Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.13/0100-4.13.1-all-fixes.patch

    Annotation of /trunk/kernel-magellan/patches-4.13/0100-4.13.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2993 - (hide annotations) (download)
    Tue Sep 12 09:41:16 2017 UTC (6 years, 8 months ago) by niro
    File size: 59547 byte(s) 
    -linux-4.13.1
    1 niro 2993 diff --git a/Makefile b/Makefile
    2     index ed65d7278bb3..41a976854cad 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 13
    8     -SUBLEVEL = 0
    9     +SUBLEVEL = 1
    10     EXTRAVERSION =
    11     NAME = Fearless Coyote
    12    
    13     diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
    14     index 57057fb1cc07..65ab11d654e1 100644
    15     --- a/arch/s390/include/asm/pgtable.h
    16     +++ b/arch/s390/include/asm/pgtable.h
    17     @@ -505,7 +505,7 @@ static inline int mm_alloc_pgste(struct mm_struct *mm)
    18     * In the case that a guest uses storage keys
    19     * faults should no longer be backed by zero pages
    20     */
    21     -#define mm_forbids_zeropage mm_use_skey
    22     +#define mm_forbids_zeropage mm_has_pgste
    23     static inline int mm_use_skey(struct mm_struct *mm)
    24     {
    25     #ifdef CONFIG_PGSTE
    26     diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
    27     index 4fb3d3cdb370..ff84fb214bf9 100644
    28     --- a/arch/s390/mm/gmap.c
    29     +++ b/arch/s390/mm/gmap.c
    30     @@ -2120,6 +2120,37 @@ static inline void thp_split_mm(struct mm_struct *mm)
    31     #endif
    32     }
    33    
    34     +/*
    35     + * Remove all empty zero pages from the mapping for lazy refaulting
    36     + * - This must be called after mm->context.has_pgste is set, to avoid
    37     + * future creation of zero pages
    38     + * - This must be called after THP was enabled
    39     + */
    40     +static int __zap_zero_pages(pmd_t *pmd, unsigned long start,
    41     + unsigned long end, struct mm_walk *walk)
    42     +{
    43     + unsigned long addr;
    44     +
    45     + for (addr = start; addr != end; addr += PAGE_SIZE) {
    46     + pte_t *ptep;
    47     + spinlock_t *ptl;
    48     +
    49     + ptep = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
    50     + if (is_zero_pfn(pte_pfn(*ptep)))
    51     + ptep_xchg_direct(walk->mm, addr, ptep, __pte(_PAGE_INVALID));
    52     + pte_unmap_unlock(ptep, ptl);
    53     + }
    54     + return 0;
    55     +}
    56     +
    57     +static inline void zap_zero_pages(struct mm_struct *mm)
    58     +{
    59     + struct mm_walk walk = { .pmd_entry = __zap_zero_pages };
    60     +
    61     + walk.mm = mm;
    62     + walk_page_range(0, TASK_SIZE, &walk);
    63     +}
    64     +
    65     /*
    66     * switch on pgstes for its userspace process (for kvm)
    67     */
    68     @@ -2137,6 +2168,7 @@ int s390_enable_sie(void)
    69     mm->context.has_pgste = 1;
    70     /* split thp mappings and disable thp for future mappings */
    71     thp_split_mm(mm);
    72     + zap_zero_pages(mm);
    73     up_write(&mm->mmap_sem);
    74     return 0;
    75     }
    76     @@ -2149,13 +2181,6 @@ EXPORT_SYMBOL_GPL(s390_enable_sie);
    77     static int __s390_enable_skey(pte_t *pte, unsigned long addr,
    78     unsigned long next, struct mm_walk *walk)
    79     {
    80     - /*
    81     - * Remove all zero page mappings,
    82     - * after establishing a policy to forbid zero page mappings
    83     - * following faults for that page will get fresh anonymous pages
    84     - */
    85     - if (is_zero_pfn(pte_pfn(*pte)))
    86     - ptep_xchg_direct(walk->mm, addr, pte, __pte(_PAGE_INVALID));
    87     /* Clear storage key */
    88     ptep_zap_key(walk->mm, addr, pte);
    89     return 0;
    90     diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig
    91     index 832e885349b1..4d4cdc1a6e25 100644
    92     --- a/drivers/android/Kconfig
    93     +++ b/drivers/android/Kconfig
    94     @@ -22,7 +22,7 @@ config ANDROID_BINDER_IPC
    95     config ANDROID_BINDER_DEVICES
    96     string "Android Binder devices"
    97     depends on ANDROID_BINDER_IPC
    98     - default "binder,hwbinder"
    99     + default "binder,hwbinder,vndbinder"
    100     ---help---
    101     Default value for the binder.devices parameter.
    102    
    103     diff --git a/drivers/android/binder.c b/drivers/android/binder.c
    104     index 831cdd7d197d..3db96b79d122 100644
    105     --- a/drivers/android/binder.c
    106     +++ b/drivers/android/binder.c
    107     @@ -4215,7 +4215,7 @@ static int __init init_binder_device(const char *name)
    108     static int __init binder_init(void)
    109     {
    110     int ret;
    111     - char *device_name, *device_names;
    112     + char *device_name, *device_names, *device_tmp;
    113     struct binder_device *device;
    114     struct hlist_node *tmp;
    115    
    116     @@ -4263,7 +4263,8 @@ static int __init binder_init(void)
    117     }
    118     strcpy(device_names, binder_devices_param);
    119    
    120     - while ((device_name = strsep(&device_names, ","))) {
    121     + device_tmp = device_names;
    122     + while ((device_name = strsep(&device_tmp, ","))) {
    123     ret = init_binder_device(device_name);
    124     if (ret)
    125     goto err_init_binder_device_failed;
    126     @@ -4277,6 +4278,9 @@ static int __init binder_init(void)
    127     hlist_del(&device->hlist);
    128     kfree(device);
    129     }
    130     +
    131     + kfree(device_names);
    132     +
    133     err_alloc_device_names_failed:
    134     debugfs_remove_recursive(binder_debugfs_dir_entry_root);
    135    
    136     diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
    137     index 5a5fd0b404eb..cb9b0e9090e3 100644
    138     --- a/drivers/ata/ahci.c
    139     +++ b/drivers/ata/ahci.c
    140     @@ -1469,7 +1469,14 @@ static void ahci_remap_check(struct pci_dev *pdev, int bar,
    141     return;
    142    
    143     dev_warn(&pdev->dev, "Found %d remapped NVMe devices.\n", count);
    144     - dev_warn(&pdev->dev, "Switch your BIOS from RAID to AHCI mode to use them.\n");
    145     + dev_warn(&pdev->dev,
    146     + "Switch your BIOS from RAID to AHCI mode to use them.\n");
    147     +
    148     + /*
    149     + * Don't rely on the msi-x capability in the remap case,
    150     + * share the legacy interrupt across ahci and remapped devices.
    151     + */
    152     + hpriv->flags |= AHCI_HFLAG_NO_MSI;
    153     }
    154    
    155     static int ahci_get_irq_vector(struct ata_host *host, int port)
    156     diff --git a/drivers/ata/pata_amd.c b/drivers/ata/pata_amd.c
    157     index 8d4d959a821c..8706533db57b 100644
    158     --- a/drivers/ata/pata_amd.c
    159     +++ b/drivers/ata/pata_amd.c
    160     @@ -616,6 +616,7 @@ static const struct pci_device_id amd[] = {
    161     { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_IDE), 8 },
    162     { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE), 8 },
    163     { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_IDE), 9 },
    164     + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_DEV_IDE), 9 },
    165    
    166     { },
    167     };
    168     diff --git a/drivers/ata/pata_cs5536.c b/drivers/ata/pata_cs5536.c
    169     index 6c15a554efbe..dc1255294628 100644
    170     --- a/drivers/ata/pata_cs5536.c
    171     +++ b/drivers/ata/pata_cs5536.c
    172     @@ -289,6 +289,7 @@ static int cs5536_init_one(struct pci_dev *dev, const struct pci_device_id *id)
    173    
    174     static const struct pci_device_id cs5536[] = {
    175     { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_IDE), },
    176     + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_DEV_IDE), },
    177     { },
    178     };
    179    
    180     diff --git a/drivers/base/bus.c b/drivers/base/bus.c
    181     index e162c9a789ba..22a64fd3309b 100644
    182     --- a/drivers/base/bus.c
    183     +++ b/drivers/base/bus.c
    184     @@ -698,7 +698,7 @@ int bus_add_driver(struct device_driver *drv)
    185    
    186     out_unregister:
    187     kobject_put(&priv->kobj);
    188     - kfree(drv->p);
    189     + /* drv->p is freed in driver_release() */
    190     drv->p = NULL;
    191     out_put_bus:
    192     bus_put(bus);
    193     diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
    194     index fa24d693af24..e331e212f5fc 100644
    195     --- a/drivers/bluetooth/btusb.c
    196     +++ b/drivers/bluetooth/btusb.c
    197     @@ -357,6 +357,7 @@ static const struct usb_device_id blacklist_table[] = {
    198     { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
    199     { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
    200     { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
    201     + { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
    202    
    203     /* Additional Realtek 8821AE Bluetooth devices */
    204     { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
    205     diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
    206     index 0488b7f81dcf..54f3b375a453 100644
    207     --- a/drivers/crypto/caam/caamalg.c
    208     +++ b/drivers/crypto/caam/caamalg.c
    209     @@ -81,40 +81,6 @@
    210     #define debug(format, arg...)
    211     #endif
    212    
    213     -#ifdef DEBUG
    214     -#include <linux/highmem.h>
    215     -
    216     -static void dbg_dump_sg(const char *level, const char *prefix_str,
    217     - int prefix_type, int rowsize, int groupsize,
    218     - struct scatterlist *sg, size_t tlen, bool ascii)
    219     -{
    220     - struct scatterlist *it;
    221     - void *it_page;
    222     - size_t len;
    223     - void *buf;
    224     -
    225     - for (it = sg; it != NULL && tlen > 0 ; it = sg_next(sg)) {
    226     - /*
    227     - * make sure the scatterlist's page
    228     - * has a valid virtual memory mapping
    229     - */
    230     - it_page = kmap_atomic(sg_page(it));
    231     - if (unlikely(!it_page)) {
    232     - printk(KERN_ERR "dbg_dump_sg: kmap failed\n");
    233     - return;
    234     - }
    235     -
    236     - buf = it_page + it->offset;
    237     - len = min_t(size_t, tlen, it->length);
    238     - print_hex_dump(level, prefix_str, prefix_type, rowsize,
    239     - groupsize, buf, len, ascii);
    240     - tlen -= len;
    241     -
    242     - kunmap_atomic(it_page);
    243     - }
    244     -}
    245     -#endif
    246     -
    247     static struct list_head alg_list;
    248    
    249     struct caam_alg_entry {
    250     @@ -898,10 +864,10 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
    251     print_hex_dump(KERN_ERR, "dstiv @"__stringify(__LINE__)": ",
    252     DUMP_PREFIX_ADDRESS, 16, 4, req->info,
    253     edesc->src_nents > 1 ? 100 : ivsize, 1);
    254     - dbg_dump_sg(KERN_ERR, "dst @"__stringify(__LINE__)": ",
    255     - DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    256     - edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    257     #endif
    258     + caam_dump_sg(KERN_ERR, "dst @" __stringify(__LINE__)": ",
    259     + DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    260     + edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    261    
    262     ablkcipher_unmap(jrdev, edesc, req);
    263    
    264     @@ -937,10 +903,10 @@ static void ablkcipher_decrypt_done(struct device *jrdev, u32 *desc, u32 err,
    265     print_hex_dump(KERN_ERR, "dstiv @"__stringify(__LINE__)": ",
    266     DUMP_PREFIX_ADDRESS, 16, 4, req->info,
    267     ivsize, 1);
    268     - dbg_dump_sg(KERN_ERR, "dst @"__stringify(__LINE__)": ",
    269     - DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    270     - edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    271     #endif
    272     + caam_dump_sg(KERN_ERR, "dst @" __stringify(__LINE__)": ",
    273     + DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    274     + edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    275    
    276     ablkcipher_unmap(jrdev, edesc, req);
    277    
    278     @@ -1107,10 +1073,10 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
    279     ivsize, 1);
    280     pr_err("asked=%d, nbytes%d\n",
    281     (int)edesc->src_nents > 1 ? 100 : req->nbytes, req->nbytes);
    282     - dbg_dump_sg(KERN_ERR, "src @"__stringify(__LINE__)": ",
    283     - DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    284     - edesc->src_nents > 1 ? 100 : req->nbytes, 1);
    285     #endif
    286     + caam_dump_sg(KERN_ERR, "src @" __stringify(__LINE__)": ",
    287     + DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    288     + edesc->src_nents > 1 ? 100 : req->nbytes, 1);
    289    
    290     len = desc_len(sh_desc);
    291     init_job_desc_shared(desc, ptr, len, HDR_SHARE_DEFER | HDR_REVERSE);
    292     @@ -1164,10 +1130,10 @@ static void init_ablkcipher_giv_job(u32 *sh_desc, dma_addr_t ptr,
    293     print_hex_dump(KERN_ERR, "presciv@" __stringify(__LINE__) ": ",
    294     DUMP_PREFIX_ADDRESS, 16, 4, req->info,
    295     ivsize, 1);
    296     - dbg_dump_sg(KERN_ERR, "src @" __stringify(__LINE__) ": ",
    297     - DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    298     - edesc->src_nents > 1 ? 100 : req->nbytes, 1);
    299     #endif
    300     + caam_dump_sg(KERN_ERR, "src @" __stringify(__LINE__) ": ",
    301     + DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    302     + edesc->src_nents > 1 ? 100 : req->nbytes, 1);
    303    
    304     len = desc_len(sh_desc);
    305     init_job_desc_shared(desc, ptr, len, HDR_SHARE_DEFER | HDR_REVERSE);
    306     @@ -1449,11 +1415,9 @@ static int aead_decrypt(struct aead_request *req)
    307     u32 *desc;
    308     int ret = 0;
    309    
    310     -#ifdef DEBUG
    311     - dbg_dump_sg(KERN_ERR, "dec src@"__stringify(__LINE__)": ",
    312     - DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    313     - req->assoclen + req->cryptlen, 1);
    314     -#endif
    315     + caam_dump_sg(KERN_ERR, "dec src@" __stringify(__LINE__)": ",
    316     + DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    317     + req->assoclen + req->cryptlen, 1);
    318    
    319     /* allocate extended descriptor */
    320     edesc = aead_edesc_alloc(req, AUTHENC_DESC_JOB_IO_LEN,
    321     diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
    322     index 78c4c0485c58..3425f2d9a2a1 100644
    323     --- a/drivers/crypto/caam/caamalg_qi.c
    324     +++ b/drivers/crypto/caam/caamalg_qi.c
    325     @@ -791,9 +791,9 @@ static void ablkcipher_done(struct caam_drv_req *drv_req, u32 status)
    326     print_hex_dump(KERN_ERR, "dstiv @" __stringify(__LINE__)": ",
    327     DUMP_PREFIX_ADDRESS, 16, 4, req->info,
    328     edesc->src_nents > 1 ? 100 : ivsize, 1);
    329     - dbg_dump_sg(KERN_ERR, "dst @" __stringify(__LINE__)": ",
    330     - DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    331     - edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    332     + caam_dump_sg(KERN_ERR, "dst @" __stringify(__LINE__)": ",
    333     + DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    334     + edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    335     #endif
    336    
    337     ablkcipher_unmap(qidev, edesc, req);
    338     diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
    339     index 6f44ccb55c63..3d639f3b45aa 100644
    340     --- a/drivers/crypto/caam/error.c
    341     +++ b/drivers/crypto/caam/error.c
    342     @@ -9,6 +9,46 @@
    343     #include "desc.h"
    344     #include "error.h"
    345    
    346     +#ifdef DEBUG
    347     +#include <linux/highmem.h>
    348     +
    349     +void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
    350     + int rowsize, int groupsize, struct scatterlist *sg,
    351     + size_t tlen, bool ascii)
    352     +{
    353     + struct scatterlist *it;
    354     + void *it_page;
    355     + size_t len;
    356     + void *buf;
    357     +
    358     + for (it = sg; it && tlen > 0 ; it = sg_next(sg)) {
    359     + /*
    360     + * make sure the scatterlist's page
    361     + * has a valid virtual memory mapping
    362     + */
    363     + it_page = kmap_atomic(sg_page(it));
    364     + if (unlikely(!it_page)) {
    365     + pr_err("caam_dump_sg: kmap failed\n");
    366     + return;
    367     + }
    368     +
    369     + buf = it_page + it->offset;
    370     + len = min_t(size_t, tlen, it->length);
    371     + print_hex_dump(level, prefix_str, prefix_type, rowsize,
    372     + groupsize, buf, len, ascii);
    373     + tlen -= len;
    374     +
    375     + kunmap_atomic(it_page);
    376     + }
    377     +}
    378     +#else
    379     +void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
    380     + int rowsize, int groupsize, struct scatterlist *sg,
    381     + size_t tlen, bool ascii)
    382     +{}
    383     +#endif /* DEBUG */
    384     +EXPORT_SYMBOL(caam_dump_sg);
    385     +
    386     static const struct {
    387     u8 value;
    388     const char *error_text;
    389     diff --git a/drivers/crypto/caam/error.h b/drivers/crypto/caam/error.h
    390     index b6350b0d9153..250e1a21c473 100644
    391     --- a/drivers/crypto/caam/error.h
    392     +++ b/drivers/crypto/caam/error.h
    393     @@ -8,4 +8,8 @@
    394     #define CAAM_ERROR_H
    395     #define CAAM_ERROR_STR_MAX 302
    396     void caam_jr_strstatus(struct device *jrdev, u32 status);
    397     +
    398     +void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
    399     + int rowsize, int groupsize, struct scatterlist *sg,
    400     + size_t tlen, bool ascii);
    401     #endif /* CAAM_ERROR_H */
    402     diff --git a/drivers/crypto/caam/qi.c b/drivers/crypto/caam/qi.c
    403     index 1990ed460c46..53aed5816416 100644
    404     --- a/drivers/crypto/caam/qi.c
    405     +++ b/drivers/crypto/caam/qi.c
    406     @@ -55,6 +55,7 @@ struct caam_qi_pcpu_priv {
    407     } ____cacheline_aligned;
    408    
    409     static DEFINE_PER_CPU(struct caam_qi_pcpu_priv, pcpu_qipriv);
    410     +static DEFINE_PER_CPU(int, last_cpu);
    411    
    412     /*
    413     * caam_qi_priv - CAAM QI backend private params
    414     @@ -392,7 +393,6 @@ struct caam_drv_ctx *caam_drv_ctx_init(struct device *qidev,
    415     dma_addr_t hwdesc;
    416     struct caam_drv_ctx *drv_ctx;
    417     const cpumask_t *cpus = qman_affine_cpus();
    418     - static DEFINE_PER_CPU(int, last_cpu);
    419    
    420     num_words = desc_len(sh_desc);
    421     if (num_words > MAX_SDLEN) {
    422     diff --git a/drivers/fpga/altera-hps2fpga.c b/drivers/fpga/altera-hps2fpga.c
    423     index 3066b805f2d0..08c0ecb7d109 100644
    424     --- a/drivers/fpga/altera-hps2fpga.c
    425     +++ b/drivers/fpga/altera-hps2fpga.c
    426     @@ -66,7 +66,7 @@ static int alt_hps2fpga_enable_show(struct fpga_bridge *bridge)
    427    
    428     /* The L3 REMAP register is write only, so keep a cached value. */
    429     static unsigned int l3_remap_shadow;
    430     -static spinlock_t l3_remap_lock;
    431     +static DEFINE_SPINLOCK(l3_remap_lock);
    432    
    433     static int _alt_hps2fpga_enable_set(struct altera_hps2fpga_data *priv,
    434     bool enable)
    435     @@ -171,8 +171,6 @@ static int alt_fpga_bridge_probe(struct platform_device *pdev)
    436     return -EBUSY;
    437     }
    438    
    439     - spin_lock_init(&l3_remap_lock);
    440     -
    441     if (!of_property_read_u32(dev->of_node, "bridge-enable", &enable)) {
    442     if (enable > 1) {
    443     dev_warn(dev, "invalid bridge-enable %u > 1\n", enable);
    444     diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
    445     index ae5f06895562..da2745b3d0a7 100644
    446     --- a/drivers/gpu/drm/drm_dp_mst_topology.c
    447     +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
    448     @@ -2540,8 +2540,8 @@ int drm_dp_atomic_find_vcpi_slots(struct drm_atomic_state *state,
    449     int req_slots;
    450    
    451     topology_state = drm_atomic_get_mst_topology_state(state, mgr);
    452     - if (topology_state == NULL)
    453     - return -ENOMEM;
    454     + if (IS_ERR(topology_state))
    455     + return PTR_ERR(topology_state);
    456    
    457     port = drm_dp_get_validated_port_ref(mgr, port);
    458     if (port == NULL)
    459     @@ -2580,8 +2580,8 @@ int drm_dp_atomic_release_vcpi_slots(struct drm_atomic_state *state,
    460     struct drm_dp_mst_topology_state *topology_state;
    461    
    462     topology_state = drm_atomic_get_mst_topology_state(state, mgr);
    463     - if (topology_state == NULL)
    464     - return -ENOMEM;
    465     + if (IS_ERR(topology_state))
    466     + return PTR_ERR(topology_state);
    467    
    468     /* We cannot rely on port->vcpi.num_slots to update
    469     * topology_state->avail_slots as the port may not exist if the parent
    470     diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
    471     index 2bc0dc985214..3d35ea3e95db 100644
    472     --- a/drivers/gpu/drm/nouveau/nv50_display.c
    473     +++ b/drivers/gpu/drm/nouveau/nv50_display.c
    474     @@ -4134,7 +4134,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
    475     if (!nonblock) {
    476     ret = drm_atomic_helper_wait_for_fences(dev, state, true);
    477     if (ret)
    478     - goto done;
    479     + goto err_cleanup;
    480     }
    481    
    482     for_each_plane_in_state(state, plane, plane_state, i) {
    483     @@ -4162,7 +4162,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
    484     if (crtc->state->enable) {
    485     if (!drm->have_disp_power_ref) {
    486     drm->have_disp_power_ref = true;
    487     - return ret;
    488     + return 0;
    489     }
    490     active = true;
    491     break;
    492     @@ -4174,6 +4174,9 @@ nv50_disp_atomic_commit(struct drm_device *dev,
    493     drm->have_disp_power_ref = false;
    494     }
    495    
    496     +err_cleanup:
    497     + if (ret)
    498     + drm_atomic_helper_cleanup_planes(dev, state);
    499     done:
    500     pm_runtime_put_autosuspend(dev->dev);
    501     return ret;
    502     diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
    503     index eb9b278198b2..a4cb82495cee 100644
    504     --- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
    505     +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
    506     @@ -192,6 +192,10 @@ nvkm_pci_new_(const struct nvkm_pci_func *func, struct nvkm_device *device,
    507     }
    508     }
    509    
    510     +#ifdef __BIG_ENDIAN
    511     + pci->msi = false;
    512     +#endif
    513     +
    514     pci->msi = nvkm_boolopt(device->cfgopt, "NvMSI", pci->msi);
    515     if (pci->msi && func->msi_rearm) {
    516     pci->msi = pci_enable_msi(pci->pdev) == 0;
    517     diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
    518     index eeddc1e48409..871599826773 100644
    519     --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
    520     +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
    521     @@ -615,7 +615,7 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool,
    522     } else {
    523     pr_err("Failed to fill pool (%p)\n", pool);
    524     /* If we have any pages left put them to the pool. */
    525     - list_for_each_entry(p, &pool->list, lru) {
    526     + list_for_each_entry(p, &new_pages, lru) {
    527     ++cpages;
    528     }
    529     list_splice(&new_pages, &pool->list);
    530     diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
    531     index 18f401b442c2..c938af8c40cf 100644
    532     --- a/drivers/gpu/drm/vgem/vgem_drv.c
    533     +++ b/drivers/gpu/drm/vgem/vgem_drv.c
    534     @@ -52,6 +52,7 @@ static void vgem_gem_free_object(struct drm_gem_object *obj)
    535     struct drm_vgem_gem_object *vgem_obj = to_vgem_bo(obj);
    536    
    537     kvfree(vgem_obj->pages);
    538     + mutex_destroy(&vgem_obj->pages_lock);
    539    
    540     if (obj->import_attach)
    541     drm_prime_gem_destroy(obj, vgem_obj->table);
    542     @@ -76,11 +77,15 @@ static int vgem_gem_fault(struct vm_fault *vmf)
    543     if (page_offset > num_pages)
    544     return VM_FAULT_SIGBUS;
    545    
    546     + ret = -ENOENT;
    547     + mutex_lock(&obj->pages_lock);
    548     if (obj->pages) {
    549     get_page(obj->pages[page_offset]);
    550     vmf->page = obj->pages[page_offset];
    551     ret = 0;
    552     - } else {
    553     + }
    554     + mutex_unlock(&obj->pages_lock);
    555     + if (ret) {
    556     struct page *page;
    557    
    558     page = shmem_read_mapping_page(
    559     @@ -161,6 +166,8 @@ static struct drm_vgem_gem_object *__vgem_gem_create(struct drm_device *dev,
    560     return ERR_PTR(ret);
    561     }
    562    
    563     + mutex_init(&obj->pages_lock);
    564     +
    565     return obj;
    566     }
    567    
    568     @@ -274,37 +281,66 @@ static const struct file_operations vgem_driver_fops = {
    569     .release = drm_release,
    570     };
    571    
    572     +static struct page **vgem_pin_pages(struct drm_vgem_gem_object *bo)
    573     +{
    574     + mutex_lock(&bo->pages_lock);
    575     + if (bo->pages_pin_count++ == 0) {
    576     + struct page **pages;
    577     +
    578     + pages = drm_gem_get_pages(&bo->base);
    579     + if (IS_ERR(pages)) {
    580     + bo->pages_pin_count--;
    581     + mutex_unlock(&bo->pages_lock);
    582     + return pages;
    583     + }
    584     +
    585     + bo->pages = pages;
    586     + }
    587     + mutex_unlock(&bo->pages_lock);
    588     +
    589     + return bo->pages;
    590     +}
    591     +
    592     +static void vgem_unpin_pages(struct drm_vgem_gem_object *bo)
    593     +{
    594     + mutex_lock(&bo->pages_lock);
    595     + if (--bo->pages_pin_count == 0) {
    596     + drm_gem_put_pages(&bo->base, bo->pages, true, true);
    597     + bo->pages = NULL;
    598     + }
    599     + mutex_unlock(&bo->pages_lock);
    600     +}
    601     +
    602     static int vgem_prime_pin(struct drm_gem_object *obj)
    603     {
    604     + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    605     long n_pages = obj->size >> PAGE_SHIFT;
    606     struct page **pages;
    607    
    608     - /* Flush the object from the CPU cache so that importers can rely
    609     - * on coherent indirect access via the exported dma-address.
    610     - */
    611     - pages = drm_gem_get_pages(obj);
    612     + pages = vgem_pin_pages(bo);
    613     if (IS_ERR(pages))
    614     return PTR_ERR(pages);
    615    
    616     + /* Flush the object from the CPU cache so that importers can rely
    617     + * on coherent indirect access via the exported dma-address.
    618     + */
    619     drm_clflush_pages(pages, n_pages);
    620     - drm_gem_put_pages(obj, pages, true, false);
    621    
    622     return 0;
    623     }
    624    
    625     -static struct sg_table *vgem_prime_get_sg_table(struct drm_gem_object *obj)
    626     +static void vgem_prime_unpin(struct drm_gem_object *obj)
    627     {
    628     - struct sg_table *st;
    629     - struct page **pages;
    630     + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    631    
    632     - pages = drm_gem_get_pages(obj);
    633     - if (IS_ERR(pages))
    634     - return ERR_CAST(pages);
    635     + vgem_unpin_pages(bo);
    636     +}
    637    
    638     - st = drm_prime_pages_to_sg(pages, obj->size >> PAGE_SHIFT);
    639     - drm_gem_put_pages(obj, pages, false, false);
    640     +static struct sg_table *vgem_prime_get_sg_table(struct drm_gem_object *obj)
    641     +{
    642     + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    643    
    644     - return st;
    645     + return drm_prime_pages_to_sg(bo->pages, bo->base.size >> PAGE_SHIFT);
    646     }
    647    
    648     static struct drm_gem_object* vgem_prime_import(struct drm_device *dev,
    649     @@ -333,6 +369,8 @@ static struct drm_gem_object *vgem_prime_import_sg_table(struct drm_device *dev,
    650     __vgem_gem_destroy(obj);
    651     return ERR_PTR(-ENOMEM);
    652     }
    653     +
    654     + obj->pages_pin_count++; /* perma-pinned */
    655     drm_prime_sg_to_page_addr_arrays(obj->table, obj->pages, NULL,
    656     npages);
    657     return &obj->base;
    658     @@ -340,23 +378,23 @@ static struct drm_gem_object *vgem_prime_import_sg_table(struct drm_device *dev,
    659    
    660     static void *vgem_prime_vmap(struct drm_gem_object *obj)
    661     {
    662     + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    663     long n_pages = obj->size >> PAGE_SHIFT;
    664     struct page **pages;
    665     - void *addr;
    666    
    667     - pages = drm_gem_get_pages(obj);
    668     + pages = vgem_pin_pages(bo);
    669     if (IS_ERR(pages))
    670     return NULL;
    671    
    672     - addr = vmap(pages, n_pages, 0, pgprot_writecombine(PAGE_KERNEL));
    673     - drm_gem_put_pages(obj, pages, false, false);
    674     -
    675     - return addr;
    676     + return vmap(pages, n_pages, 0, pgprot_writecombine(PAGE_KERNEL));
    677     }
    678    
    679     static void vgem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)
    680     {
    681     + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    682     +
    683     vunmap(vaddr);
    684     + vgem_unpin_pages(bo);
    685     }
    686    
    687     static int vgem_prime_mmap(struct drm_gem_object *obj,
    688     @@ -409,6 +447,7 @@ static struct drm_driver vgem_driver = {
    689     .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
    690     .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
    691     .gem_prime_pin = vgem_prime_pin,
    692     + .gem_prime_unpin = vgem_prime_unpin,
    693     .gem_prime_import = vgem_prime_import,
    694     .gem_prime_export = drm_gem_prime_export,
    695     .gem_prime_import_sg_table = vgem_prime_import_sg_table,
    696     diff --git a/drivers/gpu/drm/vgem/vgem_drv.h b/drivers/gpu/drm/vgem/vgem_drv.h
    697     index 1aae01419112..5c8f6d619ff3 100644
    698     --- a/drivers/gpu/drm/vgem/vgem_drv.h
    699     +++ b/drivers/gpu/drm/vgem/vgem_drv.h
    700     @@ -43,7 +43,11 @@ struct vgem_file {
    701     #define to_vgem_bo(x) container_of(x, struct drm_vgem_gem_object, base)
    702     struct drm_vgem_gem_object {
    703     struct drm_gem_object base;
    704     +
    705     struct page **pages;
    706     + unsigned int pages_pin_count;
    707     + struct mutex pages_lock;
    708     +
    709     struct sg_table *table;
    710     };
    711    
    712     diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
    713     index 9f940293ede4..bb17d7bbefd3 100644
    714     --- a/drivers/hid/wacom_wac.c
    715     +++ b/drivers/hid/wacom_wac.c
    716     @@ -1846,7 +1846,13 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
    717     features->device_type |= WACOM_DEVICETYPE_PAD;
    718     break;
    719     case WACOM_HID_WD_TOUCHRINGSTATUS:
    720     - wacom_map_usage(input, usage, field, EV_ABS, ABS_WHEEL, 0);
    721     + /*
    722     + * Only set up type/code association. Completely mapping
    723     + * this usage may overwrite the axis resolution and range.
    724     + */
    725     + usage->type = EV_ABS;
    726     + usage->code = ABS_WHEEL;
    727     + set_bit(EV_ABS, input->evbit);
    728     features->device_type |= WACOM_DEVICETYPE_PAD;
    729     break;
    730     case WACOM_HID_WD_BUTTONCONFIG:
    731     diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
    732     index 590cf90dd21a..da40df2ff27d 100644
    733     --- a/drivers/hwtracing/intel_th/pci.c
    734     +++ b/drivers/hwtracing/intel_th/pci.c
    735     @@ -95,6 +95,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
    736     PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
    737     .driver_data = (kernel_ulong_t)0,
    738     },
    739     + {
    740     + /* Cannon Lake H */
    741     + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa326),
    742     + .driver_data = (kernel_ulong_t)0,
    743     + },
    744     + {
    745     + /* Cannon Lake LP */
    746     + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6),
    747     + .driver_data = (kernel_ulong_t)0,
    748     + },
    749     { 0 },
    750     };
    751    
    752     diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
    753     index 884b8e461b17..9c501e5042fb 100644
    754     --- a/drivers/iio/adc/ti-ads1015.c
    755     +++ b/drivers/iio/adc/ti-ads1015.c
    756     @@ -81,18 +81,12 @@ static const unsigned int ads1115_data_rate[] = {
    757     8, 16, 32, 64, 128, 250, 475, 860
    758     };
    759    
    760     -static const struct {
    761     - int scale;
    762     - int uscale;
    763     -} ads1015_scale[] = {
    764     - {3, 0},
    765     - {2, 0},
    766     - {1, 0},
    767     - {0, 500000},
    768     - {0, 250000},
    769     - {0, 125000},
    770     - {0, 125000},
    771     - {0, 125000},
    772     +/*
    773     + * Translation from PGA bits to full-scale positive and negative input voltage
    774     + * range in mV
    775     + */
    776     +static int ads1015_fullscale_range[] = {
    777     + 6144, 4096, 2048, 1024, 512, 256, 256, 256
    778     };
    779    
    780     #define ADS1015_V_CHAN(_chan, _addr) { \
    781     @@ -183,6 +177,12 @@ struct ads1015_data {
    782     struct ads1015_channel_data channel_data[ADS1015_CHANNELS];
    783    
    784     unsigned int *data_rate;
    785     + /*
    786     + * Set to true when the ADC is switched to the continuous-conversion
    787     + * mode and exits from a power-down state. This flag is used to avoid
    788     + * getting the stale result from the conversion register.
    789     + */
    790     + bool conv_invalid;
    791     };
    792    
    793     static bool ads1015_is_writeable_reg(struct device *dev, unsigned int reg)
    794     @@ -235,33 +235,43 @@ static int ads1015_set_power_state(struct ads1015_data *data, bool on)
    795     ret = pm_runtime_put_autosuspend(dev);
    796     }
    797    
    798     - return ret;
    799     + return ret < 0 ? ret : 0;
    800     }
    801    
    802     static
    803     int ads1015_get_adc_result(struct ads1015_data *data, int chan, int *val)
    804     {
    805     int ret, pga, dr, conv_time;
    806     - bool change;
    807     + unsigned int old, mask, cfg;
    808    
    809     if (chan < 0 || chan >= ADS1015_CHANNELS)
    810     return -EINVAL;
    811    
    812     + ret = regmap_read(data->regmap, ADS1015_CFG_REG, &old);
    813     + if (ret)
    814     + return ret;
    815     +
    816     pga = data->channel_data[chan].pga;
    817     dr = data->channel_data[chan].data_rate;
    818     + mask = ADS1015_CFG_MUX_MASK | ADS1015_CFG_PGA_MASK |
    819     + ADS1015_CFG_DR_MASK;
    820     + cfg = chan << ADS1015_CFG_MUX_SHIFT | pga << ADS1015_CFG_PGA_SHIFT |
    821     + dr << ADS1015_CFG_DR_SHIFT;
    822    
    823     - ret = regmap_update_bits_check(data->regmap, ADS1015_CFG_REG,
    824     - ADS1015_CFG_MUX_MASK |
    825     - ADS1015_CFG_PGA_MASK,
    826     - chan << ADS1015_CFG_MUX_SHIFT |
    827     - pga << ADS1015_CFG_PGA_SHIFT,
    828     - &change);
    829     - if (ret < 0)
    830     + cfg = (old & ~mask) | (cfg & mask);
    831     +
    832     + ret = regmap_write(data->regmap, ADS1015_CFG_REG, cfg);
    833     + if (ret)
    834     return ret;
    835    
    836     - if (change) {
    837     - conv_time = DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr]);
    838     + if (old != cfg || data->conv_invalid) {
    839     + int dr_old = (old & ADS1015_CFG_DR_MASK) >>
    840     + ADS1015_CFG_DR_SHIFT;
    841     +
    842     + conv_time = DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr_old]);
    843     + conv_time += DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr]);
    844     usleep_range(conv_time, conv_time + 1);
    845     + data->conv_invalid = false;
    846     }
    847    
    848     return regmap_read(data->regmap, ADS1015_CONV_REG, val);
    849     @@ -298,17 +308,20 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p)
    850     return IRQ_HANDLED;
    851     }
    852    
    853     -static int ads1015_set_scale(struct ads1015_data *data, int chan,
    854     +static int ads1015_set_scale(struct ads1015_data *data,
    855     + struct iio_chan_spec const *chan,
    856     int scale, int uscale)
    857     {
    858     int i, ret, rindex = -1;
    859     + int fullscale = div_s64((scale * 1000000LL + uscale) <<
    860     + (chan->scan_type.realbits - 1), 1000000);
    861    
    862     - for (i = 0; i < ARRAY_SIZE(ads1015_scale); i++)
    863     - if (ads1015_scale[i].scale == scale &&
    864     - ads1015_scale[i].uscale == uscale) {
    865     + for (i = 0; i < ARRAY_SIZE(ads1015_fullscale_range); i++) {
    866     + if (ads1015_fullscale_range[i] == fullscale) {
    867     rindex = i;
    868     break;
    869     }
    870     + }
    871     if (rindex < 0)
    872     return -EINVAL;
    873    
    874     @@ -318,32 +331,23 @@ static int ads1015_set_scale(struct ads1015_data *data, int chan,
    875     if (ret < 0)
    876     return ret;
    877    
    878     - data->channel_data[chan].pga = rindex;
    879     + data->channel_data[chan->address].pga = rindex;
    880    
    881     return 0;
    882     }
    883    
    884     static int ads1015_set_data_rate(struct ads1015_data *data, int chan, int rate)
    885     {
    886     - int i, ret, rindex = -1;
    887     + int i;
    888    
    889     - for (i = 0; i < ARRAY_SIZE(ads1015_data_rate); i++)
    890     + for (i = 0; i < ARRAY_SIZE(ads1015_data_rate); i++) {
    891     if (data->data_rate[i] == rate) {
    892     - rindex = i;
    893     - break;
    894     + data->channel_data[chan].data_rate = i;
    895     + return 0;
    896     }
    897     - if (rindex < 0)
    898     - return -EINVAL;
    899     -
    900     - ret = regmap_update_bits(data->regmap, ADS1015_CFG_REG,
    901     - ADS1015_CFG_DR_MASK,
    902     - rindex << ADS1015_CFG_DR_SHIFT);
    903     - if (ret < 0)
    904     - return ret;
    905     -
    906     - data->channel_data[chan].data_rate = rindex;
    907     + }
    908    
    909     - return 0;
    910     + return -EINVAL;
    911     }
    912    
    913     static int ads1015_read_raw(struct iio_dev *indio_dev,
    914     @@ -385,9 +389,9 @@ static int ads1015_read_raw(struct iio_dev *indio_dev,
    915     }
    916     case IIO_CHAN_INFO_SCALE:
    917     idx = data->channel_data[chan->address].pga;
    918     - *val = ads1015_scale[idx].scale;
    919     - *val2 = ads1015_scale[idx].uscale;
    920     - ret = IIO_VAL_INT_PLUS_MICRO;
    921     + *val = ads1015_fullscale_range[idx];
    922     + *val2 = chan->scan_type.realbits - 1;
    923     + ret = IIO_VAL_FRACTIONAL_LOG2;
    924     break;
    925     case IIO_CHAN_INFO_SAMP_FREQ:
    926     idx = data->channel_data[chan->address].data_rate;
    927     @@ -414,7 +418,7 @@ static int ads1015_write_raw(struct iio_dev *indio_dev,
    928     mutex_lock(&data->lock);
    929     switch (mask) {
    930     case IIO_CHAN_INFO_SCALE:
    931     - ret = ads1015_set_scale(data, chan->address, val, val2);
    932     + ret = ads1015_set_scale(data, chan, val, val2);
    933     break;
    934     case IIO_CHAN_INFO_SAMP_FREQ:
    935     ret = ads1015_set_data_rate(data, chan->address, val);
    936     @@ -446,7 +450,10 @@ static const struct iio_buffer_setup_ops ads1015_buffer_setup_ops = {
    937     .validate_scan_mask = &iio_validate_scan_mask_onehot,
    938     };
    939    
    940     -static IIO_CONST_ATTR(scale_available, "3 2 1 0.5 0.25 0.125");
    941     +static IIO_CONST_ATTR_NAMED(ads1015_scale_available, scale_available,
    942     + "3 2 1 0.5 0.25 0.125");
    943     +static IIO_CONST_ATTR_NAMED(ads1115_scale_available, scale_available,
    944     + "0.1875 0.125 0.0625 0.03125 0.015625 0.007813");
    945    
    946     static IIO_CONST_ATTR_NAMED(ads1015_sampling_frequency_available,
    947     sampling_frequency_available, "128 250 490 920 1600 2400 3300");
    948     @@ -454,7 +461,7 @@ static IIO_CONST_ATTR_NAMED(ads1115_sampling_frequency_available,
    949     sampling_frequency_available, "8 16 32 64 128 250 475 860");
    950    
    951     static struct attribute *ads1015_attributes[] = {
    952     - &iio_const_attr_scale_available.dev_attr.attr,
    953     + &iio_const_attr_ads1015_scale_available.dev_attr.attr,
    954     &iio_const_attr_ads1015_sampling_frequency_available.dev_attr.attr,
    955     NULL,
    956     };
    957     @@ -464,7 +471,7 @@ static const struct attribute_group ads1015_attribute_group = {
    958     };
    959    
    960     static struct attribute *ads1115_attributes[] = {
    961     - &iio_const_attr_scale_available.dev_attr.attr,
    962     + &iio_const_attr_ads1115_scale_available.dev_attr.attr,
    963     &iio_const_attr_ads1115_sampling_frequency_available.dev_attr.attr,
    964     NULL,
    965     };
    966     @@ -630,6 +637,15 @@ static int ads1015_probe(struct i2c_client *client,
    967     dev_err(&client->dev, "iio triggered buffer setup failed\n");
    968     return ret;
    969     }
    970     +
    971     + ret = regmap_update_bits(data->regmap, ADS1015_CFG_REG,
    972     + ADS1015_CFG_MOD_MASK,
    973     + ADS1015_CONTINUOUS << ADS1015_CFG_MOD_SHIFT);
    974     + if (ret)
    975     + return ret;
    976     +
    977     + data->conv_invalid = true;
    978     +
    979     ret = pm_runtime_set_active(&client->dev);
    980     if (ret)
    981     goto err_buffer_cleanup;
    982     @@ -685,10 +701,15 @@ static int ads1015_runtime_resume(struct device *dev)
    983     {
    984     struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
    985     struct ads1015_data *data = iio_priv(indio_dev);
    986     + int ret;
    987    
    988     - return regmap_update_bits(data->regmap, ADS1015_CFG_REG,
    989     + ret = regmap_update_bits(data->regmap, ADS1015_CFG_REG,
    990     ADS1015_CFG_MOD_MASK,
    991     ADS1015_CONTINUOUS << ADS1015_CFG_MOD_SHIFT);
    992     + if (!ret)
    993     + data->conv_invalid = true;
    994     +
    995     + return ret;
    996     }
    997     #endif
    998    
    999     diff --git a/drivers/mcb/mcb-lpc.c b/drivers/mcb/mcb-lpc.c
    1000     index d072c088ce73..945091a88354 100644
    1001     --- a/drivers/mcb/mcb-lpc.c
    1002     +++ b/drivers/mcb/mcb-lpc.c
    1003     @@ -114,6 +114,12 @@ static struct resource sc24_fpga_resource = {
    1004     .flags = IORESOURCE_MEM,
    1005     };
    1006    
    1007     +static struct resource sc31_fpga_resource = {
    1008     + .start = 0xf000e000,
    1009     + .end = 0xf000e000 + CHAM_HEADER_SIZE,
    1010     + .flags = IORESOURCE_MEM,
    1011     +};
    1012     +
    1013     static struct platform_driver mcb_lpc_driver = {
    1014     .driver = {
    1015     .name = "mcb-lpc",
    1016     @@ -132,6 +138,15 @@ static const struct dmi_system_id mcb_lpc_dmi_table[] = {
    1017     .driver_data = (void *)&sc24_fpga_resource,
    1018     .callback = mcb_lpc_create_platform_device,
    1019     },
    1020     + {
    1021     + .ident = "SC31",
    1022     + .matches = {
    1023     + DMI_MATCH(DMI_SYS_VENDOR, "MEN"),
    1024     + DMI_MATCH(DMI_PRODUCT_VERSION, "14SC31"),
    1025     + },
    1026     + .driver_data = (void *)&sc31_fpga_resource,
    1027     + .callback = mcb_lpc_create_platform_device,
    1028     + },
    1029     {}
    1030     };
    1031     MODULE_DEVICE_TABLE(dmi, mcb_lpc_dmi_table);
    1032     diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
    1033     index 75c5c903c8a6..53fa5b7380ff 100644
    1034     --- a/drivers/net/wireless/ath/ath10k/core.c
    1035     +++ b/drivers/net/wireless/ath/ath10k/core.c
    1036     @@ -2055,6 +2055,12 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode,
    1037     goto err_wmi_detach;
    1038     }
    1039    
    1040     + /* If firmware indicates Full Rx Reorder support it must be used in a
    1041     + * slightly different manner. Let HTT code know.
    1042     + */
    1043     + ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
    1044     + ar->wmi.svc_map));
    1045     +
    1046     status = ath10k_htt_rx_alloc(&ar->htt);
    1047     if (status) {
    1048     ath10k_err(ar, "failed to alloc htt rx: %d\n", status);
    1049     @@ -2167,12 +2173,6 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode,
    1050     }
    1051     }
    1052    
    1053     - /* If firmware indicates Full Rx Reorder support it must be used in a
    1054     - * slightly different manner. Let HTT code know.
    1055     - */
    1056     - ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
    1057     - ar->wmi.svc_map));
    1058     -
    1059     status = ath10k_htt_rx_ring_refill(ar);
    1060     if (status) {
    1061     ath10k_err(ar, "failed to refill htt rx ring: %d\n", status);
    1062     diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
    1063     index 84f4ba01e14f..875374e4747d 100644
    1064     --- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
    1065     +++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
    1066     @@ -430,6 +430,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
    1067     {IWL_PCI_DEVICE(0x095B, 0x520A, iwl7265_2ac_cfg)},
    1068     {IWL_PCI_DEVICE(0x095A, 0x9000, iwl7265_2ac_cfg)},
    1069     {IWL_PCI_DEVICE(0x095A, 0x9400, iwl7265_2ac_cfg)},
    1070     + {IWL_PCI_DEVICE(0x095A, 0x9E10, iwl7265_2ac_cfg)},
    1071    
    1072     /* 8000 Series */
    1073     {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
    1074     diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
    1075     index 06ad2d50f9b0..fdfdf2371986 100644
    1076     --- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
    1077     +++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
    1078     @@ -4215,7 +4215,7 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
    1079     if (adapter->config_bands & BAND_A)
    1080     n_channels_a = mwifiex_band_5ghz.n_channels;
    1081    
    1082     - adapter->num_in_chan_stats = max_t(u32, n_channels_bg, n_channels_a);
    1083     + adapter->num_in_chan_stats = n_channels_bg + n_channels_a;
    1084     adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) *
    1085     adapter->num_in_chan_stats);
    1086    
    1087     diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
    1088     index ae9630b49342..9900855746ac 100644
    1089     --- a/drivers/net/wireless/marvell/mwifiex/scan.c
    1090     +++ b/drivers/net/wireless/marvell/mwifiex/scan.c
    1091     @@ -2492,6 +2492,12 @@ mwifiex_update_chan_statistics(struct mwifiex_private *priv,
    1092     sizeof(struct mwifiex_chan_stats);
    1093    
    1094     for (i = 0 ; i < num_chan; i++) {
    1095     + if (adapter->survey_idx >= adapter->num_in_chan_stats) {
    1096     + mwifiex_dbg(adapter, WARN,
    1097     + "FW reported too many channel results (max %d)\n",
    1098     + adapter->num_in_chan_stats);
    1099     + return;
    1100     + }
    1101     chan_stats.chan_num = fw_chan_stats->chan_num;
    1102     chan_stats.bandcfg = fw_chan_stats->bandcfg;
    1103     chan_stats.flags = fw_chan_stats->flags;
    1104     diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
    1105     index 032b6317690d..08dc8919ef60 100644
    1106     --- a/drivers/net/wireless/realtek/rtlwifi/pci.c
    1107     +++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
    1108     @@ -2257,7 +2257,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
    1109     /* find adapter */
    1110     if (!_rtl_pci_find_adapter(pdev, hw)) {
    1111     err = -ENODEV;
    1112     - goto fail3;
    1113     + goto fail2;
    1114     }
    1115    
    1116     /* Init IO handler */
    1117     @@ -2318,10 +2318,10 @@ int rtl_pci_probe(struct pci_dev *pdev,
    1118     pci_set_drvdata(pdev, NULL);
    1119     rtl_deinit_core(hw);
    1120    
    1121     +fail2:
    1122     if (rtlpriv->io.pci_mem_start != 0)
    1123     pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
    1124    
    1125     -fail2:
    1126     pci_release_regions(pdev);
    1127     complete(&rtlpriv->firmware_loading_complete);
    1128    
    1129     diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
    1130     index 774e72058d24..bddd5a5ebe52 100644
    1131     --- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
    1132     +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
    1133     @@ -175,6 +175,8 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
    1134     rtl_fw_cb);
    1135     if (err) {
    1136     pr_info("Failed to request firmware!\n");
    1137     + vfree(rtlpriv->rtlhal.pfirmware);
    1138     + rtlpriv->rtlhal.pfirmware = NULL;
    1139     return 1;
    1140     }
    1141    
    1142     diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
    1143     index bcbb0c60f1f1..38f85bfdf0c7 100644
    1144     --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
    1145     +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
    1146     @@ -176,6 +176,8 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
    1147     rtl_fw_cb);
    1148     if (err) {
    1149     pr_err("Failed to request firmware!\n");
    1150     + vfree(rtlpriv->rtlhal.pfirmware);
    1151     + rtlpriv->rtlhal.pfirmware = NULL;
    1152     return 1;
    1153     }
    1154    
    1155     diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
    1156     index 96c923b3feb4..e3eb850bb1de 100644
    1157     --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
    1158     +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
    1159     @@ -85,6 +85,10 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
    1160     err = request_firmware_nowait(THIS_MODULE, 1,
    1161     fw_name, rtlpriv->io.dev,
    1162     GFP_KERNEL, hw, rtl_fw_cb);
    1163     + if (err) {
    1164     + vfree(rtlpriv->rtlhal.pfirmware);
    1165     + rtlpriv->rtlhal.pfirmware = NULL;
    1166     + }
    1167     return err;
    1168     }
    1169    
    1170     diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
    1171     index 16132c66e5e1..e38d6f7370aa 100644
    1172     --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
    1173     +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
    1174     @@ -183,6 +183,8 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
    1175     rtl_fw_cb);
    1176     if (err) {
    1177     pr_err("Failed to request firmware!\n");
    1178     + vfree(rtlpriv->rtlhal.pfirmware);
    1179     + rtlpriv->rtlhal.pfirmware = NULL;
    1180     return 1;
    1181     }
    1182    
    1183     diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
    1184     index eaa503b7c4b4..745e9c32655c 100644
    1185     --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
    1186     +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
    1187     @@ -177,6 +177,8 @@ int rtl92ee_init_sw_vars(struct ieee80211_hw *hw)
    1188     rtl_fw_cb);
    1189     if (err) {
    1190     pr_err("Failed to request firmware!\n");
    1191     + vfree(rtlpriv->rtlhal.pfirmware);
    1192     + rtlpriv->rtlhal.pfirmware = NULL;
    1193     return 1;
    1194     }
    1195    
    1196     diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
    1197     index 2006b09ea74f..1ec20efb9ce1 100644
    1198     --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
    1199     +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
    1200     @@ -216,6 +216,8 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
    1201     rtl92se_fw_cb);
    1202     if (err) {
    1203     pr_err("Failed to request firmware!\n");
    1204     + vfree(rtlpriv->rtlhal.pfirmware);
    1205     + rtlpriv->rtlhal.pfirmware = NULL;
    1206     return 1;
    1207     }
    1208    
    1209     diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
    1210     index 7bf9f2557920..aab86667a7f3 100644
    1211     --- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
    1212     +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
    1213     @@ -184,6 +184,8 @@ int rtl8723e_init_sw_vars(struct ieee80211_hw *hw)
    1214     rtl_fw_cb);
    1215     if (err) {
    1216     pr_err("Failed to request firmware!\n");
    1217     + vfree(rtlpriv->rtlhal.pfirmware);
    1218     + rtlpriv->rtlhal.pfirmware = NULL;
    1219     return 1;
    1220     }
    1221     return 0;
    1222     diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
    1223     index f9d10f1e7cf8..f47d839f388d 100644
    1224     --- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
    1225     +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
    1226     @@ -187,16 +187,10 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
    1227     rtlpriv->io.dev, GFP_KERNEL, hw,
    1228     rtl_fw_cb);
    1229     if (err) {
    1230     - /* Failed to get firmware. Check if old version available */
    1231     - fw_name = "rtlwifi/rtl8723befw.bin";
    1232     - pr_info("Using firmware %s\n", fw_name);
    1233     - err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
    1234     - rtlpriv->io.dev, GFP_KERNEL, hw,
    1235     - rtl_fw_cb);
    1236     - if (err) {
    1237     - pr_err("Failed to request firmware!\n");
    1238     - return 1;
    1239     - }
    1240     + pr_err("Failed to request firmware!\n");
    1241     + vfree(rtlpriv->rtlhal.pfirmware);
    1242     + rtlpriv->rtlhal.pfirmware = NULL;
    1243     + return 1;
    1244     }
    1245     return 0;
    1246     }
    1247     @@ -287,6 +281,7 @@ static const struct rtl_hal_cfg rtl8723be_hal_cfg = {
    1248     .bar_id = 2,
    1249     .write_readback = true,
    1250     .name = "rtl8723be_pci",
    1251     + .alt_fw_name = "rtlwifi/rtl8723befw.bin",
    1252     .ops = &rtl8723be_hal_ops,
    1253     .mod_params = &rtl8723be_mod_params,
    1254     .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
    1255     diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
    1256     index d71d2776ca03..5925edf7877f 100644
    1257     --- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
    1258     +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
    1259     @@ -196,6 +196,8 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
    1260     rtlpriv->rtlhal.wowlan_firmware = vzalloc(0x8000);
    1261     if (!rtlpriv->rtlhal.wowlan_firmware) {
    1262     pr_err("Can't alloc buffer for wowlan fw.\n");
    1263     + vfree(rtlpriv->rtlhal.pfirmware);
    1264     + rtlpriv->rtlhal.pfirmware = NULL;
    1265     return 1;
    1266     }
    1267    
    1268     @@ -214,16 +216,10 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
    1269     rtlpriv->io.dev, GFP_KERNEL, hw,
    1270     rtl_fw_cb);
    1271     if (err) {
    1272     - /* Failed to get firmware. Check if old version available */
    1273     - fw_name = "rtlwifi/rtl8821aefw.bin";
    1274     - pr_info("Using firmware %s\n", fw_name);
    1275     - err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
    1276     - rtlpriv->io.dev, GFP_KERNEL, hw,
    1277     - rtl_fw_cb);
    1278     - if (err) {
    1279     - pr_err("Failed to request normal firmware!\n");
    1280     - return 1;
    1281     - }
    1282     + pr_err("Failed to request normal firmware!\n");
    1283     + vfree(rtlpriv->rtlhal.wowlan_firmware);
    1284     + vfree(rtlpriv->rtlhal.pfirmware);
    1285     + return 1;
    1286     }
    1287     /*load wowlan firmware*/
    1288     pr_info("Using firmware %s\n", wowlan_fw_name);
    1289     @@ -233,6 +229,8 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
    1290     rtl_wowlan_fw_cb);
    1291     if (err) {
    1292     pr_err("Failed to request wowlan firmware!\n");
    1293     + vfree(rtlpriv->rtlhal.wowlan_firmware);
    1294     + vfree(rtlpriv->rtlhal.pfirmware);
    1295     return 1;
    1296     }
    1297     return 0;
    1298     @@ -325,6 +323,7 @@ static const struct rtl_hal_cfg rtl8821ae_hal_cfg = {
    1299     .bar_id = 2,
    1300     .write_readback = true,
    1301     .name = "rtl8821ae_pci",
    1302     + .alt_fw_name = "rtlwifi/rtl8821aefw.bin",
    1303     .ops = &rtl8821ae_hal_ops,
    1304     .mod_params = &rtl8821ae_mod_params,
    1305     .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
    1306     diff --git a/drivers/of/device.c b/drivers/of/device.c
    1307     index e0a28ea341fe..eabfa36383ce 100644
    1308     --- a/drivers/of/device.c
    1309     +++ b/drivers/of/device.c
    1310     @@ -274,6 +274,8 @@ ssize_t of_device_modalias(struct device *dev, char *str, ssize_t len)
    1311     ssize_t sl = of_device_get_modalias(dev, str, len - 2);
    1312     if (sl < 0)
    1313     return sl;
    1314     + if (sl > len - 2)
    1315     + return -ENOMEM;
    1316    
    1317     str[sl++] = '\n';
    1318     str[sl] = 0;
    1319     diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
    1320     index 84e782d8e7c3..aad6ebb51735 100644
    1321     --- a/drivers/scsi/sg.c
    1322     +++ b/drivers/scsi/sg.c
    1323     @@ -1233,6 +1233,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
    1324     unsigned long req_sz, len, sa;
    1325     Sg_scatter_hold *rsv_schp;
    1326     int k, length;
    1327     + int ret = 0;
    1328    
    1329     if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
    1330     return -ENXIO;
    1331     @@ -1243,8 +1244,11 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
    1332     if (vma->vm_pgoff)
    1333     return -EINVAL; /* want no offset */
    1334     rsv_schp = &sfp->reserve;
    1335     - if (req_sz > rsv_schp->bufflen)
    1336     - return -ENOMEM; /* cannot map more than reserved buffer */
    1337     + mutex_lock(&sfp->f_mutex);
    1338     + if (req_sz > rsv_schp->bufflen) {
    1339     + ret = -ENOMEM; /* cannot map more than reserved buffer */
    1340     + goto out;
    1341     + }
    1342    
    1343     sa = vma->vm_start;
    1344     length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
    1345     @@ -1258,7 +1262,9 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
    1346     vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
    1347     vma->vm_private_data = sfp;
    1348     vma->vm_ops = &sg_mmap_vm_ops;
    1349     - return 0;
    1350     +out:
    1351     + mutex_unlock(&sfp->f_mutex);
    1352     + return ret;
    1353     }
    1354    
    1355     static void
    1356     @@ -1735,9 +1741,12 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
    1357     !sfp->res_in_use) {
    1358     sfp->res_in_use = 1;
    1359     sg_link_reserve(sfp, srp, dxfer_len);
    1360     - } else if ((hp->flags & SG_FLAG_MMAP_IO) && sfp->res_in_use) {
    1361     + } else if (hp->flags & SG_FLAG_MMAP_IO) {
    1362     + res = -EBUSY; /* sfp->res_in_use == 1 */
    1363     + if (dxfer_len > rsv_schp->bufflen)
    1364     + res = -ENOMEM;
    1365     mutex_unlock(&sfp->f_mutex);
    1366     - return -EBUSY;
    1367     + return res;
    1368     } else {
    1369     res = sg_build_indirect(req_schp, sfp, dxfer_len);
    1370     if (res) {
    1371     diff --git a/drivers/staging/ccree/ssi_cipher.c b/drivers/staging/ccree/ssi_cipher.c
    1372     index cd2eafc04232..bdc68830389f 100644
    1373     --- a/drivers/staging/ccree/ssi_cipher.c
    1374     +++ b/drivers/staging/ccree/ssi_cipher.c
    1375     @@ -23,6 +23,7 @@
    1376     #include <crypto/aes.h>
    1377     #include <crypto/ctr.h>
    1378     #include <crypto/des.h>
    1379     +#include <crypto/scatterwalk.h>
    1380    
    1381     #include "ssi_config.h"
    1382     #include "ssi_driver.h"
    1383     @@ -716,6 +717,7 @@ static int ssi_blkcipher_complete(struct device *dev,
    1384     {
    1385     int completion_error = 0;
    1386     u32 inflight_counter;
    1387     + struct ablkcipher_request *req = (struct ablkcipher_request *)areq;
    1388    
    1389     ssi_buffer_mgr_unmap_blkcipher_request(dev, req_ctx, ivsize, src, dst);
    1390    
    1391     @@ -726,6 +728,22 @@ static int ssi_blkcipher_complete(struct device *dev,
    1392     ctx_p->drvdata->inflight_counter--;
    1393    
    1394     if (areq) {
    1395     + /*
    1396     + * The crypto API expects us to set the req->info to the last
    1397     + * ciphertext block. For encrypt, simply copy from the result.
    1398     + * For decrypt, we must copy from a saved buffer since this
    1399     + * could be an in-place decryption operation and the src is
    1400     + * lost by this point.
    1401     + */
    1402     + if (req_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_DECRYPT) {
    1403     + memcpy(req->info, req_ctx->backup_info, ivsize);
    1404     + kfree(req_ctx->backup_info);
    1405     + } else {
    1406     + scatterwalk_map_and_copy(req->info, req->dst,
    1407     + (req->nbytes - ivsize),
    1408     + ivsize, 0);
    1409     + }
    1410     +
    1411     ablkcipher_request_complete(areq, completion_error);
    1412     return 0;
    1413     }
    1414     @@ -759,11 +777,13 @@ static int ssi_blkcipher_process(
    1415     if (unlikely(validate_data_size(ctx_p, nbytes))) {
    1416     SSI_LOG_ERR("Unsupported data size %d.\n", nbytes);
    1417     crypto_tfm_set_flags(tfm, CRYPTO_TFM_RES_BAD_BLOCK_LEN);
    1418     - return -EINVAL;
    1419     + rc = -EINVAL;
    1420     + goto exit_process;
    1421     }
    1422     if (nbytes == 0) {
    1423     /* No data to process is valid */
    1424     - return 0;
    1425     + rc = 0;
    1426     + goto exit_process;
    1427     }
    1428     /*For CTS in case of data size aligned to 16 use CBC mode*/
    1429     if (((nbytes % AES_BLOCK_SIZE) == 0) && (ctx_p->cipher_mode == DRV_CIPHER_CBC_CTS)) {
    1430     @@ -842,6 +862,9 @@ static int ssi_blkcipher_process(
    1431     if (cts_restore_flag != 0)
    1432     ctx_p->cipher_mode = DRV_CIPHER_CBC_CTS;
    1433    
    1434     + if (rc != -EINPROGRESS)
    1435     + kfree(req_ctx->backup_info);
    1436     +
    1437     return rc;
    1438     }
    1439    
    1440     @@ -884,7 +907,6 @@ static int ssi_ablkcipher_encrypt(struct ablkcipher_request *req)
    1441     struct blkcipher_req_ctx *req_ctx = ablkcipher_request_ctx(req);
    1442     unsigned int ivsize = crypto_ablkcipher_ivsize(ablk_tfm);
    1443    
    1444     - req_ctx->backup_info = req->info;
    1445     req_ctx->is_giv = false;
    1446    
    1447     return ssi_blkcipher_process(tfm, req_ctx, req->dst, req->src, req->nbytes, req->info, ivsize, (void *)req, DRV_CRYPTO_DIRECTION_ENCRYPT);
    1448     @@ -897,8 +919,18 @@ static int ssi_ablkcipher_decrypt(struct ablkcipher_request *req)
    1449     struct blkcipher_req_ctx *req_ctx = ablkcipher_request_ctx(req);
    1450     unsigned int ivsize = crypto_ablkcipher_ivsize(ablk_tfm);
    1451    
    1452     - req_ctx->backup_info = req->info;
    1453     + /*
    1454     + * Allocate and save the last IV sized bytes of the source, which will
    1455     + * be lost in case of in-place decryption and might be needed for CTS.
    1456     + */
    1457     + req_ctx->backup_info = kmalloc(ivsize, GFP_KERNEL);
    1458     + if (!req_ctx->backup_info)
    1459     + return -ENOMEM;
    1460     +
    1461     + scatterwalk_map_and_copy(req_ctx->backup_info, req->src,
    1462     + (req->nbytes - ivsize), ivsize, 0);
    1463     req_ctx->is_giv = false;
    1464     +
    1465     return ssi_blkcipher_process(tfm, req_ctx, req->dst, req->src, req->nbytes, req->info, ivsize, (void *)req, DRV_CRYPTO_DIRECTION_DECRYPT);
    1466     }
    1467    
    1468     diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h
    1469     index e6d28a249fc1..bfbabae1aad8 100644
    1470     --- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h
    1471     +++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h
    1472     @@ -123,8 +123,8 @@ struct dpaa2_eth_swa {
    1473     /* Error bits in FD CTRL */
    1474     #define DPAA2_FD_CTRL_UFD 0x00000004
    1475     #define DPAA2_FD_CTRL_SBE 0x00000008
    1476     -#define DPAA2_FD_CTRL_FSE 0x00000010
    1477     -#define DPAA2_FD_CTRL_FAERR 0x00000020
    1478     +#define DPAA2_FD_CTRL_FSE 0x00000020
    1479     +#define DPAA2_FD_CTRL_FAERR 0x00000040
    1480    
    1481     #define DPAA2_FD_RX_ERR_MASK (DPAA2_FD_CTRL_SBE | \
    1482     DPAA2_FD_CTRL_FAERR)
    1483     diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c
    1484     index 36b5a11f21d2..a401b13f5f5e 100644
    1485     --- a/drivers/staging/rts5208/rtsx_scsi.c
    1486     +++ b/drivers/staging/rts5208/rtsx_scsi.c
    1487     @@ -414,7 +414,7 @@ void set_sense_data(struct rtsx_chip *chip, unsigned int lun, u8 err_code,
    1488     sense->ascq = ascq;
    1489     if (sns_key_info0 != 0) {
    1490     sense->sns_key_info[0] = SKSV | sns_key_info0;
    1491     - sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 8;
    1492     + sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 4;
    1493     sense->sns_key_info[2] = sns_key_info1 & 0x0f;
    1494     }
    1495     }
    1496     diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c
    1497     index 69c0232a22f8..fb40dd0588b9 100644
    1498     --- a/drivers/thunderbolt/ctl.c
    1499     +++ b/drivers/thunderbolt/ctl.c
    1500     @@ -804,7 +804,7 @@ struct tb_cfg_result tb_cfg_reset(struct tb_ctl *ctl, u64 route,
    1501     req->request_type = TB_CFG_PKG_RESET;
    1502     req->response = &reply;
    1503     req->response_size = sizeof(reply);
    1504     - req->response_type = sizeof(TB_CFG_PKG_RESET);
    1505     + req->response_type = TB_CFG_PKG_RESET;
    1506    
    1507     res = tb_cfg_request_sync(ctl, req, timeout_msec);
    1508    
    1509     diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    1510     index ebe27595c4af..0ff0feddfd1f 100644
    1511     --- a/drivers/usb/core/devio.c
    1512     +++ b/drivers/usb/core/devio.c
    1513     @@ -623,6 +623,8 @@ static void async_completed(struct urb *urb)
    1514     if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
    1515     as->status != -ENOENT)
    1516     cancel_bulk_urbs(ps, as->bulk_addr);
    1517     +
    1518     + wake_up(&ps->wait);
    1519     spin_unlock(&ps->lock);
    1520    
    1521     if (signr) {
    1522     @@ -630,8 +632,6 @@ static void async_completed(struct urb *urb)
    1523     put_pid(pid);
    1524     put_cred(cred);
    1525     }
    1526     -
    1527     - wake_up(&ps->wait);
    1528     }
    1529    
    1530     static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
    1531     diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    1532     index 574da2b4529c..82806e311202 100644
    1533     --- a/drivers/usb/core/quirks.c
    1534     +++ b/drivers/usb/core/quirks.c
    1535     @@ -57,8 +57,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    1536     /* Microsoft LifeCam-VX700 v2.0 */
    1537     { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
    1538    
    1539     - /* Logitech HD Pro Webcams C920 and C930e */
    1540     + /* Logitech HD Pro Webcams C920, C920-C and C930e */
    1541     { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
    1542     + { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
    1543     { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
    1544    
    1545     /* Logitech ConferenceCam CC3000e */
    1546     @@ -217,6 +218,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    1547     { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
    1548     USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
    1549    
    1550     + /* Corsair Strafe RGB */
    1551     + { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
    1552     +
    1553     /* Acer C120 LED Projector */
    1554     { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
    1555    
    1556     diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
    1557     index c8f38649f749..658d9d1f9ea3 100644
    1558     --- a/drivers/usb/host/pci-quirks.c
    1559     +++ b/drivers/usb/host/pci-quirks.c
    1560     @@ -142,29 +142,30 @@ static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo)
    1561     pinfo->sb_type.gen = AMD_CHIPSET_SB700;
    1562     else if (rev >= 0x40 && rev <= 0x4f)
    1563     pinfo->sb_type.gen = AMD_CHIPSET_SB800;
    1564     - }
    1565     - pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
    1566     - 0x145c, NULL);
    1567     - if (pinfo->smbus_dev) {
    1568     - pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
    1569     } else {
    1570     pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
    1571     PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
    1572    
    1573     - if (!pinfo->smbus_dev) {
    1574     - pinfo->sb_type.gen = NOT_AMD_CHIPSET;
    1575     - return 0;
    1576     + if (pinfo->smbus_dev) {
    1577     + rev = pinfo->smbus_dev->revision;
    1578     + if (rev >= 0x11 && rev <= 0x14)
    1579     + pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
    1580     + else if (rev >= 0x15 && rev <= 0x18)
    1581     + pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
    1582     + else if (rev >= 0x39 && rev <= 0x3a)
    1583     + pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
    1584     + } else {
    1585     + pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
    1586     + 0x145c, NULL);
    1587     + if (pinfo->smbus_dev) {
    1588     + rev = pinfo->smbus_dev->revision;
    1589     + pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
    1590     + } else {
    1591     + pinfo->sb_type.gen = NOT_AMD_CHIPSET;
    1592     + return 0;
    1593     + }
    1594     }
    1595     -
    1596     - rev = pinfo->smbus_dev->revision;
    1597     - if (rev >= 0x11 && rev <= 0x14)
    1598     - pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
    1599     - else if (rev >= 0x15 && rev <= 0x18)
    1600     - pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
    1601     - else if (rev >= 0x39 && rev <= 0x3a)
    1602     - pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
    1603     }
    1604     -
    1605     pinfo->sb_type.rev = rev;
    1606     return 1;
    1607     }
    1608     diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
    1609     index 87cbd56cc761..b67692857daf 100644
    1610     --- a/drivers/usb/musb/musb_core.c
    1611     +++ b/drivers/usb/musb/musb_core.c
    1612     @@ -2671,6 +2671,13 @@ static int musb_suspend(struct device *dev)
    1613     {
    1614     struct musb *musb = dev_to_musb(dev);
    1615     unsigned long flags;
    1616     + int ret;
    1617     +
    1618     + ret = pm_runtime_get_sync(dev);
    1619     + if (ret < 0) {
    1620     + pm_runtime_put_noidle(dev);
    1621     + return ret;
    1622     + }
    1623    
    1624     musb_platform_disable(musb);
    1625     musb_disable_interrupts(musb);
    1626     @@ -2721,14 +2728,6 @@ static int musb_resume(struct device *dev)
    1627     if ((devctl & mask) != (musb->context.devctl & mask))
    1628     musb->port1_status = 0;
    1629    
    1630     - /*
    1631     - * The USB HUB code expects the device to be in RPM_ACTIVE once it came
    1632     - * out of suspend
    1633     - */
    1634     - pm_runtime_disable(dev);
    1635     - pm_runtime_set_active(dev);
    1636     - pm_runtime_enable(dev);
    1637     -
    1638     musb_start(musb);
    1639    
    1640     spin_lock_irqsave(&musb->lock, flags);
    1641     @@ -2738,6 +2737,9 @@ static int musb_resume(struct device *dev)
    1642     error);
    1643     spin_unlock_irqrestore(&musb->lock, flags);
    1644    
    1645     + pm_runtime_mark_last_busy(dev);
    1646     + pm_runtime_put_autosuspend(dev);
    1647     +
    1648     return 0;
    1649     }
    1650    
    1651     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    1652     index fe123153b1a5..2a9944326210 100644
    1653     --- a/drivers/usb/serial/option.c
    1654     +++ b/drivers/usb/serial/option.c
    1655     @@ -2023,6 +2023,7 @@ static const struct usb_device_id option_ids[] = {
    1656     { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
    1657     { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
    1658     { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */
    1659     + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) }, /* D-Link DWM-157 C1 */
    1660     { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */
    1661     .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    1662     { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */
    1663     diff --git a/fs/dlm/user.c b/fs/dlm/user.c
    1664     index 23488f559cf9..84199151b64b 100644
    1665     --- a/fs/dlm/user.c
    1666     +++ b/fs/dlm/user.c
    1667     @@ -355,6 +355,10 @@ static int dlm_device_register(struct dlm_ls *ls, char *name)
    1668     error = misc_register(&ls->ls_device);
    1669     if (error) {
    1670     kfree(ls->ls_device.name);
    1671     + /* this has to be set to NULL
    1672     + * to avoid a double-free in dlm_device_deregister
    1673     + */
    1674     + ls->ls_device.name = NULL;
    1675     }
    1676     fail:
    1677     return error;
    1678     diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
    1679     index c71e532da458..4adf6161ec77 100644
    1680     --- a/include/linux/pci_ids.h
    1681     +++ b/include/linux/pci_ids.h
    1682     @@ -576,6 +576,7 @@
    1683     #define PCI_DEVICE_ID_AMD_CS5536_EHC 0x2095
    1684     #define PCI_DEVICE_ID_AMD_CS5536_UDC 0x2096
    1685     #define PCI_DEVICE_ID_AMD_CS5536_UOC 0x2097
    1686     +#define PCI_DEVICE_ID_AMD_CS5536_DEV_IDE 0x2092
    1687     #define PCI_DEVICE_ID_AMD_CS5536_IDE 0x209A
    1688     #define PCI_DEVICE_ID_AMD_LX_VIDEO 0x2081
    1689     #define PCI_DEVICE_ID_AMD_LX_AES 0x2082
    1690     diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
    1691     index db6dc9dc0482..1c49431f3121 100644
    1692     --- a/include/linux/workqueue.h
    1693     +++ b/include/linux/workqueue.h
    1694     @@ -323,8 +323,8 @@ enum {
    1695    
    1696     __WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */
    1697     __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */
    1698     - __WQ_ORDERED_EXPLICIT = 1 << 18, /* internal: alloc_ordered_workqueue() */
    1699     __WQ_LEGACY = 1 << 18, /* internal: create*_workqueue() */
    1700     + __WQ_ORDERED_EXPLICIT = 1 << 19, /* internal: alloc_ordered_workqueue() */
    1701    
    1702     WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */
    1703     WQ_MAX_UNBOUND_PER_CPU = 4, /* 4 * #cpus for unbound wq */
    1704     diff --git a/include/uapi/linux/android/binder.h b/include/uapi/linux/android/binder.h
    1705     index 51f891fb1b18..7668b5791c91 100644
    1706     --- a/include/uapi/linux/android/binder.h
    1707     +++ b/include/uapi/linux/android/binder.h
    1708     @@ -132,6 +132,7 @@ enum {
    1709    
    1710     /* struct binder_fd_array_object - object describing an array of fds in a buffer
    1711     * @hdr: common header structure
    1712     + * @pad: padding to ensure correct alignment
    1713     * @num_fds: number of file descriptors in the buffer
    1714     * @parent: index in offset array to buffer holding the fd array
    1715     * @parent_offset: start offset of fd array in the buffer
    1716     @@ -152,6 +153,7 @@ enum {
    1717     */
    1718     struct binder_fd_array_object {
    1719     struct binder_object_header hdr;
    1720     + __u32 pad;
    1721     binder_size_t num_fds;
    1722     binder_size_t parent;
    1723     binder_size_t parent_offset;
    1724     diff --git a/kernel/configs/android-base.config b/kernel/configs/android-base.config
    1725     index d70829033bb7..d3fd428f4b92 100644
    1726     --- a/kernel/configs/android-base.config
    1727     +++ b/kernel/configs/android-base.config
    1728     @@ -10,6 +10,7 @@
    1729     # CONFIG_USELIB is not set
    1730     CONFIG_ANDROID=y
    1731     CONFIG_ANDROID_BINDER_IPC=y
    1732     +CONFIG_ANDROID_BINDER_DEVICES=binder,hwbinder,vndbinder
    1733     CONFIG_ANDROID_LOW_MEMORY_KILLER=y
    1734     CONFIG_ARMV8_DEPRECATED=y
    1735     CONFIG_ASHMEM=y