_stats, iscsi_stats_dma); ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n", +diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c +index 1deb6adc411f..4c9c1a8db8c3 100644 +--- a/drivers/scsi/scsi.c ++++ b/drivers/scsi/scsi.c +@@ -951,8 +951,10 @@ EXPORT_SYMBOL(scsi_device_get); + */ + void scsi_device_put(struct scsi_device *sdev) + { +- module_put(sdev->host->hostt->module); ++ struct module *mod = sdev->host->hostt->module; ++ + put_device(&sdev->sdev_gendev); ++ module_put(mod); + } + EXPORT_SYMBOL(scsi_device_put); + diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c -index d7118d3767c3..99bfb003be3f 100644 +index d7118d3767c3..4358eb158c48 100644 --- a/drivers/scsi/scsi_debug.c +++ b/drivers/scsi/scsi_debug.c +@@ -2175,11 +2175,11 @@ static int resp_mode_select(struct scsi_cmnd *scp, + __func__, param_len, res); + md_len = mselect6 ? (arr[0] + 1) : (get_unaligned_be16(arr + 0) + 2); + bd_len = mselect6 ? arr[3] : get_unaligned_be16(arr + 6); +- if (md_len > 2) { ++ off = bd_len + (mselect6 ? 4 : 8); ++ if (md_len > 2 || off >= res) { + mk_sense_invalid_fld(scp, SDEB_IN_DATA, 0, -1); + return check_condition_result; + } +- off = bd_len + (mselect6 ? 4 : 8); + mpage = arr[off] & 0x3f; + ps = !!(arr[off] & 0x80); + if (ps) { @@ -4986,6 +4986,12 @@ static int __init scsi_debug_init(void) pr_err("submit_queues must be 1 or more\n"); return -EINVAL; @@ -64218,10 +85455,20 @@ index 3ccc858318fe..d135bd3051a6 100644 error = scsi_init_sgtable(rq, &cmd->sdb); if (error) diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c -index 5de47410fdbd..38e8071e59ed 100644 +index 5de47410fdbd..6d3520387f1a 100644 --- a/drivers/scsi/scsi_scan.c +++ b/drivers/scsi/scsi_scan.c -@@ -1733,15 +1733,16 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost) +@@ -460,7 +460,8 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, + error = shost->hostt->target_alloc(starget); + + if(error) { +- dev_printk(KERN_ERR, dev, "target allocation failed, error %d\n", error); ++ if (error != -ENXIO) ++ dev_err(dev, "target allocation failed, error %d\n", error); + /* don't want scsi_target_reap to do the final + * put because it will be under the host lock */ + scsi_target_destroy(starget); +@@ -1733,15 +1734,16 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost) */ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) { @@ -64240,7 +85487,7 @@ index 5de47410fdbd..38e8071e59ed 100644 } data = kmalloc(sizeof(*data), GFP_KERNEL); -@@ -1752,7 +1753,6 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) +@@ -1752,7 +1754,6 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) goto err; init_completion(&data->prev_finished); @@ -64248,7 +85495,7 @@ index 5de47410fdbd..38e8071e59ed 100644 spin_lock_irqsave(shost->host_lock, flags); shost->async_scan = 1; spin_unlock_irqrestore(shost->host_lock, flags); -@@ -1767,6 +1767,7 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) +@@ -1767,6 +1768,7 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) return data; err: @@ -64256,8 +85503,43 @@ index 5de47410fdbd..38e8071e59ed 100644 kfree(data); return NULL; } +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 522d118f5b85..113bf8ba5f25 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -427,9 +427,12 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) + struct device *parent; + struct list_head *this, *tmp; + unsigned long flags; ++ struct module *mod; + + sdev = container_of(work, struct scsi_device, ew.work); + ++ mod = sdev->host->hostt->module; ++ + scsi_dh_release_device(sdev); + + parent = sdev->sdev_gendev.parent; +@@ -461,11 +464,17 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) + + if (parent) + put_device(parent); ++ module_put(mod); + } + + static void scsi_device_dev_release(struct device *dev) + { + struct scsi_device *sdp = to_scsi_device(dev); ++ ++ /* Set module pointer as NULL in case of module unloading */ ++ if (!try_module_get(sdp->host->hostt->module)) ++ sdp->host->hostt->module = NULL; ++ + execute_in_process_context(scsi_device_dev_release_usercontext, + &sdp->ew); + } diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c -index 42b97f119623..8d10b35caed5 100644 +index 42b97f119623..acd8eb8c94cf 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -119,7 +119,11 @@ show_transport_handle(struct device *dev, struct device_attribute *attr, @@ -64291,7 +85573,7 @@ index 42b97f119623..8d10b35caed5 100644 } static ISCSI_ATTR(ep, handle, S_IRUGO, show_ep_handle, NULL); -@@ -423,39 +427,10 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, +@@ -423,40 +427,9 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, struct device *dev = container_of(kobj, struct device, kobj); struct iscsi_iface *iface = iscsi_dev_to_iface(dev); struct iscsi_transport *t = iface->transport; @@ -64299,8 +85581,8 @@ index 42b97f119623..8d10b35caed5 100644 - int param_type; + int param = -1; - if (attr == &dev_attr_iface_enabled.attr) - param = ISCSI_NET_PARAM_IFACE_ENABLE; +- if (attr == &dev_attr_iface_enabled.attr) +- param = ISCSI_NET_PARAM_IFACE_ENABLE; - else if (attr == &dev_attr_iface_vlan_id.attr) - param = ISCSI_NET_PARAM_VLAN_ID; - else if (attr == &dev_attr_iface_vlan_priority.attr) @@ -64329,10 +85611,12 @@ index 42b97f119623..8d10b35caed5 100644 - param = ISCSI_NET_PARAM_CACHE_ID; - else if (attr == &dev_attr_iface_redirect_en.attr) - param = ISCSI_NET_PARAM_REDIRECT_EN; - else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) +- else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) ++ if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO; else if (attr == &dev_attr_iface_header_digest.attr) -@@ -492,6 +467,38 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, + param = ISCSI_IFACE_PARAM_HDRDGST_EN; +@@ -492,6 +465,40 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, param = ISCSI_IFACE_PARAM_STRICT_LOGIN_COMP_EN; else if (attr == &dev_attr_iface_initiator_name.attr) param = ISCSI_IFACE_PARAM_INITIATOR_NAME; @@ -64340,7 +85624,9 @@ index 42b97f119623..8d10b35caed5 100644 + if (param != -1) + return t->attr_is_visible(ISCSI_IFACE_PARAM, param); + -+ if (attr == &dev_attr_iface_vlan_id.attr) ++ if (attr == &dev_attr_iface_enabled.attr) ++ param = ISCSI_NET_PARAM_IFACE_ENABLE; ++ else if (attr == &dev_attr_iface_vlan_id.attr) + param = ISCSI_NET_PARAM_VLAN_ID; + else if (attr == &dev_attr_iface_vlan_priority.attr) + param = ISCSI_NET_PARAM_VLAN_PRIORITY; @@ -64405,6 +85691,22 @@ index 42b97f119623..8d10b35caed5 100644 } static struct attribute *iscsi_iface_attrs[] = { +@@ -1916,12 +1898,12 @@ static void session_recovery_timedout(struct work_struct *work) + } + spin_unlock_irqrestore(&session->lock, flags); + +- if (session->transport->session_recovery_timedout) +- session->transport->session_recovery_timedout(session); +- + ISCSI_DBG_TRANS_SESSION(session, "Unblocking SCSI target\n"); + scsi_target_unblock(&session->dev, SDEV_TRANSPORT_OFFLINE); + ISCSI_DBG_TRANS_SESSION(session, "Completed unblocking SCSI target\n"); ++ ++ if (session->transport->session_recovery_timedout) ++ session->transport->session_recovery_timedout(session); + } + + static void __iscsi_unblock_session(struct work_struct *work) @@ -2323,6 +2305,18 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn) } EXPORT_SYMBOL_GPL(iscsi_destroy_conn); @@ -64537,6 +85839,44 @@ index 319868f3f674..083cd11ce7d7 100644 return -EINVAL; \ val = simple_strtoul(buf, NULL, 0); \ if (val > tp->max_##field) \ +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index dd0fdc671531..bc0992e25745 100755 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -3091,15 +3091,16 @@ static int sd_probe(struct device *dev) + } + + device_initialize(&sdkp->dev); +- sdkp->dev.parent = dev; ++ sdkp->dev.parent = get_device(dev); + sdkp->dev.class = &sd_disk_class; + dev_set_name(&sdkp->dev, "%s", dev_name(dev)); + + error = device_add(&sdkp->dev); +- if (error) +- goto out_free_index; ++ if (error) { ++ put_device(&sdkp->dev); ++ goto out; ++ } + +- get_device(dev); + dev_set_drvdata(dev, sdkp); + + get_device(&sdkp->dev); /* prevent release before async_schedule */ +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 69046d342bc5..39396548f9b5 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -120,7 +120,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code, + static int ses_send_diag(struct scsi_device *sdev, int page_code, + void *buf, int bufflen) + { +- u32 result; ++ int result; + + unsigned char cmd[] = { + SEND_DIAGNOSTIC, diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c index b0f5220ae23a..fad68cb028d6 100644 --- a/drivers/scsi/sni_53c710.c @@ -64561,7 +85901,7 @@ index b0f5220ae23a..fad68cb028d6 100644 printk(KERN_ERR "snirm710: request_irq failed!\n"); goto out_put_host; diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c -index cc484cb287d2..5e51a39a0c27 100644 +index cc484cb287d2..9b63e46edffc 100644 --- a/drivers/scsi/sr.c +++ b/drivers/scsi/sr.c @@ -216,6 +216,8 @@ static unsigned int sr_get_events(struct scsi_device *sdev) @@ -64569,7 +85909,7 @@ index cc484cb287d2..5e51a39a0c27 100644 else if (med->media_event_code == 2) return DISK_EVENT_MEDIA_CHANGE; + else if (med->media_event_code == 3) -+ return DISK_EVENT_EJECT_REQUEST; ++ return DISK_EVENT_MEDIA_CHANGE; return 0; } @@ -64777,6 +86117,28 @@ index a302ec1dc12d..57cf40b21d23 100755 err = ufshcd_clear_cmd(hba, pos); if (err) break; +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 7ba0031d3a73..d5575869a25c 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -343,7 +343,7 @@ static void virtscsi_handle_transport_reset(struct virtio_scsi *vscsi, + } + break; + default: +- pr_info("Unsupport virtio scsi event reason %x\n", event->reason); ++ pr_info("Unsupported virtio scsi event reason %x\n", event->reason); + } + } + +@@ -396,7 +396,7 @@ static void virtscsi_handle_event(struct work_struct *work) + virtscsi_handle_param_change(vscsi, event); + break; + default: +- pr_err("Unsupport virtio scsi event %x\n", event->event); ++ pr_err("Unsupported virtio scsi event %x\n", event->event); + } + virtscsi_kick_event(vscsi, event_node); + } diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c index df6fabcce4f7..4d2172c115c6 100644 --- a/drivers/scsi/vmw_pvscsi.c @@ -64796,6 +86158,30 @@ index df6fabcce4f7..4d2172c115c6 100644 cmd->result = (DID_OK << 16); break; +diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c +index bec81c2404f7..1682fa3671bc 100644 +--- a/drivers/sh/maple/maple.c ++++ b/drivers/sh/maple/maple.c +@@ -835,8 +835,10 @@ static int __init maple_bus_init(void) + + maple_queue_cache = KMEM_CACHE(maple_buffer, SLAB_HWCACHE_ALIGN); + +- if (!maple_queue_cache) ++ if (!maple_queue_cache) { ++ retval = -ENOMEM; + goto cleanup_bothirqs; ++ } + + INIT_LIST_HEAD(&maple_waitq); + INIT_LIST_HEAD(&maple_sentq); +@@ -849,6 +851,7 @@ static int __init maple_bus_init(void) + if (!mdev[i]) { + while (i-- > 0) + maple_free_dev(mdev[i]); ++ retval = -ENOMEM; + goto cleanup_cache; + } + baseunits[i] = mdev[i]; diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c index 91f5c951850f..44463afb8015 100644 --- a/drivers/soc/fsl/qbman/qman.c @@ -65464,6 +86850,68 @@ index f51fb2ea7200..4c5767c73b7a 100644 if (val != orig) qcom_smp2p_kick(entry->smp2p); +diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c +index d0337b2a71c8..783cb3364599 100644 +--- a/drivers/soc/qcom/smsm.c ++++ b/drivers/soc/qcom/smsm.c +@@ -117,7 +117,7 @@ struct smsm_entry { + DECLARE_BITMAP(irq_enabled, 32); + DECLARE_BITMAP(irq_rising, 32); + DECLARE_BITMAP(irq_falling, 32); +- u32 last_value; ++ unsigned long last_value; + + u32 *remote_state; + u32 *subscription; +@@ -212,8 +212,7 @@ static irqreturn_t smsm_intr(int irq, void *data) + u32 val; + + val = readl(entry->remote_state); +- changed = val ^ entry->last_value; +- entry->last_value = val; ++ changed = val ^ xchg(&entry->last_value, val); + + for_each_set_bit(i, entry->irq_enabled, 32) { + if (!(changed & BIT(i))) +@@ -274,6 +273,12 @@ static void smsm_unmask_irq(struct irq_data *irqd) + struct qcom_smsm *smsm = entry->smsm; + u32 val; + ++ /* Make sure our last cached state is up-to-date */ ++ if (readl(entry->remote_state) & BIT(irq)) ++ set_bit(irq, &entry->last_value); ++ else ++ clear_bit(irq, &entry->last_value); ++ + set_bit(irq, entry->irq_enabled); + + if (entry->subscription) { +diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c +index c4f5e5bbb8dc..9397e8ba2646 100644 +--- a/drivers/soc/tegra/fuse/fuse-tegra.c ++++ b/drivers/soc/tegra/fuse/fuse-tegra.c +@@ -176,7 +176,7 @@ static struct platform_driver tegra_fuse_driver = { + }; + module_platform_driver(tegra_fuse_driver); + +-bool __init tegra_fuse_read_spare(unsigned int spare) ++u32 __init tegra_fuse_read_spare(unsigned int spare) + { + unsigned int offset = fuse->soc->info->spare + spare * 4; + +diff --git a/drivers/soc/tegra/fuse/fuse.h b/drivers/soc/tegra/fuse/fuse.h +index 10c2076d5089..f368bd537308 100644 +--- a/drivers/soc/tegra/fuse/fuse.h ++++ b/drivers/soc/tegra/fuse/fuse.h +@@ -62,7 +62,7 @@ struct tegra_fuse { + void tegra_init_revision(void); + void tegra_init_apbmisc(void); + +-bool __init tegra_fuse_read_spare(unsigned int spare); ++u32 __init tegra_fuse_read_spare(unsigned int spare); + u32 __init tegra_fuse_read_early(unsigned int offset); + + #ifdef CONFIG_ARCH_TEGRA_2x_SOC diff --git a/drivers/soc/tegra/fuse/speedo-tegra210.c b/drivers/soc/tegra/fuse/speedo-tegra210.c index 5373f4c16b54..4403b89561fd 100644 --- a/drivers/soc/tegra/fuse/speedo-tegra210.c @@ -65477,6 +86925,28 @@ index 5373f4c16b54..4403b89561fd 100644 return i; return -EINVAL; +diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c +index a12710c917a1..93da93513039 100644 +--- a/drivers/soc/tegra/pmc.c ++++ b/drivers/soc/tegra/pmc.c +@@ -384,7 +384,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg, + + err = tegra_powergate_enable_clocks(pg); + if (err) +- goto disable_clks; ++ goto powergate_off; + + usleep_range(10, 20); + +@@ -396,7 +396,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg, + + err = tegra_powergate_reset_deassert(pg); + if (err) +- goto powergate_off; ++ goto disable_clks; + + usleep_range(10, 20); + diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c index 1a7b5caa127b..b86bea453732 100644 --- a/drivers/soc/ti/knav_dma.c @@ -65552,7 +87022,7 @@ index fc96f62a4838..37c55881b916 100644 + endif # SPI diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c -index 63231760facc..5453910d8abc 100644 +index 63231760facc..d521adf6ac24 100644 --- a/drivers/spi/spi-bcm-qspi.c +++ b/drivers/spi/spi-bcm-qspi.c @@ -698,7 +698,7 @@ static void read_from_hw(struct bcm_qspi *qspi, int slots) @@ -65648,6 +87118,24 @@ index 63231760facc..5453910d8abc 100644 for (val = 0; val < num_irqs; val++) { irq = -1; +@@ -1274,7 +1266,7 @@ int bcm_qspi_probe(struct platform_device *pdev, + &qspi->dev_ids[val]); + if (ret < 0) { + dev_err(&pdev->dev, "IRQ %s not found\n", name); +- goto qspi_probe_err; ++ goto qspi_unprepare_err; + } + + qspi->dev_ids[val].dev = qspi; +@@ -1289,7 +1281,7 @@ int bcm_qspi_probe(struct platform_device *pdev, + if (!num_ints) { + dev_err(&pdev->dev, "no IRQs registered, cannot init driver\n"); + ret = -EINVAL; +- goto qspi_probe_err; ++ goto qspi_unprepare_err; + } + + /* @@ -1330,7 +1322,7 @@ int bcm_qspi_probe(struct platform_device *pdev, qspi->xfer_mode.addrlen = -1; qspi->xfer_mode.hp = -1; @@ -65657,7 +87145,11 @@ index 63231760facc..5453910d8abc 100644 if (ret < 0) { dev_err(dev, "can't register master\n"); goto qspi_reg_err; -@@ -1343,8 +1335,6 @@ int bcm_qspi_probe(struct platform_device *pdev, +@@ -1340,11 +1332,10 @@ int bcm_qspi_probe(struct platform_device *pdev, + + qspi_reg_err: + bcm_qspi_hw_uninit(qspi); ++qspi_unprepare_err: clk_disable_unprepare(qspi->clk); qspi_probe_err: kfree(qspi->dev_ids); @@ -65666,7 +87158,7 @@ index 63231760facc..5453910d8abc 100644 return ret; } /* probe function to be called by SoC specific platform driver probe */ -@@ -1355,10 +1345,10 @@ int bcm_qspi_remove(struct platform_device *pdev) +@@ -1355,10 +1346,10 @@ int bcm_qspi_remove(struct platform_device *pdev) struct bcm_qspi *qspi = platform_get_drvdata(pdev); platform_set_drvdata(pdev, NULL); @@ -66050,32 +87542,29 @@ index 50e620f4e8fe..cac38753d0cd 100644 } diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c -index 899d7a8f0889..419aecb94274 100644 +index 899d7a8f0889..dd0bf25d4550 100644 --- a/drivers/spi/spi-mt65xx.c +++ b/drivers/spi/spi-mt65xx.c -@@ -338,13 +338,23 @@ static int mtk_spi_fifo_transfer(struct spi_master *master, +@@ -337,14 +337,15 @@ static int mtk_spi_fifo_transfer(struct spi_master *master, + mtk_spi_prepare_transfer(master, xfer); mtk_spi_setup_packet(master); - cnt = xfer->len / 4; +- cnt = xfer->len / 4; - iowrite32_rep(mdata->base + SPI_TX_DATA_REG, xfer->tx_buf, cnt); -+ if (xfer->tx_buf) -+ iowrite32_rep(mdata->base + SPI_TX_DATA_REG, xfer->tx_buf, cnt); -+ -+ if (xfer->rx_buf) -+ ioread32_rep(mdata->base + SPI_RX_DATA_REG, xfer->rx_buf, cnt); - - remainder = xfer->len % 4; - if (remainder > 0) { - reg_val = 0; +- +- remainder = xfer->len % 4; +- if (remainder > 0) { +- reg_val = 0; - memcpy(®_val, xfer->tx_buf + (cnt * 4), remainder); - writel(reg_val, mdata->base + SPI_TX_DATA_REG); -+ if (xfer->tx_buf) { ++ if (xfer->tx_buf) { ++ cnt = xfer->len / 4; ++ iowrite32_rep(mdata->base + SPI_TX_DATA_REG, xfer->tx_buf, cnt); ++ remainder = xfer->len % 4; ++ if (remainder > 0) { ++ reg_val = 0; + memcpy(®_val, xfer->tx_buf + (cnt * 4), remainder); + writel(reg_val, mdata->base + SPI_TX_DATA_REG); -+ } -+ if (xfer->rx_buf) { -+ reg_val = readl(mdata->base + SPI_RX_DATA_REG); -+ memcpy(xfer->rx_buf + (cnt * 4), ®_val, remainder); + } } @@ -66121,10 +87610,18 @@ index 76a8425be227..2eeb0fe2eed2 100644 int ret; diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c -index 2f4df804c4d8..9a97ad973c41 100644 +index 2f4df804c4d8..021dddf484e5 100644 --- a/drivers/spi/spi-pic32.c +++ b/drivers/spi/spi-pic32.c -@@ -839,6 +839,7 @@ static int pic32_spi_probe(struct platform_device *pdev) +@@ -369,6 +369,7 @@ static int pic32_spi_dma_config(struct pic32_spi *pic32s, u32 dma_width) + struct dma_slave_config cfg; + int ret; + ++ memset(&cfg, 0, sizeof(cfg)); + cfg.device_fc = true; + cfg.src_addr = pic32s->dma_base + buf_offset; + cfg.dst_addr = pic32s->dma_base + buf_offset; +@@ -839,6 +840,7 @@ static int pic32_spi_probe(struct platform_device *pdev) return 0; err_bailout: @@ -66132,6 +87629,26 @@ index 2f4df804c4d8..9a97ad973c41 100644 clk_disable_unprepare(pic32s->clk); err_master: spi_master_put(master); +diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c +index f7f7ba17b40e..27cf77dfc603 100644 +--- a/drivers/spi/spi-pl022.c ++++ b/drivers/spi/spi-pl022.c +@@ -1703,12 +1703,13 @@ static int verify_controller_parameters(struct pl022 *pl022, + return -EINVAL; + } + } else { +- if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) ++ if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) { + dev_err(&pl022->adev->dev, + "Microwire half duplex mode requested," + " but this is only available in the" + " ST version of PL022\n"); +- return -EINVAL; ++ return -EINVAL; ++ } + } + } + return 0; diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c index 58d2d48e16a5..c37e35aeafa4 100644 --- a/drivers/spi/spi-pxa2xx-pci.c @@ -66492,7 +88009,7 @@ index b6558bb6f9df..4b9541e1726a 100644 return ret; } diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c -index cf2a329fd895..9f14560686b6 100644 +index cf2a329fd895..88bfe7682a9e 100644 --- a/drivers/spi/spi-tegra20-slink.c +++ b/drivers/spi/spi-tegra20-slink.c @@ -761,6 +761,7 @@ static int tegra_slink_setup(struct spi_device *spi) @@ -66511,6 +88028,24 @@ index cf2a329fd895..9f14560686b6 100644 dev_err(dev, "pm runtime failed, e = %d\n", ret); return ret; } +@@ -1208,7 +1210,7 @@ static int tegra_slink_resume(struct device *dev) + } + #endif + +-static int tegra_slink_runtime_suspend(struct device *dev) ++static int __maybe_unused tegra_slink_runtime_suspend(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); + struct tegra_slink_data *tspi = spi_master_get_devdata(master); +@@ -1220,7 +1222,7 @@ static int tegra_slink_runtime_suspend(struct device *dev) + return 0; + } + +-static int tegra_slink_runtime_resume(struct device *dev) ++static int __maybe_unused tegra_slink_runtime_resume(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); + struct tegra_slink_data *tspi = spi_master_get_devdata(master); diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c index 4cb72a8e4646..b0a5486936c0 100644 --- a/drivers/spi/spi-ti-qspi.c @@ -67174,6 +88709,96 @@ index 2278e43614bd..5e10514ef80c 100644 goto err_out; } offset |= bus->sdio_sbaddr & 0xffff; +diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c +index 7fec28cf3850..85e1c25cc98a 100644 +--- a/drivers/staging/android/ion/ion.c ++++ b/drivers/staging/android/ion/ion.c +@@ -765,6 +765,9 @@ static void *ion_buffer_kmap_get(struct ion_buffer *buffer) + void *vaddr; + + if (buffer->kmap_cnt) { ++ if (buffer->kmap_cnt == INT_MAX) ++ return ERR_PTR(-EOVERFLOW); ++ + buffer->kmap_cnt++; + return buffer->vaddr; + } +@@ -785,6 +788,9 @@ static void *ion_handle_kmap_get(struct ion_handle *handle) + void *vaddr; + + if (handle->kmap_cnt) { ++ if (handle->kmap_cnt == INT_MAX) ++ return ERR_PTR(-EOVERFLOW); ++ + handle->kmap_cnt++; + return buffer->vaddr; + } +@@ -1349,42 +1355,45 @@ static void ion_dma_buf_release(struct dma_buf *dmabuf) + static void *ion_dma_buf_kmap(struct dma_buf *dmabuf, unsigned long offset) + { + struct ion_buffer *buffer = dmabuf->priv; ++ void *vaddr; + +- return buffer->vaddr + offset * PAGE_SIZE; ++ if (!buffer->heap->ops->map_kernel) { ++ pr_err("%s: map kernel is not implemented by this heap.\n", ++ __func__); ++ return ERR_PTR(-ENOTTY); ++ } ++ mutex_lock(&buffer->lock); ++ vaddr = ion_buffer_kmap_get(buffer); ++ mutex_unlock(&buffer->lock); ++ ++ if (IS_ERR(vaddr)) ++ return vaddr; ++ ++ return vaddr + offset * PAGE_SIZE; + } + + static void ion_dma_buf_kunmap(struct dma_buf *dmabuf, unsigned long offset, + void *ptr) + { ++ struct ion_buffer *buffer = dmabuf->priv; ++ ++ if (buffer->heap->ops->map_kernel) { ++ mutex_lock(&buffer->lock); ++ ion_buffer_kmap_put(buffer); ++ mutex_unlock(&buffer->lock); ++ } ++ + } + + static int ion_dma_buf_begin_cpu_access(struct dma_buf *dmabuf, + enum dma_data_direction direction) + { +- struct ion_buffer *buffer = dmabuf->priv; +- void *vaddr; +- +- if (!buffer->heap->ops->map_kernel) { +- pr_err("%s: map kernel is not implemented by this heap.\n", +- __func__); +- return -ENODEV; +- } +- +- mutex_lock(&buffer->lock); +- vaddr = ion_buffer_kmap_get(buffer); +- mutex_unlock(&buffer->lock); +- return PTR_ERR_OR_ZERO(vaddr); ++ return 0; + } + + static int ion_dma_buf_end_cpu_access(struct dma_buf *dmabuf, + enum dma_data_direction direction) + { +- struct ion_buffer *buffer = dmabuf->priv; +- +- mutex_lock(&buffer->lock); +- ion_buffer_kmap_put(buffer); +- mutex_unlock(&buffer->lock); +- + return 0; + } + diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c index 43d3f92cd418..b27fc68d03dc 100644 --- a/drivers/staging/android/ion/ion_heap.c @@ -67207,6 +88832,31 @@ index 954ed2c5d807..a9aa89cf8778 100644 copy_from_user(&managed_fd, &arg->managed_region_fd, sizeof(managed_fd))) { return -EFAULT; +diff --git a/drivers/staging/board/board.c b/drivers/staging/board/board.c +index 86dc41101610..1e2b33912a8a 100644 +--- a/drivers/staging/board/board.c ++++ b/drivers/staging/board/board.c +@@ -139,6 +139,7 @@ int __init board_staging_register_clock(const struct board_staging_clk *bsc) + static int board_staging_add_dev_domain(struct platform_device *pdev, + const char *domain) + { ++ struct device *dev = &pdev->dev; + struct of_phandle_args pd_args; + struct device_node *np; + +@@ -151,7 +152,11 @@ static int board_staging_add_dev_domain(struct platform_device *pdev, + pd_args.np = np; + pd_args.args_count = 0; + +- return of_genpd_add_device(&pd_args, &pdev->dev); ++ /* Initialization similar to device_pm_init_common() */ ++ spin_lock_init(&dev->power.lock); ++ dev->power.early_init = true; ++ ++ return of_genpd_add_device(&pd_args, dev); + } + #else + static inline int board_staging_add_dev_domain(struct platform_device *pdev, diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c b/drivers/staging/comedi/drivers/addi_apci_1032.c index ccd1a91290bf..9058ef473c33 100644 --- a/drivers/staging/comedi/drivers/addi_apci_1032.c @@ -67533,6 +89183,187 @@ index b8606ded0623..a2e3240b66a8 100644 int i; if (!dev->attached) { +diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c +index 7ebca862ecaa..e758eb3d2d19 100644 +--- a/drivers/staging/comedi/drivers/dt9812.c ++++ b/drivers/staging/comedi/drivers/dt9812.c +@@ -41,6 +41,7 @@ + #include + #include + #include ++#include + #include + + #include "../comedi_usb.h" +@@ -246,22 +247,42 @@ static int dt9812_read_info(struct comedi_device *dev, + { + struct usb_device *usb = comedi_to_usb_dev(dev); + struct dt9812_private *devpriv = dev->private; +- struct dt9812_usb_cmd cmd; ++ struct dt9812_usb_cmd *cmd; ++ size_t tbuf_size; + int count, ret; ++ void *tbuf; + +- cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA); +- cmd.u.flash_data_info.address = ++ tbuf_size = max(sizeof(*cmd), buf_size); ++ ++ tbuf = kzalloc(tbuf_size, GFP_KERNEL); ++ if (!tbuf) ++ return -ENOMEM; ++ ++ cmd = tbuf; ++ ++ cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA); ++ cmd->u.flash_data_info.address = + cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset); +- cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size); ++ cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size); + + /* DT9812 only responds to 32 byte writes!! */ + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), +- &cmd, 32, &count, DT9812_USB_TIMEOUT); ++ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); + if (ret) +- return ret; ++ goto out; ++ ++ ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), ++ tbuf, buf_size, &count, DT9812_USB_TIMEOUT); ++ if (!ret) { ++ if (count == buf_size) ++ memcpy(buf, tbuf, buf_size); ++ else ++ ret = -EREMOTEIO; ++ } ++out: ++ kfree(tbuf); + +- return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), +- buf, buf_size, &count, DT9812_USB_TIMEOUT); ++ return ret; + } + + static int dt9812_read_multiple_registers(struct comedi_device *dev, +@@ -270,22 +291,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev, + { + struct usb_device *usb = comedi_to_usb_dev(dev); + struct dt9812_private *devpriv = dev->private; +- struct dt9812_usb_cmd cmd; ++ struct dt9812_usb_cmd *cmd; + int i, count, ret; ++ size_t buf_size; ++ void *buf; + +- cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); +- cmd.u.read_multi_info.count = reg_count; ++ buf_size = max_t(size_t, sizeof(*cmd), reg_count); ++ ++ buf = kzalloc(buf_size, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ cmd = buf; ++ ++ cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); ++ cmd->u.read_multi_info.count = reg_count; + for (i = 0; i < reg_count; i++) +- cmd.u.read_multi_info.address[i] = address[i]; ++ cmd->u.read_multi_info.address[i] = address[i]; + + /* DT9812 only responds to 32 byte writes!! */ + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), +- &cmd, 32, &count, DT9812_USB_TIMEOUT); ++ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); + if (ret) +- return ret; ++ goto out; ++ ++ ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), ++ buf, reg_count, &count, DT9812_USB_TIMEOUT); ++ if (!ret) { ++ if (count == reg_count) ++ memcpy(value, buf, reg_count); ++ else ++ ret = -EREMOTEIO; ++ } ++out: ++ kfree(buf); + +- return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), +- value, reg_count, &count, DT9812_USB_TIMEOUT); ++ return ret; + } + + static int dt9812_write_multiple_registers(struct comedi_device *dev, +@@ -294,19 +335,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev, + { + struct usb_device *usb = comedi_to_usb_dev(dev); + struct dt9812_private *devpriv = dev->private; +- struct dt9812_usb_cmd cmd; ++ struct dt9812_usb_cmd *cmd; + int i, count; ++ int ret; ++ ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); ++ if (!cmd) ++ return -ENOMEM; + +- cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); +- cmd.u.read_multi_info.count = reg_count; ++ cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); ++ cmd->u.read_multi_info.count = reg_count; + for (i = 0; i < reg_count; i++) { +- cmd.u.write_multi_info.write[i].address = address[i]; +- cmd.u.write_multi_info.write[i].value = value[i]; ++ cmd->u.write_multi_info.write[i].address = address[i]; ++ cmd->u.write_multi_info.write[i].value = value[i]; + } + + /* DT9812 only responds to 32 byte writes!! */ +- return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), +- &cmd, 32, &count, DT9812_USB_TIMEOUT); ++ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), ++ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); ++ kfree(cmd); ++ ++ return ret; + } + + static int dt9812_rmw_multiple_registers(struct comedi_device *dev, +@@ -315,17 +364,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev, + { + struct usb_device *usb = comedi_to_usb_dev(dev); + struct dt9812_private *devpriv = dev->private; +- struct dt9812_usb_cmd cmd; ++ struct dt9812_usb_cmd *cmd; + int i, count; ++ int ret; ++ ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); ++ if (!cmd) ++ return -ENOMEM; + +- cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); +- cmd.u.rmw_multi_info.count = reg_count; ++ cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); ++ cmd->u.rmw_multi_info.count = reg_count; + for (i = 0; i < reg_count; i++) +- cmd.u.rmw_multi_info.rmw[i] = rmw[i]; ++ cmd->u.rmw_multi_info.rmw[i] = rmw[i]; + + /* DT9812 only responds to 32 byte writes!! */ +- return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), +- &cmd, 32, &count, DT9812_USB_TIMEOUT); ++ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), ++ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); ++ kfree(cmd); ++ ++ return ret; + } + + static int dt9812_digital_in(struct comedi_device *dev, u8 *bits) diff --git a/drivers/staging/comedi/drivers/me4000.c b/drivers/staging/comedi/drivers/me4000.c index 15a53204a36a..4fe856128870 100644 --- a/drivers/staging/comedi/drivers/me4000.c @@ -67574,6 +89405,34 @@ index 84c62e256094..6e411b634015 100644 mask = 0; rising = 0; falling = 0; +diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c +index 2f174a34d9e9..7f647d80ec05 100644 +--- a/drivers/staging/comedi/drivers/ni_usb6501.c ++++ b/drivers/staging/comedi/drivers/ni_usb6501.c +@@ -153,6 +153,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, + 0x00, 0x00, 0x00, 0x02, + 0x00, 0x00, 0x00, 0x00}; + ++/* Largest supported packets */ ++static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); ++static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); ++ + enum commands { + READ_PORT, + WRITE_PORT, +@@ -510,6 +514,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev) + if (!devpriv->ep_rx || !devpriv->ep_tx) + return -ENODEV; + ++ if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE) ++ return -ENODEV; ++ ++ if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE) ++ return -ENODEV; ++ + return 0; + } + diff --git a/drivers/staging/comedi/drivers/pcl711.c b/drivers/staging/comedi/drivers/pcl711.c index 3774daa9d661..e1334733abe7 100644 --- a/drivers/staging/comedi/drivers/pcl711.c @@ -67601,10 +89460,69 @@ index 5aeed44dff70..f06241712308 100644 struct pcl818_private *devpriv = dev->private; struct comedi_cmd *cmd = &s->async->cmd; diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c -index 1800eb3ae017..cdf86284dd04 100644 +index 1800eb3ae017..36470ee06596 100644 --- a/drivers/staging/comedi/drivers/vmk80xx.c +++ b/drivers/staging/comedi/drivers/vmk80xx.c -@@ -676,6 +676,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev) +@@ -99,6 +99,9 @@ enum { + #define IC3_VERSION BIT(0) + #define IC6_VERSION BIT(1) + ++#define MIN_BUF_SIZE 64 ++#define PACKET_TIMEOUT 10000 /* ms */ ++ + enum vmk80xx_model { + VMK8055_MODEL, + VMK8061_MODEL +@@ -166,22 +169,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev) + __u8 rx_addr; + unsigned int tx_pipe; + unsigned int rx_pipe; +- size_t size; ++ size_t tx_size; ++ size_t rx_size; + + tx_addr = devpriv->ep_tx->bEndpointAddress; + rx_addr = devpriv->ep_rx->bEndpointAddress; + tx_pipe = usb_sndbulkpipe(usb, tx_addr); + rx_pipe = usb_rcvbulkpipe(usb, rx_addr); ++ tx_size = usb_endpoint_maxp(devpriv->ep_tx); ++ rx_size = usb_endpoint_maxp(devpriv->ep_rx); + +- /* +- * The max packet size attributes of the K8061 +- * input/output endpoints are identical +- */ +- size = usb_endpoint_maxp(devpriv->ep_tx); ++ usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL, ++ PACKET_TIMEOUT); + +- usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, +- size, NULL, devpriv->ep_tx->bInterval); +- usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10); ++ usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL, ++ PACKET_TIMEOUT); + } + + static int vmk80xx_read_packet(struct comedi_device *dev) +@@ -200,7 +202,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev) + pipe = usb_rcvintpipe(usb, ep->bEndpointAddress); + return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf, + usb_endpoint_maxp(ep), NULL, +- HZ * 10); ++ PACKET_TIMEOUT); + } + + static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) +@@ -221,7 +223,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) + pipe = usb_sndintpipe(usb, ep->bEndpointAddress); + return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf, + usb_endpoint_maxp(ep), NULL, +- HZ * 10); ++ PACKET_TIMEOUT); + } + + static int vmk80xx_reset_device(struct comedi_device *dev) +@@ -676,6 +678,9 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev) if (!devpriv->ep_rx || !devpriv->ep_tx) return -ENODEV; @@ -67614,6 +89532,21 @@ index 1800eb3ae017..cdf86284dd04 100644 return 0; } +@@ -684,12 +689,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev) + struct vmk80xx_private *devpriv = dev->private; + size_t size; + +- size = usb_endpoint_maxp(devpriv->ep_rx); ++ size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); + devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL); + if (!devpriv->usb_rx_buf) + return -ENOMEM; + +- size = usb_endpoint_maxp(devpriv->ep_tx); ++ size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); + devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); + if (!devpriv->usb_tx_buf) + return -ENOMEM; diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c index 1055649f034c..59266650e071 100644 --- a/drivers/staging/emxx_udc/emxx_udc.c @@ -67827,7 +89760,7 @@ index 5649ef1e379d..82a1c2cf6687 100644 goto out; diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c -index 9ef9cbfd8926..c35c9b766a00 100644 +index 9ef9cbfd8926..d4c7210cdb0e 100644 --- a/drivers/staging/greybus/uart.c +++ b/drivers/staging/greybus/uart.c @@ -661,8 +661,6 @@ static int set_serial_info(struct gb_tty *gb_tty, @@ -67839,6 +89772,151 @@ index 9ef9cbfd8926..c35c9b766a00 100644 } else { gb_tty->port.close_delay = close_delay; gb_tty->port.closing_wait = closing_wait; +@@ -814,6 +812,17 @@ static void gb_tty_port_shutdown(struct tty_port *port) + gbphy_runtime_put_autosuspend(gb_tty->gbphy_dev); + } + ++static void gb_tty_port_destruct(struct tty_port *port) ++{ ++ struct gb_tty *gb_tty = container_of(port, struct gb_tty, port); ++ ++ if (gb_tty->minor != GB_NUM_MINORS) ++ release_minor(gb_tty); ++ kfifo_free(&gb_tty->write_fifo); ++ kfree(gb_tty->buffer); ++ kfree(gb_tty); ++} ++ + static const struct tty_operations gb_ops = { + .install = gb_tty_install, + .open = gb_tty_open, +@@ -836,6 +845,7 @@ static struct tty_port_operations gb_port_ops = { + .dtr_rts = gb_tty_dtr_rts, + .activate = gb_tty_port_activate, + .shutdown = gb_tty_port_shutdown, ++ .destruct = gb_tty_port_destruct, + }; + + static int gb_uart_probe(struct gbphy_device *gbphy_dev, +@@ -848,17 +858,11 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + int retval; + int minor; + +- gb_tty = kzalloc(sizeof(*gb_tty), GFP_KERNEL); +- if (!gb_tty) +- return -ENOMEM; +- + connection = gb_connection_create(gbphy_dev->bundle, + le16_to_cpu(gbphy_dev->cport_desc->id), + gb_uart_request_handler); +- if (IS_ERR(connection)) { +- retval = PTR_ERR(connection); +- goto exit_tty_free; +- } ++ if (IS_ERR(connection)) ++ return PTR_ERR(connection); + + max_payload = gb_operation_get_payload_size_max(connection); + if (max_payload < sizeof(struct gb_uart_send_data_request)) { +@@ -866,13 +870,23 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + goto exit_connection_destroy; + } + ++ gb_tty = kzalloc(sizeof(*gb_tty), GFP_KERNEL); ++ if (!gb_tty) { ++ retval = -ENOMEM; ++ goto exit_connection_destroy; ++ } ++ ++ tty_port_init(&gb_tty->port); ++ gb_tty->port.ops = &gb_port_ops; ++ gb_tty->minor = GB_NUM_MINORS; ++ + gb_tty->buffer_payload_max = max_payload - + sizeof(struct gb_uart_send_data_request); + + gb_tty->buffer = kzalloc(gb_tty->buffer_payload_max, GFP_KERNEL); + if (!gb_tty->buffer) { + retval = -ENOMEM; +- goto exit_connection_destroy; ++ goto exit_put_port; + } + + INIT_WORK(&gb_tty->tx_work, gb_uart_tx_write_work); +@@ -880,7 +894,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + retval = kfifo_alloc(&gb_tty->write_fifo, GB_UART_WRITE_FIFO_SIZE, + GFP_KERNEL); + if (retval) +- goto exit_buf_free; ++ goto exit_put_port; + + gb_tty->credits = GB_UART_FIRMWARE_CREDITS; + init_completion(&gb_tty->credits_complete); +@@ -894,7 +908,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + } else { + retval = minor; + } +- goto exit_kfifo_free; ++ goto exit_put_port; + } + + gb_tty->minor = minor; +@@ -903,9 +917,6 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + init_waitqueue_head(&gb_tty->wioctl); + mutex_init(&gb_tty->mutex); + +- tty_port_init(&gb_tty->port); +- gb_tty->port.ops = &gb_port_ops; +- + gb_tty->connection = connection; + gb_tty->gbphy_dev = gbphy_dev; + gb_connection_set_data(connection, gb_tty); +@@ -913,7 +924,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + + retval = gb_connection_enable_tx(connection); + if (retval) +- goto exit_release_minor; ++ goto exit_put_port; + + send_control(gb_tty, gb_tty->ctrlout); + +@@ -940,16 +951,10 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev, + + exit_connection_disable: + gb_connection_disable(connection); +-exit_release_minor: +- release_minor(gb_tty); +-exit_kfifo_free: +- kfifo_free(&gb_tty->write_fifo); +-exit_buf_free: +- kfree(gb_tty->buffer); ++exit_put_port: ++ tty_port_put(&gb_tty->port); + exit_connection_destroy: + gb_connection_destroy(connection); +-exit_tty_free: +- kfree(gb_tty); + + return retval; + } +@@ -980,15 +985,10 @@ static void gb_uart_remove(struct gbphy_device *gbphy_dev) + gb_connection_disable_rx(connection); + tty_unregister_device(gb_tty_driver, gb_tty->minor); + +- /* FIXME - free transmit / receive buffers */ +- + gb_connection_disable(connection); +- tty_port_destroy(&gb_tty->port); + gb_connection_destroy(connection); +- release_minor(gb_tty); +- kfifo_free(&gb_tty->write_fifo); +- kfree(gb_tty->buffer); +- kfree(gb_tty); ++ ++ tty_port_put(&gb_tty->port); + } + + static int gb_tty_init(void) diff --git a/drivers/staging/iio/cdc/ad7746.c b/drivers/staging/iio/cdc/ad7746.c index 5771d4ee8ef1..1a71bca4e698 100644 --- a/drivers/staging/iio/cdc/ad7746.c @@ -67871,6 +89949,21 @@ index 08f1583ee34e..fb3ec56d45b6 100644 gain_trim_val = (unsigned int)(((chip->taos_settings.als_cal_target) * chip->taos_settings.als_gain_trim) / lux_val); +diff --git a/drivers/staging/ks7010/ks7010_sdio.c b/drivers/staging/ks7010/ks7010_sdio.c +index 81c46f4d0935..16d2036018e2 100644 +--- a/drivers/staging/ks7010/ks7010_sdio.c ++++ b/drivers/staging/ks7010/ks7010_sdio.c +@@ -1037,9 +1037,9 @@ static int ks7010_sdio_probe(struct sdio_func *func, + memset(&priv->wstats, 0, sizeof(priv->wstats)); + + /* sleep mode */ ++ atomic_set(&priv->sleepstatus.status, 0); + atomic_set(&priv->sleepstatus.doze_request, 0); + atomic_set(&priv->sleepstatus.wakeup_request, 0); +- atomic_set(&priv->sleepstatus.wakeup_request, 0); + + trx_device_init(priv); + hostif_init(priv); diff --git a/drivers/staging/ks7010/ks_wlan_net.c b/drivers/staging/ks7010/ks_wlan_net.c index b2b4fa4c3834..498ea7754dcc 100644 --- a/drivers/staging/ks7010/ks_wlan_net.c @@ -68136,6 +90229,26 @@ index c14088075c59..3afdb326e224 100644 {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ {} /* Terminating entry */ }; +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +index 0d6fe039ac19..234a46ff4484 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +@@ -2710,13 +2710,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev) + free_irq(dev->irq, dev); + priv->irq = 0; + } +- free_rtllib(dev); + + if (dev->mem_start != 0) { + iounmap((void __iomem *)dev->mem_start); + release_mem_region(pci_resource_start(pdev, 1), + pci_resource_len(pdev, 1)); + } ++ ++ free_rtllib(dev); + } else { + priv = rtllib_priv(dev); + } diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c index 7413a100ca19..fb3291dde3ae 100644 --- a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c @@ -68181,9 +90294,90 @@ index c743182b933e..247475aa522e 100644 network->bCcxRmEnable = true; else diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c -index 6ec379056650..53b77c8ae328 100644 +index 6ec379056650..95cbf7cf55e6 100644 --- a/drivers/staging/rtl8192u/r8192U_core.c +++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -266,7 +266,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data) + + status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), + RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, +- indx | 0xfe00, 0, usbdata, 1, HZ / 2); ++ indx | 0xfe00, 0, usbdata, 1, 500); + kfree(usbdata); + + if (status < 0){ +@@ -289,7 +289,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data) + + status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), + RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, +- indx | 0xfe00, 0, usbdata, 1, HZ / 2); ++ indx | 0xfe00, 0, usbdata, 1, 500); + *data = *usbdata; + kfree(usbdata); + +@@ -317,7 +317,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data) + status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), + RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, + (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, +- usbdata, 1, HZ / 2); ++ usbdata, 1, 500); + kfree(usbdata); + + if (status < 0) { +@@ -344,7 +344,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data) + status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), + RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, + (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, +- usbdata, 2, HZ / 2); ++ usbdata, 2, 500); + kfree(usbdata); + + if (status < 0) { +@@ -371,7 +371,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data) + status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), + RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, + (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, +- usbdata, 4, HZ / 2); ++ usbdata, 4, 500); + kfree(usbdata); + + +@@ -399,7 +399,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data) + status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), + RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, + (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, +- usbdata, 1, HZ / 2); ++ usbdata, 1, 500); + *data = *usbdata; + kfree(usbdata); + +@@ -426,7 +426,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data) + status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), + RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, + (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, +- usbdata, 2, HZ / 2); ++ usbdata, 2, 500); + *data = *usbdata; + kfree(usbdata); + +@@ -450,7 +450,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data) + + status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), + RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, +- indx | 0xfe00, 0, usbdata, 2, HZ / 2); ++ indx | 0xfe00, 0, usbdata, 2, 500); + *data = *usbdata; + kfree(usbdata); + +@@ -476,7 +476,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data) + status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), + RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, + (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, +- usbdata, 4, HZ / 2); ++ usbdata, 4, 500); + *data = *usbdata; + kfree(usbdata); + @@ -2522,7 +2522,7 @@ static int rtl8192_read_eeprom_info(struct net_device *dev) ret = eprom_read(dev, (EEPROM_TxPwIndex_CCK >> 1)); if (ret < 0) @@ -68249,6 +90443,19 @@ index 2d26f9a30fcf..af190b3863c8 100644 if (IS_ERR(ext)) return PTR_ERR(ext); +diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c +index fc6bb0be2a28..2919498fd808 100644 +--- a/drivers/staging/rtl8712/usb_ops_linux.c ++++ b/drivers/staging/rtl8712/usb_ops_linux.c +@@ -504,7 +504,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, + memcpy(pIo_buf, pdata, len); + } + status = usb_control_msg(udev, pipe, request, reqtype, value, index, +- pIo_buf, len, HZ / 2); ++ pIo_buf, len, 500); + if (status > 0) { /* Success this control transfer. */ + if (requesttype == 0x01) { + /* For Control read transfer, we have to copy the read diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c index 86ace1449309..ee54711cf8e8 100644 --- a/drivers/staging/sm750fb/sm750.c @@ -68456,6 +90663,43 @@ index e8efb4299a95..26b8828101ea 100644 } static void iscsi_target_login_timeout(unsigned long data) +diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c +index ee5b29aed54b..fa28fd89add6 100644 +--- a/drivers/target/target_core_alua.c ++++ b/drivers/target/target_core_alua.c +@@ -1735,7 +1735,6 @@ int core_alua_set_tg_pt_gp_id( + pr_err("Maximum ALUA alua_tg_pt_gps_count:" + " 0x0000ffff reached\n"); + spin_unlock(&dev->t10_alua.tg_pt_gps_lock); +- kmem_cache_free(t10_alua_tg_pt_gp_cache, tg_pt_gp); + return -ENOSPC; + } + again: +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index c3d576ed6f13..d8c3c72da746 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -787,6 +787,8 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + INIT_LIST_HEAD(&dev->t10_alua.lba_map_list); + spin_lock_init(&dev->t10_alua.lba_map_lock); + ++ INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work); ++ + dev->t10_wwn.t10_dev = dev; + dev->t10_alua.t10_dev = dev; + +diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h +index be52838cc1a8..48a631ab449e 100644 +--- a/drivers/target/target_core_internal.h ++++ b/drivers/target/target_core_internal.h +@@ -144,6 +144,7 @@ void transport_clear_lun_ref(struct se_lun *); + void transport_send_task_abort(struct se_cmd *); + sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size); + void target_qf_do_work(struct work_struct *work); ++void target_do_delayed_work(struct work_struct *work); + bool target_check_wce(struct se_device *dev); + bool target_check_fua(struct se_device *dev); + void __target_execute_cmd(struct se_cmd *, bool); diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c index ef1c8c158f66..089ba39f76a2 100644 --- a/drivers/target/target_core_pscsi.c @@ -68646,7 +90890,7 @@ index b3b1461ec60d..6a5a089fd13e 100644 return ret; break; diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index e738b4621cbb..6afb65387be6 100644 +index e738b4621cbb..0e9383fbdd4d 100644 --- a/drivers/target/target_core_transport.c +++ b/drivers/target/target_core_transport.c @@ -1736,6 +1736,10 @@ void transport_generic_request_failure(struct se_cmd *cmd, @@ -68660,7 +90904,156 @@ index e738b4621cbb..6afb65387be6 100644 break; case TCM_OUT_OF_RESOURCES: sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; -@@ -2775,9 +2779,7 @@ __transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop, +@@ -1879,32 +1883,35 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + */ + switch (cmd->sam_task_attr) { + case TCM_HEAD_TAG: ++ atomic_inc_mb(&dev->non_ordered); + pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x\n", + cmd->t_task_cdb[0]); + return false; + case TCM_ORDERED_TAG: +- atomic_inc_mb(&dev->dev_ordered_sync); ++ atomic_inc_mb(&dev->delayed_cmd_count); + + pr_debug("Added ORDERED for CDB: 0x%02x to ordered list\n", + cmd->t_task_cdb[0]); +- +- /* +- * Execute an ORDERED command if no other older commands +- * exist that need to be completed first. +- */ +- if (!atomic_read(&dev->simple_cmds)) +- return false; + break; + default: + /* + * For SIMPLE and UNTAGGED Task Attribute commands + */ +- atomic_inc_mb(&dev->simple_cmds); ++ atomic_inc_mb(&dev->non_ordered); ++ ++ if (atomic_read(&dev->delayed_cmd_count) == 0) ++ return false; + break; + } + +- if (atomic_read(&dev->dev_ordered_sync) == 0) +- return false; ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) { ++ atomic_inc_mb(&dev->delayed_cmd_count); ++ /* ++ * We will account for this when we dequeue from the delayed ++ * list. ++ */ ++ atomic_dec_mb(&dev->non_ordered); ++ } + + spin_lock(&dev->delayed_cmd_lock); + list_add_tail(&cmd->se_delayed_node, &dev->delayed_cmd_list); +@@ -1912,6 +1919,12 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + + pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to delayed CMD listn", + cmd->t_task_cdb[0], cmd->sam_task_attr); ++ /* ++ * We may have no non ordered cmds when this function started or we ++ * could have raced with the last simple/head cmd completing, so kick ++ * the delayed handler here. ++ */ ++ schedule_work(&dev->delayed_cmd_work); + return true; + } + +@@ -1962,29 +1975,48 @@ EXPORT_SYMBOL(target_execute_cmd); + * Process all commands up to the last received ORDERED task attribute which + * requires another blocking boundary + */ +-static void target_restart_delayed_cmds(struct se_device *dev) ++void target_do_delayed_work(struct work_struct *work) + { +- for (;;) { ++ struct se_device *dev = container_of(work, struct se_device, ++ delayed_cmd_work); ++ ++ spin_lock(&dev->delayed_cmd_lock); ++ while (!dev->ordered_sync_in_progress) { + struct se_cmd *cmd; + +- spin_lock(&dev->delayed_cmd_lock); +- if (list_empty(&dev->delayed_cmd_list)) { +- spin_unlock(&dev->delayed_cmd_lock); ++ if (list_empty(&dev->delayed_cmd_list)) + break; +- } + + cmd = list_entry(dev->delayed_cmd_list.next, + struct se_cmd, se_delayed_node); ++ ++ if (cmd->sam_task_attr == TCM_ORDERED_TAG) { ++ /* ++ * Check if we started with: ++ * [ordered] [simple] [ordered] ++ * and we are now at the last ordered so we have to wait ++ * for the simple cmd. ++ */ ++ if (atomic_read(&dev->non_ordered) > 0) ++ break; ++ ++ dev->ordered_sync_in_progress = true; ++ } ++ + list_del(&cmd->se_delayed_node); ++ atomic_dec_mb(&dev->delayed_cmd_count); + spin_unlock(&dev->delayed_cmd_lock); + ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) ++ atomic_inc_mb(&dev->non_ordered); ++ + cmd->transport_state |= CMD_T_SENT; + + __target_execute_cmd(cmd, true); + +- if (cmd->sam_task_attr == TCM_ORDERED_TAG) +- break; ++ spin_lock(&dev->delayed_cmd_lock); + } ++ spin_unlock(&dev->delayed_cmd_lock); + } + + /* +@@ -2002,16 +2034,19 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + goto restart; + + if (cmd->sam_task_attr == TCM_SIMPLE_TAG) { +- atomic_dec_mb(&dev->simple_cmds); ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev->dev_cur_ordered_id: %u for SIMPLE\n", + dev->dev_cur_ordered_id); + } else if (cmd->sam_task_attr == TCM_HEAD_TAG) { ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for HEAD_OF_QUEUE\n", + dev->dev_cur_ordered_id); + } else if (cmd->sam_task_attr == TCM_ORDERED_TAG) { +- atomic_dec_mb(&dev->dev_ordered_sync); ++ spin_lock(&dev->delayed_cmd_lock); ++ dev->ordered_sync_in_progress = false; ++ spin_unlock(&dev->delayed_cmd_lock); + + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n", +@@ -2020,7 +2055,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET; + + restart: +- target_restart_delayed_cmds(dev); ++ if (atomic_read(&dev->delayed_cmd_count) > 0) ++ schedule_work(&dev->delayed_cmd_work); + } + + static void transport_complete_qf(struct se_cmd *cmd) +@@ -2775,9 +2811,7 @@ __transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop, __releases(&cmd->t_state_lock) __acquires(&cmd->t_state_lock) { @@ -68671,7 +91064,7 @@ index e738b4621cbb..6afb65387be6 100644 if (fabric_stop) cmd->transport_state |= CMD_T_FABRIC_STOP; -@@ -2886,6 +2888,26 @@ static const struct sense_info sense_info_table[] = { +@@ -2886,6 +2920,26 @@ static const struct sense_info sense_info_table[] = { .key = ILLEGAL_REQUEST, .asc = 0x26, /* INVALID FIELD IN PARAMETER LIST */ }, @@ -69147,11 +91540,32 @@ index ea9558679634..34169c32d495 100644 writel((1 << conf->bank_data[num].num_sensors) - 1, mt->thermal_base + TEMP_MONCTL0); +diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c +index c974cb5fb958..02510c191c7d 100644 +--- a/drivers/thermal/samsung/exynos_tmu.c ++++ b/drivers/thermal/samsung/exynos_tmu.c +@@ -1372,6 +1372,7 @@ static int exynos_tmu_probe(struct platform_device *pdev) + data->sclk = devm_clk_get(&pdev->dev, "tmu_sclk"); + if (IS_ERR(data->sclk)) { + dev_err(&pdev->dev, "Failed to get sclk\n"); ++ ret = PTR_ERR(data->sclk); + goto err_clk; + } else { + ret = clk_prepare_enable(data->sclk); diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c -index 5b6475a8804e..230f43efbf1e 100755 +index 5b6475a8804e..598558b2c868 100755 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c -@@ -2327,7 +2327,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, +@@ -612,6 +612,8 @@ static void thermal_zone_device_init(struct thermal_zone_device *tz) + { + struct thermal_instance *pos; + tz->temperature = THERMAL_TEMP_INVALID; ++ tz->prev_low_trip = -INT_MAX; ++ tz->prev_high_trip = INT_MAX; + list_for_each_entry(pos, &tz->thermal_instances, tz_node) + pos->initialized = false; + } +@@ -2327,7 +2329,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type, EXPORT_SYMBOL_GPL(thermal_zone_device_register); /** @@ -69218,6 +91632,113 @@ index 6f2de3a3356d..86850082b24b 100644 /* bandgap clock limits (no control on 4430) */ #define OMAP4430_MAX_FREQ 32768 #define OMAP4430_MIN_FREQ 32768 +diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c +index 5e87e4866bcb..2af089b2a343 100644 +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -50,6 +50,8 @@ struct xencons_info { + struct xenbus_device *xbdev; + struct xencons_interface *intf; + unsigned int evtchn; ++ XENCONS_RING_IDX out_cons; ++ unsigned int out_cons_same; + struct hvc_struct *hvc; + int irq; + int vtermno; +@@ -99,7 +101,11 @@ static int __write_console(struct xencons_info *xencons, + cons = intf->out_cons; + prod = intf->out_prod; + mb(); /* update queue values before going on */ +- BUG_ON((prod - cons) > sizeof(intf->out)); ++ ++ if ((prod - cons) > sizeof(intf->out)) { ++ pr_err_once("xencons: Illegal ring page indices"); ++ return -EINVAL; ++ } + + while ((sent < len) && ((prod - cons) < sizeof(intf->out))) + intf->out[MASK_XENCONS_IDX(prod++, intf->out)] = data[sent++]; +@@ -127,7 +133,10 @@ static int domU_write_console(uint32_t vtermno, const char *data, int len) + */ + while (len) { + int sent = __write_console(cons, data, len); +- ++ ++ if (sent < 0) ++ return sent; ++ + data += sent; + len -= sent; + +@@ -144,6 +153,8 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) + XENCONS_RING_IDX cons, prod; + int recv = 0; + struct xencons_info *xencons = vtermno_to_xencons(vtermno); ++ unsigned int eoiflag = 0; ++ + if (xencons == NULL) + return -EINVAL; + intf = xencons->intf; +@@ -151,7 +162,11 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) + cons = intf->in_cons; + prod = intf->in_prod; + mb(); /* get pointers before reading ring */ +- BUG_ON((prod - cons) > sizeof(intf->in)); ++ ++ if ((prod - cons) > sizeof(intf->in)) { ++ pr_err_once("xencons: Illegal ring page indices"); ++ return -EINVAL; ++ } + + while (cons != prod && recv < len) + buf[recv++] = intf->in[MASK_XENCONS_IDX(cons++, intf->in)]; +@@ -159,7 +174,27 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) + mb(); /* read ring before consuming */ + intf->in_cons = cons; + +- notify_daemon(xencons); ++ /* ++ * When to mark interrupt having been spurious: ++ * - there was no new data to be read, and ++ * - the backend did not consume some output bytes, and ++ * - the previous round with no read data didn't see consumed bytes ++ * (we might have a race with an interrupt being in flight while ++ * updating xencons->out_cons, so account for that by allowing one ++ * round without any visible reason) ++ */ ++ if (intf->out_cons != xencons->out_cons) { ++ xencons->out_cons = intf->out_cons; ++ xencons->out_cons_same = 0; ++ } ++ if (recv) { ++ notify_daemon(xencons); ++ } else if (xencons->out_cons_same++ > 1) { ++ eoiflag = XEN_EOI_FLAG_SPURIOUS; ++ } ++ ++ xen_irq_lateeoi(xencons->irq, eoiflag); ++ + return recv; + } + +@@ -388,7 +423,7 @@ static int xencons_connect_backend(struct xenbus_device *dev, + if (ret) + return ret; + info->evtchn = evtchn; +- irq = bind_evtchn_to_irq(evtchn); ++ irq = bind_interdomain_evtchn_to_irq_lateeoi(dev->otherend_id, evtchn); + if (irq < 0) + return irq; + info->irq = irq; +@@ -552,7 +587,7 @@ static int __init xen_hvc_init(void) + return r; + + info = vtermno_to_xencons(HVC_COOKIE); +- info->irq = bind_evtchn_to_irq(info->evtchn); ++ info->irq = bind_evtchn_to_irq_lateeoi(info->evtchn); + } + if (info->irq < 0) + info->irq = 0; /* NO_IRQ */ diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c index 3c4d7c2b4ade..de05196738da 100644 --- a/drivers/tty/hvc/hvcs.c @@ -69250,6 +91771,47 @@ index 3c4d7c2b4ade..de05196738da 100644 tty_port_put(&hvcsd->port); } +diff --git a/drivers/tty/hvc/hvsi.c b/drivers/tty/hvc/hvsi.c +index 96ce6bd1cc6f..4b6f93067ae4 100644 +--- a/drivers/tty/hvc/hvsi.c ++++ b/drivers/tty/hvc/hvsi.c +@@ -1051,7 +1051,7 @@ static const struct tty_operations hvsi_ops = { + + static int __init hvsi_init(void) + { +- int i; ++ int i, ret; + + hvsi_driver = alloc_tty_driver(hvsi_count); + if (!hvsi_driver) +@@ -1082,12 +1082,25 @@ static int __init hvsi_init(void) + } + hvsi_wait = wait_for_state; /* irqs active now */ + +- if (tty_register_driver(hvsi_driver)) +- panic("Couldn't register hvsi console driver\n"); ++ ret = tty_register_driver(hvsi_driver); ++ if (ret) { ++ pr_err("Couldn't register hvsi console driver\n"); ++ goto err_free_irq; ++ } + + printk(KERN_DEBUG "HVSI: registered %i devices\n", hvsi_count); + + return 0; ++err_free_irq: ++ hvsi_wait = poll_for_state; ++ for (i = 0; i < hvsi_count; i++) { ++ struct hvsi_struct *hp = &hvsi_ports[i]; ++ ++ free_irq(hp->virq, hp); ++ } ++ tty_driver_kref_put(hvsi_driver); ++ ++ return ret; + } + device_initcall(hvsi_init); + diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c index c0dfb642383b..dc7f4eb18e0a 100644 --- a/drivers/tty/ipwireless/network.c @@ -69451,6 +92013,19 @@ index c4e9eba36023..8dbfd4ffd635 100644 } EXPORT_SYMBOL(serial8250_register_8250_port); +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 22d65a33059e..aa9cc5e1c91c 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -637,7 +637,7 @@ static struct platform_driver dw8250_platform_driver = { + .name = "dw-apb-uart", + .pm = &dw8250_pm_ops, + .of_match_table = dw8250_of_match, +- .acpi_match_table = ACPI_PTR(dw8250_acpi_match), ++ .acpi_match_table = dw8250_acpi_match, + }, + .probe = dw8250_probe, + .remove = dw8250_remove, diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c index 91db9ca1c6c9..d7421f0f857b 100644 --- a/drivers/tty/serial/8250/8250_mtk.c @@ -69539,9 +92114,18 @@ index a3adf21f9dce..c551407bee07 100644 pm_runtime_get_sync(&pdev->dev); diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 2c38b3a1d518..a9c46e10d204 100644 +index 2c38b3a1d518..550f2f0523d8 100644 --- a/drivers/tty/serial/8250/8250_pci.c +++ b/drivers/tty/serial/8250/8250_pci.c +@@ -73,7 +73,7 @@ static void moan_device(const char *str, struct pci_dev *dev) + + static int + setup_port(struct serial_private *priv, struct uart_8250_port *port, +- int bar, int offset, int regshift) ++ u8 bar, unsigned int offset, int regshift) + { + struct pci_dev *dev = priv->dev; + @@ -5709,6 +5709,17 @@ static struct pci_device_id serial_pci_tbl[] = { 0, 0, pbn_exar_XR17V358 }, @@ -69561,10 +92145,47 @@ index 2c38b3a1d518..a9c46e10d204 100644 { PCI_DEVICE(0x1c29, 0x1104), .driver_data = pbn_fintek_4 }, { PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 }, diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index c7a7574172fa..827a641ac336 100644 +index c7a7574172fa..460c35b2b54d 100644 --- a/drivers/tty/serial/8250/8250_port.c +++ b/drivers/tty/serial/8250/8250_port.c -@@ -1806,6 +1806,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) +@@ -125,7 +125,8 @@ static const struct serial8250_config uart_config[] = { + .name = "16C950/954", + .fifo_size = 128, + .tx_loadsz = 128, +- .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10, ++ .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_01, ++ .rxtrig_bytes = {16, 32, 112, 120}, + /* UART_CAP_EFR breaks billionon CF bluetooth card. */ + .flags = UART_CAP_FIFO | UART_CAP_SLEEP, + }, +@@ -277,7 +278,11 @@ static const struct serial8250_config uart_config[] = { + /* Uart divisor latch read */ + static int default_serial_dl_read(struct uart_8250_port *up) + { +- return serial_in(up, UART_DLL) | serial_in(up, UART_DLM) << 8; ++ /* Assign these in pieces to truncate any bits above 7. */ ++ unsigned char dll = serial_in(up, UART_DLL); ++ unsigned char dlm = serial_in(up, UART_DLM); ++ ++ return dll | dlm << 8; + } + + /* Uart divisor latch write */ +@@ -1262,9 +1267,11 @@ static void autoconfig(struct uart_8250_port *up) + serial_out(up, UART_LCR, 0); + + serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO); +- scratch = serial_in(up, UART_IIR) >> 6; + +- switch (scratch) { ++ /* Assign this as it is to truncate any bits above 7. */ ++ scratch = serial_in(up, UART_IIR); ++ ++ switch (scratch >> 6) { + case 0: + autoconfig_8250(up); + break; +@@ -1806,6 +1813,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) unsigned char status; unsigned long flags; struct uart_8250_port *up = up_to_u8250p(port); @@ -69572,7 +92193,7 @@ index c7a7574172fa..827a641ac336 100644 if (iir & UART_IIR_NO_INT) return 0; -@@ -1814,7 +1815,20 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) +@@ -1814,7 +1822,20 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) status = serial_port_in(port, UART_LSR); @@ -69594,7 +92215,7 @@ index c7a7574172fa..827a641ac336 100644 if (!up->dma || handle_rx_dma(up, iir)) status = serial8250_rx_chars(up, status); } -@@ -2205,6 +2219,10 @@ int serial8250_do_startup(struct uart_port *port) +@@ -2205,6 +2226,10 @@ int serial8250_do_startup(struct uart_port *port) if (port->irq) { unsigned char iir1; @@ -69605,7 +92226,7 @@ index c7a7574172fa..827a641ac336 100644 /* * Test for UARTs that do not reassert THRE when the * transmitter is idle and the interrupt has already -@@ -2214,8 +2232,6 @@ int serial8250_do_startup(struct uart_port *port) +@@ -2214,8 +2239,6 @@ int serial8250_do_startup(struct uart_port *port) * allow register changes to become visible. */ spin_lock_irqsave(&port->lock, flags); @@ -69614,7 +92235,7 @@ index c7a7574172fa..827a641ac336 100644 wait_for_xmitr(up, UART_LSR_THRE); serial_port_out_sync(port, UART_IER, UART_IER_THRI); -@@ -2227,9 +2243,10 @@ int serial8250_do_startup(struct uart_port *port) +@@ -2227,9 +2250,10 @@ int serial8250_do_startup(struct uart_port *port) iir = serial_port_in(port, UART_IIR); serial_port_out(port, UART_IER, 0); @@ -69684,7 +92305,7 @@ index 0c5e9ca9d928..f09c327405ac 100644 Support for early consoles with the earlycon parameter. This enables the console before standard serial driver is probed. The console is diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c -index f6586a8681b9..6e27dee3876a 100644 +index f6586a8681b9..e91bdd7d4c05 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -2249,9 +2249,8 @@ pl011_console_write(struct console *co, const char *s, unsigned int count) @@ -69746,6 +92367,14 @@ index f6586a8681b9..6e27dee3876a 100644 return ret; } } +@@ -2699,6 +2702,7 @@ MODULE_DEVICE_TABLE(of, sbsa_uart_of_match); + + static const struct acpi_device_id sbsa_uart_acpi_match[] = { + { "ARMH0011", 0 }, ++ { "ARMHB000", 0 }, + {}, + }; + MODULE_DEVICE_TABLE(acpi, sbsa_uart_acpi_match); diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 5b6093dc3ff2..a4c1797e30d7 100644 --- a/drivers/tty/serial/fsl_lpuart.c @@ -69810,6 +92439,48 @@ index 325c38c9b451..a60376496b1a 100644 error_console: return retval; +diff --git a/drivers/tty/serial/jsm/jsm_neo.c b/drivers/tty/serial/jsm/jsm_neo.c +index c6fdd6369534..96e01bf4599c 100644 +--- a/drivers/tty/serial/jsm/jsm_neo.c ++++ b/drivers/tty/serial/jsm/jsm_neo.c +@@ -827,7 +827,9 @@ static void neo_parse_isr(struct jsm_board *brd, u32 port) + /* Parse any modem signal changes */ + jsm_dbg(INTR, &ch->ch_bd->pci_dev, + "MOD_STAT: sending to parse_modem_sigs\n"); ++ spin_lock_irqsave(&ch->uart_port.lock, lock_flags); + neo_parse_modem(ch, readb(&ch->ch_neo_uart->msr)); ++ spin_unlock_irqrestore(&ch->uart_port.lock, lock_flags); + } + } + +diff --git a/drivers/tty/serial/jsm/jsm_tty.c b/drivers/tty/serial/jsm/jsm_tty.c +index ec7d8383900f..7c790ff6b511 100644 +--- a/drivers/tty/serial/jsm/jsm_tty.c ++++ b/drivers/tty/serial/jsm/jsm_tty.c +@@ -195,6 +195,7 @@ static void jsm_tty_break(struct uart_port *port, int break_state) + + static int jsm_tty_open(struct uart_port *port) + { ++ unsigned long lock_flags; + struct jsm_board *brd; + struct jsm_channel *channel = + container_of(port, struct jsm_channel, uart_port); +@@ -248,6 +249,7 @@ static int jsm_tty_open(struct uart_port *port) + channel->ch_cached_lsr = 0; + channel->ch_stops_sent = 0; + ++ spin_lock_irqsave(&port->lock, lock_flags); + termios = &port->state->port.tty->termios; + channel->ch_c_cflag = termios->c_cflag; + channel->ch_c_iflag = termios->c_iflag; +@@ -267,6 +269,7 @@ static int jsm_tty_open(struct uart_port *port) + jsm_carrier(channel); + + channel->ch_open_count++; ++ spin_unlock_irqrestore(&port->lock, lock_flags); + + jsm_dbg(OPEN, &channel->ch_bd->pci_dev, "finish\n"); + return 0; diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c index 80ab672d61cc..febbacecb3ba 100644 --- a/drivers/tty/serial/max310x.c @@ -69829,6 +92500,20 @@ index 80ab672d61cc..febbacecb3ba 100644 } module_init(max310x_uart_init); +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index 2c13cff1a742..aadaf07e6e5a 100755 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -629,6 +629,9 @@ static void msm_start_rx_dma(struct msm_port *msm_port) + u32 val; + int ret; + ++ if (IS_ENABLED(CONFIG_CONSOLE_POLL)) ++ return; ++ + if (!dma->chan) + return; + diff --git a/drivers/tty/serial/msm_serial_hs.c b/drivers/tty/serial/msm_serial_hs.c index a2522c6d781b..c114757b726b 100644 --- a/drivers/tty/serial/msm_serial_hs.c @@ -69851,6 +92536,19 @@ index a2522c6d781b..c114757b726b 100644 MSM_HS_DBG("%s(): Queue kthread work", __func__); kthread_queue_work(&msm_uport->tx.kworker, &msm_uport->tx.kwork); } +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index a10e4aa9e18e..ffd454e4bacf 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -108,7 +108,7 @@ static unsigned int mvebu_uart_tx_empty(struct uart_port *port) + st = readl(port->membase + UART_STAT); + spin_unlock_irqrestore(&port->lock, flags); + +- return (st & STAT_TX_FIFO_EMP) ? TIOCSER_TEMT : 0; ++ return (st & STAT_TX_EMP) ? TIOCSER_TEMT : 0; + } + + static unsigned int mvebu_uart_get_mctrl(struct uart_port *port) diff --git a/drivers/tty/serial/rp2.c b/drivers/tty/serial/rp2.c index 056f91b3a4ca..b7d1b1645c84 100644 --- a/drivers/tty/serial/rp2.c @@ -69999,10 +92697,35 @@ index 01ff8ec78023..8c89697c5357 100644 * DMA is currently supported only on DT platforms, if DMA properties * are specified. diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index 9ab13210f8ab..cb137b334bc5 100644 +index 9ab13210f8ab..68dd30baeb5f 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c -@@ -1418,6 +1418,10 @@ static void uart_set_ldisc(struct tty_struct *tty) +@@ -212,7 +212,11 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state, + if (retval == 0) { + if (uart_console(uport) && uport->cons->cflag) { + tty->termios.c_cflag = uport->cons->cflag; ++ tty->termios.c_ispeed = uport->cons->ispeed; ++ tty->termios.c_ospeed = uport->cons->ospeed; + uport->cons->cflag = 0; ++ uport->cons->ispeed = 0; ++ uport->cons->ospeed = 0; + } + /* + * Initialise the hardware port settings. +@@ -280,8 +284,11 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state) + /* + * Turn off DTR and RTS early. + */ +- if (uport && uart_console(uport) && tty) ++ if (uport && uart_console(uport) && tty) { + uport->cons->cflag = tty->termios.c_cflag; ++ uport->cons->ispeed = tty->termios.c_ispeed; ++ uport->cons->ospeed = tty->termios.c_ospeed; ++ } + + if (!tty || C_HUPCL(tty)) + uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS); +@@ -1418,6 +1425,10 @@ static void uart_set_ldisc(struct tty_struct *tty) { struct uart_state *state = tty->driver_data; struct uart_port *uport; @@ -70013,6 +92736,56 @@ index 9ab13210f8ab..cb137b334bc5 100644 mutex_lock(&state->port.mutex); uport = uart_port_check(state); +@@ -1514,6 +1525,7 @@ static void uart_tty_port_shutdown(struct tty_port *port) + { + struct uart_state *state = container_of(port, struct uart_state, port); + struct uart_port *uport = uart_port_check(state); ++ char *buf; + + /* + * At this point, we stop accepting input. To do this, we +@@ -1535,8 +1547,18 @@ static void uart_tty_port_shutdown(struct tty_port *port) + */ + tty_port_set_suspended(port, 0); + +- uart_change_pm(state, UART_PM_STATE_OFF); ++ /* ++ * Free the transmit buffer. ++ */ ++ spin_lock_irq(&uport->lock); ++ buf = state->xmit.buf; ++ state->xmit.buf = NULL; ++ spin_unlock_irq(&uport->lock); + ++ if (buf) ++ free_page((unsigned long)buf); ++ ++ uart_change_pm(state, UART_PM_STATE_OFF); + } + + static void uart_wait_until_sent(struct tty_struct *tty, int timeout) +@@ -2058,8 +2080,11 @@ uart_set_options(struct uart_port *port, struct console *co, + * Allow the setting of the UART parameters with a NULL console + * too: + */ +- if (co) ++ if (co) { + co->cflag = termios.c_cflag; ++ co->ispeed = termios.c_ispeed; ++ co->ospeed = termios.c_ospeed; ++ } + + return 0; + } +@@ -2197,6 +2222,8 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport) + */ + memset(&termios, 0, sizeof(struct ktermios)); + termios.c_cflag = uport->cons->cflag; ++ termios.c_ispeed = uport->cons->ispeed; ++ termios.c_ospeed = uport->cons->ospeed; + + /* + * If that's unset, use the tty termios setting. diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c index f80312eed4fd..ffb3fb1bda9e 100644 --- a/drivers/tty/serial/serial_txx9.c @@ -70077,8 +92850,38 @@ index ea8b591dd46f..f325019887b2 100644 /* Stop serial port and reset value */ writel_relaxed(0, port->membase + ofs->cr1); +diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c +index eb61a07fcbbc..b92700fdfd51 100644 +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -589,9 +589,10 @@ static void cdns_uart_start_tx(struct uart_port *port) + if (uart_circ_empty(&port->state->xmit)) + return; + ++ writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR); ++ + cdns_uart_handle_tx(port); + +- writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR); + /* Enable the TX Empty interrupt */ + writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_IER); + } +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index ca9c82ee6c35..dfccc102c1dd 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -536,6 +536,9 @@ static void flush_to_ldisc(struct work_struct *work) + if (!count) + break; + head->read += count; ++ ++ if (need_resched()) ++ cond_resched(); + } + + mutex_unlock(&buf->lock); diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index 08e47dec0901..4b9987a47f1d 100644 +index 08e47dec0901..dbc4d7de697c 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -544,8 +544,8 @@ static void __proc_set_tty(struct tty_struct *tty) @@ -70118,6 +92921,26 @@ index 08e47dec0901..4b9987a47f1d 100644 /* Now clear signal->tty under the lock */ read_lock(&tasklist_lock); session_clear_tty(task_session(current)); +@@ -2313,8 +2316,6 @@ static int tty_fasync(int fd, struct file *filp, int on) + * Locking: + * Called functions take tty_ldiscs_lock + * current->signal->tty check is safe without locks +- * +- * FIXME: may race normal receive processing + */ + + static int tiocsti(struct tty_struct *tty, char __user *p) +@@ -2330,8 +2331,10 @@ static int tiocsti(struct tty_struct *tty, char __user *p) + ld = tty_ldisc_ref_wait(tty); + if (!ld) + return -EIO; ++ tty_buffer_lock_exclusive(tty->port); + if (ld->ops->receive_buf) + ld->ops->receive_buf(tty, &ch, &mbz, 1); ++ tty_buffer_unlock_exclusive(tty->port); + tty_ldisc_deref(ld); + return 0; + } @@ -2632,14 +2635,19 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t return -ENOTTY; if (retval) @@ -70336,7 +93159,7 @@ index d9eba7938917..4bc6261ef3c1 100644 if (!perm) { ret = -EPERM; diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 29fb08c8a2fd..8c74d9ebfc50 100644 +index 29fb08c8a2fd..9f1573b0e453 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -765,10 +765,19 @@ static const struct tty_port_operations vc_port_ops = { @@ -70420,16 +93243,38 @@ index 29fb08c8a2fd..8c74d9ebfc50 100644 return -EINVAL; new_cols = (cols ? cols : vc->vc_cols); -@@ -883,7 +889,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, - if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) - return 0; +@@ -880,10 +886,27 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, + new_row_size = new_cols << 1; + new_screen_size = new_row_size * new_rows; + +- if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) +- return 0; ++ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) { ++ /* ++ * This function is being called here to cover the case ++ * where the userspace calls the FBIOPUT_VSCREENINFO twice, ++ * passing the same fb_var_screeninfo containing the fields ++ * yres/xres equal to a number non-multiple of vc_font.height ++ * and yres_virtual/xres_virtual equal to number lesser than the ++ * vc_font.height and yres/xres. ++ * In the second call, the struct fb_var_screeninfo isn't ++ * being modified by the underlying driver because of the ++ * if above, and this causes the fbcon_display->vrows to become ++ * negative and it eventually leads to out-of-bound ++ * access by the imageblit function. ++ * To give the correct values to the struct and to not have ++ * to deal with possible errors from the code below, we call ++ * the resize_screen here as well. ++ */ ++ return resize_screen(vc, new_cols, new_rows, user); ++ } - if (new_screen_size > (4 << 20)) + if (new_screen_size > (4 << 20) || !new_screen_size) return -EINVAL; newscreen = kzalloc(new_screen_size, GFP_USER); if (!newscreen) -@@ -944,10 +950,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, +@@ -944,10 +967,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, if (new_scr_end > new_origin) scr_memsetw((void *)new_origin, vc->vc_video_erase_char, new_scr_end - new_origin); @@ -70442,7 +93287,7 @@ index 29fb08c8a2fd..8c74d9ebfc50 100644 /* do part of a reset_terminal() */ vc->vc_top = 0; -@@ -3033,6 +3040,7 @@ static int __init con_init(void) +@@ -3033,6 +3057,7 @@ static int __init con_init(void) INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); tty_port_init(&vc->port); visual_init(vc, currcons, 1); @@ -70450,7 +93295,7 @@ index 29fb08c8a2fd..8c74d9ebfc50 100644 vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_NOWAIT); vc_init(vc, vc->vc_rows, vc->vc_cols, currcons || !vc->vc_sw->con_save_screen); -@@ -4227,27 +4235,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) +@@ -4227,27 +4252,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) return rc; } @@ -70478,7 +93323,7 @@ index 29fb08c8a2fd..8c74d9ebfc50 100644 int con_font_op(struct vc_data *vc, struct console_font_op *op) { switch (op->op) { -@@ -4258,7 +4245,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op) +@@ -4258,7 +4262,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op) case KD_FONT_OP_SET_DEFAULT: return con_font_default(vc, op); case KD_FONT_OP_COPY: @@ -70489,7 +93334,7 @@ index 29fb08c8a2fd..8c74d9ebfc50 100644 return -ENOSYS; } diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c -index 4ed0d77e5918..9206fd248935 100644 +index 4ed0d77e5918..e1c1627a3356 100644 --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -243,7 +243,7 @@ int vt_waitactive(int n) @@ -70529,7 +93374,31 @@ index 4ed0d77e5918..9206fd248935 100644 } return -EINVAL; } -@@ -896,12 +896,22 @@ int vt_ioctl(struct tty_struct *tty, +@@ -487,16 +487,19 @@ int vt_ioctl(struct tty_struct *tty, + ret = -EINVAL; + goto out; + } +- /* FIXME: this needs the console lock extending */ +- if (vc->vc_mode == (unsigned char) arg) ++ console_lock(); ++ if (vc->vc_mode == (unsigned char) arg) { ++ console_unlock(); + break; ++ } + vc->vc_mode = (unsigned char) arg; +- if (console != fg_console) ++ if (console != fg_console) { ++ console_unlock(); + break; ++ } + /* + * explicitly blank/unblank the screen if switching modes + */ +- console_lock(); + if (arg == KD_TEXT) + do_unblank_screen(1); + else +@@ -896,12 +899,22 @@ int vt_ioctl(struct tty_struct *tty, console_lock(); vcp = vc_cons[i].d; if (vcp) { @@ -70554,7 +93423,7 @@ index 4ed0d77e5918..9206fd248935 100644 } console_unlock(); } -@@ -917,7 +927,7 @@ int vt_ioctl(struct tty_struct *tty, +@@ -917,7 +930,7 @@ int vt_ioctl(struct tty_struct *tty, op.height = 0; op.charcount = 256; op.data = up; @@ -70563,7 +93432,7 @@ index 4ed0d77e5918..9206fd248935 100644 break; } -@@ -928,7 +938,7 @@ int vt_ioctl(struct tty_struct *tty, +@@ -928,7 +941,7 @@ int vt_ioctl(struct tty_struct *tty, op.height = 32; op.charcount = 256; op.data = up; @@ -70572,7 +93441,7 @@ index 4ed0d77e5918..9206fd248935 100644 break; } -@@ -945,7 +955,7 @@ int vt_ioctl(struct tty_struct *tty, +@@ -945,7 +958,7 @@ int vt_ioctl(struct tty_struct *tty, case PIO_FONTX: case GIO_FONTX: @@ -70581,7 +93450,7 @@ index 4ed0d77e5918..9206fd248935 100644 break; case PIO_FONTRESET: -@@ -962,11 +972,11 @@ int vt_ioctl(struct tty_struct *tty, +@@ -962,11 +975,11 @@ int vt_ioctl(struct tty_struct *tty, { op.op = KD_FONT_OP_SET_DEFAULT; op.data = NULL; @@ -70595,7 +93464,7 @@ index 4ed0d77e5918..9206fd248935 100644 console_unlock(); break; } -@@ -1093,8 +1103,9 @@ struct compat_consolefontdesc { +@@ -1093,8 +1106,9 @@ struct compat_consolefontdesc { }; static inline int @@ -70607,7 +93476,7 @@ index 4ed0d77e5918..9206fd248935 100644 { struct compat_consolefontdesc cfdarg; int i; -@@ -1112,7 +1123,8 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, +@@ -1112,7 +1126,8 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data = compat_ptr(cfdarg.chardata); @@ -70617,7 +93486,7 @@ index 4ed0d77e5918..9206fd248935 100644 case GIO_FONTX: op->op = KD_FONT_OP_GET; op->flags = KD_FONT_FLAG_OLD; -@@ -1120,7 +1132,7 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, +@@ -1120,7 +1135,7 @@ compat_fontx_ioctl(int cmd, struct compat_consolefontdesc __user *user_cfd, op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data = compat_ptr(cfdarg.chardata); @@ -70626,7 +93495,7 @@ index 4ed0d77e5918..9206fd248935 100644 if (i) return i; cfdarg.charheight = op->height; -@@ -1215,7 +1227,7 @@ long vt_compat_ioctl(struct tty_struct *tty, +@@ -1215,7 +1230,7 @@ long vt_compat_ioctl(struct tty_struct *tty, */ case PIO_FONTX: case GIO_FONTX: @@ -70648,6 +93517,20 @@ index f598ecddc8a7..b58a504240c4 100644 uioinfo->irq = UIO_IRQ_NONE; else if (ret < 0) { dev_err(&pdev->dev, "failed to get IRQ\n"); +diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig +index e0ed5d8a3768..0b60a99cd5c8 100644 +--- a/drivers/usb/Kconfig ++++ b/drivers/usb/Kconfig +@@ -162,8 +162,7 @@ source "drivers/usb/gadget/Kconfig" + + config USB_LED_TRIG + bool "USB LED Triggers" +- depends on LEDS_CLASS && LEDS_TRIGGERS +- select USB_COMMON ++ depends on LEDS_CLASS && USB_COMMON && LEDS_TRIGGERS + help + This option adds LED triggers for USB host and/or gadget activity. + diff --git a/drivers/usb/c67x00/c67x00-sched.c b/drivers/usb/c67x00/c67x00-sched.c index 7311ed61e99a..029c8bc54b7a 100644 --- a/drivers/usb/c67x00/c67x00-sched.c @@ -70691,10 +93574,62 @@ index 099179457f60..553bdd0983f7 100644 if (of_find_property(np, "disable-over-current", NULL)) diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index e96e3a5808b3..6062a5d816a6 100644 +index e96e3a5808b3..f4b13f0637ea 100644 --- a/drivers/usb/chipidea/core.c +++ b/drivers/usb/chipidea/core.c -@@ -1110,6 +1110,29 @@ static void ci_controller_suspend(struct ci_hdrc *ci) +@@ -516,7 +516,7 @@ int hw_device_reset(struct ci_hdrc *ci) + return 0; + } + +-static irqreturn_t ci_irq(int irq, void *data) ++static irqreturn_t ci_irq_handler(int irq, void *data) + { + struct ci_hdrc *ci = data; + irqreturn_t ret = IRQ_NONE; +@@ -569,6 +569,15 @@ static irqreturn_t ci_irq(int irq, void *data) + return ret; + } + ++static void ci_irq(struct ci_hdrc *ci) ++{ ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ ci_irq_handler(ci->irq, ci); ++ local_irq_restore(flags); ++} ++ + static int ci_vbus_notifier(struct notifier_block *nb, unsigned long event, + void *ptr) + { +@@ -582,7 +591,7 @@ static int ci_vbus_notifier(struct notifier_block *nb, unsigned long event, + + vbus->changed = true; + +- ci_irq(ci->irq, ci); ++ ci_irq(ci); + return NOTIFY_DONE; + } + +@@ -599,7 +608,7 @@ static int ci_id_notifier(struct notifier_block *nb, unsigned long event, + + id->changed = true; + +- ci_irq(ci->irq, ci); ++ ci_irq(ci); + return NOTIFY_DONE; + } + +@@ -1011,7 +1020,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) + } + + platform_set_drvdata(pdev, ci); +- ret = devm_request_irq(dev, ci->irq, ci_irq, IRQF_SHARED, ++ ret = devm_request_irq(dev, ci->irq, ci_irq_handler, IRQF_SHARED, + ci->platdata->name, ci); + if (ret) + goto stop; +@@ -1110,6 +1119,29 @@ static void ci_controller_suspend(struct ci_hdrc *ci) enable_irq(ci->irq); } @@ -70714,17 +93649,17 @@ index e96e3a5808b3..6062a5d816a6 100644 + + if (!IS_ERR(cable_id->edev) && ci->is_otg && + (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) -+ ci_irq(ci->irq, ci); ++ ci_irq(ci); + + if (!IS_ERR(cable_vbus->edev) && ci->is_otg && + (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) -+ ci_irq(ci->irq, ci); ++ ci_irq(ci); +} + static int ci_controller_resume(struct device *dev) { struct ci_hdrc *ci = dev_get_drvdata(dev); -@@ -1136,6 +1159,7 @@ static int ci_controller_resume(struct device *dev) +@@ -1136,6 +1168,7 @@ static int ci_controller_resume(struct device *dev) enable_irq(ci->irq); if (ci_otg_is_fsm_mode(ci)) ci_otg_fsm_wakeup_by_srp(ci); @@ -70733,7 +93668,7 @@ index e96e3a5808b3..6062a5d816a6 100644 return 0; diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 5b0bffba4aac..23df1549eb0d 100644 +index 5b0bffba4aac..b7b83ca83ba0 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -335,8 +335,10 @@ static void acm_ctrl_irq(struct urb *urb) @@ -70748,7 +93683,34 @@ index 5b0bffba4aac..23df1549eb0d 100644 if (newctrl & ACM_CTRL_RI) acm->iocount.rng++; if (newctrl & ACM_CTRL_FRAMING) -@@ -541,7 +543,8 @@ static void acm_port_dtr_rts(struct tty_port *port, int raise) +@@ -347,6 +349,9 @@ static void acm_ctrl_irq(struct urb *urb) + acm->iocount.overrun++; + spin_unlock(&acm->read_lock); + ++ if (newctrl & ACM_CTRL_BRK) ++ tty_flip_buffer_push(&acm->port); ++ + if (difference) + wake_up_all(&acm->wioctl); + +@@ -406,11 +411,16 @@ static int acm_submit_read_urbs(struct acm *acm, gfp_t mem_flags) + + static void acm_process_read_urb(struct acm *acm, struct urb *urb) + { ++ unsigned long flags; ++ + if (!urb->actual_length) + return; + ++ spin_lock_irqsave(&acm->read_lock, flags); + tty_insert_flip_string(&acm->port, urb->transfer_buffer, + urb->actual_length); ++ spin_unlock_irqrestore(&acm->read_lock, flags); ++ + tty_flip_buffer_push(&acm->port); + } + +@@ -541,7 +551,8 @@ static void acm_port_dtr_rts(struct tty_port *port, int raise) res = acm_set_control(acm, val); if (res && (acm->ctrl_caps & USB_CDC_CAP_LINE)) @@ -70758,7 +93720,7 @@ index 5b0bffba4aac..23df1549eb0d 100644 } static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) -@@ -867,8 +870,6 @@ static int set_serial_info(struct acm *acm, +@@ -867,8 +878,6 @@ static int set_serial_info(struct acm *acm, if ((new_serial.close_delay != old_close_delay) || (new_serial.closing_wait != old_closing_wait)) retval = -EPERM; @@ -70767,7 +93729,7 @@ index 5b0bffba4aac..23df1549eb0d 100644 } else { acm->port.close_delay = close_delay; acm->port.closing_wait = closing_wait; -@@ -1178,9 +1179,21 @@ static int acm_probe(struct usb_interface *intf, +@@ -1178,9 +1187,21 @@ static int acm_probe(struct usb_interface *intf, } } } else { @@ -70789,7 +93751,7 @@ index 5b0bffba4aac..23df1549eb0d 100644 } if (!control_interface || !data_interface) { -@@ -1445,6 +1458,11 @@ static int acm_probe(struct usb_interface *intf, +@@ -1445,6 +1466,11 @@ static int acm_probe(struct usb_interface *intf, return 0; alloc_fail8: @@ -70801,7 +93763,7 @@ index 5b0bffba4aac..23df1549eb0d 100644 if (acm->country_codes) { device_remove_file(&acm->control->dev, &dev_attr_wCountryCodes); -@@ -1627,6 +1645,8 @@ static int acm_reset_resume(struct usb_interface *intf) +@@ -1627,6 +1653,8 @@ static int acm_reset_resume(struct usb_interface *intf) static const struct usb_device_id acm_ids[] = { /* quirky and broken devices */ @@ -70810,7 +93772,7 @@ index 5b0bffba4aac..23df1549eb0d 100644 { USB_DEVICE(0x076d, 0x0006), /* Denso Cradle CU-321 */ .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */ { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */ -@@ -1634,6 +1654,15 @@ static const struct usb_device_id acm_ids[] = { +@@ -1634,6 +1662,15 @@ static const struct usb_device_id acm_ids[] = { { USB_DEVICE(0x0870, 0x0001), /* Metricom GS Modem */ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ }, @@ -70826,7 +93788,7 @@ index 5b0bffba4aac..23df1549eb0d 100644 { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ }, -@@ -1826,6 +1855,10 @@ static const struct usb_device_id acm_ids[] = { +@@ -1826,6 +1863,10 @@ static const struct usb_device_id acm_ids[] = { { USB_DEVICE(0x04d8, 0x0083), /* Bootloader mode */ .driver_info = IGNORE_DEVICE, }, @@ -70837,7 +93799,7 @@ index 5b0bffba4aac..23df1549eb0d 100644 #endif /*Samsung phone in firmware update mode */ -@@ -1838,6 +1871,17 @@ static const struct usb_device_id acm_ids[] = { +@@ -1838,6 +1879,17 @@ static const struct usb_device_id acm_ids[] = { .driver_info = IGNORE_DEVICE, }, @@ -70855,7 +93817,7 @@ index 5b0bffba4aac..23df1549eb0d 100644 { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */ .driver_info = SEND_ZERO_PACKET, }, -@@ -1845,6 +1889,16 @@ static const struct usb_device_id acm_ids[] = { +@@ -1845,6 +1897,16 @@ static const struct usb_device_id acm_ids[] = { .driver_info = SEND_ZERO_PACKET, }, @@ -71088,8 +94050,47 @@ index 07c3c3449147..582099f4f449 100644 mutex_unlock(&usblp_mutex); } +diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c +index a391b50fb32f..c310c6d4d150 100644 +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -1342,16 +1342,10 @@ static void usbtmc_interrupt(struct urb *urb) + case -EOVERFLOW: + dev_err(dev, "overflow with length %d, actual length is %d\n", + data->iin_wMaxPacketSize, urb->actual_length); +- case -ECONNRESET: +- case -ENOENT: +- case -ESHUTDOWN: +- case -EILSEQ: +- case -ETIME: ++ default: + /* urb terminated, clean up */ + dev_dbg(dev, "urb terminated, status: %d\n", status); + return; +- default: +- dev_err(dev, "unknown status received: %d\n", status); + } + exit: + rv = usb_submit_urb(urb, GFP_ATOMIC); +diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c +index 2f537bbdda09..362cca983e6e 100644 +--- a/drivers/usb/common/usb-otg-fsm.c ++++ b/drivers/usb/common/usb-otg-fsm.c +@@ -199,7 +199,11 @@ static void otg_start_hnp_polling(struct otg_fsm *fsm) + if (!fsm->host_req_flag) + return; + +- INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); ++ if (!fsm->hnp_work_inited) { ++ INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); ++ fsm->hnp_work_inited = true; ++ } ++ + schedule_delayed_work(&fsm->hnp_polling_work, + msecs_to_jiffies(T_HOST_REQ_POLL)); + } diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index dcaf82dc87fd..c25ba4db8673 100644 +index dcaf82dc87fd..cc3f234fd4fa 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -251,6 +251,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, @@ -71117,6 +94118,27 @@ index dcaf82dc87fd..c25ba4db8673 100644 endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; ++ifp->desc.bNumEndpoints; +@@ -393,7 +404,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, + * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 + * (see the end of section 5.6.3), so don't warn about them. + */ +- maxp = usb_endpoint_maxp(&endpoint->desc); ++ maxp = le16_to_cpu(endpoint->desc.wMaxPacketSize); + if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { + dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", + cfgno, inum, asnum, d->bEndpointAddress); +@@ -409,9 +420,9 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, + maxpacket_maxes = full_speed_maxpacket_maxes; + break; + case USB_SPEED_HIGH: +- /* Bits 12..11 are allowed only for HS periodic endpoints */ ++ /* Multiple-transactions bits are allowed only for HS periodic endpoints */ + if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) { +- i = maxp & (BIT(12) | BIT(11)); ++ i = maxp & USB_EP_MAXP_MULT_MASK; + maxp &= ~i; + } + /* fallthrough */ diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 059e71d71b66..781db58004f7 100644 --- a/drivers/usb/core/devio.c @@ -71181,7 +94203,7 @@ index 059e71d71b66..781db58004f7 100644 break; diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 865bd3b79012..90e62eec027c 100644 +index 865bd3b79012..ccf605f31c7c 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -3516,6 +3516,9 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) @@ -71278,6 +94300,101 @@ index 865bd3b79012..90e62eec027c 100644 /* * Disable the hub-initiated U1/U2 idle timeouts, and disable device-initiated * U1/U2 entry. +@@ -4429,8 +4476,6 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, + if (oldspeed == USB_SPEED_LOW) + delay = HUB_LONG_RESET_TIME; + +- mutex_lock(hcd->address0_mutex); +- + /* Reset the device; full speed may morph to high speed */ + /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */ + retval = hub_port_reset(hub, port1, udev, delay, false); +@@ -4717,7 +4762,6 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, + hub_port_disable(hub, port1, 0); + update_devnum(udev, devnum); /* for disconnect processing */ + } +- mutex_unlock(hcd->address0_mutex); + return retval; + } + +@@ -4808,6 +4852,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + struct usb_device *udev = port_dev->child; + static int unreliable_port = -1; + enum usb_device_speed dev_speed = USB_SPEED_UNKNOWN; ++ bool retry_locked; + + /* Disconnect any existing devices under this port */ + if (udev) { +@@ -4864,7 +4909,11 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + + retry_enum: + status = 0; ++ + for (i = 0; i < SET_CONFIG_TRIES; i++) { ++ usb_lock_port(port_dev); ++ mutex_lock(hcd->address0_mutex); ++ retry_locked = true; + + /* reallocate for each attempt, since references + * to the previous one can escape in various ways +@@ -4873,6 +4922,8 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + if (!udev) { + dev_err(&port_dev->dev, + "couldn't allocate usb_device\n"); ++ mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); + goto done; + } + +@@ -4894,9 +4945,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + } + + /* reset (non-USB 3.0 devices) and get descriptor */ +- usb_lock_port(port_dev); + status = hub_port_init(hub, udev, port1, i); +- usb_unlock_port(port_dev); + if (status < 0) + goto loop; + +@@ -4907,6 +4956,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + hcd->usb_phy->disable_chirp(hcd->usb_phy, + false); + ++ mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); ++ retry_locked = false; ++ + if (udev->quirks & USB_QUIRK_DELAY_INIT) + msleep(2000); + +@@ -4999,6 +5052,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, + usb_ep0_reinit(udev); + release_devnum(udev); + hub_free_dev(udev); ++ if (retry_locked) { ++ mutex_unlock(hcd->address0_mutex); ++ usb_unlock_port(port_dev); ++ } + usb_put_dev(udev); + if ((status == -ENOTCONN) || (status == -ENOTSUPP)) + break; +@@ -5563,6 +5620,8 @@ static int usb_reset_and_verify_device(struct usb_device *udev) + bos = udev->bos; + udev->bos = NULL; + ++ mutex_lock(hcd->address0_mutex); ++ + for (i = 0; i < SET_CONFIG_TRIES; ++i) { + + /* ep0 maxpacket size may change; let the HCD know about it. +@@ -5572,6 +5631,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev) + if (ret >= 0 || ret == -ENOTCONN || ret == -ENODEV) + break; + } ++ mutex_unlock(hcd->address0_mutex); + + if (ret < 0) + goto re_enumerate; diff --git a/drivers/usb/core/hub.h b/drivers/usb/core/hub.h index 34c1a7e22aae..be5075d41406 100644 --- a/drivers/usb/core/hub.h @@ -72123,7 +95240,7 @@ index e3d40acd6ba7..77618496ecc2 100644 +void orderly_poweroff(bool force); #endif /* __DRIVERS_USB_DWC3_CORE_H */ diff --git a/drivers/usb/dwc3/dwc3-msm.c b/drivers/usb/dwc3/dwc3-msm.c -index 3da1d2992698..b5b7689a0093 100644 +index 3da1d2992698..d4440c7b45ed 100644 --- a/drivers/usb/dwc3/dwc3-msm.c +++ b/drivers/usb/dwc3/dwc3-msm.c @@ -1,4 +1,4 @@ @@ -72132,7 +95249,15 @@ index 3da1d2992698..b5b7689a0093 100644 * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and -@@ -358,6 +358,8 @@ static void dwc3_msm_notify_event(struct dwc3 *dwc, unsigned int event, +@@ -323,6 +323,7 @@ struct dwc3_msm { + u32 num_gsi_event_buffers; + struct dwc3_event_buffer **gsi_ev_buff; + int pm_qos_latency; ++ bool perf_mode; + struct pm_qos_request pm_qos_req_dma; + struct delayed_work perf_vote_work; + struct delayed_work sdp_check; +@@ -358,6 +359,8 @@ static void dwc3_msm_notify_event(struct dwc3 *dwc, unsigned int event, unsigned int value); static int dwc3_restart_usb_host_mode(struct notifier_block *nb, unsigned long event, void *ptr); @@ -72141,7 +95266,7 @@ index 3da1d2992698..b5b7689a0093 100644 /** * -@@ -1406,6 +1408,7 @@ static void gsi_configure_ep(struct usb_ep *ep, struct usb_gsi_request *request) +@@ -1406,6 +1409,7 @@ static void gsi_configure_ep(struct usb_ep *ep, struct usb_gsi_request *request) reg = dwc3_readl(dwc->regs, DWC3_DALEPENA); reg |= DWC3_DALEPENA_EP(dep->number); dwc3_writel(dwc->regs, DWC3_DALEPENA, reg); @@ -72149,6 +95274,16 @@ index 3da1d2992698..b5b7689a0093 100644 } } +@@ -2033,8 +2037,7 @@ static void dwc3_msm_notify_event(struct dwc3 *dwc, unsigned int event, + switch (event) { + case DWC3_CONTROLLER_ERROR_EVENT: + dev_info(mdwc->dev, +- "DWC3_CONTROLLER_ERROR_EVENT received, irq cnt %lu\n", +- dwc->irq_cnt); ++ "DWC3_CONTROLLER_ERROR_EVENT received\n"); + + dwc3_gadget_disable_irq(dwc); + @@ -2981,10 +2984,16 @@ static void dwc3_resume_work(struct work_struct *w) mdwc->typec_orientation = val.intval ? ORIENTATION_CC2 : ORIENTATION_CC1; @@ -72202,7 +95337,57 @@ index 3da1d2992698..b5b7689a0093 100644 /* Assumes dwc3 is the first DT child of dwc3-msm */ dwc3_node = of_get_next_available_child(node, NULL); if (!dwc3_node) { -@@ -4691,9 +4705,14 @@ static void dwc3_otg_sm_work(struct work_struct *w) +@@ -4078,6 +4092,7 @@ static int dwc3_msm_remove(struct platform_device *pdev) + } + + cancel_delayed_work_sync(&mdwc->perf_vote_work); ++ msm_dwc3_perf_vote_update(mdwc, false); + cancel_delayed_work_sync(&mdwc->sm_work); + + if (mdwc->hs_phy) +@@ -4202,10 +4217,12 @@ static int dwc3_msm_host_notifier(struct notifier_block *nb, + + static void msm_dwc3_perf_vote_update(struct dwc3_msm *mdwc, bool perf_mode) + { +- static bool curr_perf_mode; + int latency = mdwc->pm_qos_latency; ++ struct dwc3 *dwc = platform_get_drvdata(mdwc->dwc3); + +- if ((curr_perf_mode == perf_mode) || !latency) ++ dwc->irq_cnt = 0; ++ ++ if ((mdwc->perf_mode == perf_mode) || !latency) + return; + + if (perf_mode) +@@ -4214,7 +4231,7 @@ static void msm_dwc3_perf_vote_update(struct dwc3_msm *mdwc, bool perf_mode) + pm_qos_update_request(&mdwc->pm_qos_req_dma, + PM_QOS_DEFAULT_VALUE); + +- curr_perf_mode = perf_mode; ++ mdwc->perf_mode = perf_mode; + pr_debug("%s: latency updated to: %d\n", __func__, + perf_mode ? latency : PM_QOS_DEFAULT_VALUE); + } +@@ -4224,13 +4241,14 @@ static void msm_dwc3_perf_vote_work(struct work_struct *w) + struct dwc3_msm *mdwc = container_of(w, struct dwc3_msm, + perf_vote_work.work); + struct dwc3 *dwc = platform_get_drvdata(mdwc->dwc3); +- static unsigned long last_irq_cnt; + bool in_perf_mode = false; + +- if (dwc->irq_cnt - last_irq_cnt >= PM_QOS_THRESHOLD) ++ if (dwc->irq_cnt >= PM_QOS_THRESHOLD) + in_perf_mode = true; + +- last_irq_cnt = dwc->irq_cnt; ++ pr_debug("%s: in_perf_mode:%u, interrupts in last sample:%lu\n", ++ __func__, in_perf_mode, dwc->irq_cnt); ++ + msm_dwc3_perf_vote_update(mdwc, in_perf_mode); + schedule_delayed_work(&mdwc->perf_vote_work, + msecs_to_jiffies(1000 * PM_QOS_SAMPLE_SEC)); +@@ -4691,9 +4709,14 @@ static void dwc3_otg_sm_work(struct work_struct *w) dwc3_msm_gadget_vbus_draw(mdwc, 0); dev_dbg(mdwc->dev, "Cable disconnected\n"); #ifdef CONFIG_VXR200_XR_MISC @@ -72219,7 +95404,7 @@ index 3da1d2992698..b5b7689a0093 100644 } break; -@@ -4879,7 +4898,7 @@ static int dwc3_msm_pm_resume(struct device *dev) +@@ -4879,7 +4902,7 @@ static int dwc3_msm_pm_resume(struct device *dev) if (atomic_read(&dwc->in_lpm) && mdwc->drd_state == DRD_STATE_PERIPHERAL_SUSPEND) { dev_info(mdwc->dev, "USB Resume start\n"); @@ -72243,7 +95428,7 @@ index 82e159c66b8c..de747b8c26ec 100644 return dep; diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 8a02f84495cc..c9e0a3f95aca 100644 +index 8a02f84495cc..4edeb4be883f 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -36,6 +36,10 @@ @@ -72321,6 +95506,34 @@ index 8a02f84495cc..c9e0a3f95aca 100644 spin_unlock_irqrestore(&dwc->lock, flags); return ret; +@@ -1072,19 +1108,19 @@ static struct dwc3_trb *dwc3_ep_prev_trb(struct dwc3_ep *dep, u8 index) + + static u32 dwc3_calc_trbs_left(struct dwc3_ep *dep) + { +- struct dwc3_trb *tmp; + u8 trbs_left; + + /* +- * If enqueue & dequeue are equal than it is either full or empty. +- * +- * One way to know for sure is if the TRB right before us has HWO bit +- * set or not. If it has, then we're definitely full and can't fit any +- * more transfers in our ring. ++ * If the enqueue & dequeue are equal then the TRB ring is either full ++ * or empty. It's considered full when there are DWC3_TRB_NUM-1 of TRBs ++ * pending to be processed by the driver. + */ + if (dep->trb_enqueue == dep->trb_dequeue) { +- tmp = dwc3_ep_prev_trb(dep, dep->trb_enqueue); +- if (!tmp || tmp->ctrl & DWC3_TRB_CTRL_HWO) ++ /* ++ * If there is any request remained in the started_list at ++ * this point, that means there is no TRB available. ++ */ ++ if (!list_empty(&dep->started_list)) + return 0; + + return DWC3_TRB_NUM - 1; @@ -1130,12 +1166,18 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep, { unsigned int length; @@ -72461,7 +95674,7 @@ index d29c5837c643..dd34f47d23a2 100644 CDC EEM is a newer USB standard that is somewhat simpler than CDC ECM and therefore can be supported by more hardware. Technically ECM and diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index f7367ba4b2aa..ab5283eb6fbf 100755 +index f7367ba4b2aa..c7089cf8d079 100755 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -108,40 +108,43 @@ function_descriptors(struct usb_function *f, @@ -72594,7 +95807,29 @@ index f7367ba4b2aa..ab5283eb6fbf 100755 EXPORT_SYMBOL_GPL(config_ep_by_speed); /** -@@ -1179,7 +1223,7 @@ static void collect_langs(struct usb_gadget_strings **sp, __le16 *buf) +@@ -560,7 +604,7 @@ static u8 encode_bMaxPower(enum usb_device_speed speed, + { + unsigned val; + +- if (c->MaxPower) ++ if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER)) + val = c->MaxPower; + else + val = CONFIG_USB_GADGET_VBUS_DRAW; +@@ -983,7 +1027,11 @@ static int set_config(struct usb_composite_dev *cdev, + } + + /* when we return, be sure our power usage is valid */ +- power = c->MaxPower ? c->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW; ++ if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER)) ++ power = c->MaxPower; ++ else ++ power = CONFIG_USB_GADGET_VBUS_DRAW; ++ + if (gadget->speed < USB_SPEED_SUPER) + power = min(power, 500U); + else +@@ -1179,7 +1227,7 @@ static void collect_langs(struct usb_gadget_strings **sp, __le16 *buf) while (*sp) { s = *sp; language = cpu_to_le16(s->language); @@ -72603,7 +95838,7 @@ index f7367ba4b2aa..ab5283eb6fbf 100755 if (*tmp == language) goto repeat; } -@@ -1254,7 +1298,7 @@ static int get_string(struct usb_composite_dev *cdev, +@@ -1254,7 +1302,7 @@ static int get_string(struct usb_composite_dev *cdev, collect_langs(sp, s->wData); } @@ -72612,7 +95847,26 @@ index f7367ba4b2aa..ab5283eb6fbf 100755 continue; if (!len) return -EINVAL; -@@ -1807,8 +1851,10 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) +@@ -1736,6 +1784,18 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + struct usb_function *f = NULL; + u8 endp; + ++ if (w_length > USB_COMP_EP0_BUFSIZ) { ++ if (ctrl->bRequestType & USB_DIR_IN) { ++ /* Cast away the const, we are going to overwrite on purpose. */ ++ __le16 *temp = (__le16 *)&ctrl->wLength; ++ ++ *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ); ++ w_length = USB_COMP_EP0_BUFSIZ; ++ } else { ++ goto done; ++ } ++ } ++ + /* partial re-init of the response message; the function or the + * gadget might need to intercept e.g. a control-OUT completion + * when we delegate to it. +@@ -1807,8 +1867,10 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) value = min(w_length, (u16) value); break; case USB_DT_STRING: @@ -72623,7 +95877,16 @@ index f7367ba4b2aa..ab5283eb6fbf 100755 if (value >= 0) value = min(w_length, (u16) value); break; -@@ -2503,7 +2549,7 @@ void composite_resume(struct usb_gadget *gadget) +@@ -2322,7 +2384,7 @@ int composite_dev_prepare(struct usb_composite_driver *composite, + if (!cdev->req) + return -ENOMEM; + +- cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ + ++ cdev->req->buf = kzalloc(USB_COMP_EP0_BUFSIZ + + (gadget->extra_buf_alloc), GFP_KERNEL); + if (!cdev->req->buf) + goto fail; +@@ -2503,7 +2565,7 @@ void composite_resume(struct usb_gadget *gadget) * suspend/resume callbacks? */ INFO(cdev, "USB Resume end\n"); @@ -73978,7 +97241,7 @@ index fbc942d7a484..104a0e78cf9b 100644 uvc_ss_streaming_ep.wMaxPacketSize = cpu_to_le16(max_packet_size); uvc_ss_streaming_ep.bInterval = opts->streaming_interval; diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c -index a0ad21f6994d..403633498d7d 100644 +index a0ad21f6994d..44117d1231e8 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -137,7 +137,7 @@ MODULE_PARM_DESC(tx_qmult, "Additional queue length multiplier for tx"); @@ -73990,6 +97253,18 @@ index a0ad21f6994d..403633498d7d 100644 return qmult * DEFAULT_QLEN; else return DEFAULT_QLEN; +@@ -788,8 +788,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, + } + spin_unlock_irqrestore(&dev->lock, flags); + +- if (skb && !in) { +- dev_kfree_skb_any(skb); ++ if (!in) { ++ if (skb) ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c index 91fd78212488..bce3732bdd1d 100644 --- a/drivers/usb/gadget/function/uvc_video.c @@ -74020,6 +97295,39 @@ index c39de65a448b..270bb88c51cb 100644 usb_otg_descriptor_init(gadget, usb_desc); otg_desc[0] = usb_desc; otg_desc[1] = NULL; +diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c +index 99ca3dabc4f3..e8818ad973e4 100644 +--- a/drivers/usb/gadget/legacy/dbgp.c ++++ b/drivers/usb/gadget/legacy/dbgp.c +@@ -136,7 +136,7 @@ static int dbgp_enable_ep_req(struct usb_ep *ep) + goto fail_1; + } + +- req->buf = kmalloc(DBGP_REQ_LEN, GFP_KERNEL); ++ req->buf = kzalloc(DBGP_REQ_LEN, GFP_KERNEL); + if (!req->buf) { + err = -ENOMEM; + stp = 2; +@@ -344,6 +344,19 @@ static int dbgp_setup(struct usb_gadget *gadget, + void *data = NULL; + u16 len = 0; + ++ if (length > DBGP_REQ_LEN) { ++ if (ctrl->bRequestType & USB_DIR_IN) { ++ /* Cast away the const, we are going to overwrite on purpose. */ ++ __le16 *temp = (__le16 *)&ctrl->wLength; ++ ++ *temp = cpu_to_le16(DBGP_REQ_LEN); ++ length = DBGP_REQ_LEN; ++ } else { ++ return err; ++ } ++ } ++ ++ + if (request == USB_REQ_GET_DESCRIPTOR) { + switch (value>>8) { + case USB_DT_DEVICE: diff --git a/drivers/usb/gadget/legacy/ether.c b/drivers/usb/gadget/legacy/ether.c index 25a2c2e48592..3396e7193dba 100644 --- a/drivers/usb/gadget/legacy/ether.c @@ -74037,10 +97345,22 @@ index 25a2c2e48592..3396e7193dba 100644 otg_desc[0] = usb_desc; otg_desc[1] = NULL; diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c -index a71a884f79fc..cccbb948821b 100644 +index a71a884f79fc..a55d3761d777 100644 --- a/drivers/usb/gadget/legacy/hid.c +++ b/drivers/usb/gadget/legacy/hid.c -@@ -175,8 +175,10 @@ static int hid_bind(struct usb_composite_dev *cdev) +@@ -103,8 +103,10 @@ static int do_config(struct usb_configuration *c) + + list_for_each_entry(e, &hidg_func_list, node) { + e->f = usb_get_function(e->fi); +- if (IS_ERR(e->f)) ++ if (IS_ERR(e->f)) { ++ status = PTR_ERR(e->f); + goto put; ++ } + status = usb_add_function(c, e->f); + if (status < 0) { + usb_put_function(e->f); +@@ -175,8 +177,10 @@ static int hid_bind(struct usb_composite_dev *cdev) struct usb_descriptor_header *usb_desc; usb_desc = usb_otg_descriptor_alloc(gadget); @@ -74053,10 +97373,47 @@ index a71a884f79fc..cccbb948821b 100644 otg_desc[0] = usb_desc; otg_desc[1] = NULL; diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c -index cb02e9ecd8e7..de0f3c2c9f6f 100644 +index cb02e9ecd8e7..19eb954a7afa 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c -@@ -2045,6 +2045,9 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent) +@@ -113,6 +113,8 @@ enum ep0_state { + /* enough for the whole queue: most events invalidate others */ + #define N_EVENT 5 + ++#define RBUF_SIZE 256 ++ + struct dev_data { + spinlock_t lock; + atomic_t count; +@@ -147,7 +149,7 @@ struct dev_data { + struct dentry *dentry; + + /* except this scratch i/o buffer for ep0 */ +- u8 rbuf [256]; ++ u8 rbuf[RBUF_SIZE]; + }; + + static inline void get_dev (struct dev_data *data) +@@ -1336,6 +1338,18 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + u16 w_value = le16_to_cpu(ctrl->wValue); + u16 w_length = le16_to_cpu(ctrl->wLength); + ++ if (w_length > RBUF_SIZE) { ++ if (ctrl->bRequestType & USB_DIR_IN) { ++ /* Cast away the const, we are going to overwrite on purpose. */ ++ __le16 *temp = (__le16 *)&ctrl->wLength; ++ ++ *temp = cpu_to_le16(RBUF_SIZE); ++ w_length = RBUF_SIZE; ++ } else { ++ return value; ++ } ++ } ++ + spin_lock (&dev->lock); + dev->setup_abort = 0; + if (dev->state == STATE_DEV_UNCONNECTED) { +@@ -2045,6 +2059,9 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent) return 0; Enomem: @@ -74126,6 +97483,33 @@ index 2f03334c6874..d150a6795f48 100644 }) #define vla_ptr(ptr, groupname, name) \ +diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig +index 42028cc9304c..24a75c3f73fb 100644 +--- a/drivers/usb/gadget/udc/Kconfig ++++ b/drivers/usb/gadget/udc/Kconfig +@@ -278,6 +278,7 @@ config USB_AMD5536UDC + config USB_FSL_QE + tristate "Freescale QE/CPM USB Device Controller" + depends on FSL_SOC && (QUICC_ENGINE || CPM) ++ depends on !64BIT || BROKEN + help + Some of Freescale PowerPC processors have a Full Speed + QE/CPM2 USB controller, which support device mode with 4 +diff --git a/drivers/usb/gadget/udc/at91_udc.c b/drivers/usb/gadget/udc/at91_udc.c +index 8bc78418d40e..cd92cda03d71 100644 +--- a/drivers/usb/gadget/udc/at91_udc.c ++++ b/drivers/usb/gadget/udc/at91_udc.c +@@ -1895,7 +1895,9 @@ static int at91udc_probe(struct platform_device *pdev) + clk_disable(udc->iclk); + + /* request UDC and maybe VBUS irqs */ +- udc->udp_irq = platform_get_irq(pdev, 0); ++ udc->udp_irq = retval = platform_get_irq(pdev, 0); ++ if (retval < 0) ++ goto err_unprepare_iclk; + retval = devm_request_irq(dev, udc->udp_irq, at91_udc_irq, 0, + driver_name, udc); + if (retval) { diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c index 57dd3bad9539..ccf1e9fe5ebd 100644 --- a/drivers/usb/gadget/udc/atmel_usba_udc.c @@ -74471,6 +97855,51 @@ index 6e977dc22570..1be409644a48 100644 clean_up3: if (m66592->pdata->on_chip) { clk_disable(m66592->clk); +diff --git a/drivers/usb/gadget/udc/mv_u3d_core.c b/drivers/usb/gadget/udc/mv_u3d_core.c +index b9e19a591322..d75c6449616b 100644 +--- a/drivers/usb/gadget/udc/mv_u3d_core.c ++++ b/drivers/usb/gadget/udc/mv_u3d_core.c +@@ -1912,14 +1912,6 @@ static int mv_u3d_probe(struct platform_device *dev) + goto err_get_irq; + } + u3d->irq = r->start; +- if (request_irq(u3d->irq, mv_u3d_irq, +- IRQF_SHARED, driver_name, u3d)) { +- u3d->irq = 0; +- dev_err(&dev->dev, "Request irq %d for u3d failed\n", +- u3d->irq); +- retval = -ENODEV; +- goto err_request_irq; +- } + + /* initialize gadget structure */ + u3d->gadget.ops = &mv_u3d_ops; /* usb_gadget_ops */ +@@ -1932,6 +1924,15 @@ static int mv_u3d_probe(struct platform_device *dev) + + mv_u3d_eps_init(u3d); + ++ if (request_irq(u3d->irq, mv_u3d_irq, ++ IRQF_SHARED, driver_name, u3d)) { ++ u3d->irq = 0; ++ dev_err(&dev->dev, "Request irq %d for u3d failed\n", ++ u3d->irq); ++ retval = -ENODEV; ++ goto err_request_irq; ++ } ++ + /* external vbus detection */ + if (u3d->vbus) { + u3d->clock_gating = 1; +@@ -1955,8 +1956,8 @@ static int mv_u3d_probe(struct platform_device *dev) + + err_unregister: + free_irq(u3d->irq, u3d); +-err_request_irq: + err_get_irq: ++err_request_irq: + kfree(u3d->status_req); + err_alloc_status_req: + kfree(u3d->eps); diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c index ce73b3552269..8700db903382 100644 --- a/drivers/usb/gadget/udc/mv_udc_core.c @@ -74638,9 +98067,18 @@ index 8a365aad66fe..18ce19162804 100644 static int pch_udc_start(struct usb_gadget *g, diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c -index 230e3248f386..80503c3604ca 100644 +index 230e3248f386..192d76a1bdd5 100644 --- a/drivers/usb/gadget/udc/r8a66597-udc.c +++ b/drivers/usb/gadget/udc/r8a66597-udc.c +@@ -1253,7 +1253,7 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl) + do { + tmp = r8a66597_read(r8a66597, INTSTS0) & CTSQ; + udelay(1); +- } while (tmp != CS_IDST || timeout-- > 0); ++ } while (tmp != CS_IDST && timeout-- > 0); + + if (tmp == CS_IDST) + r8a66597_bset(r8a66597, @@ -1855,6 +1855,8 @@ static int r8a66597_probe(struct platform_device *pdev) return PTR_ERR(reg); @@ -74805,8 +98243,34 @@ index 94ea9fff13e6..9227a9ddac60 100644 err_phy: for (i = 0; i < omap->nports; i++) { +diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c +index ee8d5faa0194..3eecf47d4e89 100644 +--- a/drivers/usb/host/ehci-orion.c ++++ b/drivers/usb/host/ehci-orion.c +@@ -218,8 +218,11 @@ static int ehci_orion_drv_probe(struct platform_device *pdev) + * the clock does not exists. + */ + priv->clk = devm_clk_get(&pdev->dev, NULL); +- if (!IS_ERR(priv->clk)) +- clk_prepare_enable(priv->clk); ++ if (!IS_ERR(priv->clk)) { ++ err = clk_prepare_enable(priv->clk); ++ if (err) ++ goto err_put_hcd; ++ } + + priv->phy = devm_phy_optional_get(&pdev->dev, "usb"); + if (IS_ERR(priv->phy)) { +@@ -280,6 +283,7 @@ static int ehci_orion_drv_probe(struct platform_device *pdev) + err_phy_get: + if (!IS_ERR(priv->clk)) + clk_disable_unprepare(priv->clk); ++err_put_hcd: + usb_put_hcd(hcd); + err: + dev_err(&pdev->dev, "init %s fail, %d\n", diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c -index 3b3649d88c5f..08b3f8c80601 100644 +index 3b3649d88c5f..a31015a95fd6 100644 --- a/drivers/usb/host/ehci-pci.c +++ b/drivers/usb/host/ehci-pci.c @@ -229,6 +229,13 @@ static int ehci_pci_setup(struct usb_hcd *hcd) @@ -74823,11 +98287,150 @@ index 3b3649d88c5f..08b3f8c80601 100644 } /* optional debug port, normally in the first BAR */ +@@ -305,6 +312,9 @@ static int ehci_pci_setup(struct usb_hcd *hcd) + if (pdev->vendor == PCI_VENDOR_ID_STMICRO + && pdev->device == PCI_DEVICE_ID_STMICRO_USB_HOST) + ; /* ConneXT has no sbrn register */ ++ else if (pdev->vendor == PCI_VENDOR_ID_HUAWEI ++ && pdev->device == 0xa239) ++ ; /* HUAWEI Kunpeng920 USB EHCI has no sbrn register */ + else + pci_read_config_byte(pdev, 0x60, &ehci->sbrn); + diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c -index 72853020a542..15249e664b89 100644 +index 72853020a542..f0ec538a8813 100644 --- a/drivers/usb/host/fotg210-hcd.c +++ b/drivers/usb/host/fotg210-hcd.c -@@ -5599,7 +5599,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) +@@ -2537,11 +2537,6 @@ static unsigned qh_completions(struct fotg210_hcd *fotg210, + return count; + } + +-/* high bandwidth multiplier, as encoded in highspeed endpoint descriptors */ +-#define hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03)) +-/* ... and packet size, for any kind of endpoint descriptor */ +-#define max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff) +- + /* reverse of qh_urb_transaction: free a list of TDs. + * used for cleanup after errors, before HC sees an URB's TDs. + */ +@@ -2627,7 +2622,7 @@ static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210, + token |= (1 /* "in" */ << 8); + /* else it's already initted to "out" pid (0 << 8) */ + +- maxpacket = max_packet(usb_maxpacket(urb->dev, urb->pipe, !is_input)); ++ maxpacket = usb_maxpacket(urb->dev, urb->pipe, !is_input); + + /* + * buffer gets wrapped in one or more qtds; +@@ -2741,9 +2736,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, + gfp_t flags) + { + struct fotg210_qh *qh = fotg210_qh_alloc(fotg210, flags); ++ struct usb_host_endpoint *ep; + u32 info1 = 0, info2 = 0; + int is_input, type; + int maxp = 0; ++ int mult; + struct usb_tt *tt = urb->dev->tt; + struct fotg210_qh_hw *hw; + +@@ -2758,14 +2755,15 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, + + is_input = usb_pipein(urb->pipe); + type = usb_pipetype(urb->pipe); +- maxp = usb_maxpacket(urb->dev, urb->pipe, !is_input); ++ ep = usb_pipe_endpoint(urb->dev, urb->pipe); ++ maxp = usb_endpoint_maxp(&ep->desc); ++ mult = usb_endpoint_maxp_mult(&ep->desc); + + /* 1024 byte maxpacket is a hardware ceiling. High bandwidth + * acts like up to 3KB, but is built from smaller packets. + */ +- if (max_packet(maxp) > 1024) { +- fotg210_dbg(fotg210, "bogus qh maxpacket %d\n", +- max_packet(maxp)); ++ if (maxp > 1024) { ++ fotg210_dbg(fotg210, "bogus qh maxpacket %d\n", maxp); + goto done; + } + +@@ -2779,8 +2777,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, + */ + if (type == PIPE_INTERRUPT) { + qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH, +- is_input, 0, +- hb_mult(maxp) * max_packet(maxp))); ++ is_input, 0, mult * maxp)); + qh->start = NO_FRAME; + + if (urb->dev->speed == USB_SPEED_HIGH) { +@@ -2817,7 +2814,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, + think_time = tt ? tt->think_time : 0; + qh->tt_usecs = NS_TO_US(think_time + + usb_calc_bus_time(urb->dev->speed, +- is_input, 0, max_packet(maxp))); ++ is_input, 0, maxp)); + qh->period = urb->interval; + if (qh->period > fotg210->periodic_size) { + qh->period = fotg210->periodic_size; +@@ -2880,11 +2877,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, + * to help them do so. So now people expect to use + * such nonconformant devices with Linux too; sigh. + */ +- info1 |= max_packet(maxp) << 16; ++ info1 |= maxp << 16; + info2 |= (FOTG210_TUNE_MULT_HS << 30); + } else { /* PIPE_INTERRUPT */ +- info1 |= max_packet(maxp) << 16; +- info2 |= hb_mult(maxp) << 30; ++ info1 |= maxp << 16; ++ info2 |= mult << 30; + } + break; + default: +@@ -3954,6 +3951,7 @@ static void iso_stream_init(struct fotg210_hcd *fotg210, + int is_input; + long bandwidth; + unsigned multi; ++ struct usb_host_endpoint *ep; + + /* + * this might be a "high bandwidth" highspeed endpoint, +@@ -3961,14 +3959,14 @@ static void iso_stream_init(struct fotg210_hcd *fotg210, + */ + epnum = usb_pipeendpoint(pipe); + is_input = usb_pipein(pipe) ? USB_DIR_IN : 0; +- maxp = usb_maxpacket(dev, pipe, !is_input); ++ ep = usb_pipe_endpoint(dev, pipe); ++ maxp = usb_endpoint_maxp(&ep->desc); + if (is_input) + buf1 = (1 << 11); + else + buf1 = 0; + +- maxp = max_packet(maxp); +- multi = hb_mult(maxp); ++ multi = usb_endpoint_maxp_mult(&ep->desc); + buf1 |= maxp; + maxp *= multi; + +@@ -4490,13 +4488,12 @@ static bool itd_complete(struct fotg210_hcd *fotg210, struct fotg210_itd *itd) + + /* HC need not update length with this error */ + if (!(t & FOTG210_ISOC_BABBLE)) { +- desc->actual_length = +- fotg210_itdlen(urb, desc, t); ++ desc->actual_length = FOTG210_ITD_LENGTH(t); + urb->actual_length += desc->actual_length; + } + } else if (likely((t & FOTG210_ISOC_ACTIVE) == 0)) { + desc->status = 0; +- desc->actual_length = fotg210_itdlen(urb, desc, t); ++ desc->actual_length = FOTG210_ITD_LENGTH(t); + urb->actual_length += desc->actual_length; + } else { + /* URB was too late */ +@@ -5599,7 +5596,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) struct usb_hcd *hcd; struct resource *res; int irq; @@ -74836,7 +98439,7 @@ index 72853020a542..15249e664b89 100644 struct fotg210_hcd *fotg210; if (usb_disabled()) -@@ -5619,7 +5619,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) +@@ -5619,7 +5616,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev, dev_name(dev)); if (!hcd) { @@ -74845,6 +98448,22 @@ index 72853020a542..15249e664b89 100644 retval = -ENOMEM; goto fail_create_hcd; } +diff --git a/drivers/usb/host/fotg210.h b/drivers/usb/host/fotg210.h +index b5cfa7aeb277..1a3f94123c88 100644 +--- a/drivers/usb/host/fotg210.h ++++ b/drivers/usb/host/fotg210.h +@@ -682,11 +682,6 @@ static inline unsigned fotg210_read_frame_index(struct fotg210_hcd *fotg210) + return fotg210_readl(fotg210, &fotg210->regs->frame_index); + } + +-#define fotg210_itdlen(urb, desc, t) ({ \ +- usb_pipein((urb)->pipe) ? \ +- (desc)->length - FOTG210_ITD_LENGTH(t) : \ +- FOTG210_ITD_LENGTH(t); \ +-}) + /*-------------------------------------------------------------------------*/ + + #endif /* __LINUX_FOTG210_H */ diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c index f07ccb25bc24..6f006cbf1f83 100644 --- a/drivers/usb/host/fsl-mph-dr-of.c @@ -74867,10 +98486,19 @@ index f07ccb25bc24..6f006cbf1f83 100644 retval = platform_device_add_data(pdev, pdata, sizeof(*pdata)); if (retval) diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c -index 369869a29ebd..1654a1bc6414 100644 +index 369869a29ebd..88aa5acac6fd 100644 --- a/drivers/usb/host/max3421-hcd.c +++ b/drivers/usb/host/max3421-hcd.c -@@ -149,8 +149,6 @@ struct max3421_hcd { +@@ -121,8 +121,6 @@ struct max3421_hcd { + + struct task_struct *spi_thread; + +- struct max3421_hcd *next; +- + enum max3421_rh_state rh_state; + /* lower 16 bits contain port status, upper 16 bits the change mask: */ + u32 port_status; +@@ -149,8 +147,6 @@ struct max3421_hcd { */ struct urb *curr_urb; enum scheduling_pass sched_pass; @@ -74879,7 +98507,16 @@ index 369869a29ebd..1654a1bc6414 100644 int urb_done; /* > 0 -> no errors, < 0: errno */ size_t curr_len; u8 hien; -@@ -488,39 +486,17 @@ max3421_set_speed(struct usb_hcd *hcd, struct usb_device *dev) +@@ -172,8 +168,6 @@ struct max3421_ep { + u8 retransmit; /* packet needs retransmission */ + }; + +-static struct max3421_hcd *max3421_hcd_list; +- + #define MAX3421_FIFO_SIZE 64 + + #define MAX3421_SPI_DIR_RD 0 /* read register from MAX3421 */ +@@ -488,39 +482,17 @@ max3421_set_speed(struct usb_hcd *hcd, struct usb_device *dev) * Caller must NOT hold HCD spinlock. */ static void @@ -74921,7 +98558,7 @@ index 369869a29ebd..1654a1bc6414 100644 spi_wr8(hcd, MAX3421_REG_HCTL, hctl); /* -@@ -528,7 +504,6 @@ max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum, +@@ -528,7 +500,6 @@ max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum, * address-assignment so it's best to just always load the * address whenever the end-point changed/was forced. */ @@ -74929,7 +98566,7 @@ index 369869a29ebd..1654a1bc6414 100644 spi_wr8(hcd, MAX3421_REG_PERADDR, dev->devnum); } -@@ -663,7 +638,7 @@ max3421_select_and_start_urb(struct usb_hcd *hcd) +@@ -663,7 +634,7 @@ max3421_select_and_start_urb(struct usb_hcd *hcd) struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd); struct urb *urb, *curr_urb = NULL; struct max3421_ep *max3421_ep; @@ -74938,7 +98575,7 @@ index 369869a29ebd..1654a1bc6414 100644 struct usb_host_endpoint *ep; struct list_head *pos; unsigned long flags; -@@ -773,7 +748,6 @@ max3421_select_and_start_urb(struct usb_hcd *hcd) +@@ -773,7 +744,6 @@ max3421_select_and_start_urb(struct usb_hcd *hcd) usb_settoggle(urb->dev, epnum, 0, 1); usb_settoggle(urb->dev, epnum, 1, 1); max3421_ep->pkt_state = PKT_STATE_SETUP; @@ -74946,7 +98583,7 @@ index 369869a29ebd..1654a1bc6414 100644 } else max3421_ep->pkt_state = PKT_STATE_TRANSFER; } -@@ -781,7 +755,7 @@ max3421_select_and_start_urb(struct usb_hcd *hcd) +@@ -781,7 +751,7 @@ max3421_select_and_start_urb(struct usb_hcd *hcd) spin_unlock_irqrestore(&max3421_hcd->lock, flags); max3421_ep->last_active = max3421_hcd->frame_number; @@ -74955,7 +98592,7 @@ index 369869a29ebd..1654a1bc6414 100644 max3421_set_speed(hcd, urb->dev); max3421_next_transfer(hcd, 0); return 1; -@@ -1376,6 +1350,16 @@ max3421_urb_done(struct usb_hcd *hcd) +@@ -1376,6 +1346,16 @@ max3421_urb_done(struct usb_hcd *hcd) status = 0; urb = max3421_hcd->curr_urb; if (urb) { @@ -74972,6 +98609,50 @@ index 369869a29ebd..1654a1bc6414 100644 max3421_hcd->curr_urb = NULL; spin_lock_irqsave(&max3421_hcd->lock, flags); usb_hcd_unlink_urb_from_ep(hcd, urb); +@@ -1851,9 +1831,8 @@ max3421_probe(struct spi_device *spi) + } + set_bit(HCD_FLAG_POLL_RH, &hcd->flags); + max3421_hcd = hcd_to_max3421(hcd); +- max3421_hcd->next = max3421_hcd_list; +- max3421_hcd_list = max3421_hcd; + INIT_LIST_HEAD(&max3421_hcd->ep_list); ++ spi_set_drvdata(spi, max3421_hcd); + + max3421_hcd->tx = kmalloc(sizeof(*max3421_hcd->tx), GFP_KERNEL); + if (!max3421_hcd->tx) +@@ -1898,28 +1877,18 @@ max3421_probe(struct spi_device *spi) + static int + max3421_remove(struct spi_device *spi) + { +- struct max3421_hcd *max3421_hcd = NULL, **prev; +- struct usb_hcd *hcd = NULL; ++ struct max3421_hcd *max3421_hcd; ++ struct usb_hcd *hcd; + unsigned long flags; + +- for (prev = &max3421_hcd_list; *prev; prev = &(*prev)->next) { +- max3421_hcd = *prev; +- hcd = max3421_to_hcd(max3421_hcd); +- if (hcd->self.controller == &spi->dev) +- break; +- } +- if (!max3421_hcd) { +- dev_err(&spi->dev, "no MAX3421 HCD found for SPI device %p\n", +- spi); +- return -ENODEV; +- } ++ max3421_hcd = spi_get_drvdata(spi); ++ hcd = max3421_to_hcd(max3421_hcd); + + usb_remove_hcd(hcd); + + spin_lock_irqsave(&max3421_hcd->lock, flags); + + kthread_stop(max3421_hcd->spi_thread); +- *prev = max3421_hcd->next; + + spin_unlock_irqrestore(&max3421_hcd->lock, flags); + diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c index 6865b919403f..2ed062a2e93b 100644 --- a/drivers/usb/host/ohci-exynos.c @@ -75044,6 +98725,24 @@ index a8b8d8b8d9f3..a960d2bb8dd1 100644 release_mem_region(hcd->rsrc_start, hcd->rsrc_len); usb_put_hcd(hcd); dma_release_declared_memory(&pdev->dev); +diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c +index cfcfadfc94fc..4d42ae3b2fd6 100644 +--- a/drivers/usb/host/ohci-tmio.c ++++ b/drivers/usb/host/ohci-tmio.c +@@ -199,9 +199,12 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev) + if (usb_disabled()) + return -ENODEV; + +- if (!cell) ++ if (!cell || !regs || !config || !sram) + return -EINVAL; + ++ if (irq < 0) ++ return irq; ++ + hcd = usb_create_hcd(&ohci_tmio_hc_driver, &dev->dev, dev_name(&dev->dev)); + if (!hcd) { + ret = -ENOMEM; diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c index 4e4d601af35c..2f48da0c0bb3 100644 --- a/drivers/usb/host/oxu210hp-hcd.c @@ -75097,10 +98796,34 @@ index e0244fb3903d..1e9b2ed83da2 100644 #define XHCI_STS_HALT (1<<0) diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index d3d65f037ea1..51a84f86ca49 100644 +index d3d65f037ea1..9f0b7108ed84 100644 --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c -@@ -627,15 +627,6 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, +@@ -175,7 +175,6 @@ static void xhci_common_hub_descriptor(struct xhci_hcd *xhci, + { + u16 temp; + +- desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.9 says 20ms max */ + desc->bHubContrCurrent = 0; + + desc->bNbrPorts = ports; +@@ -209,6 +208,7 @@ static void xhci_usb2_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci, + desc->bDescriptorType = USB_DT_HUB; + temp = 1 + (ports / 8); + desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * temp; ++ desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.8 says 20ms */ + + /* The Device Removable bits are reported on a byte granularity. + * If the port doesn't exist within that byte, the bit is set to 0. +@@ -259,6 +259,7 @@ static void xhci_usb3_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci, + xhci_common_hub_descriptor(xhci, desc, ports); + desc->bDescriptorType = USB_DT_SS_HUB; + desc->bDescLength = USB_DT_SS_HUB_SIZE; ++ desc->bPwrOn2PwrGood = 50; /* usb 3.1 may fail if less than 100ms */ + + /* header decode latency should be zero for roothubs, + * see section 4.23.5.2. +@@ -627,15 +628,6 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, { u32 pls = status_reg & PORT_PLS_MASK; @@ -75116,7 +98839,7 @@ index d3d65f037ea1..51a84f86ca49 100644 /* When the CAS bit is set then warm reset * should be performed on port */ -@@ -657,6 +648,16 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, +@@ -657,6 +649,16 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, */ pls |= USB_PORT_STAT_CONNECTION; } else { @@ -75133,7 +98856,7 @@ index d3d65f037ea1..51a84f86ca49 100644 /* * If CAS bit isn't set but the Port is already at * Compliance Mode, fake a connection so the USB core -@@ -1506,11 +1507,12 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) +@@ -1506,11 +1508,12 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf) * Inform the usbcore about resume-in-progress by returning * a non-zero value even if there are no status changes. */ @@ -75147,7 +98870,7 @@ index d3d65f037ea1..51a84f86ca49 100644 /* For each port, did anything change? If so, set that bit in buf. */ for (i = 0; i < max_ports; i++) { temp = readl(port_array[i]); -@@ -1638,6 +1640,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd) +@@ -1638,6 +1641,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd) hcd->state = HC_STATE_SUSPENDED; bus_state->next_statechange = jiffies + msecs_to_jiffies(10); spin_unlock_irqrestore(&xhci->lock, flags); @@ -75222,10 +98945,26 @@ index c10875834a5a..0fe26152bae5 100644 ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED); diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index adf21ac76e34..1b063e491f60 100644 +index adf21ac76e34..a039cb2fb21a 100644 --- a/drivers/usb/host/xhci-pci.c +++ b/drivers/usb/host/xhci-pci.c -@@ -215,6 +215,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) +@@ -38,6 +38,7 @@ + #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73 + #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000 + #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009 ++#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 0x1100 + #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400 + + #define PCI_VENDOR_ID_ETRON 0x1b6f +@@ -91,6 +92,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + /* Look for vendor-specific quirks */ + if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC && + (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK || ++ pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 || + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1400)) { + if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK && + pdev->revision == 0x0) { +@@ -215,6 +217,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && pdev->device == 0x1142) xhci->quirks |= XHCI_TRUST_TX_LENGTH; @@ -75353,7 +99092,7 @@ index 97d57a94776a..040c43097d55 100644 if (err < 0) { diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index a4fead9772e5..ba677acb1d48 100755 +index a4fead9772e5..603dba9d6f0c 100755 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1079,6 +1079,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) @@ -75479,58 +99218,6 @@ index a4fead9772e5..ba677acb1d48 100755 return 0; } } -@@ -4469,19 +4491,19 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci, - { - unsigned long long timeout_ns; - -+ if (xhci->quirks & XHCI_INTEL_HOST) -+ timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc); -+ else -+ timeout_ns = udev->u1_params.sel; -+ - /* Prevent U1 if service interval is shorter than U1 exit latency */ - if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { -- if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) { -+ if (xhci_service_interval_to_ns(desc) <= timeout_ns) { - dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n"); - return USB3_LPM_DISABLED; - } - } - -- if (xhci->quirks & XHCI_INTEL_HOST) -- timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc); -- else -- timeout_ns = udev->u1_params.sel; -- - /* The U1 timeout is encoded in 1us intervals. - * Don't return a timeout of zero, because that's USB3_LPM_DISABLED. - */ -@@ -4533,19 +4555,19 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci, - { - unsigned long long timeout_ns; - -+ if (xhci->quirks & XHCI_INTEL_HOST) -+ timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc); -+ else -+ timeout_ns = udev->u2_params.sel; -+ - /* Prevent U2 if service interval is shorter than U2 exit latency */ - if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { -- if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) { -+ if (xhci_service_interval_to_ns(desc) <= timeout_ns) { - dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n"); - return USB3_LPM_DISABLED; - } - } - -- if (xhci->quirks & XHCI_INTEL_HOST) -- timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc); -- else -- timeout_ns = udev->u2_params.sel; -- - /* The U2 timeout is encoded in 256us intervals */ - timeout_ns = DIV_ROUND_UP_ULL(timeout_ns, 256 * 1000); - /* If the necessary timeout value is bigger than what we can set in the diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h index 6c0cfaa0c6d4..cd402a196758 100644 --- a/drivers/usb/host/xhci.h @@ -75556,6 +99243,39 @@ index 7fb0590187d4..a1bc516be154 100644 (status != -ECONNRESET)) { dev_dbg(&dev->udev->dev, "%s :nonzero status received: %d\n", __func__, +diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c +index 1b83946bfb18..1ea48590bf3b 100644 +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -96,10 +96,6 @@ struct iowarrior { + /* globals */ + /*--------------*/ + +-/* +- * USB spec identifies 5 second timeouts. +- */ +-#define GET_TIMEOUT 5 + #define USB_REQ_GET_REPORT 0x01 + //#if 0 + static int usb_get_report(struct usb_device *dev, +@@ -111,7 +107,7 @@ static int usb_get_report(struct usb_device *dev, + USB_DIR_IN | USB_TYPE_CLASS | + USB_RECIP_INTERFACE, (type << 8) + id, + inter->desc.bInterfaceNumber, buf, size, +- GET_TIMEOUT*HZ); ++ USB_CTRL_GET_TIMEOUT); + } + //#endif + +@@ -126,7 +122,7 @@ static int usb_set_report(struct usb_interface *intf, unsigned char type, + USB_TYPE_CLASS | USB_RECIP_INTERFACE, + (type << 8) + id, + intf->cur_altsetting->desc.bInterfaceNumber, buf, +- size, HZ); ++ size, 1000); + } + + /*---------------------*/ diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c index baa57bc29192..1db97bbb7463 100644 --- a/drivers/usb/misc/lvstest.c @@ -75709,6 +99429,47 @@ index c232229162e0..fcc709c043f0 100644 return error; } EXPORT_SYMBOL_GPL(musb_queue_resume_work); +diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c +index 60540a8ac431..8eb3a291ca9d 100644 +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -1284,9 +1284,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req, + status = musb_queue_resume_work(musb, + musb_ep_restart_resume_work, + request); +- if (status < 0) ++ if (status < 0) { + dev_err(musb->controller, "%s resume work: %i\n", + __func__, status); ++ list_del(&request->list); ++ } + } + + unlock: +diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c +index e85cc8e4e7a9..fb4239b5286f 100644 +--- a/drivers/usb/musb/tusb6010.c ++++ b/drivers/usb/musb/tusb6010.c +@@ -193,6 +193,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len) + } + if (len > 0) { + /* Write the rest 1 - 3 bytes to FIFO */ ++ val = 0; + memcpy(&val, buf, len); + musb_writel(fifo, 0, val); + } +@@ -1119,6 +1120,11 @@ static int tusb_musb_init(struct musb *musb) + + /* dma address for async dma */ + mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!mem) { ++ pr_debug("no async dma resource?\n"); ++ ret = -ENODEV; ++ goto done; ++ } + musb->async = mem->start; + + /* dma address for sync dma */ diff --git a/drivers/usb/pd/policy_engine.c b/drivers/usb/pd/policy_engine.c index 241c22a48d63..9c9ba887622e 100644 --- a/drivers/usb/pd/policy_engine.c @@ -75798,6 +99559,63 @@ index 241c22a48d63..9c9ba887622e 100644 NULL, }; ATTRIBUTE_GROUPS(usbpd); +diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c +index 85d031ce85c1..63798de8b5ae 100644 +--- a/drivers/usb/phy/phy-fsl-usb.c ++++ b/drivers/usb/phy/phy-fsl-usb.c +@@ -891,6 +891,8 @@ int usb_otg_start(struct platform_device *pdev) + + /* request irq */ + p_otg->irq = platform_get_irq(pdev, 0); ++ if (p_otg->irq < 0) ++ return p_otg->irq; + status = request_irq(p_otg->irq, fsl_otg_isr, + IRQF_SHARED, driver_name, p_otg); + if (status) { +diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c +index b3b33cf7ddf6..f333024660b4 100644 +--- a/drivers/usb/phy/phy-isp1301.c ++++ b/drivers/usb/phy/phy-isp1301.c +@@ -136,7 +136,7 @@ static int isp1301_remove(struct i2c_client *client) + static struct i2c_driver isp1301_driver = { + .driver = { + .name = DRV_NAME, +- .of_match_table = of_match_ptr(isp1301_of_match), ++ .of_match_table = isp1301_of_match, + }, + .probe = isp1301_probe, + .remove = isp1301_remove, +diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c +index 335a1ef35224..ec86eedd789b 100644 +--- a/drivers/usb/phy/phy-tahvo.c ++++ b/drivers/usb/phy/phy-tahvo.c +@@ -404,7 +404,9 @@ static int tahvo_usb_probe(struct platform_device *pdev) + + dev_set_drvdata(&pdev->dev, tu); + +- tu->irq = platform_get_irq(pdev, 0); ++ tu->irq = ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; + ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt, + IRQF_ONESHOT, + "tahvo-vbus", tu); +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index cf0b67433ac9..ccb36e240953 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -352,6 +352,11 @@ static int twl6030_usb_probe(struct platform_device *pdev) + twl->irq2 = platform_get_irq(pdev, 1); + twl->linkstat = MUSB_UNKNOWN; + ++ if (twl->irq1 < 0) ++ return twl->irq1; ++ if (twl->irq2 < 0) ++ return twl->irq2; ++ + twl->comparator.set_vbus = twl6030_set_vbus; + twl->comparator.start_srp = twl6030_start_srp; + diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c index f6a1ae8abb21..aafecac9ba26 100644 --- a/drivers/usb/renesas_usbhs/fifo.c @@ -75860,7 +99678,7 @@ index 0291dc7cd284..c6ff79360302 100644 }; MODULE_DEVICE_TABLE(usb, id_table); diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 71a951f9dbe8..45be4c72401b 100644 +index 71a951f9dbe8..5214ea601b1c 100644 --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -58,6 +58,7 @@ static const struct usb_device_id id_table[] = { @@ -75897,7 +99715,15 @@ index 71a951f9dbe8..45be4c72401b 100644 { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ -@@ -255,6 +261,8 @@ static struct usb_serial_driver cp210x_device = { +@@ -225,6 +231,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ + { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ + { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ ++ { USB_DEVICE(0x2184, 0x0030) }, /* GW Instek GDM-834x Digital Multimeter */ + { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ +@@ -255,6 +262,8 @@ static struct usb_serial_driver cp210x_device = { .break_ctl = cp210x_break_ctl, .set_termios = cp210x_set_termios, .tx_empty = cp210x_tx_empty, @@ -75906,7 +99732,7 @@ index 71a951f9dbe8..45be4c72401b 100644 .tiocmget = cp210x_tiocmget, .tiocmset = cp210x_tiocmset, .port_probe = cp210x_port_probe, -@@ -765,6 +773,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, +@@ -765,6 +774,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, u32 baud; u16 bits = 0; u32 ctl_hs; @@ -75914,7 +99740,7 @@ index 71a951f9dbe8..45be4c72401b 100644 cp210x_read_u32_reg(port, CP210X_GET_BAUDRATE, &baud); -@@ -865,6 +874,22 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, +@@ -865,6 +875,22 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, ctl_hs = le32_to_cpu(flow_ctl.ulControlHandshake); if (ctl_hs & CP210X_SERIAL_CTS_HANDSHAKE) { dev_dbg(dev, "%s - flow control = CRTSCTS\n", __func__); @@ -76138,10 +99964,18 @@ index 7ab3235febfc..4aa6fe834091 100644 spin_lock(&priv->dp_port_lock); priv->dp_transmit_idle = 1; diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index a7cb0968259e..8f4bd9fa8244 100644 +index a7cb0968259e..fe6b32c2ff1c 100644 --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c -@@ -606,6 +606,7 @@ static const struct usb_device_id id_table_combined[] = { +@@ -214,6 +214,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) }, + { USB_DEVICE(FTDI_VID, FTDI_VARDAAN_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_AUTO_M3_OP_COM_V2_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) }, +@@ -606,6 +607,7 @@ static const struct usb_device_id id_table_combined[] = { .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, @@ -76149,7 +99983,7 @@ index a7cb0968259e..8f4bd9fa8244 100644 { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, -@@ -708,6 +709,7 @@ static const struct usb_device_id id_table_combined[] = { +@@ -708,6 +710,7 @@ static const struct usb_device_id id_table_combined[] = { { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) }, { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) }, { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) }, @@ -76157,7 +99991,7 @@ index a7cb0968259e..8f4bd9fa8244 100644 { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) }, { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) }, { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) }, -@@ -1028,9 +1030,17 @@ static const struct usb_device_id id_table_combined[] = { +@@ -1028,9 +1031,17 @@ static const struct usb_device_id id_table_combined[] = { /* Sienna devices */ { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) }, { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) }, @@ -76175,7 +100009,7 @@ index a7cb0968259e..8f4bd9fa8244 100644 { } /* Terminating entry */ }; -@@ -2051,12 +2061,11 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port, +@@ -2051,12 +2062,11 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port, #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE) static int ftdi_process_packet(struct usb_serial_port *port, @@ -76190,7 +100024,7 @@ index a7cb0968259e..8f4bd9fa8244 100644 if (len < 2) { dev_dbg(&port->dev, "malformed packet\n"); -@@ -2066,7 +2075,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, +@@ -2066,7 +2076,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, /* Compare new line status to the old one, signal if different/ N.B. packet may be processed more than once, but differences are only processed once. */ @@ -76199,7 +100033,7 @@ index a7cb0968259e..8f4bd9fa8244 100644 if (status != priv->prev_status) { char diff_status = status ^ priv->prev_status; -@@ -2092,13 +2101,12 @@ static int ftdi_process_packet(struct usb_serial_port *port, +@@ -2092,13 +2102,12 @@ static int ftdi_process_packet(struct usb_serial_port *port, } /* save if the transmitter is empty or not */ @@ -76215,7 +100049,7 @@ index a7cb0968259e..8f4bd9fa8244 100644 return 0; /* status only */ /* -@@ -2106,40 +2114,41 @@ static int ftdi_process_packet(struct usb_serial_port *port, +@@ -2106,40 +2115,41 @@ static int ftdi_process_packet(struct usb_serial_port *port, * data payload to avoid over-reporting. */ flag = TTY_NORMAL; @@ -76270,7 +100104,7 @@ index a7cb0968259e..8f4bd9fa8244 100644 static void ftdi_process_read_urb(struct urb *urb) diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 32a40ab9a385..54ded2bc9eb6 100644 +index 32a40ab9a385..3b7cea8df446 100644 --- a/drivers/usb/serial/ftdi_sio_ids.h +++ b/drivers/usb/serial/ftdi_sio_ids.h @@ -38,6 +38,13 @@ @@ -76287,7 +100121,17 @@ index 32a40ab9a385..54ded2bc9eb6 100644 /* Sienna Serial Interface by Secyourit GmbH */ #define FTDI_SIENNA_PID 0x8348 -@@ -159,6 +166,7 @@ +@@ -151,6 +158,9 @@ + /* Vardaan Enterprises Serial Interface VEUSB422R3 */ + #define FTDI_VARDAAN_PID 0xF070 + ++/* Auto-M3 Ltd. - OP-COM USB V2 - OBD interface Adapter */ ++#define FTDI_AUTO_M3_OP_COM_V2_PID 0x4f50 ++ + /* + * Xsens Technologies BV products (http://www.xsens.com). + */ +@@ -159,6 +169,7 @@ #define XSENS_AWINDA_DONGLE_PID 0x0102 #define XSENS_MTW_PID 0x0200 /* Xsens MTw */ #define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */ @@ -76295,7 +100139,7 @@ index 32a40ab9a385..54ded2bc9eb6 100644 #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */ /* Xsens devices using FTDI VID */ -@@ -572,6 +580,7 @@ +@@ -572,6 +583,7 @@ #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ #define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */ #define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */ @@ -76303,7 +100147,7 @@ index 32a40ab9a385..54ded2bc9eb6 100644 /* * Synapse Wireless product ids (FTDI_VID) -@@ -1558,6 +1567,13 @@ +@@ -1558,6 +1570,13 @@ #define UNJO_VID 0x22B7 #define UNJO_ISODEBUG_V1_PID 0x150D @@ -76473,6 +100317,56 @@ index d57fb5199218..f3c0ad138c3e 100644 spin_unlock_irqrestore(&priv->lock, flags); return count; +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index e08755e9b612..9c825d4e564e 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2419,22 +2419,22 @@ static int keyspan_port_probe(struct usb_serial_port *port) + for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) { + p_priv->in_buffer[i] = kzalloc(IN_BUFLEN, GFP_KERNEL); + if (!p_priv->in_buffer[i]) +- goto err_in_buffer; ++ goto err_free_in_buffer; + } + + for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) { + p_priv->out_buffer[i] = kzalloc(OUT_BUFLEN, GFP_KERNEL); + if (!p_priv->out_buffer[i]) +- goto err_out_buffer; ++ goto err_free_out_buffer; + } + + p_priv->inack_buffer = kzalloc(INACK_BUFLEN, GFP_KERNEL); + if (!p_priv->inack_buffer) +- goto err_inack_buffer; ++ goto err_free_out_buffer; + + p_priv->outcont_buffer = kzalloc(OUTCONT_BUFLEN, GFP_KERNEL); + if (!p_priv->outcont_buffer) +- goto err_outcont_buffer; ++ goto err_free_inack_buffer; + + p_priv->device_details = d_details; + +@@ -2480,15 +2480,14 @@ static int keyspan_port_probe(struct usb_serial_port *port) + + return 0; + +-err_outcont_buffer: ++err_free_inack_buffer: + kfree(p_priv->inack_buffer); +-err_inack_buffer: ++err_free_out_buffer: + for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) + kfree(p_priv->out_buffer[i]); +-err_out_buffer: ++err_free_in_buffer: + for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) + kfree(p_priv->in_buffer[i]); +-err_in_buffer: + kfree(p_priv); + + return -ENOMEM; diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c index d17f7872f95a..1899190d4f5d 100644 --- a/drivers/usb/serial/keyspan_pda.c @@ -76686,10 +100580,22 @@ index 6cb45757818f..64f5765df5b6 100644 return retval; } diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c -index 14b45f3e6388..b16e37f43247 100644 +index 14b45f3e6388..1278d6ce97b9 100644 --- a/drivers/usb/serial/mos7720.c +++ b/drivers/usb/serial/mos7720.c -@@ -640,6 +640,8 @@ static void parport_mos7715_restore_state(struct parport *pp, +@@ -229,8 +229,10 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum, + int status; + + buf = kmalloc(1, GFP_KERNEL); +- if (!buf) ++ if (!buf) { ++ *data = 0; + return -ENOMEM; ++ } + + status = usb_control_msg(usbdev, pipe, request, requesttype, value, + index, buf, 1, MOS_WDR_TIMEOUT); +@@ -640,6 +642,8 @@ static void parport_mos7715_restore_state(struct parport *pp, spin_unlock(&release_lock); return; } @@ -76698,7 +100604,7 @@ index 14b45f3e6388..b16e37f43247 100644 write_parport_reg_nonblock(mos_parport, MOS7720_DCR, mos_parport->shadowDCR); write_parport_reg_nonblock(mos_parport, MOS7720_ECR, -@@ -1237,8 +1239,10 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port, +@@ -1237,8 +1241,10 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port, if (urb->transfer_buffer == NULL) { urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_ATOMIC); @@ -76711,10 +100617,26 @@ index 14b45f3e6388..b16e37f43247 100644 transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE); diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c -index 0c92252c9316..31ca5d925b36 100644 +index 0c92252c9316..579595a78257 100644 --- a/drivers/usb/serial/mos7840.c +++ b/drivers/usb/serial/mos7840.c -@@ -1362,8 +1362,10 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port, +@@ -126,7 +126,6 @@ + #define BANDB_DEVICE_ID_USOPTL4_2P 0xBC02 + #define BANDB_DEVICE_ID_USOPTL4_4 0xAC44 + #define BANDB_DEVICE_ID_USOPTL4_4P 0xBC03 +-#define BANDB_DEVICE_ID_USOPTL2_4 0xAC24 + + /* This driver also supports + * ATEN UC2324 device using Moschip MCS7840 +@@ -207,7 +206,6 @@ static const struct usb_device_id id_table[] = { + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2P)}, + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)}, + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4P)}, +- {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)}, + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)}, + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)}, + {USB_DEVICE(USB_VENDOR_ID_MOXA, MOXA_DEVICE_ID_2210)}, +@@ -1362,8 +1360,10 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port, if (urb->transfer_buffer == NULL) { urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_ATOMIC); @@ -76747,7 +100669,7 @@ index 76564b3bebb9..cc0bf59bd08d 100644 { } /* Terminating entry */ }; diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 326e7109b8f8..b9017e85cc1a 100644 +index 326e7109b8f8..9479abb9eaaa 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -241,6 +241,7 @@ static void option_instat_callback(struct urb *urb); @@ -76815,27 +100737,47 @@ index 326e7109b8f8..b9017e85cc1a 100644 { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06), -@@ -1168,6 +1181,10 @@ static const struct usb_device_id option_ids[] = { +@@ -1168,6 +1181,28 @@ static const struct usb_device_id option_ids[] = { .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff), /* Telit FN980 (ECM) */ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */ + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ ++ .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1062, 0xff), /* Telit LN920 (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1070, 0xff), /* Telit FN990 (rmnet) */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1071, 0xff), /* Telit FN990 (MBIM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1072, 0xff), /* Telit FN990 (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), -@@ -1180,6 +1197,8 @@ static const struct usb_device_id option_ids[] = { +@@ -1180,6 +1215,10 @@ static const struct usb_device_id option_ids[] = { .driver_info = NCTRL(0) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */ + .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1204, 0xff), /* Telit LE910Cx (MBIM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), -@@ -1194,6 +1213,10 @@ static const struct usb_device_id option_ids[] = { +@@ -1194,6 +1233,10 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, @@ -76846,7 +100788,7 @@ index 326e7109b8f8..b9017e85cc1a 100644 { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x1261), -@@ -1202,6 +1225,10 @@ static const struct usb_device_id option_ids[] = { +@@ -1202,8 +1245,14 @@ static const struct usb_device_id option_ids[] = { .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ .driver_info = NCTRL(0) }, @@ -76856,8 +100798,12 @@ index 326e7109b8f8..b9017e85cc1a 100644 + .driver_info = NCTRL(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ .driver_info = NCTRL(0) | ZLP }, ++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ ++ .driver_info = NCTRL(0) | ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ -@@ -1531,7 +1558,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, +@@ -1531,7 +1580,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) }, @@ -76867,7 +100813,15 @@ index 326e7109b8f8..b9017e85cc1a 100644 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) }, -@@ -1805,6 +1833,8 @@ static const struct usb_device_id option_ids[] = { +@@ -1602,7 +1652,6 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff), +@@ -1805,6 +1854,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */ .driver_info = RSVD(7) }, @@ -76876,7 +100830,7 @@ index 326e7109b8f8..b9017e85cc1a 100644 { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), -@@ -1869,12 +1899,17 @@ static const struct usb_device_id option_ids[] = { +@@ -1869,12 +1920,17 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_CLS8, 0xff), .driver_info = RSVD(0) | RSVD(4) }, @@ -76894,7 +100848,7 @@ index 326e7109b8f8..b9017e85cc1a 100644 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), .driver_info = RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), -@@ -1962,6 +1997,8 @@ static const struct usb_device_id option_ids[] = { +@@ -1962,6 +2018,8 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) }, { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, @@ -76903,18 +100857,25 @@ index 326e7109b8f8..b9017e85cc1a 100644 { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) }, { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) }, { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */ -@@ -2013,12 +2050,17 @@ static const struct usb_device_id option_ids[] = { +@@ -2013,12 +2071,24 @@ static const struct usb_device_id option_ids[] = { .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, - { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */ ++ .driver_info = RSVD(3) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ .driver_info = RSVD(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ ++ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ @@ -76922,7 +100883,7 @@ index 326e7109b8f8..b9017e85cc1a 100644 { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); -@@ -2062,6 +2104,14 @@ static struct usb_serial_driver * const serial_drivers[] = { +@@ -2062,6 +2132,14 @@ static struct usb_serial_driver * const serial_drivers[] = { module_usb_serial_driver(serial_drivers, option_ids); @@ -76937,7 +100898,7 @@ index 326e7109b8f8..b9017e85cc1a 100644 static int option_probe(struct usb_serial *serial, const struct usb_device_id *id) { -@@ -2079,7 +2129,7 @@ static int option_probe(struct usb_serial *serial, +@@ -2079,7 +2157,7 @@ static int option_probe(struct usb_serial *serial, * the same class/subclass/protocol as the serial interfaces. Look at * the Windows driver .INF files for reserved interface numbers. */ @@ -76946,7 +100907,7 @@ index 326e7109b8f8..b9017e85cc1a 100644 return -ENODEV; /* * Don't bind network interface on Samsung GT-B3730, it is handled by -@@ -2096,6 +2146,14 @@ static int option_probe(struct usb_serial *serial, +@@ -2096,6 +2174,14 @@ static int option_probe(struct usb_serial *serial, return 0; } @@ -76961,7 +100922,7 @@ index 326e7109b8f8..b9017e85cc1a 100644 static int option_attach(struct usb_serial *serial) { struct usb_interface_descriptor *iface_desc; -@@ -2111,7 +2169,7 @@ static int option_attach(struct usb_serial *serial) +@@ -2111,7 +2197,7 @@ static int option_attach(struct usb_serial *serial) iface_desc = &serial->interface->cur_altsetting->desc; @@ -77011,7 +100972,7 @@ index 54d2fb974a41..62b8cd673aa1 100644 /* SMART USB Serial Adapter */ #define SMART_VENDOR_ID 0x0b8c diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index c59e6d4a8a61..11fb4d78e2db 100644 +index c59e6d4a8a61..f0bd6a66f551 100644 --- a/drivers/usb/serial/qcserial.c +++ b/drivers/usb/serial/qcserial.c @@ -159,6 +159,7 @@ static const struct usb_device_id id_table[] = { @@ -77022,6 +100983,14 @@ index c59e6d4a8a61..11fb4d78e2db 100644 {DEVICE_SWI(0x1199, 0x9063)}, /* Sierra Wireless EM7305 */ {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx */ {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */ +@@ -168,6 +169,7 @@ static const struct usb_device_id id_table[] = { + {DEVICE_SWI(0x1199, 0x907b)}, /* Sierra Wireless EM74xx */ + {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ + {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ ++ {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c index 19952ccd028a..ba69acaa7a30 100644 --- a/drivers/usb/serial/quatech2.c @@ -77121,10 +101090,45 @@ index bb7556952a18..8378e92f7c04 100644 return 0; } diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 46079468df42..4a94effb64f7 100644 +index 46079468df42..ec2b7f5c900c 100644 --- a/drivers/usb/storage/unusual_devs.h +++ b/drivers/usb/storage/unusual_devs.h -@@ -2347,7 +2347,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114, +@@ -425,6 +425,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110, + "785EPX Storage", + USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN), + ++/* ++ * Reported by James Buren ++ * Virtual ISOs cannot be remounted if ejected while the device is locked ++ * Disable locking to mimic Windows behavior that bypasses the issue ++ */ ++UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001, ++ "iODD", ++ "2531/2541", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE), ++ + /* + * Not sure who reported this originally but + * Pavel Machek reported that the extra US_FL_SINGLE_LUN +@@ -435,9 +445,16 @@ UNUSUAL_DEV( 0x04cb, 0x0100, 0x0000, 0x2210, + USB_SC_UFI, USB_PR_DEVICE, NULL, US_FL_FIX_INQUIRY | US_FL_SINGLE_LUN), + + /* +- * Reported by Ondrej Zary ++ * Reported by Ondrej Zary + * The device reports one sector more and breaks when that sector is accessed ++ * Firmwares older than 2.6c (the latest one and the only that claims Linux ++ * support) have also broken tag handling + */ ++UNUSUAL_DEV( 0x04ce, 0x0002, 0x0000, 0x026b, ++ "ScanLogic", ++ "SL11R-IDE", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_FIX_CAPACITY | US_FL_BULK_IGNORE_TAG), + UNUSUAL_DEV( 0x04ce, 0x0002, 0x026c, 0x026c, + "ScanLogic", + "SL11R-IDE", +@@ -2347,7 +2364,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114, "JMicron", "USB to ATA/ATAPI Bridge", USB_SC_DEVICE, USB_PR_DEVICE, NULL, @@ -77325,10 +101329,43 @@ index f8f7f3803a99..01eaae1f265b 100644 wake_up(&ud->eh_waitq); } diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c -index 8bda6455dfcb..fb7b03029b8e 100644 +index 8bda6455dfcb..91ccf57759ae 100644 --- a/drivers/usb/usbip/vhci_hcd.c +++ b/drivers/usb/usbip/vhci_hcd.c -@@ -907,6 +907,7 @@ static void vhci_device_init(struct vhci_device *vdev) +@@ -762,8 +762,32 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev) + spin_lock(&vdev->priv_lock); + + list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) { ++ struct urb *urb; ++ ++ /* give back urb of unsent unlink request */ + pr_info("unlink cleanup tx %lu\n", unlink->unlink_seqnum); ++ ++ urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum); ++ if (!urb) { ++ list_del(&unlink->list); ++ kfree(unlink); ++ continue; ++ } ++ ++ urb->status = -ENODEV; ++ ++ usb_hcd_unlink_urb_from_ep(hcd, urb); ++ + list_del(&unlink->list); ++ ++ spin_unlock(&vdev->priv_lock); ++ spin_unlock_irqrestore(&vhci->lock, flags); ++ ++ usb_hcd_giveback_urb(hcd, urb, urb->status); ++ ++ spin_lock_irqsave(&vhci->lock, flags); ++ spin_lock(&vdev->priv_lock); ++ + kfree(unlink); + } + +@@ -907,6 +931,7 @@ static void vhci_device_init(struct vhci_device *vdev) vdev->ud.side = USBIP_VHCI; vdev->ud.status = VDEV_ST_NULL; spin_lock_init(&vdev->ud.lock); @@ -77601,6 +101638,19 @@ index 7efa374a4970..0a4482ced945 100644 return ret; } +diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig +index 06cd48d59258..00a1f0342da1 100644 +--- a/drivers/vfio/Kconfig ++++ b/drivers/vfio/Kconfig +@@ -30,7 +30,7 @@ menuconfig VFIO + + If you don't know what to do here, say N. + +-menuconfig VFIO_NOIOMMU ++config VFIO_NOIOMMU + bool "VFIO No-IOMMU support" + depends on VFIO + help diff --git a/drivers/vfio/pci/Kconfig b/drivers/vfio/pci/Kconfig index 24ee2605b9f0..0da884bfc7a8 100644 --- a/drivers/vfio/pci/Kconfig @@ -78573,7 +102623,7 @@ index 861f43f8f9ce..66663757cd70 100644 % UIO_MAXIOV; } diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index b14e62f11075..d2431afeda84 100644 +index b14e62f11075..62c61a283b35 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -306,8 +306,8 @@ static void vhost_vq_reset(struct vhost_dev *dev, @@ -78586,8 +102636,27 @@ index b14e62f11075..d2431afeda84 100644 vq->busyloop_timeout = 0; vq->umem = NULL; vq->iotlb = NULL; +@@ -675,10 +675,16 @@ static int log_access_ok(void __user *log_base, u64 addr, unsigned long sz) + (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); + } + ++/* Make sure 64 bit math will not overflow. */ + static bool vhost_overflow(u64 uaddr, u64 size) + { +- /* Make sure 64 bit math will not overflow. */ +- return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size; ++ if (uaddr > ULONG_MAX || size > ULONG_MAX) ++ return true; ++ ++ if (!size) ++ return false; ++ ++ return uaddr > ULONG_MAX - size + 1; + } + + /* Caller should have vq mutex and device mutex. */ diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c -index 3bb02c60a2f5..d56736655dec 100644 +index 3bb02c60a2f5..da47542496cc 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -272,13 +272,14 @@ __vringh_iov(struct vringh *vrh, u16 i, @@ -78609,6 +102678,28 @@ index 3bb02c60a2f5..d56736655dec 100644 for (;;) { void *addr; +@@ -328,7 +329,7 @@ __vringh_iov(struct vringh *vrh, u16 i, + iov = wiov; + else { + iov = riov; +- if (unlikely(wiov && wiov->i)) { ++ if (unlikely(wiov && wiov->used)) { + vringh_bad("Readable desc %p after writable", + &descs[i]); + err = -EINVAL; +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 2ac966400c42..e282e8174a5d 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -406,7 +406,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) + else + virtio_transport_free_pkt(pkt); + +- vhost_add_used(vq, head, sizeof(pkt->hdr) + len); ++ vhost_add_used(vq, head, 0); + added = true; + } + diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c index 1771220b2437..90a24b975240 100644 --- a/drivers/video/backlight/lm3630a_bl.c @@ -79661,6 +103752,30 @@ index e3b9521e4ec3..1a3a2f1d9817 100644 } static struct gio_device_id newport_ids[] = { +diff --git a/drivers/video/console/sticon.c b/drivers/video/console/sticon.c +index 3a10ac19598f..8827e0ec5995 100644 +--- a/drivers/video/console/sticon.c ++++ b/drivers/video/console/sticon.c +@@ -290,13 +290,13 @@ static unsigned long sticon_getxy(struct vc_data *conp, unsigned long pos, + static u8 sticon_build_attr(struct vc_data *conp, u8 color, u8 intens, + u8 blink, u8 underline, u8 reverse, u8 italic) + { +- u8 attr = ((color & 0x70) >> 1) | ((color & 7)); ++ u8 fg = color & 7; ++ u8 bg = (color & 0x70) >> 4; + +- if (reverse) { +- color = ((color >> 3) & 0x7) | ((color & 0x7) << 3); +- } +- +- return attr; ++ if (reverse) ++ return (fg << 3) | bg; ++ else ++ return (bg << 3) | fg; + } + + static void sticon_invert_region(struct vc_data *conp, u16 *p, int count) diff --git a/drivers/video/console/tileblit.c b/drivers/video/console/tileblit.c index 15e8e1a89c45..691717276c3e 100644 --- a/drivers/video/console/tileblit.c @@ -79683,7 +103798,7 @@ index 15e8e1a89c45..691717276c3e 100644 struct fb_tilecursor cursor; int use_sw = (vc->vc_cursor_type & 0x10); diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c -index 42c0a26646f6..cb9b87963129 100644 +index 42c0a26646f6..6c5c7d45d9f6 100644 --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -179,153 +179,6 @@ static inline void vga_set_mem_top(struct vc_data *c) @@ -79860,16 +103975,37 @@ index 42c0a26646f6..cb9b87963129 100644 return display_desc; } -@@ -585,7 +434,7 @@ static void vgacon_init(struct vc_data *c, int init) +@@ -571,11 +420,17 @@ static void vgacon_init(struct vc_data *c, int init) + struct uni_pagedir *p; + + /* +- * We cannot be loaded as a module, therefore init is always 1, +- * but vgacon_init can be called more than once, and init will +- * not be 1. ++ * We cannot be loaded as a module, therefore init will be 1 ++ * if we are the default console, however if we are a fallback ++ * console, for example if fbcon has failed registration, then ++ * init will be 0, so we need to make sure our boot parameters ++ * have been copied to the console structure for vgacon_resize ++ * ultimately called by vc_resize. Any subsequent calls to ++ * vgacon_init init will have init set to 0 too. + */ + c->vc_can_do_color = vga_can_do_color; ++ c->vc_scan_lines = vga_scan_lines; ++ c->vc_font.height = c->vc_cell_height = vga_video_font_height; + + /* set dimensions manually if init != 0 since vc_resize() will fail */ + if (init) { +@@ -584,8 +439,6 @@ static void vgacon_init(struct vc_data *c, int init) + } else vc_resize(c, vga_video_num_columns, vga_video_num_lines); - c->vc_scan_lines = vga_scan_lines; +- c->vc_scan_lines = vga_scan_lines; - c->vc_font.height = vga_video_font_height; -+ c->vc_font.height = c->vc_cell_height = vga_video_font_height; c->vc_complement_mask = 0x7700; if (vga_512_chars) c->vc_hi_font_mask = 0x0800; -@@ -723,32 +572,32 @@ static void vgacon_cursor(struct vc_data *c, int mode) +@@ -723,32 +576,32 @@ static void vgacon_cursor(struct vc_data *c, int mode) switch (c->vc_cursor_type & 0x0f) { case CUR_UNDERLINE: vgacon_set_cursor_size(c->vc_x, @@ -79915,7 +104051,7 @@ index 42c0a26646f6..cb9b87963129 100644 10 ? 1 : 2)); break; case CUR_NONE: -@@ -759,7 +608,7 @@ static void vgacon_cursor(struct vc_data *c, int mode) +@@ -759,7 +612,7 @@ static void vgacon_cursor(struct vc_data *c, int mode) break; default: vgacon_set_cursor_size(c->vc_x, 1, @@ -79924,7 +104060,7 @@ index 42c0a26646f6..cb9b87963129 100644 break; } break; -@@ -770,13 +619,13 @@ static int vgacon_doresize(struct vc_data *c, +@@ -770,13 +623,13 @@ static int vgacon_doresize(struct vc_data *c, unsigned int width, unsigned int height) { unsigned long flags; @@ -79940,7 +104076,7 @@ index 42c0a26646f6..cb9b87963129 100644 if (vga_video_type >= VIDEO_TYPE_VGAC) { outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg); max_scan = inb_p(vga_video_port_val); -@@ -831,9 +680,9 @@ static int vgacon_doresize(struct vc_data *c, +@@ -831,9 +684,9 @@ static int vgacon_doresize(struct vc_data *c, static int vgacon_switch(struct vc_data *c) { int x = c->vc_cols * VGA_FONTWIDTH; @@ -79952,7 +104088,7 @@ index 42c0a26646f6..cb9b87963129 100644 /* * We need to save screen size here as it's the only way * we can spot the screen has been resized and we need to -@@ -857,7 +706,6 @@ static int vgacon_switch(struct vc_data *c) +@@ -857,7 +710,6 @@ static int vgacon_switch(struct vc_data *c) vgacon_doresize(c, c->vc_cols, c->vc_rows); } @@ -79960,7 +104096,7 @@ index 42c0a26646f6..cb9b87963129 100644 return 0; /* Redrawing not needed */ } -@@ -1272,7 +1120,7 @@ static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight) +@@ -1272,7 +1124,7 @@ static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight) cursor_size_lastto = 0; c->vc_sw->con_cursor(c, CM_DRAW); } @@ -79969,7 +104105,7 @@ index 42c0a26646f6..cb9b87963129 100644 vc_resize(c, 0, rows); /* Adjust console size */ } } -@@ -1326,12 +1174,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width, +@@ -1326,12 +1178,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width, if ((width << 1) * height > vga_vram_size) return -EINVAL; @@ -79994,7 +104130,7 @@ index 42c0a26646f6..cb9b87963129 100644 if (con_is_visible(c) && !vga_is_gfx) /* who knows */ vgacon_doresize(c, width, height); -@@ -1387,7 +1243,6 @@ static int vgacon_scroll(struct vc_data *c, int t, int b, int dir, +@@ -1387,7 +1247,6 @@ static int vgacon_scroll(struct vc_data *c, int t, int b, int dir, oldo = c->vc_origin; delta = lines * c->vc_size_row; if (dir == SM_UP) { @@ -80022,6 +104158,33 @@ index 1809e6663b2d..b0a94c154c7b 100644 help Say Y here to support use of ATI's 64-bit Rage boards (or other boards based on the Mach64 CT, VT, GT, and LT chipsets) as a +diff --git a/drivers/video/fbdev/asiliantfb.c b/drivers/video/fbdev/asiliantfb.c +index 91eea4583382..ceb579eff1ea 100644 +--- a/drivers/video/fbdev/asiliantfb.c ++++ b/drivers/video/fbdev/asiliantfb.c +@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo *var, + { + unsigned long Ftarget, ratio, remainder; + ++ if (!var->pixclock) ++ return -EINVAL; ++ + ratio = 1000000 / var->pixclock; + remainder = 1000000 % var->pixclock; + Ftarget = 1000000 * ratio + (1000000 * remainder) / var->pixclock; +diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c +index 314b7eceb81c..84a3778552eb 100644 +--- a/drivers/video/fbdev/chipsfb.c ++++ b/drivers/video/fbdev/chipsfb.c +@@ -332,7 +332,7 @@ static struct fb_var_screeninfo chipsfb_var = { + + static void init_chips(struct fb_info *p, unsigned long addr) + { +- memset(p->screen_base, 0, 0x100000); ++ fb_memset(p->screen_base, 0, 0x100000); + + p->fix = chipsfb_fix; + p->fix.smem_start = addr; diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c index 2811c4afde01..e8ea76848104 100644 --- a/drivers/video/fbdev/core/fbcmap.c @@ -80048,6 +104211,42 @@ index 2811c4afde01..e8ea76848104 100644 if (!cmap->transp) goto fail; } else { +diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c +index 50c6bf9834ee..d4d4184c03c6 100644 +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + #include + +@@ -981,6 +982,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) + if ((var->activate & FB_ACTIVATE_FORCE) || + memcmp(&info->var, var, sizeof(struct fb_var_screeninfo))) { + u32 activate = var->activate; ++ u32 unused; + + /* When using FOURCC mode, make sure the red, green, blue and + * transp fields are set to 0. +@@ -1001,6 +1003,15 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) + goto done; + } + ++ /* bitfill_aligned() assumes that it's at least 8x8 */ ++ if (var->xres < 8 || var->yres < 8) ++ return -EINVAL; ++ ++ /* Too huge resolution causes multiplication overflow. */ ++ if (check_mul_overflow(var->xres, var->yres, &unused) || ++ check_mul_overflow(var->xres_virtual, var->yres_virtual, &unused)) ++ return -EINVAL; ++ + ret = info->fbops->fb_check_var(var, info); + + if (ret) diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c index 59e1cae57948..03c0b1b8747b 100644 --- a/drivers/video/fbdev/hgafb.c @@ -80132,6 +104331,32 @@ index 4ef9dc94e813..4363c64d74e8 100644 info->fix.mmio_start = addr + 0x800000; par->dc_regs = ioremap(addr + 0x800000, 0x1000); par->cmap_regs_phys = addr + 0x840000; +diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c +index f77478fb3d14..0b844f6d8a30 100644 +--- a/drivers/video/fbdev/kyro/fbdev.c ++++ b/drivers/video/fbdev/kyro/fbdev.c +@@ -372,6 +372,11 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 ulWidth, u32 ulHeight + /* probably haven't called CreateOverlay yet */ + return -EINVAL; + ++ if (ulWidth == 0 || ulWidth == 0xffffffff || ++ ulHeight == 0 || ulHeight == 0xffffffff || ++ (x < 2 && ulWidth + 2 == 0)) ++ return -EINVAL; ++ + /* Stop Ramdac Output */ + DisableRamdacOutput(deviceInfo.pSTGReg); + +@@ -394,6 +399,9 @@ static int kyrofb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) + { + struct kyrofb_info *par = info->par; + ++ if (!var->pixclock) ++ return -EINVAL; ++ + if (var->bits_per_pixel != 16 && var->bits_per_pixel != 32) { + printk(KERN_WARNING "kyrofb: depth not supported: %u\n", var->bits_per_pixel); + return -EINVAL; diff --git a/drivers/video/fbdev/msm/mdp3_ctrl.c b/drivers/video/fbdev/msm/mdp3_ctrl.c index 55da18f8b6b0..87050de57669 100644 --- a/drivers/video/fbdev/msm/mdp3_ctrl.c @@ -80346,6 +104571,20 @@ index 8503310a3816..7f8b6af29aab 100644 iounmap(fbi->mmio_base); +diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c +index 2ef26ad99341..69f3acd405c5 100644 +--- a/drivers/video/fbdev/riva/fbdev.c ++++ b/drivers/video/fbdev/riva/fbdev.c +@@ -1088,6 +1088,9 @@ static int rivafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) + int mode_valid = 0; + + NVTRACE_ENTER(); ++ if (!var->pixclock) ++ return -EINVAL; ++ + switch (var->bits_per_pixel) { + case 1 ... 8: + var->red.offset = var->green.offset = var->blue.offset = 0; diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c index dfe3eb769638..fde27feae5d0 100644 --- a/drivers/video/fbdev/sis/init.c @@ -80537,7 +104776,7 @@ index 732e9abdcf96..29b968003525 100644 if (!ret) diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index e459cd7302e2..5cad9f41c238 100644 +index e459cd7302e2..cf7eccfe3469 100644 --- a/drivers/virtio/virtio_ring.c +++ b/drivers/virtio/virtio_ring.c @@ -785,6 +785,9 @@ bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx) @@ -80550,6 +104789,26 @@ index e459cd7302e2..5cad9f41c238 100644 virtio_mb(vq->weak_barriers); return (u16)last_used_idx != virtio16_to_cpu(_vq->vdev, vq->vring.used->idx); } +@@ -1147,7 +1150,7 @@ bool virtqueue_is_broken(struct virtqueue *_vq) + { + struct vring_virtqueue *vq = to_vvq(_vq); + +- return vq->broken; ++ return READ_ONCE(vq->broken); + } + EXPORT_SYMBOL_GPL(virtqueue_is_broken); + +@@ -1161,7 +1164,9 @@ void virtio_break_device(struct virtio_device *dev) + + list_for_each_entry(_vq, &dev->vqs, list) { + struct vring_virtqueue *vq = to_vvq(_vq); +- vq->broken = true; ++ ++ /* Pairs with READ_ONCE() in virtqueue_is_broken(). */ ++ WRITE_ONCE(vq->broken, true); + } + } + EXPORT_SYMBOL_GPL(virtio_break_device); diff --git a/drivers/w1/masters/mxc_w1.c b/drivers/w1/masters/mxc_w1.c index dacb5919970c..d2e9d2f6a784 100644 --- a/drivers/w1/masters/mxc_w1.c @@ -80690,10 +104949,29 @@ index daeb645fcea8..519419136ce8 100644 return regmap_update_bits(chip->regmap, DA9062AA_CONTROL_D, diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c -index 88cd2a52d8d3..ae4974701e5c 100644 +index 88cd2a52d8d3..6fe9daf2367b 100644 --- a/drivers/watchdog/f71808e_wdt.c +++ b/drivers/watchdog/f71808e_wdt.c -@@ -688,9 +688,9 @@ static int __init watchdog_init(int sioaddr) +@@ -237,15 +237,17 @@ static int watchdog_set_timeout(int timeout) + + mutex_lock(&watchdog.lock); + +- watchdog.timeout = timeout; + if (timeout > 0xff) { + watchdog.timer_val = DIV_ROUND_UP(timeout, 60); + watchdog.minutes_mode = true; ++ timeout = watchdog.timer_val * 60; + } else { + watchdog.timer_val = timeout; + watchdog.minutes_mode = false; + } + ++ watchdog.timeout = timeout; ++ + mutex_unlock(&watchdog.lock); + + return 0; +@@ -688,9 +690,9 @@ static int __init watchdog_init(int sioaddr) * into the module have been registered yet. */ watchdog.sioaddr = sioaddr; @@ -80706,7 +104984,7 @@ index 88cd2a52d8d3..ae4974701e5c 100644 snprintf(watchdog.ident.identity, sizeof(watchdog.ident.identity), "%s watchdog", -@@ -704,6 +704,13 @@ static int __init watchdog_init(int sioaddr) +@@ -704,6 +706,13 @@ static int __init watchdog_init(int sioaddr) wdt_conf = superio_inb(sioaddr, F71808FG_REG_WDT_CONF); watchdog.caused_reboot = wdt_conf & BIT(F71808FG_FLAG_WDTMOUT_STS); @@ -80733,6 +105011,24 @@ index fd171e6caa16..1b63d1d85aa0 100644 watchdog_unregister_device(&lpc18xx_wdt->wdt_dev); clk_disable_unprepare(lpc18xx_wdt->wdt_clk); +diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c +index 1b02bfa81b29..40c006ee8492 100644 +--- a/drivers/watchdog/omap_wdt.c ++++ b/drivers/watchdog/omap_wdt.c +@@ -271,8 +271,12 @@ static int omap_wdt_probe(struct platform_device *pdev) + wdev->wdog.bootstatus = WDIOF_CARDRESET; + } + +- if (!early_enable) ++ if (early_enable) { ++ omap_wdt_start(&wdev->wdog); ++ set_bit(WDOG_HW_RUNNING, &wdev->wdog.status); ++ } else { + omap_wdt_disable(wdev); ++ } + + ret = watchdog_register_device(&wdev->wdog); + if (ret) { diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c index 4f47b5e90956..8b88824a88dc 100644 --- a/drivers/watchdog/qcom-wdt.c @@ -80935,7 +105231,7 @@ index bdff01095f54..ec3417a9e1a4 100644 void __init xen_evtchn_2l_init(void) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index 4b0cc9d0ca53..c6e6b7470cbf 100644 +index 4b0cc9d0ca53..fbb6a4701ea3 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -32,6 +32,10 @@ @@ -81004,20 +105300,55 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 static void enable_dynirq(struct irq_data *data); static void disable_dynirq(struct irq_data *data); +-static void clear_evtchn_to_irq_row(unsigned row) +static DEFINE_PER_CPU(unsigned int, irq_epoch); + - static void clear_evtchn_to_irq_row(unsigned row) ++static void clear_evtchn_to_irq_row(int *evtchn_row) { unsigned col; for (col = 0; col < EVTCHN_PER_ROW; col++) - evtchn_to_irq[row][col] = -1; -+ WRITE_ONCE(evtchn_to_irq[row][col], -1); ++ WRITE_ONCE(evtchn_row[col], -1); } static void clear_evtchn_to_irq_all(void) -@@ -139,7 +176,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) - clear_evtchn_to_irq_row(row); +@@ -112,7 +149,7 @@ static void clear_evtchn_to_irq_all(void) + for (row = 0; row < EVTCHN_ROW(xen_evtchn_max_channels()); row++) { + if (evtchn_to_irq[row] == NULL) + continue; +- clear_evtchn_to_irq_row(row); ++ clear_evtchn_to_irq_row(evtchn_to_irq[row]); + } + } + +@@ -120,6 +157,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) + { + unsigned row; + unsigned col; ++ int *evtchn_row; + + if (evtchn >= xen_evtchn_max_channels()) + return -EINVAL; +@@ -132,14 +170,21 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) + if (irq == -1) + return 0; + +- evtchn_to_irq[row] = (int *)get_zeroed_page(GFP_KERNEL); +- if (evtchn_to_irq[row] == NULL) ++ evtchn_row = (int *) __get_free_pages(GFP_KERNEL, 0); ++ if (evtchn_row == NULL) + return -ENOMEM; + +- clear_evtchn_to_irq_row(row); ++ clear_evtchn_to_irq_row(evtchn_row); ++ ++ /* ++ * We've prepared an empty row for the mapping. If a different ++ * thread was faster inserting it, we can drop ours. ++ */ ++ if (cmpxchg(&evtchn_to_irq[row], NULL, evtchn_row) != NULL) ++ free_page((unsigned long) evtchn_row); } - evtchn_to_irq[row][col] = irq; @@ -81025,7 +105356,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 return 0; } -@@ -149,13 +186,24 @@ int get_evtchn_to_irq(unsigned evtchn) +@@ -149,13 +194,24 @@ int get_evtchn_to_irq(unsigned evtchn) return -1; if (evtchn_to_irq[EVTCHN_ROW(evtchn)] == NULL) return -1; @@ -81052,7 +105383,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 } /* Constructors for packed IRQ information. */ -@@ -173,6 +221,8 @@ static int xen_irq_info_common_setup(struct irq_info *info, +@@ -173,6 +229,8 @@ static int xen_irq_info_common_setup(struct irq_info *info, info->irq = irq; info->evtchn = evtchn; info->cpu = cpu; @@ -81061,7 +105392,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 ret = set_evtchn_to_irq(evtchn, irq); if (ret < 0) -@@ -239,6 +289,7 @@ static int xen_irq_info_pirq_setup(unsigned irq, +@@ -239,6 +297,7 @@ static int xen_irq_info_pirq_setup(unsigned irq, static void xen_irq_info_cleanup(struct irq_info *info) { set_evtchn_to_irq(info->evtchn, -1); @@ -81069,7 +105400,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 info->evtchn = 0; } -@@ -247,10 +298,14 @@ static void xen_irq_info_cleanup(struct irq_info *info) +@@ -247,10 +306,14 @@ static void xen_irq_info_cleanup(struct irq_info *info) */ unsigned int evtchn_from_irq(unsigned irq) { @@ -81086,7 +105417,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 } unsigned irq_from_evtchn(unsigned int evtchn) -@@ -315,6 +370,34 @@ unsigned int cpu_from_evtchn(unsigned int evtchn) +@@ -315,6 +378,34 @@ unsigned int cpu_from_evtchn(unsigned int evtchn) return ret; } @@ -81121,7 +105452,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 #ifdef CONFIG_X86 static bool pirq_check_eoi_map(unsigned irq) { -@@ -369,9 +452,160 @@ void notify_remote_via_irq(int irq) +@@ -369,9 +460,160 @@ void notify_remote_via_irq(int irq) } EXPORT_SYMBOL_GPL(notify_remote_via_irq); @@ -81282,7 +105613,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 #ifdef CONFIG_SMP /* By default all event channels notify CPU#0. */ cpumask_copy(irq_get_affinity_mask(irq), cpumask_of(0)); -@@ -384,8 +618,9 @@ static void xen_irq_init(unsigned irq) +@@ -384,8 +626,9 @@ static void xen_irq_init(unsigned irq) info->type = IRQT_UNBOUND; info->refcnt = -1; @@ -81293,7 +105624,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 list_add_tail(&info->list, &xen_irq_list_head); } -@@ -433,17 +668,25 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) +@@ -433,17 +676,25 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) static void xen_free_irq(unsigned irq) { @@ -81321,7 +105652,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 kfree(info); /* Legacy IRQ descriptors are managed by the arch. */ -@@ -462,6 +705,12 @@ static void xen_evtchn_close(unsigned int port) +@@ -462,6 +713,12 @@ static void xen_evtchn_close(unsigned int port) BUG(); } @@ -81334,7 +105665,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 static void pirq_query_unmask(int irq) { struct physdev_irq_status_query irq_status; -@@ -480,7 +729,8 @@ static void pirq_query_unmask(int irq) +@@ -480,7 +737,8 @@ static void pirq_query_unmask(int irq) static void eoi_pirq(struct irq_data *data) { @@ -81344,7 +105675,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) }; int rc = 0; -@@ -489,16 +739,15 @@ static void eoi_pirq(struct irq_data *data) +@@ -489,16 +747,15 @@ static void eoi_pirq(struct irq_data *data) if (unlikely(irqd_is_setaffinity_pending(data)) && likely(!irqd_irq_disabled(data))) { @@ -81365,7 +105696,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 if (pirq_needs_eoi(data->irq)) { rc = HYPERVISOR_physdev_op(PHYSDEVOP_eoi, &eoi); -@@ -549,7 +798,8 @@ static unsigned int __startup_pirq(unsigned int irq) +@@ -549,7 +806,8 @@ static unsigned int __startup_pirq(unsigned int irq) goto err; out: @@ -81375,7 +105706,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 eoi_pirq(irq_get_irq_data(irq)); return 0; -@@ -576,7 +826,7 @@ static void shutdown_pirq(struct irq_data *data) +@@ -576,7 +834,7 @@ static void shutdown_pirq(struct irq_data *data) if (!VALID_EVTCHN(evtchn)) return; @@ -81384,7 +105715,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 xen_evtchn_close(evtchn); xen_irq_info_cleanup(info); } -@@ -610,7 +860,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); +@@ -610,7 +868,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); static void __unbind_from_irq(unsigned int irq) { int evtchn = evtchn_from_irq(irq); @@ -81393,7 +105724,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 if (info->refcnt > 0) { info->refcnt--; -@@ -835,7 +1085,7 @@ int xen_pirq_from_irq(unsigned irq) +@@ -835,7 +1093,7 @@ int xen_pirq_from_irq(unsigned irq) } EXPORT_SYMBOL_GPL(xen_pirq_from_irq); @@ -81402,7 +105733,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 { int irq; int ret; -@@ -852,7 +1102,7 @@ int bind_evtchn_to_irq(unsigned int evtchn) +@@ -852,7 +1110,7 @@ int bind_evtchn_to_irq(unsigned int evtchn) if (irq < 0) goto out; @@ -81411,7 +105742,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 handle_edge_irq, "event"); ret = xen_irq_info_evtchn_setup(irq, evtchn); -@@ -873,8 +1123,19 @@ int bind_evtchn_to_irq(unsigned int evtchn) +@@ -873,8 +1131,19 @@ int bind_evtchn_to_irq(unsigned int evtchn) return irq; } @@ -81431,7 +105762,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu) { struct evtchn_bind_ipi bind_ipi; -@@ -916,8 +1177,9 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu) +@@ -916,8 +1185,9 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu) return irq; } @@ -81443,7 +105774,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 { struct evtchn_bind_interdomain bind_interdomain; int err; -@@ -928,10 +1190,26 @@ int bind_interdomain_evtchn_to_irq(unsigned int remote_domain, +@@ -928,10 +1198,26 @@ int bind_interdomain_evtchn_to_irq(unsigned int remote_domain, err = HYPERVISOR_event_channel_op(EVTCHNOP_bind_interdomain, &bind_interdomain); @@ -81471,7 +105802,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 static int find_virq(unsigned int virq, unsigned int cpu) { struct evtchn_status status; -@@ -1027,14 +1305,15 @@ static void unbind_from_irq(unsigned int irq) +@@ -1027,14 +1313,15 @@ static void unbind_from_irq(unsigned int irq) mutex_unlock(&irq_mapping_update_lock); } @@ -81492,7 +105823,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 if (irq < 0) return irq; retval = request_irq(irq, handler, irqflags, devname, dev_id); -@@ -1045,18 +1324,38 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn, +@@ -1045,18 +1332,38 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn, return irq; } @@ -81538,7 +105869,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 if (irq < 0) return irq; -@@ -1068,8 +1367,33 @@ int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain, +@@ -1068,8 +1375,33 @@ int bind_interdomain_evtchn_to_irqhandler(unsigned int remote_domain, return irq; } @@ -81572,7 +105903,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, irq_handler_t handler, unsigned long irqflags, const char *devname, void *dev_id) -@@ -1114,7 +1438,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi, +@@ -1114,7 +1446,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi, void unbind_from_irqhandler(unsigned int irq, void *dev_id) { @@ -81581,7 +105912,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 if (WARN_ON(!info)) return; -@@ -1148,7 +1472,7 @@ int evtchn_make_refcounted(unsigned int evtchn) +@@ -1148,7 +1480,7 @@ int evtchn_make_refcounted(unsigned int evtchn) if (irq == -1) return -ENOENT; @@ -81590,7 +105921,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 if (!info) return -ENOENT; -@@ -1176,13 +1500,13 @@ int evtchn_get(unsigned int evtchn) +@@ -1176,13 +1508,13 @@ int evtchn_get(unsigned int evtchn) if (irq == -1) goto done; @@ -81606,7 +105937,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 goto done; info->refcnt++; -@@ -1221,6 +1545,56 @@ void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector) +@@ -1221,6 +1553,56 @@ void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector) notify_remote_via_irq(irq); } @@ -81663,7 +105994,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 static DEFINE_PER_CPU(unsigned, xed_nesting_count); static void __xen_evtchn_do_upcall(void) -@@ -1228,6 +1602,9 @@ static void __xen_evtchn_do_upcall(void) +@@ -1228,6 +1610,9 @@ static void __xen_evtchn_do_upcall(void) struct vcpu_info *vcpu_info = __this_cpu_read(xen_vcpu); int cpu = get_cpu(); unsigned count; @@ -81673,7 +106004,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 do { vcpu_info->evtchn_upcall_pending = 0; -@@ -1235,7 +1612,7 @@ static void __xen_evtchn_do_upcall(void) +@@ -1235,7 +1620,7 @@ static void __xen_evtchn_do_upcall(void) if (__this_cpu_inc_return(xed_nesting_count) - 1) goto out; @@ -81682,7 +106013,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 BUG_ON(!irqs_disabled()); -@@ -1244,6 +1621,14 @@ static void __xen_evtchn_do_upcall(void) +@@ -1244,6 +1629,14 @@ static void __xen_evtchn_do_upcall(void) } while (count != 1 || vcpu_info->evtchn_upcall_pending); out: @@ -81697,7 +106028,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 put_cpu(); } -@@ -1306,8 +1691,8 @@ void rebind_evtchn_irq(int evtchn, int irq) +@@ -1306,8 +1699,8 @@ void rebind_evtchn_irq(int evtchn, int irq) static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu) { struct evtchn_bind_vcpu bind_vcpu; @@ -81708,7 +106039,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 if (!VALID_EVTCHN(evtchn)) return -1; -@@ -1323,7 +1708,7 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu) +@@ -1323,7 +1716,7 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu) * Mask the event while changing the VCPU binding to prevent * it being delivered on an unexpected VCPU. */ @@ -81717,7 +106048,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 /* * If this fails, it usually just indicates that we're dealing with a -@@ -1333,8 +1718,7 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu) +@@ -1333,8 +1726,7 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu) if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0) bind_evtchn_to_cpu(evtchn, tcpu); @@ -81727,7 +106058,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 return 0; } -@@ -1349,39 +1733,41 @@ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest, +@@ -1349,39 +1741,41 @@ static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest, static void enable_dynirq(struct irq_data *data) { @@ -81779,7 +106110,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 } static void mask_ack_dynirq(struct irq_data *data) -@@ -1390,18 +1776,51 @@ static void mask_ack_dynirq(struct irq_data *data) +@@ -1390,18 +1784,51 @@ static void mask_ack_dynirq(struct irq_data *data) ack_dynirq(data); } @@ -81836,7 +106167,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 return 1; } -@@ -1496,10 +1915,11 @@ static void restore_cpu_ipis(unsigned int cpu) +@@ -1496,10 +1923,11 @@ static void restore_cpu_ipis(unsigned int cpu) /* Clear an irq's pending state, in preparation for polling on it */ void xen_clear_irq_pending(int irq) { @@ -81850,7 +106181,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 } EXPORT_SYMBOL(xen_clear_irq_pending); void xen_set_irq_pending(int irq) -@@ -1600,6 +2020,21 @@ static struct irq_chip xen_dynamic_chip __read_mostly = { +@@ -1600,6 +2028,21 @@ static struct irq_chip xen_dynamic_chip __read_mostly = { .irq_retrigger = retrigger_dynirq, }; @@ -81872,7 +106203,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 static struct irq_chip xen_pirq_chip __read_mostly = { .name = "xen-pirq", -@@ -1667,12 +2102,31 @@ void xen_callback_vector(void) +@@ -1667,12 +2110,31 @@ void xen_callback_vector(void) void xen_callback_vector(void) {} #endif @@ -81907,7 +106238,7 @@ index 4b0cc9d0ca53..c6e6b7470cbf 100644 void __init xen_init_IRQ(void) { int ret = -EINVAL; -@@ -1682,6 +2136,12 @@ void __init xen_init_IRQ(void) +@@ -1682,6 +2144,12 @@ void __init xen_init_IRQ(void) if (ret < 0) xen_evtchn_2l_init(); @@ -82321,6 +106652,19 @@ index 5f6b77ea34fb..128375ff80b8 100644 /* * Clear flag as we may be rescheduled on a different * cpu. +diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c +index b1a1d7de0894..daa2e89a50fa 100644 +--- a/drivers/xen/xen-pciback/conf_space_capability.c ++++ b/drivers/xen/xen-pciback/conf_space_capability.c +@@ -159,7 +159,7 @@ static void *pm_ctrl_init(struct pci_dev *dev, int offset) + } + + out: +- return ERR_PTR(err); ++ return err ? ERR_PTR(err) : NULL; + } + + static const struct config_field caplist_pm[] = { diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c index ee5ce9286d61..83d798d12400 100644 --- a/drivers/xen/xen-pciback/pci_stub.c @@ -82779,7 +107123,7 @@ index df27cefb2fa3..8bbd887ca422 100644 xenbus_dev_fatal(dev, err, "granting access to ring page"); diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c -index c2d447687e33..ba7590d75985 100644 +index c2d447687e33..d7f886dd7b55 100644 --- a/drivers/xen/xenbus/xenbus_probe.c +++ b/drivers/xen/xenbus/xenbus_probe.c @@ -137,6 +137,7 @@ static int watch_otherend(struct xenbus_device *dev) @@ -82790,6 +107134,56 @@ index c2d447687e33..ba7590d75985 100644 bus->otherend_changed, "%s/%s", dev->otherend, "state"); } +@@ -763,7 +764,7 @@ static struct notifier_block xenbus_resume_nb = { + + static int __init xenbus_init(void) + { +- int err = 0; ++ int err; + uint64_t v = 0; + xen_store_domain_type = XS_UNKNOWN; + +@@ -803,6 +804,29 @@ static int __init xenbus_init(void) + err = hvm_get_parameter(HVM_PARAM_STORE_PFN, &v); + if (err) + goto out_error; ++ /* ++ * Uninitialized hvm_params are zero and return no error. ++ * Although it is theoretically possible to have ++ * HVM_PARAM_STORE_PFN set to zero on purpose, in reality it is ++ * not zero when valid. If zero, it means that Xenstore hasn't ++ * been properly initialized. Instead of attempting to map a ++ * wrong guest physical address return error. ++ * ++ * Also recognize all bits set as an invalid value. ++ */ ++ if (!v || !~v) { ++ err = -ENOENT; ++ goto out_error; ++ } ++ /* Avoid truncation on 32-bit. */ ++#if BITS_PER_LONG == 32 ++ if (v > ULONG_MAX) { ++ pr_err("%s: cannot handle HVM_PARAM_STORE_PFN=%llx > ULONG_MAX\n", ++ __func__, v); ++ err = -EINVAL; ++ goto out_error; ++ } ++#endif + xen_store_gfn = (unsigned long)v; + xen_store_interface = + xen_remap(xen_store_gfn << XEN_PAGE_SHIFT, +@@ -831,8 +855,10 @@ static int __init xenbus_init(void) + */ + proc_mkdir("xen", NULL); + #endif ++ return 0; + + out_error: ++ xen_store_domain_type = XS_UNKNOWN; + return err; + } + diff --git a/drivers/xen/xenbus/xenbus_probe.h b/drivers/xen/xenbus/xenbus_probe.h index c9ec7ca1f7ab..2c394c6ba605 100644 --- a/drivers/xen/xenbus/xenbus_probe.h @@ -83185,6 +107579,38 @@ index 80e9c18ea64f..fd6b67c40d9d 100644 help Btrfs is a general purpose copy-on-write filesystem with extents, +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index 5456937836b8..033cb85ce9b5 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -283,6 +283,13 @@ static void run_ordered_work(struct __btrfs_workqueue *wq, + ordered_list); + if (!test_bit(WORK_DONE_BIT, &work->flags)) + break; ++ /* ++ * Orders all subsequent loads after reading WORK_DONE_BIT, ++ * paired with the smp_mb__before_atomic in btrfs_work_helper ++ * this guarantees that the ordered function will see all ++ * updates from ordinary work function. ++ */ ++ smp_rmb(); + + /* + * we are going to call the ordered done function, but +@@ -368,6 +375,13 @@ static void normal_work_helper(struct btrfs_work *work) + thresh_exec_hook(wq); + work->func(work); + if (need_order) { ++ /* ++ * Ensures all memory accesses done in the work function are ++ * ordered before setting the WORK_DONE_BIT. Ensuring the thread ++ * which is going to executed the ordered work sees them. ++ * Pairs with the smp_rmb in run_ordered_work. ++ */ ++ smp_mb__before_atomic(); + set_bit(WORK_DONE_BIT, &work->flags); + run_ordered_work(wq, work); + } diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c index 2973d256bb44..bb008ac507fe 100644 --- a/fs/btrfs/backref.c @@ -83197,6 +107623,19 @@ index 2973d256bb44..bb008ac507fe 100644 return ret; } node = ulist_next(tmp, &uiter); +diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c +index d4d8b7e36b2f..2534e44cfd40 100644 +--- a/fs/btrfs/compression.c ++++ b/fs/btrfs/compression.c +@@ -290,7 +290,7 @@ static void end_compressed_bio_write(struct bio *bio) + cb->start, + cb->start + cb->len - 1, + NULL, +- bio->bi_error ? 0 : 1); ++ !cb->errors); + cb->compressed_pages[0]->mapping = NULL; + + end_compressed_writeback(inode, cb); diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c index b5ebb43b1824..cad06c60ad66 100644 --- a/fs/btrfs/ctree.c @@ -83741,18 +108180,9 @@ index a84a1ceb260a..f74cb39a64e5 100644 if (right_info && !right_info->bitmap) { diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 250c8403ec67..a55d23a73cdb 100644 +index 250c8403ec67..26866785e1c7 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c -@@ -484,7 +484,7 @@ static noinline void compress_file_range(struct inode *inode, - * inode has not been flagged as nocompress. This flag can - * change at any time if we discover bad compression ratios. - */ -- if (inode_need_compress(inode)) { -+ if (nr_pages > 1 && inode_need_compress(inode)) { - WARN_ON(pages); - pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS); - if (!pages) { @@ -947,7 +947,7 @@ static noinline int cow_file_range(struct inode *inode, u64 alloc_hint = 0; u64 num_bytes; @@ -83956,6 +108386,23 @@ index 250c8403ec67..a55d23a73cdb 100644 btrfs_bio = btrfs_io_bio(io_bio); btrfs_bio->logical = file_offset; +@@ -9591,8 +9632,14 @@ static int btrfs_rename_exchange(struct inode *old_dir, + bool root_log_pinned = false; + bool dest_log_pinned = false; + +- /* we only allow rename subvolume link between subvolumes */ +- if (old_ino != BTRFS_FIRST_FREE_OBJECTID && root != dest) ++ /* ++ * For non-subvolumes allow exchange only within one subvolume, in the ++ * same inode namespace. Two subvolumes (represented as directory) can ++ * be exchanged as they're a logical link and have a fixed inode number. ++ */ ++ if (root != dest && ++ (old_ino != BTRFS_FIRST_FREE_OBJECTID || ++ new_ino != BTRFS_FIRST_FREE_OBJECTID)) + return -EXDEV; + + /* close the race window with snapshot create/destroy ioctl */ diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index eefe103c65da..cb6e1ce1e25f 100644 --- a/fs/btrfs/ioctl.c @@ -84500,7 +108947,7 @@ index 31df020634cd..d0fbe49420fc 100644 ret = btrfs_defrag_leaves(trans, root); diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index f79682937faf..11ecd798864c 100644 +index f79682937faf..cc91b0c564a3 100644 --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -1529,6 +1529,7 @@ static noinline int fixup_inode_link_counts(struct btrfs_trans_handle *trans, @@ -84553,7 +109000,18 @@ index f79682937faf..11ecd798864c 100644 } iput(inode); -@@ -3191,11 +3190,13 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans, +@@ -2226,7 +2225,9 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans, + else { + ret = find_dir_range(log, path, dirid, key_type, + &range_start, &range_end); +- if (ret != 0) ++ if (ret < 0) ++ goto out; ++ else if (ret > 0) + break; + } + +@@ -3191,11 +3192,13 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans, btrfs_free_path(path); out_unlock: mutex_unlock(&BTRFS_I(dir)->log_mutex); @@ -84571,7 +109029,7 @@ index f79682937faf..11ecd798864c 100644 btrfs_end_log_trans(root); -@@ -3355,6 +3356,7 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, +@@ -3355,6 +3358,7 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, * search and this search we'll not find the key again and can just * bail. */ @@ -84579,7 +109037,7 @@ index f79682937faf..11ecd798864c 100644 ret = btrfs_search_slot(NULL, root, &min_key, path, 0, 0); if (ret != 0) goto done; -@@ -3374,6 +3376,13 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, +@@ -3374,6 +3378,13 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, if (min_key.objectid != ino || min_key.type != key_type) goto done; @@ -84593,7 +109051,7 @@ index f79682937faf..11ecd798864c 100644 ret = overwrite_item(trans, log, dst_path, src, i, &min_key); if (ret) { -@@ -3755,11 +3764,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, +@@ -3755,11 +3766,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, log->fs_info->csum_root, ds + cs, ds + cs + cl - 1, &ordered_sums, 0); @@ -84607,7 +109065,7 @@ index f79682937faf..11ecd798864c 100644 } } } -@@ -3772,7 +3778,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, +@@ -3772,7 +3780,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, * we have to do this after the loop above to avoid changing the * log tree while trying to change the log tree. */ @@ -84802,7 +109260,7 @@ index 546d643b09d4..72ff09d0438c 100644 sigset_t oldset; diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index e11aacb35d6b..0eb2ada032c7 100644 +index e11aacb35d6b..839bccbcc9d6 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -927,12 +927,19 @@ void __ceph_remove_cap(struct ceph_cap *cap, bool queue_release) @@ -84827,7 +109285,14 @@ index e11aacb35d6b..0eb2ada032c7 100644 /* remove from inode's cap rbtree, and clear auth cap */ rb_erase(&cap->ci_node, &ci->i_caps); if (ci->i_auth_cap == cap) -@@ -1570,6 +1577,7 @@ static int try_nonblocking_invalidate(struct inode *inode) +@@ -1565,11 +1572,14 @@ static int __mark_caps_flushing(struct inode *inode, + * try to invalidate mapping pages without blocking. + */ + static int try_nonblocking_invalidate(struct inode *inode) ++ __releases(ci->i_ceph_lock) ++ __acquires(ci->i_ceph_lock) + { + struct ceph_inode_info *ci = ceph_inode(inode); u32 invalidating_gen = ci->i_rdcache_gen; spin_unlock(&ci->i_ceph_lock); @@ -84835,7 +109300,7 @@ index e11aacb35d6b..0eb2ada032c7 100644 invalidate_mapping_pages(&inode->i_data, 0, -1); spin_lock(&ci->i_ceph_lock); -@@ -1807,12 +1815,24 @@ void ceph_check_caps(struct ceph_inode_info *ci, int flags, +@@ -1807,12 +1817,24 @@ void ceph_check_caps(struct ceph_inode_info *ci, int flags, if (mutex_trylock(&session->s_mutex) == 0) { dout("inverting session/ino locks on %p\n", session); @@ -84966,10 +109431,27 @@ index a3b56544c21b..ae1f2817bd6a 100644 } diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c -index 211ac472cb9d..942874257a09 100644 +index 211ac472cb9d..e5e780145728 100644 --- a/fs/cifs/cifs_unicode.c +++ b/fs/cifs/cifs_unicode.c -@@ -493,7 +493,13 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, +@@ -367,14 +367,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen, + if (!dst) + return NULL; + cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage, +- NO_MAP_UNI_RSVD); ++ NO_MAP_UNI_RSVD); + } else { +- len = strnlen(src, maxlen); +- len++; +- dst = kmalloc(len, GFP_KERNEL); +- if (!dst) +- return NULL; +- strlcpy(dst, src, len); ++ dst = kstrndup(src, maxlen, GFP_KERNEL); + } + + return dst; +@@ -493,7 +488,13 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen, else if (map_chars == SFM_MAP_UNI_RSVD) { bool end_of_string; @@ -85032,7 +109514,7 @@ index 7ae21ad420fb..a12258c32e8a 100644 #define CIFS_INO_INVALID_MAPPING (4) /* pagecache is invalid */ #define CIFS_INO_LOCK (5) /* lock bit for synchronization */ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 803a7663da2a..f7e957eaa064 100644 +index 803a7663da2a..02ed9bc05aca 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -730,6 +730,8 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server) @@ -85044,7 +109526,20 @@ index 803a7663da2a..f7e957eaa064 100644 spin_lock(&GlobalMid_Lock); server->tcpStatus = CifsExiting; spin_unlock(&GlobalMid_Lock); -@@ -4213,9 +4215,12 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) +@@ -2958,9 +2960,10 @@ cifs_match_super(struct super_block *sb, void *data) + spin_lock(&cifs_tcp_ses_lock); + cifs_sb = CIFS_SB(sb); + tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb)); +- if (IS_ERR(tlink)) { ++ if (tlink == NULL) { ++ /* can not match superblock if tlink were ever null */ + spin_unlock(&cifs_tcp_ses_lock); +- return rc; ++ return 0; + } + tcon = tlink_tcon(tlink); + ses = tcon->ses; +@@ -4213,9 +4216,12 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) vol_info->retry = master_tcon->retry; vol_info->nocase = master_tcon->nocase; vol_info->local_lease = master_tcon->local_lease; @@ -85237,6 +109732,19 @@ index 5e75df69062d..bdf151e94916 100644 spin_unlock(&tcon->open_file_lock); spin_unlock(&cifs_tcp_ses_lock); +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index bb208076cb71..aeec5a896ea6 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -602,7 +602,7 @@ sess_alloc_buffer(struct sess_data *sess_data, int wct) + return 0; + + out_free_smb_buf: +- kfree(smb_buf); ++ cifs_small_buf_release(smb_buf); + sess_data->iov[0].iov_base = NULL; + sess_data->iov[0].iov_len = 0; + sess_data->buf0_type = CIFS_NO_BUFFER; diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c index 6f5d78b172ba..9a1f01c2f020 100644 --- a/fs/cifs/smb1ops.c @@ -85956,9 +110464,18 @@ index 4bcbab679afb..bb3f4be68fff 100644 } diff --git a/fs/exec.c b/fs/exec.c -index 3291665e4739..d1ccac4df9f2 100644 +index 3291665e4739..bace792e765d 100644 --- a/fs/exec.c +++ b/fs/exec.c +@@ -994,7 +994,7 @@ int kernel_read_file_from_fd(int fd, void **buf, loff_t *size, loff_t max_size, + struct fd f = fdget(fd); + int ret = -EBADF; + +- if (!f.file) ++ if (!f.file || !(f.file->f_mode & FMODE_READ)) + goto out; + + ret = kernel_read_file(f.file, buf, size, max_size, id); @@ -1021,7 +1021,7 @@ static int exec_mmap(struct mm_struct *mm) /* Notify parent that we're no longer interested in the old VM */ tsk = current; @@ -85968,6 +110485,38 @@ index 3291665e4739..d1ccac4df9f2 100644 if (old_mm) { sync_mm_rss(old_mm); +diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c +index 4c40c0786e16..bd32140bdfee 100644 +--- a/fs/ext2/balloc.c ++++ b/fs/ext2/balloc.c +@@ -46,10 +46,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb, + struct ext2_sb_info *sbi = EXT2_SB(sb); + + if (block_group >= sbi->s_groups_count) { +- ext2_error (sb, "ext2_get_group_desc", +- "block_group >= groups_count - " +- "block_group = %d, groups_count = %lu", +- block_group, sbi->s_groups_count); ++ WARN(1, "block_group >= groups_count - " ++ "block_group = %d, groups_count = %lu", ++ block_group, sbi->s_groups_count); + + return NULL; + } +@@ -57,10 +56,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb, + group_desc = block_group >> EXT2_DESC_PER_BLOCK_BITS(sb); + offset = block_group & (EXT2_DESC_PER_BLOCK(sb) - 1); + if (!sbi->s_group_desc[group_desc]) { +- ext2_error (sb, "ext2_get_group_desc", +- "Group descriptor not loaded - " +- "block_group = %d, group_desc = %lu, desc = %lu", +- block_group, group_desc, offset); ++ WARN(1, "Group descriptor not loaded - " ++ "block_group = %d, group_desc = %lu, desc = %lu", ++ block_group, group_desc, offset); + return NULL; + } + diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c index 395fc074c0db..6e1907cc1741 100644 --- a/fs/ext2/ialloc.c @@ -86143,6 +110692,37 @@ index 45c7b0f9a8e3..c50dcda7b708 100644 es->s_last_error_block = cpu_to_le64(blk); ext4_error_inode(inode, function, line, blk, "invalid block"); +diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c +index 022d67f5424f..add4e69dd3f8 100644 +--- a/fs/ext4/dir.c ++++ b/fs/ext4/dir.c +@@ -529,7 +529,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) + struct dir_private_info *info = file->private_data; + struct inode *inode = file_inode(file); + struct fname *fname; +- int ret; ++ int ret = 0; + + if (!info) { + info = ext4_htree_create_dir_info(file, ctx->pos); +@@ -577,7 +577,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) + info->curr_minor_hash, + &info->next_hash); + if (ret < 0) +- return ret; ++ goto finished; + if (ret == 0) { + ctx->pos = ext4_get_htree_eof(file); + break; +@@ -608,7 +608,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) + } + finished: + info->last_pos = ctx->pos; +- return 0; ++ return ret < 0 ? ret : 0; + } + + static int ext4_dir_open(struct inode * inode, struct file * filp) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index af727a4b4565..2cc22df451e8 100644 --- a/fs/ext4/ext4.h @@ -86530,10 +111110,23 @@ index d2844fe9040d..ff7e1ac6ee53 100644 "invalid indirect mapped " "block %lu (level %d)", diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index 7e777624072a..a410c3b6aa40 100644 +index 7e777624072a..cf8fef806816 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c -@@ -1903,6 +1903,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline) +@@ -761,6 +761,12 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, + ext4_write_lock_xattr(inode, &no_expand); + BUG_ON(!ext4_has_inline_data(inode)); + ++ /* ++ * ei->i_inline_off may have changed since ext4_write_begin() ++ * called ext4_try_to_write_inline_data() ++ */ ++ (void) ext4_find_inline_data_nolock(inode); ++ + kaddr = kmap_atomic(page); + ext4_write_inline_data(inode, &iloc, kaddr, pos, len); + kunmap_atomic(kaddr); +@@ -1903,6 +1909,7 @@ void ext4_inline_data_truncate(struct inode *inode, int *has_inline) ext4_write_lock_xattr(inode, &no_expand); if (!ext4_has_inline_data(inode)) { @@ -86968,6 +111561,92 @@ index 7e2ef060d07f..11dd089786a0 100644 error = 0; out: +diff --git a/fs/file.c b/fs/file.c +index 82d3f925bab3..0e31a66207e8 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -692,7 +692,7 @@ void do_close_on_exec(struct files_struct *files) + spin_unlock(&files->file_lock); + } + +-static struct file *__fget(unsigned int fd, fmode_t mask) ++static struct file *__fget(unsigned int fd, fmode_t mask, unsigned int refs) + { + struct files_struct *files = current->files; + struct file *file; +@@ -707,23 +707,32 @@ static struct file *__fget(unsigned int fd, fmode_t mask) + */ + if (file->f_mode & mask) + file = NULL; +- else if (!get_file_rcu(file)) ++ else if (!get_file_rcu_many(file, refs)) + goto loop; ++ else if (__fcheck_files(files, fd) != file) { ++ fput_many(file, refs); ++ goto loop; ++ } + } + rcu_read_unlock(); + + return file; + } + ++struct file *fget_many(unsigned int fd, unsigned int refs) ++{ ++ return __fget(fd, FMODE_PATH, refs); ++} ++ + struct file *fget(unsigned int fd) + { +- return __fget(fd, FMODE_PATH); ++ return __fget(fd, FMODE_PATH, 1); + } + EXPORT_SYMBOL(fget); + + struct file *fget_raw(unsigned int fd) + { +- return __fget(fd, 0); ++ return __fget(fd, 0, 1); + } + EXPORT_SYMBOL(fget_raw); + +@@ -754,7 +763,7 @@ static unsigned long __fget_light(unsigned int fd, fmode_t mask) + return 0; + return (unsigned long)file; + } else { +- file = __fget(fd, mask); ++ file = __fget(fd, mask, 1); + if (!file) + return 0; + return FDPUT_FPUT | (unsigned long)file; +diff --git a/fs/file_table.c b/fs/file_table.c +index ad17e05ebf95..747bb386b446 100644 +--- a/fs/file_table.c ++++ b/fs/file_table.c +@@ -261,9 +261,9 @@ void flush_delayed_fput(void) + + static DECLARE_DELAYED_WORK(delayed_fput_work, delayed_fput); + +-void fput(struct file *file) ++void fput_many(struct file *file, unsigned int refs) + { +- if (atomic_long_dec_and_test(&file->f_count)) { ++ if (atomic_long_sub_and_test(refs, &file->f_count)) { + struct task_struct *task = current; + + if (likely(!in_interrupt() && !(task->flags & PF_KTHREAD))) { +@@ -282,6 +282,11 @@ void fput(struct file *file) + } + } + ++void fput(struct file *file) ++{ ++ fput_many(file, 1); ++} ++ + /* + * synchronous analog of fput(); for kernel threads that might be needed + * in some umount() (and thus can't use flush_delayed_fput() without diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index 2a9e755877d4..e7815bebaeb8 100644 --- a/fs/fs-writeback.c @@ -87297,7 +111976,7 @@ index d9aba9700726..b83367300f48 100644 cuse_class = class_create(THIS_MODULE, "cuse"); if (IS_ERR(cuse_class)) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index dd77bb929ee0..5a0f089fbc47 100644 +index dd77bb929ee0..7fbf780b1c5f 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -835,7 +835,6 @@ static int fuse_check_page(struct page *page) @@ -87336,7 +112015,20 @@ index dd77bb929ee0..5a0f089fbc47 100644 } get_page(newpage); -@@ -924,14 +924,19 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) +@@ -913,6 +913,12 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) + if (!(buf->flags & PIPE_BUF_FLAG_LRU)) + lru_cache_add_file(newpage); + ++ /* ++ * Release while we have extra ref on stolen page. Otherwise ++ * anon_pipe_buf_release() might think the page can be reused. ++ */ ++ pipe_buf_release(cs->pipe, buf); ++ + err = 0; + spin_lock(&cs->req->waitq.lock); + if (test_bit(FR_ABORTED, &cs->req->flags)) +@@ -924,14 +930,19 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) if (err) { unlock_page(newpage); put_page(newpage); @@ -87358,7 +112050,7 @@ index dd77bb929ee0..5a0f089fbc47 100644 out_fallback_unlock: unlock_page(newpage); -@@ -940,10 +945,10 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) +@@ -940,10 +951,10 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) cs->offset = buf->offset; err = lock_request(cs->req); @@ -87372,7 +112064,7 @@ index dd77bb929ee0..5a0f089fbc47 100644 } static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page, -@@ -955,14 +960,16 @@ static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page, +@@ -955,14 +966,16 @@ static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page, if (cs->nr_segs == cs->pipe->buffers) return -EIO; @@ -87391,7 +112083,7 @@ index dd77bb929ee0..5a0f089fbc47 100644 buf->page = page; buf->offset = offset; buf->len = count; -@@ -1301,6 +1308,15 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, +@@ -1301,6 +1314,15 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, goto restart; } spin_lock(&fpq->lock); @@ -87407,7 +112099,7 @@ index dd77bb929ee0..5a0f089fbc47 100644 list_add(&req->list, &fpq->io); spin_unlock(&fpq->lock); cs->req = req; -@@ -1877,7 +1893,7 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud, +@@ -1877,7 +1899,7 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud, } err = -EINVAL; @@ -87416,6 +112108,34 @@ index dd77bb929ee0..5a0f089fbc47 100644 goto err_finish; spin_lock(&fpq->lock); +@@ -2043,8 +2065,12 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, + + pipe_lock(pipe); + out_free: +- for (idx = 0; idx < nbuf; idx++) +- pipe_buf_release(pipe, &bufs[idx]); ++ for (idx = 0; idx < nbuf; idx++) { ++ struct pipe_buffer *buf = &bufs[idx]; ++ ++ if (buf->ops) ++ pipe_buf_release(pipe, buf); ++ } + pipe_unlock(pipe); + + kfree(bufs); +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index a24f5a9750dd..c001698ad2cd 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -1022,7 +1022,7 @@ int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid, + if (!parent) + return -ENOENT; + +- inode_lock(parent); ++ inode_lock_nested(parent, I_MUTEX_PARENT); + if (!S_ISDIR(parent->i_mode)) + goto unlock; + diff --git a/fs/fuse/file.c b/fs/fuse/file.c index b1ee8b7a5a9b..1956f2abe211 100644 --- a/fs/fuse/file.c @@ -87459,6 +112179,62 @@ index c8d9c6620090..2a5229b73dea 100644 .async = 0, \ .file = f, \ } +diff --git a/fs/gfs2/acl.c b/fs/gfs2/acl.c +index 6fa5a66f8063..a6d962323790 100644 +--- a/fs/gfs2/acl.c ++++ b/fs/gfs2/acl.c +@@ -86,22 +86,6 @@ int __gfs2_set_acl(struct inode *inode, struct posix_acl *acl, int type) + char *data; + const char *name = gfs2_acl_name(type); + +- if (acl && acl->a_count > GFS2_ACL_MAX_ENTRIES(GFS2_SB(inode))) +- return -E2BIG; +- +- if (type == ACL_TYPE_ACCESS) { +- umode_t mode = inode->i_mode; +- struct posix_acl *old_acl = acl; +- error = posix_acl_update_mode(inode, &inode->i_mode, &acl); +- +- if (!acl) +- posix_acl_release(old_acl); +- if (error) +- return error; +- if (mode != inode->i_mode) +- mark_inode_dirty(inode); +- } +- + if (acl) { + len = posix_acl_to_xattr(&init_user_ns, acl, NULL, 0); + if (len == 0) +@@ -133,6 +117,9 @@ int gfs2_set_acl(struct inode *inode, struct posix_acl *acl, int type) + bool need_unlock = false; + int ret; + ++ if (acl && acl->a_count > GFS2_ACL_MAX_ENTRIES(GFS2_SB(inode))) ++ return -E2BIG; ++ + ret = gfs2_rsqa_alloc(ip); + if (ret) + return ret; +@@ -143,7 +130,18 @@ int gfs2_set_acl(struct inode *inode, struct posix_acl *acl, int type) + return ret; + need_unlock = true; + } ++ if (type == ACL_TYPE_ACCESS && acl) { ++ umode_t mode = inode->i_mode; ++ ++ ret = posix_acl_update_mode(inode, &inode->i_mode, &acl); ++ if (ret) ++ goto unlock; ++ if (mode != inode->i_mode) ++ mark_inode_dirty(inode); ++ } ++ + ret = __gfs2_set_acl(inode, acl, type); ++unlock: + if (need_unlock) + gfs2_glock_dq_uninit(&gh); + return ret; diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c index efd44d5645d8..3d4d35083438 100644 --- a/fs/gfs2/glock.c @@ -87490,7 +112266,7 @@ index efd44d5645d8..3d4d35083438 100644 continue; } diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c -index 3c3d037df824..3cbc9147286d 100644 +index 3c3d037df824..da9f97911852 100644 --- a/fs/gfs2/lock_dlm.c +++ b/fs/gfs2/lock_dlm.c @@ -284,7 +284,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl) @@ -87501,7 +112277,7 @@ index 3c3d037df824..3cbc9147286d 100644 int error; if (gl->gl_lksb.sb_lkid == 0) { -@@ -297,13 +296,10 @@ static void gdlm_put_lock(struct gfs2_glock *gl) +@@ -297,13 +296,15 @@ static void gdlm_put_lock(struct gfs2_glock *gl) gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT); gfs2_update_request_times(gl); @@ -87509,6 +112285,11 @@ index 3c3d037df824..3cbc9147286d 100644 - - if (gl->gl_lksb.sb_lvbptr && (gl->gl_state == LM_ST_EXCLUSIVE)) - lvb_needs_unlock = 1; ++ /* don't want to call dlm if we've unmounted the lock protocol */ ++ if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) { ++ gfs2_glock_free(gl); ++ return; ++ } + /* don't want to skip dlm_unlock writing the lvb when lock has one */ if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) && @@ -87626,6 +112407,121 @@ index 37496d83661a..ef401aecaa2c 100644 } gfs2_glock_dq_uninit(&sdp->sd_freeze_gh); +diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c +index de69d8a24f6d..7f2ef95dcd05 100644 +--- a/fs/hfs/bfind.c ++++ b/fs/hfs/bfind.c +@@ -24,7 +24,19 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) + fd->key = ptr + tree->max_key_len + 2; + hfs_dbg(BNODE_REFS, "find_init: %d (%p)\n", + tree->cnid, __builtin_return_address(0)); +- mutex_lock(&tree->tree_lock); ++ switch (tree->cnid) { ++ case HFS_CAT_CNID: ++ mutex_lock_nested(&tree->tree_lock, CATALOG_BTREE_MUTEX); ++ break; ++ case HFS_EXT_CNID: ++ mutex_lock_nested(&tree->tree_lock, EXTENTS_BTREE_MUTEX); ++ break; ++ case HFS_ATTR_CNID: ++ mutex_lock_nested(&tree->tree_lock, ATTR_BTREE_MUTEX); ++ break; ++ default: ++ return -EINVAL; ++ } + return 0; + } + +diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c +index d77d844b668b..1ff979c9d0a3 100644 +--- a/fs/hfs/bnode.c ++++ b/fs/hfs/bnode.c +@@ -14,16 +14,31 @@ + + #include "btree.h" + +-void hfs_bnode_read(struct hfs_bnode *node, void *buf, +- int off, int len) ++void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len) + { + struct page *page; ++ int pagenum; ++ int bytes_read; ++ int bytes_to_read; ++ void *vaddr; + + off += node->page_offset; +- page = node->page[0]; ++ pagenum = off >> PAGE_SHIFT; ++ off &= ~PAGE_MASK; /* compute page offset for the first page */ + +- memcpy(buf, kmap(page) + off, len); +- kunmap(page); ++ for (bytes_read = 0; bytes_read < len; bytes_read += bytes_to_read) { ++ if (pagenum >= node->tree->pages_per_bnode) ++ break; ++ page = node->page[pagenum]; ++ bytes_to_read = min_t(int, len - bytes_read, PAGE_SIZE - off); ++ ++ vaddr = kmap_atomic(page); ++ memcpy(buf + bytes_read, vaddr + off, bytes_to_read); ++ kunmap_atomic(vaddr); ++ ++ pagenum++; ++ off = 0; /* page offset only applies to the first page */ ++ } + } + + u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off) +diff --git a/fs/hfs/btree.h b/fs/hfs/btree.h +index 2715f416b5a8..308b5f1af65b 100644 +--- a/fs/hfs/btree.h ++++ b/fs/hfs/btree.h +@@ -12,6 +12,13 @@ typedef int (*btree_keycmp)(const btree_key *, const btree_key *); + + #define NODE_HASH_SIZE 256 + ++/* B-tree mutex nested subclasses */ ++enum hfs_btree_mutex_classes { ++ CATALOG_BTREE_MUTEX, ++ EXTENTS_BTREE_MUTEX, ++ ATTR_BTREE_MUTEX, ++}; ++ + /* A HFS BTree held in memory */ + struct hfs_btree { + struct super_block *sb; +diff --git a/fs/hfs/super.c b/fs/hfs/super.c +index bf6304a350a6..c2a5a0ca3948 100644 +--- a/fs/hfs/super.c ++++ b/fs/hfs/super.c +@@ -427,14 +427,12 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent) + if (!res) { + if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) { + res = -EIO; +- goto bail; ++ goto bail_hfs_find; + } + hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength); + } +- if (res) { +- hfs_find_exit(&fd); +- goto bail_no_root; +- } ++ if (res) ++ goto bail_hfs_find; + res = -EINVAL; + root_inode = hfs_iget(sb, &fd.search_key->cat, &rec); + hfs_find_exit(&fd); +@@ -450,6 +448,8 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent) + /* everything's okay */ + return 0; + ++bail_hfs_find: ++ hfs_find_exit(&fd); + bail_no_root: + pr_err("get root inode failed\n"); + bail: diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 253b03451b72..e7339a39e718 100644 --- a/fs/hugetlbfs/inode.c @@ -87671,6 +112567,19 @@ index e7599615e4e0..e876a30f9073 100644 return -EIO; } +diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c +index 871c8b392099..2d1d41c94e37 100644 +--- a/fs/isofs/inode.c ++++ b/fs/isofs/inode.c +@@ -1265,6 +1265,8 @@ static int isofs_read_inode(struct inode *inode, int relocated) + + de = (struct iso_directory_record *) (bh->b_data + offset); + de_len = *(unsigned char *) de; ++ if (de_len < sizeof(struct iso_directory_record)) ++ goto fail; + + if (offset + de_len > bufsize) { + int frag1 = bufsize - offset; diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c index aee592767f1d..2c43de1b034d 100644 --- a/fs/isofs/namei.c @@ -87905,7 +112814,7 @@ index a21ea8b3e5fa..12555c4eeb2b 100644 } log->size = le32_to_cpu(logsuper->size); diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c -index 9895595fd2f2..103788ecc28c 100644 +index 9895595fd2f2..0c2aabba1fdb 100644 --- a/fs/jfs/jfs_mount.c +++ b/fs/jfs/jfs_mount.c @@ -49,6 +49,7 @@ @@ -87916,7 +112825,134 @@ index 9895595fd2f2..103788ecc28c 100644 #include "jfs_incore.h" #include "jfs_filsys.h" -@@ -378,6 +379,15 @@ static int chkSuper(struct super_block *sb) +@@ -92,14 +93,14 @@ int jfs_mount(struct super_block *sb) + * (initialize mount inode from the superblock) + */ + if ((rc = chkSuper(sb))) { +- goto errout20; ++ goto out; + } + + ipaimap = diReadSpecial(sb, AGGREGATE_I, 0); + if (ipaimap == NULL) { + jfs_err("jfs_mount: Failed to read AGGREGATE_I"); + rc = -EIO; +- goto errout20; ++ goto out; + } + sbi->ipaimap = ipaimap; + +@@ -110,7 +111,7 @@ int jfs_mount(struct super_block *sb) + */ + if ((rc = diMount(ipaimap))) { + jfs_err("jfs_mount: diMount(ipaimap) failed w/rc = %d", rc); +- goto errout21; ++ goto err_ipaimap; + } + + /* +@@ -119,7 +120,7 @@ int jfs_mount(struct super_block *sb) + ipbmap = diReadSpecial(sb, BMAP_I, 0); + if (ipbmap == NULL) { + rc = -EIO; +- goto errout22; ++ goto err_umount_ipaimap; + } + + jfs_info("jfs_mount: ipbmap:0x%p", ipbmap); +@@ -131,7 +132,7 @@ int jfs_mount(struct super_block *sb) + */ + if ((rc = dbMount(ipbmap))) { + jfs_err("jfs_mount: dbMount failed w/rc = %d", rc); +- goto errout22; ++ goto err_ipbmap; + } + + /* +@@ -150,7 +151,7 @@ int jfs_mount(struct super_block *sb) + if (!ipaimap2) { + jfs_err("jfs_mount: Failed to read AGGREGATE_I"); + rc = -EIO; +- goto errout35; ++ goto err_umount_ipbmap; + } + sbi->ipaimap2 = ipaimap2; + +@@ -162,7 +163,7 @@ int jfs_mount(struct super_block *sb) + if ((rc = diMount(ipaimap2))) { + jfs_err("jfs_mount: diMount(ipaimap2) failed, rc = %d", + rc); +- goto errout35; ++ goto err_ipaimap2; + } + } else + /* Secondary aggregate inode table is not valid */ +@@ -179,7 +180,7 @@ int jfs_mount(struct super_block *sb) + jfs_err("jfs_mount: Failed to read FILESYSTEM_I"); + /* open fileset secondary inode allocation map */ + rc = -EIO; +- goto errout40; ++ goto err_umount_ipaimap2; + } + jfs_info("jfs_mount: ipimap:0x%p", ipimap); + +@@ -189,41 +190,34 @@ int jfs_mount(struct super_block *sb) + /* initialize fileset inode allocation map */ + if ((rc = diMount(ipimap))) { + jfs_err("jfs_mount: diMount failed w/rc = %d", rc); +- goto errout41; ++ goto err_ipimap; + } + +- goto out; ++ return rc; + + /* + * unwind on error + */ +- errout41: /* close fileset inode allocation map inode */ ++err_ipimap: ++ /* close fileset inode allocation map inode */ + diFreeSpecial(ipimap); +- +- errout40: /* fileset closed */ +- ++err_umount_ipaimap2: + /* close secondary aggregate inode allocation map */ +- if (ipaimap2) { ++ if (ipaimap2) + diUnmount(ipaimap2, 1); ++err_ipaimap2: ++ /* close aggregate inodes */ ++ if (ipaimap2) + diFreeSpecial(ipaimap2); +- } +- +- errout35: +- +- /* close aggregate block allocation map */ ++err_umount_ipbmap: /* close aggregate block allocation map */ + dbUnmount(ipbmap, 1); ++err_ipbmap: /* close aggregate inodes */ + diFreeSpecial(ipbmap); +- +- errout22: /* close aggregate inode allocation map */ +- ++err_umount_ipaimap: /* close aggregate inode allocation map */ + diUnmount(ipaimap, 1); +- +- errout21: /* close aggregate inodes */ ++err_ipaimap: /* close aggregate inodes */ + diFreeSpecial(ipaimap); +- errout20: /* aggregate closed */ +- +- out: +- ++out: + if (rc) + jfs_err("Mount JFS Failure: %d", rc); + +@@ -378,6 +372,15 @@ static int chkSuper(struct super_block *sb) sbi->bsize = bsize; sbi->l2bsize = le16_to_cpu(j_sb->s_l2bsize); @@ -88102,6 +113138,107 @@ index 4c57c9af6946..0417c4c5ebbd 100644 } static inline int splice_branch(struct inode *inode, +diff --git a/fs/namespace.c b/fs/namespace.c +index d7a32893c9e0..8f4ce6c56e74 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1687,13 +1687,22 @@ static inline bool may_mount(void) + return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN); + } + ++#ifdef CONFIG_MANDATORY_FILE_LOCKING ++static bool may_mandlock(void) ++{ ++ pr_warn_once("======================================================\n" ++ "WARNING: the mand mount option is being deprecated and\n" ++ " will be removed in v5.15!\n" ++ "======================================================\n"); ++ return capable(CAP_SYS_ADMIN); ++} ++#else + static inline bool may_mandlock(void) + { +-#ifndef CONFIG_MANDATORY_FILE_LOCKING ++ pr_warn("VFS: \"mand\" mount option not supported"); + return false; +-#endif +- return capable(CAP_SYS_ADMIN); + } ++#endif + + /* + * Now umount can handle mount points as well as block devices. +@@ -1871,6 +1880,20 @@ void drop_collected_mounts(struct vfsmount *mnt) + namespace_unlock(); + } + ++static bool has_locked_children(struct mount *mnt, struct dentry *dentry) ++{ ++ struct mount *child; ++ ++ list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { ++ if (!is_subdir(child->mnt_mountpoint, dentry)) ++ continue; ++ ++ if (child->mnt.mnt_flags & MNT_LOCKED) ++ return true; ++ } ++ return false; ++} ++ + /** + * clone_private_mount - create a private clone of a path + * +@@ -1885,16 +1908,27 @@ struct vfsmount *clone_private_mount(struct path *path) + struct mount *old_mnt = real_mount(path->mnt); + struct mount *new_mnt; + ++ down_read(&namespace_sem); + if (IS_MNT_UNBINDABLE(old_mnt)) +- return ERR_PTR(-EINVAL); ++ goto invalid; ++ ++ if (!check_mnt(old_mnt)) ++ goto invalid; ++ ++ if (has_locked_children(old_mnt, path->dentry)) ++ goto invalid; + +- down_read(&namespace_sem); + new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); + up_read(&namespace_sem); ++ + if (IS_ERR(new_mnt)) + return ERR_CAST(new_mnt); + + return &new_mnt->mnt; ++ ++invalid: ++ up_read(&namespace_sem); ++ return ERR_PTR(-EINVAL); + } + EXPORT_SYMBOL_GPL(clone_private_mount); + +@@ -2210,19 +2244,6 @@ static int do_change_type(struct path *path, int flag) + return err; + } + +-static bool has_locked_children(struct mount *mnt, struct dentry *dentry) +-{ +- struct mount *child; +- list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { +- if (!is_subdir(child->mnt_mountpoint, dentry)) +- continue; +- +- if (child->mnt.mnt_flags & MNT_LOCKED) +- return true; +- } +- return false; +-} +- + /* + * do loopback mount. + */ diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig index c3428767332c..55ebf9f4a824 100644 --- a/fs/nfs/Kconfig @@ -88197,6 +113334,23 @@ index 4539008502ce..ee1225369700 100644 } static unsigned int +diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +index c8863563c635..287ed99a7e51 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c ++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +@@ -383,10 +383,10 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx, + goto out_fail; + + ds = mirror->mirror_ds->ds; ++ if (READ_ONCE(ds->ds_clp)) ++ goto out; + /* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */ + smp_rmb(); +- if (ds->ds_clp) +- goto out; + + /* FIXME: For now we assume the server sent only one version of NFS + * to use for the DS. diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index 851274b25d39..7a94f5a5f8c8 100644 --- a/fs/nfs/inode.c @@ -88339,7 +113493,7 @@ index 267126d32ec0..4a68837e92ea 100644 #define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) #define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2) diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c -index 5cda392028ce..7efb9e0e9f25 100644 +index 5cda392028ce..3038cefff15c 100644 --- a/fs/nfs/nfs42proc.c +++ b/fs/nfs/nfs42proc.c @@ -56,7 +56,8 @@ static int _nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep, @@ -88394,7 +113548,19 @@ index 5cda392028ce..7efb9e0e9f25 100644 inode_unlock(inode); return err; } -@@ -292,7 +294,10 @@ static loff_t _nfs42_proc_llseek(struct file *filep, +@@ -179,8 +181,9 @@ static ssize_t _nfs42_proc_copy(struct file *src, + return status; + } + +- truncate_pagecache_range(dst_inode, pos_dst, +- pos_dst + res->write_res.count); ++ WARN_ON_ONCE(invalidate_inode_pages2_range(dst_inode->i_mapping, ++ pos_dst >> PAGE_SHIFT, ++ (pos_dst + res->write_res.count - 1) >> PAGE_SHIFT)); + + return res->write_res.count; + } +@@ -292,7 +295,10 @@ static loff_t _nfs42_proc_llseek(struct file *filep, if (status) return status; @@ -88406,6 +113572,20 @@ index 5cda392028ce..7efb9e0e9f25 100644 } loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence) +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index 8b2605882a20..335c34f0d130 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -593,8 +593,7 @@ static int nfs4_xdr_dec_clone(struct rpc_rqst *rqstp, + status = decode_clone(xdr); + if (status) + goto out; +- status = decode_getfattr(xdr, res->dst_fattr, res->server); +- ++ decode_getfattr(xdr, res->dst_fattr, res->server); + out: + res->rpc_status = status; + return status; diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c index 7138383382ff..80718d9999ed 100644 --- a/fs/nfs/nfs4file.c @@ -88601,6 +113781,28 @@ index c3abf92adfb7..f19cded49b29 100644 /* Don't send a LAYOUTRETURN if list was initially empty */ if (empty) { +diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c +index 53b4705abcc7..1f2da2094664 100644 +--- a/fs/nfs/pnfs_nfs.c ++++ b/fs/nfs/pnfs_nfs.c +@@ -666,7 +666,7 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv, + } + + smp_wmb(); +- ds->ds_clp = clp; ++ WRITE_ONCE(ds->ds_clp, clp); + dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr); + out: + return status; +@@ -742,7 +742,7 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, + } + + smp_wmb(); +- ds->ds_clp = clp; ++ WRITE_ONCE(ds->ds_clp, clp); + dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr); + out: + return status; diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c index 77d136ac8909..c21fca0dcba7 100644 --- a/fs/nfs_common/grace.c @@ -88654,6 +113856,87 @@ index 8d842282111b..172f697864ab 100644 return; } } +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 5c9231d5e14a..524d98e3bcf5 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -955,6 +955,11 @@ hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp) + return 0; + } + ++static bool delegation_hashed(struct nfs4_delegation *dp) ++{ ++ return !(list_empty(&dp->dl_perfile)); ++} ++ + static bool + unhash_delegation_locked(struct nfs4_delegation *dp) + { +@@ -962,7 +967,7 @@ unhash_delegation_locked(struct nfs4_delegation *dp) + + lockdep_assert_held(&state_lock); + +- if (list_empty(&dp->dl_perfile)) ++ if (!delegation_hashed(dp)) + return false; + + dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID; +@@ -3882,7 +3887,7 @@ static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb) + * queued for a lease break. Don't queue it again. + */ + spin_lock(&state_lock); +- if (dp->dl_time == 0) { ++ if (delegation_hashed(dp) && dp->dl_time == 0) { + dp->dl_time = get_seconds(); + list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru); + } +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index b16a6c036352..dc51011d670d 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -3028,15 +3028,18 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen, + goto fail; + cd->rd_maxcount -= entry_bytes; + /* +- * RFC 3530 14.2.24 describes rd_dircount as only a "hint", so +- * let's always let through the first entry, at least: ++ * RFC 3530 14.2.24 describes rd_dircount as only a "hint", and ++ * notes that it could be zero. If it is zero, then the server ++ * should enforce only the rd_maxcount value. + */ +- if (!cd->rd_dircount) +- goto fail; +- name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8; +- if (name_and_cookie > cd->rd_dircount && cd->cookie_offset) +- goto fail; +- cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie); ++ if (cd->rd_dircount) { ++ name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8; ++ if (name_and_cookie > cd->rd_dircount && cd->cookie_offset) ++ goto fail; ++ cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie); ++ if (!cd->rd_dircount) ++ cd->rd_maxcount = 0; ++ } + + cd->cookie_offset = cookie_offset; + skip_entry: +diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c +index f704f90db36c..2418b9d829ae 100644 +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -765,7 +765,10 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net) + svc_xprt_put(xprt); + } + out_err: +- nfsd_destroy(net); ++ if (!list_empty(&nn->nfsd_serv->sv_permsocks)) ++ nn->nfsd_serv->sv_nrthreads--; ++ else ++ nfsd_destroy(net); + return err; + } + diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c index 60291d10f8e4..6bb3f3a98d7d 100644 --- a/fs/nfsd/nfssvc.c @@ -88682,10 +113965,79 @@ index b0eb58ce6b4f..3dff3d5cc0e9 100644 if (err) { kfree(nilfs->ns_writer); diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c -index 490303e3d517..e9903bceb2bf 100644 +index 490303e3d517..33fba75aa9f3 100644 --- a/fs/nilfs2/sysfs.c +++ b/fs/nilfs2/sysfs.c -@@ -1064,6 +1064,7 @@ void nilfs_sysfs_delete_device_group(struct the_nilfs *nilfs) +@@ -73,11 +73,9 @@ static const struct sysfs_ops nilfs_##name##_attr_ops = { \ + #define NILFS_DEV_INT_GROUP_TYPE(name, parent_name) \ + static void nilfs_##name##_attr_release(struct kobject *kobj) \ + { \ +- struct nilfs_sysfs_##parent_name##_subgroups *subgroups; \ +- struct the_nilfs *nilfs = container_of(kobj->parent, \ +- struct the_nilfs, \ +- ns_##parent_name##_kobj); \ +- subgroups = nilfs->ns_##parent_name##_subgroups; \ ++ struct nilfs_sysfs_##parent_name##_subgroups *subgroups = container_of(kobj, \ ++ struct nilfs_sysfs_##parent_name##_subgroups, \ ++ sg_##name##_kobj); \ + complete(&subgroups->sg_##name##_kobj_unregister); \ + } \ + static struct kobj_type nilfs_##name##_ktype = { \ +@@ -103,12 +101,12 @@ static int nilfs_sysfs_create_##name##_group(struct the_nilfs *nilfs) \ + err = kobject_init_and_add(kobj, &nilfs_##name##_ktype, parent, \ + #name); \ + if (err) \ +- return err; \ +- return 0; \ ++ kobject_put(kobj); \ ++ return err; \ + } \ + static void nilfs_sysfs_delete_##name##_group(struct the_nilfs *nilfs) \ + { \ +- kobject_del(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \ ++ kobject_put(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \ + } + + /************************************************************************ +@@ -219,14 +217,14 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root) + } + + if (err) +- return err; ++ kobject_put(&root->snapshot_kobj); + +- return 0; ++ return err; + } + + void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root) + { +- kobject_del(&root->snapshot_kobj); ++ kobject_put(&root->snapshot_kobj); + } + + /************************************************************************ +@@ -1010,7 +1008,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb) + err = kobject_init_and_add(&nilfs->ns_dev_kobj, &nilfs_dev_ktype, NULL, + "%s", sb->s_id); + if (err) +- goto free_dev_subgroups; ++ goto cleanup_dev_kobject; + + err = nilfs_sysfs_create_mounted_snapshots_group(nilfs); + if (err) +@@ -1047,9 +1045,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb) + nilfs_sysfs_delete_mounted_snapshots_group(nilfs); + + cleanup_dev_kobject: +- kobject_del(&nilfs->ns_dev_kobj); +- +-free_dev_subgroups: ++ kobject_put(&nilfs->ns_dev_kobj); + kfree(nilfs->ns_dev_subgroups); + + failed_create_device_group: +@@ -1064,6 +1060,7 @@ void nilfs_sysfs_delete_device_group(struct the_nilfs *nilfs) nilfs_sysfs_delete_superblock_group(nilfs); nilfs_sysfs_delete_segctor_group(nilfs); kobject_del(&nilfs->ns_dev_kobj); @@ -88732,6 +114084,120 @@ index 7c410f879412..8cd134750ebb 100644 /* Apply the mst fixups. */ if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) { /* FIXME: Try to use the $MFTMirr now. */ +diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c +index dfb8a923921e..04bb03b01f62 100644 +--- a/fs/ocfs2/alloc.c ++++ b/fs/ocfs2/alloc.c +@@ -6891,7 +6891,7 @@ void ocfs2_set_inode_data_inline(struct inode *inode, struct ocfs2_dinode *di) + int ocfs2_convert_inline_data_to_extents(struct inode *inode, + struct buffer_head *di_bh) + { +- int ret, i, has_data, num_pages = 0; ++ int ret, has_data, num_pages = 0; + int need_free = 0; + u32 bit_off, num; + handle_t *handle; +@@ -6900,26 +6900,17 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data; + struct ocfs2_alloc_context *data_ac = NULL; +- struct page **pages = NULL; +- loff_t end = osb->s_clustersize; ++ struct page *page = NULL; + struct ocfs2_extent_tree et; + int did_quota = 0; + + has_data = i_size_read(inode) ? 1 : 0; + + if (has_data) { +- pages = kcalloc(ocfs2_pages_per_cluster(osb->sb), +- sizeof(struct page *), GFP_NOFS); +- if (pages == NULL) { +- ret = -ENOMEM; +- mlog_errno(ret); +- return ret; +- } +- + ret = ocfs2_reserve_clusters(osb, 1, &data_ac); + if (ret) { + mlog_errno(ret); +- goto free_pages; ++ goto out; + } + } + +@@ -6939,7 +6930,8 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + } + + if (has_data) { +- unsigned int page_end; ++ unsigned int page_end = min_t(unsigned, PAGE_SIZE, ++ osb->s_clustersize); + u64 phys; + + ret = dquot_alloc_space_nodirty(inode, +@@ -6963,15 +6955,8 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + */ + block = phys = ocfs2_clusters_to_blocks(inode->i_sb, bit_off); + +- /* +- * Non sparse file systems zero on extend, so no need +- * to do that now. +- */ +- if (!ocfs2_sparse_alloc(osb) && +- PAGE_SIZE < osb->s_clustersize) +- end = PAGE_SIZE; +- +- ret = ocfs2_grab_eof_pages(inode, 0, end, pages, &num_pages); ++ ret = ocfs2_grab_eof_pages(inode, 0, page_end, &page, ++ &num_pages); + if (ret) { + mlog_errno(ret); + need_free = 1; +@@ -6982,20 +6967,15 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + * This should populate the 1st page for us and mark + * it up to date. + */ +- ret = ocfs2_read_inline_data(inode, pages[0], di_bh); ++ ret = ocfs2_read_inline_data(inode, page, di_bh); + if (ret) { + mlog_errno(ret); + need_free = 1; + goto out_unlock; + } + +- page_end = PAGE_SIZE; +- if (PAGE_SIZE > osb->s_clustersize) +- page_end = osb->s_clustersize; +- +- for (i = 0; i < num_pages; i++) +- ocfs2_map_and_dirty_page(inode, handle, 0, page_end, +- pages[i], i > 0, &phys); ++ ocfs2_map_and_dirty_page(inode, handle, 0, page_end, page, 0, ++ &phys); + } + + spin_lock(&oi->ip_lock); +@@ -7026,8 +7006,8 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + } + + out_unlock: +- if (pages) +- ocfs2_unlock_and_free_pages(pages, num_pages); ++ if (page) ++ ocfs2_unlock_and_free_pages(&page, num_pages); + + out_commit: + if (ret < 0 && did_quota) +@@ -7051,8 +7031,6 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + out: + if (data_ac) + ocfs2_free_alloc_context(data_ac); +-free_pages: +- kfree(pages); + return ret; + } + diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c index 6ad76397b31d..291a8250017a 100644 --- a/fs/ocfs2/aops.c @@ -88794,11 +114260,56 @@ index 5e8709aa1e7e..89c71d32dc05 100644 free: kfree(reg); return ERR_PTR(ret); +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c +index 2c3e975126b3..5219f4352ad3 100644 +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -3704,7 +3704,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres, + oi = OCFS2_I(inode); + oi->ip_dir_lock_gen++; + mlog(0, "generation: %u\n", oi->ip_dir_lock_gen); +- goto out; ++ goto out_forget; + } + + if (!S_ISREG(inode->i_mode)) +@@ -3735,6 +3735,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres, + filemap_fdatawait(mapping); + } + ++out_forget: + forget_all_cached_acls(inode); + + out: diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c -index 05a0fb9854f9..3aa4441f5ab5 100644 +index 05a0fb9854f9..f584ef6e754a 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c -@@ -1236,22 +1236,24 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) +@@ -490,10 +490,11 @@ int ocfs2_truncate_file(struct inode *inode, + * greater than page size, so we have to truncate them + * anyway. + */ +- unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1); +- truncate_inode_pages(inode->i_mapping, new_i_size); + + if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) { ++ unmap_mapping_range(inode->i_mapping, ++ new_i_size + PAGE_SIZE - 1, 0, 1); ++ truncate_inode_pages(inode->i_mapping, new_i_size); + status = ocfs2_truncate_inline(inode, di_bh, new_i_size, + i_size_read(inode), 1); + if (status) +@@ -512,6 +513,9 @@ int ocfs2_truncate_file(struct inode *inode, + goto bail_unlock_sem; + } + ++ unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1); ++ truncate_inode_pages(inode->i_mapping, new_i_size); ++ + status = ocfs2_commit_truncate(osb, inode, di_bh); + if (status < 0) { + mlog_errno(status); +@@ -1236,22 +1240,24 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) goto bail_unlock; } } @@ -88825,7 +114336,7 @@ index 05a0fb9854f9..3aa4441f5ab5 100644 } } -@@ -1264,6 +1266,8 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) +@@ -1264,6 +1270,8 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) bail_commit: ocfs2_commit_trans(osb, handle); @@ -88834,8 +114345,8 @@ index 05a0fb9854f9..3aa4441f5ab5 100644 bail_unlock: if (status) { ocfs2_inode_unlock(inode, 1); -@@ -1834,6 +1838,45 @@ static int ocfs2_remove_inode_range(struct inode *inode, - return ret; +@@ -1507,6 +1515,45 @@ static void ocfs2_truncate_cluster_pages(struct inode *inode, u64 byte_start, + } } +/* @@ -88877,10 +114388,45 @@ index 05a0fb9854f9..3aa4441f5ab5 100644 + return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS); +} + - /* - * Parts of this function taken from xfs_change_file_space() - */ -@@ -1844,7 +1887,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, + static int ocfs2_zero_partial_clusters(struct inode *inode, + u64 start, u64 len) + { +@@ -1516,6 +1563,7 @@ static int ocfs2_zero_partial_clusters(struct inode *inode, + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + unsigned int csize = osb->s_clustersize; + handle_t *handle; ++ loff_t isize = i_size_read(inode); + + /* + * The "start" and "end" values are NOT necessarily part of +@@ -1536,6 +1584,26 @@ static int ocfs2_zero_partial_clusters(struct inode *inode, + if ((start & (csize - 1)) == 0 && (end & (csize - 1)) == 0) + goto out; + ++ /* No page cache for EOF blocks, issue zero out to disk. */ ++ if (end > isize) { ++ /* ++ * zeroout eof blocks in last cluster starting from ++ * "isize" even "start" > "isize" because it is ++ * complicated to zeroout just at "start" as "start" ++ * may be not aligned with block size, buffer write ++ * would be required to do that, but out of eof buffer ++ * write is not supported. ++ */ ++ ret = ocfs2_zeroout_partial_cluster(inode, isize, ++ end - isize); ++ if (ret) { ++ mlog_errno(ret); ++ goto out; ++ } ++ if (start >= isize) ++ goto out; ++ end = isize; ++ } + handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS); + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); +@@ -1844,7 +1912,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, { int ret; s64 llen; @@ -88889,28 +114435,12 @@ index 05a0fb9854f9..3aa4441f5ab5 100644 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); struct buffer_head *di_bh = NULL; handle_t *handle; -@@ -1875,6 +1918,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, - goto out_inode_unlock; - } - -+ orig_isize = i_size_read(inode); - switch (sr->l_whence) { - case 0: /*SEEK_SET*/ - break; -@@ -1882,7 +1926,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, - sr->l_start += f_pos; - break; - case 2: /*SEEK_END*/ -- sr->l_start += i_size_read(inode); -+ sr->l_start += orig_isize; - break; - default: - ret = -EINVAL; -@@ -1936,6 +1980,14 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, +@@ -1936,6 +2004,15 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, default: ret = -EINVAL; } + ++ orig_isize = i_size_read(inode); + /* zeroout eof blocks in the cluster. */ + if (!ret && change_size && orig_isize < size) { + ret = ocfs2_zeroout_partial_cluster(inode, orig_isize, @@ -88921,7 +114451,7 @@ index 05a0fb9854f9..3aa4441f5ab5 100644 up_write(&OCFS2_I(inode)->ip_alloc_sem); if (ret) { mlog_errno(ret); -@@ -1952,9 +2004,6 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, +@@ -1952,9 +2029,6 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, goto out_inode_unlock; } @@ -89045,7 +114575,7 @@ index 6ad3533940ba..f8d092b80a49 100644 /* the error code could be inaccurate, but we are not able to * get the correct one. */ diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c -index 64dfbe5755da..e0fb62f5cf63 100644 +index 64dfbe5755da..454aad87b866 100644 --- a/fs/ocfs2/super.c +++ b/fs/ocfs2/super.c @@ -91,7 +91,7 @@ struct mount_options @@ -89074,6 +114604,54 @@ index 64dfbe5755da..e0fb62f5cf63 100644 ocfs2_resv_init_once(&oi->ip_la_data_resv); +@@ -2188,11 +2189,17 @@ static int ocfs2_initialize_super(struct super_block *sb, + } + + if (ocfs2_clusterinfo_valid(osb)) { ++ /* ++ * ci_stack and ci_cluster in ocfs2_cluster_info may not be null ++ * terminated, so make sure no overflow happens here by using ++ * memcpy. Destination strings will always be null terminated ++ * because osb is allocated using kzalloc. ++ */ + osb->osb_stackflags = + OCFS2_RAW_SB(di)->s_cluster_info.ci_stackflags; +- strlcpy(osb->osb_cluster_stack, ++ memcpy(osb->osb_cluster_stack, + OCFS2_RAW_SB(di)->s_cluster_info.ci_stack, +- OCFS2_STACK_LABEL_LEN + 1); ++ OCFS2_STACK_LABEL_LEN); + if (strlen(osb->osb_cluster_stack) != OCFS2_STACK_LABEL_LEN) { + mlog(ML_ERROR, + "couldn't mount because of an invalid " +@@ -2201,9 +2208,9 @@ static int ocfs2_initialize_super(struct super_block *sb, + status = -EINVAL; + goto bail; + } +- strlcpy(osb->osb_cluster_name, ++ memcpy(osb->osb_cluster_name, + OCFS2_RAW_SB(di)->s_cluster_info.ci_cluster, +- OCFS2_CLUSTER_NAME_LEN + 1); ++ OCFS2_CLUSTER_NAME_LEN); + } else { + /* The empty string is identical with classic tools that + * don't know about s_cluster_info. */ +diff --git a/fs/orangefs/dcache.c b/fs/orangefs/dcache.c +index 5355efba4bc8..1942f9946ab7 100644 +--- a/fs/orangefs/dcache.c ++++ b/fs/orangefs/dcache.c +@@ -25,8 +25,10 @@ static int orangefs_revalidate_lookup(struct dentry *dentry) + gossip_debug(GOSSIP_DCACHE_DEBUG, "%s: attempting lookup.\n", __func__); + + new_op = op_alloc(ORANGEFS_VFS_OP_LOOKUP); +- if (!new_op) ++ if (!new_op) { ++ ret = -ENOMEM; + goto out_put_parent; ++ } + + new_op->upcall.req.lookup.sym_follow = ORANGEFS_LOOKUP_LINK_NO_FOLLOW; + new_op->upcall.req.lookup.parent_refn = parent->refn; diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c index 6e35ef6521b4..8972ebc87016 100644 --- a/fs/orangefs/super.c @@ -89129,6 +114707,64 @@ index 0b71cb514031..8a8426c3c755 100644 error = vfs_setxattr(new, name, value, size, 0); if (error) break; +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index 7c52993b9a3b..0fa95bc5950a 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -929,9 +929,13 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old, + goto out_dput; + } + } else { +- if (!d_is_negative(newdentry) && +- (!new_opaque || !ovl_is_whiteout(newdentry))) +- goto out_dput; ++ if (!d_is_negative(newdentry)) { ++ if (!new_opaque || !ovl_is_whiteout(newdentry)) ++ goto out_dput; ++ } else { ++ if (flags & RENAME_EXCHANGE) ++ goto out_dput; ++ } + } + + if (olddentry == trap) +diff --git a/fs/pipe.c b/fs/pipe.c +index 347c6dc888c8..6375e625a263 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -28,6 +28,21 @@ + + #include "internal.h" + ++/* ++ * New pipe buffers will be restricted to this size while the user is exceeding ++ * their pipe buffer quota. The general pipe use case needs at least two ++ * buffers: one for data yet to be read, and one for new data. If this is less ++ * than two, then a write to a non-empty pipe may block even if the pipe is not ++ * full. This can occur with GNU make jobserver or similar uses of pipes as ++ * semaphores: multiple processes may be waiting to write tokens back to the ++ * pipe before reading tokens: https://lore.kernel.org/lkml/1628086770.5rn8p04n6j.none@localhost/. ++ * ++ * Users can reduce their pipe buffers with F_SETPIPE_SZ below this at their ++ * own risk, namely: pipe writes to non-full pipes may block until the pipe is ++ * emptied. ++ */ ++#define PIPE_MIN_DEF_BUFFERS 2 ++ + /* + * The max size that a non-root user is allowed to grow the pipe. Can + * be set by root in /proc/sys/fs/pipe-max-size +@@ -653,8 +668,8 @@ struct pipe_inode_info *alloc_pipe_info(void) + user_bufs = account_pipe_buffers(user, 0, pipe_bufs); + + if (too_many_pipe_buffers_soft(user_bufs) && is_unprivileged_user()) { +- user_bufs = account_pipe_buffers(user, pipe_bufs, 1); +- pipe_bufs = 1; ++ user_bufs = account_pipe_buffers(user, pipe_bufs, PIPE_MIN_DEF_BUFFERS); ++ pipe_bufs = PIPE_MIN_DEF_BUFFERS; + } + + if (too_many_pipe_buffers_hard(user_bufs) && is_unprivileged_user()) diff --git a/fs/proc/base.c b/fs/proc/base.c index 89091588a887..3b0af99dd1fd 100644 --- a/fs/proc/base.c @@ -89244,8 +114880,135 @@ index 595b90a9766c..02d1db8e9723 100644 if (inode) { inode->i_ino = thread_self_inum; inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode); +diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c +index 8e8012769f3e..e8b40835770c 100644 +--- a/fs/proc/vmcore.c ++++ b/fs/proc/vmcore.c +@@ -105,14 +105,19 @@ static ssize_t read_from_oldmem(char *buf, size_t count, + nr_bytes = count; + + /* If pfn is not ram, return zeros for sparse dump files */ +- if (pfn_is_ram(pfn) == 0) +- memset(buf, 0, nr_bytes); +- else { ++ if (pfn_is_ram(pfn) == 0) { ++ tmp = 0; ++ if (!userbuf) ++ memset(buf, 0, nr_bytes); ++ else if (clear_user(buf, nr_bytes)) ++ tmp = -EFAULT; ++ } else { + tmp = copy_oldmem_page(pfn, buf, nr_bytes, + offset, userbuf); +- if (tmp < 0) +- return tmp; + } ++ if (tmp < 0) ++ return tmp; ++ + *ppos += nr_bytes; + count -= nr_bytes; + buf += nr_bytes; +diff --git a/fs/qnx4/dir.c b/fs/qnx4/dir.c +index 781056a0480f..b3bde1826001 100644 +--- a/fs/qnx4/dir.c ++++ b/fs/qnx4/dir.c +@@ -14,13 +14,48 @@ + #include + #include "qnx4.h" + ++/* ++ * A qnx4 directory entry is an inode entry or link info ++ * depending on the status field in the last byte. The ++ * first byte is where the name start either way, and a ++ * zero means it's empty. ++ * ++ * Also, due to a bug in gcc, we don't want to use the ++ * real (differently sized) name arrays in the inode and ++ * link entries, but always the 'de_name[]' one in the ++ * fake struct entry. ++ * ++ * See ++ * ++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578#c6 ++ * ++ * for details, but basically gcc will take the size of the ++ * 'name' array from one of the used union entries randomly. ++ * ++ * This use of 'de_name[]' (48 bytes) avoids the false positive ++ * warnings that would happen if gcc decides to use 'inode.di_name' ++ * (16 bytes) even when the pointer and size were to come from ++ * 'link.dl_name' (48 bytes). ++ * ++ * In all cases the actual name pointer itself is the same, it's ++ * only the gcc internal 'what is the size of this field' logic ++ * that can get confused. ++ */ ++union qnx4_directory_entry { ++ struct { ++ const char de_name[48]; ++ u8 de_pad[15]; ++ u8 de_status; ++ }; ++ struct qnx4_inode_entry inode; ++ struct qnx4_link_info link; ++}; ++ + static int qnx4_readdir(struct file *file, struct dir_context *ctx) + { + struct inode *inode = file_inode(file); + unsigned int offset; + struct buffer_head *bh; +- struct qnx4_inode_entry *de; +- struct qnx4_link_info *le; + unsigned long blknum; + int ix, ino; + int size; +@@ -37,27 +72,27 @@ static int qnx4_readdir(struct file *file, struct dir_context *ctx) + } + ix = (ctx->pos >> QNX4_DIR_ENTRY_SIZE_BITS) % QNX4_INODES_PER_BLOCK; + for (; ix < QNX4_INODES_PER_BLOCK; ix++, ctx->pos += QNX4_DIR_ENTRY_SIZE) { ++ union qnx4_directory_entry *de; ++ + offset = ix * QNX4_DIR_ENTRY_SIZE; +- de = (struct qnx4_inode_entry *) (bh->b_data + offset); +- if (!de->di_fname[0]) ++ de = (union qnx4_directory_entry *) (bh->b_data + offset); ++ ++ if (!de->de_name[0]) + continue; +- if (!(de->di_status & (QNX4_FILE_USED|QNX4_FILE_LINK))) ++ if (!(de->de_status & (QNX4_FILE_USED|QNX4_FILE_LINK))) + continue; +- if (!(de->di_status & QNX4_FILE_LINK)) +- size = QNX4_SHORT_NAME_MAX; +- else +- size = QNX4_NAME_MAX; +- size = strnlen(de->di_fname, size); +- QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, de->di_fname)); +- if (!(de->di_status & QNX4_FILE_LINK)) ++ if (!(de->de_status & QNX4_FILE_LINK)) { ++ size = sizeof(de->inode.di_fname); + ino = blknum * QNX4_INODES_PER_BLOCK + ix - 1; +- else { +- le = (struct qnx4_link_info*)de; +- ino = ( le32_to_cpu(le->dl_inode_blk) - 1 ) * ++ } else { ++ size = sizeof(de->link.dl_fname); ++ ino = ( le32_to_cpu(de->link.dl_inode_blk) - 1 ) * + QNX4_INODES_PER_BLOCK + +- le->dl_inode_ndx; ++ de->link.dl_inode_ndx; + } +- if (!dir_emit(ctx, de->di_fname, size, ino, DT_UNKNOWN)) { ++ size = strnlen(de->de_name, size); ++ QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, name)); ++ if (!dir_emit(ctx, de->de_name, size, ino, DT_UNKNOWN)) { + brelse(bh); + return 0; + } diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c -index 0738972e8d3f..ecd9887b0d1f 100644 +index 0738972e8d3f..8c7705b50e5d 100644 --- a/fs/quota/quota_tree.c +++ b/fs/quota/quota_tree.c @@ -61,7 +61,7 @@ static ssize_t read_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) @@ -89275,7 +115038,29 @@ index 0738972e8d3f..ecd9887b0d1f 100644 sizeof(struct qt_disk_dqdbheader) + i * info->dqi_entry_size; kfree(buf); -@@ -558,7 +558,7 @@ static loff_t find_block_dqentry(struct qtree_mem_dqinfo *info, +@@ -422,6 +422,7 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot, + quota_error(dquot->dq_sb, "Quota structure has offset to " + "other block (%u) than it should (%u)", blk, + (uint)(dquot->dq_off >> info->dqi_blocksize_bits)); ++ ret = -EIO; + goto out_buf; + } + ret = read_blk(info, blk, buf); +@@ -487,6 +488,13 @@ static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot, + goto out_buf; + } + newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); ++ if (newblk < QT_TREEOFF || newblk >= info->dqi_blocks) { ++ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)", ++ newblk, info->dqi_blocks); ++ ret = -EUCLEAN; ++ goto out_buf; ++ } ++ + if (depth == info->dqi_qtree_depth - 1) { + ret = free_dqentry(info, dquot, newblk); + newblk = 0; +@@ -558,7 +566,7 @@ static loff_t find_block_dqentry(struct qtree_mem_dqinfo *info, ret = -EIO; goto out_buf; } else { @@ -89284,6 +115069,20 @@ index 0738972e8d3f..ecd9887b0d1f 100644 qt_disk_dqdbheader) + i * info->dqi_entry_size; } out_buf: +@@ -586,6 +594,13 @@ static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info, + blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); + if (!blk) /* No reference? */ + goto out_buf; ++ if (blk < QT_TREEOFF || blk >= info->dqi_blocks) { ++ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)", ++ blk, info->dqi_blocks); ++ ret = -EUCLEAN; ++ goto out_buf; ++ } ++ + if (depth < info->dqi_qtree_depth - 1) + ret = find_tree_dqentry(info, dquot, blk, depth+1); + else diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c index ca71bf881ad1..4a39bb98f8ab 100644 --- a/fs/quota/quota_v2.c @@ -89349,24 +115148,52 @@ index 2a5c4813c47d..94871f611fa8 100644 reiserfs_warning(sb, "sh-462", "unable to initialize journal device"); diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c -index 5f5fff068877..25b2aed9af0b 100644 +index 5f5fff068877..f2f7055303ca 100644 --- a/fs/reiserfs/stree.c +++ b/fs/reiserfs/stree.c -@@ -453,6 +453,12 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) +@@ -386,6 +386,24 @@ void pathrelse(struct treepath *search_path) + search_path->path_length = ILLEGAL_PATH_ELEMENT_OFFSET; + } + ++static int has_valid_deh_location(struct buffer_head *bh, struct item_head *ih) ++{ ++ struct reiserfs_de_head *deh; ++ int i; ++ ++ deh = B_I_DEH(bh, ih); ++ for (i = 0; i < ih_entry_count(ih); i++) { ++ if (deh_location(&deh[i]) > ih_item_len(ih)) { ++ reiserfs_warning(NULL, "reiserfs-5094", ++ "directory entry location seems wrong %h", ++ &deh[i]); ++ return 0; ++ } ++ } ++ ++ return 1; ++} ++ + static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) + { + struct block_head *blkh; +@@ -453,6 +471,15 @@ static int is_leaf(char *buf, int blocksize, struct buffer_head *bh) "(second one): %h", ih); return 0; } -+ if (is_direntry_le_ih(ih) && (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE))) { -+ reiserfs_warning(NULL, "reiserfs-5093", -+ "item entry count seems wrong %h", -+ ih); -+ return 0; ++ if (is_direntry_le_ih(ih)) { ++ if (ih_item_len(ih) < (ih_entry_count(ih) * IH_SIZE)) { ++ reiserfs_warning(NULL, "reiserfs-5093", ++ "item entry count seems wrong %h", ++ ih); ++ return 0; ++ } ++ return has_valid_deh_location(bh, ih); + } prev_location = ih_location(ih); } diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c -index 677608a89b08..c533d8715a6c 100644 +index 677608a89b08..0d324c07762a 100644 --- a/fs/reiserfs/super.c +++ b/fs/reiserfs/super.c @@ -1234,6 +1234,10 @@ static int reiserfs_parse_options(struct super_block *s, @@ -89391,6 +115218,21 @@ index 677608a89b08..c533d8715a6c 100644 if (qtype == USRQUOTA) *mount_options &= ~(1 << REISERFS_USRQUOTA); else +@@ -2059,6 +2059,14 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent) + unlock_new_inode(root_inode); + } + ++ if (!S_ISDIR(root_inode->i_mode) || !inode_get_bytes(root_inode) || ++ !root_inode->i_size) { ++ SWARN(silent, s, "", "corrupt root inode, run fsck"); ++ iput(root_inode); ++ errval = -EUCLEAN; ++ goto error; ++ } ++ + s->s_root = d_make_root(root_inode); + if (!s->s_root) + goto error; diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c index 07900105523f..645ee1bbd025 100644 --- a/fs/reiserfs/xattr.c @@ -89487,6 +115329,29 @@ index 368bfb92b115..3ade39e02bb7 100644 /* * For high order allocations, use __GFP_NORETRY to avoid oom-killing - * it's better to fall back to vmalloc() than to kill things. For small +diff --git a/fs/signalfd.c b/fs/signalfd.c +index 270221fcef42..9c5fa0ab5e0f 100644 +--- a/fs/signalfd.c ++++ b/fs/signalfd.c +@@ -34,17 +34,7 @@ + + void signalfd_cleanup(struct sighand_struct *sighand) + { +- wait_queue_head_t *wqh = &sighand->signalfd_wqh; +- /* +- * The lockless check can race with remove_wait_queue() in progress, +- * but in this case its caller should run under rcu_read_lock() and +- * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return. +- */ +- if (likely(!waitqueue_active(wqh))) +- return; +- +- /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */ +- wake_up_poll(wqh, POLLHUP | POLLFREE); ++ wake_up_pollfree(&sighand->signalfd_wqh); + } + + struct signalfd_ctx { diff --git a/fs/squashfs/export.c b/fs/squashfs/export.c index 8073b6532cf0..1d406a2094a5 100644 --- a/fs/squashfs/export.c @@ -89960,6 +115825,119 @@ index 666986b95c5d..300cdbdc8494 100644 + return len; +} +EXPORT_SYMBOL_GPL(sysfs_emit_at); +diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c +index 21d36d284735..e00594ad9972 100644 +--- a/fs/tracefs/inode.c ++++ b/fs/tracefs/inode.c +@@ -162,6 +162,77 @@ struct tracefs_fs_info { + struct tracefs_mount_opts mount_opts; + }; + ++static void change_gid(struct dentry *dentry, kgid_t gid) ++{ ++ if (!dentry->d_inode) ++ return; ++ dentry->d_inode->i_gid = gid; ++} ++ ++/* ++ * Taken from d_walk, but without he need for handling renames. ++ * Nothing can be renamed while walking the list, as tracefs ++ * does not support renames. This is only called when mounting ++ * or remounting the file system, to set all the files to ++ * the given gid. ++ */ ++static void set_gid(struct dentry *parent, kgid_t gid) ++{ ++ struct dentry *this_parent; ++ struct list_head *next; ++ ++ this_parent = parent; ++ spin_lock(&this_parent->d_lock); ++ ++ change_gid(this_parent, gid); ++repeat: ++ next = this_parent->d_subdirs.next; ++resume: ++ while (next != &this_parent->d_subdirs) { ++ struct list_head *tmp = next; ++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child); ++ next = tmp->next; ++ ++ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); ++ ++ change_gid(dentry, gid); ++ ++ if (!list_empty(&dentry->d_subdirs)) { ++ spin_unlock(&this_parent->d_lock); ++ spin_release(&dentry->d_lock.dep_map, 1, _RET_IP_); ++ this_parent = dentry; ++ spin_acquire(&this_parent->d_lock.dep_map, 0, 1, _RET_IP_); ++ goto repeat; ++ } ++ spin_unlock(&dentry->d_lock); ++ } ++ /* ++ * All done at this level ... ascend and resume the search. ++ */ ++ rcu_read_lock(); ++ascend: ++ if (this_parent != parent) { ++ struct dentry *child = this_parent; ++ this_parent = child->d_parent; ++ ++ spin_unlock(&child->d_lock); ++ spin_lock(&this_parent->d_lock); ++ ++ /* go into the first sibling still alive */ ++ do { ++ next = child->d_child.next; ++ if (next == &this_parent->d_subdirs) ++ goto ascend; ++ child = list_entry(next, struct dentry, d_child); ++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); ++ rcu_read_unlock(); ++ goto resume; ++ } ++ rcu_read_unlock(); ++ spin_unlock(&this_parent->d_lock); ++ return; ++} ++ + static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts) + { + substring_t args[MAX_OPT_ARGS]; +@@ -194,6 +265,7 @@ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts) + if (!gid_valid(gid)) + return -EINVAL; + opts->gid = gid; ++ set_gid(tracefs_mount->mnt_root, gid); + break; + case Opt_mode: + if (match_octal(&args[0], &option)) +@@ -411,6 +483,8 @@ struct dentry *tracefs_create_file(const char *name, umode_t mode, + inode->i_mode = mode; + inode->i_fop = fops ? fops : &tracefs_file_operations; + inode->i_private = data; ++ inode->i_uid = d_inode(dentry->d_parent)->i_uid; ++ inode->i_gid = d_inode(dentry->d_parent)->i_gid; + d_instantiate(dentry, inode); + fsnotify_create(dentry->d_parent->d_inode, dentry); + return end_creating(dentry); +@@ -429,9 +503,12 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent, + if (unlikely(!inode)) + return failed_creating(dentry); + +- inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO; ++ /* Do not set bits for OTH */ ++ inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP; + inode->i_op = ops; + inode->i_fop = &simple_dir_operations; ++ inode->i_uid = d_inode(dentry->d_parent)->i_uid; ++ inode->i_gid = d_inode(dentry->d_parent)->i_gid; + + /* directory inodes start off with i_nlink == 2 (for "." entry) */ + inc_nlink(inode); diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c index 69e287e20732..8223e4330981 100644 --- a/fs/ubifs/debug.c @@ -90134,6 +116112,35 @@ index 9e66d85021fc..50607673a6a9 100644 } /* Managed to do everything necessary? */ +diff --git a/fs/udf/misc.c b/fs/udf/misc.c +index 71d1c25f360d..8c7f9ea251e5 100644 +--- a/fs/udf/misc.c ++++ b/fs/udf/misc.c +@@ -175,13 +175,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type, + else + offset = le32_to_cpu(eahd->appAttrLocation); + +- while (offset < iinfo->i_lenEAttr) { ++ while (offset + sizeof(*gaf) < iinfo->i_lenEAttr) { ++ uint32_t attrLength; ++ + gaf = (struct genericFormat *)&ea[offset]; ++ attrLength = le32_to_cpu(gaf->attrLength); ++ ++ /* Detect undersized elements and buffer overflows */ ++ if ((attrLength < sizeof(*gaf)) || ++ (attrLength > (iinfo->i_lenEAttr - offset))) ++ break; ++ + if (le32_to_cpu(gaf->attrType) == type && + gaf->attrSubtype == subtype) + return gaf; + else +- offset += le32_to_cpu(gaf->attrLength); ++ offset += attrLength; + } + } + diff --git a/fs/udf/namei.c b/fs/udf/namei.c index 348b922d1b6a..bfa53dead8c8 100644 --- a/fs/udf/namei.c @@ -90150,10 +116157,29 @@ index 348b922d1b6a..bfa53dead8c8 100644 memset(epos.bh->b_data, 0x00, bsize); set_buffer_uptodate(epos.bh); diff --git a/fs/udf/super.c b/fs/udf/super.c -index 4abdba453885..c8c037e8e57b 100644 +index 4abdba453885..cf2e770080f9 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c -@@ -1391,6 +1391,12 @@ static int udf_load_sparable_map(struct super_block *sb, +@@ -115,16 +115,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb) + return NULL; + lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data; + partnum = le32_to_cpu(lvid->numOfPartitions); +- if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) - +- offsetof(struct logicalVolIntegrityDesc, impUse)) / +- (2 * sizeof(uint32_t)) < partnum) { +- udf_err(sb, "Logical volume integrity descriptor corrupted " +- "(numOfPartitions = %u)!\n", partnum); +- return NULL; +- } + /* The offset is to skip freeSpaceTable and sizeTable arrays */ + offset = partnum * 2 * sizeof(uint32_t); +- return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]); ++ return (struct logicalVolIntegrityDescImpUse *) ++ (((uint8_t *)(lvid + 1)) + offset); + } + + /* UDF filesystem type */ +@@ -1391,6 +1385,12 @@ static int udf_load_sparable_map(struct super_block *sb, (int)spm->numSparingTables); return -EIO; } @@ -90166,6 +116192,43 @@ index 4abdba453885..c8c037e8e57b 100644 for (i = 0; i < spm->numSparingTables; i++) { loc = le32_to_cpu(spm->locSparingTable[i]); +@@ -1565,6 +1565,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ + struct udf_sb_info *sbi = UDF_SB(sb); + struct logicalVolIntegrityDesc *lvid; + int indirections = 0; ++ u32 parts, impuselen; + + while (++indirections <= UDF_MAX_LVID_NESTING) { + final_bh = NULL; +@@ -1591,15 +1592,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ + + lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data; + if (lvid->nextIntegrityExt.extLength == 0) +- return; ++ goto check; + + loc = leea_to_cpu(lvid->nextIntegrityExt); + } + + udf_warn(sb, "Too many LVID indirections (max %u), ignoring.\n", + UDF_MAX_LVID_NESTING); ++out_err: + brelse(sbi->s_lvid_bh); + sbi->s_lvid_bh = NULL; ++ return; ++check: ++ parts = le32_to_cpu(lvid->numOfPartitions); ++ impuselen = le32_to_cpu(lvid->lengthOfImpUse); ++ if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize || ++ sizeof(struct logicalVolIntegrityDesc) + impuselen + ++ 2 * parts * sizeof(u32) > sb->s_blocksize) { ++ udf_warn(sb, "Corrupted LVID (parts=%u, impuselen=%u), " ++ "ignoring.\n", parts, impuselen); ++ goto out_err; ++ } + } + + diff --git a/fs/ufs/super.c b/fs/ufs/super.c index 351162ff1bfd..e320d824ee4d 100644 --- a/fs/ufs/super.c @@ -90780,8 +116843,45 @@ index c1a524de67c5..53b2a1f320f9 100644 struct acpi_pnp_type type; /* ID type */ acpi_bus_address bus_address; /* _ADR */ char *unique_id; /* _UID */ +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index 0a4c2d4d9f8d..b43fa9d95a7a 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -847,6 +847,19 @@ static inline bool arch_has_pfn_modify_check(void) + #define io_remap_pfn_range remap_pfn_range + #endif + ++#if !defined(MAX_POSSIBLE_PHYSMEM_BITS) && !defined(CONFIG_64BIT) ++#ifdef CONFIG_PHYS_ADDR_T_64BIT ++/* ++ * ZSMALLOC needs to know the highest PFN on 32-bit architectures ++ * with physical address space extension, but falls back to ++ * BITS_PER_LONG otherwise. ++ */ ++#error Missing MAX_POSSIBLE_PHYSMEM_BITS definition ++#else ++#define MAX_POSSIBLE_PHYSMEM_BITS 32 ++#endif ++#endif ++ + #ifndef has_transparent_hugepage + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + #define has_transparent_hugepage() 1 +diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h +index c6d667187608..e9851100c0f7 100644 +--- a/include/asm-generic/tlb.h ++++ b/include/asm-generic/tlb.h +@@ -123,6 +123,8 @@ void tlb_finish_mmu(struct mmu_gather *tlb, unsigned long start, + unsigned long end); + extern bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page, + int page_size); ++void tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address, ++ unsigned long size); + + static inline void __tlb_adjust_range(struct mmu_gather *tlb, + unsigned long address) diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h -index 3c3519b0fce5..63ba5050175d 100644 +index 3c3519b0fce5..1c5b8e306e6b 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -252,7 +252,8 @@ @@ -90794,7 +116894,7 @@ index 3c3519b0fce5..63ba5050175d 100644 #define READ_MOSTLY_DATA(align) \ . = ALIGN(align); \ -@@ -461,7 +462,10 @@ +@@ -461,10 +462,14 @@ */ #define TEXT_TEXT \ ALIGN_FUNCTION(); \ @@ -90806,7 +116906,11 @@ index 3c3519b0fce5..63ba5050175d 100644 *(.text..ftrace) \ *(TEXT_CFI_MAIN) \ *(.ref.text) \ -@@ -621,7 +625,9 @@ ++ *(.text.asan.* .text.tsan.*) \ + MEM_KEEP(init.text) \ + MEM_KEEP(exit.text) \ + +@@ -621,7 +626,9 @@ . = ALIGN(bss_align); \ .bss : AT(ADDR(.bss) - LOAD_OFFSET) { \ BSS_FIRST_SECTIONS \ @@ -90850,6 +116954,554 @@ index 5203560f992e..000c049a75f7 100644 bool crypto_hash_alg_has_setkey(struct hash_alg_common *halg); +diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h +index 882ca0e1e7a5..d8435eac3729 100644 +--- a/include/crypto/public_key.h ++++ b/include/crypto/public_key.h +@@ -35,9 +35,9 @@ extern void public_key_free(struct public_key *key); + struct public_key_signature { + struct asymmetric_key_id *auth_ids[2]; + u8 *s; /* Signature */ +- u32 s_size; /* Number of bytes in signature */ + u8 *digest; +- u8 digest_size; /* Number of bytes in digest */ ++ u32 s_size; /* Number of bytes in signature */ ++ u32 digest_size; /* Number of bytes in digest */ + const char *pkey_algo; + const char *hash_algo; + }; +diff --git a/include/drm/drmP.h b/include/drm/drmP.h +index 0c4f9c67c221..c56176c4b670 100644 +--- a/include/drm/drmP.h ++++ b/include/drm/drmP.h +@@ -803,6 +803,27 @@ struct drm_device { + struct mutex filelist_mutex; + struct list_head filelist; + ++ /** ++ * @filelist_internal: ++ * ++ * List of open DRM files for in-kernel clients. Protected by @filelist_mutex. ++ */ ++ struct list_head filelist_internal; ++ ++ /** ++ * @clientlist_mutex: ++ * ++ * Protects @clientlist access. ++ */ ++ struct mutex clientlist_mutex; ++ ++ /** ++ * @clientlist: ++ * ++ * List of in-kernel clients. Protected by @clientlist_mutex. ++ */ ++ struct list_head clientlist; ++ + /** \name Memory management */ + /*@{ */ + struct list_head maplist; /**< Linked list of regions */ +@@ -901,12 +922,36 @@ struct drm_device { + #define DRM_SWITCH_POWER_CHANGING 2 + #define DRM_SWITCH_POWER_DYNAMIC_OFF 3 + ++/** ++ * drm_core_check_feature - check driver feature flags ++ * @dev: DRM device to check ++ * @feature: feature flag ++ * ++ * This checks @dev for driver features, see &drm_driver.driver_features and the ++ * various DRIVER_\* flags. ++ * ++ * Returns true if the @feature is supported, false otherwise. ++ */ + static __inline__ int drm_core_check_feature(struct drm_device *dev, + int feature) + { + return ((dev->driver->driver_features & feature) ? 1 : 0); + } + ++/** ++ * drm_drv_uses_atomic_modeset - check if the driver implements ++ * atomic_commit() ++ * @dev: DRM device ++ * ++ * This check is useful if drivers do not have DRIVER_ATOMIC set but ++ * have atomic modesetting internally implemented. ++ */ ++static __inline__ int drm_drv_uses_atomic_modeset(struct drm_device *dev) ++{ ++ return drm_core_check_feature(dev, DRIVER_ATOMIC) || ++ dev->mode_config.funcs->atomic_commit != NULL; ++} ++ + static inline void drm_device_set_unplugged(struct drm_device *dev) + { + smp_wmb(); +diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h +index a5696c1806c9..11fc4e84f5c0 100644 +--- a/include/drm/drm_atomic.h ++++ b/include/drm/drm_atomic.h +@@ -137,19 +137,19 @@ struct drm_crtc_commit { + + struct __drm_planes_state { + struct drm_plane *ptr; +- struct drm_plane_state *state; ++ struct drm_plane_state *state, *old_state, *new_state; + }; + + struct __drm_crtcs_state { + struct drm_crtc *ptr; +- struct drm_crtc_state *state; ++ struct drm_crtc_state *state, *old_state, *new_state; + struct drm_crtc_commit *commit; + s32 __user *out_fence_ptr; + }; + + struct __drm_connnectors_state { + struct drm_connector *ptr; +- struct drm_connector_state *state; ++ struct drm_connector_state *state, *old_state, *new_state; + }; + + /** +@@ -225,8 +225,8 @@ int drm_atomic_connector_set_property(struct drm_connector *connector, + * @state: global atomic state object + * @crtc: crtc to grab + * +- * This function returns the crtc state for the given crtc, or NULL +- * if the crtc is not part of the global atomic state. ++ * This function is deprecated, @drm_atomic_get_old_crtc_state or ++ * @drm_atomic_get_new_crtc_state should be used instead. + */ + static inline struct drm_crtc_state * + drm_atomic_get_existing_crtc_state(struct drm_atomic_state *state, +@@ -235,6 +235,35 @@ drm_atomic_get_existing_crtc_state(struct drm_atomic_state *state, + return state->crtcs[drm_crtc_index(crtc)].state; + } + ++/** ++ * drm_atomic_get_old_crtc_state - get old crtc state, if it exists ++ * @state: global atomic state object ++ * @crtc: crtc to grab ++ * ++ * This function returns the old crtc state for the given crtc, or ++ * NULL if the crtc is not part of the global atomic state. ++ */ ++static inline struct drm_crtc_state * ++drm_atomic_get_old_crtc_state(struct drm_atomic_state *state, ++ struct drm_crtc *crtc) ++{ ++ return state->crtcs[drm_crtc_index(crtc)].old_state; ++} ++/** ++ * drm_atomic_get_new_crtc_state - get new crtc state, if it exists ++ * @state: global atomic state object ++ * @crtc: crtc to grab ++ * ++ * This function returns the new crtc state for the given crtc, or ++ * NULL if the crtc is not part of the global atomic state. ++ */ ++static inline struct drm_crtc_state * ++drm_atomic_get_new_crtc_state(struct drm_atomic_state *state, ++ struct drm_crtc *crtc) ++{ ++ return state->crtcs[drm_crtc_index(crtc)].new_state; ++} ++ + /** + * drm_atomic_get_existing_plane_state - get plane state, if it exists + * @state: global atomic state object +@@ -250,13 +279,43 @@ drm_atomic_get_existing_plane_state(struct drm_atomic_state *state, + return state->planes[drm_plane_index(plane)].state; + } + ++/** ++ * drm_atomic_get_old_plane_state - get plane state, if it exists ++ * @state: global atomic state object ++ * @plane: plane to grab ++ * ++ * This function is deprecated, @drm_atomic_get_old_plane_state or ++ * @drm_atomic_get_new_plane_state should be used instead. ++ */ ++static inline struct drm_plane_state * ++drm_atomic_get_old_plane_state(struct drm_atomic_state *state, ++ struct drm_plane *plane) ++{ ++ return state->planes[drm_plane_index(plane)].old_state; ++} ++ ++/** ++ * drm_atomic_get_new_plane_state - get plane state, if it exists ++ * @state: global atomic state object ++ * @plane: plane to grab ++ * ++ * This function returns the new plane state for the given plane, or ++ * NULL if the plane is not part of the global atomic state. ++ */ ++static inline struct drm_plane_state * ++drm_atomic_get_new_plane_state(struct drm_atomic_state *state, ++ struct drm_plane *plane) ++{ ++ return state->planes[drm_plane_index(plane)].new_state; ++} ++ + /** + * drm_atomic_get_existing_connector_state - get connector state, if it exists + * @state: global atomic state object + * @connector: connector to grab + * +- * This function returns the connector state for the given connector, +- * or NULL if the connector is not part of the global atomic state. ++ * This function is deprecated, @drm_atomic_get_old_connector_state or ++ * @drm_atomic_get_new_connector_state should be used instead. + */ + static inline struct drm_connector_state * + drm_atomic_get_existing_connector_state(struct drm_atomic_state *state, +@@ -270,6 +329,46 @@ drm_atomic_get_existing_connector_state(struct drm_atomic_state *state, + return state->connectors[index].state; + } + ++/** ++ * drm_atomic_get_old_connector_state - get connector state, if it exists ++ * @state: global atomic state object ++ * @connector: connector to grab ++ * ++ * This function returns the old connector state for the given connector, ++ * or NULL if the connector is not part of the global atomic state. ++ */ ++static inline struct drm_connector_state * ++drm_atomic_get_old_connector_state(struct drm_atomic_state *state, ++ struct drm_connector *connector) ++{ ++ int index = drm_connector_index(connector); ++ ++ if (index >= state->num_connector) ++ return NULL; ++ ++ return state->connectors[index].old_state; ++} ++ ++/** ++ * drm_atomic_get_new_connector_state - get connector state, if it exists ++ * @state: global atomic state object ++ * @connector: connector to grab ++ * ++ * This function returns the new connector state for the given connector, ++ * or NULL if the connector is not part of the global atomic state. ++ */ ++static inline struct drm_connector_state * ++drm_atomic_get_new_connector_state(struct drm_atomic_state *state, ++ struct drm_connector *connector) ++{ ++ int index = drm_connector_index(connector); ++ ++ if (index >= state->num_connector) ++ return NULL; ++ ++ return state->connectors[index].new_state; ++} ++ + /** + * __drm_atomic_get_current_plane_state - get current plane state + * @state: global atomic state object +diff --git a/include/drm/drm_blend.h b/include/drm/drm_blend.h +index 36baa175de99..cf9e19178296 100644 +--- a/include/drm/drm_blend.h ++++ b/include/drm/drm_blend.h +@@ -25,28 +25,11 @@ + + #include + #include ++#include + + struct drm_device; + struct drm_atomic_state; + +-/* +- * Rotation property bits. DRM_ROTATE_ rotates the image by the +- * specified amount in degrees in counter clockwise direction. DRM_REFLECT_X and +- * DRM_REFLECT_Y reflects the image along the specified axis prior to rotation +- * +- * WARNING: These defines are UABI since they're exposed in the rotation +- * property. +- */ +-#define DRM_ROTATE_0 BIT(0) +-#define DRM_ROTATE_90 BIT(1) +-#define DRM_ROTATE_180 BIT(2) +-#define DRM_ROTATE_270 BIT(3) +-#define DRM_ROTATE_MASK (DRM_ROTATE_0 | DRM_ROTATE_90 | \ +- DRM_ROTATE_180 | DRM_ROTATE_270) +-#define DRM_REFLECT_X BIT(4) +-#define DRM_REFLECT_Y BIT(5) +-#define DRM_REFLECT_MASK (DRM_REFLECT_X | DRM_REFLECT_Y) +- + struct drm_property *drm_mode_create_rotation_property(struct drm_device *dev, + unsigned int supported_rotations); + unsigned int drm_rotation_simplify(unsigned int rotation, +diff --git a/include/drm/drm_client.h b/include/drm/drm_client.h +new file mode 100644 +index 000000000000..37b23affb3d1 +--- /dev/null ++++ b/include/drm/drm_client.h +@@ -0,0 +1,177 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++ ++#ifndef _DRM_CLIENT_H_ ++#define _DRM_CLIENT_H_ ++ ++#include ++#include ++#include ++ ++#include ++ ++struct drm_client_dev; ++struct drm_device; ++struct drm_file; ++struct drm_framebuffer; ++struct drm_gem_object; ++struct drm_minor; ++struct module; ++ ++/** ++ * struct drm_client_funcs - DRM client callbacks ++ */ ++struct drm_client_funcs { ++ /** ++ * @owner: The module owner ++ */ ++ struct module *owner; ++ ++ /** ++ * @unregister: ++ * ++ * Called when &drm_device is unregistered. The client should respond by ++ * releasing it's resources using drm_client_release(). ++ * ++ * This callback is optional. ++ */ ++ void (*unregister)(struct drm_client_dev *client); ++ ++ /** ++ * @restore: ++ * ++ * Called on drm_lastclose(). The first client instance in the list that ++ * returns zero gets the privilege to restore and no more clients are ++ * called. This callback is not called after @unregister has been called. ++ * ++ * This callback is optional. ++ */ ++ int (*restore)(struct drm_client_dev *client); ++ ++ /** ++ * @hotplug: ++ * ++ * Called on drm_kms_helper_hotplug_event(). ++ * This callback is not called after @unregister has been called. ++ * ++ * This callback is optional. ++ */ ++ int (*hotplug)(struct drm_client_dev *client); ++}; ++ ++/** ++ * struct drm_client_dev - DRM client instance ++ */ ++struct drm_client_dev { ++ /** ++ * @dev: DRM device ++ */ ++ struct drm_device *dev; ++ ++ /** ++ * @name: Name of the client. ++ */ ++ const char *name; ++ ++ /** ++ * @list: ++ * ++ * List of all clients of a DRM device, linked into ++ * &drm_device.clientlist. Protected by &drm_device.clientlist_mutex. ++ */ ++ struct list_head list; ++ ++ /** ++ * @funcs: DRM client functions (optional) ++ */ ++ const struct drm_client_funcs *funcs; ++ ++ /** ++ * @file: DRM file ++ */ ++ struct drm_file *file; ++ ++ /** ++ * @modeset_mutex: Protects @modesets. ++ */ ++ struct mutex modeset_mutex; ++ ++ /** ++ * @modesets: CRTC configurations ++ */ ++ struct drm_mode_set *modesets; ++}; ++ ++int drm_client_init(struct drm_device *dev, struct drm_client_dev *client, ++ const char *name, const struct drm_client_funcs *funcs); ++void drm_client_register(struct drm_client_dev *client); ++void drm_client_release(struct drm_client_dev *client); ++ ++void drm_client_dev_register(struct drm_device *dev); ++void drm_client_dev_unregister(struct drm_device *dev); ++void drm_client_dev_hotplug(struct drm_device *dev); ++void drm_client_dev_restore(struct drm_device *dev); ++ ++/** ++ * struct drm_client_buffer - DRM client buffer ++ */ ++struct drm_client_buffer { ++ /** ++ * @client: DRM client ++ */ ++ struct drm_client_dev *client; ++ ++ /** ++ * @handle: Buffer handle ++ */ ++ u32 handle; ++ ++ /** ++ * @pitch: Buffer pitch ++ */ ++ u32 pitch; ++ ++ /** ++ * @gem: GEM object backing this buffer ++ */ ++ struct drm_gem_object *gem; ++ ++ /** ++ * @vaddr: Virtual address for the buffer ++ */ ++ void *vaddr; ++ ++ /** ++ * @fb: DRM framebuffer ++ */ ++ struct drm_framebuffer *fb; ++}; ++ ++struct drm_client_buffer * ++drm_client_framebuffer_create(struct drm_client_dev *client, u32 width, u32 height, u32 format); ++void drm_client_framebuffer_delete(struct drm_client_buffer *buffer); ++void *drm_client_buffer_vmap(struct drm_client_buffer *buffer); ++void drm_client_buffer_vunmap(struct drm_client_buffer *buffer); ++ ++int drm_client_modeset_create(struct drm_client_dev *client); ++void drm_client_modeset_free(struct drm_client_dev *client); ++int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, unsigned int height); ++int drm_client_modeset_commit_force(struct drm_client_dev *client); ++int drm_client_modeset_commit(struct drm_client_dev *client); ++int drm_client_modeset_dpms(struct drm_client_dev *client, int mode); ++ ++#ifdef CONFIG_DRM_CLIENT_BOOTSPLASH ++void drm_bootsplash_client_register(struct drm_device *dev); ++#endif ++ ++/** ++ * drm_client_for_each_modeset() - Iterate over client modesets ++ * @modeset: &drm_mode_set loop cursor ++ * @client: DRM client ++ */ ++#define drm_client_for_each_modeset(modeset, client) \ ++ for (({ lockdep_assert_held(&(client)->modeset_mutex); }), \ ++ modeset = (client)->modesets; modeset->crtc; modeset++) ++ ++int drm_client_debugfs_init(struct drm_minor *minor); ++ ++#endif +diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h +index 0acf72e98c90..fd93e876bf0b 100644 +--- a/include/drm/drm_connector.h ++++ b/include/drm/drm_connector.h +@@ -497,6 +497,12 @@ struct drm_connector_funcs { + + /* mode specified on the command line */ + struct drm_cmdline_mode { ++ /** ++ * @name: ++ * ++ * Name of the mode. ++ */ ++ char name[DRM_DISPLAY_MODE_LEN]; + bool specified; + bool refresh_specified; + bool bpp_specified; +@@ -836,4 +842,17 @@ int drm_mode_connector_update_edid_property(struct drm_connector *connector, + &connector->head != (&(dev)->mode_config.connector_list); \ + connector = list_next_entry(connector, head)) + ++/** ++ * drm_connector_for_each_possible_encoder - iterate connector's possible encoders ++ * @connector: &struct drm_connector pointer ++ * @encoder: &struct drm_encoder pointer used as cursor ++ * @__i: int iteration cursor, for macro-internal use ++ */ ++#define drm_connector_for_each_possible_encoder(connector, encoder, __i) \ ++ for ((__i) = 0; (__i) < ARRAY_SIZE((connector)->encoder_ids) && \ ++ (connector)->encoder_ids[(__i)] != 0; (__i)++) \ ++ for_each_if((encoder) = \ ++ drm_encoder_find((connector)->dev, \ ++ (connector)->encoder_ids[(__i)])) \ ++ + #endif +diff --git a/include/drm/drm_framebuffer.h b/include/drm/drm_framebuffer.h +index f5ae1f436a4b..3111316070a8 100644 +--- a/include/drm/drm_framebuffer.h ++++ b/include/drm/drm_framebuffer.h +@@ -121,6 +121,12 @@ struct drm_framebuffer { + * @base: base modeset object structure, contains the reference count. + */ + struct drm_mode_object base; ++ ++ /** ++ * @comm: Name of the process allocating the fb, used for fb dumping. ++ */ ++ char comm[TASK_COMM_LEN]; ++ + /** + * @funcs: framebuffer vfunc table + */ +diff --git a/include/drm/drm_modes.h b/include/drm/drm_modes.h +index 2e44dadfdc84..0b496244d05c 100644 +--- a/include/drm/drm_modes.h ++++ b/include/drm/drm_modes.h +@@ -148,6 +148,12 @@ enum drm_mode_status { + + #define DRM_MODE_FLAG_3D_MAX DRM_MODE_FLAG_3D_SIDE_BY_SIDE_HALF + ++#define DRM_MODE_MATCH_TIMINGS (1 << 0) ++#define DRM_MODE_MATCH_CLOCK (1 << 1) ++#define DRM_MODE_MATCH_FLAGS (1 << 2) ++#define DRM_MODE_MATCH_3D_FLAGS (1 << 3) ++#define DRM_MODE_MATCH_ASPECT_RATIO (1 << 4) ++ + /** + * struct drm_display_mode - DRM kernel-internal display mode structure + * @hdisplay: horizontal display size +@@ -468,6 +474,9 @@ void drm_mode_copy(struct drm_display_mode *dst, + const struct drm_display_mode *src); + struct drm_display_mode *drm_mode_duplicate(struct drm_device *dev, + const struct drm_display_mode *mode); ++bool drm_mode_match(const struct drm_display_mode *mode1, ++ const struct drm_display_mode *mode2, ++ unsigned int match_flags); + bool drm_mode_equal(const struct drm_display_mode *mode1, + const struct drm_display_mode *mode2); + bool drm_mode_equal_no_clocks(const struct drm_display_mode *mode1, diff --git a/include/linux/acpi.h b/include/linux/acpi.h index 5670bb9788bb..192b045cc56e 100644 --- a/include/linux/acpi.h @@ -91168,6 +117820,32 @@ index 61650c1830d4..d830eddacdc6 100644 #endif #if GCC_VERSION < 30300 +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index d00e7b3bdaeb..77ac47cb8c77 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -233,6 +233,8 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); + (typeof(ptr)) (__ptr + (off)); }) + #endif + ++#define absolute_pointer(val) RELOC_HIDE((void *)(val), 0) ++ + #ifndef OPTIMIZER_HIDE_VAR + #define OPTIMIZER_HIDE_VAR(var) barrier() + #endif +diff --git a/include/linux/console.h b/include/linux/console.h +index d530c4627e54..118c33aa5ecf 100644 +--- a/include/linux/console.h ++++ b/include/linux/console.h +@@ -135,6 +135,8 @@ struct console { + short flags; + short index; + int cflag; ++ uint ispeed; ++ uint ospeed; + void *data; + struct console *next; + }; diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h index 6fd3c908a340..a30112ba06e4 100644 --- a/include/linux/console_struct.h @@ -91180,6 +117858,52 @@ index 6fd3c908a340..a30112ba06e4 100644 unsigned long vc_origin; /* [!] Start of real screen */ unsigned long vc_scr_end; /* [!] End of real screen */ unsigned long vc_visible_origin; /* [!] Top of visible window */ +diff --git a/include/linux/cred.h b/include/linux/cred.h +index 4f614042214b..09debf2e047f 100644 +--- a/include/linux/cred.h ++++ b/include/linux/cred.h +@@ -234,7 +234,7 @@ static inline struct cred *get_new_cred(struct cred *cred) + * @cred: The credentials to reference + * + * Get a reference on the specified set of credentials. The caller must +- * release the reference. ++ * release the reference. If %NULL is passed, it is returned with no action. + * + * This is used to deal with a committed set of credentials. Although the + * pointer is const, this will temporarily discard the const and increment the +@@ -245,6 +245,8 @@ static inline struct cred *get_new_cred(struct cred *cred) + static inline const struct cred *get_cred(const struct cred *cred) + { + struct cred *nonconst_cred = (struct cred *) cred; ++ if (!cred) ++ return cred; + validate_creds(cred); + nonconst_cred->non_rcu = 0; + return get_new_cred(nonconst_cred); +@@ -255,7 +257,7 @@ static inline const struct cred *get_cred(const struct cred *cred) + * @cred: The credentials to release + * + * Release a reference to a set of credentials, deleting them when the last ref +- * is released. ++ * is released. If %NULL is passed, nothing is done. + * + * This takes a const pointer to a set of credentials because the credentials + * on task_struct are attached by const pointers to prevent accidental +@@ -265,9 +267,11 @@ static inline void put_cred(const struct cred *_cred) + { + struct cred *cred = (struct cred *) _cred; + +- validate_creds(cred); +- if (atomic_dec_and_test(&(cred)->usage)) +- __put_cred(cred); ++ if (cred) { ++ validate_creds(cred); ++ if (atomic_dec_and_test(&(cred)->usage)) ++ __put_cred(cred); ++ } + } + + /** diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h index 2e75ae2d850b..a3e447ec56ea 100644 --- a/include/linux/debugfs.h @@ -91223,8 +117947,20 @@ index 2b37e89a85d2..715800a25a31 100644 /* * Definitions of return values from target end_io function. */ +diff --git a/include/linux/device.h b/include/linux/device.h +index 5ab43f42b0c0..d52c36f97e90 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -814,6 +814,7 @@ struct device { + struct dev_pin_info *pins; + #endif + #ifdef CONFIG_GENERIC_MSI_IRQ ++ raw_spinlock_t msi_lock; + struct list_head msi_list; + #endif + diff --git a/include/linux/diagchar.h b/include/linux/diagchar.h -index 2ccbda2ea186..b11e53d1f7d8 100644 +index 2ccbda2ea186..b1b47d7d723a 100644 --- a/include/linux/diagchar.h +++ b/include/linux/diagchar.h @@ -1,4 +1,4 @@ @@ -91240,7 +117976,7 @@ index 2ccbda2ea186..b11e53d1f7d8 100644 -#define MSG_MASK_TBL_CNT 26 -#define APPS_EVENT_LAST_ID 0xCC2 +#define MSG_MASK_TBL_CNT 27 -+#define APPS_EVENT_LAST_ID 0xCFA ++#define APPS_EVENT_LAST_ID 0xCFE #define MSG_SSID_0 0 #define MSG_SSID_0_LAST 134 @@ -91294,7 +118030,7 @@ index 2ccbda2ea186..b11e53d1f7d8 100644 static const uint32_t log_code_last_tbl[] = { 0x0, /* EQUIP ID 0 */ - 0x1CDD, /* EQUIP ID 1 */ -+ 0x1D5E, /* EQUIP ID 1 */ ++ 0x1D86, /* EQUIP ID 1 */ 0x0, /* EQUIP ID 2 */ 0x0, /* EQUIP ID 3 */ 0x4910, /* EQUIP ID 4 */ @@ -91328,14 +118064,14 @@ index 02c4f16685b6..69605956beb8 100644 extern void efi_late_init(void); extern void efi_free_boot_services(void); diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h -index 698d51a0eea3..4adf7faeaeb5 100644 +index 698d51a0eea3..a65dadad65bf 100644 --- a/include/linux/elfcore.h +++ b/include/linux/elfcore.h @@ -55,6 +55,7 @@ static inline int elf_core_copy_task_xfpregs(struct task_struct *t, elf_fpxregse } #endif -+#if defined(CONFIG_UM) || defined(CONFIG_IA64) ++#if (defined(CONFIG_UML) && defined(CONFIG_X86_32)) || defined(CONFIG_IA64) /* * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out * extra segments containing the gate DSO contents. Dumping its @@ -91392,6 +118128,38 @@ index a0e03b13b449..2aa32075bca1 100644 /* The last entry's state should be 0 */ struct adc_jack_cond *adc_conditions; +diff --git a/include/linux/file.h b/include/linux/file.h +index 7444f5feda12..d5baf7194fb0 100644 +--- a/include/linux/file.h ++++ b/include/linux/file.h +@@ -12,6 +12,7 @@ + struct file; + + extern void fput(struct file *); ++extern void fput_many(struct file *, unsigned int); + + struct file_operations; + struct vfsmount; +@@ -40,6 +41,7 @@ static inline void fdput(struct fd fd) + } + + extern struct file *fget(unsigned int fd); ++extern struct file *fget_many(unsigned int fd, unsigned int refs); + extern struct file *fget_raw(unsigned int fd); + extern unsigned long __fdget(unsigned int fd); + extern unsigned long __fdget_raw(unsigned int fd); +diff --git a/include/linux/filter.h b/include/linux/filter.h +index 69e8e1951eb2..ee4df9426fe3 100644 +--- a/include/linux/filter.h ++++ b/include/linux/filter.h +@@ -600,6 +600,7 @@ void bpf_warn_invalid_xdp_action(u32 act); + extern int bpf_jit_enable; + extern int bpf_jit_harden; + extern long bpf_jit_limit; ++extern long bpf_jit_limit_max; + + typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); + diff --git a/include/linux/font.h b/include/linux/font.h index d6821769dd1e..f85e70bd4793 100644 --- a/include/linux/font.h @@ -91415,10 +118183,21 @@ index d6821769dd1e..f85e70bd4793 100644 + #endif /* _VIDEO_FONT_H */ diff --git a/include/linux/fs.h b/include/linux/fs.h -index c3d2a2a09967..86c97fee70e0 100644 +index c3d2a2a09967..5acf88abdfa9 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h -@@ -1989,6 +1989,10 @@ static inline bool HAS_UNMAPPED_ID(struct inode *inode) +@@ -959,7 +959,9 @@ static inline struct file *get_file(struct file *f) + atomic_long_inc(&f->f_count); + return f; + } +-#define get_file_rcu(x) atomic_long_inc_not_zero(&(x)->f_count) ++#define get_file_rcu_many(x, cnt) \ ++ atomic_long_add_unless(&(x)->f_count, (cnt), 0) ++#define get_file_rcu(x) get_file_rcu_many((x), 1) + #define fput_atomic(x) atomic_long_add_unless(&(x)->f_count, -1, 1) + #define file_count(x) atomic_long_read(&(x)->f_count) + +@@ -1989,6 +1991,10 @@ static inline bool HAS_UNMAPPED_ID(struct inode *inode) * wb stat updates to grab mapping->tree_lock. See * inode_switch_wb_work_fn() for details. * @@ -91429,7 +118208,7 @@ index c3d2a2a09967..86c97fee70e0 100644 * Q: What is the difference between I_WILL_FREE and I_FREEING? */ #define I_DIRTY_SYNC (1 << 0) -@@ -2006,9 +2010,9 @@ static inline bool HAS_UNMAPPED_ID(struct inode *inode) +@@ -2006,9 +2012,9 @@ static inline bool HAS_UNMAPPED_ID(struct inode *inode) #define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP) #define I_LINKABLE (1 << 10) #define I_DIRTY_TIME (1 << 11) @@ -91543,7 +118322,7 @@ index 3c99fb6727ca..12a2f5ac51c9 100644 preempt_disable(); part->nr_sects = size; diff --git a/include/linux/hid.h b/include/linux/hid.h -index 877bb9aaca18..57d4a65b0fda 100644 +index 877bb9aaca18..67ef1abe5afa 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -248,6 +248,8 @@ struct hid_item { @@ -91555,7 +118334,30 @@ index 877bb9aaca18..57d4a65b0fda 100644 #define HID_CP_PLAYBACKSPEED 0x000c00f1 #define HID_CP_PROXIMITY 0x000c0109 #define HID_CP_SPEAKERSYSTEM 0x000c0160 -@@ -877,34 +879,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) { +@@ -763,6 +765,22 @@ struct hid_ll_driver { + int (*idle)(struct hid_device *hdev, int report, int idle, int reqtype); + }; + ++extern struct hid_ll_driver i2c_hid_ll_driver; ++extern struct hid_ll_driver hidp_hid_driver; ++extern struct hid_ll_driver uhid_hid_driver; ++extern struct hid_ll_driver usb_hid_driver; ++ ++static inline bool hid_is_using_ll_driver(struct hid_device *hdev, ++ struct hid_ll_driver *driver) ++{ ++ return hdev->ll_driver == driver; ++} ++ ++static inline bool hid_is_usb(struct hid_device *hdev) ++{ ++ return hid_is_using_ll_driver(hdev, &usb_hid_driver); ++} ++ + #define PM_HINT_FULLON 1<<5 + #define PM_HINT_NORMAL 1<<1 + +@@ -877,34 +895,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) { * @max: maximal valid usage->code to consider later (out parameter) * @type: input event type (EV_KEY, EV_REL, ...) * @c: code which corresponds to this usage and type @@ -91617,7 +118419,7 @@ index 877bb9aaca18..57d4a65b0fda 100644 } /** -@@ -918,7 +935,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput, +@@ -918,7 +951,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput, __u8 type, __u16 c) { hid_map_usage(hidinput, usage, bit, max, type, c); @@ -91627,7 +118429,7 @@ index 877bb9aaca18..57d4a65b0fda 100644 } /** -@@ -1112,8 +1130,7 @@ static inline void hid_hw_wait(struct hid_device *hdev) +@@ -1112,8 +1146,7 @@ static inline void hid_hw_wait(struct hid_device *hdev) */ static inline u32 hid_report_len(struct hid_report *report) { @@ -91651,7 +118453,7 @@ index 394a8405dd74..e0521a1d9325 100644 struct hil_mlc_devinfo { diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h -index 6b8a7b654771..6417bc845db5 100644 +index 6b8a7b654771..4b377186fddd 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -93,7 +93,7 @@ void free_huge_page(struct page *page); @@ -91681,7 +118483,19 @@ index 6b8a7b654771..6417bc845db5 100644 extern int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn); static inline bool hugepage_migration_supported(struct hstate *h) -@@ -502,6 +491,9 @@ static inline void hugetlb_count_sub(long l, struct mm_struct *mm) +@@ -493,6 +482,11 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h, + + void hugetlb_report_usage(struct seq_file *m, struct mm_struct *mm); + ++static inline void hugetlb_count_init(struct mm_struct *mm) ++{ ++ atomic_long_set(&mm->hugetlb_usage, 0); ++} ++ + static inline void hugetlb_count_add(long l, struct mm_struct *mm) + { + atomic_long_add(l, &mm->hugetlb_usage); +@@ -502,6 +496,9 @@ static inline void hugetlb_count_sub(long l, struct mm_struct *mm) { atomic_long_sub(l, &mm->hugetlb_usage); } @@ -91691,7 +118505,7 @@ index 6b8a7b654771..6417bc845db5 100644 #else /* CONFIG_HUGETLB_PAGE */ struct hstate {}; #define alloc_huge_page(v, a, r) NULL -@@ -526,10 +518,6 @@ static inline unsigned int pages_per_huge_page(struct hstate *h) +@@ -526,10 +523,6 @@ static inline unsigned int pages_per_huge_page(struct hstate *h) #define hstate_index_to_shift(index) 0 #define hstate_index(h) 0 @@ -91702,6 +118516,17 @@ index 6b8a7b654771..6417bc845db5 100644 #define dissolve_free_huge_pages(s, e) 0 #define hugepage_migration_supported(h) false +@@ -539,6 +532,10 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h, + return &mm->page_table_lock; + } + ++static inline void hugetlb_count_init(struct mm_struct *mm) ++{ ++} ++ + static inline void hugetlb_report_usage(struct seq_file *f, struct mm_struct *m) + { + } diff --git a/include/linux/i2c-algo-pca.h b/include/linux/i2c-algo-pca.h index a3c3ecd59f08..7a43afd27365 100644 --- a/include/linux/i2c-algo-pca.h @@ -91986,6 +118811,39 @@ index 58df02bd93c9..fa46183b163b 100644 #if defined(pgprot_noncached_wc) /* archs can't agree on a name ... */ iomap->prot = pgprot_noncached_wc(PAGE_KERNEL); #elif defined(pgprot_writecombine) +diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h +index 848e5796400e..325e7cbb3d32 100644 +--- a/include/linux/ipc_namespace.h ++++ b/include/linux/ipc_namespace.h +@@ -122,6 +122,16 @@ static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns) + return ns; + } + ++static inline struct ipc_namespace *get_ipc_ns_not_zero(struct ipc_namespace *ns) ++{ ++ if (ns) { ++ if (atomic_inc_not_zero(&ns->count)) ++ return ns; ++ } ++ ++ return NULL; ++} ++ + extern void put_ipc_ns(struct ipc_namespace *ns); + #else + static inline struct ipc_namespace *copy_ipcs(unsigned long flags, +@@ -138,6 +148,11 @@ static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns) + return ns; + } + ++static inline struct ipc_namespace *get_ipc_ns_not_zero(struct ipc_namespace *ns) ++{ ++ return ns; ++} ++ + static inline void put_ipc_ns(struct ipc_namespace *ns) + { + } diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h index 4eee852f5bc7..342e622f84a4 100755 --- a/include/linux/ipv6.h @@ -92120,10 +118978,19 @@ index 1e032a1ddb3e..60af12869ac7 100644 #endif /* _LINUX_KHUGEPAGED_H */ diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h -index cb527c78de9f..4db62045f01a 100644 +index cb527c78de9f..006ef813959b 100644 --- a/include/linux/kprobes.h +++ b/include/linux/kprobes.h -@@ -366,6 +366,10 @@ static inline struct kprobe_ctlblk *get_kprobe_ctlblk(void) +@@ -192,6 +192,8 @@ struct kretprobe { + raw_spinlock_t lock; + }; + ++#define KRETPROBE_MAX_DATA_SIZE 4096 ++ + struct kretprobe_instance { + struct hlist_node hlist; + struct kretprobe *rp; +@@ -366,6 +368,10 @@ static inline struct kprobe_ctlblk *get_kprobe_ctlblk(void) return this_cpu_ptr(&kprobe_ctlblk); } @@ -92177,7 +119044,7 @@ index bb4af1bfcaf4..05aa860daa5c 100644 static inline int memslot_id(struct kvm *kvm, gfn_t gfn) diff --git a/include/linux/libata.h b/include/linux/libata.h -index cdfb67b22317..3fabf57fd6e0 100644 +index cdfb67b22317..208534322bcd 100644 --- a/include/linux/libata.h +++ b/include/linux/libata.h @@ -38,6 +38,7 @@ @@ -92188,15 +119055,25 @@ index cdfb67b22317..3fabf57fd6e0 100644 /* * Define if arch has non-standard setup. This is a _PCI_ standard -@@ -434,6 +435,7 @@ enum { +@@ -403,7 +404,7 @@ enum { + /* This should match the actual table size of + * ata_eh_cmd_timeout_table in libata-eh.c. + */ +- ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 6, ++ ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 7, + + /* Horkage types. May be set by libata or controller on drives + (some horkage may be drive/controller pair dependent */ +@@ -434,6 +435,8 @@ enum { ATA_HORKAGE_NO_NCQ_LOG = (1 << 23), /* don't use NCQ for log read */ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */ + ATA_HORKAGE_MAX_TRIM_128M = (1 << 26), /* Limit max trim size to 128M */ ++ ATA_HORKAGE_NO_NCQ_ON_ATI = (1 << 27), /* Disable NCQ on ATI chipset */ /* DMA mask for user DMA control: User visible values; DO NOT renumber */ -@@ -497,6 +499,7 @@ enum hsm_task_states { +@@ -497,6 +500,7 @@ enum hsm_task_states { }; enum ata_completion_errors { @@ -92204,7 +119081,7 @@ index cdfb67b22317..3fabf57fd6e0 100644 AC_ERR_DEV = (1 << 0), /* device reported error */ AC_ERR_HSM = (1 << 1), /* host state machine violation */ AC_ERR_TIMEOUT = (1 << 2), /* timeout */ -@@ -878,6 +881,8 @@ struct ata_port { +@@ -878,6 +882,8 @@ struct ata_port { struct timer_list fastdrain_timer; unsigned long fastdrain_cnt; @@ -92213,7 +119090,7 @@ index cdfb67b22317..3fabf57fd6e0 100644 int em_message_type; void *private_data; -@@ -899,9 +904,9 @@ struct ata_port_operations { +@@ -899,9 +905,9 @@ struct ata_port_operations { /* * Command execution */ @@ -92226,7 +119103,7 @@ index cdfb67b22317..3fabf57fd6e0 100644 unsigned int (*qc_issue)(struct ata_queued_cmd *qc); bool (*qc_fill_rtf)(struct ata_queued_cmd *qc); -@@ -1164,7 +1169,7 @@ extern int ata_xfer_mode2shift(unsigned long xfer_mode); +@@ -1164,7 +1170,7 @@ extern int ata_xfer_mode2shift(unsigned long xfer_mode); extern const char *ata_mode_string(unsigned long xfer_mask); extern unsigned long ata_id_xfermask(const u16 *id); extern int ata_std_qc_defer(struct ata_queued_cmd *qc); @@ -92235,7 +119112,7 @@ index cdfb67b22317..3fabf57fd6e0 100644 extern void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg, unsigned int n_elem); extern unsigned int ata_dev_classify(const struct ata_taskfile *tf); -@@ -1877,9 +1882,9 @@ extern const struct ata_port_operations ata_bmdma_port_ops; +@@ -1877,9 +1883,9 @@ extern const struct ata_port_operations ata_bmdma_port_ops; .sg_tablesize = LIBATA_MAX_PRD, \ .dma_boundary = ATA_DMA_BOUNDARY @@ -92260,6 +119137,77 @@ index c373295f359f..cca606609e1b 100644 (1UL << (ilog2((n) - 1) + 1)) \ ) : \ __roundup_pow_of_two(n) \ +diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h +index f510c681378c..eff58ecc0182 100644 +--- a/include/linux/lsm_hooks.h ++++ b/include/linux/lsm_hooks.h +@@ -1147,22 +1147,22 @@ + * + * @binder_set_context_mgr + * Check whether @mgr is allowed to be the binder context manager. +- * @mgr contains the task_struct for the task being registered. ++ * @mgr contains the struct cred for the current binder process. + * Return 0 if permission is granted. + * @binder_transaction + * Check whether @from is allowed to invoke a binder transaction call + * to @to. +- * @from contains the task_struct for the sending task. +- * @to contains the task_struct for the receiving task. +- * @binder_transfer_binder ++ * @from contains the struct cred for the sending process. ++ * @to contains the struct cred for the receiving process. ++ * @binder_transfer_binder: + * Check whether @from is allowed to transfer a binder reference to @to. +- * @from contains the task_struct for the sending task. +- * @to contains the task_struct for the receiving task. +- * @binder_transfer_file ++ * @from contains the struct cred for the sending process. ++ * @to contains the struct cred for the receiving process. ++ * @binder_transfer_file: + * Check whether @from is allowed to transfer @file to @to. +- * @from contains the task_struct for the sending task. ++ * @from contains the struct cred for the sending process. + * @file contains the struct file being transferred. +- * @to contains the task_struct for the receiving task. ++ * @to contains the struct cred for the receiving process. + * + * @ptrace_access_check: + * Check permission before allowing the current process to trace the +@@ -1365,13 +1365,13 @@ + */ + + union security_list_options { +- int (*binder_set_context_mgr)(struct task_struct *mgr); +- int (*binder_transaction)(struct task_struct *from, +- struct task_struct *to); +- int (*binder_transfer_binder)(struct task_struct *from, +- struct task_struct *to); +- int (*binder_transfer_file)(struct task_struct *from, +- struct task_struct *to, ++ int (*binder_set_context_mgr)(const struct cred *mgr); ++ int (*binder_transaction)(const struct cred *from, ++ const struct cred *to); ++ int (*binder_transfer_binder)(const struct cred *from, ++ const struct cred *to); ++ int (*binder_transfer_file)(const struct cred *from, ++ const struct cred *to, + struct file *file); + + int (*ptrace_access_check)(struct task_struct *child, +diff --git a/include/linux/mdio.h b/include/linux/mdio.h +index bf9d1d750693..78b3cf50566f 100644 +--- a/include/linux/mdio.h ++++ b/include/linux/mdio.h +@@ -61,6 +61,9 @@ struct mdio_driver { + + /* Clears up any memory if needed */ + void (*remove)(struct mdio_device *mdiodev); ++ ++ /* Quiesces the device on system shutdown, turns off interrupts etc */ ++ void (*shutdown)(struct mdio_device *mdiodev); + }; + #define to_mdio_driver(d) \ + container_of(to_mdio_common_driver(d), struct mdio_driver, mdiodrv) diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 5fbbfa6ce1f2..4bd47d1cb78c 100644 --- a/include/linux/memcontrol.h @@ -92325,6 +119273,26 @@ index 67703f23e7ba..821a3b9bc16e 100644 /* Forward declaration */ struct ux500_charger; +diff --git a/include/linux/mfd/rt5033-private.h b/include/linux/mfd/rt5033-private.h +index 1b63fc2f42d1..52d53d134f72 100644 +--- a/include/linux/mfd/rt5033-private.h ++++ b/include/linux/mfd/rt5033-private.h +@@ -203,13 +203,13 @@ enum rt5033_reg { + #define RT5033_REGULATOR_BUCK_VOLTAGE_MIN 1000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_BUCK_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 21 + + /* RT5033 regulator LDO output voltage uV */ + #define RT5033_REGULATOR_LDO_VOLTAGE_MIN 1200000U + #define RT5033_REGULATOR_LDO_VOLTAGE_MAX 3000000U + #define RT5033_REGULATOR_LDO_VOLTAGE_STEP 100000U +-#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 32 ++#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 19 + + /* RT5033 regulator SAFE LDO output voltage uV */ + #define RT5033_REGULATOR_SAFE_LDO_VOLTAGE 4900000U diff --git a/include/linux/mmdebug.h b/include/linux/mmdebug.h index 451a811f48f2..d1fb3bbff37a 100644 --- a/include/linux/mmdebug.h @@ -92378,6 +119346,19 @@ index e717b8db7e94..f146244e7b6a 100644 void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx); bool __zone_watermark_ok(struct zone *z, unsigned int order, unsigned long mark, int classzone_idx, unsigned int alloc_flags, +diff --git a/include/linux/msi.h b/include/linux/msi.h +index debc8aa4ec19..601bff9fbbec 100644 +--- a/include/linux/msi.h ++++ b/include/linux/msi.h +@@ -133,7 +133,7 @@ void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg); + void pci_write_msi_msg(unsigned int irq, struct msi_msg *msg); + + u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag); +-u32 __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag); ++void __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag); + void pci_msi_mask_irq(struct irq_data *data); + void pci_msi_unmask_irq(struct irq_data *data); + diff --git a/include/linux/msm-sps.h b/include/linux/msm-sps.h index 8f2c2ee8a504..6b5c68184464 100644 --- a/include/linux/msm-sps.h @@ -92701,6 +119682,22 @@ index 0dfc605b3c6a..c953fd345f43 100644 return page_to_index(page); } +diff --git a/include/linux/pci.h b/include/linux/pci.h +index b9ac0ba81221..7563261bed88 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1552,8 +1552,9 @@ static inline int pci_enable_device(struct pci_dev *dev) { return -EIO; } + static inline void pci_disable_device(struct pci_dev *dev) { } + static inline int pci_assign_resource(struct pci_dev *dev, int i) + { return -EBUSY; } +-static inline int __pci_register_driver(struct pci_driver *drv, +- struct module *owner) ++static inline int __must_check __pci_register_driver(struct pci_driver *drv, ++ struct module *owner, ++ const char *mod_name) + { return 0; } + static inline int pci_register_driver(struct pci_driver *drv) + { return 0; } diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h index 667f7e89b2b5..664558fff07a 100644 --- a/include/linux/perf_event.h @@ -92714,6 +119711,19 @@ index 667f7e89b2b5..664558fff07a 100644 unsigned long offset; unsigned long size; unsigned int range : 1, +diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h +index 522757ac9cd4..890f53881fad 100644 +--- a/include/linux/power/max17042_battery.h ++++ b/include/linux/power/max17042_battery.h +@@ -75,7 +75,7 @@ enum max17042_register { + MAX17042_RelaxCFG = 0x2A, + MAX17042_MiscCFG = 0x2B, + MAX17042_TGAIN = 0x2C, +- MAx17042_TOFF = 0x2D, ++ MAX17042_TOFF = 0x2D, + MAX17042_CGAIN = 0x2E, + MAX17042_COFF = 0x2F, + diff --git a/include/linux/prandom.h b/include/linux/prandom.h new file mode 100644 index 000000000000..e20339c78a84 @@ -92961,7 +119971,7 @@ index 1fa0dc880bd7..01a1fb1826ca 100644 - #endif /* _LINUX_RANDOM_H */ diff --git a/include/linux/sched.h b/include/linux/sched.h -index 2794cd540218..8ee9240f612d 100755 +index 2794cd540218..c6875c615d7d 100755 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2041,6 +2041,8 @@ struct task_struct { @@ -92994,6 +120004,15 @@ index 2794cd540218..8ee9240f612d 100755 #ifdef CONFIG_HAVE_COPY_THREAD_TLS extern int copy_thread_tls(unsigned long, unsigned long, unsigned long, +@@ -3406,7 +3409,7 @@ static inline int thread_group_empty(struct task_struct *p) + * Protects ->fs, ->files, ->mm, ->group_info, ->comm, keyring + * subscriptions and synchronises with wait4(). Also used in procfs. Also + * pins the final release of task.io_context. Also protects ->cpuset and +- * ->cgroup.subsys[]. And ->vfork_done. ++ * ->cgroup.subsys[]. And ->vfork_done. And ->sysvshm.shm_clist. + * + * Nests both inside and outside of read_lock(&tasklist_lock). + * It must not be nested with write_lock_irq(&tasklist_lock), diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index 150aa102c861..cff944690e1e 100755 --- a/include/linux/sched/sysctl.h @@ -93006,6 +120025,64 @@ index 150aa102c861..cff944690e1e 100755 extern int sched_rr_timeslice; extern int sched_rr_handler(struct ctl_table *table, int write, +diff --git a/include/linux/security.h b/include/linux/security.h +index bfb1b749da64..c6ef76aec04c 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -185,13 +185,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) + extern int security_init(void); + + /* Security operations */ +-int security_binder_set_context_mgr(struct task_struct *mgr); +-int security_binder_transaction(struct task_struct *from, +- struct task_struct *to); +-int security_binder_transfer_binder(struct task_struct *from, +- struct task_struct *to); +-int security_binder_transfer_file(struct task_struct *from, +- struct task_struct *to, struct file *file); ++int security_binder_set_context_mgr(const struct cred *mgr); ++int security_binder_transaction(const struct cred *from, ++ const struct cred *to); ++int security_binder_transfer_binder(const struct cred *from, ++ const struct cred *to); ++int security_binder_transfer_file(const struct cred *from, ++ const struct cred *to, struct file *file); + int security_ptrace_access_check(struct task_struct *child, unsigned int mode); + int security_ptrace_traceme(struct task_struct *parent); + int security_capget(struct task_struct *target, +@@ -398,25 +398,25 @@ static inline int security_init(void) + return 0; + } + +-static inline int security_binder_set_context_mgr(struct task_struct *mgr) ++static inline int security_binder_set_context_mgr(const struct cred *mgr) + { + return 0; + } + +-static inline int security_binder_transaction(struct task_struct *from, +- struct task_struct *to) ++static inline int security_binder_transaction(const struct cred *from, ++ const struct cred *to) + { + return 0; + } + +-static inline int security_binder_transfer_binder(struct task_struct *from, +- struct task_struct *to) ++static inline int security_binder_transfer_binder(const struct cred *from, ++ const struct cred *to) + { + return 0; + } + +-static inline int security_binder_transfer_file(struct task_struct *from, +- struct task_struct *to, ++static inline int security_binder_transfer_file(const struct cred *from, ++ const struct cred *to, + struct file *file) + { + return 0; diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h index fb7eb9ccb1cd..d4c3c9bab582 100644 --- a/include/linux/seq_buf.h @@ -93051,8 +120128,84 @@ index ead97654c4e9..1613fe5c668e 100644 * } */ static inline void raw_write_seqcount_barrier(seqcount_t *s) +diff --git a/include/linux/shm.h b/include/linux/shm.h +index 04e881829625..9c8b942bd67f 100644 +--- a/include/linux/shm.h ++++ b/include/linux/shm.h +@@ -19,9 +19,18 @@ struct shmid_kernel /* private to the kernel */ + pid_t shm_lprid; + struct user_struct *mlock_user; + +- /* The task created the shm object. NULL if the task is dead. */ ++ /* ++ * The task created the shm object, for ++ * task_lock(shp->shm_creator) ++ */ + struct task_struct *shm_creator; +- struct list_head shm_clist; /* list by creator */ ++ ++ /* ++ * List by creator. task_lock(->shm_creator) required for read/write. ++ * If list_empty(), then the creator is dead already. ++ */ ++ struct list_head shm_clist; ++ struct ipc_namespace *ns; + }; + + /* shm_mode upper byte flags */ +diff --git a/include/linux/siphash.h b/include/linux/siphash.h +index bf21591a9e5e..0cda61855d90 100644 +--- a/include/linux/siphash.h ++++ b/include/linux/siphash.h +@@ -27,9 +27,7 @@ static inline bool siphash_key_is_zero(const siphash_key_t *key) + } + + u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key); +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key); +-#endif + + u64 siphash_1u64(const u64 a, const siphash_key_t *key); + u64 siphash_2u64(const u64 a, const u64 b, const siphash_key_t *key); +@@ -82,10 +80,9 @@ static inline u64 ___siphash_aligned(const __le64 *data, size_t len, + static inline u64 siphash(const void *data, size_t len, + const siphash_key_t *key) + { +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS +- if (!IS_ALIGNED((unsigned long)data, SIPHASH_ALIGNMENT)) ++ if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) || ++ !IS_ALIGNED((unsigned long)data, SIPHASH_ALIGNMENT)) + return __siphash_unaligned(data, len, key); +-#endif + return ___siphash_aligned(data, len, key); + } + +@@ -96,10 +93,8 @@ typedef struct { + + u32 __hsiphash_aligned(const void *data, size_t len, + const hsiphash_key_t *key); +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_unaligned(const void *data, size_t len, + const hsiphash_key_t *key); +-#endif + + u32 hsiphash_1u32(const u32 a, const hsiphash_key_t *key); + u32 hsiphash_2u32(const u32 a, const u32 b, const hsiphash_key_t *key); +@@ -135,10 +130,9 @@ static inline u32 ___hsiphash_aligned(const __le32 *data, size_t len, + static inline u32 hsiphash(const void *data, size_t len, + const hsiphash_key_t *key) + { +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS +- if (!IS_ALIGNED((unsigned long)data, HSIPHASH_ALIGNMENT)) ++ if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) || ++ !IS_ALIGNED((unsigned long)data, HSIPHASH_ALIGNMENT)) + return __hsiphash_unaligned(data, len, key); +-#endif + return ___hsiphash_aligned(data, len, key); + } + diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index fdde51a16c87..cc6d0d279ad4 100644 +index fdde51a16c87..9d5cd67ffa26 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1553,6 +1553,18 @@ static inline __u32 skb_queue_len(const struct sk_buff_head *list_) @@ -93074,6 +120227,15 @@ index fdde51a16c87..cc6d0d279ad4 100644 /** * __skb_queue_head_init - initialize non-spinlock portions of sk_buff_head * @list: queue to initialize +@@ -1605,7 +1617,7 @@ static inline void __skb_insert(struct sk_buff *newsk, + newsk->next = next; + newsk->prev = prev; + next->prev = prev->next = newsk; +- list->qlen++; ++ WRITE_ONCE(list->qlen, list->qlen + 1); + } + + static inline void __skb_queue_splice(const struct sk_buff_head *list, @@ -1756,7 +1768,7 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list) { struct sk_buff *next, *prev; @@ -93144,7 +120306,7 @@ index 4b743ac35396..9c8445f1af0c 100644 extern int spi_register_master(struct spi_master *master); extern int devm_spi_register_master(struct device *dev, diff --git a/include/linux/string.h b/include/linux/string.h -index c890bdfe296e..7c4cc7d6dcd9 100644 +index c890bdfe296e..f2a3dedccfe8 100644 --- a/include/linux/string.h +++ b/include/linux/string.h @@ -29,6 +29,10 @@ size_t strlcpy(char *, const char *, size_t); @@ -93158,6 +120320,43 @@ index c890bdfe296e..7c4cc7d6dcd9 100644 #ifndef __HAVE_ARCH_STRCAT extern char * strcat(char *, const char *); #endif +@@ -99,6 +103,36 @@ extern __kernel_size_t strcspn(const char *,const char *); + #ifndef __HAVE_ARCH_MEMSET + extern void * memset(void *,int,__kernel_size_t); + #endif ++ ++#ifndef __HAVE_ARCH_MEMSET16 ++extern void *memset16(uint16_t *, uint16_t, __kernel_size_t); ++#endif ++ ++#ifndef __HAVE_ARCH_MEMSET32 ++extern void *memset32(uint32_t *, uint32_t, __kernel_size_t); ++#endif ++ ++#ifndef __HAVE_ARCH_MEMSET64 ++extern void *memset64(uint64_t *, uint64_t, __kernel_size_t); ++#endif ++ ++static inline void *memset_l(unsigned long *p, unsigned long v, ++ __kernel_size_t n) ++{ ++ if (BITS_PER_LONG == 32) ++ return memset32((uint32_t *)p, v, n); ++ else ++ return memset64((uint64_t *)p, v, n); ++} ++ ++static inline void *memset_p(void **p, void *v, __kernel_size_t n) ++{ ++ if (BITS_PER_LONG == 32) ++ return memset32((uint32_t *)p, (uintptr_t)v, n); ++ else ++ return memset64((uint64_t *)p, (uintptr_t)v, n); ++} ++ + #ifndef __HAVE_ARCH_MEMCPY + extern void * memcpy(void *,const void *,__kernel_size_t); + #endif diff --git a/include/linux/sunrpc/gss_api.h b/include/linux/sunrpc/gss_api.h index 68ec78c1aa48..bd8480ae82e9 100644 --- a/include/linux/sunrpc/gss_api.h @@ -93533,6 +120732,18 @@ index bd25e8133db6..94caa5f9efdc 100644 int config_ep_by_speed(struct usb_gadget *g, struct usb_function *f, struct usb_ep *_ep); +diff --git a/include/linux/usb/otg-fsm.h b/include/linux/usb/otg-fsm.h +index 7a0350535cb1..603b298dc747 100644 +--- a/include/linux/usb/otg-fsm.h ++++ b/include/linux/usb/otg-fsm.h +@@ -210,6 +210,7 @@ struct otg_fsm { + struct mutex lock; + u8 *host_req_flag; + struct delayed_work hnp_polling_work; ++ bool hnp_work_inited; + bool state_changed; + }; + diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h index ea4f81c2a6d5..602dff213bae 100644 --- a/include/linux/usb/quirks.h @@ -93572,6 +120783,50 @@ index 584f9a647ad4..6b6c1138f963 100644 enum { VSOCK_VQ_RX = 0, /* for host to guest data */ +diff --git a/include/linux/wait.h b/include/linux/wait.h +index 2408e8d5c05c..e022ee95bd45 100644 +--- a/include/linux/wait.h ++++ b/include/linux/wait.h +@@ -202,6 +202,7 @@ void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, void *key); + void __wake_up_sync_key(wait_queue_head_t *q, unsigned int mode, int nr, void *key); + void __wake_up_locked(wait_queue_head_t *q, unsigned int mode, int nr); + void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr); ++void __wake_up_pollfree(wait_queue_head_t *wq_head); + void __wake_up_bit(wait_queue_head_t *, void *, int); + int __wait_on_bit(wait_queue_head_t *, struct wait_bit_queue *, wait_bit_action_f *, unsigned); + int __wait_on_bit_lock(wait_queue_head_t *, struct wait_bit_queue *, wait_bit_action_f *, unsigned); +@@ -236,6 +237,31 @@ wait_queue_head_t *bit_waitqueue(void *, int); + #define wake_up_interruptible_sync_poll(x, m) \ + __wake_up_sync_key((x), TASK_INTERRUPTIBLE, 1, (void *) (m)) + ++/** ++ * wake_up_pollfree - signal that a polled waitqueue is going away ++ * @wq_head: the wait queue head ++ * ++ * In the very rare cases where a ->poll() implementation uses a waitqueue whose ++ * lifetime is tied to a task rather than to the 'struct file' being polled, ++ * this function must be called before the waitqueue is freed so that ++ * non-blocking polls (e.g. epoll) are notified that the queue is going away. ++ * ++ * The caller must also RCU-delay the freeing of the wait_queue_head, e.g. via ++ * an explicit synchronize_rcu() or call_rcu(), or via SLAB_DESTROY_BY_RCU. ++ */ ++static inline void wake_up_pollfree(wait_queue_head_t *wq_head) ++{ ++ /* ++ * For performance reasons, we don't always take the queue lock here. ++ * Therefore, we might race with someone removing the last entry from ++ * the queue, and proceed while they still hold the queue lock. ++ * However, rcu_read_lock() is required to be held in such cases, so we ++ * can safely proceed with an RCU-delayed free. ++ */ ++ if (waitqueue_active(wq_head)) ++ __wake_up_pollfree(wq_head); ++} ++ + #define ___wait_cond_timeout(condition) \ + ({ \ + bool __cond = (condition); \ diff --git a/include/linux/xattr.h b/include/linux/xattr.h index e77605a0c8da..1b1c9bfd24e9 100644 --- a/include/linux/xattr.h @@ -93612,8 +120867,20 @@ index 335b85d94182..8e2362c6855e 100644 void ipv6_sock_ac_close(struct sock *sk); int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr); +diff --git a/include/net/af_unix.h b/include/net/af_unix.h +index fd60eccb59a6..79f2e1ccfcfb 100644 +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -8,6 +8,7 @@ + + void unix_inflight(struct user_struct *user, struct file *fp); + void unix_notinflight(struct user_struct *user, struct file *fp); ++void unix_destruct_scm(struct sk_buff *skb); + void unix_gc(void); + void wait_for_unix_gc(void); + struct sock *unix_get_socket(struct file *filp); diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h -index 57a7dba49d29..33db6c6d3fba 100644 +index 57a7dba49d29..819796fb9d46 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -512,6 +512,7 @@ struct hci_chan { @@ -93624,7 +120891,15 @@ index 57a7dba49d29..33db6c6d3fba 100644 }; struct hci_conn_params { -@@ -1250,16 +1251,34 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) +@@ -1027,6 +1028,7 @@ struct hci_dev *hci_alloc_dev(void); + void hci_free_dev(struct hci_dev *hdev); + int hci_register_dev(struct hci_dev *hdev); + void hci_unregister_dev(struct hci_dev *hdev); ++void hci_cleanup_dev(struct hci_dev *hdev); + int hci_suspend_dev(struct hci_dev *hdev); + int hci_resume_dev(struct hci_dev *hdev); + int hci_reset_dev(struct hci_dev *hdev); +@@ -1250,16 +1252,34 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status) conn->security_cfm_cb(conn, status); } @@ -93885,6 +121160,86 @@ index 96cc703abc4f..cfaa29c2d78d 100644 { struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? inet6_sk(skb->sk) : NULL; +diff --git a/include/net/llc.h b/include/net/llc.h +index 95e5ced4c133..18dfd3e49a69 100644 +--- a/include/net/llc.h ++++ b/include/net/llc.h +@@ -72,7 +72,9 @@ struct llc_sap { + static inline + struct hlist_head *llc_sk_dev_hash(struct llc_sap *sap, int ifindex) + { +- return &sap->sk_dev_hash[ifindex % LLC_SK_DEV_HASH_ENTRIES]; ++ u32 bucket = hash_32(ifindex, LLC_SK_DEV_HASH_BITS); ++ ++ return &sap->sk_dev_hash[bucket]; + } + + static inline +diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h +index c0f0a13ed818..49aa79c7b278 100644 +--- a/include/net/llc_pdu.h ++++ b/include/net/llc_pdu.h +@@ -15,9 +15,11 @@ + #include + + /* Lengths of frame formats */ +-#define LLC_PDU_LEN_I 4 /* header and 2 control bytes */ +-#define LLC_PDU_LEN_S 4 +-#define LLC_PDU_LEN_U 3 /* header and 1 control byte */ ++#define LLC_PDU_LEN_I 4 /* header and 2 control bytes */ ++#define LLC_PDU_LEN_S 4 ++#define LLC_PDU_LEN_U 3 /* header and 1 control byte */ ++/* header and 1 control byte and XID info */ ++#define LLC_PDU_LEN_U_XID (LLC_PDU_LEN_U + sizeof(struct llc_xid_info)) + /* Known SAP addresses */ + #define LLC_GLOBAL_SAP 0xFF + #define LLC_NULL_SAP 0x00 /* not network-layer visible */ +@@ -50,9 +52,10 @@ + #define LLC_PDU_TYPE_U_MASK 0x03 /* 8-bit control field */ + #define LLC_PDU_TYPE_MASK 0x03 + +-#define LLC_PDU_TYPE_I 0 /* first bit */ +-#define LLC_PDU_TYPE_S 1 /* first two bits */ +-#define LLC_PDU_TYPE_U 3 /* first two bits */ ++#define LLC_PDU_TYPE_I 0 /* first bit */ ++#define LLC_PDU_TYPE_S 1 /* first two bits */ ++#define LLC_PDU_TYPE_U 3 /* first two bits */ ++#define LLC_PDU_TYPE_U_XID 4 /* private type for detecting XID commands */ + + #define LLC_PDU_TYPE_IS_I(pdu) \ + ((!(pdu->ctrl_1 & LLC_PDU_TYPE_I_MASK)) ? 1 : 0) +@@ -230,9 +233,18 @@ static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb) + static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type, + u8 ssap, u8 dsap, u8 cr) + { +- const int hlen = type == LLC_PDU_TYPE_U ? 3 : 4; ++ int hlen = 4; /* default value for I and S types */ + struct llc_pdu_un *pdu; + ++ switch (type) { ++ case LLC_PDU_TYPE_U: ++ hlen = 3; ++ break; ++ case LLC_PDU_TYPE_U_XID: ++ hlen = 6; ++ break; ++ } ++ + skb_push(skb, hlen); + skb_reset_network_header(skb); + pdu = llc_pdu_un_hdr(skb); +@@ -374,7 +386,10 @@ static inline void llc_pdu_init_as_xid_cmd(struct sk_buff *skb, + xid_info->fmt_id = LLC_XID_FMT_ID; /* 0x81 */ + xid_info->type = svcs_supported; + xid_info->rw = rx_window << 1; /* size of receive window */ +- skb_put(skb, sizeof(struct llc_xid_info)); ++ ++ /* no need to push/put since llc_pdu_header_init() has already ++ * pushed 3 + 3 bytes ++ */ + } + + /** diff --git a/include/net/ndisc.h b/include/net/ndisc.h index 96c475bbc57b..db78894e8886 100644 --- a/include/net/ndisc.h @@ -93924,10 +121279,18 @@ index af1c5e7c7e94..b0905b2be9ad 100644 int sysctl_igmp_max_memberships; int sysctl_igmp_max_msf; diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h -index 87499b6b35d6..2ba054fe14ac 100644 +index 87499b6b35d6..3bcce1523894 100644 --- a/include/net/nfc/nci_core.h +++ b/include/net/nfc/nci_core.h -@@ -310,6 +310,7 @@ int nci_nfcc_loopback(struct nci_dev *ndev, void *data, size_t data_len, +@@ -42,6 +42,7 @@ enum nci_flag { + NCI_UP, + NCI_DATA_EXCHANGE, + NCI_DATA_EXCHANGE_TO, ++ NCI_UNREG, + }; + + /* NCI device states */ +@@ -310,6 +311,7 @@ int nci_nfcc_loopback(struct nci_dev *ndev, void *data, size_t data_len, struct sk_buff **resp); struct nci_hci_dev *nci_hci_allocate(struct nci_dev *ndev); @@ -93935,6 +121298,32 @@ index 87499b6b35d6..2ba054fe14ac 100644 int nci_hci_send_event(struct nci_dev *ndev, u8 gate, u8 event, const u8 *param, size_t param_len); int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate, +diff --git a/include/net/nl802154.h b/include/net/nl802154.h +index ddcee128f5d9..145acb8f2509 100644 +--- a/include/net/nl802154.h ++++ b/include/net/nl802154.h +@@ -19,6 +19,8 @@ + * + */ + ++#include ++ + #define NL802154_GENL_NAME "nl802154" + + enum nl802154_commands { +@@ -150,10 +152,9 @@ enum nl802154_attrs { + }; + + enum nl802154_iftype { +- /* for backwards compatibility TODO */ +- NL802154_IFTYPE_UNSPEC = -1, ++ NL802154_IFTYPE_UNSPEC = (~(__u32)0), + +- NL802154_IFTYPE_NODE, ++ NL802154_IFTYPE_NODE = 0, + NL802154_IFTYPE_MONITOR, + NL802154_IFTYPE_COORD, + diff --git a/include/net/red.h b/include/net/red.h index 3618cdfec884..117a3654d319 100644 --- a/include/net/red.h @@ -93988,10 +121377,24 @@ index 4113916cc1bb..af0745f316fe 100644 const struct nla_policy *slave_policy; int (*slave_validate)(struct nlattr *tb[], diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h -index 5b847e49f7e9..8890fd66021d 100644 +index 5b847e49f7e9..9799c300603a 100644 --- a/include/net/sctp/constants.h +++ b/include/net/sctp/constants.h -@@ -357,11 +357,13 @@ typedef enum { +@@ -344,8 +344,7 @@ typedef enum { + } sctp_scope_policy_t; + + /* Based on IPv4 scoping , +- * SCTP IPv4 unusable addresses: 0.0.0.0/8, 224.0.0.0/4, 198.18.0.0/24, +- * 192.88.99.0/24. ++ * SCTP IPv4 unusable addresses: 0.0.0.0/8, 224.0.0.0/4, 192.88.99.0/24. + * Also, RFC 8.4, non-unicast addresses are not considered valid SCTP + * addresses. + */ +@@ -353,15 +352,16 @@ typedef enum { + ((htonl(INADDR_BROADCAST) == a) || \ + ipv4_is_multicast(a) || \ + ipv4_is_zeronet(a) || \ +- ipv4_is_test_198(a) || \ ipv4_is_anycast_6to4(a)) /* Flags used for the bind address copy functions. */ @@ -94008,11 +121411,35 @@ index 5b847e49f7e9..8890fd66021d 100644 peer */ /* Reasons to retransmit. */ +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h +index b46133a41f55..c0707e9bd918 100644 +--- a/include/net/sctp/structs.h ++++ b/include/net/sctp/structs.h +@@ -470,7 +470,7 @@ struct sctp_af { + int saddr); + void (*from_sk) (union sctp_addr *, + struct sock *sk); +- void (*from_addr_param) (union sctp_addr *, ++ bool (*from_addr_param) (union sctp_addr *, + union sctp_addr_param *, + __be16 port, int iif); + int (*to_addr_param) (const union sctp_addr *, diff --git a/include/net/sock.h b/include/net/sock.h -index 7a57d6f55f1f..83dab256b8b5 100644 +index 7a57d6f55f1f..924c75b9d972 100644 --- a/include/net/sock.h +++ b/include/net/sock.h -@@ -785,6 +785,8 @@ static inline int sk_memalloc_socks(void) +@@ -421,8 +421,10 @@ struct sock { + __u32 sk_priority; + __u32 sk_mark; + kuid_t sk_uid; ++ spinlock_t sk_peer_lock; + struct pid *sk_peer_pid; + const struct cred *sk_peer_cred; ++ + long sk_rcvtimeo; + long sk_sndtimeo; + struct timer_list sk_timer; +@@ -785,6 +787,8 @@ static inline int sk_memalloc_socks(void) { return static_key_false(&memalloc_socks); } @@ -94021,7 +121448,7 @@ index 7a57d6f55f1f..83dab256b8b5 100644 #else static inline int sk_memalloc_socks(void) -@@ -792,6 +794,8 @@ static inline int sk_memalloc_socks(void) +@@ -792,6 +796,8 @@ static inline int sk_memalloc_socks(void) return 0; } @@ -94030,7 +121457,7 @@ index 7a57d6f55f1f..83dab256b8b5 100644 #endif static inline gfp_t sk_gfp_mask(const struct sock *sk, gfp_t gfp_mask) -@@ -1632,7 +1636,6 @@ static inline int sk_tx_queue_get(const struct sock *sk) +@@ -1632,7 +1638,6 @@ static inline int sk_tx_queue_get(const struct sock *sk) static inline void sk_set_socket(struct sock *sk, struct socket *sock) { @@ -94038,7 +121465,7 @@ index 7a57d6f55f1f..83dab256b8b5 100644 sk->sk_socket = sock; } -@@ -1685,7 +1688,8 @@ static inline u32 net_tx_rndhash(void) +@@ -1685,7 +1690,8 @@ static inline u32 net_tx_rndhash(void) static inline void sk_set_txhash(struct sock *sk) { @@ -94048,7 +121475,7 @@ index 7a57d6f55f1f..83dab256b8b5 100644 } static inline void sk_rethink_txhash(struct sock *sk) -@@ -1940,9 +1944,12 @@ static inline void sock_poll_wait(struct file *filp, +@@ -1940,9 +1946,12 @@ static inline void sock_poll_wait(struct file *filp, static inline void skb_set_hash_from_sk(struct sk_buff *skb, struct sock *sk) { @@ -94295,7 +121722,7 @@ index c2c6d28fde74..9a5978272f57 100644 wake_up(&stream->runtime->sleep); } diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 30f99ce4c6ce..8a70d38f1332 100644 +index 30f99ce4c6ce..0c7dd6dd2395 100644 --- a/include/target/target_core_base.h +++ b/include/target/target_core_base.h @@ -178,6 +178,10 @@ enum tcm_sense_reason_table { @@ -94309,6 +121736,26 @@ index 30f99ce4c6ce..8a70d38f1332 100644 #undef R }; +@@ -775,8 +779,9 @@ struct se_device { + atomic_long_t read_bytes; + atomic_long_t write_bytes; + /* Active commands on this virtual SE device */ +- atomic_t simple_cmds; +- atomic_t dev_ordered_sync; ++ atomic_t non_ordered; ++ bool ordered_sync_in_progress; ++ atomic_t delayed_cmd_count; + atomic_t dev_qf_count; + u32 export_count; + spinlock_t delayed_cmd_lock; +@@ -799,6 +804,7 @@ struct se_device { + struct list_head dev_tmr_list; + struct workqueue_struct *tmr_wq; + struct work_struct qf_work_queue; ++ struct work_struct delayed_cmd_work; + struct list_head delayed_cmd_list; + struct list_head state_list; + struct list_head qf_cmd_list; diff --git a/include/trace/events/target.h b/include/trace/events/target.h index 50fea660c0f8..d543e8b87e50 100644 --- a/include/trace/events/target.h @@ -94517,6 +121964,64 @@ index 7bd8783a590f..2cad62ed000c 100644 __entry->ino = inode->i_ino; __entry->state = inode->i_state; __entry->dirtied_when = inode->dirtied_when; +diff --git a/include/uapi/drm/drm_mode.h b/include/uapi/drm/drm_mode.h +index b420f2acbb3e..3850258e10e7 100644 +--- a/include/uapi/drm/drm_mode.h ++++ b/include/uapi/drm/drm_mode.h +@@ -126,6 +126,53 @@ extern "C" { + #define DRM_MODE_DIRTY_ON 1 + #define DRM_MODE_DIRTY_ANNOTATE 2 + ++/* ++ * DRM_MODE_ROTATE_ ++ * ++ * Signals that a drm plane is been rotated degrees in counter ++ * clockwise direction. ++ * ++ * This define is provided as a convenience, looking up the property id ++ * using the name->prop id lookup is the preferred method. ++ */ ++#define DRM_MODE_ROTATE_0 (1<<0) ++#define DRM_MODE_ROTATE_90 (1<<1) ++#define DRM_MODE_ROTATE_180 (1<<2) ++#define DRM_MODE_ROTATE_270 (1<<3) ++ ++/* ++ * DRM_MODE_ROTATE_MASK ++ * ++ * Bitmask used to look for drm plane rotations. ++ */ ++#define DRM_MODE_ROTATE_MASK (\ ++ DRM_MODE_ROTATE_0 | \ ++ DRM_MODE_ROTATE_90 | \ ++ DRM_MODE_ROTATE_180 | \ ++ DRM_MODE_ROTATE_270) ++ ++/* ++ * DRM_MODE_REFLECT_ ++ * ++ * Signals that the contents of a drm plane is reflected in the axis, ++ * in the same way as mirroring. ++ * ++ * This define is provided as a convenience, looking up the property id ++ * using the name->prop id lookup is the preferred method. ++ */ ++#define DRM_MODE_REFLECT_X (1<<4) ++#define DRM_MODE_REFLECT_Y (1<<5) ++ ++/* ++ * DRM_MODE_REFLECT_MASK ++ * ++ * Bitmask used to look for drm plane reflections. ++ */ ++#define DRM_MODE_REFLECT_MASK (\ ++ DRM_MODE_REFLECT_X | \ ++ DRM_MODE_REFLECT_Y) ++ ++ + struct drm_mode_modeinfo { + __u32 clock; + __u16 hdisplay; diff --git a/include/uapi/linux/bcache.h b/include/uapi/linux/bcache.h index 8562b1cb776b..3b92610502ca 100644 --- a/include/uapi/linux/bcache.h @@ -95649,6 +123154,23 @@ index 2817ca1c1ee5..b0e61994ecf5 100644 #include /* for __kernel_sa_family_t */ #include +diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h +index b67cfd8d3705..b3957261d351 100644 +--- a/include/uapi/linux/pci_regs.h ++++ b/include/uapi/linux/pci_regs.h +@@ -488,6 +488,12 @@ + #define PCI_EXP_DEVCTL_URRE 0x0008 /* Unsupported Request Reporting En. */ + #define PCI_EXP_DEVCTL_RELAX_EN 0x0010 /* Enable relaxed ordering */ + #define PCI_EXP_DEVCTL_PAYLOAD 0x00e0 /* Max_Payload_Size */ ++#define PCI_EXP_DEVCTL_PAYLOAD_128B 0x0000 /* 128 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_256B 0x0020 /* 256 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_512B 0x0040 /* 512 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_1024B 0x0060 /* 1024 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_2048B 0x0080 /* 2048 Bytes */ ++#define PCI_EXP_DEVCTL_PAYLOAD_4096B 0x00a0 /* 4096 Bytes */ + #define PCI_EXP_DEVCTL_EXT_TAG 0x0100 /* Extended Tag Field Enable */ + #define PCI_EXP_DEVCTL_PHANTOM 0x0200 /* Phantom Functions Enable */ + #define PCI_EXP_DEVCTL_AUX_PME 0x0400 /* Auxiliary Power PM Enable */ diff --git a/include/uapi/linux/pr.h b/include/uapi/linux/pr.h index 57d7c0f916b6..645ef3cf3dd0 100644 --- a/include/uapi/linux/pr.h @@ -95674,6 +123196,18 @@ index 4b25d2fc65aa..fc557cccb638 100644 #define QRTR_NODE_BCAST 0xffffffffu #define QRTR_PORT_CTRL 0xfffffffeu +diff --git a/include/uapi/linux/serial_reg.h b/include/uapi/linux/serial_reg.h +index b4c04842a8c0..bad5c56a78a2 100644 +--- a/include/uapi/linux/serial_reg.h ++++ b/include/uapi/linux/serial_reg.h +@@ -61,6 +61,7 @@ + * ST16C654: 8 16 56 60 8 16 32 56 PORT_16654 + * TI16C750: 1 16 32 56 xx xx xx xx PORT_16750 + * TI16C752: 8 16 56 60 8 16 32 56 ++ * OX16C950: 16 32 112 120 16 32 64 112 PORT_16C950 + * Tegra: 1 4 8 14 16 8 4 1 PORT_TEGRA + */ + #define UART_FCR_R_TRIG_00 0x00 diff --git a/include/uapi/linux/slatecom_interface.h b/include/uapi/linux/slatecom_interface.h new file mode 100644 index 000000000000..1caed8c42bf6 @@ -95896,6 +123430,364 @@ index 34b1379f9777..f9d8aac170fb 100644 } static inline void +diff --git a/include/xen/interface/io/ring.h b/include/xen/interface/io/ring.h +index 21f4fbd55e48..276b81cf0daf 100644 +--- a/include/xen/interface/io/ring.h ++++ b/include/xen/interface/io/ring.h +@@ -24,82 +24,79 @@ typedef unsigned int RING_IDX; + * A ring contains as many entries as will fit, rounded down to the nearest + * power of two (so we can mask with (size-1) to loop around). + */ +-#define __CONST_RING_SIZE(_s, _sz) \ +- (__RD32(((_sz) - offsetof(struct _s##_sring, ring)) / \ +- sizeof(((struct _s##_sring *)0)->ring[0]))) +- ++#define __CONST_RING_SIZE(_s, _sz) \ ++ (__RD32(((_sz) - offsetof(struct _s##_sring, ring)) / \ ++ sizeof(((struct _s##_sring *)0)->ring[0]))) + /* + * The same for passing in an actual pointer instead of a name tag. + */ +-#define __RING_SIZE(_s, _sz) \ +- (__RD32(((_sz) - (long)&(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0]))) ++#define __RING_SIZE(_s, _sz) \ ++ (__RD32(((_sz) - (long)(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0]))) + + /* + * Macros to make the correct C datatypes for a new kind of ring. + * + * To make a new ring datatype, you need to have two message structures, +- * let's say struct request, and struct response already defined. ++ * let's say request_t, and response_t already defined. + * + * In a header where you want the ring datatype declared, you then do: + * +- * DEFINE_RING_TYPES(mytag, struct request, struct response); ++ * DEFINE_RING_TYPES(mytag, request_t, response_t); + * + * These expand out to give you a set of types, as you can see below. + * The most important of these are: + * +- * struct mytag_sring - The shared ring. +- * struct mytag_front_ring - The 'front' half of the ring. +- * struct mytag_back_ring - The 'back' half of the ring. ++ * mytag_sring_t - The shared ring. ++ * mytag_front_ring_t - The 'front' half of the ring. ++ * mytag_back_ring_t - The 'back' half of the ring. + * + * To initialize a ring in your code you need to know the location and size + * of the shared memory area (PAGE_SIZE, for instance). To initialise + * the front half: + * +- * struct mytag_front_ring front_ring; +- * SHARED_RING_INIT((struct mytag_sring *)shared_page); +- * FRONT_RING_INIT(&front_ring, (struct mytag_sring *)shared_page, +- * PAGE_SIZE); ++ * mytag_front_ring_t front_ring; ++ * SHARED_RING_INIT((mytag_sring_t *)shared_page); ++ * FRONT_RING_INIT(&front_ring, (mytag_sring_t *)shared_page, PAGE_SIZE); + * + * Initializing the back follows similarly (note that only the front + * initializes the shared ring): + * +- * struct mytag_back_ring back_ring; +- * BACK_RING_INIT(&back_ring, (struct mytag_sring *)shared_page, +- * PAGE_SIZE); ++ * mytag_back_ring_t back_ring; ++ * BACK_RING_INIT(&back_ring, (mytag_sring_t *)shared_page, PAGE_SIZE); + */ + +-#define DEFINE_RING_TYPES(__name, __req_t, __rsp_t) \ +- \ +-/* Shared ring entry */ \ +-union __name##_sring_entry { \ +- __req_t req; \ +- __rsp_t rsp; \ +-}; \ +- \ +-/* Shared ring page */ \ +-struct __name##_sring { \ +- RING_IDX req_prod, req_event; \ +- RING_IDX rsp_prod, rsp_event; \ +- uint8_t pad[48]; \ +- union __name##_sring_entry ring[1]; /* variable-length */ \ +-}; \ +- \ +-/* "Front" end's private variables */ \ +-struct __name##_front_ring { \ +- RING_IDX req_prod_pvt; \ +- RING_IDX rsp_cons; \ +- unsigned int nr_ents; \ +- struct __name##_sring *sring; \ +-}; \ +- \ +-/* "Back" end's private variables */ \ +-struct __name##_back_ring { \ +- RING_IDX rsp_prod_pvt; \ +- RING_IDX req_cons; \ +- unsigned int nr_ents; \ +- struct __name##_sring *sring; \ +-}; +- ++#define DEFINE_RING_TYPES(__name, __req_t, __rsp_t) \ ++ \ ++/* Shared ring entry */ \ ++union __name##_sring_entry { \ ++ __req_t req; \ ++ __rsp_t rsp; \ ++}; \ ++ \ ++/* Shared ring page */ \ ++struct __name##_sring { \ ++ RING_IDX req_prod, req_event; \ ++ RING_IDX rsp_prod, rsp_event; \ ++ uint8_t __pad[48]; \ ++ union __name##_sring_entry ring[1]; /* variable-length */ \ ++}; \ ++ \ ++/* "Front" end's private variables */ \ ++struct __name##_front_ring { \ ++ RING_IDX req_prod_pvt; \ ++ RING_IDX rsp_cons; \ ++ unsigned int nr_ents; \ ++ struct __name##_sring *sring; \ ++}; \ ++ \ ++/* "Back" end's private variables */ \ ++struct __name##_back_ring { \ ++ RING_IDX rsp_prod_pvt; \ ++ RING_IDX req_cons; \ ++ unsigned int nr_ents; \ ++ struct __name##_sring *sring; \ ++}; \ ++ \ + /* + * Macros for manipulating rings. + * +@@ -116,105 +113,99 @@ struct __name##_back_ring { \ + */ + + /* Initialising empty rings */ +-#define SHARED_RING_INIT(_s) do { \ +- (_s)->req_prod = (_s)->rsp_prod = 0; \ +- (_s)->req_event = (_s)->rsp_event = 1; \ +- memset((_s)->pad, 0, sizeof((_s)->pad)); \ ++#define SHARED_RING_INIT(_s) do { \ ++ (_s)->req_prod = (_s)->rsp_prod = 0; \ ++ (_s)->req_event = (_s)->rsp_event = 1; \ ++ (void)memset((_s)->__pad, 0, sizeof((_s)->__pad)); \ + } while(0) + +-#define FRONT_RING_INIT(_r, _s, __size) do { \ +- (_r)->req_prod_pvt = 0; \ +- (_r)->rsp_cons = 0; \ +- (_r)->nr_ents = __RING_SIZE(_s, __size); \ +- (_r)->sring = (_s); \ ++#define FRONT_RING_ATTACH(_r, _s, _i, __size) do { \ ++ (_r)->req_prod_pvt = (_i); \ ++ (_r)->rsp_cons = (_i); \ ++ (_r)->nr_ents = __RING_SIZE(_s, __size); \ ++ (_r)->sring = (_s); \ + } while (0) + +-#define BACK_RING_INIT(_r, _s, __size) do { \ +- (_r)->rsp_prod_pvt = 0; \ +- (_r)->req_cons = 0; \ +- (_r)->nr_ents = __RING_SIZE(_s, __size); \ +- (_r)->sring = (_s); \ +-} while (0) ++#define FRONT_RING_INIT(_r, _s, __size) FRONT_RING_ATTACH(_r, _s, 0, __size) + +-/* Initialize to existing shared indexes -- for recovery */ +-#define FRONT_RING_ATTACH(_r, _s, __size) do { \ +- (_r)->sring = (_s); \ +- (_r)->req_prod_pvt = (_s)->req_prod; \ +- (_r)->rsp_cons = (_s)->rsp_prod; \ +- (_r)->nr_ents = __RING_SIZE(_s, __size); \ ++#define BACK_RING_ATTACH(_r, _s, _i, __size) do { \ ++ (_r)->rsp_prod_pvt = (_i); \ ++ (_r)->req_cons = (_i); \ ++ (_r)->nr_ents = __RING_SIZE(_s, __size); \ ++ (_r)->sring = (_s); \ + } while (0) + +-#define BACK_RING_ATTACH(_r, _s, __size) do { \ +- (_r)->sring = (_s); \ +- (_r)->rsp_prod_pvt = (_s)->rsp_prod; \ +- (_r)->req_cons = (_s)->req_prod; \ +- (_r)->nr_ents = __RING_SIZE(_s, __size); \ +-} while (0) ++#define BACK_RING_INIT(_r, _s, __size) BACK_RING_ATTACH(_r, _s, 0, __size) + + /* How big is this ring? */ +-#define RING_SIZE(_r) \ ++#define RING_SIZE(_r) \ + ((_r)->nr_ents) + + /* Number of free requests (for use on front side only). */ +-#define RING_FREE_REQUESTS(_r) \ ++#define RING_FREE_REQUESTS(_r) \ + (RING_SIZE(_r) - ((_r)->req_prod_pvt - (_r)->rsp_cons)) + + /* Test if there is an empty slot available on the front ring. + * (This is only meaningful from the front. ) + */ +-#define RING_FULL(_r) \ ++#define RING_FULL(_r) \ + (RING_FREE_REQUESTS(_r) == 0) + + /* Test if there are outstanding messages to be processed on a ring. */ +-#define RING_HAS_UNCONSUMED_RESPONSES(_r) \ ++#define RING_HAS_UNCONSUMED_RESPONSES(_r) \ + ((_r)->sring->rsp_prod - (_r)->rsp_cons) + +-#define RING_HAS_UNCONSUMED_REQUESTS(_r) \ +- ({ \ +- unsigned int req = (_r)->sring->req_prod - (_r)->req_cons; \ +- unsigned int rsp = RING_SIZE(_r) - \ +- ((_r)->req_cons - (_r)->rsp_prod_pvt); \ +- req < rsp ? req : rsp; \ +- }) ++#define RING_HAS_UNCONSUMED_REQUESTS(_r) ({ \ ++ unsigned int req = (_r)->sring->req_prod - (_r)->req_cons; \ ++ unsigned int rsp = RING_SIZE(_r) - \ ++ ((_r)->req_cons - (_r)->rsp_prod_pvt); \ ++ req < rsp ? req : rsp; \ ++}) + + /* Direct access to individual ring elements, by index. */ +-#define RING_GET_REQUEST(_r, _idx) \ ++#define RING_GET_REQUEST(_r, _idx) \ + (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req)) + ++#define RING_GET_RESPONSE(_r, _idx) \ ++ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp)) ++ + /* +- * Get a local copy of a request. ++ * Get a local copy of a request/response. + * +- * Use this in preference to RING_GET_REQUEST() so all processing is ++ * Use this in preference to RING_GET_{REQUEST,RESPONSE}() so all processing is + * done on a local copy that cannot be modified by the other end. + * + * Note that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 may cause this +- * to be ineffective where _req is a struct which consists of only bitfields. ++ * to be ineffective where dest is a struct which consists of only bitfields. + */ +-#define RING_COPY_REQUEST(_r, _idx, _req) do { \ +- /* Use volatile to force the copy into _req. */ \ +- *(_req) = *(volatile typeof(_req))RING_GET_REQUEST(_r, _idx); \ ++#define RING_COPY_(type, r, idx, dest) do { \ ++ /* Use volatile to force the copy into dest. */ \ ++ *(dest) = *(volatile typeof(dest))RING_GET_##type(r, idx); \ + } while (0) + +-#define RING_GET_RESPONSE(_r, _idx) \ +- (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp)) ++#define RING_COPY_REQUEST(r, idx, req) RING_COPY_(REQUEST, r, idx, req) ++#define RING_COPY_RESPONSE(r, idx, rsp) RING_COPY_(RESPONSE, r, idx, rsp) + + /* Loop termination condition: Would the specified index overflow the ring? */ +-#define RING_REQUEST_CONS_OVERFLOW(_r, _cons) \ ++#define RING_REQUEST_CONS_OVERFLOW(_r, _cons) \ + (((_cons) - (_r)->rsp_prod_pvt) >= RING_SIZE(_r)) + + /* Ill-behaved frontend determination: Can there be this many requests? */ +-#define RING_REQUEST_PROD_OVERFLOW(_r, _prod) \ ++#define RING_REQUEST_PROD_OVERFLOW(_r, _prod) \ + (((_prod) - (_r)->rsp_prod_pvt) > RING_SIZE(_r)) + ++/* Ill-behaved backend determination: Can there be this many responses? */ ++#define RING_RESPONSE_PROD_OVERFLOW(_r, _prod) \ ++ (((_prod) - (_r)->rsp_cons) > RING_SIZE(_r)) + +-#define RING_PUSH_REQUESTS(_r) do { \ +- virt_wmb(); /* back sees requests /before/ updated producer index */ \ +- (_r)->sring->req_prod = (_r)->req_prod_pvt; \ ++#define RING_PUSH_REQUESTS(_r) do { \ ++ virt_wmb(); /* back sees requests /before/ updated producer index */\ ++ (_r)->sring->req_prod = (_r)->req_prod_pvt; \ + } while (0) + +-#define RING_PUSH_RESPONSES(_r) do { \ +- virt_wmb(); /* front sees responses /before/ updated producer index */ \ +- (_r)->sring->rsp_prod = (_r)->rsp_prod_pvt; \ ++#define RING_PUSH_RESPONSES(_r) do { \ ++ virt_wmb(); /* front sees resps /before/ updated producer index */ \ ++ (_r)->sring->rsp_prod = (_r)->rsp_prod_pvt; \ + } while (0) + + /* +@@ -247,40 +238,40 @@ struct __name##_back_ring { \ + * field appropriately. + */ + +-#define RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(_r, _notify) do { \ +- RING_IDX __old = (_r)->sring->req_prod; \ +- RING_IDX __new = (_r)->req_prod_pvt; \ +- virt_wmb(); /* back sees requests /before/ updated producer index */ \ +- (_r)->sring->req_prod = __new; \ +- virt_mb(); /* back sees new requests /before/ we check req_event */ \ +- (_notify) = ((RING_IDX)(__new - (_r)->sring->req_event) < \ +- (RING_IDX)(__new - __old)); \ ++#define RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(_r, _notify) do { \ ++ RING_IDX __old = (_r)->sring->req_prod; \ ++ RING_IDX __new = (_r)->req_prod_pvt; \ ++ virt_wmb(); /* back sees requests /before/ updated producer index */\ ++ (_r)->sring->req_prod = __new; \ ++ virt_mb(); /* back sees new requests /before/ we check req_event */ \ ++ (_notify) = ((RING_IDX)(__new - (_r)->sring->req_event) < \ ++ (RING_IDX)(__new - __old)); \ + } while (0) + +-#define RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(_r, _notify) do { \ +- RING_IDX __old = (_r)->sring->rsp_prod; \ +- RING_IDX __new = (_r)->rsp_prod_pvt; \ +- virt_wmb(); /* front sees responses /before/ updated producer index */ \ +- (_r)->sring->rsp_prod = __new; \ +- virt_mb(); /* front sees new responses /before/ we check rsp_event */ \ +- (_notify) = ((RING_IDX)(__new - (_r)->sring->rsp_event) < \ +- (RING_IDX)(__new - __old)); \ ++#define RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(_r, _notify) do { \ ++ RING_IDX __old = (_r)->sring->rsp_prod; \ ++ RING_IDX __new = (_r)->rsp_prod_pvt; \ ++ virt_wmb(); /* front sees resps /before/ updated producer index */ \ ++ (_r)->sring->rsp_prod = __new; \ ++ virt_mb(); /* front sees new resps /before/ we check rsp_event */ \ ++ (_notify) = ((RING_IDX)(__new - (_r)->sring->rsp_event) < \ ++ (RING_IDX)(__new - __old)); \ + } while (0) + +-#define RING_FINAL_CHECK_FOR_REQUESTS(_r, _work_to_do) do { \ +- (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \ +- if (_work_to_do) break; \ +- (_r)->sring->req_event = (_r)->req_cons + 1; \ +- virt_mb(); \ +- (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \ ++#define RING_FINAL_CHECK_FOR_REQUESTS(_r, _work_to_do) do { \ ++ (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \ ++ if (_work_to_do) break; \ ++ (_r)->sring->req_event = (_r)->req_cons + 1; \ ++ virt_mb(); \ ++ (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \ + } while (0) + +-#define RING_FINAL_CHECK_FOR_RESPONSES(_r, _work_to_do) do { \ +- (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \ +- if (_work_to_do) break; \ +- (_r)->sring->rsp_event = (_r)->rsp_cons + 1; \ +- virt_mb(); \ +- (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \ ++#define RING_FINAL_CHECK_FOR_RESPONSES(_r, _work_to_do) do { \ ++ (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \ ++ if (_work_to_do) break; \ ++ (_r)->sring->rsp_event = (_r)->rsp_cons + 1; \ ++ virt_mb(); \ ++ (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \ + } while (0) + + #endif /* __XEN_PUBLIC_IO_RING_H__ */ diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h index 32b944b7cebd..ed9e7e3307b7 100644 --- a/include/xen/xenbus.h @@ -96002,6 +123894,263 @@ index fe41a63efed6..5606341e9efd 100644 .name = { .sysname = UTS_SYSNAME, .nodename = UTS_NODENAME, +diff --git a/ipc/shm.c b/ipc/shm.c +index 9c687cda9b0a..74e0f2af9998 100644 +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -90,6 +90,7 @@ static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp) + { + struct shmid_kernel *shp; + shp = container_of(ipcp, struct shmid_kernel, shm_perm); ++ WARN_ON(ns != shp->ns); + + if (shp->shm_nattch) { + shp->shm_perm.mode |= SHM_DEST; +@@ -180,10 +181,43 @@ static void shm_rcu_free(struct rcu_head *head) + ipc_rcu_free(head); + } + +-static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s) ++/* ++ * It has to be called with shp locked. ++ * It must be called before ipc_rmid() ++ */ ++static inline void shm_clist_rm(struct shmid_kernel *shp) + { +- list_del(&s->shm_clist); +- ipc_rmid(&shm_ids(ns), &s->shm_perm); ++ struct task_struct *creator; ++ ++ /* ensure that shm_creator does not disappear */ ++ rcu_read_lock(); ++ ++ /* ++ * A concurrent exit_shm may do a list_del_init() as well. ++ * Just do nothing if exit_shm already did the work ++ */ ++ if (!list_empty(&shp->shm_clist)) { ++ /* ++ * shp->shm_creator is guaranteed to be valid *only* ++ * if shp->shm_clist is not empty. ++ */ ++ creator = shp->shm_creator; ++ ++ task_lock(creator); ++ /* ++ * list_del_init() is a nop if the entry was already removed ++ * from the list. ++ */ ++ list_del_init(&shp->shm_clist); ++ task_unlock(creator); ++ } ++ rcu_read_unlock(); ++} ++ ++static inline void shm_rmid(struct shmid_kernel *s) ++{ ++ shm_clist_rm(s); ++ ipc_rmid(&shm_ids(s->ns), &s->shm_perm); + } + + +@@ -238,7 +272,7 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) + shm_file = shp->shm_file; + shp->shm_file = NULL; + ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT; +- shm_rmid(ns, shp); ++ shm_rmid(shp); + shm_unlock(shp); + if (!is_file_hugepages(shm_file)) + shmem_lock(shm_file, 0, shp->mlock_user); +@@ -259,10 +293,10 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) + * + * 2) sysctl kernel.shm_rmid_forced is set to 1. + */ +-static bool shm_may_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) ++static bool shm_may_destroy(struct shmid_kernel *shp) + { + return (shp->shm_nattch == 0) && +- (ns->shm_rmid_forced || ++ (shp->ns->shm_rmid_forced || + (shp->shm_perm.mode & SHM_DEST)); + } + +@@ -293,7 +327,7 @@ static void shm_close(struct vm_area_struct *vma) + shp->shm_lprid = task_tgid_vnr(current); + shp->shm_dtim = get_seconds(); + shp->shm_nattch--; +- if (shm_may_destroy(ns, shp)) ++ if (shm_may_destroy(shp)) + shm_destroy(ns, shp); + else + shm_unlock(shp); +@@ -314,10 +348,10 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data) + * + * As shp->* are changed under rwsem, it's safe to skip shp locking. + */ +- if (shp->shm_creator != NULL) ++ if (!list_empty(&shp->shm_clist)) + return 0; + +- if (shm_may_destroy(ns, shp)) { ++ if (shm_may_destroy(shp)) { + shm_lock_by_ptr(shp); + shm_destroy(ns, shp); + } +@@ -335,48 +369,97 @@ void shm_destroy_orphaned(struct ipc_namespace *ns) + /* Locking assumes this will only be called with task == current */ + void exit_shm(struct task_struct *task) + { +- struct ipc_namespace *ns = task->nsproxy->ipc_ns; +- struct shmid_kernel *shp, *n; ++ for (;;) { ++ struct shmid_kernel *shp; ++ struct ipc_namespace *ns; + +- if (list_empty(&task->sysvshm.shm_clist)) +- return; ++ task_lock(task); ++ ++ if (list_empty(&task->sysvshm.shm_clist)) { ++ task_unlock(task); ++ break; ++ } ++ ++ shp = list_first_entry(&task->sysvshm.shm_clist, struct shmid_kernel, ++ shm_clist); + +- /* +- * If kernel.shm_rmid_forced is not set then only keep track of +- * which shmids are orphaned, so that a later set of the sysctl +- * can clean them up. +- */ +- if (!ns->shm_rmid_forced) { +- down_read(&shm_ids(ns).rwsem); +- list_for_each_entry(shp, &task->sysvshm.shm_clist, shm_clist) +- shp->shm_creator = NULL; + /* +- * Only under read lock but we are only called on current +- * so no entry on the list will be shared. ++ * 1) Get pointer to the ipc namespace. It is worth to say ++ * that this pointer is guaranteed to be valid because ++ * shp lifetime is always shorter than namespace lifetime ++ * in which shp lives. ++ * We taken task_lock it means that shp won't be freed. + */ +- list_del(&task->sysvshm.shm_clist); +- up_read(&shm_ids(ns).rwsem); +- return; +- } ++ ns = shp->ns; + +- /* +- * Destroy all already created segments, that were not yet mapped, +- * and mark any mapped as orphan to cover the sysctl toggling. +- * Destroy is skipped if shm_may_destroy() returns false. +- */ +- down_write(&shm_ids(ns).rwsem); +- list_for_each_entry_safe(shp, n, &task->sysvshm.shm_clist, shm_clist) { +- shp->shm_creator = NULL; ++ /* ++ * 2) If kernel.shm_rmid_forced is not set then only keep track of ++ * which shmids are orphaned, so that a later set of the sysctl ++ * can clean them up. ++ */ ++ if (!ns->shm_rmid_forced) ++ goto unlink_continue; + +- if (shm_may_destroy(ns, shp)) { +- shm_lock_by_ptr(shp); +- shm_destroy(ns, shp); ++ /* ++ * 3) get a reference to the namespace. ++ * The refcount could be already 0. If it is 0, then ++ * the shm objects will be free by free_ipc_work(). ++ */ ++ ns = get_ipc_ns_not_zero(ns); ++ if (!ns) { ++unlink_continue: ++ list_del_init(&shp->shm_clist); ++ task_unlock(task); ++ continue; + } +- } + +- /* Remove the list head from any segments still attached. */ +- list_del(&task->sysvshm.shm_clist); +- up_write(&shm_ids(ns).rwsem); ++ /* ++ * 4) get a reference to shp. ++ * This cannot fail: shm_clist_rm() is called before ++ * ipc_rmid(), thus the refcount cannot be 0. ++ */ ++ WARN_ON(!ipc_rcu_getref(&shp->shm_perm)); ++ ++ /* ++ * 5) unlink the shm segment from the list of segments ++ * created by current. ++ * This must be done last. After unlinking, ++ * only the refcounts obtained above prevent IPC_RMID ++ * from destroying the segment or the namespace. ++ */ ++ list_del_init(&shp->shm_clist); ++ ++ task_unlock(task); ++ ++ /* ++ * 6) we have all references ++ * Thus lock & if needed destroy shp. ++ */ ++ down_write(&shm_ids(ns).rwsem); ++ shm_lock_by_ptr(shp); ++ /* ++ * rcu_read_lock was implicitly taken in shm_lock_by_ptr, it's ++ * safe to call ipc_rcu_putref here ++ */ ++ ipc_rcu_putref(&shp->shm_perm, shm_rcu_free); ++ ++ if (ipc_valid_object(&shp->shm_perm)) { ++ if (shm_may_destroy(shp)) ++ shm_destroy(ns, shp); ++ else ++ shm_unlock(shp); ++ } else { ++ /* ++ * Someone else deleted the shp from namespace ++ * idr/kht while we have waited. ++ * Just unlock and continue. ++ */ ++ shm_unlock(shp); ++ } ++ ++ up_write(&shm_ids(ns).rwsem); ++ put_ipc_ns(ns); /* paired with get_ipc_ns_not_zero */ ++ } + } + + static int shm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) +@@ -621,7 +704,11 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) + goto no_id; + } + ++ shp->ns = ns; ++ ++ task_lock(current); + list_add(&shp->shm_clist, ¤t->sysvshm.shm_clist); ++ task_unlock(current); + + /* + * shmid gets reported as "inode#" in /proc/pid/maps. +@@ -1270,7 +1357,8 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, + down_write(&shm_ids(ns).rwsem); + shp = shm_lock(ns, shmid); + shp->shm_nattch--; +- if (shm_may_destroy(ns, shp)) ++ ++ if (shm_may_destroy(shp)) + shm_destroy(ns, shp); + else + shm_unlock(shp); diff --git a/kernel/Makefile b/kernel/Makefile index 29071ac3c66b..f3a91fa080bf 100644 --- a/kernel/Makefile @@ -96191,6 +124340,28 @@ index a71ff9965cba..cd12d79d1b17 100644 } int audit_comparator(u32 left, u32 op, u32 right) +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index 8def8ae931d9..5c6f4cb9a6c2 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -212,6 +212,7 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off, + int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON); + int bpf_jit_harden __read_mostly; + long bpf_jit_limit __read_mostly; ++long bpf_jit_limit_max __read_mostly; + + static atomic_long_t bpf_jit_current; + +@@ -231,7 +232,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void) + static int __init bpf_jit_charge_init(void) + { + /* Only used as heuristic here to derive limit. */ +- bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2, ++ bpf_jit_limit_max = bpf_jit_alloc_exec_limit(); ++ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2, + PAGE_SIZE), LONG_MAX); + return 0; + } diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index b6e2bfd3491e..998f7466e69d 100644 --- a/kernel/bpf/hashtab.c @@ -96212,10 +124383,20 @@ index b6e2bfd3491e..998f7466e69d 100644 static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c -index 6039db3dcf02..770779d3cd1b 100644 +index 6039db3dcf02..22857ee8ce70 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c -@@ -73,6 +73,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr) +@@ -31,7 +31,8 @@ struct bpf_stack_map { + + static int prealloc_elems_and_freelist(struct bpf_stack_map *smap) + { +- u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size; ++ u64 elem_size = sizeof(struct stack_map_bucket) + ++ (u64)smap->map.value_size; + int err; + + smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries); +@@ -73,6 +74,8 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr) /* hash table size must be power of 2 */ n_buckets = roundup_pow_of_two(attr->max_entries); @@ -96245,10 +124426,64 @@ index 335c00209f74..78bdfbefd996 100644 default: reset_reg_range_values(regs, insn->dst_reg); diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index e3311fe8f526..464200954737 100644 +index e3311fe8f526..d15a6f454da3 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c -@@ -3710,6 +3710,10 @@ static int cgroup_rename(struct kernfs_node *kn, struct kernfs_node *new_parent, +@@ -1545,6 +1545,7 @@ static int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) + struct cgroup *dcgrp = &dst_root->cgrp; + struct cgroup_subsys *ss; + int ssid, i, ret; ++ u16 dfl_disable_ss_mask = 0; + + lockdep_assert_held(&cgroup_mutex); + +@@ -1561,8 +1562,28 @@ static int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) + /* can't move between two non-dummy roots either */ + if (ss->root != &cgrp_dfl_root && dst_root != &cgrp_dfl_root) + return -EBUSY; ++ ++ /* ++ * Collect ssid's that need to be disabled from default ++ * hierarchy. ++ */ ++ if (ss->root == &cgrp_dfl_root) ++ dfl_disable_ss_mask |= 1 << ssid; ++ + } while_each_subsys_mask(); + ++ if (dfl_disable_ss_mask) { ++ struct cgroup *scgrp = &cgrp_dfl_root.cgrp; ++ ++ /* ++ * Controllers from default hierarchy that need to be rebound ++ * are all disabled together in one go. ++ */ ++ cgrp_dfl_root.subsys_mask &= ~dfl_disable_ss_mask; ++ WARN_ON(cgroup_apply_control(scgrp)); ++ cgroup_finalize_control(scgrp, 0); ++ } ++ + do_each_subsys_mask(ss, ssid, ss_mask) { + struct cgroup_root *src_root = ss->root; + struct cgroup *scgrp = &src_root->cgrp; +@@ -1571,10 +1592,12 @@ static int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) + + WARN_ON(!css || cgroup_css(dcgrp, ss)); + +- /* disable from the source */ +- src_root->subsys_mask &= ~(1 << ssid); +- WARN_ON(cgroup_apply_control(scgrp)); +- cgroup_finalize_control(scgrp, 0); ++ if (src_root != &cgrp_dfl_root) { ++ /* disable from the source */ ++ src_root->subsys_mask &= ~(1 << ssid); ++ WARN_ON(cgroup_apply_control(scgrp)); ++ cgroup_finalize_control(scgrp, 0); ++ } + + /* rebind */ + RCU_INIT_POINTER(scgrp->subsys[ssid], NULL); +@@ -3710,6 +3733,10 @@ static int cgroup_rename(struct kernfs_node *kn, struct kernfs_node *new_parent, struct cgroup *cgrp = kn->priv; int ret; @@ -96259,7 +124494,7 @@ index e3311fe8f526..464200954737 100644 if (kernfs_type(kn) != KERNFS_DIR) return -ENOTDIR; if (kn->parent != new_parent) -@@ -5789,8 +5793,6 @@ int __init cgroup_init_early(void) +@@ -5789,8 +5816,6 @@ int __init cgroup_init_early(void) return 0; } @@ -96268,7 +124503,7 @@ index e3311fe8f526..464200954737 100644 /** * cgroup_init - cgroup initialization * -@@ -5848,12 +5850,8 @@ int __init cgroup_init(void) +@@ -5848,12 +5873,8 @@ int __init cgroup_init(void) * disabled flag and cftype registration needs kmalloc, * both of which aren't available during early_init. */ @@ -96282,7 +124517,7 @@ index e3311fe8f526..464200954737 100644 if (cgroup_ssid_no_v1(ssid)) printk(KERN_INFO "Disabling %s control group subsystem in v1 mounts\n", -@@ -6296,7 +6294,10 @@ static int __init cgroup_disable(char *str) +@@ -6296,7 +6317,10 @@ static int __init cgroup_disable(char *str) if (strcmp(token, ss->name) && strcmp(token, ss->legacy_name)) continue; @@ -96294,7 +124529,7 @@ index e3311fe8f526..464200954737 100644 } } return 1; -@@ -6479,12 +6480,8 @@ void cgroup_sk_alloc_disable(void) +@@ -6479,12 +6503,8 @@ void cgroup_sk_alloc_disable(void) void cgroup_sk_alloc(struct sock_cgroup_data *skcd) { @@ -96309,7 +124544,7 @@ index e3311fe8f526..464200954737 100644 return; } -@@ -6508,8 +6505,26 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd) +@@ -6508,8 +6528,26 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd) rcu_read_unlock(); } @@ -96530,7 +124765,7 @@ index a2b29b9bdfcb..000000000000 - return 0; -} diff --git a/kernel/events/core.c b/kernel/events/core.c -index 2854afbbc440..7a2d3a61a938 100644 +index 2854afbbc440..484db9cb7532 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -90,11 +90,11 @@ static void remote_function(void *data) @@ -96644,6 +124879,15 @@ index 2854afbbc440..7a2d3a61a938 100644 list_del(&filter->entry); kfree(filter); } +@@ -8271,7 +8283,7 @@ static void perf_event_addr_filters_apply(struct perf_event *event) + if (task == TASK_TOMBSTONE) + return; + +- mm = get_task_mm(event->ctx->task); ++ mm = get_task_mm(task); + if (!mm) + goto restart; + @@ -8285,7 +8297,7 @@ static void perf_event_addr_filters_apply(struct perf_event *event) * Adjust base offset if the filter is associated to a binary * that needs to be mapped: @@ -96851,10 +125095,18 @@ index c7b2cfc2aa13..14d111c3b371 100644 if (tsk->io_context) exit_io_context(tsk); diff --git a/kernel/fork.c b/kernel/fork.c -index 04e239cdcfaa..33b60de1b6f1 100644 +index 04e239cdcfaa..ff94c1ce0bf2 100644 --- a/kernel/fork.c +++ b/kernel/fork.c -@@ -1094,24 +1094,8 @@ static int wait_for_vfork_done(struct task_struct *child, +@@ -797,6 +797,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, + mm->pmd_huge_pte = NULL; + #endif + mm_init_uprobes_state(mm); ++ hugetlb_count_init(mm); + + if (current->mm) { + mm->flags = current->mm->flags & MMF_INIT_MASK; +@@ -1094,24 +1095,8 @@ static int wait_for_vfork_done(struct task_struct *child, * restoring the old one. . . * Eric Biederman 10 January 1998 */ @@ -96880,7 +125132,7 @@ index 04e239cdcfaa..33b60de1b6f1 100644 uprobe_free_utask(tsk); /* Get rid of any cached register state */ -@@ -1144,6 +1128,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm) +@@ -1144,6 +1129,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm) complete_vfork_done(tsk); } @@ -96899,7 +125151,7 @@ index 04e239cdcfaa..33b60de1b6f1 100644 /* * Allocate a new mm structure and copy contents from the * mm structure of the passed in task structure. -@@ -1856,14 +1852,8 @@ static __latent_entropy struct task_struct *copy_process( +@@ -1856,14 +1853,8 @@ static __latent_entropy struct task_struct *copy_process( #ifdef CONFIG_BLOCK p->plug = NULL; #endif @@ -96916,7 +125168,7 @@ index 04e239cdcfaa..33b60de1b6f1 100644 /* * sigaltstack should be cleared when sharing the same VM */ -@@ -1884,14 +1874,9 @@ static __latent_entropy struct task_struct *copy_process( +@@ -1884,14 +1875,9 @@ static __latent_entropy struct task_struct *copy_process( /* ok, now we should be set up.. */ p->pid = pid_nr(pid); if (clone_flags & CLONE_THREAD) { @@ -96931,7 +125183,7 @@ index 04e239cdcfaa..33b60de1b6f1 100644 p->group_leader = p; p->tgid = p->pid; } -@@ -1936,9 +1921,14 @@ static __latent_entropy struct task_struct *copy_process( +@@ -1936,9 +1922,14 @@ static __latent_entropy struct task_struct *copy_process( if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { p->real_parent = current->real_parent; p->parent_exec_id = current->parent_exec_id; @@ -99398,7 +127650,7 @@ index e4e5e98002fe..3f3bbae4cec3 100644 * Our parent (unbound workqueue) runs with elevated scheduling * priority. Avoid propagating that into the userspace child. diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index 1b75fb8c7735..51867a2e537f 100644 +index 1b75fb8c7735..fb2357d0dbc8 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -561,11 +561,12 @@ static void kprobe_optimizer(struct work_struct *work) @@ -99471,7 +127723,17 @@ index 1b75fb8c7735..51867a2e537f 100644 if (kretprobe_blacklist_size) { addr = kprobe_addr(&rp->kp); if (IS_ERR(addr)) -@@ -1987,6 +2016,9 @@ static void kill_kprobe(struct kprobe *p) +@@ -1870,6 +1899,9 @@ int register_kretprobe(struct kretprobe *rp) + } + } + ++ if (rp->data_size > KRETPROBE_MAX_DATA_SIZE) ++ return -E2BIG; ++ + rp->kp.pre_handler = pre_handler_kretprobe; + rp->kp.post_handler = NULL; + rp->kp.fault_handler = NULL; +@@ -1987,6 +2019,9 @@ static void kill_kprobe(struct kprobe *p) { struct kprobe *kp; @@ -99481,7 +127743,7 @@ index 1b75fb8c7735..51867a2e537f 100644 p->flags |= KPROBE_FLAG_GONE; if (kprobe_aggrprobe(p)) { /* -@@ -2004,6 +2036,14 @@ static void kill_kprobe(struct kprobe *p) +@@ -2004,6 +2039,14 @@ static void kill_kprobe(struct kprobe *p) * the original probed function (which will be freed soon) any more. */ arch_remove_kprobe(p); @@ -99496,7 +127758,7 @@ index 1b75fb8c7735..51867a2e537f 100644 } /* Disable one kprobe */ -@@ -2122,7 +2162,10 @@ static int kprobes_module_callback(struct notifier_block *nb, +@@ -2122,7 +2165,10 @@ static int kprobes_module_callback(struct notifier_block *nb, mutex_lock(&kprobe_mutex); for (i = 0; i < KPROBE_TABLE_SIZE; i++) { head = &kprobe_table[i]; @@ -99508,7 +127770,7 @@ index 1b75fb8c7735..51867a2e537f 100644 if (within_module_init((unsigned long)p->addr, mod) || (checkcore && within_module_core((unsigned long)p->addr, mod))) { -@@ -2133,6 +2176,7 @@ static int kprobes_module_callback(struct notifier_block *nb, +@@ -2133,6 +2179,7 @@ static int kprobes_module_callback(struct notifier_block *nb, */ kill_kprobe(p); } @@ -99639,6 +127901,19 @@ index 981ebe937264..2e709b5726bc 100644 if (worker->current_work != work) goto out_fast; +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 9f56e3fac795..05dd765e2cbc 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -695,7 +695,7 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass) + if (DEBUG_LOCKS_WARN_ON(!irqs_disabled())) + return NULL; + +- hlist_for_each_entry_rcu(class, hash_head, hash_entry) { ++ hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) { + if (class->key == key) { + /* + * Huh! same key, different name? Did someone trample diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c index 75d80809c48c..09bad6cbb95c 100644 --- a/kernel/locking/lockdep_proc.c @@ -100216,10 +128491,32 @@ index 6e855d2011e7..2c19594da84c 100644 .pidmap = { [ 0 ... PIDMAP_ENTRIES-1] = { ATOMIC_INIT(BITS_PER_PAGE), NULL } }, +diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c +index 0eab538841fd..64b91b8d4d84 100644 +--- a/kernel/pid_namespace.c ++++ b/kernel/pid_namespace.c +@@ -52,7 +52,7 @@ static struct kmem_cache *create_pid_cachep(int nr_ids) + snprintf(pcache->name, sizeof(pcache->name), "pid_%d", nr_ids); + cachep = kmem_cache_create(pcache->name, + sizeof(struct pid) + (nr_ids - 1) * sizeof(struct upid), +- 0, SLAB_HWCACHE_ALIGN, NULL); ++ 0, SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, NULL); + if (cachep == NULL) + goto err_cachep; + diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index 3c775d6b7317..7b393faf930f 100644 +index 3c775d6b7317..e938fd8db056 100644 --- a/kernel/power/hibernate.c +++ b/kernel/power/hibernate.c +@@ -672,7 +672,7 @@ static int load_image_and_restore(void) + goto Unlock; + + error = swsusp_read(&flags); +- swsusp_close(FMODE_READ); ++ swsusp_close(FMODE_READ | FMODE_EXCL); + if (!error) + hibernation_restore(flags & SF_PLATFORM_MODE); + @@ -834,17 +834,6 @@ static int software_resume(void) /* Check if the device is there */ @@ -100238,6 +128535,49 @@ index 3c775d6b7317..7b393faf930f 100644 if (!swsusp_resume_device) { /* * Some device discovery might still be in progress; we need +@@ -877,7 +866,7 @@ static int software_resume(void) + /* The snapshot device should not be opened while we're running */ + if (!atomic_add_unless(&snapshot_device_available, -1, 0)) { + error = -EBUSY; +- swsusp_close(FMODE_READ); ++ swsusp_close(FMODE_READ | FMODE_EXCL); + goto Unlock; + } + +@@ -911,7 +900,7 @@ static int software_resume(void) + pr_debug("PM: Hibernation image not present or could not be loaded.\n"); + return error; + Close_Finish: +- swsusp_close(FMODE_READ); ++ swsusp_close(FMODE_READ | FMODE_EXCL); + goto Finish; + } + +diff --git a/kernel/power/swap.c b/kernel/power/swap.c +index 1f6aef2e2131..479df28ab137 100644 +--- a/kernel/power/swap.c ++++ b/kernel/power/swap.c +@@ -1530,9 +1530,10 @@ int swsusp_read(unsigned int *flags_p) + int swsusp_check(void) + { + int error; ++ void *holder; + + hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device, +- FMODE_READ, NULL); ++ FMODE_READ | FMODE_EXCL, &holder); + if (!IS_ERR(hib_resume_bdev)) { + set_blocksize(hib_resume_bdev, PAGE_SIZE); + clear_page(swsusp_header); +@@ -1556,7 +1557,7 @@ int swsusp_check(void) + + put: + if (error) +- blkdev_put(hib_resume_bdev, FMODE_READ); ++ blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL); + else + pr_debug("PM: Image signature found, resuming\n"); + } else { diff --git a/kernel/printk/nmi.c b/kernel/printk/nmi.c index 2c3e7f024c15..7a50b405ad28 100644 --- a/kernel/printk/nmi.c @@ -100294,19 +128634,88 @@ index 2c3e7f024c15..7a50b405ad28 100644 } diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index 96592f1192b3..9c0a09a35289 100644 +index 96592f1192b3..fcccd337dd8b 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c -@@ -2044,6 +2044,9 @@ static int __init console_setup(char *str) +@@ -2044,6 +2044,16 @@ static int __init console_setup(char *str) char *s, *options, *brl_options = NULL; int idx; -+ if (str[0] == 0) ++ /* ++ * console="" or console=null have been suggested as a way to ++ * disable console output. Use ttynull that has been created ++ * for exacly this purpose. ++ */ ++ if (str[0] == 0 || strcmp(str, "null") == 0) { ++ __add_preferred_console("ttynull", 0, NULL, NULL); + return 1; ++ } + if (_braille_console_setup(&str, &brl_options)) return 1; +diff --git a/kernel/profile.c b/kernel/profile.c +index 2dbccf2d806c..9c78e3ab4b42 100644 +--- a/kernel/profile.c ++++ b/kernel/profile.c +@@ -38,7 +38,8 @@ struct profile_hit { + #define NR_PROFILE_GRP (NR_PROFILE_HIT/PROFILE_GRPSZ) + + static atomic_t *prof_buffer; +-static unsigned long prof_len, prof_shift; ++static unsigned long prof_len; ++static unsigned short int prof_shift; + + int prof_on __read_mostly; + EXPORT_SYMBOL_GPL(prof_on); +@@ -64,8 +65,8 @@ int profile_setup(char *str) + if (str[strlen(sleepstr)] == ',') + str += strlen(sleepstr) + 1; + if (get_option(&str, &par)) +- prof_shift = par; +- pr_info("kernel sleep profiling enabled (shift: %ld)\n", ++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); ++ pr_info("kernel sleep profiling enabled (shift: %u)\n", + prof_shift); + #else + pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n"); +@@ -75,21 +76,21 @@ int profile_setup(char *str) + if (str[strlen(schedstr)] == ',') + str += strlen(schedstr) + 1; + if (get_option(&str, &par)) +- prof_shift = par; +- pr_info("kernel schedule profiling enabled (shift: %ld)\n", ++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); ++ pr_info("kernel schedule profiling enabled (shift: %u)\n", + prof_shift); + } else if (!strncmp(str, kvmstr, strlen(kvmstr))) { + prof_on = KVM_PROFILING; + if (str[strlen(kvmstr)] == ',') + str += strlen(kvmstr) + 1; + if (get_option(&str, &par)) +- prof_shift = par; +- pr_info("kernel KVM profiling enabled (shift: %ld)\n", ++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); ++ pr_info("kernel KVM profiling enabled (shift: %u)\n", + prof_shift); + } else if (get_option(&str, &par)) { +- prof_shift = par; ++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); + prof_on = CPU_PROFILING; +- pr_info("kernel profiling enabled (shift: %ld)\n", ++ pr_info("kernel profiling enabled (shift: %u)\n", + prof_shift); + } + return 1; +@@ -465,7 +466,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos) + unsigned long p = *ppos; + ssize_t read; + char *pnt; +- unsigned int sample_step = 1 << prof_shift; ++ unsigned long sample_step = 1UL << prof_shift; + + profile_flip_buffers(); + if (p >= (prof_len+1)*sizeof(unsigned int)) diff --git a/kernel/ptrace.c b/kernel/ptrace.c index ea3370e205fb..4f10223bc7b0 100644 --- a/kernel/ptrace.c @@ -100397,10 +128806,20 @@ index 5034cb3a339f..3623ad9b529c 100644 } diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index e6bfa9af3570..02a799e2a707 100755 +index e6bfa9af3570..1e7203e61b22 100755 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c -@@ -3933,7 +3933,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio) +@@ -1943,6 +1943,9 @@ void wake_up_if_idle(int cpu) + + bool cpus_share_cache(int this_cpu, int that_cpu) + { ++ if (this_cpu == that_cpu) ++ return true; ++ + return per_cpu(sd_llc_id, this_cpu) == per_cpu(sd_llc_id, that_cpu); + } + #endif /* CONFIG_SMP */ +@@ -3933,7 +3936,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio) if (dl_prio(prio)) { struct task_struct *pi_task = rt_mutex_get_top_task(p); if (!dl_prio(p->normal_prio) || @@ -100410,7 +128829,7 @@ index e6bfa9af3570..02a799e2a707 100755 p->dl.dl_boosted = 1; queue_flag |= ENQUEUE_REPLENISH; } else -@@ -9074,8 +9075,9 @@ int sched_rr_handler(struct ctl_table *table, int write, +@@ -9074,8 +9078,9 @@ int sched_rr_handler(struct ctl_table *table, int write, /* make sure that internally we keep jiffies */ /* also, writing zero resets timeslice to default */ if (!ret && write) { @@ -100422,6 +128841,64 @@ index e6bfa9af3570..02a799e2a707 100755 } mutex_unlock(&mutex); return ret; +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index cfe4f40d5819..3c8a2a7f5d61 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -686,9 +686,17 @@ static struct attribute *sugov_attributes[] = { + NULL + }; + ++static void sugov_tunables_free(struct kobject *kobj) ++{ ++ struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj); ++ ++ kfree(to_sugov_tunables(attr_set)); ++} ++ + static struct kobj_type sugov_tunables_ktype = { + .default_attrs = sugov_attributes, + .sysfs_ops = &governor_sysfs_ops, ++ .release = &sugov_tunables_free, + }; + + /********************** cpufreq governor interface *********************/ +@@ -801,12 +809,10 @@ static void sugov_tunables_save(struct cpufreq_policy *policy, + cached->down_rate_limit_us = tunables->down_rate_limit_us; + } + +-static void sugov_tunables_free(struct sugov_tunables *tunables) ++static void sugov_clear_global_tunables(void) + { + if (!have_governor_per_policy()) + global_tunables = NULL; +- +- kfree(tunables); + } + + static void sugov_tunables_restore(struct cpufreq_policy *policy) +@@ -895,7 +901,7 @@ static int sugov_init(struct cpufreq_policy *policy) + + fail: + policy->governor_data = NULL; +- sugov_tunables_free(tunables); ++ sugov_clear_global_tunables(); + + stop_kthread: + sugov_kthread_stop(sg_policy); +@@ -922,10 +928,8 @@ static void sugov_exit(struct cpufreq_policy *policy) + + count = gov_attr_set_put(&tunables->attr_set, &sg_policy->tunables_hook); + policy->governor_data = NULL; +- if (!count) { +- sugov_tunables_save(policy, tunables); +- sugov_tunables_free(tunables); +- } ++ if (!count) ++ sugov_clear_global_tunables(); + + mutex_unlock(&global_tunables_lock); + diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index dc669e370ee5..73bb0233e6a7 100755 --- a/kernel/sched/fair.c @@ -100482,6 +128959,32 @@ index 4e56c0859a5e..026a471bf59a 100755 static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun); +diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c +index 9453efe9b25a..133afaf05c3f 100644 +--- a/kernel/sched/wait.c ++++ b/kernel/sched/wait.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + + void __init_waitqueue_head(wait_queue_head_t *q, const char *name, struct lock_class_key *key) + { +@@ -156,6 +157,13 @@ void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr_exclusive) + } + EXPORT_SYMBOL_GPL(__wake_up_sync); /* For internal use only */ + ++void __wake_up_pollfree(wait_queue_head_t *wq_head) ++{ ++ __wake_up(wq_head, TASK_NORMAL, 0, (void *)(POLLHUP | POLLFREE)); ++ /* POLLFREE must have cleared the queue. */ ++ WARN_ON_ONCE(waitqueue_active(wq_head)); ++} ++ + /* + * Note: we use "set_current_state()" _after_ the wait-queue add, + * because we need a memory barrier there on SMP, so that any diff --git a/kernel/seccomp.c b/kernel/seccomp.c index 3975856d476c..ac56ebffeb95 100644 --- a/kernel/seccomp.c @@ -100495,8 +128998,54 @@ index 3975856d476c..ac56ebffeb95 100644 } #endif +diff --git a/kernel/signal.c b/kernel/signal.c +index d7535f16209f..efb77a8a9cd9 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -1841,16 +1841,6 @@ static inline int may_ptrace_stop(void) + return 1; + } + +-/* +- * Return non-zero if there is a SIGKILL that should be waking us up. +- * Called with the siglock held. +- */ +-static int sigkill_pending(struct task_struct *tsk) +-{ +- return sigismember(&tsk->pending.signal, SIGKILL) || +- sigismember(&tsk->signal->shared_pending.signal, SIGKILL); +-} +- + /* + * This must be called with current->sighand->siglock held. + * +@@ -1876,15 +1866,10 @@ static void ptrace_stop(int exit_code, int why, int clear_code, siginfo_t *info) + * calling arch_ptrace_stop, so we must release it now. + * To preserve proper semantics, we must do this before + * any signal bookkeeping like checking group_stop_count. +- * Meanwhile, a SIGKILL could come in before we retake the +- * siglock. That must prevent us from sleeping in TASK_TRACED. +- * So after regaining the lock, we must check for SIGKILL. + */ + spin_unlock_irq(¤t->sighand->siglock); + arch_ptrace_stop(exit_code, info); + spin_lock_irq(¤t->sighand->siglock); +- if (sigkill_pending(current)) +- return; + } + + /* +@@ -1893,6 +1878,8 @@ static void ptrace_stop(int exit_code, int why, int clear_code, siginfo_t *info) + * Also, transition to TRACED and updates to ->jobctl should be + * atomic with respect to siglock and should be done after the arch + * hook as siglock is released and regrabbed across it. ++ * schedule() will not sleep if there is a pending signal that ++ * can awaken the task. + */ + set_current_state(TASK_TRACED); + diff --git a/kernel/sys.c b/kernel/sys.c -index 15cf3eea6f2e..2f055b6d33c3 100644 +index 15cf3eea6f2e..a7f823224546 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1186,11 +1186,13 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name) @@ -100514,6 +129063,20 @@ index 15cf3eea6f2e..2f055b6d33c3 100644 down_read(&uts_sem); memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN); memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN); +@@ -1775,13 +1777,6 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map) + + error = -EINVAL; + +- /* +- * @brk should be after @end_data in traditional maps. +- */ +- if (prctl_map->start_brk <= prctl_map->end_data || +- prctl_map->brk <= prctl_map->end_data) +- goto out; +- + /* + * Neither we should allow to override limits if they set. + */ diff --git a/kernel/sysctl.c b/kernel/sysctl.c index f3a22c903ddb..4b3f3f066711 100644 --- a/kernel/sysctl.c @@ -100576,7 +129139,7 @@ index be1cc6124bb4..9294d6922c58 100644 return error; } diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c -index 86e896981da0..ef0440514e60 100644 +index 86e896981da0..94922c8184c8 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -988,9 +988,8 @@ static int scale64_check_overflow(u64 mult, u64 div, u64 *base) @@ -100590,6 +129153,16 @@ index 86e896981da0..ef0440514e60 100644 *base = tmp + rem; return 0; } +@@ -1237,8 +1236,7 @@ int do_settimeofday64(const struct timespec64 *ts) + timekeeping_forward_now(tk); + + xt = tk_xtime(tk); +- ts_delta.tv_sec = ts->tv_sec - xt.tv_sec; +- ts_delta.tv_nsec = ts->tv_nsec - xt.tv_nsec; ++ ts_delta = timespec64_sub(*ts, xt); + + if (timespec64_compare(&tk->wall_to_monotonic, &ts_delta) > 0) { + ret = -EINVAL; diff --git a/kernel/time/timer.c b/kernel/time/timer.c index 97da9247cb38..c012154e74ff 100644 --- a/kernel/time/timer.c @@ -100614,7 +129187,7 @@ index 97da9247cb38..c012154e74ff 100644 idx = calc_index(expires, LVL_DEPTH - 1); } diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c -index 6d3b432a748a..88eb9261c7b5 100644 +index 6d3b432a748a..056107787f4a 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -15,6 +15,9 @@ @@ -100644,8 +129217,23 @@ index 6d3b432a748a..88eb9261c7b5 100644 bt = kzalloc(sizeof(*bt), GFP_KERNEL); if (!bt) return -ENOMEM; +@@ -1571,6 +1584,14 @@ static int blk_trace_remove_queue(struct request_queue *q) + if (bt == NULL) + return -EINVAL; + ++ if (bt->trace_state == Blktrace_running) { ++ bt->trace_state = Blktrace_stopped; ++ spin_lock_irq(&running_trace_lock); ++ list_del_init(&bt->running_list); ++ spin_unlock_irq(&running_trace_lock); ++ relay_flush(bt->rchan); ++ } ++ + put_probe_ref(); + synchronize_rcu(); + blk_trace_free(bt); diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 3126dbc29dc7..5be2bfa57535 100644 +index 3126dbc29dc7..cc352f5383ee 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -1635,6 +1635,8 @@ static bool test_rec_ops_needs_regs(struct dyn_ftrace *rec) @@ -100749,6 +129337,15 @@ index 3126dbc29dc7..5be2bfa57535 100644 if (ftrace_start_up && cnt) { int failed = __ftrace_replace_code(rec, 1); +@@ -5257,7 +5289,7 @@ __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *op; + int bit; + +- bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX); ++ bit = trace_test_and_set_recursion(TRACE_LIST_START); + if (bit < 0) + return; + @@ -5333,17 +5365,15 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip, { int bit; @@ -100756,7 +129353,8 @@ index 3126dbc29dc7..5be2bfa57535 100644 - if ((op->flags & FTRACE_OPS_FL_RCU) && !rcu_is_watching()) - return; - - bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX); +- bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX); ++ bit = trace_test_and_set_recursion(TRACE_LIST_START); if (bit < 0) return; @@ -101160,25 +129758,101 @@ index aa1150d79f38..33f5755f6d15 100644 trace_printk_init_buffers(); diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index 5078a317e284..994f47fdd9cf 100644 +index 5078a317e284..90e15f86d59c 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h -@@ -491,6 +491,12 @@ enum { - * can only be modified by current, we can reuse trace_recursion. +@@ -446,23 +446,8 @@ struct tracer { + * When function tracing occurs, the following steps are made: + * If arch does not support a ftrace feature: + * call internal function (uses INTERNAL bits) which calls... +- * If callback is registered to the "global" list, the list +- * function is called and recursion checks the GLOBAL bits. +- * then this function calls... + * The function callback, which can use the FTRACE bits to + * check for recursion. +- * +- * Now if the arch does not suppport a feature, and it calls +- * the global list function which calls the ftrace callback +- * all three of these steps will do a recursion protection. +- * There's no reason to do one if the previous caller already +- * did. The recursion that we are protecting against will +- * go through the same steps again. +- * +- * To prevent the multiple recursion checks, if a recursion +- * bit is set that is higher than the MAX bit of the current +- * check, then we know that the check was made by the previous +- * caller, and we can skip the current check. */ - TRACE_IRQ_BIT, + enum { + TRACE_BUFFER_BIT, +@@ -475,12 +460,14 @@ enum { + TRACE_FTRACE_NMI_BIT, + TRACE_FTRACE_IRQ_BIT, + TRACE_FTRACE_SIRQ_BIT, ++ TRACE_FTRACE_TRANSITION_BIT, + +- /* INTERNAL_BITs must be greater than FTRACE_BITs */ ++ /* Internal use recursion bits */ + TRACE_INTERNAL_BIT, + TRACE_INTERNAL_NMI_BIT, + TRACE_INTERNAL_IRQ_BIT, + TRACE_INTERNAL_SIRQ_BIT, ++ TRACE_INTERNAL_TRANSITION_BIT, + + TRACE_BRANCH_BIT, + /* +@@ -500,12 +487,18 @@ enum { + #define TRACE_CONTEXT_BITS 4 + + #define TRACE_FTRACE_START TRACE_FTRACE_BIT +-#define TRACE_FTRACE_MAX ((1 << (TRACE_FTRACE_START + TRACE_CONTEXT_BITS)) - 1) + + #define TRACE_LIST_START TRACE_INTERNAL_BIT +-#define TRACE_LIST_MAX ((1 << (TRACE_LIST_START + TRACE_CONTEXT_BITS)) - 1) + +-#define TRACE_CONTEXT_MASK TRACE_LIST_MAX ++#define TRACE_CONTEXT_MASK ((1 << (TRACE_LIST_START + TRACE_CONTEXT_BITS)) - 1) + -+ /* -+ * When transitioning between context, the preempt_count() may -+ * not be correct. Allow for a single recursion to cover this case. -+ */ -+ TRACE_TRANSITION_BIT, - }; ++enum { ++ TRACE_CTX_NMI, ++ TRACE_CTX_IRQ, ++ TRACE_CTX_SOFTIRQ, ++ TRACE_CTX_NORMAL, ++ TRACE_CTX_TRANSITION, ++}; - #define trace_recursion_set(bit) do { (current)->trace_recursion |= (1<<(bit)); } while (0) -@@ -535,14 +541,27 @@ static __always_inline int trace_test_and_set_recursion(int start, int max) - return 0; + static __always_inline int trace_get_context_bit(void) + { +@@ -513,30 +506,36 @@ static __always_inline int trace_get_context_bit(void) + if (in_interrupt()) { + if (in_nmi()) +- bit = 0; ++ bit = TRACE_CTX_NMI; + + else if (in_irq()) +- bit = 1; ++ bit = TRACE_CTX_IRQ; + else +- bit = 2; ++ bit = TRACE_CTX_SOFTIRQ; + } else +- bit = 3; ++ bit = TRACE_CTX_NORMAL; + + return bit; + } + +-static __always_inline int trace_test_and_set_recursion(int start, int max) ++static __always_inline int trace_test_and_set_recursion(int start) + { + unsigned int val = current->trace_recursion; + int bit; + +- /* A previous recursion check was made */ +- if ((val & TRACE_CONTEXT_MASK) > max) +- return 0; +- bit = trace_get_context_bit() + start; - if (unlikely(val & (1 << bit))) - return -1; @@ -101187,35 +129861,27 @@ index 5078a317e284..994f47fdd9cf 100644 + * It could be that preempt_count has not been updated during + * a switch between contexts. Allow for a single recursion. + */ -+ bit = TRACE_TRANSITION_BIT; ++ bit = start + TRACE_CTX_TRANSITION; + if (trace_recursion_test(bit)) + return -1; + trace_recursion_set(bit); + barrier(); -+ return bit + 1; ++ return bit; + } -+ -+ /* Normal check passed, clear the transition to allow it again */ -+ trace_recursion_clear(TRACE_TRANSITION_BIT); val |= 1 << bit; current->trace_recursion = val; - barrier(); +@@ -549,9 +548,6 @@ static __always_inline void trace_clear_recursion(int bit) + { + unsigned int val = current->trace_recursion; -- return bit; -+ return bit + 1; - } - - static __always_inline void trace_clear_recursion(int bit) -@@ -552,6 +571,7 @@ static __always_inline void trace_clear_recursion(int bit) - if (!bit) - return; - -+ bit--; +- if (!bit) +- return; +- bit = 1 << bit; val &= ~bit; -@@ -669,13 +689,15 @@ void update_max_tr_single(struct trace_array *tr, +@@ -669,13 +665,15 @@ void update_max_tr_single(struct trace_array *tr, #endif /* CONFIG_TRACER_MAX_TRACE */ #ifdef CONFIG_STACKTRACE @@ -101233,6 +129899,39 @@ index 5078a317e284..994f47fdd9cf 100644 unsigned long flags, int pc) { } +@@ -1165,14 +1163,26 @@ __event_trigger_test_discard(struct trace_event_file *file, + if (eflags & EVENT_FILE_FL_TRIGGER_COND) + *tt = event_triggers_call(file, entry); + +- if (test_bit(EVENT_FILE_FL_SOFT_DISABLED_BIT, &file->flags) || +- (unlikely(file->flags & EVENT_FILE_FL_FILTERED) && +- !filter_match_preds(file->filter, entry))) { +- __trace_event_discard_commit(buffer, event); +- return true; +- } ++ if (likely(!(file->flags & (EVENT_FILE_FL_SOFT_DISABLED | ++ EVENT_FILE_FL_FILTERED | ++ EVENT_FILE_FL_PID_FILTER)))) ++ return false; ++ ++ if (file->flags & EVENT_FILE_FL_SOFT_DISABLED) ++ goto discard; ++ ++ if (file->flags & EVENT_FILE_FL_FILTERED && ++ !filter_match_preds(file->filter, entry)) ++ goto discard; ++ ++ if ((file->flags & EVENT_FILE_FL_PID_FILTER) && ++ trace_event_ignore_this_pid(file)) ++ goto discard; + + return false; ++ discard: ++ __trace_event_discard_commit(buffer, event); ++ return true; + } + + /** diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c index 0f06532a755b..b70233a9563f 100644 --- a/kernel/trace/trace_clock.c @@ -101315,7 +130014,7 @@ index d1cc37e78f99..1430f6bbb1a0 100644 F_printk("\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n" diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index ffa1a0b6509e..ffd570ae9830 100644 +index ffa1a0b6509e..96eeab9ee0b8 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -791,6 +791,8 @@ static int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set) @@ -101337,6 +130036,26 @@ index ffa1a0b6509e..ffd570ae9830 100644 continue; if (system && strcmp(call->class->system, system->name) != 0) +@@ -2239,12 +2242,19 @@ static struct trace_event_file * + trace_create_new_event(struct trace_event_call *call, + struct trace_array *tr) + { ++ struct trace_pid_list *pid_list; + struct trace_event_file *file; + + file = kmem_cache_alloc(file_cachep, GFP_TRACE); + if (!file) + return NULL; + ++ pid_list = rcu_dereference_protected(tr->filtered_pids, ++ lockdep_is_held(&event_mutex)); ++ ++ if (pid_list) ++ file->flags |= EVENT_FILE_FL_PID_FILTER; ++ + file->event_call = call; + file->tr = tr; + atomic_set(&file->sm_ref, 0); diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 766e5ccad60a..57a9341c67e4 100644 --- a/kernel/trace/trace_events_hist.c @@ -101412,6 +130131,19 @@ index c9ca2ed50c0e..a371c7def875 100644 system = strsep(&trigger, ":"); if (!trigger) +diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c +index 0efa00d80623..9434d2fe932f 100644 +--- a/kernel/trace/trace_functions.c ++++ b/kernel/trace/trace_functions.c +@@ -137,7 +137,7 @@ function_trace_call(unsigned long ip, unsigned long parent_ip, + pc = preempt_count(); + preempt_disable_notrace(); + +- bit = trace_test_and_set_recursion(TRACE_FTRACE_START, TRACE_FTRACE_MAX); ++ bit = trace_test_and_set_recursion(TRACE_FTRACE_START); + if (bit < 0) + goto out; + diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c index 5fe23f0ee7db..d1e007c72923 100644 --- a/kernel/trace/trace_hwlat.c @@ -101522,6 +130254,126 @@ index ca70d11b8aa7..f444f57f1338 100644 trace_selftest_recursion_cnt); goto out; } +diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c +index 35b2ba07f3c6..572c0854d631 100644 +--- a/kernel/trace/tracing_map.c ++++ b/kernel/trace/tracing_map.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + #include "tracing_map.h" + #include "trace.h" +@@ -227,6 +228,7 @@ void tracing_map_array_free(struct tracing_map_array *a) + for (i = 0; i < a->n_pages; i++) { + if (!a->pages[i]) + break; ++ kmemleak_free(a->pages[i]); + free_page((unsigned long)a->pages[i]); + } + +@@ -262,6 +264,7 @@ struct tracing_map_array *tracing_map_array_alloc(unsigned int n_elts, + a->pages[i] = (void *)get_zeroed_page(GFP_KERNEL); + if (!a->pages[i]) + goto free; ++ kmemleak_alloc(a->pages[i], PAGE_SIZE, 1, GFP_KERNEL); + } + out: + return a; +@@ -703,29 +706,35 @@ int tracing_map_init(struct tracing_map *map) + return err; + } + +-static int cmp_entries_dup(const struct tracing_map_sort_entry **a, +- const struct tracing_map_sort_entry **b) ++static int cmp_entries_dup(const void *A, const void *B) + { ++ const struct tracing_map_sort_entry *a, *b; + int ret = 0; + +- if (memcmp((*a)->key, (*b)->key, (*a)->elt->map->key_size)) ++ a = *(const struct tracing_map_sort_entry **)A; ++ b = *(const struct tracing_map_sort_entry **)B; ++ ++ if (memcmp(a->key, b->key, a->elt->map->key_size)) + ret = 1; + + return ret; + } + +-static int cmp_entries_sum(const struct tracing_map_sort_entry **a, +- const struct tracing_map_sort_entry **b) ++static int cmp_entries_sum(const void *A, const void *B) + { + const struct tracing_map_elt *elt_a, *elt_b; ++ const struct tracing_map_sort_entry *a, *b; + struct tracing_map_sort_key *sort_key; + struct tracing_map_field *field; + tracing_map_cmp_fn_t cmp_fn; + void *val_a, *val_b; + int ret = 0; + +- elt_a = (*a)->elt; +- elt_b = (*b)->elt; ++ a = *(const struct tracing_map_sort_entry **)A; ++ b = *(const struct tracing_map_sort_entry **)B; ++ ++ elt_a = a->elt; ++ elt_b = b->elt; + + sort_key = &elt_a->map->sort_key; + +@@ -742,18 +751,21 @@ static int cmp_entries_sum(const struct tracing_map_sort_entry **a, + return ret; + } + +-static int cmp_entries_key(const struct tracing_map_sort_entry **a, +- const struct tracing_map_sort_entry **b) ++static int cmp_entries_key(const void *A, const void *B) + { + const struct tracing_map_elt *elt_a, *elt_b; ++ const struct tracing_map_sort_entry *a, *b; + struct tracing_map_sort_key *sort_key; + struct tracing_map_field *field; + tracing_map_cmp_fn_t cmp_fn; + void *val_a, *val_b; + int ret = 0; + +- elt_a = (*a)->elt; +- elt_b = (*b)->elt; ++ a = *(const struct tracing_map_sort_entry **)A; ++ b = *(const struct tracing_map_sort_entry **)B; ++ ++ elt_a = a->elt; ++ elt_b = b->elt; + + sort_key = &elt_a->map->sort_key; + +@@ -926,10 +938,8 @@ static void sort_secondary(struct tracing_map *map, + struct tracing_map_sort_key *primary_key, + struct tracing_map_sort_key *secondary_key) + { +- int (*primary_fn)(const struct tracing_map_sort_entry **, +- const struct tracing_map_sort_entry **); +- int (*secondary_fn)(const struct tracing_map_sort_entry **, +- const struct tracing_map_sort_entry **); ++ int (*primary_fn)(const void *, const void *); ++ int (*secondary_fn)(const void *, const void *); + unsigned i, start = 0, n_sub = 1; + + if (is_key(map, primary_key->field_idx)) +@@ -998,8 +1008,7 @@ int tracing_map_sort_entries(struct tracing_map *map, + unsigned int n_sort_keys, + struct tracing_map_sort_entry ***sort_entries) + { +- int (*cmp_entries_fn)(const struct tracing_map_sort_entry **, +- const struct tracing_map_sort_entry **); ++ int (*cmp_entries_fn)(const void *, const void *); + struct tracing_map_sort_entry *sort_entry, **entries; + int i, n_entries, ret; + diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c index c8e7cc0e6ff6..88ae873ee6cf 100644 --- a/kernel/tracepoint.c @@ -101655,7 +130507,7 @@ index c8e7cc0e6ff6..88ae873ee6cf 100644 if (!tp_funcs) { /* Removed last function */ diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index ac381bff69df..c9d628e8f0b6 100644 +index ac381bff69df..134200a12196 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -51,6 +51,7 @@ @@ -101682,7 +130534,36 @@ index ac381bff69df..c9d628e8f0b6 100644 insert_work(pwq, work, worklist, work_flags); spin_unlock(&pwq->pool->lock); -@@ -3494,17 +3495,24 @@ static void pwq_adjust_max_active(struct pool_workqueue *pwq) +@@ -3440,15 +3441,21 @@ static void pwq_unbound_release_workfn(struct work_struct *work) + unbound_release_work); + struct workqueue_struct *wq = pwq->wq; + struct worker_pool *pool = pwq->pool; +- bool is_last; ++ bool is_last = false; + +- if (WARN_ON_ONCE(!(wq->flags & WQ_UNBOUND))) +- return; ++ /* ++ * when @pwq is not linked, it doesn't hold any reference to the ++ * @wq, and @wq is invalid to access. ++ */ ++ if (!list_empty(&pwq->pwqs_node)) { ++ if (WARN_ON_ONCE(!(wq->flags & WQ_UNBOUND))) ++ return; + +- mutex_lock(&wq->mutex); +- list_del_rcu(&pwq->pwqs_node); +- is_last = list_empty(&wq->pwqs); +- mutex_unlock(&wq->mutex); ++ mutex_lock(&wq->mutex); ++ list_del_rcu(&pwq->pwqs_node); ++ is_last = list_empty(&wq->pwqs); ++ mutex_unlock(&wq->mutex); ++ } + + mutex_lock(&wq_pool_mutex); + put_unbound_pool(pool); +@@ -3494,17 +3501,24 @@ static void pwq_adjust_max_active(struct pool_workqueue *pwq) * is updated and visible. */ if (!freezable || !workqueue_freezing) { @@ -101710,7 +130591,7 @@ index ac381bff69df..c9d628e8f0b6 100644 } else { pwq->max_active = 0; } -@@ -5423,6 +5431,7 @@ static void wq_watchdog_timer_fn(unsigned long data) +@@ -5423,6 +5437,7 @@ static void wq_watchdog_timer_fn(unsigned long data) { unsigned long thresh = READ_ONCE(wq_watchdog_thresh) * HZ; bool lockup_detected = false; @@ -101718,7 +130599,7 @@ index ac381bff69df..c9d628e8f0b6 100644 struct worker_pool *pool; int pi; -@@ -5437,6 +5446,12 @@ static void wq_watchdog_timer_fn(unsigned long data) +@@ -5437,6 +5452,12 @@ static void wq_watchdog_timer_fn(unsigned long data) if (list_empty(&pool->worklist)) continue; @@ -101731,7 +130612,7 @@ index ac381bff69df..c9d628e8f0b6 100644 /* get the latest of pool and touched timestamps */ pool_ts = READ_ONCE(pool->watchdog_ts); touched = READ_ONCE(wq_watchdog_touched); -@@ -5455,12 +5470,12 @@ static void wq_watchdog_timer_fn(unsigned long data) +@@ -5455,12 +5476,12 @@ static void wq_watchdog_timer_fn(unsigned long data) } /* did we stall? */ @@ -101792,6 +130673,19 @@ index 036fc882cd72..f1449244fdd4 100644 ret = 0; exit_2: if (!input) +diff --git a/lib/decompress_unxz.c b/lib/decompress_unxz.c +index 25d59a95bd66..abea25310ac7 100644 +--- a/lib/decompress_unxz.c ++++ b/lib/decompress_unxz.c +@@ -167,7 +167,7 @@ + * memeq and memzero are not used much and any remotely sane implementation + * is fast enough. memcpy/memmove speed matters in multi-call mode, but + * the kernel image is decompressed in single-call mode, in which only +- * memcpy speed can matter and only if there is a lot of uncompressible data ++ * memmove speed can matter and only if there is a lot of uncompressible data + * (LZMA2 stores uncompressible chunks in uncompressed form). Thus, the + * functions below should just be kept small; it's probably not worth + * optimizing for speed. diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c index c7c96bc7654a..91c451e0f474 100644 --- a/lib/dynamic_debug.c @@ -102907,6 +131801,88 @@ index 5954f9fb6675..b3ec487c9728 100644 } return 0; } +diff --git a/lib/siphash.c b/lib/siphash.c +index 3ae58b4edad6..e632ee40aac1 100644 +--- a/lib/siphash.c ++++ b/lib/siphash.c +@@ -49,6 +49,7 @@ + SIPROUND; \ + return (v0 ^ v1) ^ (v2 ^ v3); + ++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key) + { + const u8 *end = data + len - (len % sizeof(u64)); +@@ -80,8 +81,8 @@ u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key) + POSTAMBLE + } + EXPORT_SYMBOL(__siphash_aligned); ++#endif + +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key) + { + const u8 *end = data + len - (len % sizeof(u64)); +@@ -113,7 +114,6 @@ u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key) + POSTAMBLE + } + EXPORT_SYMBOL(__siphash_unaligned); +-#endif + + /** + * siphash_1u64 - compute 64-bit siphash PRF value of a u64 +@@ -250,6 +250,7 @@ EXPORT_SYMBOL(siphash_3u32); + HSIPROUND; \ + return (v0 ^ v1) ^ (v2 ^ v3); + ++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key) + { + const u8 *end = data + len - (len % sizeof(u64)); +@@ -280,8 +281,8 @@ u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key) + HPOSTAMBLE + } + EXPORT_SYMBOL(__hsiphash_aligned); ++#endif + +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_unaligned(const void *data, size_t len, + const hsiphash_key_t *key) + { +@@ -313,7 +314,6 @@ u32 __hsiphash_unaligned(const void *data, size_t len, + HPOSTAMBLE + } + EXPORT_SYMBOL(__hsiphash_unaligned); +-#endif + + /** + * hsiphash_1u32 - compute 64-bit hsiphash PRF value of a u32 +@@ -418,6 +418,7 @@ EXPORT_SYMBOL(hsiphash_4u32); + HSIPROUND; \ + return v1 ^ v3; + ++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key) + { + const u8 *end = data + len - (len % sizeof(u32)); +@@ -438,8 +439,8 @@ u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key) + HPOSTAMBLE + } + EXPORT_SYMBOL(__hsiphash_aligned); ++#endif + +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_unaligned(const void *data, size_t len, + const hsiphash_key_t *key) + { +@@ -461,7 +462,6 @@ u32 __hsiphash_unaligned(const void *data, size_t len, + HPOSTAMBLE + } + EXPORT_SYMBOL(__hsiphash_unaligned); +-#endif + + /** + * hsiphash_1u32 - compute 32-bit hsiphash PRF value of a u32 diff --git a/lib/stackdepot.c b/lib/stackdepot.c index 759ff419fe61..c519aa07d2e9 100644 --- a/lib/stackdepot.c @@ -102939,7 +131915,7 @@ index 759ff419fe61..c519aa07d2e9 100644 if (prealloc) { /* Nobody used this memory, ok to free it. */ diff --git a/lib/string.c b/lib/string.c -index fbaca936f69c..830100ea8fa1 100644 +index fbaca936f69c..9f4a98cd47e1 100644 --- a/lib/string.c +++ b/lib/string.c @@ -157,11 +157,9 @@ EXPORT_SYMBOL(strlcpy); @@ -103034,6 +132010,79 @@ index fbaca936f69c..830100ea8fa1 100644 #ifndef __HAVE_ARCH_STRCAT /** * strcat - Append one %NUL-terminated string to another +@@ -697,6 +754,72 @@ void memzero_explicit(void *s, size_t count) + } + EXPORT_SYMBOL(memzero_explicit); + ++#ifndef __HAVE_ARCH_MEMSET16 ++/** ++ * memset16() - Fill a memory area with a uint16_t ++ * @s: Pointer to the start of the area. ++ * @v: The value to fill the area with ++ * @count: The number of values to store ++ * ++ * Differs from memset() in that it fills with a uint16_t instead ++ * of a byte. Remember that @count is the number of uint16_ts to ++ * store, not the number of bytes. ++ */ ++void *memset16(uint16_t *s, uint16_t v, size_t count) ++{ ++ uint16_t *xs = s; ++ ++ while (count--) ++ *xs++ = v; ++ return s; ++} ++EXPORT_SYMBOL(memset16); ++#endif ++ ++#ifndef __HAVE_ARCH_MEMSET32 ++/** ++ * memset32() - Fill a memory area with a uint32_t ++ * @s: Pointer to the start of the area. ++ * @v: The value to fill the area with ++ * @count: The number of values to store ++ * ++ * Differs from memset() in that it fills with a uint32_t instead ++ * of a byte. Remember that @count is the number of uint32_ts to ++ * store, not the number of bytes. ++ */ ++void *memset32(uint32_t *s, uint32_t v, size_t count) ++{ ++ uint32_t *xs = s; ++ ++ while (count--) ++ *xs++ = v; ++ return s; ++} ++EXPORT_SYMBOL(memset32); ++#endif ++ ++#ifndef __HAVE_ARCH_MEMSET64 ++/** ++ * memset64() - Fill a memory area with a uint64_t ++ * @s: Pointer to the start of the area. ++ * @v: The value to fill the area with ++ * @count: The number of values to store ++ * ++ * Differs from memset() in that it fills with a uint64_t instead ++ * of a byte. Remember that @count is the number of uint64_ts to ++ * store, not the number of bytes. ++ */ ++void *memset64(uint64_t *s, uint64_t v, size_t count) ++{ ++ uint64_t *xs = s; ++ ++ while (count--) ++ *xs++ = v; ++ return s; ++} ++EXPORT_SYMBOL(memset64); ++#endif ++ + #ifndef __HAVE_ARCH_MEMCPY + /** + * memcpy - Copy one area of memory to another diff --git a/lib/swiotlb.c b/lib/swiotlb.c index 7ff9dc36c2f8..74b5b8862198 100644 --- a/lib/swiotlb.c @@ -103067,6 +132116,103 @@ index 7ff9dc36c2f8..74b5b8862198 100644 swiotlb_print_info(); +diff --git a/lib/test_bpf.c b/lib/test_bpf.c +index 960d4d627361..0c62275630fa 100644 +--- a/lib/test_bpf.c ++++ b/lib/test_bpf.c +@@ -4295,8 +4295,8 @@ static struct bpf_test tests[] = { + .u.insns_int = { + BPF_LD_IMM64(R0, 0), + BPF_LD_IMM64(R1, 0xffffffffffffffffLL), +- BPF_STX_MEM(BPF_W, R10, R1, -40), +- BPF_LDX_MEM(BPF_W, R0, R10, -40), ++ BPF_STX_MEM(BPF_DW, R10, R1, -40), ++ BPF_LDX_MEM(BPF_DW, R0, R10, -40), + BPF_EXIT_INSN(), + }, + INTERNAL, +@@ -5744,7 +5744,14 @@ static int run_one(const struct bpf_prog *fp, struct bpf_test *test) + u64 duration; + u32 ret; + +- if (test->test[i].data_size == 0 && ++ /* ++ * NOTE: Several sub-tests may be present, in which case ++ * a zero {data_size, result} tuple indicates the end of ++ * the sub-test array. The first test is always run, ++ * even if both data_size and result happen to be zero. ++ */ ++ if (i > 0 && ++ test->test[i].data_size == 0 && + test->test[i].result == 0) + break; + +diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c +index 08c3c8049998..2c5197d6b944 100644 +--- a/lib/xz/xz_dec_lzma2.c ++++ b/lib/xz/xz_dec_lzma2.c +@@ -387,7 +387,14 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b, + + *left -= copy_size; + +- memcpy(dict->buf + dict->pos, b->in + b->in_pos, copy_size); ++ /* ++ * If doing in-place decompression in single-call mode and the ++ * uncompressed size of the file is larger than the caller ++ * thought (i.e. it is invalid input!), the buffers below may ++ * overlap and cause undefined behavior with memcpy(). ++ * With valid inputs memcpy() would be fine here. ++ */ ++ memmove(dict->buf + dict->pos, b->in + b->in_pos, copy_size); + dict->pos += copy_size; + + if (dict->full < dict->pos) +@@ -397,7 +404,11 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b, + if (dict->pos == dict->end) + dict->pos = 0; + +- memcpy(b->out + b->out_pos, b->in + b->in_pos, ++ /* ++ * Like above but for multi-call mode: use memmove() ++ * to avoid undefined behavior with invalid input. ++ */ ++ memmove(b->out + b->out_pos, b->in + b->in_pos, + copy_size); + } + +@@ -421,6 +432,12 @@ static uint32_t dict_flush(struct dictionary *dict, struct xz_buf *b) + if (dict->pos == dict->end) + dict->pos = 0; + ++ /* ++ * These buffers cannot overlap even if doing in-place ++ * decompression because in multi-call mode dict->buf ++ * has been allocated by us in this file; it's not ++ * provided by the caller like in single-call mode. ++ */ + memcpy(b->out + b->out_pos, dict->buf + dict->start, + copy_size); + } +diff --git a/lib/xz/xz_dec_stream.c b/lib/xz/xz_dec_stream.c +index ac809b1e64f7..9e5b9ab537fe 100644 +--- a/lib/xz/xz_dec_stream.c ++++ b/lib/xz/xz_dec_stream.c +@@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s) + * we will accept other check types too, but then the check won't + * be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given. + */ ++ if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX) ++ return XZ_OPTIONS_ERROR; ++ + s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1]; + + #ifdef XZ_DEC_ANY_CHECK +- if (s->check_type > XZ_CHECK_MAX) +- return XZ_OPTIONS_ERROR; +- + if (s->check_type > XZ_CHECK_CRC32) + return XZ_UNSUPPORTED_CHECK; + #else diff --git a/lib/zlib_inflate/inffast.c b/lib/zlib_inflate/inffast.c index 2c13ecc5bb2c..ed1f3df27260 100644 --- a/lib/zlib_inflate/inffast.c @@ -103301,7 +132447,7 @@ index 2c13ecc5bb2c..ed1f3df27260 100644 strm->avail_out = (unsigned)(out < end ? 257 + (end - out) : 257 - (out - end)); diff --git a/mm/backing-dev.c b/mm/backing-dev.c -index bdb7d168293b..269adc2de903 100755 +index bdb7d168293b..ca0c32853266 100755 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -21,6 +21,7 @@ struct backing_dev_info noop_backing_dev_info = { @@ -103312,6 +132458,20 @@ index bdb7d168293b..269adc2de903 100755 /* * bdi_lock protects updates to bdi_list. bdi_list has RCU reader side +@@ -928,6 +929,13 @@ void bdi_unregister(struct backing_dev_info *bdi) + wb_shutdown(&bdi->wb); + cgwb_bdi_unregister(bdi); + ++ /* ++ * If this BDI's min ratio has been set, use bdi_set_min_ratio() to ++ * update the global bdi_min_ratio. ++ */ ++ if (bdi->min_ratio) ++ bdi_set_min_ratio(bdi, 0); ++ + if (bdi->dev) { + bdi_debug_unregister(bdi); + device_unregister(bdi->dev); diff --git a/mm/filemap.c b/mm/filemap.c index 1aaebed9d20d..4b50ece85394 100644 --- a/mm/filemap.c @@ -103331,8 +132491,109 @@ index 1aaebed9d20d..4b50ece85394 100644 goto filler; out: +diff --git a/mm/gup.c b/mm/gup.c +index 6bb7a8eb7f82..301dd96ef176 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -61,13 +61,22 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address, + } + + /* +- * FOLL_FORCE can write to even unwritable pte's, but only +- * after we've gone through a COW cycle and they are dirty. ++ * FOLL_FORCE or a forced COW break can write even to unwritable pte's, ++ * but only after we've gone through a COW cycle and they are dirty. + */ + static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) + { +- return pte_write(pte) || +- ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); ++ return pte_write(pte) || ((flags & FOLL_COW) && pte_dirty(pte)); ++} ++ ++/* ++ * A (separate) COW fault might break the page the other way and ++ * get_user_pages() would return the page from what is now the wrong ++ * VM. So we need to force a COW break at GUP time even for reads. ++ */ ++static inline bool should_force_cow_break(struct vm_area_struct *vma, unsigned int flags) ++{ ++ return is_cow_mapping(vma->vm_flags) && (flags & FOLL_GET); + } + + static struct page *follow_page_pte(struct vm_area_struct *vma, +@@ -577,12 +586,18 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, + if (!vma || check_vma_flags(vma, gup_flags)) + return i ? : -EFAULT; + if (is_vm_hugetlb_page(vma)) { ++ if (should_force_cow_break(vma, foll_flags)) ++ foll_flags |= FOLL_WRITE; + i = follow_hugetlb_page(mm, vma, pages, vmas, + &start, &nr_pages, i, +- gup_flags); ++ foll_flags); + continue; + } + } ++ ++ if (should_force_cow_break(vma, foll_flags)) ++ foll_flags |= FOLL_WRITE; ++ + retry: + /* + * If we have a pending SIGKILL, don't keep faulting pages and +@@ -1503,6 +1518,10 @@ static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end, + /* + * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to + * the regular GUP. It will only return non-negative values. ++ * ++ * Careful, careful! COW breaking can go either way, so a non-write ++ * access can get ambiguous page results. If you call this function without ++ * 'write' set, you'd better be sure that you're ok with that ambiguity. + */ + int __get_user_pages_fast(unsigned long start, int nr_pages, int write, + struct page **pages) +@@ -1532,6 +1551,12 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write, + * + * We do not adopt an rcu_read_lock(.) here as we also want to + * block IPIs that come from THPs splitting. ++ * ++ * NOTE! We allow read-only gup_fast() here, but you'd better be ++ * careful about possible COW pages. You'll get _a_ COW page, but ++ * not necessarily the one you intended to get depending on what ++ * COW event happens after this. COW may break the page copy in a ++ * random direction. + */ + + local_irq_save(flags); +@@ -1542,15 +1567,22 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write, + next = pgd_addr_end(addr, end); + if (pgd_none(pgd)) + break; ++ /* ++ * The FAST_GUP case requires FOLL_WRITE even for pure reads, ++ * because get_user_pages() may need to cause an early COW in ++ * order to avoid confusing the normal COW routines. So only ++ * targets that are already writable are safe to do by just ++ * looking at the page tables. ++ */ + if (unlikely(pgd_huge(pgd))) { +- if (!gup_huge_pgd(pgd, pgdp, addr, next, write, ++ if (!gup_huge_pgd(pgd, pgdp, addr, next, 1, + pages, &nr)) + break; + } else if (unlikely(is_hugepd(__hugepd(pgd_val(pgd))))) { + if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr, +- PGDIR_SHIFT, next, write, pages, &nr)) ++ PGDIR_SHIFT, next, 1, pages, &nr)) + break; +- } else if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) ++ } else if (!gup_pud_range(pgd, addr, next, 1, pages, &nr)) + break; + } while (pgdp++, addr = next, addr != end); + local_irq_restore(flags); diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index fad4a0ca903c..d11aef19f184 100644 +index fad4a0ca903c..f640c45103a3 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -661,7 +661,6 @@ int do_huge_pmd_anonymous_page(struct fault_env *fe) @@ -103400,7 +132661,24 @@ index fad4a0ca903c..d11aef19f184 100644 get_page(page); spin_unlock(fe->ptl); alloc: -@@ -1356,7 +1369,7 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, +@@ -1122,13 +1135,12 @@ int do_huge_pmd_wp_page(struct fault_env *fe, pmd_t orig_pmd) + } + + /* +- * FOLL_FORCE can write to even unwritable pmd's, but only +- * after we've gone through a COW cycle and they are dirty. ++ * FOLL_FORCE or a forced COW break can write even to unwritable pmd's, ++ * but only after we've gone through a COW cycle and they are dirty. + */ + static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags) + { +- return pmd_write(pmd) || +- ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd)); ++ return pmd_write(pmd) || ((flags & FOLL_COW) && pmd_dirty(pmd)); + } + + struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, +@@ -1356,7 +1368,7 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, * If other processes are mapping this page, we couldn't discard * the page unless they all do MADV_FREE so let's skip the page. */ @@ -103409,7 +132687,7 @@ index fad4a0ca903c..d11aef19f184 100644 goto out; if (!trylock_page(page)) -@@ -1755,6 +1768,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, +@@ -1755,6 +1767,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, spinlock_t *ptl; struct mm_struct *mm = vma->vm_mm; unsigned long haddr = address & HPAGE_PMD_MASK; @@ -103418,7 +132696,7 @@ index fad4a0ca903c..d11aef19f184 100644 mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE); ptl = pmd_lock(mm, pmd); -@@ -1764,11 +1779,41 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, +@@ -1764,11 +1778,41 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, * pmd against. Otherwise we can end up replacing wrong page. */ VM_BUG_ON(freeze && !page); @@ -103463,7 +132741,7 @@ index fad4a0ca903c..d11aef19f184 100644 if (PageMlocked(page)) clear_page_mlock(page); } else if (!pmd_devmap(*pmd)) -@@ -1776,6 +1821,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, +@@ -1776,6 +1820,8 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, __split_huge_pmd_locked(vma, pmd, haddr, freeze); out: spin_unlock(ptl); @@ -103472,7 +132750,7 @@ index fad4a0ca903c..d11aef19f184 100644 mmu_notifier_invalidate_range_end(mm, haddr, haddr + HPAGE_PMD_SIZE); } -@@ -1844,7 +1891,7 @@ static void unmap_page(struct page *page) +@@ -1844,7 +1890,7 @@ static void unmap_page(struct page *page) { enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS | TTU_RMAP_LOCKED; @@ -103481,7 +132759,7 @@ index fad4a0ca903c..d11aef19f184 100644 VM_BUG_ON_PAGE(!PageHead(page), page); -@@ -1852,15 +1899,16 @@ static void unmap_page(struct page *page) +@@ -1852,15 +1898,16 @@ static void unmap_page(struct page *page) ttu_flags |= TTU_MIGRATION; /* We only need TTU_SPLIT_HUGE_PMD once */ @@ -103502,7 +132780,7 @@ index fad4a0ca903c..d11aef19f184 100644 } static void remap_page(struct page *page) -@@ -2091,7 +2139,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) +@@ -2091,7 +2138,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) struct pglist_data *pgdata = NODE_DATA(page_to_nid(head)); struct anon_vma *anon_vma = NULL; struct address_space *mapping = NULL; @@ -103511,7 +132789,7 @@ index fad4a0ca903c..d11aef19f184 100644 bool mlocked; unsigned long flags; pgoff_t end; -@@ -2154,7 +2202,6 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) +@@ -2154,7 +2201,6 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) mlocked = PageMlocked(page); unmap_page(head); @@ -103519,7 +132797,7 @@ index fad4a0ca903c..d11aef19f184 100644 /* Make sure the page is not on per-CPU pagevec as it takes pin */ if (mlocked) -@@ -2180,9 +2227,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) +@@ -2180,9 +2226,7 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) /* Prevent deferred_split_scan() touching ->_refcount */ spin_lock(&pgdata->split_queue_lock); @@ -103530,7 +132808,7 @@ index fad4a0ca903c..d11aef19f184 100644 if (!list_empty(page_deferred_list(head))) { pgdata->split_queue_len--; list_del(page_deferred_list(head)); -@@ -2193,16 +2238,9 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) +@@ -2193,16 +2237,9 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) __split_huge_page(page, list, end, flags); ret = 0; } else { @@ -103550,7 +132828,7 @@ index fad4a0ca903c..d11aef19f184 100644 spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags); remap_page(head); diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 9914da93069e..de89e9295f6c 100644 +index 9914da93069e..8aad9bd08462 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -66,6 +66,21 @@ DEFINE_SPINLOCK(hugetlb_lock); @@ -103767,7 +133045,88 @@ index 9914da93069e..de89e9295f6c 100644 if (ret) goto out; -@@ -3753,7 +3813,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3333,14 +3393,20 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, + struct page *page; + struct hstate *h = hstate_vma(vma); + unsigned long sz = huge_page_size(h); +- const unsigned long mmun_start = start; /* For mmu_notifiers */ +- const unsigned long mmun_end = end; /* For mmu_notifiers */ ++ unsigned long mmun_start = start; /* For mmu_notifiers */ ++ unsigned long mmun_end = end; /* For mmu_notifiers */ ++ bool force_flush = false; + + WARN_ON(!is_vm_hugetlb_page(vma)); + BUG_ON(start & ~huge_page_mask(h)); + BUG_ON(end & ~huge_page_mask(h)); + + tlb_start_vma(tlb, vma); ++ ++ /* ++ * If sharing possible, alert mmu notifiers of worst case. ++ */ ++ adjust_range_if_pmd_sharing_possible(vma, &mmun_start, &mmun_end); + mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end); + address = start; + for (; address < end; address += sz) { +@@ -3351,6 +3417,8 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, + ptl = huge_pte_lock(h, mm, ptep); + if (huge_pmd_unshare(mm, &address, ptep)) { + spin_unlock(ptl); ++ tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE); ++ force_flush = true; + continue; + } + +@@ -3407,6 +3475,22 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, + } + mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end); + tlb_end_vma(tlb, vma); ++ ++ /* ++ * If we unshared PMDs, the TLB flush was not recorded in mmu_gather. We ++ * could defer the flush until now, since by holding i_mmap_rwsem we ++ * guaranteed that the last refernece would not be dropped. But we must ++ * do the flushing before we return, as otherwise i_mmap_rwsem will be ++ * dropped and the last reference to the shared PMDs page might be ++ * dropped as well. ++ * ++ * In theory we could defer the freeing of the PMD pages as well, but ++ * huge_pmd_unshare() relies on the exact page_count for the PMD page to ++ * detect sharing, so we cannot defer the release of the page either. ++ * Instead, do flush now. ++ */ ++ if (force_flush) ++ tlb_flush_mmu(tlb); + } + + void __unmap_hugepage_range_final(struct mmu_gather *tlb, +@@ -3433,12 +3517,23 @@ void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start, + { + struct mm_struct *mm; + struct mmu_gather tlb; ++ unsigned long tlb_start = start; ++ unsigned long tlb_end = end; ++ ++ /* ++ * If shared PMDs were possibly used within this vma range, adjust ++ * start/end for worst case tlb flushing. ++ * Note that we can not be sure if PMDs are shared until we try to ++ * unmap pages. However, we want to make sure TLB flushing covers ++ * the largest possible range. ++ */ ++ adjust_range_if_pmd_sharing_possible(vma, &tlb_start, &tlb_end); + + mm = vma->vm_mm; + +- tlb_gather_mmu(&tlb, mm, start, end); ++ tlb_gather_mmu(&tlb, mm, tlb_start, tlb_end); + __unmap_hugepage_range(&tlb, vma, start, end, ref_page); +- tlb_finish_mmu(&tlb, start, end); ++ tlb_finish_mmu(&tlb, tlb_start, tlb_end); + } + + /* +@@ -3753,7 +3848,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma, * So we need to block hugepage fault by PG_hwpoison bit check. */ if (unlikely(PageHWPoison(page))) { @@ -103776,7 +133135,7 @@ index 9914da93069e..de89e9295f6c 100644 VM_FAULT_SET_HINDEX(hstate_index(h)); goto backout_unlocked; } -@@ -3824,7 +3884,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3824,7 +3919,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma, #ifdef CONFIG_SMP u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, @@ -103785,7 +133144,7 @@ index 9914da93069e..de89e9295f6c 100644 { unsigned long key[2]; u32 hash; -@@ -3832,7 +3892,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, +@@ -3832,7 +3927,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, key[0] = (unsigned long) mapping; key[1] = idx; @@ -103794,7 +133153,7 @@ index 9914da93069e..de89e9295f6c 100644 return hash & (num_fault_mutexes - 1); } -@@ -3842,7 +3902,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, +@@ -3842,7 +3937,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, * return 0 and avoid the hashing overhead. */ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping, @@ -103803,7 +133162,7 @@ index 9914da93069e..de89e9295f6c 100644 { return 0; } -@@ -3887,7 +3947,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -3887,7 +3982,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma, * get spurious allocation failures if two CPUs race to instantiate * the same page in the page cache. */ @@ -103812,7 +133171,62 @@ index 9914da93069e..de89e9295f6c 100644 mutex_lock(&hugetlb_fault_mutex_table[hash]); entry = huge_ptep_get(ptep); -@@ -4380,25 +4440,23 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr) +@@ -4126,11 +4221,21 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma, + pte_t pte; + struct hstate *h = hstate_vma(vma); + unsigned long pages = 0; ++ unsigned long f_start = start; ++ unsigned long f_end = end; ++ bool shared_pmd = false; ++ ++ /* ++ * In the case of shared PMDs, the area to flush could be beyond ++ * start/end. Set f_start/f_end to cover the maximum possible ++ * range if PMD sharing is possible. ++ */ ++ adjust_range_if_pmd_sharing_possible(vma, &f_start, &f_end); + + BUG_ON(address >= end); +- flush_cache_range(vma, address, end); ++ flush_cache_range(vma, f_start, f_end); + +- mmu_notifier_invalidate_range_start(mm, start, end); ++ mmu_notifier_invalidate_range_start(mm, f_start, f_end); + i_mmap_lock_write(vma->vm_file->f_mapping); + for (; address < end; address += huge_page_size(h)) { + spinlock_t *ptl; +@@ -4141,6 +4246,7 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma, + if (huge_pmd_unshare(mm, &address, ptep)) { + pages++; + spin_unlock(ptl); ++ shared_pmd = true; + continue; + } + pte = huge_ptep_get(ptep); +@@ -4175,12 +4281,18 @@ unsigned long hugetlb_change_protection(struct vm_area_struct *vma, + * Must flush TLB before releasing i_mmap_rwsem: x86's huge_pmd_unshare + * may have cleared our pud entry and done put_page on the page table: + * once we release i_mmap_rwsem, another task can do the final put_page +- * and that page table be reused and filled with junk. ++ * and that page table be reused and filled with junk. If we actually ++ * did unshare a page of pmds, flush the range corresponding to the pud. + */ +- flush_hugetlb_tlb_range(vma, start, end); +- mmu_notifier_invalidate_range(mm, start, end); ++ if (shared_pmd) { ++ flush_hugetlb_tlb_range(vma, f_start, f_end); ++ mmu_notifier_invalidate_range(mm, f_start, f_end); ++ } else { ++ flush_hugetlb_tlb_range(vma, start, end); ++ mmu_notifier_invalidate_range(mm, start, end); ++ } + i_mmap_unlock_write(vma->vm_file->f_mapping); +- mmu_notifier_invalidate_range_end(mm, start, end); ++ mmu_notifier_invalidate_range_end(mm, f_start, f_end); + + return pages << h->order; + } +@@ -4380,25 +4492,23 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr) void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, unsigned long *start, unsigned long *end) { @@ -103851,7 +133265,7 @@ index 9914da93069e..de89e9295f6c 100644 } /* -@@ -4647,9 +4705,9 @@ bool isolate_huge_page(struct page *page, struct list_head *list) +@@ -4647,9 +4757,9 @@ bool isolate_huge_page(struct page *page, struct list_head *list) { bool ret = true; @@ -104015,6 +133429,19 @@ index f5d1c1535f8f..7cb00eac1a4a 100644 + set_recommended_min_free_kbytes(); + mutex_unlock(&khugepaged_mutex); +} +diff --git a/mm/kmemleak.c b/mm/kmemleak.c +index bccf43c4d9f9..3d822d1491c4 100644 +--- a/mm/kmemleak.c ++++ b/mm/kmemleak.c +@@ -1454,7 +1454,7 @@ static void kmemleak_scan(void) + if (page_count(page) == 0) + continue; + scan_block(page, page + 1, NULL); +- if (!(pfn % (MAX_SCAN_SIZE / sizeof(*page)))) ++ if (!(pfn & 63)) + cond_resched(); + } + } diff --git a/mm/ksm.c b/mm/ksm.c index 34b64fb48a8b..470e268a1d94 100644 --- a/mm/ksm.c @@ -104532,7 +133959,7 @@ index a17d9c0b98fb..14be367f6f6a 100644 } diff --git a/mm/memory.c b/mm/memory.c -index cff4067b6edd..ea2a223754a2 100755 +index cff4067b6edd..144f3f262fa3 100755 --- a/mm/memory.c +++ b/mm/memory.c @@ -135,7 +135,7 @@ static int __init init_zero_pfn(void) @@ -104544,7 +133971,30 @@ index cff4067b6edd..ea2a223754a2 100755 #if defined(SPLIT_RSS_COUNTING) -@@ -1712,11 +1712,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd, +@@ -323,6 +323,22 @@ bool __tlb_remove_page_size(struct mmu_gather *tlb, struct page *page, int page_ + return false; + } + ++void tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address, ++ unsigned long size) ++{ ++ if (tlb->page_size != 0 && tlb->page_size != PMD_SIZE) ++ tlb_flush_mmu(tlb); ++ ++ tlb->page_size = PMD_SIZE; ++ tlb->start = min(tlb->start, address); ++ tlb->end = max(tlb->end, address + size); ++ /* ++ * Track the last address with which we adjusted the range. This ++ * will be used later to adjust again after a mmu_flush due to ++ * failed __tlb_remove_page ++ */ ++ tlb->addr = address + size - PMD_SIZE; ++} + #endif /* HAVE_GENERIC_MMU_GATHER */ + + #ifdef CONFIG_HAVE_RCU_TABLE_FREE +@@ -1712,11 +1728,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd, unsigned long addr, unsigned long end, unsigned long pfn, pgprot_t prot) { @@ -104558,7 +134008,7 @@ index cff4067b6edd..ea2a223754a2 100755 if (!pte) return -ENOMEM; arch_enter_lazy_mmu_mode(); -@@ -1730,7 +1730,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd, +@@ -1730,7 +1746,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd, pfn++; } while (pte++, addr += PAGE_SIZE, addr != end); arch_leave_lazy_mmu_mode(); @@ -104675,6 +134125,48 @@ index ddfff14bb63f..fa924527c8cf 100644 } vm_unacct_memory(nr_accounted); } +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index de740800a816..13ea72cbcac4 100755 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -1084,27 +1084,24 @@ bool out_of_memory(struct oom_control *oc) + } + + /* +- * The pagefault handler calls here because it is out of memory, so kill a +- * memory-hogging task. If oom_lock is held by somebody else, a parallel oom +- * killing is already in progress so do nothing. ++ * The pagefault handler calls here because some allocation has failed. We have ++ * to take care of the memcg OOM here because this is the only safe context without ++ * any locks held but let the oom killer triggered from the allocation context care ++ * about the global OOM. + */ + void pagefault_out_of_memory(void) + { +- struct oom_control oc = { +- .zonelist = NULL, +- .nodemask = NULL, +- .memcg = NULL, +- .gfp_mask = 0, +- .order = 0, +- }; ++ static DEFINE_RATELIMIT_STATE(pfoom_rs, DEFAULT_RATELIMIT_INTERVAL, ++ DEFAULT_RATELIMIT_BURST); + + if (mem_cgroup_oom_synchronize(true)) + return; + +- if (!mutex_trylock(&oom_lock)) ++ if (fatal_signal_pending(current)) + return; +- out_of_memory(&oc); +- mutex_unlock(&oom_lock); ++ ++ if (__ratelimit(&pfoom_rs)) ++ pr_warn("Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF\n"); + } + + void add_to_oom_reaper(struct task_struct *p) diff --git a/mm/page-writeback.c b/mm/page-writeback.c index 21a12577b287..a207bc406884 100644 --- a/mm/page-writeback.c @@ -104698,7 +134190,7 @@ index 21a12577b287..a207bc406884 100644 dec_zone_page_state(page, NR_ZONE_WRITE_PENDING); inc_node_page_state(page, NR_WRITTEN); diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 3f30ba2d7a09..dc37518275d9 100755 +index 3f30ba2d7a09..0e7b63a971d8 100755 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -65,6 +65,7 @@ @@ -104709,6 +134201,42 @@ index 3f30ba2d7a09..dc37518275d9 100755 #include #include +@@ -827,7 +828,7 @@ static inline void __free_one_page(struct page *page, + struct page *buddy; + unsigned int max_order; + +- max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1); ++ max_order = min_t(unsigned int, MAX_ORDER - 1, pageblock_order); + + VM_BUG_ON(!zone_is_initialized(zone)); + VM_BUG_ON_PAGE(page->flags & PAGE_FLAGS_CHECK_AT_PREP, page); +@@ -842,7 +843,7 @@ static inline void __free_one_page(struct page *page, + VM_BUG_ON_PAGE(bad_range(zone, page), page); + + continue_merging: +- while (order < max_order - 1) { ++ while (order < max_order) { + buddy_idx = __find_buddy_index(page_idx, order); + buddy = page + (buddy_idx - page_idx); + if (!page_is_buddy(page, buddy, order)) +@@ -863,7 +864,7 @@ static inline void __free_one_page(struct page *page, + page_idx = combined_idx; + order++; + } +- if (max_order < MAX_ORDER) { ++ if (order < MAX_ORDER - 1) { + /* If we are here, it means order is >= pageblock_order. + * We want to prevent merge between freepages on isolate + * pageblock and normal pageblock. Without this, pageblock +@@ -884,7 +885,7 @@ static inline void __free_one_page(struct page *page, + is_migrate_isolate(buddy_mt))) + goto done_merging; + } +- max_order++; ++ max_order = order + 1; + goto continue_merging; + } + @@ -1126,6 +1127,11 @@ static void free_pcppages_bulk(struct zone *zone, int count, spin_lock(&zone->lock); isolated_pageblocks = has_isolate_pageblock(zone); @@ -104843,6 +134371,19 @@ index d95341cffc2f..8d6290502631 100644 pte++; } +diff --git a/mm/slab.h b/mm/slab.h +index ceb7d70cdb76..34929ac0ebea 100644 +--- a/mm/slab.h ++++ b/mm/slab.h +@@ -139,7 +139,7 @@ static inline unsigned long kmem_cache_flags(unsigned long object_size, + #define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE | SLAB_RECLAIM_ACCOUNT | \ + SLAB_TEMPORARY | SLAB_NOTRACK | SLAB_ACCOUNT) + #else +-#define SLAB_CACHE_FLAGS (0) ++#define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE) + #endif + + #define CACHE_CREATE_MASK (SLAB_CORE_FLAGS | SLAB_DEBUG_FLAGS | SLAB_CACHE_FLAGS) diff --git a/mm/slab_common.c b/mm/slab_common.c index 467cf11f6990..0e6e78b96267 100644 --- a/mm/slab_common.c @@ -105003,10 +134544,51 @@ index 67c229324086..f272a74d9dcf 100644 seq_putc(m, '\n'); } diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c -index ffe8c4341ec9..ad5fc40281eb 100644 +index ffe8c4341ec9..303478ec1d3b 100644 --- a/mm/zsmalloc.c +++ b/mm/zsmalloc.c -@@ -2352,11 +2352,13 @@ static unsigned long zs_can_compact(struct size_class *class) +@@ -83,18 +83,19 @@ + * This is made more complicated by various memory models and PAE. + */ + +-#ifndef MAX_PHYSMEM_BITS +-#ifdef CONFIG_HIGHMEM64G +-#define MAX_PHYSMEM_BITS 36 +-#else /* !CONFIG_HIGHMEM64G */ ++#ifndef MAX_POSSIBLE_PHYSMEM_BITS ++#ifdef MAX_PHYSMEM_BITS ++#define MAX_POSSIBLE_PHYSMEM_BITS MAX_PHYSMEM_BITS ++#else + /* + * If this definition of MAX_PHYSMEM_BITS is used, OBJ_INDEX_BITS will just + * be PAGE_SHIFT + */ +-#define MAX_PHYSMEM_BITS BITS_PER_LONG ++#define MAX_POSSIBLE_PHYSMEM_BITS BITS_PER_LONG + #endif + #endif +-#define _PFN_BITS (MAX_PHYSMEM_BITS - PAGE_SHIFT) ++ ++#define _PFN_BITS (MAX_POSSIBLE_PHYSMEM_BITS - PAGE_SHIFT) + + /* + * Memory for allocating for handle keeps object position by +@@ -1981,10 +1982,11 @@ static inline void zs_pool_dec_isolated(struct zs_pool *pool) + VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0); + atomic_long_dec(&pool->isolated_pages); + /* +- * There's no possibility of racing, since wait_for_isolated_drain() +- * checks the isolated count under &class->lock after enqueuing +- * on migration_wait. ++ * Checking pool->destroying must happen after atomic_long_dec() ++ * for pool->isolated_pages above. Paired with the smp_mb() in ++ * zs_unregister_migration(). + */ ++ smp_mb__after_atomic(); + if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying) + wake_up_all(&pool->migration_wait); + } +@@ -2352,11 +2354,13 @@ static unsigned long zs_can_compact(struct size_class *class) return obj_wasted * class->pages_per_zspage; } @@ -105021,7 +134603,7 @@ index ffe8c4341ec9..ad5fc40281eb 100644 spin_lock(&class->lock); while ((src_zspage = isolate_zspage(class, true))) { -@@ -2386,7 +2388,7 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class) +@@ -2386,7 +2390,7 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class) putback_zspage(class, dst_zspage); if (putback_zspage(class, src_zspage) == ZS_EMPTY) { free_zspage(pool, class, src_zspage); @@ -105030,7 +134612,7 @@ index ffe8c4341ec9..ad5fc40281eb 100644 } spin_unlock(&class->lock); cond_resched(); -@@ -2397,12 +2399,15 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class) +@@ -2397,12 +2401,15 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class) putback_zspage(class, src_zspage); spin_unlock(&class->lock); @@ -105046,7 +134628,7 @@ index ffe8c4341ec9..ad5fc40281eb 100644 for (i = zs_size_classes - 1; i >= 0; i--) { class = pool->size_class[i]; -@@ -2410,10 +2415,11 @@ unsigned long zs_compact(struct zs_pool *pool) +@@ -2410,10 +2417,11 @@ unsigned long zs_compact(struct zs_pool *pool) continue; if (class->index != i) continue; @@ -105060,7 +134642,7 @@ index ffe8c4341ec9..ad5fc40281eb 100644 } EXPORT_SYMBOL_GPL(zs_compact); -@@ -2430,13 +2436,12 @@ static unsigned long zs_shrinker_scan(struct shrinker *shrinker, +@@ -2430,13 +2438,12 @@ static unsigned long zs_shrinker_scan(struct shrinker *shrinker, struct zs_pool *pool = container_of(shrinker, struct zs_pool, shrinker); @@ -105075,6 +134657,70 @@ index ffe8c4341ec9..ad5fc40281eb 100644 return pages_freed ? pages_freed : SHRINK_STOP; } +diff --git a/net/802/garp.c b/net/802/garp.c +index b38ee6dcba45..5239b8f244e7 100644 +--- a/net/802/garp.c ++++ b/net/802/garp.c +@@ -206,6 +206,19 @@ static void garp_attr_destroy(struct garp_applicant *app, struct garp_attr *attr + kfree(attr); + } + ++static void garp_attr_destroy_all(struct garp_applicant *app) ++{ ++ struct rb_node *node, *next; ++ struct garp_attr *attr; ++ ++ for (node = rb_first(&app->gid); ++ next = node ? rb_next(node) : NULL, node != NULL; ++ node = next) { ++ attr = rb_entry(node, struct garp_attr, node); ++ garp_attr_destroy(app, attr); ++ } ++} ++ + static int garp_pdu_init(struct garp_applicant *app) + { + struct sk_buff *skb; +@@ -612,6 +625,7 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl + + spin_lock_bh(&app->lock); + garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU); ++ garp_attr_destroy_all(app); + garp_pdu_queue(app); + spin_unlock_bh(&app->lock); + +diff --git a/net/802/mrp.c b/net/802/mrp.c +index 72db2785ef2c..4ee3af3d400b 100644 +--- a/net/802/mrp.c ++++ b/net/802/mrp.c +@@ -295,6 +295,19 @@ static void mrp_attr_destroy(struct mrp_applicant *app, struct mrp_attr *attr) + kfree(attr); + } + ++static void mrp_attr_destroy_all(struct mrp_applicant *app) ++{ ++ struct rb_node *node, *next; ++ struct mrp_attr *attr; ++ ++ for (node = rb_first(&app->mad); ++ next = node ? rb_next(node) : NULL, node != NULL; ++ node = next) { ++ attr = rb_entry(node, struct mrp_attr, node); ++ mrp_attr_destroy(app, attr); ++ } ++} ++ + static int mrp_pdu_init(struct mrp_applicant *app) + { + struct sk_buff *skb; +@@ -900,6 +913,7 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl) + + spin_lock_bh(&app->lock); + mrp_mad_event(app, MRP_EVENT_TX); ++ mrp_attr_destroy_all(app); + mrp_pdu_queue(app); + spin_unlock_bh(&app->lock); + diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index aa4586672cee..33b317a25a2d 100644 --- a/net/9p/trans_fd.c @@ -105182,6 +134828,41 @@ index aa4586672cee..33b317a25a2d 100644 return -EINVAL; if (strlen(addr) >= UNIX_PATH_MAX) { +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index f88911cffa1a..c6a46e8e9eda 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -602,7 +602,7 @@ static int p9_virtio_probe(struct virtio_device *vdev) + chan->vc_wq = kmalloc(sizeof(wait_queue_head_t), GFP_KERNEL); + if (!chan->vc_wq) { + err = -ENOMEM; +- goto out_free_tag; ++ goto out_remove_file; + } + init_waitqueue_head(chan->vc_wq); + chan->ring_bufs_avail = 1; +@@ -620,6 +620,8 @@ static int p9_virtio_probe(struct virtio_device *vdev) + + return 0; + ++out_remove_file: ++ sysfs_remove_file(&vdev->dev.kobj, &dev_attr_mount_tag.attr); + out_free_tag: + kfree(tag); + out_free_vq: +diff --git a/net/Makefile b/net/Makefile +index c84a3470ad8d..83e91dcafec0 100644 +--- a/net/Makefile ++++ b/net/Makefile +@@ -16,7 +16,7 @@ obj-$(CONFIG_NET) += ethernet/ 802/ sched/ netlink/ + obj-$(CONFIG_NETFILTER) += netfilter/ + obj-$(CONFIG_INET) += ipv4/ + obj-$(CONFIG_XFRM) += xfrm/ +-obj-$(CONFIG_UNIX) += unix/ ++obj-$(CONFIG_UNIX_SCM) += unix/ + obj-$(CONFIG_NET) += ipv6/ + obj-$(CONFIG_PACKET) += packet/ + obj-$(CONFIG_NET_KEY) += key/ diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c index 93209c009df5..a66de21671ac 100644 --- a/net/appletalk/ddp.c @@ -105269,10 +134950,22 @@ index 704892d79bf1..756429c95e85 100644 vcc_release_async(entry->recv_vcc, -EPIPE); entry->recv_vcc = NULL; diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c -index 02be8ee23271..64fede18aa33 100644 +index 02be8ee23271..f4c8567e91b3 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c -@@ -1191,7 +1191,10 @@ static int __must_check ax25_connect(struct socket *sock, +@@ -88,8 +88,10 @@ static void ax25_kill_by_device(struct net_device *dev) + again: + ax25_for_each(s, &ax25_list) { + if (s->ax25_dev == ax25_dev) { +- s->ax25_dev = NULL; + spin_unlock_bh(&ax25_list_lock); ++ lock_sock(s->sk); ++ s->ax25_dev = NULL; ++ release_sock(s->sk); + ax25_disconnect(s, ENETUNREACH); + spin_lock_bh(&ax25_list_lock); + +@@ -1191,7 +1193,10 @@ static int __must_check ax25_connect(struct socket *sock, if (addr_len > sizeof(struct sockaddr_ax25) && fsa->fsa_ax25.sax25_ndigis != 0) { /* Valid number of digipeaters ? */ @@ -105284,7 +134977,7 @@ index 02be8ee23271..64fede18aa33 100644 err = -EINVAL; goto out_release; } -@@ -1510,7 +1513,10 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) +@@ -1510,7 +1515,10 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax; /* Valid number of digipeaters ? */ @@ -105312,8 +135005,37 @@ index 2b663622bdb4..f85e6a9ee5ea 100644 if (forw_packet->if_incoming->if_status != BATADV_IF_ACTIVE) return; +diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c +index d2e6885479cb..cb94ac988618 100644 +--- a/net/batman-adv/bat_v_ogm.c ++++ b/net/batman-adv/bat_v_ogm.c +@@ -690,6 +690,12 @@ static void batadv_v_ogm_process(const struct sk_buff *skb, int ogm_offset, + ntohl(ogm_packet->seqno), ogm_throughput, ogm_packet->ttl, + ogm_packet->version, ntohs(ogm_packet->tvlv_len)); + ++ if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) { ++ batadv_dbg(BATADV_DBG_BATMAN, bat_priv, ++ "Drop packet: originator packet from ourself\n"); ++ return; ++ } ++ + /* If the troughput metric is 0, immediately drop the packet. No need to + * create orig_node / neigh_node for an unusable route. + */ +@@ -788,11 +794,6 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb, + if (batadv_is_my_mac(bat_priv, ethhdr->h_source)) + return NET_RX_DROP; + +- ogm_packet = (struct batadv_ogm2_packet *)skb->data; +- +- if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) +- return NET_RX_DROP; +- + batadv_inc_counter(bat_priv, BATADV_CNT_MGMT_RX); + batadv_add_counter(bat_priv, BATADV_CNT_MGMT_RX_BYTES, + skb->len + ETH_HLEN); diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c -index 00123064eb26..516c45771d59 100644 +index 00123064eb26..a087f559f93e 100644 --- a/net/batman-adv/bridge_loop_avoidance.c +++ b/net/batman-adv/bridge_loop_avoidance.c @@ -36,6 +36,7 @@ @@ -105352,7 +135074,161 @@ index 00123064eb26..516c45771d59 100644 out: if (primary_if) batadv_hardif_put(primary_if); -@@ -1817,7 +1822,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb, +@@ -1564,10 +1569,14 @@ int batadv_bla_init(struct batadv_priv *bat_priv) + return 0; + + bat_priv->bla.claim_hash = batadv_hash_new(128); +- bat_priv->bla.backbone_hash = batadv_hash_new(32); ++ if (!bat_priv->bla.claim_hash) ++ return -ENOMEM; + +- if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash) ++ bat_priv->bla.backbone_hash = batadv_hash_new(32); ++ if (!bat_priv->bla.backbone_hash) { ++ batadv_hash_destroy(bat_priv->bla.claim_hash); + return -ENOMEM; ++ } + + batadv_hash_set_lock_class(bat_priv->bla.claim_hash, + &batadv_claim_hash_lock_class_key); +@@ -1584,13 +1593,16 @@ int batadv_bla_init(struct batadv_priv *bat_priv) + } + + /** +- * batadv_bla_check_bcast_duplist - Check if a frame is in the broadcast dup. ++ * batadv_bla_check_duplist() - Check if a frame is in the broadcast dup. + * @bat_priv: the bat priv with all the soft interface information +- * @skb: contains the bcast_packet to be checked ++ * @skb: contains the multicast packet to be checked ++ * @payload_ptr: pointer to position inside the head buffer of the skb ++ * marking the start of the data to be CRC'ed ++ * @orig: originator mac address, NULL if unknown + * +- * check if it is on our broadcast list. Another gateway might +- * have sent the same packet because it is connected to the same backbone, +- * so we have to remove this duplicate. ++ * Check if it is on our broadcast list. Another gateway might have sent the ++ * same packet because it is connected to the same backbone, so we have to ++ * remove this duplicate. + * + * This is performed by checking the CRC, which will tell us + * with a good chance that it is the same packet. If it is furthermore +@@ -1599,19 +1611,17 @@ int batadv_bla_init(struct batadv_priv *bat_priv) + * + * Return: true if a packet is in the duplicate list, false otherwise. + */ +-bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, +- struct sk_buff *skb) ++static bool batadv_bla_check_duplist(struct batadv_priv *bat_priv, ++ struct sk_buff *skb, u8 *payload_ptr, ++ const u8 *orig) + { +- int i, curr; +- __be32 crc; +- struct batadv_bcast_packet *bcast_packet; + struct batadv_bcast_duplist_entry *entry; + bool ret = false; +- +- bcast_packet = (struct batadv_bcast_packet *)skb->data; ++ int i, curr; ++ __be32 crc; + + /* calculate the crc ... */ +- crc = batadv_skb_crc32(skb, (u8 *)(bcast_packet + 1)); ++ crc = batadv_skb_crc32(skb, payload_ptr); + + spin_lock_bh(&bat_priv->bla.bcast_duplist_lock); + +@@ -1630,8 +1640,21 @@ bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, + if (entry->crc != crc) + continue; + +- if (batadv_compare_eth(entry->orig, bcast_packet->orig)) +- continue; ++ /* are the originators both known and not anonymous? */ ++ if (orig && !is_zero_ether_addr(orig) && ++ !is_zero_ether_addr(entry->orig)) { ++ /* If known, check if the new frame came from ++ * the same originator: ++ * We are safe to take identical frames from the ++ * same orig, if known, as multiplications in ++ * the mesh are detected via the (orig, seqno) pair. ++ * So we can be a bit more liberal here and allow ++ * identical frames from the same orig which the source ++ * host might have sent multiple times on purpose. ++ */ ++ if (batadv_compare_eth(entry->orig, orig)) ++ continue; ++ } + + /* this entry seems to match: same crc, not too old, + * and from another gw. therefore return true to forbid it. +@@ -1647,7 +1670,14 @@ bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, + entry = &bat_priv->bla.bcast_duplist[curr]; + entry->crc = crc; + entry->entrytime = jiffies; +- ether_addr_copy(entry->orig, bcast_packet->orig); ++ ++ /* known originator */ ++ if (orig) ++ ether_addr_copy(entry->orig, orig); ++ /* anonymous originator */ ++ else ++ eth_zero_addr(entry->orig); ++ + bat_priv->bla.bcast_duplist_curr = curr; + + out: +@@ -1656,6 +1686,48 @@ bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, + return ret; + } + ++/** ++ * batadv_bla_check_ucast_duplist() - Check if a frame is in the broadcast dup. ++ * @bat_priv: the bat priv with all the soft interface information ++ * @skb: contains the multicast packet to be checked, decapsulated from a ++ * unicast_packet ++ * ++ * Check if it is on our broadcast list. Another gateway might have sent the ++ * same packet because it is connected to the same backbone, so we have to ++ * remove this duplicate. ++ * ++ * Return: true if a packet is in the duplicate list, false otherwise. ++ */ ++static bool batadv_bla_check_ucast_duplist(struct batadv_priv *bat_priv, ++ struct sk_buff *skb) ++{ ++ return batadv_bla_check_duplist(bat_priv, skb, (u8 *)skb->data, NULL); ++} ++ ++/** ++ * batadv_bla_check_bcast_duplist() - Check if a frame is in the broadcast dup. ++ * @bat_priv: the bat priv with all the soft interface information ++ * @skb: contains the bcast_packet to be checked ++ * ++ * Check if it is on our broadcast list. Another gateway might have sent the ++ * same packet because it is connected to the same backbone, so we have to ++ * remove this duplicate. ++ * ++ * Return: true if a packet is in the duplicate list, false otherwise. ++ */ ++bool batadv_bla_check_bcast_duplist(struct batadv_priv *bat_priv, ++ struct sk_buff *skb) ++{ ++ struct batadv_bcast_packet *bcast_packet; ++ u8 *payload_ptr; ++ ++ bcast_packet = (struct batadv_bcast_packet *)skb->data; ++ payload_ptr = (u8 *)(bcast_packet + 1); ++ ++ return batadv_bla_check_duplist(bat_priv, skb, payload_ptr, ++ bcast_packet->orig); ++} ++ + /** + * batadv_bla_is_backbone_gw_orig - Check if the originator is a gateway for + * the VLAN identified by vid. +@@ -1817,7 +1889,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb, * @bat_priv: the bat priv with all the soft interface information * @skb: the frame to be checked * @vid: the VLAN ID of the frame @@ -105361,7 +135237,7 @@ index 00123064eb26..516c45771d59 100644 * * batadv_bla_rx avoidance checks if: * * we have to race for a claim -@@ -1829,7 +1834,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb, +@@ -1829,7 +1901,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb, * further process the skb. */ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb, @@ -105370,7 +135246,7 @@ index 00123064eb26..516c45771d59 100644 { struct batadv_bla_backbone_gw *backbone_gw; struct ethhdr *ethhdr; -@@ -1851,9 +1856,24 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb, +@@ -1851,9 +1923,32 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb, goto handled; if (unlikely(atomic_read(&bat_priv->bla.num_requests))) @@ -105395,10 +135271,18 @@ index 00123064eb26..516c45771d59 100644 + if (packet_type == BATADV_BCAST || + packet_type == BATADV_UNICAST) + goto handled; ++ ++ /* potential duplicates from foreign BLA backbone gateways via ++ * multicast-in-unicast packets ++ */ ++ if (is_multicast_ether_addr(ethhdr->h_dest) && ++ packet_type == BATADV_UNICAST && ++ batadv_bla_check_ucast_duplist(bat_priv, skb)) ++ goto handled; ether_addr_copy(search_claim.addr, ethhdr->h_source); search_claim.vid = vid; -@@ -1881,13 +1901,14 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb, +@@ -1881,13 +1976,14 @@ bool batadv_bla_rx(struct batadv_priv *bat_priv, struct sk_buff *skb, goto allow; } @@ -105439,6 +135323,116 @@ index 1ae93e46fb98..40b8ec9d4b1b 100644 { return false; } +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index fef21f75892e..343f4fc5909d 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -394,9 +394,10 @@ bool batadv_frag_skb_fwd(struct sk_buff *skb, + + /** + * batadv_frag_create - create a fragment from skb ++ * @net_dev: outgoing device for fragment + * @skb: skb to create fragment from + * @frag_head: header to use in new fragment +- * @mtu: size of new fragment ++ * @fragment_size: size of new fragment + * + * Split the passed skb into two fragments: A new one with size matching the + * passed mtu and the old one with the rest. The new skb contains data from the +@@ -404,22 +405,25 @@ bool batadv_frag_skb_fwd(struct sk_buff *skb, + * + * Return: the new fragment, NULL on error. + */ +-static struct sk_buff *batadv_frag_create(struct sk_buff *skb, ++static struct sk_buff *batadv_frag_create(struct net_device *net_dev, ++ struct sk_buff *skb, + struct batadv_frag_packet *frag_head, +- unsigned int mtu) ++ unsigned int fragment_size) + { ++ unsigned int ll_reserved = LL_RESERVED_SPACE(net_dev); ++ unsigned int tailroom = net_dev->needed_tailroom; + struct sk_buff *skb_fragment; + unsigned int header_size = sizeof(*frag_head); +- unsigned int fragment_size = mtu - header_size; ++ unsigned int mtu = fragment_size + header_size; + +- skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN); ++ skb_fragment = dev_alloc_skb(ll_reserved + mtu + tailroom); + if (!skb_fragment) + goto err; + + skb_fragment->priority = skb->priority; + + /* Eat the last mtu-bytes of the skb */ +- skb_reserve(skb_fragment, header_size + ETH_HLEN); ++ skb_reserve(skb_fragment, ll_reserved + header_size); + skb_split(skb, skb_fragment, skb->len - fragment_size); + + /* Add the header */ +@@ -443,13 +447,14 @@ int batadv_frag_send_packet(struct sk_buff *skb, + struct batadv_orig_node *orig_node, + struct batadv_neigh_node *neigh_node) + { ++ struct net_device *net_dev = neigh_node->if_incoming->net_dev; + struct batadv_priv *bat_priv; + struct batadv_hard_iface *primary_if = NULL; + struct batadv_frag_packet frag_header; + struct sk_buff *skb_fragment; +- unsigned int mtu = neigh_node->if_incoming->net_dev->mtu; ++ unsigned int mtu = net_dev->mtu; + unsigned int header_size = sizeof(frag_header); +- unsigned int max_fragment_size, max_packet_size; ++ unsigned int max_fragment_size, num_fragments; + int ret = -1; + + /* To avoid merge and refragmentation at next-hops we never send +@@ -457,10 +462,15 @@ int batadv_frag_send_packet(struct sk_buff *skb, + */ + mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE); + max_fragment_size = mtu - header_size; +- max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS; ++ ++ if (skb->len == 0 || max_fragment_size == 0) ++ return -EINVAL; ++ ++ num_fragments = (skb->len - 1) / max_fragment_size + 1; ++ max_fragment_size = (skb->len - 1) / num_fragments + 1; + + /* Don't even try to fragment, if we need more than 16 fragments */ +- if (skb->len > max_packet_size) ++ if (num_fragments > BATADV_FRAG_MAX_FRAGMENTS) + goto out; + + bat_priv = orig_node->bat_priv; +@@ -498,7 +508,8 @@ int batadv_frag_send_packet(struct sk_buff *skb, + goto out; + } + +- skb_fragment = batadv_frag_create(skb, &frag_header, mtu); ++ skb_fragment = batadv_frag_create(net_dev, skb, &frag_header, ++ max_fragment_size); + if (!skb_fragment) + goto out; + +@@ -517,11 +528,14 @@ int batadv_frag_send_packet(struct sk_buff *skb, + frag_header.no++; + } + +- /* Make room for the fragment header. */ +- if (batadv_skb_head_push(skb, header_size) < 0 || +- pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) ++ /* make sure that there is at least enough head for the fragmentation ++ * and ethernet headers ++ */ ++ ret = skb_cow_head(skb, ETH_HLEN + header_size); ++ if (ret < 0) + goto out; + ++ skb_push(skb, header_size); + memcpy(skb->data, &frag_header, header_size); + + /* Send the last fragment */ diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c index 3bd7ed6b6b3e..9727afc030d8 100644 --- a/net/batman-adv/gateway_client.c @@ -105456,6 +135450,20 @@ index 3bd7ed6b6b3e..9727afc030d8 100644 /* check if the DHCP packet carries an Ethernet DHCP */ p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET; if (*p != BATADV_DHCP_HTYPE_ETHERNET) +diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c +index f528761674df..4f384abb4ced 100644 +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -359,6 +359,9 @@ static void batadv_hardif_recalc_extra_skbroom(struct net_device *soft_iface) + needed_headroom = lower_headroom + (lower_header_len - ETH_HLEN); + needed_headroom += batadv_max_header_len(); + ++ /* fragmentation headers don't strip the unicast/... header */ ++ needed_headroom += sizeof(struct batadv_frag_packet); ++ + soft_iface->needed_headroom = needed_headroom; + soft_iface->needed_tailroom = lower_tailroom; + } diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c index 56dc532f7a2c..b422a8b34b9f 100644 --- a/net/batman-adv/log.c @@ -105468,6 +135476,191 @@ index 56dc532f7a2c..b422a8b34b9f 100644 }; int batadv_debug_log_setup(struct batadv_priv *bat_priv) +diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c +index 2c017ab47557..96b6ab9681cd 100644 +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -177,29 +177,41 @@ int batadv_mesh_init(struct net_device *soft_iface) + INIT_HLIST_HEAD(&bat_priv->softif_vlan_list); + INIT_HLIST_HEAD(&bat_priv->tp_list); + +- ret = batadv_v_mesh_init(bat_priv); +- if (ret < 0) +- goto err; +- + ret = batadv_originator_init(bat_priv); +- if (ret < 0) +- goto err; ++ if (ret < 0) { ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); ++ goto err_orig; ++ } + + ret = batadv_tt_init(bat_priv); +- if (ret < 0) +- goto err; ++ if (ret < 0) { ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); ++ goto err_tt; ++ } ++ ++ ret = batadv_v_mesh_init(bat_priv); ++ if (ret < 0) { ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); ++ goto err_v; ++ } + + ret = batadv_bla_init(bat_priv); +- if (ret < 0) +- goto err; ++ if (ret < 0) { ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); ++ goto err_bla; ++ } + + ret = batadv_dat_init(bat_priv); +- if (ret < 0) +- goto err; ++ if (ret < 0) { ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); ++ goto err_dat; ++ } + + ret = batadv_nc_mesh_init(bat_priv); +- if (ret < 0) +- goto err; ++ if (ret < 0) { ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); ++ goto err_nc; ++ } + + batadv_gw_init(bat_priv); + batadv_mcast_init(bat_priv); +@@ -209,8 +221,20 @@ int batadv_mesh_init(struct net_device *soft_iface) + + return 0; + +-err: +- batadv_mesh_free(soft_iface); ++err_nc: ++ batadv_dat_free(bat_priv); ++err_dat: ++ batadv_bla_free(bat_priv); ++err_bla: ++ batadv_v_mesh_free(bat_priv); ++err_v: ++ batadv_tt_free(bat_priv); ++err_tt: ++ batadv_originator_free(bat_priv); ++err_orig: ++ batadv_purge_outstanding_packets(bat_priv, NULL); ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE); ++ + return ret; + } + +diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c +index 5a2aac17805b..283ac3fb9429 100644 +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -53,10 +53,12 @@ + #include + #include + ++#include "bridge_loop_avoidance.h" + #include "hard-interface.h" + #include "hash.h" + #include "log.h" + #include "packet.h" ++#include "send.h" + #include "translation-table.h" + #include "tvlv.h" + +@@ -1251,6 +1253,35 @@ void batadv_mcast_free(struct batadv_priv *bat_priv) + spin_unlock_bh(&bat_priv->tt.commit_lock); + } + ++/** ++ * batadv_mcast_forw_send_orig() - send a multicast packet to an originator ++ * @bat_priv: the bat priv with all the soft interface information ++ * @skb: the multicast packet to send ++ * @vid: the vlan identifier ++ * @orig_node: the originator to send the packet to ++ * ++ * Return: NET_XMIT_DROP in case of error or NET_XMIT_SUCCESS otherwise. ++ */ ++int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, ++ struct sk_buff *skb, ++ unsigned short vid, ++ struct batadv_orig_node *orig_node) ++{ ++ /* Avoid sending multicast-in-unicast packets to other BLA ++ * gateways - they already got the frame from the LAN side ++ * we share with them. ++ * TODO: Refactor to take BLA into account earlier, to avoid ++ * reducing the mcast_fanout count. ++ */ ++ if (batadv_bla_is_backbone_gw_orig(bat_priv, orig_node->orig, vid)) { ++ dev_kfree_skb(skb); ++ return NET_XMIT_SUCCESS; ++ } ++ ++ return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST, 0, ++ orig_node, vid); ++} ++ + /** + * batadv_mcast_purge_orig - reset originator global mcast state modifications + * @orig: the originator which is going to get purged +diff --git a/net/batman-adv/multicast.h b/net/batman-adv/multicast.h +index 1fb00ba84907..751f54756164 100644 +--- a/net/batman-adv/multicast.h ++++ b/net/batman-adv/multicast.h +@@ -45,6 +45,11 @@ enum batadv_forw_mode + batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, + struct batadv_orig_node **mcast_single_orig); + ++int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, ++ struct sk_buff *skb, ++ unsigned short vid, ++ struct batadv_orig_node *orig_node); ++ + void batadv_mcast_init(struct batadv_priv *bat_priv); + + int batadv_mcast_flags_seq_print_text(struct seq_file *seq, void *offset); +@@ -71,6 +76,16 @@ static inline int batadv_mcast_init(struct batadv_priv *bat_priv) + return 0; + } + ++static inline int ++batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, ++ struct sk_buff *skb, ++ unsigned short vid, ++ struct batadv_orig_node *orig_node) ++{ ++ kfree_skb(skb); ++ return NET_XMIT_DROP; ++} ++ + static inline void batadv_mcast_free(struct batadv_priv *bat_priv) + { + } +diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c +index 09549885cd14..b0a85bd72afc 100644 +--- a/net/batman-adv/network-coding.c ++++ b/net/batman-adv/network-coding.c +@@ -166,8 +166,10 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv) + &batadv_nc_coding_hash_lock_class_key); + + bat_priv->nc.decoding_hash = batadv_hash_new(128); +- if (!bat_priv->nc.decoding_hash) ++ if (!bat_priv->nc.decoding_hash) { ++ batadv_hash_destroy(bat_priv->nc.coding_hash); + goto err; ++ } + + batadv_hash_set_lock_class(bat_priv->nc.decoding_hash, + &batadv_nc_decoding_hash_lock_class_key); diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c index 19059ae26e51..1ba205c3ea9f 100644 --- a/net/batman-adv/routing.c @@ -105484,10 +135677,22 @@ index 19059ae26e51..1ba205c3ea9f 100644 * roaming. In this case, it means that the node has got a ROAM_ADV * message and that it knows the new destination in the mesh to re-route diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c -index 99d2c453c872..af0a8439cf08 100644 +index 99d2c453c872..4805c98588dc 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c -@@ -415,10 +415,10 @@ void batadv_interface_rx(struct net_device *soft_iface, +@@ -356,9 +356,8 @@ static int batadv_interface_tx(struct sk_buff *skb, + goto dropped; + ret = batadv_send_skb_via_gw(bat_priv, skb, vid); + } else if (mcast_single_orig) { +- ret = batadv_send_skb_unicast(bat_priv, skb, +- BATADV_UNICAST, 0, +- mcast_single_orig, vid); ++ ret = batadv_mcast_forw_send_orig(bat_priv, skb, vid, ++ mcast_single_orig); + } else { + if (batadv_dat_snoop_outgoing_arp_request(bat_priv, + skb)) +@@ -415,10 +414,10 @@ void batadv_interface_rx(struct net_device *soft_iface, struct vlan_ethhdr *vhdr; struct ethhdr *ethhdr; unsigned short vid; @@ -105500,7 +135705,7 @@ index 99d2c453c872..af0a8439cf08 100644 skb_pull_rcsum(skb, hdr_size); skb_reset_mac_header(skb); -@@ -463,7 +463,7 @@ void batadv_interface_rx(struct net_device *soft_iface, +@@ -463,7 +462,7 @@ void batadv_interface_rx(struct net_device *soft_iface, /* Let the bridge loop avoidance check the packet. If will * not handle it, we can safely push it up. */ @@ -105510,7 +135715,7 @@ index 99d2c453c872..af0a8439cf08 100644 if (orig_node) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c -index d40d83949b00..607d8bac8376 100644 +index d40d83949b00..6e9844e73bac 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -897,6 +897,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, @@ -105529,6 +135734,18 @@ index d40d83949b00..607d8bac8376 100644 tt_vlan++; } +@@ -4371,8 +4373,10 @@ int batadv_tt_init(struct batadv_priv *bat_priv) + return ret; + + ret = batadv_tt_global_init(bat_priv); +- if (ret < 0) ++ if (ret < 0) { ++ batadv_tt_local_table_free(bat_priv); + return ret; ++ } + + batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1, + batadv_tt_tvlv_unicast_handler_v1, diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index 21096c882223..3bfd747aa515 100644 --- a/net/bluetooth/6lowpan.c @@ -105695,6 +135912,19 @@ index e32f34189007..b01b43ab6f83 100644 cp.phy_handle = hcon->handle; cp.len_so_far = cpu_to_le16(0); cp.max_len = cpu_to_le16(hdev->amp_assoc_size); +diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h +index c32638dddbf9..f6b9dc4e408f 100644 +--- a/net/bluetooth/cmtp/cmtp.h ++++ b/net/bluetooth/cmtp/cmtp.h +@@ -26,7 +26,7 @@ + #include + #include + +-#define BTNAMSIZ 18 ++#define BTNAMSIZ 21 + + /* CMTP ioctl defines */ + #define CMTPCONNADD _IOW('C', 200, int) diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c index 1152ce34dad4..0bb150e68c53 100644 --- a/net/bluetooth/cmtp/core.c @@ -105740,10 +135970,23 @@ index 1d085eed72d0..e3cd81ce2a7b 100644 !test_bit(HCI_CONN_ENCRYPT, &conn->flags)) return 0; diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index a70b078ceb3c..50b9a0bbe5df 100644 +index a70b078ceb3c..b43f31203a43 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c -@@ -1243,8 +1243,10 @@ int hci_inquiry(void __user *arg) +@@ -1223,6 +1223,12 @@ int hci_inquiry(void __user *arg) + goto done; + } + ++ /* Restrict maximum inquiry length to 60 seconds */ ++ if (ir.length > 60) { ++ err = -EINVAL; ++ goto done; ++ } ++ + hci_dev_lock(hdev); + if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || + inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) { +@@ -1243,8 +1249,10 @@ int hci_inquiry(void __user *arg) * cleared). If it is interrupted by a signal, return -EINTR. */ if (wait_on_bit(&hdev->flags, HCI_INQUIRY, @@ -105756,7 +135999,7 @@ index a70b078ceb3c..50b9a0bbe5df 100644 } /* for unlimited number of responses we will use buffer with -@@ -1420,8 +1422,13 @@ static int hci_dev_do_open(struct hci_dev *hdev) +@@ -1420,8 +1428,13 @@ static int hci_dev_do_open(struct hci_dev *hdev) } else { /* Init failed, cleanup */ flush_work(&hdev->tx_work); @@ -105771,24 +136014,9 @@ index a70b078ceb3c..50b9a0bbe5df 100644 skb_queue_purge(&hdev->cmd_q); skb_queue_purge(&hdev->rx_q); -@@ -1526,14 +1533,6 @@ int hci_dev_do_close(struct hci_dev *hdev) - - BT_DBG("%s %p", hdev->name, hdev); - -- if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && -- !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && -- test_bit(HCI_UP, &hdev->flags)) { -- /* Execute vendor specific shutdown routine */ -- if (hdev->shutdown) -- hdev->shutdown(hdev); -- } -- - cancel_delayed_work(&hdev->power_off); - +@@ -1539,6 +1552,14 @@ int hci_dev_do_close(struct hci_dev *hdev) hci_request_cancel_all(hdev); -@@ -1601,6 +1600,14 @@ int hci_dev_do_close(struct hci_dev *hdev) - clear_bit(HCI_INIT, &hdev->flags); - } + hci_req_sync_lock(hdev); + if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && + !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && @@ -105798,11 +136026,54 @@ index a70b078ceb3c..50b9a0bbe5df 100644 + hdev->shutdown(hdev); + } + - /* flush cmd work */ - flush_work(&hdev->cmd_work); + if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { + cancel_delayed_work_sync(&hdev->cmd_timer); + hci_req_sync_unlock(hdev); +@@ -3139,14 +3160,10 @@ EXPORT_SYMBOL(hci_register_dev); + /* Unregister HCI device */ + void hci_unregister_dev(struct hci_dev *hdev) + { +- int id; +- + BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); + hci_dev_set_flag(hdev, HCI_UNREGISTER); + +- id = hdev->id; +- + write_lock(&hci_dev_list_lock); + list_del(&hdev->list); + write_unlock(&hci_dev_list_lock); +@@ -3175,7 +3192,14 @@ void hci_unregister_dev(struct hci_dev *hdev) + } + + device_del(&hdev->dev); ++ /* Actual cleanup is deferred until hci_cleanup_dev(). */ ++ hci_dev_put(hdev); ++} ++EXPORT_SYMBOL(hci_unregister_dev); + ++/* Cleanup HCI device */ ++void hci_cleanup_dev(struct hci_dev *hdev) ++{ + debugfs_remove_recursive(hdev->debugfs); + kfree_const(hdev->hw_info); + kfree_const(hdev->fw_info); +@@ -3197,11 +3221,8 @@ void hci_unregister_dev(struct hci_dev *hdev) + hci_discovery_filter_clear(hdev); + hci_dev_unlock(hdev); + +- hci_dev_put(hdev); +- +- ida_simple_remove(&hci_index_ida, id); ++ ida_simple_remove(&hci_index_ida, hdev->id); + } +-EXPORT_SYMBOL(hci_unregister_dev); + + /* Suspend HCI device */ + int hci_suspend_dev(struct hci_dev *hdev) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index 6f78489fdb13..44eeb27e341a 100644 +index 6f78489fdb13..f9484755a9ba 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -41,12 +41,27 @@ @@ -105975,7 +136246,29 @@ index 6f78489fdb13..44eeb27e341a 100644 hci_dev_unlock(hdev); } -@@ -3775,6 +3774,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, +@@ -3762,6 +3761,21 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, + + switch (ev->status) { + case 0x00: ++ /* The synchronous connection complete event should only be ++ * sent once per new connection. Receiving a successful ++ * complete event when the connection status is already ++ * BT_CONNECTED means that the device is misbehaving and sent ++ * multiple complete event packets for the same new connection. ++ * ++ * Registering the device more than once can corrupt kernel ++ * memory, hence upon detecting this invalid event, we report ++ * an error and ignore the packet. ++ */ ++ if (conn->state == BT_CONNECTED) { ++ bt_dev_err(hdev, "Ignoring connect complete event for existing connection"); ++ goto unlock; ++ } ++ + conn->handle = __le16_to_cpu(ev->handle); + conn->state = BT_CONNECTED; + conn->type = ev->link_type; +@@ -3775,6 +3789,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, case 0x11: /* Unsupported Feature or Parameter Value */ case 0x1c: /* SCO interval rejected */ case 0x1a: /* Unsupported Remote Feature */ @@ -105983,7 +136276,7 @@ index 6f78489fdb13..44eeb27e341a 100644 case 0x1f: /* Unspecified error */ case 0x20: /* Unsupported LMP Parameter value */ if (conn->out) { -@@ -3825,7 +3825,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, +@@ -3825,7 +3840,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, BT_DBG("%s num_rsp %d", hdev->name, num_rsp); @@ -105992,7 +136285,7 @@ index 6f78489fdb13..44eeb27e341a 100644 return; if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) -@@ -4350,6 +4350,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev, +@@ -4350,6 +4365,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev, return; } @@ -106004,7 +136297,7 @@ index 6f78489fdb13..44eeb27e341a 100644 if (ev->status) { hci_conn_del(hcon); hci_dev_unlock(hdev); -@@ -4394,6 +4399,7 @@ static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) +@@ -4394,6 +4414,7 @@ static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) return; hchan->handle = le16_to_cpu(ev->handle); @@ -106012,7 +136305,7 @@ index 6f78489fdb13..44eeb27e341a 100644 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan); -@@ -4426,7 +4432,7 @@ static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, +@@ -4426,7 +4447,7 @@ static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, hci_dev_lock(hdev); hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle)); @@ -106021,7 +136314,7 @@ index 6f78489fdb13..44eeb27e341a 100644 goto unlock; amp_destroy_logical_link(hchan, ev->reason); -@@ -4756,6 +4762,11 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, +@@ -4756,6 +4777,11 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, return; } @@ -106033,7 +136326,7 @@ index 6f78489fdb13..44eeb27e341a 100644 /* Find the end of the data in case the report contains padded zero * bytes at the end causing an invalid length value. * -@@ -4816,7 +4827,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, +@@ -4816,7 +4842,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, */ conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type, direct_addr); @@ -106042,7 +136335,7 @@ index 6f78489fdb13..44eeb27e341a 100644 /* Store report for later inclusion by * mgmt_device_connected */ -@@ -4941,10 +4952,14 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) +@@ -4941,10 +4967,14 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) struct hci_ev_le_advertising_info *ev = ptr; s8 rssi; @@ -106061,7 +136354,7 @@ index 6f78489fdb13..44eeb27e341a 100644 ptr += sizeof(*ev) + ev->length + 1; } -@@ -5132,20 +5147,18 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, +@@ -5132,20 +5162,18 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) { u8 num_reports = skb->data[0]; @@ -106087,7 +136380,7 @@ index 6f78489fdb13..44eeb27e341a 100644 hci_dev_unlock(hdev); } -@@ -5249,6 +5262,11 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) +@@ -5249,6 +5277,11 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) u8 status = 0, event = hdr->evt, req_evt = 0; u16 opcode = HCI_OP_NOP; @@ -106099,7 +136392,7 @@ index 6f78489fdb13..44eeb27e341a 100644 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) { struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data; opcode = __le16_to_cpu(cmd_hdr->opcode); -@@ -5460,6 +5478,7 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) +@@ -5460,6 +5493,7 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) req_complete_skb(hdev, status, opcode, orig_skb); } @@ -106133,27 +136426,151 @@ index 4a89e121d662..bfbfe1758978 100644 return ret; diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c -index 44b3146c6117..35f5585188de 100644 +index 44b3146c6117..d30163eb1643 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c -@@ -750,7 +750,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event) - /* Detach sockets from device */ +@@ -59,6 +59,17 @@ struct hci_pinfo { + char comm[TASK_COMM_LEN]; + }; + ++static struct hci_dev *hci_hdev_from_sock(struct sock *sk) ++{ ++ struct hci_dev *hdev = hci_pi(sk)->hdev; ++ ++ if (!hdev) ++ return ERR_PTR(-EBADFD); ++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) ++ return ERR_PTR(-EPIPE); ++ return hdev; ++} ++ + void hci_sock_set_flag(struct sock *sk, int nr) + { + set_bit(nr, &hci_pi(sk)->flags); +@@ -747,19 +758,13 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event) + if (event == HCI_DEV_UNREG) { + struct sock *sk; + +- /* Detach sockets from device */ ++ /* Wake up sockets using this dead device */ read_lock(&hci_sk_list.lock); sk_for_each(sk, &hci_sk_list.head) { - bh_lock_sock_nested(sk); -+ lock_sock(sk); if (hci_pi(sk)->hdev == hdev) { - hci_pi(sk)->hdev = NULL; +- hci_pi(sk)->hdev = NULL; sk->sk_err = EPIPE; -@@ -759,7 +759,7 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event) - - hci_dev_put(hdev); +- sk->sk_state = BT_OPEN; + sk->sk_state_change(sk); +- +- hci_dev_put(hdev); } - bh_unlock_sock(sk); -+ release_sock(sk); } read_unlock(&hci_sk_list.lock); } +@@ -918,10 +923,10 @@ static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg) + static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, + unsigned long arg) + { +- struct hci_dev *hdev = hci_pi(sk)->hdev; ++ struct hci_dev *hdev = hci_hdev_from_sock(sk); + +- if (!hdev) +- return -EBADFD; ++ if (IS_ERR(hdev)) ++ return PTR_ERR(hdev); + + if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) + return -EBUSY; +@@ -1075,6 +1080,18 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, + + lock_sock(sk); + ++ /* Allow detaching from dead device and attaching to alive device, if ++ * the caller wants to re-bind (instead of close) this socket in ++ * response to hci_sock_dev_event(HCI_DEV_UNREG) notification. ++ */ ++ hdev = hci_pi(sk)->hdev; ++ if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) { ++ hci_pi(sk)->hdev = NULL; ++ sk->sk_state = BT_OPEN; ++ hci_dev_put(hdev); ++ } ++ hdev = NULL; ++ + if (sk->sk_state == BT_BOUND) { + err = -EALREADY; + goto done; +@@ -1351,9 +1368,9 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, + + lock_sock(sk); + +- hdev = hci_pi(sk)->hdev; +- if (!hdev) { +- err = -EBADFD; ++ hdev = hci_hdev_from_sock(sk); ++ if (IS_ERR(hdev)) { ++ err = PTR_ERR(hdev); + goto done; + } + +@@ -1713,9 +1730,9 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, + goto done; + } + +- hdev = hci_pi(sk)->hdev; +- if (!hdev) { +- err = -EBADFD; ++ hdev = hci_hdev_from_sock(sk); ++ if (IS_ERR(hdev)) { ++ err = PTR_ERR(hdev); + goto done; + } + +diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c +index ca7a35ebaefb..cb7d06bb0243 100644 +--- a/net/bluetooth/hci_sysfs.c ++++ b/net/bluetooth/hci_sysfs.c +@@ -82,6 +82,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn) + static void bt_host_release(struct device *dev) + { + struct hci_dev *hdev = to_hci_dev(dev); ++ ++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) ++ hci_cleanup_dev(hdev); + kfree(hdev); + module_put(THIS_MODULE); + } +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index 552e00b07196..00f25e54119c 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -734,7 +734,7 @@ static void hidp_stop(struct hid_device *hid) + hid->claimed = 0; + } + +-static struct hid_ll_driver hidp_hid_driver = { ++struct hid_ll_driver hidp_hid_driver = { + .parse = hidp_parse, + .start = hidp_start, + .stop = hidp_stop, +@@ -743,6 +743,7 @@ static struct hid_ll_driver hidp_hid_driver = { + .raw_request = hidp_raw_request, + .output_report = hidp_output_report, + }; ++EXPORT_SYMBOL_GPL(hidp_hid_driver); + + /* This function sets up the hid device. It does not add it + to the HID system. That is done in hidp_add_connection(). */ +@@ -1282,7 +1283,7 @@ static int hidp_session_thread(void *arg) + + /* cleanup runtime environment */ + remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait); +- remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait); ++ remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait); + wake_up_interruptible(&session->report_queue); + hidp_del_timer(session); + diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 11012a509070..204b6ebd2a24 100644 --- a/net/bluetooth/l2cap_core.c @@ -106288,7 +136705,7 @@ index 11012a509070..204b6ebd2a24 100644 if (!control->sframe) { int err; diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index a8ba752732c9..f46f59129bf3 100644 +index a8ba752732c9..a47430d843dc 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1038,7 +1038,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, @@ -106344,7 +136761,27 @@ index a8ba752732c9..f46f59129bf3 100644 } } -@@ -1328,8 +1340,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) +@@ -1307,6 +1319,9 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan) + { + struct sock *sk = chan->data; + ++ if (!sk) ++ return; ++ + l2cap_sock_kill(sk); + } + +@@ -1315,6 +1330,9 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) + struct sock *sk = chan->data; + struct sock *parent; + ++ if (!sk) ++ return; ++ + BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); + + /* This callback can be called both for server (BT_LISTEN) +@@ -1328,8 +1346,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) parent = bt_sk(sk)->parent; @@ -106353,7 +136790,7 @@ index a8ba752732c9..f46f59129bf3 100644 switch (chan->state) { case BT_OPEN: case BT_BOUND: -@@ -1356,8 +1366,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) +@@ -1356,8 +1372,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) break; } @@ -106366,7 +136803,7 @@ index a8ba752732c9..f46f59129bf3 100644 } static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, -@@ -1463,6 +1476,19 @@ static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) +@@ -1463,6 +1482,19 @@ static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) sk->sk_state_change(sk); } @@ -106386,7 +136823,7 @@ index a8ba752732c9..f46f59129bf3 100644 static const struct l2cap_ops l2cap_chan_ops = { .name = "L2CAP Socket Interface", .new_connection = l2cap_sock_new_connection_cb, -@@ -1477,6 +1503,7 @@ static const struct l2cap_ops l2cap_chan_ops = { +@@ -1477,14 +1509,17 @@ static const struct l2cap_ops l2cap_chan_ops = { .set_shutdown = l2cap_sock_set_shutdown_cb, .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, .alloc_skb = l2cap_sock_alloc_skb_cb, @@ -106394,6 +136831,17 @@ index a8ba752732c9..f46f59129bf3 100644 }; static void l2cap_sock_destruct(struct sock *sk) + { + BT_DBG("sk %p", sk); + +- if (l2cap_pi(sk)->chan) ++ if (l2cap_pi(sk)->chan) { ++ l2cap_pi(sk)->chan->data = NULL; + l2cap_chan_put(l2cap_pi(sk)->chan); ++ } + + if (l2cap_pi(sk)->rx_busy_skb) { + kfree_skb(l2cap_pi(sk)->rx_busy_skb); diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index ba24f613c0fc..7aef6d23bc77 100644 --- a/net/bluetooth/mgmt.c @@ -106445,6 +136893,213 @@ index ba24f613c0fc..7aef6d23bc77 100644 if (data[i + 1] == EIR_FLAGS && (!is_adv_data || flags_managed(adv_flags))) return false; +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 95fd7a837dc5..b3b4ffaa394f 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -83,7 +83,6 @@ static void sco_sock_timeout(unsigned long arg) + sk->sk_state_change(sk); + bh_unlock_sock(sk); + +- sco_sock_kill(sk); + sock_put(sk); + } + +@@ -175,7 +174,6 @@ static void sco_conn_del(struct hci_conn *hcon, int err) + sco_sock_clear_timer(sk); + sco_chan_del(sk, err); + bh_unlock_sock(sk); +- sco_sock_kill(sk); + sock_put(sk); + } + +@@ -210,44 +208,32 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk, + return err; + } + +-static int sco_connect(struct sock *sk) ++static int sco_connect(struct hci_dev *hdev, struct sock *sk) + { + struct sco_conn *conn; + struct hci_conn *hcon; +- struct hci_dev *hdev; + int err, type; + + BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst); + +- hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR); +- if (!hdev) +- return -EHOSTUNREACH; +- +- hci_dev_lock(hdev); +- + if (lmp_esco_capable(hdev) && !disable_esco) + type = ESCO_LINK; + else + type = SCO_LINK; + + if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT && +- (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) { +- err = -EOPNOTSUPP; +- goto done; +- } ++ (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) ++ return -EOPNOTSUPP; + + hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst, + sco_pi(sk)->setting); +- if (IS_ERR(hcon)) { +- err = PTR_ERR(hcon); +- goto done; +- } ++ if (IS_ERR(hcon)) ++ return PTR_ERR(hcon); + + conn = sco_conn_add(hcon); + if (!conn) { + hci_conn_drop(hcon); +- err = -ENOMEM; +- goto done; ++ return -ENOMEM; + } + + /* Update source addr of the socket */ +@@ -255,7 +241,7 @@ static int sco_connect(struct sock *sk) + + err = sco_chan_add(conn, sk, NULL); + if (err) +- goto done; ++ return err; + + if (hcon->state == BT_CONNECTED) { + sco_sock_clear_timer(sk); +@@ -265,13 +251,11 @@ static int sco_connect(struct sock *sk) + sco_sock_set_timer(sk, sk->sk_sndtimeo); + } + +-done: +- hci_dev_unlock(hdev); +- hci_dev_put(hdev); + return err; + } + +-static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len) ++static int sco_send_frame(struct sock *sk, void *buf, int len, ++ unsigned int msg_flags) + { + struct sco_conn *conn = sco_pi(sk)->conn; + struct sk_buff *skb; +@@ -283,15 +267,11 @@ static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len) + + BT_DBG("sk %p len %d", sk, len); + +- skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err); ++ skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err); + if (!skb) + return err; + +- if (memcpy_from_msg(skb_put(skb, len), msg, len)) { +- kfree_skb(skb); +- return -EFAULT; +- } +- ++ memcpy(skb_put(skb, len), buf, len); + hci_send_sco(conn->hcon, skb); + + return len; +@@ -392,8 +372,7 @@ static void sco_sock_cleanup_listen(struct sock *parent) + */ + static void sco_sock_kill(struct sock *sk) + { +- if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket || +- sock_flag(sk, SOCK_DEAD)) ++ if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) + return; + + BT_DBG("sk %p state %d", sk, sk->sk_state); +@@ -445,7 +424,6 @@ static void sco_sock_close(struct sock *sk) + lock_sock(sk); + __sco_sock_close(sk); + release_sock(sk); +- sco_sock_kill(sk); + } + + static void sco_sock_init(struct sock *sk, struct sock *parent) +@@ -555,6 +533,7 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen + { + struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; + struct sock *sk = sock->sk; ++ struct hci_dev *hdev; + int err; + + BT_DBG("sk %p", sk); +@@ -569,12 +548,19 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen + if (sk->sk_type != SOCK_SEQPACKET) + return -EINVAL; + ++ hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR); ++ if (!hdev) ++ return -EHOSTUNREACH; ++ hci_dev_lock(hdev); ++ + lock_sock(sk); + + /* Set destination address and psm */ + bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); + +- err = sco_connect(sk); ++ err = sco_connect(hdev, sk); ++ hci_dev_unlock(hdev); ++ hci_dev_put(hdev); + if (err) + goto done; + +@@ -704,6 +690,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, + size_t len) + { + struct sock *sk = sock->sk; ++ void *buf; + int err; + + BT_DBG("sock %p, sk %p", sock, sk); +@@ -715,14 +702,24 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, + if (msg->msg_flags & MSG_OOB) + return -EOPNOTSUPP; + ++ buf = kmalloc(len, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ if (memcpy_from_msg(buf, msg, len)) { ++ kfree(buf); ++ return -EFAULT; ++ } ++ + lock_sock(sk); + + if (sk->sk_state == BT_CONNECTED) +- err = sco_send_frame(sk, msg, len); ++ err = sco_send_frame(sk, buf, len, msg->msg_flags); + else + err = -ENOTCONN; + + release_sock(sk); ++ kfree(buf); + return err; + } + +@@ -763,6 +760,11 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) + cp.max_latency = cpu_to_le16(0xffff); + cp.retrans_effort = 0xff; + break; ++ default: ++ /* use CVSD settings as fallback */ ++ cp.max_latency = cpu_to_le16(0xffff); ++ cp.retrans_effort = 0xff; ++ break; + } + + hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 6670b7ffc200..cedfce6f397e 100644 --- a/net/bluetooth/smp.c @@ -106478,7 +137133,7 @@ index bef3cca4d6b4..be4f5e9e1ef5 100644 stats->tx_packets = sum.tx_packets; stats->rx_bytes = sum.rx_bytes; diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c -index 2e05a7949354..b0e31dca98cb 100644 +index 2e05a7949354..95116ee1bb6b 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -486,7 +486,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) @@ -106490,7 +137145,15 @@ index 2e05a7949354..b0e31dca98cb 100644 /* Don't allow bridging non-ethernet like devices, or DSA-enabled * master network devices since the bridge layer rx_handler prevents -@@ -556,6 +556,19 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) +@@ -520,6 +520,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) + + err = dev_set_allmulti(dev, 1); + if (err) { ++ br_multicast_del_port(p); + kfree(p); /* kobject not yet init'd, manually free */ + goto err1; + } +@@ -556,6 +557,19 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) list_add_rcu(&p->list, &br->port_list); nbp_update_port_count(br); @@ -106510,7 +137173,7 @@ index 2e05a7949354..b0e31dca98cb 100644 netdev_update_features(br->dev); -@@ -596,6 +609,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) +@@ -596,6 +610,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) return 0; err7: @@ -106519,6 +137182,14 @@ index 2e05a7949354..b0e31dca98cb 100644 list_del_rcu(&p->list); br_fdb_delete_by_port(br, p, 0, 1); nbp_update_port_count(br); +@@ -609,6 +625,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) + err3: + sysfs_remove_link(br->ifobj, p->dev->name); + err2: ++ br_multicast_del_port(p); + kobject_put(&p->kobj); + dev_set_allmulti(dev, -1); + err1: diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c index 62e045c9d452..7104d5e64abb 100644 --- a/net/bridge/br_netfilter_hooks.c @@ -106544,6 +137215,19 @@ index 62e045c9d452..7104d5e64abb 100644 if (skb->pkt_type == PACKET_OTHERHOST) { skb->pkt_type = PACKET_HOST; nf_bridge->pkt_otherhost = true; +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 4f831225d34f..ca8757090ae3 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -1298,7 +1298,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr) + } + + return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) + +- nla_total_size(sizeof(struct br_mcast_stats)) + ++ nla_total_size_64bit(sizeof(struct br_mcast_stats)) + + nla_total_size(0); + } + diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c index 5172caac645c..6ac7ad4f3547 100644 --- a/net/bridge/br_vlan.c @@ -106778,6 +137462,57 @@ index ce60f06d76de..af1e1e36dc90 100644 struct cflayer *cfserl_create(int instance, bool use_stx) { struct cfserl *this = kzalloc(sizeof(struct cfserl), GFP_ATOMIC); +diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c +index 3408ed51b611..12063f333897 100644 +--- a/net/caif/chnl_net.c ++++ b/net/caif/chnl_net.c +@@ -55,20 +55,6 @@ struct chnl_net { + enum caif_states state; + }; + +-static void robust_list_del(struct list_head *delete_node) +-{ +- struct list_head *list_node; +- struct list_head *n; +- ASSERT_RTNL(); +- list_for_each_safe(list_node, n, &chnl_net_list) { +- if (list_node == delete_node) { +- list_del(list_node); +- return; +- } +- } +- WARN_ON(1); +-} +- + static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt) + { + struct sk_buff *skb; +@@ -370,6 +356,7 @@ static int chnl_net_init(struct net_device *dev) + ASSERT_RTNL(); + priv = netdev_priv(dev); + strncpy(priv->name, dev->name, sizeof(priv->name)); ++ INIT_LIST_HEAD(&priv->list_field); + return 0; + } + +@@ -378,7 +365,7 @@ static void chnl_net_uninit(struct net_device *dev) + struct chnl_net *priv; + ASSERT_RTNL(); + priv = netdev_priv(dev); +- robust_list_del(&priv->list_field); ++ list_del_init(&priv->list_field); + } + + static const struct net_device_ops netdev_ops = { +@@ -541,7 +528,7 @@ static void __exit chnl_exit_module(void) + rtnl_lock(); + list_for_each_safe(list_node, _tmp, &chnl_net_list) { + dev = list_entry(list_node, struct chnl_net, list_field); +- list_del(list_node); ++ list_del_init(list_node); + delete_device(dev); + } + rtnl_unlock(); diff --git a/net/can/bcm.c b/net/can/bcm.c index c99e7c75eeee..369326715b9c 100644 --- a/net/can/bcm.c @@ -106989,7 +137724,7 @@ index 81650affa3fa..1867000f8a65 100644 err = 0; break; diff --git a/net/can/raw.c b/net/can/raw.c -index 6dc546a06673..2bb50b1535c2 100644 +index 6dc546a06673..082965c8dcaf 100644 --- a/net/can/raw.c +++ b/net/can/raw.c @@ -84,7 +84,7 @@ struct raw_sock { @@ -107096,7 +137831,61 @@ index 6dc546a06673..2bb50b1535c2 100644 lock_sock(sk); -@@ -857,6 +884,10 @@ static const struct can_proto raw_can_proto = { +@@ -514,10 +541,18 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + return -EFAULT; + } + ++ rtnl_lock(); + lock_sock(sk); + +- if (ro->bound && ro->ifindex) ++ if (ro->bound && ro->ifindex) { + dev = dev_get_by_index(&init_net, ro->ifindex); ++ if (!dev) { ++ if (count > 1) ++ kfree(filter); ++ err = -ENODEV; ++ goto out_fil; ++ } ++ } + + if (ro->bound) { + /* (try to) register the new filters */ +@@ -554,6 +589,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + dev_put(dev); + + release_sock(sk); ++ rtnl_unlock(); + + break; + +@@ -566,10 +602,16 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + + err_mask &= CAN_ERR_MASK; + ++ rtnl_lock(); + lock_sock(sk); + +- if (ro->bound && ro->ifindex) ++ if (ro->bound && ro->ifindex) { + dev = dev_get_by_index(&init_net, ro->ifindex); ++ if (!dev) { ++ err = -ENODEV; ++ goto out_err; ++ } ++ } + + /* remove current error mask */ + if (ro->bound) { +@@ -591,6 +633,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + dev_put(dev); + + release_sock(sk); ++ rtnl_unlock(); + + break; + +@@ -857,6 +900,10 @@ static const struct can_proto raw_can_proto = { .prot = &raw_proto, }; @@ -107107,7 +137896,7 @@ index 6dc546a06673..2bb50b1535c2 100644 static __init int raw_module_init(void) { int err; -@@ -866,6 +897,8 @@ static __init int raw_module_init(void) +@@ -866,6 +913,8 @@ static __init int raw_module_init(void) err = can_proto_register(&raw_can_proto); if (err < 0) printk(KERN_ERR "can: registration of raw protocol failed\n"); @@ -107116,7 +137905,7 @@ index 6dc546a06673..2bb50b1535c2 100644 return err; } -@@ -873,6 +906,7 @@ static __init int raw_module_init(void) +@@ -873,6 +922,7 @@ static __init int raw_module_init(void) static __exit void raw_module_exit(void) { can_proto_unregister(&raw_can_proto); @@ -107421,10 +138210,49 @@ index 768688bfc7df..2b3a03f04cc1 100644 u32 min_len = __bpf_skb_min_len(skb); int ret; +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index 26b0f70d2f1c..6b04cbd00842 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -176,8 +176,10 @@ bool __skb_flow_dissect(const struct sk_buff *skb, + FLOW_DISSECTOR_KEY_IPV4_ADDRS, + target_container); + +- memcpy(&key_addrs->v4addrs, &iph->saddr, +- sizeof(key_addrs->v4addrs)); ++ memcpy(&key_addrs->v4addrs.src, &iph->saddr, ++ sizeof(key_addrs->v4addrs.src)); ++ memcpy(&key_addrs->v4addrs.dst, &iph->daddr, ++ sizeof(key_addrs->v4addrs.dst)); + key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS; + } + +@@ -216,8 +218,10 @@ bool __skb_flow_dissect(const struct sk_buff *skb, + FLOW_DISSECTOR_KEY_IPV6_ADDRS, + target_container); + +- memcpy(&key_addrs->v6addrs, &iph->saddr, +- sizeof(key_addrs->v6addrs)); ++ memcpy(&key_addrs->v6addrs.src, &iph->saddr, ++ sizeof(key_addrs->v6addrs.src)); ++ memcpy(&key_addrs->v6addrs.dst, &iph->daddr, ++ sizeof(key_addrs->v6addrs.dst)); + key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS; + } + diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 0e831671634d..92da79e7fd43 100644 +index 0e831671634d..5463eb121961 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c +@@ -598,7 +598,7 @@ struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl, + + ASSERT_RTNL(); + +- n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL); ++ n = kzalloc(sizeof(*n) + key_len, GFP_KERNEL); + if (!n) + goto out; + @@ -1239,7 +1239,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, * we can reinject the packet there. */ @@ -107530,7 +138358,7 @@ index 3708301772f9..a9d8c8964b4a 100644 init_waitqueue_head(&t->queue); complete(&t->start_done); diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index e652e376fb30..911752e8a3e6 100644 +index e652e376fb30..012143f313a8 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -3530,6 +3530,10 @@ static int rtnl_bridge_notify(struct net_device *dev) @@ -107544,8 +138372,17 @@ index e652e376fb30..911752e8a3e6 100644 if (!skb->len) goto errout; +@@ -3896,7 +3900,7 @@ static int rtnl_fill_statsinfo(struct sk_buff *skb, struct net_device *dev, + static size_t if_nlmsg_stats_size(const struct net_device *dev, + u32 filter_mask) + { +- size_t size = 0; ++ size_t size = NLMSG_ALIGN(sizeof(struct if_stats_msg)); + + if (stats_attr_valid(filter_mask, IFLA_STATS_LINK_64, 0)) + size += nla_total_size_64bit(sizeof(struct rtnl_link_stats64)); diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 3d91d4388274..2a47156be482 100644 +index 3d91d4388274..21f501fac1dd 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -434,7 +434,11 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int len, @@ -107602,7 +138439,20 @@ index 3d91d4388274..2a47156be482 100644 } return __pskb_trim(skb, len); } -@@ -2664,7 +2679,19 @@ EXPORT_SYMBOL(skb_split); +@@ -2279,8 +2294,11 @@ skb_zerocopy_headlen(const struct sk_buff *from) + + if (!from->head_frag || + skb_headlen(from) < L1_CACHE_BYTES || +- skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) ++ skb_shinfo(from)->nr_frags >= MAX_SKB_FRAGS) { + hlen = skb_headlen(from); ++ if (!hlen) ++ hlen = from->len; ++ } + + if (skb_has_frag_list(from)) + hlen = from->len; +@@ -2664,7 +2682,19 @@ EXPORT_SYMBOL(skb_split); */ static int skb_prepare_for_shift(struct sk_buff *skb) { @@ -107623,7 +138473,7 @@ index 3d91d4388274..2a47156be482 100644 } /** -@@ -4597,8 +4624,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb) +@@ -4597,8 +4627,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb) skb = skb_share_check(skb, GFP_ATOMIC); if (unlikely(!skb)) goto err_free; @@ -107634,7 +138484,7 @@ index 3d91d4388274..2a47156be482 100644 goto err_free; vhdr = (struct vlan_hdr *)skb->data; -@@ -4996,9 +5023,13 @@ static int pskb_carve_inside_nonlinear(struct sk_buff *skb, const u32 off, +@@ -4996,9 +5026,13 @@ static int pskb_carve_inside_nonlinear(struct sk_buff *skb, const u32 off, if (skb_has_frag_list(skb)) skb_clone_fraglist(skb); @@ -107652,10 +138502,30 @@ index 3d91d4388274..2a47156be482 100644 skb_release_data(skb); diff --git a/net/core/sock.c b/net/core/sock.c -index 3e12e5059a71..123f3d7d2e5d 100644 +index 3e12e5059a71..3f1da15536d9 100644 --- a/net/core/sock.c +++ b/net/core/sock.c -@@ -1411,6 +1411,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority, +@@ -1011,7 +1011,6 @@ int sock_setsockopt(struct socket *sock, int level, int optname, + } + EXPORT_SYMBOL(sock_setsockopt); + +- + static void cred_to_ucred(struct pid *pid, const struct cred *cred, + struct ucred *ucred) + { +@@ -1172,7 +1171,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname, + struct ucred peercred; + if (len > sizeof(peercred)) + len = sizeof(peercred); ++ ++ spin_lock(&sk->sk_peer_lock); + cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred); ++ spin_unlock(&sk->sk_peer_lock); ++ + if (copy_to_user(optval, &peercred, len)) + return -EFAULT; + goto lenout; +@@ -1411,6 +1414,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority, cgroup_sk_alloc(&sk->sk_cgrp_data); sock_update_classid(&sk->sk_cgrp_data); sock_update_netprioidx(&sk->sk_cgrp_data); @@ -107663,7 +138533,20 @@ index 3e12e5059a71..123f3d7d2e5d 100644 } return sk; -@@ -1540,7 +1541,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) +@@ -1446,9 +1450,10 @@ static void __sk_destruct(struct rcu_head *head) + sk->sk_frag.page = NULL; + } + +- if (sk->sk_peer_cred) +- put_cred(sk->sk_peer_cred); ++ /* We do not need to acquire sk->sk_peer_lock, we are the last user. */ ++ put_cred(sk->sk_peer_cred); + put_pid(sk->sk_peer_pid); ++ + if (likely(sk->sk_net_refcnt)) + put_net(sock_net(sk)); + sk_prot_free(sk->sk_prot_creator, sk); +@@ -1540,7 +1545,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) newsk->sk_userlocks = sk->sk_userlocks & ~SOCK_BINDPORT_LOCK; sock_reset_flag(newsk, SOCK_DONE); @@ -107672,7 +138555,7 @@ index 3e12e5059a71..123f3d7d2e5d 100644 skb_queue_head_init(&newsk->sk_error_queue); filter = rcu_dereference_protected(newsk->sk_filter, 1); -@@ -1595,6 +1596,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) +@@ -1595,6 +1600,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) */ sk_refcnt_debug_inc(newsk); sk_set_socket(newsk, NULL); @@ -107680,7 +138563,7 @@ index 3e12e5059a71..123f3d7d2e5d 100644 newsk->sk_wq = NULL; if (newsk->sk_prot->sockets_allocated) -@@ -2329,6 +2331,27 @@ int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct * +@@ -2329,6 +2335,27 @@ int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct * } EXPORT_SYMBOL(sock_no_mmap); @@ -107708,6 +138591,42 @@ index 3e12e5059a71..123f3d7d2e5d 100644 ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags) { ssize_t res; +@@ -2478,6 +2505,8 @@ void sock_init_data(struct socket *sock, struct sock *sk) + + sk->sk_peer_pid = NULL; + sk->sk_peer_cred = NULL; ++ spin_lock_init(&sk->sk_peer_lock); ++ + sk->sk_write_pending = 0; + sk->sk_rcvlowat = 1; + sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT; +diff --git a/net/core/stream.c b/net/core/stream.c +index 6e41b20bf9f8..05b63feac7e5 100644 +--- a/net/core/stream.c ++++ b/net/core/stream.c +@@ -193,9 +193,6 @@ void sk_stream_kill_queues(struct sock *sk) + /* First the read buffer. */ + __skb_queue_purge(&sk->sk_receive_queue); + +- /* Next, the error queue. */ +- __skb_queue_purge(&sk->sk_error_queue); +- + /* Next, the write queue. */ + WARN_ON(!skb_queue_empty(&sk->sk_write_queue)); + +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index b4318c1b5b96..f62e177267c3 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -368,7 +368,7 @@ static struct ctl_table net_core_table[] = { + .mode = 0600, + .proc_handler = proc_dolongvec_minmax_bpf_restricted, + .extra1 = &long_one, +- .extra2 = &long_max, ++ .extra2 = &bpf_jit_limit_max, + }, + #endif + { diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c index a1116701287f..2dbf5a0faad3 100644 --- a/net/dcb/dcbnl.c @@ -107721,6 +138640,23 @@ index a1116701287f..2dbf5a0faad3 100644 if (!tb[DCB_ATTR_IFNAME]) return -EINVAL; +diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h +index 0c55ffb859bf..121aa71fcb5c 100644 +--- a/net/dccp/dccp.h ++++ b/net/dccp/dccp.h +@@ -44,9 +44,9 @@ extern bool dccp_debug; + #define dccp_pr_debug_cat(format, a...) DCCP_PRINTK(dccp_debug, format, ##a) + #define dccp_debug(fmt, a...) dccp_pr_debug_cat(KERN_DEBUG fmt, ##a) + #else +-#define dccp_pr_debug(format, a...) +-#define dccp_pr_debug_cat(format, a...) +-#define dccp_debug(format, a...) ++#define dccp_pr_debug(format, a...) do {} while (0) ++#define dccp_pr_debug_cat(format, a...) do {} while (0) ++#define dccp_debug(format, a...) do {} while (0) + #endif + + extern struct inet_hashinfo dccp_hashinfo; diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c index 9438873fc3c8..ae62c2947278 100644 --- a/net/dccp/ipv6.c @@ -107737,6 +138673,19 @@ index 9438873fc3c8..ae62c2947278 100644 if (dccp_bad_service_code(sk, service)) { dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE; goto drop; +diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c +index 62522b8d2f97..010ff4652908 100644 +--- a/net/dccp/minisocks.c ++++ b/net/dccp/minisocks.c +@@ -98,6 +98,8 @@ struct sock *dccp_create_openreq_child(const struct sock *sk, + newdp->dccps_role = DCCP_ROLE_SERVER; + newdp->dccps_hc_rx_ackvec = NULL; + newdp->dccps_service_list = NULL; ++ newdp->dccps_hc_rx_ccid = NULL; ++ newdp->dccps_hc_tx_ccid = NULL; + newdp->dccps_service = dreq->dreq_service; + newdp->dccps_timestamp_echo = dreq->dreq_timestamp_echo; + newdp->dccps_timestamp_time = dreq->dreq_timestamp_time; diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c index 9d8fcdefefc0..ee297964fcd2 100644 --- a/net/decnet/af_decnet.c @@ -108102,6 +139051,31 @@ index d90a4ed5b8a0..936371340dc3 100644 if (!info->attrs[NL802154_ATTR_SEC_LEVEL] || llsec_parse_seclevel(info->attrs[NL802154_ATTR_SEC_LEVEL], &sl) < 0) +diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c +index f66e4afb978a..6383627b783e 100644 +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -987,6 +987,11 @@ static const struct proto_ops ieee802154_dgram_ops = { + #endif + }; + ++static void ieee802154_sock_destruct(struct sock *sk) ++{ ++ skb_queue_purge(&sk->sk_receive_queue); ++} ++ + /* Create a socket. Initialise the socket, blank the addresses + * set the state. + */ +@@ -1027,7 +1032,7 @@ static int ieee802154_create(struct net *net, struct socket *sock, + sock->ops = ops; + + sock_init_data(sock, sk); +- /* FIXME: sk->sk_destruct */ ++ sk->sk_destruct = ieee802154_sock_destruct; + sk->sk_family = PF_IEEE802154; + + /* Checksums on by default */ diff --git a/net/ipc_router/Kconfig b/net/ipc_router/Kconfig index 20f94aa3a976..1ad62e212fe5 100644 --- a/net/ipc_router/Kconfig @@ -108167,6 +139141,19 @@ index 71409928763b..553cda6f887a 100644 break; } kfree(doi_def); +diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c +index a57d3b40369e..8226be7aad12 100644 +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -2273,7 +2273,7 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name, + free: + kfree(t); + out: +- return -ENOBUFS; ++ return -ENOMEM; + } + + static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf) diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c index 6c975101be1f..d612d403793e 100644 --- a/net/ipv4/fib_frontend.c @@ -108207,10 +139194,61 @@ index a1a7ed6fc8dd..88e357b5fc0f 100644 if (local_tb->tb_id != fa->tb_id) diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c -index 6b66f059a15b..88138fb965bb 100644 +index 6b66f059a15b..77d987d12043 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c -@@ -740,6 +740,40 @@ out:; +@@ -461,6 +461,23 @@ static int icmp_multipath_hash_skb(const struct sk_buff *skb) + + #endif + ++/* ++ * The device used for looking up which routing table to use for sending an ICMP ++ * error is preferably the source whenever it is set, which should ensure the ++ * icmp error can be sent to the source host, else lookup using the routing ++ * table of the destination device, else use the main routing table (index 0). ++ */ ++static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb) ++{ ++ struct net_device *route_lookup_dev = NULL; ++ ++ if (skb->dev) ++ route_lookup_dev = skb->dev; ++ else if (skb_dst(skb)) ++ route_lookup_dev = skb_dst(skb)->dev; ++ return route_lookup_dev; ++} ++ + static struct rtable *icmp_route_lookup(struct net *net, + struct flowi4 *fl4, + struct sk_buff *skb_in, +@@ -469,6 +486,7 @@ static struct rtable *icmp_route_lookup(struct net *net, + int type, int code, + struct icmp_bxm *param) + { ++ struct net_device *route_lookup_dev; + struct rtable *rt, *rt2; + struct flowi4 fl4_dec; + int err; +@@ -483,7 +501,8 @@ static struct rtable *icmp_route_lookup(struct net *net, + fl4->flowi4_proto = IPPROTO_ICMP; + fl4->fl4_icmp_type = type; + fl4->fl4_icmp_code = code; +- fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev); ++ route_lookup_dev = icmp_get_route_lookup_dev(skb_in); ++ fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev); + + security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4)); + rt = __ip_route_output_key_hash(net, fl4, +@@ -508,7 +527,7 @@ static struct rtable *icmp_route_lookup(struct net *net, + if (err) + goto relookup_failed; + +- if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev, ++ if (inet_addr_type_dev_table(net, route_lookup_dev, + fl4_dec.saddr) == RTN_LOCAL) { + rt2 = __ip_route_output_key(net, &fl4_dec); + if (IS_ERR(rt2)) +@@ -740,6 +759,40 @@ out:; } EXPORT_SYMBOL(__icmp_send); @@ -108252,7 +139290,7 @@ index 6b66f059a15b..88138fb965bb 100644 static void icmp_socket_deliver(struct sk_buff *skb, u32 info) { diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c -index 02c1736c0b89..f4a827964b68 100644 +index 02c1736c0b89..381fc854ad19 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -1782,6 +1782,7 @@ void ip_mc_destroy_dev(struct in_device *in_dev) @@ -108263,6 +139301,22 @@ index 02c1736c0b89..f4a827964b68 100644 ip_ma_put(i); } } +@@ -2684,6 +2685,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u + rv = 1; + } else if (im) { + if (src_addr) { ++ spin_lock_bh(&im->lock); + for (psf = im->sources; psf; psf = psf->sf_next) { + if (psf->sf_inaddr == src_addr) + break; +@@ -2694,6 +2696,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u + im->sfcount[MCAST_EXCLUDE]; + else + rv = im->sfcount[MCAST_EXCLUDE] != 0; ++ spin_unlock_bh(&im->lock); + } else + rv = 1; /* unspecified source; tentatively allow */ + } diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index 80a2d99b569f..2b31c4ba4722 100644 --- a/net/ipv4/inet_connection_sock.c @@ -108347,8 +139401,21 @@ index 4bf542f4d980..887633870763 100644 } inet_bind_hash(child, tb, port); spin_unlock(&head->lock); +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 9609ad71dd26..fe1801d9f059 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -353,6 +353,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, + + static int gre_handle_offloads(struct sk_buff *skb, bool csum) + { ++ if (csum && skb_checksum_start(skb) < skb->data) ++ return -EINVAL; + return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); + } + diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 8eaf20a6046d..e812bac0735f 100644 +index 8eaf20a6046d..cc5adc0ddde3 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -73,6 +73,7 @@ @@ -108368,7 +139435,19 @@ index 8eaf20a6046d..e812bac0735f 100644 return ip_fragment(net, sk, skb, mtu, ip_finish_output2); return ip_finish_output2(net, sk, skb); -@@ -1634,7 +1635,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, +@@ -414,8 +415,9 @@ static void ip_copy_addrs(struct iphdr *iph, const struct flowi4 *fl4) + { + BUILD_BUG_ON(offsetof(typeof(*fl4), daddr) != + offsetof(typeof(*fl4), saddr) + sizeof(fl4->saddr)); +- memcpy(&iph->saddr, &fl4->saddr, +- sizeof(fl4->saddr) + sizeof(fl4->daddr)); ++ ++ iph->saddr = fl4->saddr; ++ iph->daddr = fl4->daddr; + } + + /* Note: skb->sk can be different from sk, in case of tunnels */ +@@ -1634,7 +1636,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, if (IS_ERR(rt)) return; @@ -108618,7 +139697,7 @@ index 8fa153c65e76..1d8c9fa4addf 100644 EXPORT_SYMBOL_GPL(ping_rcv); diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 61263d9d3352..4a5cccfe20af 100644 +index 61263d9d3352..de47fb459807 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -70,6 +70,7 @@ @@ -108671,7 +139750,80 @@ index 61263d9d3352..4a5cccfe20af 100644 if (old != now && cmpxchg(p_tstamp, old, now) == old) delta = prandom_u32_max(now - old); -@@ -2953,18 +2961,27 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly; +@@ -592,18 +600,25 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe) + } + } + +-static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash) ++static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash) + { +- struct fib_nh_exception *fnhe, *oldest; ++ struct fib_nh_exception __rcu **fnhe_p, **oldest_p; ++ struct fib_nh_exception *fnhe, *oldest = NULL; + +- oldest = rcu_dereference(hash->chain); +- for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe; +- fnhe = rcu_dereference(fnhe->fnhe_next)) { +- if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) ++ for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) { ++ fnhe = rcu_dereference_protected(*fnhe_p, ++ lockdep_is_held(&fnhe_lock)); ++ if (!fnhe) ++ break; ++ if (!oldest || ++ time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) { + oldest = fnhe; ++ oldest_p = fnhe_p; ++ } + } + fnhe_flush_routes(oldest); +- return oldest; ++ *oldest_p = oldest->fnhe_next; ++ kfree_rcu(oldest, rcu); + } + + static inline u32 fnhe_hashfun(__be32 daddr) +@@ -680,16 +695,21 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + if (rt) + fill_route_from_fnhe(rt, fnhe); + } else { +- if (depth > FNHE_RECLAIM_DEPTH) +- fnhe = fnhe_oldest(hash); +- else { +- fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC); +- if (!fnhe) +- goto out_unlock; +- +- fnhe->fnhe_next = hash->chain; +- rcu_assign_pointer(hash->chain, fnhe); ++ /* Randomize max depth to avoid some side channels attacks. */ ++ int max_depth = FNHE_RECLAIM_DEPTH + ++ prandom_u32_max(FNHE_RECLAIM_DEPTH); ++ ++ while (depth > max_depth) { ++ fnhe_remove_oldest(hash); ++ depth--; + } ++ ++ fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC); ++ if (!fnhe) ++ goto out_unlock; ++ ++ fnhe->fnhe_next = hash->chain; ++ + fnhe->fnhe_genid = genid; + fnhe->fnhe_daddr = daddr; + fnhe->fnhe_gw = gw; +@@ -697,6 +717,8 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + fnhe->fnhe_mtu_locked = lock; + fnhe->fnhe_expires = expires; + ++ rcu_assign_pointer(hash->chain, fnhe); ++ + /* Exception created; mark the cached routes for the nexthop + * stale, so anyone caching it rechecks if this exception + * applies to them. +@@ -2953,18 +2975,27 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly; int __init ip_rt_init(void) { @@ -108843,7 +139995,7 @@ index 3fabbb5616f8..a41f4ab2ef0a 100644 } EXPORT_SYMBOL(tcp_md5_hash_key); diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c -index 3bfab2d41574..c22da42376fe 100644 +index 3bfab2d41574..47f40e105044 100644 --- a/net/ipv4/tcp_bbr.c +++ b/net/ipv4/tcp_bbr.c @@ -740,7 +740,7 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs) @@ -108855,6 +140007,15 @@ index 3bfab2d41574..c22da42376fe 100644 bbr->min_rtt_us = rs->rtt_us; bbr->min_rtt_stamp = tcp_time_stamp; } +@@ -811,7 +811,7 @@ static void bbr_init(struct sock *sk) + bbr->prior_cwnd = 0; + bbr->tso_segs_goal = 0; /* default segs per skb until first ACK */ + bbr->rtt_cnt = 0; +- bbr->next_rtt_delivered = 0; ++ bbr->next_rtt_delivered = tp->delivered; + bbr->prev_ca_state = TCP_CA_Open; + bbr->packet_conservation = 0; + diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c index 0cdbea9b9288..05643dd7b15d 100644 --- a/net/ipv4/tcp_cong.c @@ -108869,10 +140030,29 @@ index 0cdbea9b9288..05643dd7b15d 100644 } diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c -index c99230efcd52..00397c6add20 100644 +index c99230efcd52..d710c519a035 100644 --- a/net/ipv4/tcp_cubic.c +++ b/net/ipv4/tcp_cubic.c -@@ -414,6 +414,8 @@ static void hystart_update(struct sock *sk, u32 delay) +@@ -342,8 +342,6 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked) + return; + + if (tcp_in_slow_start(tp)) { +- if (hystart && after(ack, ca->end_seq)) +- bictcp_hystart_reset(sk); + acked = tcp_slow_start(tp, acked); + if (!acked) + return; +@@ -394,6 +392,9 @@ static void hystart_update(struct sock *sk, u32 delay) + if (ca->found & hystart_detect) + return; + ++ if (after(tp->snd_una, ca->end_seq)) ++ bictcp_hystart_reset(sk); ++ + if (hystart_detect & HYSTART_ACK_TRAIN) { + u32 now = bictcp_clock(); + +@@ -414,6 +415,8 @@ static void hystart_update(struct sock *sk, u32 delay) if (hystart_detect & HYSTART_DELAY) { /* obtain the minimum delay of more than sampling packets */ @@ -108882,7 +140062,7 @@ index c99230efcd52..00397c6add20 100644 if (ca->curr_rtt == 0 || ca->curr_rtt > delay) ca->curr_rtt = delay; diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 00771c262aa0..2b12b773c656 100644 +index 00771c262aa0..5bf67986cc4a 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -100,7 +100,6 @@ int sysctl_tcp_thin_dupack __read_mostly; @@ -108902,6 +140082,15 @@ index 00771c262aa0..2b12b773c656 100644 /* Dynamic Right Sizing (DRS) has 2 to 3 RTT latency * Allow enough cushion so that sender is not limited by our window +@@ -1221,7 +1220,7 @@ static u8 tcp_sacktag_one(struct sock *sk, + if (dup_sack && (sacked & TCPCB_RETRANS)) { + if (tp->undo_marker && tp->undo_retrans > 0 && + after(end_seq, tp->undo_marker)) +- tp->undo_retrans--; ++ tp->undo_retrans = max_t(int, 0, tp->undo_retrans - pcount); + if (sacked & TCPCB_SACKED_ACKED) + state->reord = min(fack_count, state->reord); + } @@ -3567,10 +3566,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq) } } @@ -108963,7 +140152,7 @@ index 00771c262aa0..2b12b773c656 100644 __tcp_ack_snd_check(sk, 0); diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 78a25d6adc9d..0ea9f7f86f3e 100644 +index 78a25d6adc9d..e6f741007de7 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -280,7 +280,7 @@ void tcp_v4_mtu_reduced(struct sock *sk) @@ -109014,7 +140203,33 @@ index 78a25d6adc9d..0ea9f7f86f3e 100644 if (!key) return -ENOMEM; if (!tcp_alloc_md5sig_pool()) { -@@ -2488,6 +2497,7 @@ static int __net_init tcp_sk_init(struct net *net) +@@ -2069,6 +2078,7 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos) + static void *tcp_seek_last_pos(struct seq_file *seq) + { + struct tcp_iter_state *st = seq->private; ++ int bucket = st->bucket; + int offset = st->offset; + int orig_num = st->num; + void *rc = NULL; +@@ -2079,7 +2089,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq) + break; + st->state = TCP_SEQ_STATE_LISTENING; + rc = listening_get_next(seq, NULL); +- while (offset-- && rc) ++ while (offset-- && rc && bucket == st->bucket) + rc = listening_get_next(seq, rc); + if (rc) + break; +@@ -2090,7 +2100,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq) + if (st->bucket > tcp_hashinfo.ehash_mask) + break; + rc = established_get_first(seq); +- while (offset-- && rc) ++ while (offset-- && rc && bucket == st->bucket) + rc = established_get_next(seq, rc); + } + +@@ -2488,6 +2498,7 @@ static int __net_init tcp_sk_init(struct net *net) net->ipv4.sysctl_tcp_orphan_retries = 0; net->ipv4.sysctl_tcp_fin_timeout = TCP_FIN_TIMEOUT; net->ipv4.sysctl_tcp_notsent_lowat = UINT_MAX; @@ -109190,9 +140405,27 @@ index a7c86c8eacf3..6366ee618d5c 100644 &tp->rcv_wnd, &tp->window_clamp, diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index 405ec0202ad8..19658c1b1d07 100644 +index 405ec0202ad8..77123a408fa1 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c +@@ -891,7 +891,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + __be16 dport; + u8 tos; + int err, is_udplite = IS_UDPLITE(sk); +- int corkreq = up->corkflag || msg->msg_flags&MSG_MORE; ++ int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE; + int (*getfrag)(void *, char *, int, int, int, struct sk_buff *); + struct sk_buff *skb; + struct ip_options_data opt_copy; +@@ -1173,7 +1173,7 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset, + } + + up->len += size; +- if (!(up->corkflag || (flags&MSG_MORE))) ++ if (!(READ_ONCE(up->corkflag) || (flags&MSG_MORE))) + ret = udp_push_pending_frames(sk); + if (!ret) + ret = size; @@ -1560,7 +1560,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) /* * UDP-Lite specific tests, ignored on UDP sockets @@ -109212,6 +140445,27 @@ index 405ec0202ad8..19658c1b1d07 100644 udp_flush_pending_frames(sk); unlock_sock_fast(sk, slow); if (static_key_false(&udp_encap_needed) && up->encap_type) { +@@ -2039,9 +2042,9 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname, + switch (optname) { + case UDP_CORK: + if (val != 0) { +- up->corkflag = 1; ++ WRITE_ONCE(up->corkflag, 1); + } else { +- up->corkflag = 0; ++ WRITE_ONCE(up->corkflag, 0); + lock_sock(sk); + push_pending_frames(sk); + release_sock(sk); +@@ -2148,7 +2151,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname, + + switch (optname) { + case UDP_CORK: +- val = up->corkflag; ++ val = READ_ONCE(up->corkflag); + break; + + case UDP_ENCAP: @@ -2236,10 +2239,17 @@ int udp_abort(struct sock *sk, int err) { lock_sock(sk); @@ -109757,10 +141011,18 @@ index e065d48b31b9..9a78b89690bd 100644 write_lock_bh(&idev->lock); } diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c -index 671eb3222f69..e89d811e239f 100644 +index 671eb3222f69..509610934110 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c -@@ -873,10 +873,6 @@ copy_entries_to_user(unsigned int total_size, +@@ -299,6 +299,7 @@ ip6t_do_table(struct sk_buff *skb, + * things we don't know, ie. tcp syn flag or ports). If the + * rule is also a fragment-specific rule, non-fragments won't + * match it. */ ++ acpar.fragoff = 0; + acpar.hotdrop = false; + acpar.net = state->net; + acpar.in = state->in; +@@ -873,10 +874,6 @@ copy_entries_to_user(unsigned int total_size, return PTR_ERR(counters); loc_cpu_entry = private->entries; @@ -109771,7 +141033,7 @@ index 671eb3222f69..e89d811e239f 100644 /* FIXME: use iterator macros --RR */ /* ... then go back and fix counters and names */ -@@ -886,6 +882,10 @@ copy_entries_to_user(unsigned int total_size, +@@ -886,6 +883,10 @@ copy_entries_to_user(unsigned int total_size, const struct xt_entry_target *t; e = (struct ip6t_entry *)(loc_cpu_entry + off); @@ -109782,7 +141044,7 @@ index 671eb3222f69..e89d811e239f 100644 if (copy_to_user(userptr + off + offsetof(struct ip6t_entry, counters), &counters[num], -@@ -899,23 +899,14 @@ copy_entries_to_user(unsigned int total_size, +@@ -899,23 +900,14 @@ copy_entries_to_user(unsigned int total_size, i += m->u.match_size) { m = (void *)e + i; @@ -109808,7 +141070,7 @@ index 671eb3222f69..e89d811e239f 100644 ret = -EFAULT; goto free_counters; } -@@ -1485,6 +1476,8 @@ translate_compat_table(struct net *net, +@@ -1485,6 +1477,8 @@ translate_compat_table(struct net *net, if (!newinfo) goto out_unlock; @@ -110055,7 +141317,7 @@ index 606c470c529d..17c11a8489ea 100644 &tcp_request_sock_ipv6_ops, sk, skb); diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 6148952fc6a6..3a7c0e5be1c0 100644 +index 6148952fc6a6..a1870910ea00 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -598,7 +598,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) @@ -110067,6 +141329,15 @@ index 6148952fc6a6..3a7c0e5be1c0 100644 if (up->pcrlen == 0) { /* full coverage was set */ net_dbg_ratelimited("UDPLITE6: partial coverage %d while full coverage %d requested\n", +@@ -1112,7 +1112,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + struct ipcm6_cookie ipc6; + int addr_len = msg->msg_namelen; + int ulen = len; +- int corkreq = up->corkflag || msg->msg_flags&MSG_MORE; ++ int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE; + int err; + int connected = 0; + int is_udplite = IS_UDPLITE(sk); @@ -1410,6 +1410,9 @@ void udpv6_destroy_sock(struct sock *sk) { struct udp_sock *up = udp_sk(sk); @@ -110168,7 +141439,7 @@ index 6b73871ff318..22ba32f0341c 100644 } } diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index 3305183b7c8f..f94c81431ace 100644 +index 3305183b7c8f..4089e26f5aca 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -112,6 +112,13 @@ struct l2tp_net { @@ -110200,7 +141471,19 @@ index 3305183b7c8f..f94c81431ace 100644 err = -EEXIST; goto err_tlock_pnlock; } -@@ -1121,8 +1133,9 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, +@@ -974,8 +986,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb) + } + + if (tunnel->version == L2TP_HDR_VER_3 && +- l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) ++ l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) { ++ l2tp_session_dec_refcount(session); + goto error; ++ } + + l2tp_recv_common(session, skb, ptr, optr, hdrflags, length); + l2tp_session_dec_refcount(session); +@@ -1121,8 +1135,9 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, /* Queue the packet to IP for output */ skb->ignore_df = 1; @@ -110211,7 +141494,7 @@ index 3305183b7c8f..f94c81431ace 100644 error = inet6_csk_xmit(tunnel->sock, skb, NULL); else #endif -@@ -1185,9 +1198,14 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len +@@ -1185,9 +1200,14 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len goto out_unlock; } @@ -110229,7 +141512,7 @@ index 3305183b7c8f..f94c81431ace 100644 inet = inet_sk(sk); fl = &inet->cork.fl; -@@ -1204,7 +1222,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len +@@ -1204,7 +1224,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len /* Calculate UDP checksum if configured to do so */ #if IS_ENABLED(CONFIG_IPV6) @@ -110238,7 +141521,7 @@ index 3305183b7c8f..f94c81431ace 100644 udp6_set_csum(udp_get_no_check6_tx(sk), skb, &inet6_sk(sk)->saddr, &sk->sk_v6_daddr, udp_len); -@@ -1610,24 +1628,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 +@@ -1610,24 +1630,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 if (cfg != NULL) tunnel->debug = cfg->debug; @@ -110292,10 +141575,28 @@ index 482c94d9d958..d1c7dcc23448 100644 break; } diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c -index 2a859f967c8a..1a77d0687d74 100644 +index 2a859f967c8a..a8866455e8b2 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c -@@ -271,6 +271,10 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) +@@ -96,8 +96,16 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr) + { + u8 rc = LLC_PDU_LEN_U; + +- if (addr->sllc_test || addr->sllc_xid) ++ if (addr->sllc_test) + rc = LLC_PDU_LEN_U; ++ else if (addr->sllc_xid) ++ /* We need to expand header to sizeof(struct llc_xid_info) ++ * since llc_pdu_init_as_xid_cmd() sets 4,5,6 bytes of LLC header ++ * as XID PDU. In llc_ui_sendmsg() we reserved header size and then ++ * filled all other space with user data. If we won't reserve this ++ * bytes, llc_pdu_init_as_xid_cmd() will overwrite user data ++ */ ++ rc = LLC_PDU_LEN_U_XID; + else if (sk->sk_type == SOCK_STREAM) + rc = LLC_PDU_LEN_I; + return rc; +@@ -271,6 +279,10 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) if (!sock_flag(sk, SOCK_ZAPPED)) goto out; @@ -110306,7 +141607,7 @@ index 2a859f967c8a..1a77d0687d74 100644 rc = -ENODEV; if (sk->sk_bound_dev_if) { llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); -@@ -328,15 +332,15 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) +@@ -328,15 +340,15 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr))) goto out; rc = -EAFNOSUPPORT; @@ -110325,6 +141626,32 @@ index 2a859f967c8a..1a77d0687d74 100644 if (is_zero_ether_addr(addr->sllc_mac)) memcpy(addr->sllc_mac, llc->dev->dev_addr, IFHWADDRLEN); +diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c +index 7ae4cc684d3a..9fa3342c7a82 100644 +--- a/net/llc/llc_s_ac.c ++++ b/net/llc/llc_s_ac.c +@@ -79,7 +79,7 @@ int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb) + struct llc_sap_state_ev *ev = llc_sap_ev(skb); + int rc; + +- llc_pdu_header_init(skb, LLC_PDU_TYPE_U, ev->saddr.lsap, ++ llc_pdu_header_init(skb, LLC_PDU_TYPE_U_XID, ev->saddr.lsap, + ev->daddr.lsap, LLC_PDU_CMD); + llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0); + rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); +diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c +index 80c45567ee3a..030d85790584 100644 +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -109,7 +109,7 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata, + mgmt->u.action.u.addba_req.start_seq_num = + cpu_to_le16(start_seq_num << 4); + +- ieee80211_tx_skb(sdata, skb); ++ ieee80211_tx_skb_tid(sdata, skb, tid); + } + + void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index 88dd5d218fe3..f37fbc71fc1d 100644 --- a/net/mac80211/cfg.c @@ -110354,6 +141681,18 @@ index 88dd5d218fe3..f37fbc71fc1d 100644 sdata->rc_has_vht_mcs_mask[i] = true; break; } +diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c +index 14ec63a02669..91b94ac9a88a 100644 +--- a/net/mac80211/debugfs_sta.c ++++ b/net/mac80211/debugfs_sta.c +@@ -80,6 +80,7 @@ static const char * const sta_flag_names[] = { + FLAG(MPSP_OWNER), + FLAG(MPSP_RECIPIENT), + FLAG(PS_DELIVER), ++ FLAG(USES_ENCRYPTION), + #undef FLAG + }; + diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c index f783d1377d9a..9f0f437a09b9 100644 --- a/net/mac80211/driver-ops.c @@ -110527,10 +141866,18 @@ index ad03331ee785..deebf42c740e 100644 INIT_LIST_HEAD(&sdata->key_list); diff --git a/net/mac80211/key.c b/net/mac80211/key.c -index 6e02f8dfce2b..4e23f240f599 100644 +index 6e02f8dfce2b..a0d9507cb6a7 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c -@@ -647,6 +647,7 @@ int ieee80211_key_link(struct ieee80211_key *key, +@@ -334,6 +334,7 @@ static void ieee80211_key_replace(struct ieee80211_sub_if_data *sdata, + if (sta) { + if (pairwise) { + rcu_assign_pointer(sta->ptk[idx], new); ++ set_sta_flag(sta, WLAN_STA_USES_ENCRYPTION); + sta->ptk_idx = idx; + ieee80211_check_fast_xmit(sta); + } else { +@@ -647,6 +648,7 @@ int ieee80211_key_link(struct ieee80211_key *key, struct sta_info *sta) { struct ieee80211_local *local = sdata->local; @@ -110538,7 +141885,7 @@ index 6e02f8dfce2b..4e23f240f599 100644 struct ieee80211_key *old_key; int idx = key->conf.keyidx; bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; -@@ -658,6 +659,12 @@ int ieee80211_key_link(struct ieee80211_key *key, +@@ -658,6 +660,12 @@ int ieee80211_key_link(struct ieee80211_key *key, bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION; int ret; @@ -110762,7 +142109,7 @@ index c230bbe93262..5a9e44f4fba4 100644 unsigned int sample_row; unsigned int sample_column; diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index d3334fd84ca2..b40e71a5d795 100644 +index d3334fd84ca2..3dc370ad23bf 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1873,19 +1873,34 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) @@ -111111,7 +142458,17 @@ index d3334fd84ca2..b40e71a5d795 100644 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, rx->sdata->vif.type, rx->local->hw.extra_tx_headroom, -@@ -3776,6 +3884,8 @@ void ieee80211_check_fast_rx(struct sta_info *sta) +@@ -3584,7 +3692,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) + if (!bssid) + return false; + if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || +- ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) ++ ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) || ++ !is_valid_ether_addr(hdr->addr2)) + return false; + if (ieee80211_is_beacon(hdr->frame_control)) + return true; +@@ -3776,6 +3885,8 @@ void ieee80211_check_fast_rx(struct sta_info *sta) rcu_read_lock(); key = rcu_dereference(sta->ptk[sta->ptk_idx]); @@ -111209,10 +142566,18 @@ index 4f7061c3b770..ded1264cf8e4 100644 } diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h -index cc808ac783e5..fd31c4db1282 100644 +index cc808ac783e5..0909332965bc 100644 --- a/net/mac80211/sta_info.h +++ b/net/mac80211/sta_info.h -@@ -391,6 +391,34 @@ struct ieee80211_sta_rx_stats { +@@ -100,6 +100,7 @@ enum ieee80211_sta_info_flags { + WLAN_STA_MPSP_OWNER, + WLAN_STA_MPSP_RECIPIENT, + WLAN_STA_PS_DELIVER, ++ WLAN_STA_USES_ENCRYPTION, + + NUM_WLAN_STA_FLAGS, + }; +@@ -391,6 +392,34 @@ struct ieee80211_sta_rx_stats { u64 msdu[IEEE80211_NUM_TIDS + 1]; }; @@ -111247,7 +142612,7 @@ index cc808ac783e5..fd31c4db1282 100644 /** * struct sta_info - STA information * -@@ -454,6 +482,7 @@ struct ieee80211_sta_rx_stats { +@@ -454,6 +483,7 @@ struct ieee80211_sta_rx_stats { * @pcpu_rx_stats: per-CPU RX statistics, assigned only if the driver needs * this (by advertising the USES_RSS hw flag) * @status_stats: TX status statistics @@ -111255,7 +142620,7 @@ index cc808ac783e5..fd31c4db1282 100644 */ struct sta_info { /* General information, mostly static */ -@@ -551,6 +580,8 @@ struct sta_info { +@@ -551,6 +581,8 @@ struct sta_info { struct cfg80211_chan_def tdls_chandef; @@ -111265,10 +142630,37 @@ index cc808ac783e5..fd31c4db1282 100644 struct ieee80211_sta sta; }; diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index 6216279efc46..eebbddccb47b 100644 +index 6216279efc46..b6942b717a59 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c -@@ -1847,19 +1847,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata, +@@ -588,10 +588,13 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx) + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; + +- if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) ++ if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) { + tx->key = NULL; +- else if (tx->sta && +- (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx]))) ++ return TX_CONTINUE; ++ } ++ ++ if (tx->sta && ++ (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx]))) + tx->key = key; + else if (ieee80211_is_group_privacy_action(tx->skb) && + (key = rcu_dereference(tx->sdata->default_multicast_key))) +@@ -652,6 +655,9 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx) + if (!skip_hw && tx->key && + tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) + info->control.hw_key = &tx->key->conf; ++ } else if (!ieee80211_is_mgmt(hdr->frame_control) && tx->sta && ++ test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) { ++ return TX_DROP; + } + + return TX_CONTINUE; +@@ -1847,19 +1853,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata, /* device xmit handlers */ @@ -111299,7 +142691,7 @@ index 6216279efc46..eebbddccb47b 100644 if (enc_tailroom) { tail_need = IEEE80211_ENCRYPT_TAILROOM; -@@ -1892,21 +1897,27 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, +@@ -1892,21 +1903,27 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; int headroom; @@ -111331,7 +142723,19 @@ index 6216279efc46..eebbddccb47b 100644 hdr = (struct ieee80211_hdr *) skb->data; info->control.vif = &sdata->vif; -@@ -2688,7 +2699,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, +@@ -2047,7 +2064,11 @@ static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local, + } + + vht_mcs = iterator.this_arg[4] >> 4; ++ if (vht_mcs > 11) ++ vht_mcs = 0; + vht_nss = iterator.this_arg[4] & 0xF; ++ if (!vht_nss || vht_nss > 8) ++ vht_nss = 1; + break; + + /* +@@ -2688,7 +2709,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, head_need += sdata->encrypt_headroom; head_need += local->tx_headroom; head_need = max_t(int, 0, head_need); @@ -111340,7 +142744,7 @@ index 6216279efc46..eebbddccb47b 100644 ieee80211_free_txskb(&local->hw, skb); skb = NULL; return ERR_PTR(-ENOMEM); -@@ -3313,7 +3324,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata, +@@ -3313,7 +3334,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata, if (unlikely(ieee80211_skb_resize(sdata, skb, max_t(int, extra_head + hw_headroom - skb_headroom(skb), 0), @@ -111376,7 +142780,7 @@ index 43e45bb660bc..b1d3fa708e16 100644 switch (own_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) { case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ: diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c -index c0529c4b60f8..7819a2507d39 100644 +index c0529c4b60f8..b4d67ec50e63 100644 --- a/net/mac80211/wpa.c +++ b/net/mac80211/wpa.c @@ -162,8 +162,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx) @@ -111401,7 +142805,17 @@ index c0529c4b60f8..7819a2507d39 100644 if (res != TKIP_DECRYPT_OK) return RX_DROP_UNUSABLE; -@@ -548,6 +548,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, +@@ -514,6 +514,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, + return RX_DROP_UNUSABLE; + } + ++ /* reload hdr - skb might have been reallocated */ ++ hdr = (void *)rx->skb->data; ++ + data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len; + if (!rx->sta || data_len < 0) + return RX_DROP_UNUSABLE; +@@ -548,6 +551,8 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, } memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN); @@ -111410,7 +142824,17 @@ index c0529c4b60f8..7819a2507d39 100644 } /* Remove CCMP header and MIC */ -@@ -777,6 +779,8 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) +@@ -742,6 +747,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) + return RX_DROP_UNUSABLE; + } + ++ /* reload hdr - skb might have been reallocated */ ++ hdr = (void *)rx->skb->data; ++ + data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len; + if (!rx->sta || data_len < 0) + return RX_DROP_UNUSABLE; +@@ -777,6 +785,8 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) } memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN); @@ -111502,6 +142926,19 @@ index 087db775b3dc..c973d88e9ea7 100644 ndp = nd ? TO_NCSI_DEV_PRIV(nd) : NULL; if (!ndp) return -ENODEV; +diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig +index c1c978e7bc62..ac6aefc5b715 100644 +--- a/net/netfilter/Kconfig ++++ b/net/netfilter/Kconfig +@@ -71,7 +71,7 @@ config NF_CONNTRACK_MARK + config NF_CONNTRACK_SECMARK + bool 'Connection tracking security mark support' + depends on NETWORK_SECMARK +- default m if NETFILTER_ADVANCED=n ++ default y if NETFILTER_ADVANCED=n + help + This option enables security markings to be applied to + connections. Typically they are copied to connections from diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c index f64660e9ff87..511496278262 100644 --- a/net/netfilter/ipset/ip_set_core.c @@ -111516,10 +142953,23 @@ index f64660e9ff87..511496278262 100644 set->offset[id] = len; set->extensions |= ip_set_extensions[id].type; diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h -index d32fd6b036bf..a4bd2d3a4821 100644 +index d32fd6b036bf..6641c3e43e2f 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h -@@ -113,20 +113,6 @@ htable_size(u8 hbits) +@@ -102,31 +102,17 @@ htable_size(u8 hbits) + { + size_t hsize; + +- /* We must fit both into u32 in jhash and size_t */ ++ /* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */ + if (hbits > 31) + return 0; + hsize = jhash_size(hbits); +- if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *) ++ if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *) + < hsize) + return 0; + return hsize * sizeof(struct hbucket *) + sizeof(struct htable); } @@ -111553,8 +143003,23 @@ index d32fd6b036bf..a4bd2d3a4821 100644 hsize = htable_size(hbits); if (hsize == 0) { kfree(h); +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index 096a45103f14..ecde2102d1ad 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -1406,6 +1406,10 @@ int __init ip_vs_conn_init(void) + int idx; + + /* Compute size and mask */ ++ if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) { ++ pr_info("conn_tab_bits not in [8, 20]. Using default value\n"); ++ ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS; ++ } + ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits; + ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1; + diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c -index 33125fc009cf..4e08305a55c4 100644 +index 33125fc009cf..3ee198b3bfe2 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -1256,7 +1256,7 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, @@ -111587,11 +143052,38 @@ index 33125fc009cf..4e08305a55c4 100644 } out_unlock: +@@ -3986,6 +3987,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) + tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode; + tbl[idx++].data = &ipvs->sysctl_schedule_icmp; + tbl[idx++].data = &ipvs->sysctl_ignore_tunneled; ++#ifdef CONFIG_IP_VS_DEBUG ++ /* Global sysctls must be ro in non-init netns */ ++ if (!net_eq(net, &init_net)) ++ tbl[idx++].mode = 0444; ++#endif + + ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl); + if (ipvs->sysctl_hdr == NULL) { diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index f0e9b63b92ab..5cbc784689a7 100644 +index f0e9b63b92ab..8b9a9c552bcc 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c -@@ -942,7 +942,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, +@@ -530,8 +530,13 @@ bool nf_ct_delete(struct nf_conn *ct, u32 portid, int report) + return false; + + tstamp = nf_conn_tstamp_find(ct); +- if (tstamp && tstamp->stop == 0) ++ if (tstamp) { ++ s32 timeout = ct->timeout - nfct_time_stamp; ++ + tstamp->stop = ktime_get_real_ns(); ++ if (timeout < 0) ++ tstamp->stop -= jiffies_to_nsecs(-timeout); ++ } + + if (nf_conntrack_event_report(IPCT_DESTROY, ct, + portid, report) < 0) { +@@ -942,7 +947,8 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, * Let nf_ct_resolve_clash() deal with this later. */ if (nf_ct_tuple_equal(&ignored_conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple, @@ -111699,6 +143191,19 @@ index 8396dc8ee247..babe42ff3eec 100644 if (tb[NFCTH_POLICY]) { ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]); +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index 2a811b5634d4..a35510565d4d 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -539,7 +539,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, + goto nla_put_failure; + + if (indev && entskb->dev && +- entskb->mac_header != entskb->network_header) { ++ skb_mac_header_was_set(entskb)) { + struct nfqnl_msg_packet_hw phw; + int len; + diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index b9dd4e960426..81adbfaffe38 100644 --- a/net/netfilter/nft_dynset.c @@ -111730,7 +143235,7 @@ index 47beb3abcc9d..e2c815ee06d0 100644 if (err < 0) goto err; diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c -index 4c48e9bb21e2..d2510e432c18 100644 +index 4c48e9bb21e2..d338d69a0e0b 100644 --- a/net/netfilter/nft_nat.c +++ b/net/netfilter/nft_nat.c @@ -135,7 +135,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, @@ -111742,7 +143247,18 @@ index 4c48e9bb21e2..d2510e432c18 100644 } err = nft_nat_validate(ctx, expr, NULL); -@@ -206,7 +206,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, +@@ -157,7 +157,9 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip6); + break; + default: +- return -EAFNOSUPPORT; ++ if (tb[NFTA_NAT_REG_ADDR_MIN]) ++ return -EAFNOSUPPORT; ++ break; + } + priv->family = family; + +@@ -206,7 +208,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, if (tb[NFTA_NAT_FLAGS]) { priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS])); if (priv->flags & ~NF_NAT_RANGE_MASK) @@ -111767,10 +143283,18 @@ index b2f88617611a..f73d47b3ffb7 100644 case NFT_PAYLOAD_LL_HEADER: if (!skb_mac_header_was_set(skb)) diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c -index e065140d0c93..2820fa6f399c 100644 +index e065140d0c93..8d84f480b01e 100644 --- a/net/netfilter/x_tables.c +++ b/net/netfilter/x_tables.c -@@ -267,11 +267,66 @@ struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision) +@@ -40,6 +40,7 @@ MODULE_AUTHOR("Harald Welte "); + MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); + + #define XT_PCPU_BLOCK_SIZE 4096 ++#define XT_MAX_TABLE_SIZE (512 * 1024 * 1024) + + struct compat_delta { + unsigned int offset; /* offset in kernel */ +@@ -267,11 +268,66 @@ struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision) } EXPORT_SYMBOL_GPL(xt_request_find_target); @@ -111837,7 +143361,7 @@ index e065140d0c93..2820fa6f399c 100644 list_for_each_entry(m, &xt[af].match, list) { if (strcmp(m->name, name) == 0) { if (m->revision > *bestp) -@@ -280,6 +335,7 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp) +@@ -280,6 +336,7 @@ static int match_revfn(u8 af, const char *name, u8 revision, int *bestp) have_rev = 1; } } @@ -111845,7 +143369,7 @@ index e065140d0c93..2820fa6f399c 100644 if (af != NFPROTO_UNSPEC && !have_rev) return match_revfn(NFPROTO_UNSPEC, name, revision, bestp); -@@ -292,6 +348,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp) +@@ -292,6 +349,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp) const struct xt_target *t; int have_rev = 0; @@ -111853,7 +143377,7 @@ index e065140d0c93..2820fa6f399c 100644 list_for_each_entry(t, &xt[af].target, list) { if (strcmp(t->name, name) == 0) { if (t->revision > *bestp) -@@ -300,6 +357,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp) +@@ -300,6 +358,7 @@ static int target_revfn(u8 af, const char *name, u8 revision, int *bestp) have_rev = 1; } } @@ -111861,7 +143385,7 @@ index e065140d0c93..2820fa6f399c 100644 if (af != NFPROTO_UNSPEC && !have_rev) return target_revfn(NFPROTO_UNSPEC, name, revision, bestp); -@@ -313,12 +371,10 @@ int xt_find_revision(u8 af, const char *name, u8 revision, int target, +@@ -313,12 +372,10 @@ int xt_find_revision(u8 af, const char *name, u8 revision, int target, { int have_rev, best = -1; @@ -111874,7 +143398,7 @@ index e065140d0c93..2820fa6f399c 100644 /* Nothing at all? Return 0 to try loading module. */ if (best == -1) { -@@ -567,7 +623,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, +@@ -567,7 +624,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, { const struct xt_match *match = m->u.kernel.match; struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m; @@ -111883,7 +143407,7 @@ index e065140d0c93..2820fa6f399c 100644 u_int16_t msize = cm->u.user.match_size; char name[sizeof(m->u.user.name)]; -@@ -577,9 +633,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, +@@ -577,9 +634,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, match->compat_from_user(m->data, cm->data); else memcpy(m->data, cm->data, msize - sizeof(*cm)); @@ -111893,7 +143417,7 @@ index e065140d0c93..2820fa6f399c 100644 msize += off; m->u.user.match_size = msize; -@@ -925,7 +978,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, +@@ -925,7 +979,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, { const struct xt_target *target = t->u.kernel.target; struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t; @@ -111902,7 +143426,7 @@ index e065140d0c93..2820fa6f399c 100644 u_int16_t tsize = ct->u.user.target_size; char name[sizeof(t->u.user.name)]; -@@ -935,9 +988,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, +@@ -935,9 +989,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, target->compat_from_user(t->data, ct->data); else memcpy(t->data, ct->data, tsize - sizeof(*ct)); @@ -111912,7 +143436,29 @@ index e065140d0c93..2820fa6f399c 100644 tsize += off; t->u.user.target_size = tsize; -@@ -1177,6 +1227,9 @@ xt_replace_table(struct xt_table *table, +@@ -984,17 +1035,15 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) + struct xt_table_info *info = NULL; + size_t sz = sizeof(*info) + size; + +- if (sz < sizeof(*info)) +- return NULL; +- +- /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ +- if ((size >> PAGE_SHIFT) + 2 > totalram_pages) ++ if (sz < sizeof(*info) || sz >= XT_MAX_TABLE_SIZE) + return NULL; + + if (sz <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) + info = kmalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY); + if (!info) { +- info = vmalloc(sz); ++ info = __vmalloc(sz, GFP_KERNEL | __GFP_NOWARN | ++ __GFP_NORETRY | __GFP_HIGHMEM, ++ PAGE_KERNEL); + if (!info) + return NULL; + } +@@ -1177,6 +1226,9 @@ xt_replace_table(struct xt_table *table, smp_wmb(); table->private = newinfo; @@ -111950,6 +143496,30 @@ index 00ef8243d48d..1390f34098e4 100644 .checkentry = xt_ct_tg_check_v2, .destroy = xt_ct_tg_destroy_v1, .target = xt_ct_target_v1, +diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c +index 736cd0f150e6..7183241558c6 100644 +--- a/net/netfilter/xt_IDLETIMER.c ++++ b/net/netfilter/xt_IDLETIMER.c +@@ -505,6 +505,7 @@ static struct xt_target idletimer_tg __read_mostly = { + .family = NFPROTO_UNSPEC, + .target = idletimer_tg_target, + .targetsize = sizeof(struct idletimer_tg_info), ++ .usersize = offsetof(struct idletimer_tg_info, timer), + .checkentry = idletimer_tg_checkentry, + .destroy = idletimer_tg_destroy, + .me = THIS_MODULE, +diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c +index 0858fe17e14a..2d1c5c169a26 100644 +--- a/net/netfilter/xt_LED.c ++++ b/net/netfilter/xt_LED.c +@@ -198,6 +198,7 @@ static struct xt_target led_tg_reg __read_mostly = { + .family = NFPROTO_UNSPEC, + .target = led_tg, + .targetsize = sizeof(struct xt_led_info), ++ .usersize = offsetof(struct xt_led_info, internal_data), + .checkentry = led_tg_check, + .destroy = led_tg_destroy, + .me = THIS_MODULE, diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c index 92cfae66743b..2306e6e3373f 100644 --- a/net/netfilter/xt_RATEEST.c @@ -112073,18 +143643,29 @@ index 140a9ae262ef..97df6f9dbdde 100644 .destroy = hashlimit_mt_destroy, .me = THIS_MODULE, diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c -index bef850596558..dab962df1787 100644 +index bef850596558..e84de7656289 100644 --- a/net/netfilter/xt_limit.c +++ b/net/netfilter/xt_limit.c -@@ -192,6 +192,8 @@ static struct xt_match limit_mt_reg __read_mostly = { - .compatsize = sizeof(struct compat_xt_rateinfo), +@@ -193,6 +193,7 @@ static struct xt_match limit_mt_reg __read_mostly = { .compat_from_user = limit_mt_compat_from_user, .compat_to_user = limit_mt_compat_to_user, -+#else -+ .usersize = offsetof(struct xt_rateinfo, prev), #endif ++ .usersize = offsetof(struct xt_rateinfo, prev), .me = THIS_MODULE, }; + +diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c +index cf327593852a..51541c5be5a4 100644 +--- a/net/netfilter/xt_nfacct.c ++++ b/net/netfilter/xt_nfacct.c +@@ -62,6 +62,7 @@ static struct xt_match nfacct_mt_reg __read_mostly = { + .match = nfacct_mt, + .destroy = nfacct_mt_destroy, + .matchsize = sizeof(struct xt_nfacct_match_info), ++ .usersize = offsetof(struct xt_nfacct_match_info, nfacct), + .me = THIS_MODULE, + }; + diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c index 44c8eb4c9d66..10d61a6eed71 100644 --- a/net/netfilter/xt_quota.c @@ -112098,10 +143679,19 @@ index 44c8eb4c9d66..10d61a6eed71 100644 }; diff --git a/net/netfilter/xt_quota2.c b/net/netfilter/xt_quota2.c -index 8c56ff2aa2fa..c17509ee2537 100644 +index 8c56ff2aa2fa..2a48285f6845 100644 --- a/net/netfilter/xt_quota2.c +++ b/net/netfilter/xt_quota2.c -@@ -282,6 +282,8 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par) +@@ -135,6 +135,8 @@ static ssize_t quota_proc_write(struct file *file, const char __user *input, + if (copy_from_user(buf, input, size) != 0) + return -EFAULT; + buf[sizeof(buf)-1] = '\0'; ++ if (size < sizeof(buf)) ++ buf[size] = '\0'; + + spin_lock_bh(&e->lock); + e->quota = simple_strtoull(buf, NULL, 0); +@@ -282,6 +284,8 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par) { struct xt_quota_mtinfo2 *q = (void *)par->matchinfo; struct xt_quota_counter *e = q->master; @@ -112110,7 +143700,7 @@ index 8c56ff2aa2fa..c17509ee2537 100644 bool ret = q->flags & XT_QUOTA_INVERT; spin_lock_bh(&e->lock); -@@ -290,20 +292,17 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par) +@@ -290,20 +294,17 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par) * While no_change is pointless in "grow" mode, we will * implement it here simply to have a consistent behavior. */ @@ -112139,6 +143729,22 @@ index 8c56ff2aa2fa..c17509ee2537 100644 /* we do not allow even small packets from now on */ e->quota = 0; } +@@ -321,6 +322,7 @@ static struct xt_match quota_mt2_reg[] __read_mostly = { + .match = quota_mt2, + .destroy = quota_mt2_destroy, + .matchsize = sizeof(struct xt_quota_mtinfo2), ++ .usersize = offsetof(struct xt_quota_mtinfo2, master), + .me = THIS_MODULE, + }, + { +@@ -331,6 +333,7 @@ static struct xt_match quota_mt2_reg[] __read_mostly = { + .match = quota_mt2, + .destroy = quota_mt2_destroy, + .matchsize = sizeof(struct xt_quota_mtinfo2), ++ .usersize = offsetof(struct xt_quota_mtinfo2, master), + .me = THIS_MODULE, + }, + }; diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c index 7720b036d76a..d46dc9ff591f 100644 --- a/net/netfilter/xt_rateest.c @@ -112188,6 +143794,18 @@ index 79d7ad621a80..03c8bd854e56 100644 } if (info->check_set & XT_RECENT_SET || +diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c +index 11de55e7a868..8710fdba2ae2 100644 +--- a/net/netfilter/xt_statistic.c ++++ b/net/netfilter/xt_statistic.c +@@ -84,6 +84,7 @@ static struct xt_match xt_statistic_mt_reg __read_mostly = { + .checkentry = statistic_mt_check, + .destroy = statistic_mt_destroy, + .matchsize = sizeof(struct xt_statistic_info), ++ .usersize = offsetof(struct xt_statistic_info, master), + .me = THIS_MODULE, + }; + diff --git a/net/netfilter/xt_string.c b/net/netfilter/xt_string.c index 0bc3460319c8..423293ee57c2 100644 --- a/net/netfilter/xt_string.c @@ -112200,6 +143818,56 @@ index 0bc3460319c8..423293ee57c2 100644 .me = THIS_MODULE, }; +diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c +index 7fd1104ba900..422fac2a4a3c 100644 +--- a/net/netlabel/netlabel_cipso_v4.c ++++ b/net/netlabel/netlabel_cipso_v4.c +@@ -163,8 +163,8 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, + return -ENOMEM; + doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL); + if (doi_def->map.std == NULL) { +- ret_val = -ENOMEM; +- goto add_std_failure; ++ kfree(doi_def); ++ return -ENOMEM; + } + doi_def->type = CIPSO_V4_MAP_TRANS; + +@@ -205,14 +205,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, + } + doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, + sizeof(u32), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (doi_def->map.std->lvl.local == NULL) { + ret_val = -ENOMEM; + goto add_std_failure; + } + doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size, + sizeof(u32), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (doi_def->map.std->lvl.cipso == NULL) { + ret_val = -ENOMEM; + goto add_std_failure; +@@ -279,7 +279,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, + doi_def->map.std->cat.local = kcalloc( + doi_def->map.std->cat.local_size, + sizeof(u32), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (doi_def->map.std->cat.local == NULL) { + ret_val = -ENOMEM; + goto add_std_failure; +@@ -287,7 +287,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, + doi_def->map.std->cat.cipso = kcalloc( + doi_def->map.std->cat.cipso_size, + sizeof(u32), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (doi_def->map.std->cat.cipso == NULL) { + ret_val = -ENOMEM; + goto add_std_failure; diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c index 41d0e95d171e..b1a1718495f3 100644 --- a/net/netlabel/netlabel_domainhash.c @@ -112437,7 +144105,7 @@ index 053ba8646155..467e0d19cdfe 100644 unlabel_staticlist_return: diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 205865292ba3..541410f1c3b7 100644 +index 205865292ba3..13d69cbd14c2 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -436,11 +436,13 @@ void netlink_table_ungrab(void) @@ -112456,6 +144124,78 @@ index 205865292ba3..541410f1c3b7 100644 } static inline void +@@ -572,7 +574,10 @@ static int netlink_insert(struct sock *sk, u32 portid) + + /* We need to ensure that the socket is hashed and visible. */ + smp_wmb(); +- nlk_sk(sk)->bound = portid; ++ /* Paired with lockless reads from netlink_bind(), ++ * netlink_connect() and netlink_sendmsg(). ++ */ ++ WRITE_ONCE(nlk_sk(sk)->bound, portid); + + err: + release_sock(sk); +@@ -991,7 +996,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, + else if (nlk->ngroups < 8*sizeof(groups)) + groups &= (1UL << nlk->ngroups) - 1; + +- bound = nlk->bound; ++ /* Paired with WRITE_ONCE() in netlink_insert() */ ++ bound = READ_ONCE(nlk->bound); + if (bound) { + /* Ensure nlk->portid is up-to-date. */ + smp_rmb(); +@@ -1071,8 +1077,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, + + /* No need for barriers here as we return to user-space without + * using any of the bound attributes. ++ * Paired with WRITE_ONCE() in netlink_insert(). + */ +- if (!nlk->bound) ++ if (!READ_ONCE(nlk->bound)) + err = netlink_autobind(sock); + + if (err == 0) { +@@ -1797,6 +1804,11 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + if (msg->msg_flags&MSG_OOB) + return -EOPNOTSUPP; + ++ if (len == 0) { ++ pr_warn_once("Zero length message leads to an empty skb\n"); ++ return -ENODATA; ++ } ++ + err = scm_send(sock, msg, &scm, true); + if (err < 0) + return err; +@@ -1819,7 +1831,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + dst_group = nlk->dst_group; + } + +- if (!nlk->bound) { ++ /* Paired with WRITE_ONCE() in netlink_insert() */ ++ if (!READ_ONCE(nlk->bound)) { + err = netlink_autobind(sock); + if (err) + goto out; +@@ -2407,13 +2420,15 @@ int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid, + /* errors reported via destination sk->sk_err, but propagate + * delivery errors if NETLINK_BROADCAST_ERROR flag is set */ + err = nlmsg_multicast(sk, skb, exclude_portid, group, flags); ++ if (err == -ESRCH) ++ err = 0; + } + + if (report) { + int err2; + + err2 = nlmsg_unicast(sk, skb, portid); +- if (!err || err == -ESRCH) ++ if (!err) + err = err2; + } + diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c old mode 100644 new mode 100755 @@ -112614,6 +144354,125 @@ index f0ecaec1ff3d..d1a0b7056743 100644 bh_unlock_sock(sk); + sock_put(sk); } +diff --git a/net/nfc/af_nfc.c b/net/nfc/af_nfc.c +index 54e40fa47822..1859b8e98ded 100644 +--- a/net/nfc/af_nfc.c ++++ b/net/nfc/af_nfc.c +@@ -72,6 +72,9 @@ int nfc_proto_register(const struct nfc_protocol *nfc_proto) + proto_tab[nfc_proto->id] = nfc_proto; + write_unlock(&proto_tab_lock); + ++ if (rc) ++ proto_unregister(nfc_proto->proto); ++ + return rc; + } + EXPORT_SYMBOL(nfc_proto_register); +diff --git a/net/nfc/core.c b/net/nfc/core.c +index c699d64a0753..32a2dfc08f48 100644 +--- a/net/nfc/core.c ++++ b/net/nfc/core.c +@@ -106,13 +106,13 @@ int nfc_dev_up(struct nfc_dev *dev) + + device_lock(&dev->dev); + +- if (dev->rfkill && rfkill_blocked(dev->rfkill)) { +- rc = -ERFKILL; ++ if (!device_is_registered(&dev->dev)) { ++ rc = -ENODEV; + goto error; + } + +- if (!device_is_registered(&dev->dev)) { +- rc = -ENODEV; ++ if (dev->rfkill && rfkill_blocked(dev->rfkill)) { ++ rc = -ERFKILL; + goto error; + } + +@@ -1133,11 +1133,7 @@ int nfc_register_device(struct nfc_dev *dev) + if (rc) + pr_err("Could not register llcp device\n"); + +- rc = nfc_genl_device_added(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s was added\n", +- dev_name(&dev->dev)); +- ++ device_lock(&dev->dev); + dev->rfkill = rfkill_alloc(dev_name(&dev->dev), &dev->dev, + RFKILL_TYPE_NFC, &nfc_rfkill_ops, dev); + if (dev->rfkill) { +@@ -1146,6 +1142,12 @@ int nfc_register_device(struct nfc_dev *dev) + dev->rfkill = NULL; + } + } ++ device_unlock(&dev->dev); ++ ++ rc = nfc_genl_device_added(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s was added\n", ++ dev_name(&dev->dev)); + + return 0; + } +@@ -1162,10 +1164,17 @@ void nfc_unregister_device(struct nfc_dev *dev) + + pr_debug("dev_name=%s\n", dev_name(&dev->dev)); + ++ rc = nfc_genl_device_removed(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s " ++ "was removed\n", dev_name(&dev->dev)); ++ ++ device_lock(&dev->dev); + if (dev->rfkill) { + rfkill_unregister(dev->rfkill); + rfkill_destroy(dev->rfkill); + } ++ device_unlock(&dev->dev); + + if (dev->ops->check_presence) { + device_lock(&dev->dev); +@@ -1175,11 +1184,6 @@ void nfc_unregister_device(struct nfc_dev *dev) + cancel_work_sync(&dev->check_pres_work); + } + +- rc = nfc_genl_device_removed(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s " +- "was removed\n", dev_name(&dev->dev)); +- + nfc_llcp_unregister_device(dev); + + mutex_lock(&nfc_devlist_mutex); +diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c +index 0fd5518bf252..8d083037f05b 100644 +--- a/net/nfc/digital_core.c ++++ b/net/nfc/digital_core.c +@@ -286,6 +286,7 @@ int digital_tg_configure_hw(struct nfc_digital_dev *ddev, int type, int param) + static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech) + { + struct digital_tg_mdaa_params *params; ++ int rc; + + params = kzalloc(sizeof(struct digital_tg_mdaa_params), GFP_KERNEL); + if (!params) +@@ -300,8 +301,12 @@ static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech) + get_random_bytes(params->nfcid2 + 2, NFC_NFCID2_MAXSIZE - 2); + params->sc = DIGITAL_SENSF_FELICA_SC; + +- return digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params, +- 500, digital_tg_recv_atr_req, NULL); ++ rc = digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params, ++ 500, digital_tg_recv_atr_req, NULL); ++ if (rc) ++ kfree(params); ++ ++ return rc; + } + + static int digital_tg_listen_md(struct nfc_digital_dev *ddev, u8 rf_tech) diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c index f864ce19e13d..582f97d035ef 100644 --- a/net/nfc/digital_dep.c @@ -112627,6 +144486,25 @@ index f864ce19e13d..582f97d035ef 100644 exit: kfree_skb(ddev->chaining_skb); +diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c +index d9080dec5d27..76622b3678fb 100644 +--- a/net/nfc/digital_technology.c ++++ b/net/nfc/digital_technology.c +@@ -473,8 +473,12 @@ static int digital_in_send_sdd_req(struct nfc_digital_dev *ddev, + *skb_put(skb, sizeof(u8)) = sel_cmd; + *skb_put(skb, sizeof(u8)) = DIGITAL_SDD_REQ_SEL_PAR; + +- return digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res, +- target); ++ rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res, ++ target); ++ if (rc) ++ kfree_skb(skb); ++ ++ return rc; + } + + static void digital_in_recv_sens_res(struct nfc_digital_dev *ddev, void *arg, diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c index dd59fde1dac8..92c6fbfd51f7 100644 --- a/net/nfc/llcp_sock.c @@ -112685,10 +144563,64 @@ index dd59fde1dac8..92c6fbfd51f7 100644 put_dev: nfc_put_device(dev); diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c -index 85a3d9ed4c29..bff6ba84d397 100644 +index 85a3d9ed4c29..84eedbd5716d 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c -@@ -1188,6 +1188,7 @@ EXPORT_SYMBOL(nci_allocate_device); +@@ -157,12 +157,15 @@ inline int nci_request(struct nci_dev *ndev, + { + int rc; + +- if (!test_bit(NCI_UP, &ndev->flags)) +- return -ENETDOWN; +- + /* Serialize all requests */ + mutex_lock(&ndev->req_lock); +- rc = __nci_request(ndev, req, opt, timeout); ++ /* check the state after obtaing the lock against any races ++ * from nci_close_device when the device gets removed. ++ */ ++ if (test_bit(NCI_UP, &ndev->flags)) ++ rc = __nci_request(ndev, req, opt, timeout); ++ else ++ rc = -ENETDOWN; + mutex_unlock(&ndev->req_lock); + + return rc; +@@ -483,6 +486,11 @@ static int nci_open_device(struct nci_dev *ndev) + + mutex_lock(&ndev->req_lock); + ++ if (test_bit(NCI_UNREG, &ndev->flags)) { ++ rc = -ENODEV; ++ goto done; ++ } ++ + if (test_bit(NCI_UP, &ndev->flags)) { + rc = -EALREADY; + goto done; +@@ -546,6 +554,10 @@ static int nci_open_device(struct nci_dev *ndev) + static int nci_close_device(struct nci_dev *ndev) + { + nci_req_cancel(ndev, ENODEV); ++ ++ /* This mutex needs to be held as a barrier for ++ * caller nci_unregister_device ++ */ + mutex_lock(&ndev->req_lock); + + if (!test_and_clear_bit(NCI_UP, &ndev->flags)) { +@@ -583,8 +595,8 @@ static int nci_close_device(struct nci_dev *ndev) + /* Flush cmd wq */ + flush_workqueue(ndev->cmd_wq); + +- /* Clear flags */ +- ndev->flags = 0; ++ /* Clear flags except NCI_UNREG */ ++ ndev->flags &= BIT(NCI_UNREG); + + mutex_unlock(&ndev->req_lock); + +@@ -1188,6 +1200,7 @@ EXPORT_SYMBOL(nci_allocate_device); void nci_free_device(struct nci_dev *ndev) { nfc_free_device(ndev->nfc_dev); @@ -112696,6 +144628,19 @@ index 85a3d9ed4c29..bff6ba84d397 100644 kfree(ndev); } EXPORT_SYMBOL(nci_free_device); +@@ -1267,6 +1280,12 @@ void nci_unregister_device(struct nci_dev *ndev) + { + struct nci_conn_info *conn_info, *n; + ++ /* This set_bit is not protected with specialized barrier, ++ * However, it is fine because the mutex_lock(&ndev->req_lock); ++ * in nci_close_device() will help to emit one. ++ */ ++ set_bit(NCI_UNREG, &ndev->flags); ++ + nci_close_device(ndev); + + destroy_workqueue(ndev->cmd_wq); diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c index a0ab26d535dc..5fae3f064ad0 100644 --- a/net/nfc/nci/hci.c @@ -112709,11 +144654,37 @@ index a0ab26d535dc..5fae3f064ad0 100644 +{ + kfree(ndev->hci_dev); +} +diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c +index e3bbf1937d0e..7681f89dc312 100644 +--- a/net/nfc/nci/rsp.c ++++ b/net/nfc/nci/rsp.c +@@ -289,6 +289,8 @@ static void nci_core_conn_close_rsp_packet(struct nci_dev *ndev, + ndev->cur_conn_id); + if (conn_info) { + list_del(&conn_info->list); ++ if (conn_info == ndev->rf_conn_info) ++ ndev->rf_conn_info = NULL; + devm_kfree(&ndev->nfc_dev->dev, conn_info); + } + } diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c -index e79a49fe61e8..f326a6ea35fc 100644 +index e79a49fe61e8..6e771022d43e 100644 --- a/net/nfc/netlink.c +++ b/net/nfc/netlink.c -@@ -887,6 +887,7 @@ static int nfc_genl_stop_poll(struct sk_buff *skb, struct genl_info *info) +@@ -669,8 +669,10 @@ static int nfc_genl_dump_devices_done(struct netlink_callback *cb) + { + struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0]; + +- nfc_device_iter_exit(iter); +- kfree(iter); ++ if (iter) { ++ nfc_device_iter_exit(iter); ++ kfree(iter); ++ } + + return 0; + } +@@ -887,6 +889,7 @@ static int nfc_genl_stop_poll(struct sk_buff *skb, struct genl_info *info) if (!dev->polling) { device_unlock(&dev->dev); @@ -112721,7 +144692,7 @@ index e79a49fe61e8..f326a6ea35fc 100644 return -EINVAL; } -@@ -1227,7 +1228,7 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info) +@@ -1227,7 +1230,7 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info) u32 idx; char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1]; @@ -112730,6 +144701,19 @@ index e79a49fe61e8..f326a6ea35fc 100644 return -EINVAL; idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); +@@ -1402,8 +1405,10 @@ static int nfc_genl_dump_ses_done(struct netlink_callback *cb) + { + struct class_dev_iter *iter = (struct class_dev_iter *) cb->args[0]; + +- nfc_device_iter_exit(iter); +- kfree(iter); ++ if (iter) { ++ nfc_device_iter_exit(iter); ++ kfree(iter); ++ } + + return 0; + } diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c index e386e6c90b17..2fba626a0125 100644 --- a/net/nfc/rawsock.c @@ -112961,6 +144945,19 @@ index 802fe548d621..3f23f021ff89 100644 po->running, atomic_read(&s->sk_rmem_alloc), from_kuid_munged(seq_user_ns(seq), sock_i_uid(s)), +diff --git a/net/phonet/pep.c b/net/phonet/pep.c +index f6aa532bcbf6..1e7945df3992 100644 +--- a/net/phonet/pep.c ++++ b/net/phonet/pep.c +@@ -956,6 +956,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg) + ret = -EBUSY; + else if (sk->sk_state == TCP_ESTABLISHED) + ret = -EISCONN; ++ else if (!pn->pn_sk.sobject) ++ ret = -EADDRNOTAVAIL; + else + ret = pep_sock_enable(sk, NULL, 0); + release_sock(sk); diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c index c72d59ebb906..a253f7674d1a 100644 --- a/net/qrtr/qrtr.c @@ -112986,6 +144983,22 @@ index c72d59ebb906..a253f7674d1a 100644 addr->sq_family = AF_QIPCRTR; addr->sq_node = le32_to_cpu(phdr->src_node_id); addr->sq_port = le32_to_cpu(phdr->src_port_id); +diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c +index 3d9c4c6397c3..20d045faf07c 100644 +--- a/net/rds/ib_frmr.c ++++ b/net/rds/ib_frmr.c +@@ -112,9 +112,9 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr) + cpu_relax(); + } + +- ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_len, ++ ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_dma_len, + &off, PAGE_SIZE); +- if (unlikely(ret != ibmr->sg_len)) ++ if (unlikely(ret != ibmr->sg_dma_len)) + return ret < 0 ? ret : -EINVAL; + + /* Perform a WR for the fast_reg_mr. Each individual page diff --git a/net/rds/recv.c b/net/rds/recv.c index f16ee1b13b8d..4bd307e31b40 100644 --- a/net/rds/recv.c @@ -113014,6 +145027,19 @@ index f16ee1b13b8d..4bd307e31b40 100644 } rds_stats_inc(s_recv_delivered); +diff --git a/net/rds/tcp.c b/net/rds/tcp.c +index 2daba5316caa..192f932bce0d 100644 +--- a/net/rds/tcp.c ++++ b/net/rds/tcp.c +@@ -389,7 +389,7 @@ void rds_tcp_tune(struct socket *sock) + sk->sk_userlocks |= SOCK_SNDBUF_LOCK; + } + if (rtn->rcvbuf_size > 0) { +- sk->sk_sndbuf = rtn->rcvbuf_size; ++ sk->sk_rcvbuf = rtn->rcvbuf_size; + sk->sk_userlocks |= SOCK_RCVBUF_LOCK; + } + release_sock(sk); diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c index 344456206b70..0f371e50d9c4 100644 --- a/net/rose/rose_loopback.c @@ -113180,6 +145206,42 @@ index 1de27c39564b..2ec1c29eeba4 100644 return -EPIPE; more = msg->msg_flags & MSG_MORE; +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 18904313bd4e..5d3698199757 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -445,6 +445,7 @@ static int fl_set_key(struct net *net, struct nlattr **tb, + + if (tb[TCA_FLOWER_KEY_IPV4_SRC] || tb[TCA_FLOWER_KEY_IPV4_DST]) { + key->control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS; ++ mask->control.addr_type = ~0; + fl_set_key_val(tb, &key->ipv4.src, TCA_FLOWER_KEY_IPV4_SRC, + &mask->ipv4.src, TCA_FLOWER_KEY_IPV4_SRC_MASK, + sizeof(key->ipv4.src)); +@@ -453,6 +454,7 @@ static int fl_set_key(struct net *net, struct nlattr **tb, + sizeof(key->ipv4.dst)); + } else if (tb[TCA_FLOWER_KEY_IPV6_SRC] || tb[TCA_FLOWER_KEY_IPV6_DST]) { + key->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS; ++ mask->control.addr_type = ~0; + fl_set_key_val(tb, &key->ipv6.src, TCA_FLOWER_KEY_IPV6_SRC, + &mask->ipv6.src, TCA_FLOWER_KEY_IPV6_SRC_MASK, + sizeof(key->ipv6.src)); +@@ -480,6 +482,7 @@ static int fl_set_key(struct net *net, struct nlattr **tb, + if (tb[TCA_FLOWER_KEY_ENC_IPV4_SRC] || + tb[TCA_FLOWER_KEY_ENC_IPV4_DST]) { + key->enc_control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS; ++ mask->enc_control.addr_type = ~0; + fl_set_key_val(tb, &key->enc_ipv4.src, + TCA_FLOWER_KEY_ENC_IPV4_SRC, + &mask->enc_ipv4.src, +@@ -495,6 +498,7 @@ static int fl_set_key(struct net *net, struct nlattr **tb, + if (tb[TCA_FLOWER_KEY_ENC_IPV6_SRC] || + tb[TCA_FLOWER_KEY_ENC_IPV6_DST]) { + key->enc_control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS; ++ mask->enc_control.addr_type = ~0; + fl_set_key_val(tb, &key->enc_ipv6.src, + TCA_FLOWER_KEY_ENC_IPV6_SRC, + &mask->enc_ipv6.src, diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c index ab66e2b38e66..7aafb402e5c7 100644 --- a/net/sched/cls_tcindex.c @@ -113303,6 +145365,20 @@ index 551cf193649e..02ef78d2b3df 100644 sch->qstats.backlog = 0; sch->q.qlen = 0; } +diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c +index 1e37247656f8..8b7110cbcce4 100644 +--- a/net/sched/sch_fifo.c ++++ b/net/sched/sch_fifo.c +@@ -151,6 +151,9 @@ int fifo_set_limit(struct Qdisc *q, unsigned int limit) + if (strncmp(q->ops->id + 1, "fifo", 4) != 0) + return 0; + ++ if (!q->ops->change) ++ return 0; ++ + nla = kmalloc(nla_attr_size(sizeof(struct tc_fifo_qopt)), GFP_KERNEL); + if (nla) { + nla->nla_type = RTM_NEWQDISC; diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c index da3a7c923d08..fc39517d4ccd 100644 --- a/net/sched/sch_generic.c @@ -113421,10 +145497,49 @@ index f99d4855d3de..6ab11ee3d3a5 100644 } diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c -index 401c60750b20..dc4335d817d8 100644 +index 401c60750b20..dd9532c5c19d 100644 --- a/net/sctp/bind_addr.c +++ b/net/sctp/bind_addr.c -@@ -451,6 +451,7 @@ static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest, +@@ -285,20 +285,16 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, + rawaddr = (union sctp_addr_param *)raw_addr_list; + + af = sctp_get_af_specific(param_type2af(param->type)); +- if (unlikely(!af)) { ++ if (unlikely(!af) || ++ !af->from_addr_param(&addr, rawaddr, htons(port), 0)) { + retval = -EINVAL; +- sctp_bind_addr_clean(bp); +- break; ++ goto out_err; + } + +- af->from_addr_param(&addr, rawaddr, htons(port), 0); + retval = sctp_add_bind_addr(bp, &addr, sizeof(addr), + SCTP_ADDR_SRC, gfp); +- if (retval) { +- /* Can't finish building the list, clean up. */ +- sctp_bind_addr_clean(bp); +- break; +- } ++ if (retval) ++ goto out_err; + + len = ntohs(param->length); + addrs_len -= len; +@@ -306,6 +302,12 @@ int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list, + } + + return retval; ++ ++out_err: ++ if (retval) ++ sctp_bind_addr_clean(bp); ++ ++ return retval; + } + + /******************************************************************** +@@ -451,6 +453,7 @@ static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest, * well as the remote peer. */ if ((((AF_INET == addr->sa.sa_family) && @@ -113433,7 +145548,7 @@ index 401c60750b20..dc4335d817d8 100644 (((AF_INET6 == addr->sa.sa_family) && (flags & SCTP_ADDR6_ALLOWED) && diff --git a/net/sctp/input.c b/net/sctp/input.c -index 969fb1623e4e..8f4574c4aa6c 100644 +index 969fb1623e4e..9c1670b4a687 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -449,7 +449,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk, @@ -113454,7 +145569,37 @@ index 969fb1623e4e..8f4574c4aa6c 100644 sctp_do_sm(net, SCTP_EVENT_T_OTHER, SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH), -@@ -1165,7 +1165,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net, +@@ -1051,7 +1051,8 @@ static struct sctp_association *__sctp_rcv_init_lookup(struct net *net, + if (!af) + continue; + +- af->from_addr_param(paddr, params.addr, sh->source, 0); ++ if (!af->from_addr_param(paddr, params.addr, sh->source, 0)) ++ continue; + + asoc = __sctp_lookup_association(net, laddr, paddr, transportp); + if (asoc) +@@ -1087,6 +1088,9 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( + union sctp_addr_param *param; + union sctp_addr paddr; + ++ if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr)) ++ return NULL; ++ + /* Skip over the ADDIP header and find the Address parameter */ + param = (union sctp_addr_param *)(asconf + 1); + +@@ -1094,7 +1098,8 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( + if (unlikely(!af)) + return NULL; + +- af->from_addr_param(&paddr, param, peer_port, 0); ++ if (af->from_addr_param(&paddr, param, peer_port, 0)) ++ return NULL; + + return __sctp_lookup_association(net, laddr, &paddr, transportp); + } +@@ -1165,7 +1170,7 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net, ch = (sctp_chunkhdr_t *) ch_end; chunk_num++; @@ -113463,8 +145608,34 @@ index 969fb1623e4e..8f4574c4aa6c 100644 return asoc; } +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 50bc8c4ca906..01337204d2b6 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -490,15 +490,20 @@ static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk) + } + + /* Initialize a sctp_addr from an address parameter. */ +-static void sctp_v6_from_addr_param(union sctp_addr *addr, ++static bool sctp_v6_from_addr_param(union sctp_addr *addr, + union sctp_addr_param *param, + __be16 port, int iif) + { ++ if (ntohs(param->v6.param_hdr.length) < sizeof(struct sctp_ipv6addr_param)) ++ return false; ++ + addr->v6.sin6_family = AF_INET6; + addr->v6.sin6_port = port; + addr->v6.sin6_flowinfo = 0; /* BUG */ + addr->v6.sin6_addr = param->v6.addr; + addr->v6.sin6_scope_id = iif; ++ ++ return true; + } + + /* Initialize an address parameter from a sctp_addr and return the length diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c -index c5a2a538279b..b2c242facf1b 100644 +index c5a2a538279b..02afbe571008 100644 --- a/net/sctp/protocol.c +++ b/net/sctp/protocol.c @@ -210,6 +210,7 @@ int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *bp, @@ -113475,11 +145646,120 @@ index c5a2a538279b..b2c242facf1b 100644 (copy_flags & SCTP_ADDR4_PEERSUPP))) || (((AF_INET6 == addr->a.sa.sa_family) && (copy_flags & SCTP_ADDR6_ALLOWED) && +@@ -273,14 +274,19 @@ static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk) + } + + /* Initialize a sctp_addr from an address parameter. */ +-static void sctp_v4_from_addr_param(union sctp_addr *addr, ++static bool sctp_v4_from_addr_param(union sctp_addr *addr, + union sctp_addr_param *param, + __be16 port, int iif) + { ++ if (ntohs(param->v4.param_hdr.length) < sizeof(struct sctp_ipv4addr_param)) ++ return false; ++ + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = port; + addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; + memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); ++ ++ return true; + } + + /* Initialize an address parameter from a sctp_addr and return the length +@@ -412,7 +418,8 @@ static sctp_scope_t sctp_v4_scope(union sctp_addr *addr) + retval = SCTP_SCOPE_LINK; + } else if (ipv4_is_private_10(addr->v4.sin_addr.s_addr) || + ipv4_is_private_172(addr->v4.sin_addr.s_addr) || +- ipv4_is_private_192(addr->v4.sin_addr.s_addr)) { ++ ipv4_is_private_192(addr->v4.sin_addr.s_addr) || ++ ipv4_is_test_198(addr->v4.sin_addr.s_addr)) { + retval = SCTP_SCOPE_PRIVATE; + } else { + retval = SCTP_SCOPE_GLOBAL; diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c -index acb0c2631c79..0c5aff3bb539 100644 +index acb0c2631c79..2e2802f04700 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c -@@ -3129,7 +3129,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, +@@ -2155,9 +2155,16 @@ static sctp_ierror_t sctp_verify_param(struct net *net, + break; + + case SCTP_PARAM_SET_PRIMARY: +- if (net->sctp.addip_enable) +- break; +- goto fallthrough; ++ if (!net->sctp.addip_enable) ++ goto fallthrough; ++ ++ if (ntohs(param.p->length) < sizeof(struct sctp_addip_param) + ++ sizeof(struct sctp_paramhdr)) { ++ sctp_process_inv_paramlength(asoc, param.p, ++ chunk, err_chunk); ++ retval = SCTP_IERROR_ABORT; ++ } ++ break; + + case SCTP_PARAM_HOST_NAME_ADDRESS: + /* Tell the peer, we won't support this param. */ +@@ -2335,11 +2342,13 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk, + + /* Process the initialization parameters. */ + sctp_walk_params(param, peer_init, init_hdr.params) { +- if (!src_match && (param.p->type == SCTP_PARAM_IPV4_ADDRESS || +- param.p->type == SCTP_PARAM_IPV6_ADDRESS)) { ++ if (!src_match && ++ (param.p->type == SCTP_PARAM_IPV4_ADDRESS || ++ param.p->type == SCTP_PARAM_IPV6_ADDRESS)) { + af = sctp_get_af_specific(param_type2af(param.p->type)); +- af->from_addr_param(&addr, param.addr, +- chunk->sctp_hdr->source, 0); ++ if (!af->from_addr_param(&addr, param.addr, ++ chunk->sctp_hdr->source, 0)) ++ continue; + if (sctp_cmp_addr_exact(sctp_source(chunk), &addr)) + src_match = 1; + } +@@ -2533,7 +2542,8 @@ static int sctp_process_param(struct sctp_association *asoc, + break; + do_addr_param: + af = sctp_get_af_specific(param_type2af(param.p->type)); +- af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0); ++ if (!af->from_addr_param(&addr, param.addr, htons(asoc->peer.port), 0)) ++ break; + scope = sctp_scope(peer_addr); + if (sctp_in_scope(net, &addr, scope)) + if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_UNCONFIRMED)) +@@ -2626,15 +2636,13 @@ static int sctp_process_param(struct sctp_association *asoc, + addr_param = param.v + sizeof(sctp_addip_param_t); + + af = sctp_get_af_specific(param_type2af(addr_param->p.type)); +- if (af == NULL) ++ if (!af) + break; + +- af->from_addr_param(&addr, addr_param, +- htons(asoc->peer.port), 0); ++ if (!af->from_addr_param(&addr, addr_param, ++ htons(asoc->peer.port), 0)) ++ break; + +- /* if the address is invalid, we can't process it. +- * XXX: see spec for what to do. +- */ + if (!af->addr_valid(&addr, NULL, NULL)) + break; + +@@ -3046,7 +3054,8 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, + if (unlikely(!af)) + return SCTP_ERROR_DNS_FAILED; + +- af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0); ++ if (!af->from_addr_param(&addr, addr_param, htons(asoc->peer.port), 0)) ++ return SCTP_ERROR_DNS_FAILED; + + /* ADDIP 4.2.1 This parameter MUST NOT contain a broadcast + * or multicast address. +@@ -3129,7 +3138,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, * primary. */ if (af->is_any(&addr)) @@ -113488,6 +145768,16 @@ index acb0c2631c79..0c5aff3bb539 100644 peer = sctp_assoc_lookup_paddr(asoc, &addr); if (!peer) +@@ -3311,7 +3320,8 @@ static void sctp_asconf_param_success(struct sctp_association *asoc, + + /* We have checked the packet before, so we do not check again. */ + af = sctp_get_af_specific(param_type2af(addr_param->p.type)); +- af->from_addr_param(&addr, addr_param, htons(bp->port), 0); ++ if (!af->from_addr_param(&addr, addr_param, htons(bp->port), 0)) ++ return; + + switch (asconf_param->param_hdr.type) { + case SCTP_PARAM_ADD_IP: diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c index 1133fa0830f4..26e2927e0c6e 100644 --- a/net/sctp/sm_sideeffect.c @@ -113511,7 +145801,7 @@ index 1133fa0830f4..26e2927e0c6e 100644 diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c -index 146b568962e0..9045f6bcb34c 100644 +index 146b568962e0..f71991520ad6 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -1851,7 +1851,8 @@ static sctp_disposition_t sctp_sf_do_dupcook_b(struct net *net, @@ -113524,6 +145814,24 @@ index 146b568962e0..9045f6bcb34c 100644 sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL()); repl = sctp_make_cookie_ack(new_asoc, chunk); +@@ -4332,6 +4333,9 @@ sctp_disposition_t sctp_sf_violation(struct net *net, + { + struct sctp_chunk *chunk = arg; + ++ if (!sctp_vtag_verify(chunk, asoc)) ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ + /* Make sure that the chunk has a valid length. */ + if (!sctp_chunk_length_valid(chunk, sizeof(sctp_chunkhdr_t))) + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, +@@ -6017,6 +6021,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(struct net *net, + * yet. + */ + switch (chunk->chunk_hdr->type) { ++ case SCTP_CID_INIT: + case SCTP_CID_INIT_ACK: + { + sctp_initack_chunk_t *initack; diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 95f39dde1e08..09a99c92c27d 100644 --- a/net/sctp/socket.c @@ -113883,7 +146191,7 @@ index 5fec3abbe19b..c7d88f979c56 100644 return 0; out: diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c -index d7775ca2fbb9..85ad23d9a8a9 100644 +index d7775ca2fbb9..5a7041c34c7b 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c @@ -779,7 +779,7 @@ u32 svcauth_gss_flavor(struct auth_domain *dom) @@ -113956,6 +146264,15 @@ index d7775ca2fbb9..85ad23d9a8a9 100644 return stat; } +@@ -1848,7 +1853,7 @@ gss_svc_init_net(struct net *net) + goto out2; + return 0; + out2: +- destroy_use_gss_proxy_proc_entry(net); ++ rsi_cache_destroy_net(net); + out1: + rsc_cache_destroy_net(net); + return rv; diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c index de18a463ac96..eef2f732fbe3 100644 --- a/net/sunrpc/clnt.c @@ -114331,7 +146648,7 @@ index 799900c0f2c9..c5d52c9a1acb 100644 tipc_nametbl_stop(net); tipc_sk_rht_destroy(net); diff --git a/net/tipc/link.c b/net/tipc/link.c -index c7406c1fdc14..06327f78f203 100644 +index c7406c1fdc14..6fc2fa75503d 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -877,9 +877,8 @@ void tipc_link_reset(struct tipc_link *l) @@ -114345,7 +146662,7 @@ index c7406c1fdc14..06327f78f203 100644 unsigned int mtu = l->mtu; u16 ack = l->rcv_nxt - 1; u16 seqno = l->snd_nxt; -@@ -888,7 +887,13 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list, +@@ -888,7 +887,14 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list, struct sk_buff_head *backlogq = &l->backlogq; struct sk_buff *skb, *_skb, *bskb; int pkt_cnt = skb_queue_len(list); @@ -114355,16 +146672,16 @@ index c7406c1fdc14..06327f78f203 100644 + if (pkt_cnt <= 0) + return 0; ++ hdr = buf_msg(skb_peek(list)); + imp = msg_importance(hdr); /* Match msg importance against this and all higher backlog limits: */ if (!skb_queue_empty(backlogq)) { for (i = imp; i <= TIPC_SYSTEM_IMPORTANCE; i++) { -@@ -896,6 +901,8 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list, +@@ -896,6 +902,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list, return link_schedule_user(l, list); } } + -+ hdr = buf_msg(skb_peek(list)); if (unlikely(msg_size(hdr) > mtu)) { skb_queue_purge(list); return -EMSGSIZE; @@ -114437,7 +146754,7 @@ index cdc49e680be4..69151de9657c 100644 nla_strlcpy(link_info.str, link[TIPC_NLA_LINK_NAME], TIPC_MAX_LINK_NAME); diff --git a/net/tipc/socket.c b/net/tipc/socket.c -index 57df99ca6347..c1b9074f3325 100644 +index 57df99ca6347..9f39276e5d4e 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -741,6 +741,9 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq, @@ -114450,11 +146767,88 @@ index 57df99ca6347..c1b9074f3325 100644 kfree_skb(__skb_dequeue(arrvq)); } spin_unlock_bh(&inputq->lock); +@@ -1752,7 +1755,7 @@ static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb) + static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk, + u32 dport, struct sk_buff_head *xmitq) + { +- unsigned long time_limit = jiffies + 2; ++ unsigned long time_limit = jiffies + usecs_to_jiffies(20000); + struct sk_buff *skb; + unsigned int lim; + atomic_t *dcnt; +@@ -1982,7 +1985,7 @@ static int tipc_listen(struct socket *sock, int len) + static int tipc_wait_for_accept(struct socket *sock, long timeo) + { + struct sock *sk = sock->sk; +- DEFINE_WAIT(wait); ++ DEFINE_WAIT_FUNC(wait, woken_wake_function); + int err; + + /* True wake-one mechanism for incoming connections: only +@@ -1991,12 +1994,12 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo) + * anymore, the common case will execute the loop only once. + */ + for (;;) { +- prepare_to_wait_exclusive(sk_sleep(sk), &wait, +- TASK_INTERRUPTIBLE); + if (timeo && skb_queue_empty(&sk->sk_receive_queue)) { ++ add_wait_queue(sk_sleep(sk), &wait); + release_sock(sk); +- timeo = schedule_timeout(timeo); ++ timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo); + lock_sock(sk); ++ remove_wait_queue(sk_sleep(sk), &wait); + } + err = 0; + if (!skb_queue_empty(&sk->sk_receive_queue)) +@@ -2011,7 +2014,6 @@ static int tipc_wait_for_accept(struct socket *sock, long timeo) + if (signal_pending(current)) + break; + } +- finish_wait(sk_sleep(sk), &wait); + return err; + } + +diff --git a/net/unix/Kconfig b/net/unix/Kconfig +index 8b31ab85d050..3b9e450656a4 100644 +--- a/net/unix/Kconfig ++++ b/net/unix/Kconfig +@@ -19,6 +19,11 @@ config UNIX + + Say Y unless you know what you are doing. + ++config UNIX_SCM ++ bool ++ depends on UNIX ++ default y ++ + config UNIX_DIAG + tristate "UNIX: socket monitoring interface" + depends on UNIX +diff --git a/net/unix/Makefile b/net/unix/Makefile +index b663c607b1c6..dc686c6757fb 100644 +--- a/net/unix/Makefile ++++ b/net/unix/Makefile +@@ -9,3 +9,5 @@ unix-$(CONFIG_SYSCTL) += sysctl_net_unix.o + + obj-$(CONFIG_UNIX_DIAG) += unix_diag.o + unix_diag-y := diag.o ++ ++obj-$(CONFIG_UNIX_SCM) += scm.o diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index e7012a509035..43a17fb9f290 100644 +index e7012a509035..b7ff1c92c72a 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c -@@ -191,11 +191,17 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk) +@@ -118,6 +118,8 @@ + #include + #include + ++#include "scm.h" ++ + struct hlist_head unix_socket_table[2 * UNIX_HASH_SIZE]; + EXPORT_SYMBOL_GPL(unix_socket_table); + DEFINE_SPINLOCK(unix_table_lock); +@@ -191,11 +193,17 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk) return unix_peer(osk) == NULL || unix_our_peer(sk, osk); } @@ -114473,7 +146867,7 @@ index e7012a509035..43a17fb9f290 100644 struct sock *unix_peer_get(struct sock *s) { struct sock *peer; -@@ -528,12 +534,14 @@ static void unix_release_sock(struct sock *sk, int embrion) +@@ -528,12 +536,14 @@ static void unix_release_sock(struct sock *sk, int embrion) u->path.mnt = NULL; state = sk->sk_state; sk->sk_state = TCP_CLOSE; @@ -114490,7 +146884,7 @@ index e7012a509035..43a17fb9f290 100644 if (skpair != NULL) { if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) { unix_state_lock(skpair); -@@ -548,7 +556,6 @@ static void unix_release_sock(struct sock *sk, int embrion) +@@ -548,7 +558,6 @@ static void unix_release_sock(struct sock *sk, int embrion) unix_dgram_peer_wake_disconnect(sk, skpair); sock_put(skpair); /* It may now die */ @@ -114498,7 +146892,176 @@ index e7012a509035..43a17fb9f290 100644 } /* Try to flush out this socket. Throw out buffers at least */ -@@ -1793,7 +1800,8 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, +@@ -585,20 +594,42 @@ static void unix_release_sock(struct sock *sk, int embrion) + + static void init_peercred(struct sock *sk) + { +- put_pid(sk->sk_peer_pid); +- if (sk->sk_peer_cred) +- put_cred(sk->sk_peer_cred); ++ const struct cred *old_cred; ++ struct pid *old_pid; ++ ++ spin_lock(&sk->sk_peer_lock); ++ old_pid = sk->sk_peer_pid; ++ old_cred = sk->sk_peer_cred; + sk->sk_peer_pid = get_pid(task_tgid(current)); + sk->sk_peer_cred = get_current_cred(); ++ spin_unlock(&sk->sk_peer_lock); ++ ++ put_pid(old_pid); ++ put_cred(old_cred); + } + + static void copy_peercred(struct sock *sk, struct sock *peersk) + { +- put_pid(sk->sk_peer_pid); +- if (sk->sk_peer_cred) +- put_cred(sk->sk_peer_cred); ++ const struct cred *old_cred; ++ struct pid *old_pid; ++ ++ if (sk < peersk) { ++ spin_lock(&sk->sk_peer_lock); ++ spin_lock_nested(&peersk->sk_peer_lock, SINGLE_DEPTH_NESTING); ++ } else { ++ spin_lock(&peersk->sk_peer_lock); ++ spin_lock_nested(&sk->sk_peer_lock, SINGLE_DEPTH_NESTING); ++ } ++ old_pid = sk->sk_peer_pid; ++ old_cred = sk->sk_peer_cred; + sk->sk_peer_pid = get_pid(peersk->sk_peer_pid); + sk->sk_peer_cred = get_cred(peersk->sk_peer_cred); ++ ++ spin_unlock(&sk->sk_peer_lock); ++ spin_unlock(&peersk->sk_peer_lock); ++ ++ put_pid(old_pid); ++ put_cred(old_cred); + } + + static int unix_listen(struct socket *sock, int backlog) +@@ -1498,78 +1529,51 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_ + return err; + } + +-static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) ++static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) + { +- int i; +- +- scm->fp = UNIXCB(skb).fp; +- UNIXCB(skb).fp = NULL; +- +- for (i = scm->fp->count-1; i >= 0; i--) +- unix_notinflight(scm->fp->user, scm->fp->fp[i]); +-} +- +-static void unix_destruct_scm(struct sk_buff *skb) +-{ +- struct scm_cookie scm; +- memset(&scm, 0, sizeof(scm)); +- scm.pid = UNIXCB(skb).pid; +- if (UNIXCB(skb).fp) +- unix_detach_fds(&scm, skb); +- +- /* Alas, it calls VFS */ +- /* So fscking what? fput() had been SMP-safe since the last Summer */ +- scm_destroy(&scm); +- sock_wfree(skb); +-} +- +-/* +- * The "user->unix_inflight" variable is protected by the garbage +- * collection lock, and we just read it locklessly here. If you go +- * over the limit, there might be a tiny race in actually noticing +- * it across threads. Tough. +- */ +-static inline bool too_many_unix_fds(struct task_struct *p) +-{ +- struct user_struct *user = current_user(); +- +- if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE))) +- return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); +- return false; +-} +- +-#define MAX_RECURSION_LEVEL 4 +- +-static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) +-{ +- int i; +- unsigned char max_level = 0; +- +- if (too_many_unix_fds(current)) +- return -ETOOMANYREFS; +- +- for (i = scm->fp->count - 1; i >= 0; i--) { +- struct sock *sk = unix_get_socket(scm->fp->fp[i]); +- +- if (sk) +- max_level = max(max_level, +- unix_sk(sk)->recursion_level); +- } +- if (unlikely(max_level > MAX_RECURSION_LEVEL)) +- return -ETOOMANYREFS; ++ scm->fp = scm_fp_dup(UNIXCB(skb).fp); + + /* +- * Need to duplicate file references for the sake of garbage +- * collection. Otherwise a socket in the fps might become a +- * candidate for GC while the skb is not yet queued. ++ * Garbage collection of unix sockets starts by selecting a set of ++ * candidate sockets which have reference only from being in flight ++ * (total_refs == inflight_refs). This condition is checked once during ++ * the candidate collection phase, and candidates are marked as such, so ++ * that non-candidates can later be ignored. While inflight_refs is ++ * protected by unix_gc_lock, total_refs (file count) is not, hence this ++ * is an instantaneous decision. ++ * ++ * Once a candidate, however, the socket must not be reinstalled into a ++ * file descriptor while the garbage collection is in progress. ++ * ++ * If the above conditions are met, then the directed graph of ++ * candidates (*) does not change while unix_gc_lock is held. ++ * ++ * Any operations that changes the file count through file descriptors ++ * (dup, close, sendmsg) does not change the graph since candidates are ++ * not installed in fds. ++ * ++ * Dequeing a candidate via recvmsg would install it into an fd, but ++ * that takes unix_gc_lock to decrement the inflight count, so it's ++ * serialized with garbage collection. ++ * ++ * MSG_PEEK is special in that it does not change the inflight count, ++ * yet does install the socket into an fd. The following lock/unlock ++ * pair is to ensure serialization with garbage collection. It must be ++ * done between incrementing the file count and installing the file into ++ * an fd. ++ * ++ * If garbage collection starts after the barrier provided by the ++ * lock/unlock, then it will see the elevated refcount and not mark this ++ * as a candidate. If a garbage collection is already in progress ++ * before the file count was incremented, then the lock/unlock pair will ++ * ensure that garbage collection is finished before progressing to ++ * installing the fd. ++ * ++ * (*) A -> B where B is on the queue of A or B is on the queue of C ++ * which is on the queue of listening socket A. + */ +- UNIXCB(skb).fp = scm_fp_dup(scm->fp); +- if (!UNIXCB(skb).fp) +- return -ENOMEM; +- +- for (i = scm->fp->count - 1; i >= 0; i--) +- unix_inflight(scm->fp->user, scm->fp->fp[i]); +- return max_level; ++ spin_lock(&unix_gc_lock); ++ spin_unlock(&unix_gc_lock); + } + + static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds) +@@ -1793,7 +1797,8 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, * - unix_peer(sk) == sk by time of get but disconnected before lock */ if (other != sk && @@ -114508,8 +147071,302 @@ index e7012a509035..43a17fb9f290 100644 if (timeo) { timeo = unix_wait_for_peer(other, timeo); +@@ -2204,7 +2209,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, + sk_peek_offset_fwd(sk, size); + + if (UNIXCB(skb).fp) +- scm.fp = scm_fp_dup(UNIXCB(skb).fp); ++ unix_peek_fds(&scm, skb); + } + err = (flags & MSG_TRUNC) ? skb->len - skip : size; + +@@ -2449,7 +2454,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state, + /* It is questionable, see note in unix_dgram_recvmsg. + */ + if (UNIXCB(skb).fp) +- scm.fp = scm_fp_dup(UNIXCB(skb).fp); ++ unix_peek_fds(&scm, skb); + + sk_peek_offset_fwd(sk, chunk); + +@@ -2711,7 +2716,7 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock, + + other = unix_peer(sk); + if (other && unix_peer(other) != sk && +- unix_recvq_full(other) && ++ unix_recvq_full_lockless(other) && + unix_dgram_peer_wake_me(sk, other)) + writable = 0; + +diff --git a/net/unix/garbage.c b/net/unix/garbage.c +index c36757e72844..8bbe1b8e4ff7 100644 +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -86,77 +86,13 @@ + #include + #include + ++#include "scm.h" ++ + /* Internal data structures and random procedures: */ + +-static LIST_HEAD(gc_inflight_list); + static LIST_HEAD(gc_candidates); +-static DEFINE_SPINLOCK(unix_gc_lock); + static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait); + +-unsigned int unix_tot_inflight; +- +-struct sock *unix_get_socket(struct file *filp) +-{ +- struct sock *u_sock = NULL; +- struct inode *inode = file_inode(filp); +- +- /* Socket ? */ +- if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) { +- struct socket *sock = SOCKET_I(inode); +- struct sock *s = sock->sk; +- +- /* PF_UNIX ? */ +- if (s && sock->ops && sock->ops->family == PF_UNIX) +- u_sock = s; +- } +- return u_sock; +-} +- +-/* Keep the number of times in flight count for the file +- * descriptor if it is for an AF_UNIX socket. +- */ +- +-void unix_inflight(struct user_struct *user, struct file *fp) +-{ +- struct sock *s = unix_get_socket(fp); +- +- spin_lock(&unix_gc_lock); +- +- if (s) { +- struct unix_sock *u = unix_sk(s); +- +- if (atomic_long_inc_return(&u->inflight) == 1) { +- BUG_ON(!list_empty(&u->link)); +- list_add_tail(&u->link, &gc_inflight_list); +- } else { +- BUG_ON(list_empty(&u->link)); +- } +- unix_tot_inflight++; +- } +- user->unix_inflight++; +- spin_unlock(&unix_gc_lock); +-} +- +-void unix_notinflight(struct user_struct *user, struct file *fp) +-{ +- struct sock *s = unix_get_socket(fp); +- +- spin_lock(&unix_gc_lock); +- +- if (s) { +- struct unix_sock *u = unix_sk(s); +- +- BUG_ON(!atomic_long_read(&u->inflight)); +- BUG_ON(list_empty(&u->link)); +- +- if (atomic_long_dec_and_test(&u->inflight)) +- list_del_init(&u->link); +- unix_tot_inflight--; +- } +- user->unix_inflight--; +- spin_unlock(&unix_gc_lock); +-} +- + static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *), + struct sk_buff_head *hitlist) + { +diff --git a/net/unix/scm.c b/net/unix/scm.c +new file mode 100644 +index 000000000000..df8f636ab1d8 +--- /dev/null ++++ b/net/unix/scm.c +@@ -0,0 +1,161 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include "scm.h" ++ ++unsigned int unix_tot_inflight; ++EXPORT_SYMBOL(unix_tot_inflight); ++ ++LIST_HEAD(gc_inflight_list); ++EXPORT_SYMBOL(gc_inflight_list); ++ ++DEFINE_SPINLOCK(unix_gc_lock); ++EXPORT_SYMBOL(unix_gc_lock); ++ ++struct sock *unix_get_socket(struct file *filp) ++{ ++ struct sock *u_sock = NULL; ++ struct inode *inode = file_inode(filp); ++ ++ /* Socket ? */ ++ if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) { ++ struct socket *sock = SOCKET_I(inode); ++ struct sock *s = sock->sk; ++ ++ /* PF_UNIX ? */ ++ if (s && sock->ops && sock->ops->family == PF_UNIX) ++ u_sock = s; ++ } ++ return u_sock; ++} ++EXPORT_SYMBOL(unix_get_socket); ++ ++/* Keep the number of times in flight count for the file ++ * descriptor if it is for an AF_UNIX socket. ++ */ ++void unix_inflight(struct user_struct *user, struct file *fp) ++{ ++ struct sock *s = unix_get_socket(fp); ++ ++ spin_lock(&unix_gc_lock); ++ ++ if (s) { ++ struct unix_sock *u = unix_sk(s); ++ ++ if (atomic_long_inc_return(&u->inflight) == 1) { ++ BUG_ON(!list_empty(&u->link)); ++ list_add_tail(&u->link, &gc_inflight_list); ++ } else { ++ BUG_ON(list_empty(&u->link)); ++ } ++ unix_tot_inflight++; ++ } ++ user->unix_inflight++; ++ spin_unlock(&unix_gc_lock); ++} ++ ++void unix_notinflight(struct user_struct *user, struct file *fp) ++{ ++ struct sock *s = unix_get_socket(fp); ++ ++ spin_lock(&unix_gc_lock); ++ ++ if (s) { ++ struct unix_sock *u = unix_sk(s); ++ ++ BUG_ON(!atomic_long_read(&u->inflight)); ++ BUG_ON(list_empty(&u->link)); ++ ++ if (atomic_long_dec_and_test(&u->inflight)) ++ list_del_init(&u->link); ++ unix_tot_inflight--; ++ } ++ user->unix_inflight--; ++ spin_unlock(&unix_gc_lock); ++} ++ ++/* ++ * The "user->unix_inflight" variable is protected by the garbage ++ * collection lock, and we just read it locklessly here. If you go ++ * over the limit, there might be a tiny race in actually noticing ++ * it across threads. Tough. ++ */ ++static inline bool too_many_unix_fds(struct task_struct *p) ++{ ++ struct user_struct *user = current_user(); ++ ++ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE))) ++ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN); ++ return false; ++} ++ ++#define MAX_RECURSION_LEVEL 4 ++ ++int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) ++{ ++ int i; ++ unsigned char max_level = 0; ++ ++ if (too_many_unix_fds(current)) ++ return -ETOOMANYREFS; ++ ++ for (i = scm->fp->count - 1; i >= 0; i--) { ++ struct sock *sk = unix_get_socket(scm->fp->fp[i]); ++ ++ if (sk) ++ max_level = max(max_level, ++ unix_sk(sk)->recursion_level); ++ } ++ if (unlikely(max_level > MAX_RECURSION_LEVEL)) ++ return -ETOOMANYREFS; ++ ++ /* ++ * Need to duplicate file references for the sake of garbage ++ * collection. Otherwise a socket in the fps might become a ++ * candidate for GC while the skb is not yet queued. ++ */ ++ UNIXCB(skb).fp = scm_fp_dup(scm->fp); ++ if (!UNIXCB(skb).fp) ++ return -ENOMEM; ++ ++ for (i = scm->fp->count - 1; i >= 0; i--) ++ unix_inflight(scm->fp->user, scm->fp->fp[i]); ++ return max_level; ++} ++EXPORT_SYMBOL(unix_attach_fds); ++ ++void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) ++{ ++ int i; ++ ++ scm->fp = UNIXCB(skb).fp; ++ UNIXCB(skb).fp = NULL; ++ ++ for (i = scm->fp->count-1; i >= 0; i--) ++ unix_notinflight(scm->fp->user, scm->fp->fp[i]); ++} ++EXPORT_SYMBOL(unix_detach_fds); ++ ++void unix_destruct_scm(struct sk_buff *skb) ++{ ++ struct scm_cookie scm; ++ ++ memset(&scm, 0, sizeof(scm)); ++ scm.pid = UNIXCB(skb).pid; ++ if (UNIXCB(skb).fp) ++ unix_detach_fds(&scm, skb); ++ ++ /* Alas, it calls VFS */ ++ /* So fscking what? fput() had been SMP-safe since the last Summer */ ++ scm_destroy(&scm); ++ sock_wfree(skb); ++} ++EXPORT_SYMBOL(unix_destruct_scm); +diff --git a/net/unix/scm.h b/net/unix/scm.h +new file mode 100644 +index 000000000000..5a255a477f16 +--- /dev/null ++++ b/net/unix/scm.h +@@ -0,0 +1,10 @@ ++#ifndef NET_UNIX_SCM_H ++#define NET_UNIX_SCM_H ++ ++extern struct list_head gc_inflight_list; ++extern spinlock_t unix_gc_lock; ++ ++int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb); ++void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb); ++ ++#endif diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index d6473b8d9a81..2fecdfe49bae 100644 +index d6473b8d9a81..95470d628d34 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -650,8 +650,9 @@ struct sock *__vsock_create(struct net *net, @@ -114578,6 +147435,15 @@ index d6473b8d9a81..2fecdfe49bae 100644 sock_put(sk); } +@@ -1173,6 +1173,8 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, + * non-blocking call. + */ + err = -EALREADY; ++ if (flags & O_NONBLOCK) ++ goto out; + break; + default: + if ((sk->sk_state == VSOCK_SS_LISTEN) || diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c index 0bd5a60f3bde..67aba63b5c96 100644 --- a/net/vmw_vsock/virtio_transport.c @@ -114943,18 +147809,26 @@ index 9588b7229409..e4b844f07b8e 100644 reg_get_max_bandwidth(rd, reg_rule)); else diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 4de2c7c15531..57cf1381fd4f 100644 +index 4de2c7c15531..84887901afa5 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c -@@ -959,6 +959,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev, +@@ -952,14 +952,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev, + * be grouped with this beacon for updates ... + */ + if (!cfg80211_combine_bsses(rdev, new)) { +- kfree(new); ++ bss_ref_put(rdev, new); + goto drop; + } + } if (rdev->bss_entries >= bss_entries_limit && !cfg80211_bss_expire_oldest(rdev)) { -+ if (!list_empty(&new->hidden_list)) -+ list_del(&new->hidden_list); - kfree(new); +- kfree(new); ++ bss_ref_put(rdev, new); goto drop; } + diff --git a/net/wireless/sme.c b/net/wireless/sme.c index 5d1c8ec911cd..1938ed08ed32 100644 --- a/net/wireless/sme.c @@ -114969,7 +147843,7 @@ index 5d1c8ec911cd..1938ed08ed32 100644 wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL); diff --git a/net/wireless/util.c b/net/wireless/util.c -index e7ea1524ab05..1d7a73c58d16 100755 +index e7ea1524ab05..f442ac1bb097 100755 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -429,7 +429,8 @@ unsigned int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr) @@ -115001,7 +147875,15 @@ index e7ea1524ab05..1d7a73c58d16 100755 offset += sizeof(struct ethhdr); last = remaining <= subframe_len + padding; -@@ -929,6 +933,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, +@@ -914,6 +918,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, + + switch (otype) { + case NL80211_IFTYPE_AP: ++ case NL80211_IFTYPE_P2P_GO: + cfg80211_stop_ap(rdev, dev, true); + break; + case NL80211_IFTYPE_ADHOC: +@@ -929,6 +934,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, case NL80211_IFTYPE_MESH_POINT: /* mesh should be handled? */ break; @@ -116370,6 +149252,19 @@ index 2d7529eeb294..deb87a2e4e6b 100644 } static const struct file_operations fifo_fops = { +diff --git a/samples/kprobes/kretprobe_example.c b/samples/kprobes/kretprobe_example.c +index 7f9060f435cd..da6de5e78e1d 100644 +--- a/samples/kprobes/kretprobe_example.c ++++ b/samples/kprobes/kretprobe_example.c +@@ -83,7 +83,7 @@ static int __init kretprobe_init(void) + ret = register_kretprobe(&my_kretprobe); + if (ret < 0) { + pr_err("register_kretprobe failed, returned %d\n", ret); +- return -1; ++ return ret; + } + pr_info("Planted return probe at %s: %p\n", + my_kretprobe.kp.symbol_name, my_kretprobe.kp.addr); diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c index 49db1def1721..84e583ab8fd0 100644 --- a/samples/mic/mpssd/mpssd.c @@ -116770,7 +149665,7 @@ index 347f70607a33..b7f4235bd925 100644 strcmp(".sched.text", txtname) == 0 || strcmp(".spinlock.text", txtname) == 0 || diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl -index faac4b10d8ea..113c7a071810 100755 +index faac4b10d8ea..21da2831e05b 100755 --- a/scripts/recordmcount.pl +++ b/scripts/recordmcount.pl @@ -140,6 +140,11 @@ my %text_sections = ( @@ -116785,6 +149680,15 @@ index faac4b10d8ea..113c7a071810 100755 # Note: we are nice to C-programmers here, thus we skip the '||='-idiom. $objdump = 'objdump' if (!$objdump); $objcopy = 'objcopy' if (!$objcopy); +@@ -245,7 +250,7 @@ if ($arch eq "x86_64") { + + } elsif ($arch eq "s390" && $bits == 64) { + if ($cc =~ /-DCC_USING_HOTPATCH/) { +- $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*brcl\\s*0,[0-9a-f]+ <([^\+]*)>\$"; ++ $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*c0 04 00 00 00 00\\s*(bcrl\\s*0,|jgnop\\s*)[0-9a-f]+ <([^\+]*)>\$"; + $mcount_adjust = 0; + } else { + $mcount_regex = "^\\s*([0-9a-fA-F]+):\\s*R_390_(PC|PLT)32DBL\\s+_mcount\\+0x2\$"; @@ -261,7 +266,11 @@ if ($arch eq "x86_64") { # force flags for this arch @@ -116874,7 +149778,7 @@ index 48eabf2f48f8..20a79f19a111 100755 # Read two files produced by the stackusage script, and show the # delta between them. diff --git a/scripts/tracing/draw_functrace.py b/scripts/tracing/draw_functrace.py -index db40fa04cd51..30f117dfab43 100755 +index db40fa04cd51..68ecb455b492 100755 --- a/scripts/tracing/draw_functrace.py +++ b/scripts/tracing/draw_functrace.py @@ -1,4 +1,4 @@ @@ -116883,6 +149787,28 @@ index db40fa04cd51..30f117dfab43 100755 """ Copyright 2008 (c) Frederic Weisbecker +@@ -17,7 +17,7 @@ Usage: + $ cat /sys/kernel/debug/tracing/trace_pipe > ~/raw_trace_func + Wait some times but not too much, the script is a bit slow. + Break the pipe (Ctrl + Z) +- $ scripts/draw_functrace.py < raw_trace_func > draw_functrace ++ $ scripts/tracing/draw_functrace.py < ~/raw_trace_func > draw_functrace + Then you have your drawn trace in draw_functrace + """ + +@@ -103,10 +103,10 @@ def parseLine(line): + line = line.strip() + if line.startswith("#"): + raise CommentLineException +- m = re.match("[^]]+?\\] +([0-9.]+): (\\w+) <-(\\w+)", line) ++ m = re.match("[^]]+?\\] +([a-z.]+) +([0-9.]+): (\\w+) <-(\\w+)", line) + if m is None: + raise BrokenLineException +- return (m.group(1), m.group(2), m.group(3)) ++ return (m.group(2), m.group(3), m.group(4)) + + + def main(): diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c index e034dc21421e..b0440cf34970 100644 --- a/security/integrity/evm/evm_crypto.c @@ -116896,6 +149822,19 @@ index e034dc21421e..b0440cf34970 100644 out: kfree(xattr_value); kfree(desc); +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 976b8dce6496..0138932ef34d 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -54,7 +54,7 @@ char *evm_config_xattrnames[] = { + NULL + }; + +-static int evm_fixmode; ++static int evm_fixmode __ro_after_init; + static int __init evm_set_fixmode(char *str) + { + if (strncmp(str, "fix", 3) == 0) diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index df7834aa1b8f..5f2a0a07ceac 100644 --- a/security/integrity/ima/ima.h @@ -116935,6 +149874,19 @@ index 5155c343406e..170f12031ae5 100644 } if (!rc) crypto_shash_final(shash, digest); +diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c +index 74a279957464..315a638ec8d1 100644 +--- a/security/integrity/ima/ima_mok.c ++++ b/security/integrity/ima/ima_mok.c +@@ -25,7 +25,7 @@ struct key *ima_blacklist_keyring; + /* + * Allocate the IMA blacklist keyring + */ +-__init int ima_mok_init(void) ++static __init int ima_mok_init(void) + { + pr_notice("Allocating IMA blacklist keyring.\n"); + diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index aed47b777a57..4926a5a1bc94 100644 --- a/security/integrity/ima/ima_policy.c @@ -116995,6 +149947,114 @@ index 44a20c218409..cc4000dba600 100644 dput(dentry); } audit_log_format(ab, " dev="); +diff --git a/security/security.c b/security/security.c +index d757debd56b6..0706f12ab06d 100644 +--- a/security/security.c ++++ b/security/security.c +@@ -132,25 +132,25 @@ int __init security_module_enable(const char *module) + + /* Security operations */ + +-int security_binder_set_context_mgr(struct task_struct *mgr) ++int security_binder_set_context_mgr(const struct cred *mgr) + { + return call_int_hook(binder_set_context_mgr, 0, mgr); + } + +-int security_binder_transaction(struct task_struct *from, +- struct task_struct *to) ++int security_binder_transaction(const struct cred *from, ++ const struct cred *to) + { + return call_int_hook(binder_transaction, 0, from, to); + } + +-int security_binder_transfer_binder(struct task_struct *from, +- struct task_struct *to) ++int security_binder_transfer_binder(const struct cred *from, ++ const struct cred *to) + { + return call_int_hook(binder_transfer_binder, 0, from, to); + } + +-int security_binder_transfer_file(struct task_struct *from, +- struct task_struct *to, struct file *file) ++int security_binder_transfer_file(const struct cred *from, ++ const struct cred *to, struct file *file) + { + return call_int_hook(binder_transfer_file, 0, from, to, file); + } +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 6581b288e2af..97e51b18c070 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -823,7 +823,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, + if (!strcmp(sb->s_type->name, "debugfs") || + !strcmp(sb->s_type->name, "tracefs") || + !strcmp(sb->s_type->name, "sysfs") || +- !strcmp(sb->s_type->name, "pstore")) ++ !strcmp(sb->s_type->name, "pstore") || ++ !strcmp(sb->s_type->name, "bpf")) + sbsec->flags |= SE_SBGENFS; + + if (!sbsec->behavior) { +@@ -2078,21 +2079,18 @@ static inline u32 open_file_to_av(struct file *file) + + /* Hook functions begin here. */ + +-static int selinux_binder_set_context_mgr(struct task_struct *mgr) ++static int selinux_binder_set_context_mgr(const struct cred *mgr) + { +- u32 mysid = current_sid(); +- u32 mgrsid = task_sid(mgr); +- +- return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, ++ return avc_has_perm(current_sid(), cred_sid(mgr), SECCLASS_BINDER, + BINDER__SET_CONTEXT_MGR, NULL); + } + +-static int selinux_binder_transaction(struct task_struct *from, +- struct task_struct *to) ++static int selinux_binder_transaction(const struct cred *from, ++ const struct cred *to) + { + u32 mysid = current_sid(); +- u32 fromsid = task_sid(from); +- u32 tosid = task_sid(to); ++ u32 fromsid = cred_sid(from); ++ u32 tosid = cred_sid(to); + int rc; + + if (mysid != fromsid) { +@@ -2106,21 +2104,19 @@ static int selinux_binder_transaction(struct task_struct *from, + NULL); + } + +-static int selinux_binder_transfer_binder(struct task_struct *from, +- struct task_struct *to) ++static int selinux_binder_transfer_binder(const struct cred *from, ++ const struct cred *to) + { +- u32 fromsid = task_sid(from); +- u32 tosid = task_sid(to); +- +- return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, ++ return avc_has_perm(cred_sid(from), cred_sid(to), ++ SECCLASS_BINDER, BINDER__TRANSFER, + NULL); + } + +-static int selinux_binder_transfer_file(struct task_struct *from, +- struct task_struct *to, ++static int selinux_binder_transfer_file(const struct cred *from, ++ const struct cred *to, + struct file *file) + { +- u32 sid = task_sid(to); ++ u32 sid = cred_sid(to); + struct file_security_struct *fsec = file->f_security; + struct dentry *dentry = file->f_path.dentry; + struct inode_security_struct *isec; diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 1764b221d545..6bdc0949d81b 100644 --- a/security/selinux/include/classmap.h @@ -117150,11 +150210,75 @@ index b96d4466de4c..b5cd832328b8 100644 goto out; } +diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c +index e5d5c7fb2dac..b25cc69ef7ba 100644 +--- a/security/smack/smack_access.c ++++ b/security/smack/smack_access.c +@@ -90,23 +90,22 @@ int log_policy = SMACK_AUDIT_DENIED; + int smk_access_entry(char *subject_label, char *object_label, + struct list_head *rule_list) + { +- int may = -ENOENT; + struct smack_rule *srp; + + list_for_each_entry_rcu(srp, rule_list, list) { + if (srp->smk_object->smk_known == object_label && + srp->smk_subject->smk_known == subject_label) { +- may = srp->smk_access; +- break; ++ int may = srp->smk_access; ++ /* ++ * MAY_WRITE implies MAY_LOCK. ++ */ ++ if ((may & MAY_WRITE) == MAY_WRITE) ++ may |= MAY_LOCK; ++ return may; + } + } + +- /* +- * MAY_WRITE implies MAY_LOCK. +- */ +- if ((may & MAY_WRITE) == MAY_WRITE) +- may |= MAY_LOCK; +- return may; ++ return -ENOENT; + } + + /** diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c -index 6492fe96cae4..966d30bf2e38 100644 +index 6492fe96cae4..ed5b89fbbd96 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c -@@ -878,6 +878,8 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, +@@ -716,9 +716,7 @@ static void smk_cipso_doi(void) + printk(KERN_WARNING "%s:%d remove rc = %d\n", + __func__, __LINE__, rc); + +- doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL); +- if (doip == NULL) +- panic("smack: Failed to initialize cipso DOI.\n"); ++ doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL | __GFP_NOFAIL); + doip->map.std = NULL; + doip->doi = smk_cipso_doi_value; + doip->type = CIPSO_V4_MAP_PASS; +@@ -737,7 +735,7 @@ static void smk_cipso_doi(void) + if (rc != 0) { + printk(KERN_WARNING "%s:%d map add rc = %d\n", + __func__, __LINE__, rc); +- kfree(doip); ++ netlbl_cfg_cipsov4_del(doip->doi, &nai); + return; + } + } +@@ -854,6 +852,7 @@ static int smk_open_cipso(struct inode *inode, struct file *file) + static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + size_t count, loff_t *ppos, int format) + { ++ struct netlbl_lsm_catmap *old_cat; + struct smack_known *skp; + struct netlbl_lsm_secattr ncats; + char mapcatset[SMK_CIPSOLEN]; +@@ -878,6 +877,8 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, if (format == SMK_FIXED24_FMT && (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)) return -EINVAL; @@ -117163,7 +150287,7 @@ index 6492fe96cae4..966d30bf2e38 100644 data = memdup_user_nul(buf, count); if (IS_ERR(data)) -@@ -901,11 +903,21 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, +@@ -901,11 +902,21 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, else rule += strlen(skp->smk_known) + 1; @@ -117186,7 +150310,7 @@ index 6492fe96cae4..966d30bf2e38 100644 ret = sscanf(rule, "%d", &catlen); if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM) goto out; -@@ -918,6 +930,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, +@@ -918,6 +929,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, for (i = 0; i < catlen; i++) { rule += SMK_DIGITLEN; @@ -117197,7 +150321,20 @@ index 6492fe96cae4..966d30bf2e38 100644 ret = sscanf(rule, "%u", &cat); if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM) goto out; -@@ -1172,7 +1188,7 @@ static ssize_t smk_write_net4addr(struct file *file, const char __user *buf, +@@ -927,9 +942,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, + + rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN); + if (rc >= 0) { +- netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat); ++ old_cat = skp->smk_netlabel.attr.mls.cat; + skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat; + skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl; ++ synchronize_rcu(); ++ netlbl_catmap_free(old_cat); + rc = count; + } + +@@ -1172,7 +1189,7 @@ static ssize_t smk_write_net4addr(struct file *file, const char __user *buf, return -EPERM; if (*ppos != 0) return -EINVAL; @@ -117206,7 +150343,7 @@ index 6492fe96cae4..966d30bf2e38 100644 return -EINVAL; data = memdup_user_nul(buf, count); -@@ -1432,7 +1448,7 @@ static ssize_t smk_write_net6addr(struct file *file, const char __user *buf, +@@ -1432,7 +1449,7 @@ static ssize_t smk_write_net6addr(struct file *file, const char __user *buf, return -EPERM; if (*ppos != 0) return -EINVAL; @@ -117215,7 +150352,7 @@ index 6492fe96cae4..966d30bf2e38 100644 return -EINVAL; data = memdup_user_nul(buf, count); -@@ -1839,6 +1855,10 @@ static ssize_t smk_write_ambient(struct file *file, const char __user *buf, +@@ -1839,6 +1856,10 @@ static ssize_t smk_write_ambient(struct file *file, const char __user *buf, if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; @@ -117226,7 +150363,7 @@ index 6492fe96cae4..966d30bf2e38 100644 data = memdup_user_nul(buf, count); if (IS_ERR(data)) return PTR_ERR(data); -@@ -2010,6 +2030,9 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf, +@@ -2010,6 +2031,9 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf, if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; @@ -117236,7 +150373,7 @@ index 6492fe96cae4..966d30bf2e38 100644 data = memdup_user_nul(buf, count); if (IS_ERR(data)) return PTR_ERR(data); -@@ -2097,6 +2120,9 @@ static ssize_t smk_write_unconfined(struct file *file, const char __user *buf, +@@ -2097,6 +2121,9 @@ static ssize_t smk_write_unconfined(struct file *file, const char __user *buf, if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; @@ -117246,7 +150383,7 @@ index 6492fe96cae4..966d30bf2e38 100644 data = memdup_user_nul(buf, count); if (IS_ERR(data)) return PTR_ERR(data); -@@ -2650,6 +2676,10 @@ static ssize_t smk_write_syslog(struct file *file, const char __user *buf, +@@ -2650,6 +2677,10 @@ static ssize_t smk_write_syslog(struct file *file, const char __user *buf, if (!smack_privileged(CAP_MAC_ADMIN)) return -EPERM; @@ -117257,7 +150394,7 @@ index 6492fe96cae4..966d30bf2e38 100644 data = memdup_user_nul(buf, count); if (IS_ERR(data)) return PTR_ERR(data); -@@ -2731,7 +2761,6 @@ static int smk_open_relabel_self(struct inode *inode, struct file *file) +@@ -2731,7 +2762,6 @@ static int smk_open_relabel_self(struct inode *inode, struct file *file) static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { @@ -117265,7 +150402,7 @@ index 6492fe96cae4..966d30bf2e38 100644 char *data; int rc; LIST_HEAD(list_tmp); -@@ -2743,10 +2772,13 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, +@@ -2743,10 +2773,13 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, return -EPERM; /* @@ -117279,7 +150416,7 @@ index 6492fe96cae4..966d30bf2e38 100644 data = memdup_user_nul(buf, count); if (IS_ERR(data)) -@@ -2756,11 +2788,21 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, +@@ -2756,11 +2789,21 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf, kfree(data); if (!rc || (rc == -EINVAL && list_empty(&list_tmp))) { @@ -117337,6 +150474,27 @@ index 511368fe974e..abda2c3fcd8a 100644 } static int snd_ctl_elem_add_user(struct snd_ctl_file *file, +diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c +index 84ee29c3b1a0..be5ca6f58e55 100644 +--- a/sound/core/control_compat.c ++++ b/sound/core/control_compat.c +@@ -281,6 +281,7 @@ static int copy_ctl_value_to_user(void __user *userdata, + struct snd_ctl_elem_value *data, + int type, int count) + { ++ struct snd_ctl_elem_value32 __user *data32 = userdata; + int i, size; + + if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || +@@ -297,6 +298,8 @@ static int copy_ctl_value_to_user(void __user *userdata, + if (copy_to_user(valuep, data->value.bytes.data, size)) + return -EFAULT; + } ++ if (copy_to_user(&data32->id, &data->id, sizeof(data32->id))) ++ return -EFAULT; + return 0; + } + diff --git a/sound/core/info.c b/sound/core/info.c index d092d84307cf..74850bbf6afd 100644 --- a/sound/core/info.c @@ -117367,6 +150525,171 @@ index f49f5075a6da..31fa4f50415b 100644 list_for_each_entry(mfile, &card->files_list, list) { /* it's critical part, use endless loop */ /* we have no room to fail */ +diff --git a/sound/core/jack.c b/sound/core/jack.c +index 40190775b034..89d8df8a54ed 100644 +--- a/sound/core/jack.c ++++ b/sound/core/jack.c +@@ -238,6 +238,10 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, + return -ENOMEM; + + jack->id = kstrdup(id, GFP_KERNEL); ++ if (jack->id == NULL) { ++ kfree(jack); ++ return -ENOMEM; ++ } + + /* don't creat input device for phantom jack */ + if (!phantom_jack) { +diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c +index 2ff9c12d664a..1845db338d0f 100644 +--- a/sound/core/oss/mixer_oss.c ++++ b/sound/core/oss/mixer_oss.c +@@ -145,11 +145,13 @@ static int snd_mixer_oss_devmask(struct snd_mixer_oss_file *fmixer) + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + for (chn = 0; chn < 31; chn++) { + pslot = &mixer->slots[chn]; + if (pslot->put_volume || pslot->put_recsrc) + result |= 1 << chn; + } ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -161,11 +163,13 @@ static int snd_mixer_oss_stereodevs(struct snd_mixer_oss_file *fmixer) + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + for (chn = 0; chn < 31; chn++) { + pslot = &mixer->slots[chn]; + if (pslot->put_volume && pslot->stereo) + result |= 1 << chn; + } ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -176,6 +180,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer) + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */ + result = mixer->mask_recsrc; + } else { +@@ -187,6 +192,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer) + result |= 1 << chn; + } + } ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -197,11 +203,12 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer) + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */ +- int err; + unsigned int index; +- if ((err = mixer->get_recsrc(fmixer, &index)) < 0) +- return err; ++ result = mixer->get_recsrc(fmixer, &index); ++ if (result < 0) ++ goto unlock; + result = 1 << index; + } else { + struct snd_mixer_oss_slot *pslot; +@@ -216,7 +223,10 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer) + } + } + } +- return mixer->oss_recsrc = result; ++ mixer->oss_recsrc = result; ++ unlock: ++ mutex_unlock(&mixer->reg_mutex); ++ return result; + } + + static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsrc) +@@ -229,6 +239,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr + + if (mixer == NULL) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + if (mixer->get_recsrc && mixer->put_recsrc) { /* exclusive input */ + if (recsrc & ~mixer->oss_recsrc) + recsrc &= ~mixer->oss_recsrc; +@@ -254,6 +265,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr + } + } + } ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -265,6 +277,7 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot) + + if (mixer == NULL || slot > 30) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + pslot = &mixer->slots[slot]; + left = pslot->volume[0]; + right = pslot->volume[1]; +@@ -272,15 +285,21 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot) + result = pslot->get_volume(fmixer, pslot, &left, &right); + if (!pslot->stereo) + right = left; +- if (snd_BUG_ON(left < 0 || left > 100)) +- return -EIO; +- if (snd_BUG_ON(right < 0 || right > 100)) +- return -EIO; ++ if (snd_BUG_ON(left < 0 || left > 100)) { ++ result = -EIO; ++ goto unlock; ++ } ++ if (snd_BUG_ON(right < 0 || right > 100)) { ++ result = -EIO; ++ goto unlock; ++ } + if (result >= 0) { + pslot->volume[0] = left; + pslot->volume[1] = right; + result = (left & 0xff) | ((right & 0xff) << 8); + } ++ unlock: ++ mutex_unlock(&mixer->reg_mutex); + return result; + } + +@@ -293,6 +312,7 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer, + + if (mixer == NULL || slot > 30) + return -EIO; ++ mutex_lock(&mixer->reg_mutex); + pslot = &mixer->slots[slot]; + if (left > 100) + left = 100; +@@ -303,10 +323,13 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer, + if (pslot->put_volume) + result = pslot->put_volume(fmixer, pslot, left, right); + if (result < 0) +- return result; ++ goto unlock; + pslot->volume[0] = left; + pslot->volume[1] = right; +- return (left & 0xff) | ((right & 0xff) << 8); ++ result = (left & 0xff) | ((right & 0xff) << 8); ++ unlock: ++ mutex_unlock(&mixer->reg_mutex); ++ return result; + } + + static int snd_mixer_oss_ioctl1(struct snd_mixer_oss_file *fmixer, unsigned int cmd, unsigned long arg) diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c index 3788906421a7..fe27034f2846 100644 --- a/sound/core/oss/mulaw.c @@ -117383,19 +150706,49 @@ index 3788906421a7..fe27034f2846 100644 err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion", src_format, dst_format, diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c -index 824097571467..c2fb5198d5d5 100644 +index 824097571467..0ce3f42721c4 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c -@@ -719,6 +719,8 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, +@@ -173,7 +173,7 @@ snd_pcm_hw_param_value_min(const struct snd_pcm_hw_params *params, + * + * Return the maximum value for field PAR. + */ +-static unsigned int ++static int + snd_pcm_hw_param_value_max(const struct snd_pcm_hw_params *params, + snd_pcm_hw_param_t var, int *dir) + { +@@ -708,17 +708,25 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, + struct snd_pcm_hw_params *oss_params, + struct snd_pcm_hw_params *slave_params) + { +- size_t s; +- size_t oss_buffer_size, oss_period_size, oss_periods; +- size_t min_period_size, max_period_size; ++ ssize_t s; ++ ssize_t oss_buffer_size; ++ ssize_t oss_period_size, oss_periods; ++ ssize_t min_period_size, max_period_size; + struct snd_pcm_runtime *runtime = substream->runtime; + size_t oss_frame_size; + oss_frame_size = snd_pcm_format_physical_width(params_format(oss_params)) * + params_channels(oss_params) / 8; + ++ oss_buffer_size = snd_pcm_hw_param_value_max(slave_params, ++ SNDRV_PCM_HW_PARAM_BUFFER_SIZE, ++ NULL); ++ if (oss_buffer_size <= 0) ++ return -EINVAL; oss_buffer_size = snd_pcm_plug_client_size(substream, - snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size; -+ if (!oss_buffer_size) +- snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size; ++ oss_buffer_size * oss_frame_size); ++ if (oss_buffer_size <= 0) + return -EINVAL; oss_buffer_size = rounddown_pow_of_two(oss_buffer_size); if (atomic_read(&substream->mmap_count)) { if (oss_buffer_size > runtime->oss.mmap_bytes) -@@ -754,17 +756,21 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, +@@ -754,17 +762,21 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, min_period_size = snd_pcm_plug_client_size(substream, snd_pcm_hw_param_value_min(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL)); @@ -117403,7 +150756,7 @@ index 824097571467..c2fb5198d5d5 100644 - min_period_size = roundup_pow_of_two(min_period_size); - if (oss_period_size < min_period_size) - oss_period_size = min_period_size; -+ if (min_period_size) { ++ if (min_period_size > 0) { + min_period_size *= oss_frame_size; + min_period_size = roundup_pow_of_two(min_period_size); + if (oss_period_size < min_period_size) @@ -117416,7 +150769,7 @@ index 824097571467..c2fb5198d5d5 100644 - max_period_size = rounddown_pow_of_two(max_period_size); - if (oss_period_size > max_period_size) - oss_period_size = max_period_size; -+ if (max_period_size) { ++ if (max_period_size > 0) { + max_period_size *= oss_frame_size; + max_period_size = rounddown_pow_of_two(max_period_size); + if (oss_period_size > max_period_size) @@ -117425,7 +150778,34 @@ index 824097571467..c2fb5198d5d5 100644 oss_periods = oss_buffer_size / oss_period_size; -@@ -2001,11 +2007,15 @@ static int snd_pcm_oss_set_subdivide(struct snd_pcm_oss_file *pcm_oss_file, int +@@ -772,7 +784,7 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, + oss_periods = substream->oss.setup.periods; + + s = snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIODS, NULL); +- if (runtime->oss.maxfrags && s > runtime->oss.maxfrags) ++ if (s > 0 && runtime->oss.maxfrags && s > runtime->oss.maxfrags) + s = runtime->oss.maxfrags; + if (oss_periods > s) + oss_periods = s; +@@ -898,8 +910,15 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) + err = -EINVAL; + goto failure; + } +- choose_rate(substream, sparams, runtime->oss.rate); +- snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_CHANNELS, runtime->oss.channels, NULL); ++ ++ err = choose_rate(substream, sparams, runtime->oss.rate); ++ if (err < 0) ++ goto failure; ++ err = snd_pcm_hw_param_near(substream, sparams, ++ SNDRV_PCM_HW_PARAM_CHANNELS, ++ runtime->oss.channels, NULL); ++ if (err < 0) ++ goto failure; + + format = snd_pcm_oss_format_from(runtime->oss.format); + +@@ -2001,11 +2020,15 @@ static int snd_pcm_oss_set_subdivide(struct snd_pcm_oss_file *pcm_oss_file, int static int snd_pcm_oss_set_fragment1(struct snd_pcm_substream *substream, unsigned int val) { struct snd_pcm_runtime *runtime; @@ -117436,12 +150816,25 @@ index 824097571467..c2fb5198d5d5 100644 return -EINVAL; - runtime->oss.fragshift = val & 0xffff; + fragshift = val & 0xffff; -+ if (fragshift >= 31) ++ if (fragshift >= 25) /* should be large enough */ + return -EINVAL; + runtime->oss.fragshift = fragshift; runtime->oss.maxfrags = (val >> 16) & 0xffff; if (runtime->oss.fragshift < 4) /* < 16 */ runtime->oss.fragshift = 4; +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index cab398c816e6..ba6d18656c09 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1845,7 +1845,7 @@ static int snd_pcm_lib_ioctl_fifo_size(struct snd_pcm_substream *substream, + channels = params_channels(params); + frame_size = snd_pcm_format_size(format, channels); + if (frame_size > 0) +- params->fifo_size /= (unsigned)frame_size; ++ params->fifo_size /= frame_size; + } + return 0; + } diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index 0179ef50b6b6..4bcb0d593b14 100755 --- a/sound/core/pcm_native.c @@ -117497,6 +150890,117 @@ index c93945917235..247b68790a52 100644 inf->synth_type = SYNTH_TYPE_MIDI; inf->synth_subtype = 0; inf->nr_voices = 16; +diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c +index e40a2cba5002..5d16b2079119 100644 +--- a/sound/core/seq/seq_device.c ++++ b/sound/core/seq/seq_device.c +@@ -162,6 +162,8 @@ static int snd_seq_device_dev_free(struct snd_device *device) + struct snd_seq_device *dev = device->device_data; + + cancel_autoload_drivers(); ++ if (dev->private_free) ++ dev->private_free(dev); + put_device(&dev->dev); + return 0; + } +@@ -189,11 +191,7 @@ static int snd_seq_device_dev_disconnect(struct snd_device *device) + + static void snd_seq_dev_release(struct device *dev) + { +- struct snd_seq_device *sdev = to_seq_dev(dev); +- +- if (sdev->private_free) +- sdev->private_free(sdev); +- kfree(sdev); ++ kfree(to_seq_dev(dev)); + } + + /* +diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c +index 9cfe4fcee9a5..27433f141cee 100644 +--- a/sound/core/seq/seq_ports.c ++++ b/sound/core/seq/seq_ports.c +@@ -532,10 +532,11 @@ static int check_and_subscribe_port(struct snd_seq_client *client, + return err; + } + +-static void delete_and_unsubscribe_port(struct snd_seq_client *client, +- struct snd_seq_client_port *port, +- struct snd_seq_subscribers *subs, +- bool is_src, bool ack) ++/* called with grp->list_mutex held */ ++static void __delete_and_unsubscribe_port(struct snd_seq_client *client, ++ struct snd_seq_client_port *port, ++ struct snd_seq_subscribers *subs, ++ bool is_src, bool ack) + { + struct snd_seq_port_subs_info *grp; + struct list_head *list; +@@ -543,7 +544,6 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client, + + grp = is_src ? &port->c_src : &port->c_dest; + list = is_src ? &subs->src_list : &subs->dest_list; +- down_write(&grp->list_mutex); + write_lock_irq(&grp->list_lock); + empty = list_empty(list); + if (!empty) +@@ -553,6 +553,18 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client, + + if (!empty) + unsubscribe_port(client, port, grp, &subs->info, ack); ++} ++ ++static void delete_and_unsubscribe_port(struct snd_seq_client *client, ++ struct snd_seq_client_port *port, ++ struct snd_seq_subscribers *subs, ++ bool is_src, bool ack) ++{ ++ struct snd_seq_port_subs_info *grp; ++ ++ grp = is_src ? &port->c_src : &port->c_dest; ++ down_write(&grp->list_mutex); ++ __delete_and_unsubscribe_port(client, port, subs, is_src, ack); + up_write(&grp->list_mutex); + } + +@@ -608,27 +620,30 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector, + struct snd_seq_client_port *dest_port, + struct snd_seq_port_subscribe *info) + { +- struct snd_seq_port_subs_info *src = &src_port->c_src; ++ struct snd_seq_port_subs_info *dest = &dest_port->c_dest; + struct snd_seq_subscribers *subs; + int err = -ENOENT; + +- down_write(&src->list_mutex); ++ /* always start from deleting the dest port for avoiding concurrent ++ * deletions ++ */ ++ down_write(&dest->list_mutex); + /* look for the connection */ +- list_for_each_entry(subs, &src->list_head, src_list) { ++ list_for_each_entry(subs, &dest->list_head, dest_list) { + if (match_subs_info(info, &subs->info)) { +- atomic_dec(&subs->ref_count); /* mark as not ready */ ++ __delete_and_unsubscribe_port(dest_client, dest_port, ++ subs, false, ++ connector->number != dest_client->number); + err = 0; + break; + } + } +- up_write(&src->list_mutex); ++ up_write(&dest->list_mutex); + if (err < 0) + return err; + + delete_and_unsubscribe_port(src_client, src_port, subs, true, + connector->number != src_client->number); +- delete_and_unsubscribe_port(dest_client, dest_port, subs, false, +- connector->number != dest_client->number); + kfree(subs); + return 0; + } diff --git a/sound/core/seq/seq_queue.h b/sound/core/seq/seq_queue.h index 719093489a2c..7909cf6040e3 100644 --- a/sound/core/seq/seq_queue.h @@ -117517,7 +151021,7 @@ index 719093489a2c..7909cf6040e3 100644 unsigned int flags; /* status flags */ unsigned int info_flags; /* info for sync */ diff --git a/sound/core/timer.c b/sound/core/timer.c -index be9e517e264c..4d57a7a7dd44 100644 +index be9e517e264c..7a20d2563289 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -488,9 +488,10 @@ static void snd_timer_notify1(struct snd_timer_instance *ti, int event) @@ -117532,6 +151036,52 @@ index be9e517e264c..4d57a7a7dd44 100644 } /* start/continue a master timer */ +@@ -580,13 +581,13 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) + if (!timer) + return -EINVAL; + spin_lock_irqsave(&timer->lock, flags); ++ list_del_init(&timeri->ack_list); ++ list_del_init(&timeri->active_list); + if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | + SNDRV_TIMER_IFLG_START))) { + result = -EBUSY; + goto unlock; + } +- list_del_init(&timeri->ack_list); +- list_del_init(&timeri->active_list); + if (timer->card && timer->card->shutdown) + goto unlock; + if (stop) { +@@ -621,23 +622,22 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) + static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop) + { + unsigned long flags; ++ bool running; + + spin_lock_irqsave(&slave_active_lock, flags); +- if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) { +- spin_unlock_irqrestore(&slave_active_lock, flags); +- return -EBUSY; +- } ++ running = timeri->flags & SNDRV_TIMER_IFLG_RUNNING; + timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; + if (timeri->timer) { + spin_lock(&timeri->timer->lock); + list_del_init(&timeri->ack_list); + list_del_init(&timeri->active_list); +- snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : +- SNDRV_TIMER_EVENT_PAUSE); ++ if (running) ++ snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : ++ SNDRV_TIMER_EVENT_PAUSE); + spin_unlock(&timeri->timer->lock); + } + spin_unlock_irqrestore(&slave_active_lock, flags); +- return 0; ++ return running ? 0 : -EBUSY; + } + + /* diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c index 847f70348d4d..cc600aa0f6c7 100644 --- a/sound/drivers/aloop.c @@ -117561,6 +151111,19 @@ index 847f70348d4d..cc600aa0f6c7 100644 } } } +diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c +index 7821b07415a7..ff67c4b67e26 100644 +--- a/sound/drivers/opl3/opl3_midi.c ++++ b/sound/drivers/opl3/opl3_midi.c +@@ -415,7 +415,7 @@ void snd_opl3_note_on(void *p, int note, int vel, struct snd_midi_channel *chan) + } + if (instr_4op) { + vp2 = &opl3->voices[voice + 3]; +- if (vp->state > 0) { ++ if (vp2->state > 0) { + opl3_reg = reg_side | (OPL3_REG_KEYON_BLOCK + + voice_offset + 3); + reg_val = vp->keyon_reg & ~OPL3_KEYON_BIT; diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c index 42920a243328..3f94746d587a 100644 --- a/sound/drivers/opl3/opl3_synth.c @@ -117781,6 +151344,22 @@ index 0e81ea89a596..e3f68a76d90e 100644 } /** +diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c +index 00c6af2ae1c2..f0e112906c68 100644 +--- a/sound/hda/hdac_controller.c ++++ b/sound/hda/hdac_controller.c +@@ -389,8 +389,9 @@ static int azx_reset(struct hdac_bus *bus, bool full_reset) + if (!full_reset) + goto skip_reset; + +- /* clear STATESTS */ +- snd_hdac_chip_writew(bus, STATESTS, STATESTS_INT_MASK); ++ /* clear STATESTS if not in reset */ ++ if (snd_hdac_chip_readb(bus, GCTL) & AZX_GCTL_RESET) ++ snd_hdac_chip_writew(bus, STATESTS, STATESTS_INT_MASK); + + /* reset controller */ + snd_hdac_bus_enter_link_reset(bus); diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c index 03c9872c31cf..73264d5f58f8 100644 --- a/sound/hda/hdac_device.c @@ -117823,6 +151402,19 @@ index 1901c2bb6c3b..a36e2121ef09 100644 pnp_set_card_drvdata(pcard, card); snd_es968_pnp_is_probed = 1; return 0; +diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c +index 36c27c832360..2e27cd3427c8 100644 +--- a/sound/isa/gus/gus_dma.c ++++ b/sound/isa/gus/gus_dma.c +@@ -141,6 +141,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus) + } + block = snd_gf1_dma_next_block(gus); + spin_unlock(&gus->dma_lock); ++ if (!block) ++ return; + snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd); + kfree(block); + #if 0 diff --git a/sound/isa/sb/emu8000.c b/sound/isa/sb/emu8000.c index 94c411299e5a..470058e89fef 100644 --- a/sound/isa/sb/emu8000.c @@ -118012,6 +151604,95 @@ index 7488e1b7a770..4e726d39b05d 100644 cs46xx_dsp_disable_spdif_out (chip); /* save state */ +diff --git a/sound/pci/ctxfi/ctamixer.c b/sound/pci/ctxfi/ctamixer.c +index 5fcbb065d870..d32685ce6c05 100644 +--- a/sound/pci/ctxfi/ctamixer.c ++++ b/sound/pci/ctxfi/ctamixer.c +@@ -27,16 +27,15 @@ + + #define BLANK_SLOT 4094 + +-static int amixer_master(struct rsc *rsc) ++static void amixer_master(struct rsc *rsc) + { + rsc->conj = 0; +- return rsc->idx = container_of(rsc, struct amixer, rsc)->idx[0]; ++ rsc->idx = container_of(rsc, struct amixer, rsc)->idx[0]; + } + +-static int amixer_next_conj(struct rsc *rsc) ++static void amixer_next_conj(struct rsc *rsc) + { + rsc->conj++; +- return container_of(rsc, struct amixer, rsc)->idx[rsc->conj]; + } + + static int amixer_index(const struct rsc *rsc) +@@ -335,16 +334,15 @@ int amixer_mgr_destroy(struct amixer_mgr *amixer_mgr) + + /* SUM resource management */ + +-static int sum_master(struct rsc *rsc) ++static void sum_master(struct rsc *rsc) + { + rsc->conj = 0; +- return rsc->idx = container_of(rsc, struct sum, rsc)->idx[0]; ++ rsc->idx = container_of(rsc, struct sum, rsc)->idx[0]; + } + +-static int sum_next_conj(struct rsc *rsc) ++static void sum_next_conj(struct rsc *rsc) + { + rsc->conj++; +- return container_of(rsc, struct sum, rsc)->idx[rsc->conj]; + } + + static int sum_index(const struct rsc *rsc) +diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c +index 7f089cb433e1..df326b7663a2 100644 +--- a/sound/pci/ctxfi/ctdaio.c ++++ b/sound/pci/ctxfi/ctdaio.c +@@ -55,12 +55,12 @@ static struct daio_rsc_idx idx_20k2[NUM_DAIOTYP] = { + [SPDIFIO] = {.left = 0x05, .right = 0x85}, + }; + +-static int daio_master(struct rsc *rsc) ++static void daio_master(struct rsc *rsc) + { + /* Actually, this is not the resource index of DAIO. + * For DAO, it is the input mapper index. And, for DAI, + * it is the output time-slot index. */ +- return rsc->conj = rsc->idx; ++ rsc->conj = rsc->idx; + } + + static int daio_index(const struct rsc *rsc) +@@ -68,19 +68,19 @@ static int daio_index(const struct rsc *rsc) + return rsc->conj; + } + +-static int daio_out_next_conj(struct rsc *rsc) ++static void daio_out_next_conj(struct rsc *rsc) + { +- return rsc->conj += 2; ++ rsc->conj += 2; + } + +-static int daio_in_next_conj_20k1(struct rsc *rsc) ++static void daio_in_next_conj_20k1(struct rsc *rsc) + { +- return rsc->conj += 0x200; ++ rsc->conj += 0x200; + } + +-static int daio_in_next_conj_20k2(struct rsc *rsc) ++static void daio_in_next_conj_20k2(struct rsc *rsc) + { +- return rsc->conj += 0x100; ++ rsc->conj += 0x100; + } + + static const struct rsc_ops daio_out_rsc_ops = { diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c index 18ee7768b7c4..ae8aa10a4a5d 100644 --- a/sound/pci/ctxfi/cthw20k2.c @@ -118025,6 +151706,71 @@ index 18ee7768b7c4..ae8aa10a4a5d 100644 case 1: set_field(&ctl->txctl[idx], ATXCTL_NUC, 0); break; +diff --git a/sound/pci/ctxfi/ctresource.c b/sound/pci/ctxfi/ctresource.c +index c5124c3c0fd1..f610c32ae5ad 100644 +--- a/sound/pci/ctxfi/ctresource.c ++++ b/sound/pci/ctxfi/ctresource.c +@@ -113,18 +113,17 @@ static int audio_ring_slot(const struct rsc *rsc) + return (rsc->conj << 4) + offset_in_audio_slot_block[rsc->type]; + } + +-static int rsc_next_conj(struct rsc *rsc) ++static void rsc_next_conj(struct rsc *rsc) + { + unsigned int i; + for (i = 0; (i < 8) && (!(rsc->msr & (0x1 << i))); ) + i++; + rsc->conj += (AUDIO_SLOT_BLOCK_NUM >> i); +- return rsc->conj; + } + +-static int rsc_master(struct rsc *rsc) ++static void rsc_master(struct rsc *rsc) + { +- return rsc->conj = rsc->idx; ++ rsc->conj = rsc->idx; + } + + static const struct rsc_ops rsc_generic_ops = { +diff --git a/sound/pci/ctxfi/ctresource.h b/sound/pci/ctxfi/ctresource.h +index 736d9f7e9e16..29b6fe6de659 100644 +--- a/sound/pci/ctxfi/ctresource.h ++++ b/sound/pci/ctxfi/ctresource.h +@@ -43,8 +43,8 @@ struct rsc { + }; + + struct rsc_ops { +- int (*master)(struct rsc *rsc); /* Move to master resource */ +- int (*next_conj)(struct rsc *rsc); /* Move to next conjugate resource */ ++ void (*master)(struct rsc *rsc); /* Move to master resource */ ++ void (*next_conj)(struct rsc *rsc); /* Move to next conjugate resource */ + int (*index)(const struct rsc *rsc); /* Return the index of resource */ + /* Return the output slot number */ + int (*output_slot)(const struct rsc *rsc); +diff --git a/sound/pci/ctxfi/ctsrc.c b/sound/pci/ctxfi/ctsrc.c +index a5a72df29801..234a7e96fd08 100644 +--- a/sound/pci/ctxfi/ctsrc.c ++++ b/sound/pci/ctxfi/ctsrc.c +@@ -594,16 +594,15 @@ int src_mgr_destroy(struct src_mgr *src_mgr) + + /* SRCIMP resource manager operations */ + +-static int srcimp_master(struct rsc *rsc) ++static void srcimp_master(struct rsc *rsc) + { + rsc->conj = 0; +- return rsc->idx = container_of(rsc, struct srcimp, rsc)->idx[0]; ++ rsc->idx = container_of(rsc, struct srcimp, rsc)->idx[0]; + } + +-static int srcimp_next_conj(struct rsc *rsc) ++static void srcimp_next_conj(struct rsc *rsc) + { + rsc->conj++; +- return container_of(rsc, struct srcimp, rsc)->idx[rsc->conj]; + } + + static int srcimp_index(const struct rsc *rsc) diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c index d73ee11a32bd..db14ee43e461 100644 --- a/sound/pci/echoaudio/echoaudio.c @@ -118121,7 +151867,7 @@ index bd0e4710d15d..79043b481d7b 100644 } while (active && ++repeat < 10); diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index 949c90a859fa..8d99ac931ff6 100644 +index 949c90a859fa..c29f7ff5ccd2 100644 --- a/sound/pci/hda/hda_generic.c +++ b/sound/pci/hda/hda_generic.c @@ -820,7 +820,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path, @@ -118181,6 +151927,31 @@ index 949c90a859fa..8d99ac931ff6 100644 } if (!dacs[i]) +@@ -3411,7 +3421,7 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol, + struct hda_gen_spec *spec = codec->spec; + const struct hda_input_mux *imux; + struct nid_path *path; +- int i, adc_idx, err = 0; ++ int i, adc_idx, ret, err = 0; + + imux = &spec->input_mux; + adc_idx = kcontrol->id.index; +@@ -3421,9 +3431,13 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol, + if (!path || !path->ctls[type]) + continue; + kcontrol->private_value = path->ctls[type]; +- err = func(kcontrol, ucontrol); +- if (err < 0) ++ ret = func(kcontrol, ucontrol); ++ if (ret < 0) { ++ err = ret; + break; ++ } ++ if (ret > 0) ++ err = 1; + } + mutex_unlock(&codec->control_mutex); + if (err >= 0 && spec->cap_sync_hook) diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h index 6d1cb2fb447d..33e7eafd93b3 100644 --- a/sound/pci/hda/hda_generic.h @@ -119114,10 +152885,27 @@ index fa64cc2b1729..94bf497092b2 100644 return 0; diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -index e83e314a76a5..d812cbf41b94 100644 +index e83e314a76a5..1b6dedfc33e3 100644 --- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c +++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -@@ -339,7 +339,7 @@ static int sst_media_open(struct snd_pcm_substream *substream, +@@ -135,7 +135,7 @@ static void sst_fill_alloc_params(struct snd_pcm_substream *substream, + snd_pcm_uframes_t period_size; + ssize_t periodbytes; + ssize_t buffer_bytes = snd_pcm_lib_buffer_bytes(substream); +- u32 buffer_addr = virt_to_phys(substream->dma_buffer.area); ++ u32 buffer_addr = virt_to_phys(substream->runtime->dma_area); + + channels = substream->runtime->channels; + period_size = substream->runtime->period_size; +@@ -241,7 +241,6 @@ static int sst_platform_alloc_stream(struct snd_pcm_substream *substream, + /* set codec params and inform SST driver the same */ + sst_fill_pcm_params(substream, ¶m); + sst_fill_alloc_params(substream, &alloc_params); +- substream->runtime->dma_area = substream->dma_buffer.area; + str_params.sparams = param; + str_params.aparams = alloc_params; + str_params.codec = SST_CODEC_TYPE_PCM; +@@ -339,7 +338,7 @@ static int sst_media_open(struct snd_pcm_substream *substream, ret_val = power_up_sst(stream); if (ret_val < 0) @@ -119126,7 +152914,7 @@ index e83e314a76a5..d812cbf41b94 100644 /* Make sure, that the period size is always even */ snd_pcm_hw_constraint_step(substream->runtime, 0, -@@ -348,8 +348,9 @@ static int sst_media_open(struct snd_pcm_substream *substream, +@@ -348,8 +347,9 @@ static int sst_media_open(struct snd_pcm_substream *substream, return snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS); out_ops: @@ -119137,7 +152925,7 @@ index e83e314a76a5..d812cbf41b94 100644 return ret_val; } -@@ -507,14 +508,14 @@ static struct snd_soc_dai_driver sst_platform_dai[] = { +@@ -507,14 +507,14 @@ static struct snd_soc_dai_driver sst_platform_dai[] = { .channels_min = SST_STEREO, .channels_max = SST_STEREO, .rates = SNDRV_PCM_RATE_44100|SNDRV_PCM_RATE_48000, @@ -119154,7 +152942,7 @@ index e83e314a76a5..d812cbf41b94 100644 }, }, { -@@ -525,7 +526,7 @@ static struct snd_soc_dai_driver sst_platform_dai[] = { +@@ -525,7 +525,7 @@ static struct snd_soc_dai_driver sst_platform_dai[] = { .channels_min = SST_STEREO, .channels_max = SST_STEREO, .rates = SNDRV_PCM_RATE_44100|SNDRV_PCM_RATE_48000, @@ -119163,6 +152951,60 @@ index e83e314a76a5..d812cbf41b94 100644 }, }, { +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index c17f262f0834..18e002fef401 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -172,9 +172,6 @@ static const struct snd_soc_dapm_widget byt_rt5640_widgets[] = { + static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = { + {"Headphone", NULL, "Platform Clock"}, + {"Headset Mic", NULL, "Platform Clock"}, +- {"Internal Mic", NULL, "Platform Clock"}, +- {"Speaker", NULL, "Platform Clock"}, +- + {"Headset Mic", NULL, "MICBIAS1"}, + {"IN2P", NULL, "Headset Mic"}, + {"Headphone", NULL, "HPOL"}, +@@ -182,19 +179,23 @@ static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = { + }; + + static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic1_map[] = { ++ {"Internal Mic", NULL, "Platform Clock"}, + {"DMIC1", NULL, "Internal Mic"}, + }; + + static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic2_map[] = { ++ {"Internal Mic", NULL, "Platform Clock"}, + {"DMIC2", NULL, "Internal Mic"}, + }; + + static const struct snd_soc_dapm_route byt_rt5640_intmic_in1_map[] = { ++ {"Internal Mic", NULL, "Platform Clock"}, + {"Internal Mic", NULL, "MICBIAS1"}, + {"IN1P", NULL, "Internal Mic"}, + }; + + static const struct snd_soc_dapm_route byt_rt5640_intmic_in3_map[] = { ++ {"Internal Mic", NULL, "Platform Clock"}, + {"Internal Mic", NULL, "MICBIAS1"}, + {"IN3P", NULL, "Internal Mic"}, + }; +@@ -236,6 +237,7 @@ static const struct snd_soc_dapm_route byt_rt5640_ssp0_aif2_map[] = { + }; + + static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = { ++ {"Speaker", NULL, "Platform Clock"}, + {"Speaker", NULL, "SPOLP"}, + {"Speaker", NULL, "SPOLN"}, + {"Speaker", NULL, "SPORP"}, +@@ -243,6 +245,7 @@ static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = { + }; + + static const struct snd_soc_dapm_route byt_rt5640_mono_spk_map[] = { ++ {"Speaker", NULL, "Platform Clock"}, + {"Speaker", NULL, "SPOLP"}, + {"Speaker", NULL, "SPOLN"}, + }; diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c index 11d0cc2b0e39..060da9577041 100644 --- a/sound/soc/intel/boards/haswell.c @@ -119242,7 +153084,7 @@ index 4f3d94ce0a98..d2cfebf4c01b 100644 for (i = 0; i < num_routes; i++) { diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index 70c02b02030b..c3b2168c8f24 100644 +index 70c02b02030b..cd14549b886f 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -2366,6 +2366,7 @@ void snd_soc_dapm_free_widget(struct snd_soc_dapm_widget *w) @@ -119253,6 +153095,83 @@ index 70c02b02030b..c3b2168c8f24 100644 /* * remove source and sink paths associated to this widget. * While removing the path, remove reference to it from both +@@ -2422,10 +2423,16 @@ static struct snd_soc_dapm_widget *dapm_find_widget( + return NULL; + } + +-static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, +- const char *pin, int status) ++/* ++ * set the DAPM pin status: ++ * returns 1 when the value has been updated, 0 when unchanged, or a negative ++ * error code; called from kcontrol put callback ++ */ ++static int __snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, ++ const char *pin, int status) + { + struct snd_soc_dapm_widget *w = dapm_find_widget(dapm, pin, true); ++ int ret = 0; + + dapm_assert_locked(dapm); + +@@ -2438,13 +2445,26 @@ static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, + dapm_mark_dirty(w, "pin configuration"); + dapm_widget_invalidate_input_paths(w); + dapm_widget_invalidate_output_paths(w); ++ ret = 1; + } + + w->connected = status; + if (status == 0) + w->force = 0; + +- return 0; ++ return ret; ++} ++ ++/* ++ * similar as __snd_soc_dapm_set_pin(), but returns 0 when successful; ++ * called from several API functions below ++ */ ++static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, ++ const char *pin, int status) ++{ ++ int ret = __snd_soc_dapm_set_pin(dapm, pin, status); ++ ++ return ret < 0 ? ret : 0; + } + + /** +@@ -3338,14 +3358,15 @@ int snd_soc_dapm_put_pin_switch(struct snd_kcontrol *kcontrol, + { + struct snd_soc_card *card = snd_kcontrol_chip(kcontrol); + const char *pin = (const char *)kcontrol->private_value; ++ int ret; + +- if (ucontrol->value.integer.value[0]) +- snd_soc_dapm_enable_pin(&card->dapm, pin); +- else +- snd_soc_dapm_disable_pin(&card->dapm, pin); ++ mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME); ++ ret = __snd_soc_dapm_set_pin(&card->dapm, pin, ++ !!ucontrol->value.integer.value[0]); ++ mutex_unlock(&card->dapm_mutex); + + snd_soc_dapm_sync(&card->dapm); +- return 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(snd_soc_dapm_put_pin_switch); + +@@ -3721,7 +3742,7 @@ static int snd_soc_dapm_dai_link_put(struct snd_kcontrol *kcontrol, + + w->params_select = ucontrol->value.enumerated.item[0]; + +- return 0; ++ return 1; + } + + int snd_soc_dapm_new_pcm(struct snd_soc_card *card, diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 50ce608a096f..64e23e702dad 100644 --- a/sound/soc/soc-pcm.c @@ -119273,6 +153192,34 @@ index 50ce608a096f..64e23e702dad 100644 ret = dpcm_dai_trigger_fe_be(substream, cmd, false); break; case SNDRV_PCM_TRIGGER_STOP: +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index e9c57bd3c02b..6274a5002647 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -2050,6 +2050,7 @@ EXPORT_SYMBOL_GPL(snd_soc_tplg_widget_remove_all); + /* remove dynamic controls from the component driver */ + int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index) + { ++ struct snd_card *card = comp->card->snd_card; + struct snd_soc_dobj *dobj, *next_dobj; + int pass = SOC_TPLG_PASS_END; + +@@ -2057,6 +2058,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index) + while (pass >= SOC_TPLG_PASS_START) { + + /* remove mixer controls */ ++ down_write(&card->controls_rwsem); + list_for_each_entry_safe(dobj, next_dobj, &comp->dobj_list, + list) { + +@@ -2090,6 +2092,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index) + break; + } + } ++ up_write(&card->controls_rwsem); + pass--; + } + diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c index fef3b9a21a66..e441e23a37e4 100644 --- a/sound/soc/tegra/tegra30_ahub.c @@ -119413,6 +153360,63 @@ index 2cea203c4f5f..90a770968f34 100644 .owner = THIS_MODULE, .dai_link = &trimslice_tlv320aic23_dai, .num_links = 1, +diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c +index 9312cd8a6fdd..c5c6d360843a 100644 +--- a/sound/synth/emux/emux.c ++++ b/sound/synth/emux/emux.c +@@ -101,7 +101,7 @@ int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, ch + emu->name = kstrdup(name, GFP_KERNEL); + emu->voices = kcalloc(emu->max_voices, sizeof(struct snd_emux_voice), + GFP_KERNEL); +- if (emu->voices == NULL) ++ if (emu->name == NULL || emu->voices == NULL) + return -ENOMEM; + + /* create soundfont list */ +diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c +index 161215d78d95..f29c115b9d56 100644 +--- a/sound/usb/6fire/comm.c ++++ b/sound/usb/6fire/comm.c +@@ -99,7 +99,7 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev) + int actual_len; + + ret = usb_interrupt_msg(dev, usb_sndintpipe(dev, COMM_EP), +- buffer, buffer[1] + 2, &actual_len, HZ); ++ buffer, buffer[1] + 2, &actual_len, 1000); + if (ret < 0) + return ret; + else if (actual_len != buffer[1] + 2) +diff --git a/sound/usb/6fire/firmware.c b/sound/usb/6fire/firmware.c +index 9520b4cd7038..7a89111041ed 100644 +--- a/sound/usb/6fire/firmware.c ++++ b/sound/usb/6fire/firmware.c +@@ -166,7 +166,7 @@ static int usb6fire_fw_ezusb_write(struct usb_device *device, + + ret = usb_control_msg(device, usb_sndctrlpipe(device, 0), type, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- value, 0, data, len, HZ); ++ value, 0, data, len, 1000); + if (ret < 0) + return ret; + else if (ret != len) +@@ -179,7 +179,7 @@ static int usb6fire_fw_ezusb_read(struct usb_device *device, + { + int ret = usb_control_msg(device, usb_rcvctrlpipe(device, 0), type, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, value, +- 0, data, len, HZ); ++ 0, data, len, 1000); + if (ret < 0) + return ret; + else if (ret != len) +@@ -194,7 +194,7 @@ static int usb6fire_fw_fpga_write(struct usb_device *device, + int ret; + + ret = usb_bulk_msg(device, usb_sndbulkpipe(device, FPGA_EP), data, len, +- &actual_len, HZ); ++ &actual_len, 1000); + if (ret < 0) + return ret; + else if (actual_len != len) diff --git a/sound/usb/card.c b/sound/usb/card.c index 8abe8bd41c35..c3fec43b057e 100644 --- a/sound/usb/card.c @@ -119574,9 +153578,69 @@ index 7c812565f90d..a65a82d5791d 100644 return 0; diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c -index ea3a9bd05e68..0107bbfeb17d 100644 +index ea3a9bd05e68..8cca0befcf01 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c +@@ -110,12 +110,12 @@ static int line6_send_raw_message(struct usb_line6 *line6, const char *buffer, + retval = usb_interrupt_msg(line6->usbdev, + usb_sndintpipe(line6->usbdev, properties->ep_ctrl_w), + (char *)frag_buf, frag_size, +- &partial, LINE6_TIMEOUT * HZ); ++ &partial, LINE6_TIMEOUT); + } else { + retval = usb_bulk_msg(line6->usbdev, + usb_sndbulkpipe(line6->usbdev, properties->ep_ctrl_w), + (char *)frag_buf, frag_size, +- &partial, LINE6_TIMEOUT * HZ); ++ &partial, LINE6_TIMEOUT); + } + + if (retval) { +@@ -351,7 +351,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, + ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, + (datalen << 8) | 0x21, address, +- NULL, 0, LINE6_TIMEOUT * HZ); ++ NULL, 0, LINE6_TIMEOUT); + + if (ret < 0) { + dev_err(line6->ifcdev, "read request failed (error %d)\n", ret); +@@ -366,7 +366,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | + USB_DIR_IN, + 0x0012, 0x0000, len, 1, +- LINE6_TIMEOUT * HZ); ++ LINE6_TIMEOUT); + if (ret < 0) { + dev_err(line6->ifcdev, + "receive length failed (error %d)\n", ret); +@@ -394,7 +394,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, + ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, + 0x0013, 0x0000, data, datalen, +- LINE6_TIMEOUT * HZ); ++ LINE6_TIMEOUT); + + if (ret < 0) + dev_err(line6->ifcdev, "read failed (error %d)\n", ret); +@@ -426,7 +426,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, + ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, + 0x0022, address, data, datalen, +- LINE6_TIMEOUT * HZ); ++ LINE6_TIMEOUT); + + if (ret < 0) { + dev_err(line6->ifcdev, +@@ -442,7 +442,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | + USB_DIR_IN, + 0x0012, 0x0000, +- status, 1, LINE6_TIMEOUT * HZ); ++ status, 1, LINE6_TIMEOUT); + + if (ret < 0) { + dev_err(line6->ifcdev, @@ -687,6 +687,10 @@ static int line6_init_cap_control(struct usb_line6 *line6) line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); if (!line6->buffer_message) @@ -119588,6 +153652,19 @@ index ea3a9bd05e68..0107bbfeb17d 100644 } else { ret = line6_hwdep_init(line6); if (ret < 0) +diff --git a/sound/usb/line6/driver.h b/sound/usb/line6/driver.h +index 7e3a3aada222..395f4e2c570a 100644 +--- a/sound/usb/line6/driver.h ++++ b/sound/usb/line6/driver.h +@@ -31,7 +31,7 @@ + #define LINE6_FALLBACK_INTERVAL 10 + #define LINE6_FALLBACK_MAXPACKETSIZE 16 + +-#define LINE6_TIMEOUT 1 ++#define LINE6_TIMEOUT 1000 + #define LINE6_BUFSIZE_LISTEN 64 + #define LINE6_MIDI_MESSAGE_MAXLEN 256 + diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c index 812d18191e01..1736eb3ee98e 100644 --- a/sound/usb/line6/playback.c @@ -119617,6 +153694,50 @@ index 17aa616e61f5..aaa192aee883 100644 /* initialize PCM subsystem: */ err = line6_init_pcm(line6, &pod_pcm_properties); if (err < 0) +diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c +index 8c4375bf34ab..7133c36f99b6 100644 +--- a/sound/usb/line6/podhd.c ++++ b/sound/usb/line6/podhd.c +@@ -232,7 +232,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) + ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), + 0x67, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, + 0x11, 0, +- NULL, 0, LINE6_TIMEOUT * HZ); ++ NULL, 0, LINE6_TIMEOUT); + if (ret < 0) { + dev_err(pod->line6.ifcdev, "read request failed (error %d)\n", ret); + goto exit; +@@ -242,7 +242,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) + ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, + 0x11, 0x0, +- init_bytes, 3, LINE6_TIMEOUT * HZ); ++ init_bytes, 3, LINE6_TIMEOUT); + if (ret < 0) { + dev_err(pod->line6.ifcdev, + "receive length failed (error %d)\n", ret); +@@ -262,7 +262,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) + USB_REQ_SET_FEATURE, + USB_TYPE_STANDARD | USB_RECIP_DEVICE | USB_DIR_OUT, + 1, 0, +- NULL, 0, LINE6_TIMEOUT * HZ); ++ NULL, 0, LINE6_TIMEOUT); + exit: + kfree(init_bytes); + return ret; +diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c +index d3871d99ade4..d7336333a7fb 100644 +--- a/sound/usb/line6/toneport.c ++++ b/sound/usb/line6/toneport.c +@@ -133,7 +133,7 @@ static int toneport_send_cmd(struct usb_device *usbdev, int cmd1, int cmd2) + + ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, +- cmd1, cmd2, NULL, 0, LINE6_TIMEOUT * HZ); ++ cmd1, cmd2, NULL, 0, LINE6_TIMEOUT); + + if (ret < 0) { + dev_err(&usbdev->dev, "send failed (error %d)\n", ret); diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c index 0c4512d0382e..a911cff0cec8 100644 --- a/sound/usb/line6/variax.c @@ -119755,6 +153876,28 @@ index 7ba92921bf28..f0b41fee7130 100644 umidi->input_running = 1; } EXPORT_SYMBOL(snd_usbmidi_input_start); +diff --git a/sound/usb/misc/ua101.c b/sound/usb/misc/ua101.c +index c19a5dd05631..8c00157c0fcb 100644 +--- a/sound/usb/misc/ua101.c ++++ b/sound/usb/misc/ua101.c +@@ -1032,7 +1032,7 @@ static int detect_usb_format(struct ua101 *ua) + fmt_playback->bSubframeSize * ua->playback.channels; + + epd = &ua->intf[INTF_CAPTURE]->altsetting[1].endpoint[0].desc; +- if (!usb_endpoint_is_isoc_in(epd)) { ++ if (!usb_endpoint_is_isoc_in(epd) || usb_endpoint_maxp(epd) == 0) { + dev_err(&ua->dev->dev, "invalid capture endpoint\n"); + return -ENXIO; + } +@@ -1040,7 +1040,7 @@ static int detect_usb_format(struct ua101 *ua) + ua->capture.max_packet_bytes = usb_endpoint_maxp(epd); + + epd = &ua->intf[INTF_PLAYBACK]->altsetting[1].endpoint[0].desc; +- if (!usb_endpoint_is_isoc_out(epd)) { ++ if (!usb_endpoint_is_isoc_out(epd) || usb_endpoint_maxp(epd) == 0) { + dev_err(&ua->dev->dev, "invalid playback endpoint\n"); + return -ENXIO; + } diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index 816d6036eb59..ab7422672316 100755 --- a/sound/usb/mixer.c @@ -120050,7 +154193,7 @@ index adee1c0e2bdf..d7d69956855c 100644 if (!subs->txfr_quirk) bytes = frames * stride; diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index c892b4d1e733..d3d3e05fe5b8 100644 +index c892b4d1e733..1904fc542025 100644 --- a/sound/usb/quirks-table.h +++ b/sound/usb/quirks-table.h @@ -2479,6 +2479,16 @@ YAMAHA_DEVICE(0x7010, "UB99"), @@ -120070,7 +154213,7 @@ index c892b4d1e733..d3d3e05fe5b8 100644 /* AKAI devices */ { USB_DEVICE(0x09e8, 0x0062), -@@ -3323,4 +3333,118 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), +@@ -3323,4 +3333,150 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), } }, @@ -120187,6 +154330,38 @@ index c892b4d1e733..d3d3e05fe5b8 100644 + } + } +}, ++{ ++ /* ++ * Sennheiser GSP670 ++ * Change order of interfaces loaded ++ */ ++ USB_DEVICE(0x1395, 0x0300), ++ .bInterfaceClass = USB_CLASS_PER_INTERFACE, ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = &(const struct snd_usb_audio_quirk[]) { ++ // Communication ++ { ++ .ifnum = 3, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ // Recording ++ { ++ .ifnum = 4, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ // Main ++ { ++ .ifnum = 1, ++ .type = QUIRK_AUDIO_STANDARD_INTERFACE ++ }, ++ { ++ .ifnum = -1 ++ } ++ } ++ } ++}, + #undef USB_DEVICE_VENDOR_SPEC diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c @@ -121762,6 +155937,38 @@ index 43fcab367fb0..74e6b3fc2d09 100644 if ((flags & extraflags) == extraflags) { printf("[OK]\tThe syscall worked and flags are still set\n"); } else { +diff --git a/tools/usb/testusb.c b/tools/usb/testusb.c +index 0692d99b6d8f..18c895654e76 100644 +--- a/tools/usb/testusb.c ++++ b/tools/usb/testusb.c +@@ -278,12 +278,6 @@ static int find_testdev(const char *name, const struct stat *sb, int flag) + } + + entry->ifnum = ifnum; +- +- /* FIXME update USBDEVFS_CONNECTINFO so it tells about high speed etc */ +- +- fprintf(stderr, "%s speed\t%s\t%u\n", +- speed(entry->speed), entry->name, entry->ifnum); +- + entry->next = testdevs; + testdevs = entry; + return 0; +@@ -312,6 +306,14 @@ static void *handle_testdev (void *arg) + return 0; + } + ++ status = ioctl(fd, USBDEVFS_GET_SPEED, NULL); ++ if (status < 0) ++ fprintf(stderr, "USBDEVFS_GET_SPEED failed %d\n", status); ++ else ++ dev->speed = status; ++ fprintf(stderr, "%s speed\t%s\t%u\n", ++ speed(dev->speed), dev->name, dev->ifnum); ++ + restart: + for (i = 0; i < TEST_CASES; i++) { + if (dev->test != -1 && dev->test != i) diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c index 4bb905925b0e..99c26a175beb 100644 --- a/tools/usb/usbip/libsrc/usbip_host_common.c diff --git a/Scripts/LineageOS-14.1/Functions.sh b/Scripts/LineageOS-14.1/Functions.sh index d1a229a0..fe21661a 100644 --- a/Scripts/LineageOS-14.1/Functions.sh +++ b/Scripts/LineageOS-14.1/Functions.sh @@ -108,6 +108,7 @@ patchWorkspace() { repopick -it tzdb2021c_N; repopick -it n-asb-2021-11; repopick -it n-asb-2021-12; + repopick -it n-asb-2022-01; sh "$DOS_SCRIPTS/Patch.sh"; sh "$DOS_SCRIPTS_COMMON/Enable_Verity.sh"; diff --git a/Scripts/LineageOS-14.1/Patch.sh b/Scripts/LineageOS-14.1/Patch.sh index 893c3083..64d41e0f 100644 --- a/Scripts/LineageOS-14.1/Patch.sh +++ b/Scripts/LineageOS-14.1/Patch.sh @@ -75,7 +75,7 @@ applyPatch "$DOS_PATCHES/android_build/0001-OTA_Keys.patch"; #Add correct keys t sed -i '50i$(my_res_package): PRIVATE_AAPT_FLAGS += --auto-add-overlay' core/aapt2.mk; #Enable auto-add-overlay for packages, this allows the vendor overlay to easily work across all branches. sed -i '296iLOCAL_AAPT_FLAGS += --auto-add-overlay' core/package_internal.mk; sed -i 's/messaging/Silence/' target/product/aosp_base_telephony.mk; #Replace the Messaging app with Silence -sed -i 's/2021-06-05/2021-12-05/' core/version_defaults.mk; #Bump Security String #n-asb-2021-12 #XXX +sed -i 's/2021-06-05/2022-01-05/' core/version_defaults.mk; #Bump Security String #n-asb-2022-01 #XXX fi; if enterAndClear "device/qcom/sepolicy"; then