Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.13/0100-4.13.1-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-4.13/0100-4.13.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2993 - (show annotations) (download)
    Tue Sep 12 09:41:16 2017 UTC (6 years, 7 months ago) by niro
    File size: 59547 byte(s) 
    -linux-4.13.1
    1 diff --git a/Makefile b/Makefile
    2 index ed65d7278bb3..41a976854cad 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 13
    8 -SUBLEVEL = 0
    9 +SUBLEVEL = 1
    10 EXTRAVERSION =
    11 NAME = Fearless Coyote
    12
    13 diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
    14 index 57057fb1cc07..65ab11d654e1 100644
    15 --- a/arch/s390/include/asm/pgtable.h
    16 +++ b/arch/s390/include/asm/pgtable.h
    17 @@ -505,7 +505,7 @@ static inline int mm_alloc_pgste(struct mm_struct *mm)
    18 * In the case that a guest uses storage keys
    19 * faults should no longer be backed by zero pages
    20 */
    21 -#define mm_forbids_zeropage mm_use_skey
    22 +#define mm_forbids_zeropage mm_has_pgste
    23 static inline int mm_use_skey(struct mm_struct *mm)
    24 {
    25 #ifdef CONFIG_PGSTE
    26 diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
    27 index 4fb3d3cdb370..ff84fb214bf9 100644
    28 --- a/arch/s390/mm/gmap.c
    29 +++ b/arch/s390/mm/gmap.c
    30 @@ -2120,6 +2120,37 @@ static inline void thp_split_mm(struct mm_struct *mm)
    31 #endif
    32 }
    33
    34 +/*
    35 + * Remove all empty zero pages from the mapping for lazy refaulting
    36 + * - This must be called after mm->context.has_pgste is set, to avoid
    37 + * future creation of zero pages
    38 + * - This must be called after THP was enabled
    39 + */
    40 +static int __zap_zero_pages(pmd_t *pmd, unsigned long start,
    41 + unsigned long end, struct mm_walk *walk)
    42 +{
    43 + unsigned long addr;
    44 +
    45 + for (addr = start; addr != end; addr += PAGE_SIZE) {
    46 + pte_t *ptep;
    47 + spinlock_t *ptl;
    48 +
    49 + ptep = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
    50 + if (is_zero_pfn(pte_pfn(*ptep)))
    51 + ptep_xchg_direct(walk->mm, addr, ptep, __pte(_PAGE_INVALID));
    52 + pte_unmap_unlock(ptep, ptl);
    53 + }
    54 + return 0;
    55 +}
    56 +
    57 +static inline void zap_zero_pages(struct mm_struct *mm)
    58 +{
    59 + struct mm_walk walk = { .pmd_entry = __zap_zero_pages };
    60 +
    61 + walk.mm = mm;
    62 + walk_page_range(0, TASK_SIZE, &walk);
    63 +}
    64 +
    65 /*
    66 * switch on pgstes for its userspace process (for kvm)
    67 */
    68 @@ -2137,6 +2168,7 @@ int s390_enable_sie(void)
    69 mm->context.has_pgste = 1;
    70 /* split thp mappings and disable thp for future mappings */
    71 thp_split_mm(mm);
    72 + zap_zero_pages(mm);
    73 up_write(&mm->mmap_sem);
    74 return 0;
    75 }
    76 @@ -2149,13 +2181,6 @@ EXPORT_SYMBOL_GPL(s390_enable_sie);
    77 static int __s390_enable_skey(pte_t *pte, unsigned long addr,
    78 unsigned long next, struct mm_walk *walk)
    79 {
    80 - /*
    81 - * Remove all zero page mappings,
    82 - * after establishing a policy to forbid zero page mappings
    83 - * following faults for that page will get fresh anonymous pages
    84 - */
    85 - if (is_zero_pfn(pte_pfn(*pte)))
    86 - ptep_xchg_direct(walk->mm, addr, pte, __pte(_PAGE_INVALID));
    87 /* Clear storage key */
    88 ptep_zap_key(walk->mm, addr, pte);
    89 return 0;
    90 diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig
    91 index 832e885349b1..4d4cdc1a6e25 100644
    92 --- a/drivers/android/Kconfig
    93 +++ b/drivers/android/Kconfig
    94 @@ -22,7 +22,7 @@ config ANDROID_BINDER_IPC
    95 config ANDROID_BINDER_DEVICES
    96 string "Android Binder devices"
    97 depends on ANDROID_BINDER_IPC
    98 - default "binder,hwbinder"
    99 + default "binder,hwbinder,vndbinder"
    100 ---help---
    101 Default value for the binder.devices parameter.
    102
    103 diff --git a/drivers/android/binder.c b/drivers/android/binder.c
    104 index 831cdd7d197d..3db96b79d122 100644
    105 --- a/drivers/android/binder.c
    106 +++ b/drivers/android/binder.c
    107 @@ -4215,7 +4215,7 @@ static int __init init_binder_device(const char *name)
    108 static int __init binder_init(void)
    109 {
    110 int ret;
    111 - char *device_name, *device_names;
    112 + char *device_name, *device_names, *device_tmp;
    113 struct binder_device *device;
    114 struct hlist_node *tmp;
    115
    116 @@ -4263,7 +4263,8 @@ static int __init binder_init(void)
    117 }
    118 strcpy(device_names, binder_devices_param);
    119
    120 - while ((device_name = strsep(&device_names, ","))) {
    121 + device_tmp = device_names;
    122 + while ((device_name = strsep(&device_tmp, ","))) {
    123 ret = init_binder_device(device_name);
    124 if (ret)
    125 goto err_init_binder_device_failed;
    126 @@ -4277,6 +4278,9 @@ static int __init binder_init(void)
    127 hlist_del(&device->hlist);
    128 kfree(device);
    129 }
    130 +
    131 + kfree(device_names);
    132 +
    133 err_alloc_device_names_failed:
    134 debugfs_remove_recursive(binder_debugfs_dir_entry_root);
    135
    136 diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
    137 index 5a5fd0b404eb..cb9b0e9090e3 100644
    138 --- a/drivers/ata/ahci.c
    139 +++ b/drivers/ata/ahci.c
    140 @@ -1469,7 +1469,14 @@ static void ahci_remap_check(struct pci_dev *pdev, int bar,
    141 return;
    142
    143 dev_warn(&pdev->dev, "Found %d remapped NVMe devices.\n", count);
    144 - dev_warn(&pdev->dev, "Switch your BIOS from RAID to AHCI mode to use them.\n");
    145 + dev_warn(&pdev->dev,
    146 + "Switch your BIOS from RAID to AHCI mode to use them.\n");
    147 +
    148 + /*
    149 + * Don't rely on the msi-x capability in the remap case,
    150 + * share the legacy interrupt across ahci and remapped devices.
    151 + */
    152 + hpriv->flags |= AHCI_HFLAG_NO_MSI;
    153 }
    154
    155 static int ahci_get_irq_vector(struct ata_host *host, int port)
    156 diff --git a/drivers/ata/pata_amd.c b/drivers/ata/pata_amd.c
    157 index 8d4d959a821c..8706533db57b 100644
    158 --- a/drivers/ata/pata_amd.c
    159 +++ b/drivers/ata/pata_amd.c
    160 @@ -616,6 +616,7 @@ static const struct pci_device_id amd[] = {
    161 { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_IDE), 8 },
    162 { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE), 8 },
    163 { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_IDE), 9 },
    164 + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_DEV_IDE), 9 },
    165
    166 { },
    167 };
    168 diff --git a/drivers/ata/pata_cs5536.c b/drivers/ata/pata_cs5536.c
    169 index 6c15a554efbe..dc1255294628 100644
    170 --- a/drivers/ata/pata_cs5536.c
    171 +++ b/drivers/ata/pata_cs5536.c
    172 @@ -289,6 +289,7 @@ static int cs5536_init_one(struct pci_dev *dev, const struct pci_device_id *id)
    173
    174 static const struct pci_device_id cs5536[] = {
    175 { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_IDE), },
    176 + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_DEV_IDE), },
    177 { },
    178 };
    179
    180 diff --git a/drivers/base/bus.c b/drivers/base/bus.c
    181 index e162c9a789ba..22a64fd3309b 100644
    182 --- a/drivers/base/bus.c
    183 +++ b/drivers/base/bus.c
    184 @@ -698,7 +698,7 @@ int bus_add_driver(struct device_driver *drv)
    185
    186 out_unregister:
    187 kobject_put(&priv->kobj);
    188 - kfree(drv->p);
    189 + /* drv->p is freed in driver_release() */
    190 drv->p = NULL;
    191 out_put_bus:
    192 bus_put(bus);
    193 diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
    194 index fa24d693af24..e331e212f5fc 100644
    195 --- a/drivers/bluetooth/btusb.c
    196 +++ b/drivers/bluetooth/btusb.c
    197 @@ -357,6 +357,7 @@ static const struct usb_device_id blacklist_table[] = {
    198 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
    199 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
    200 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
    201 + { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
    202
    203 /* Additional Realtek 8821AE Bluetooth devices */
    204 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
    205 diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
    206 index 0488b7f81dcf..54f3b375a453 100644
    207 --- a/drivers/crypto/caam/caamalg.c
    208 +++ b/drivers/crypto/caam/caamalg.c
    209 @@ -81,40 +81,6 @@
    210 #define debug(format, arg...)
    211 #endif
    212
    213 -#ifdef DEBUG
    214 -#include <linux/highmem.h>
    215 -
    216 -static void dbg_dump_sg(const char *level, const char *prefix_str,
    217 - int prefix_type, int rowsize, int groupsize,
    218 - struct scatterlist *sg, size_t tlen, bool ascii)
    219 -{
    220 - struct scatterlist *it;
    221 - void *it_page;
    222 - size_t len;
    223 - void *buf;
    224 -
    225 - for (it = sg; it != NULL && tlen > 0 ; it = sg_next(sg)) {
    226 - /*
    227 - * make sure the scatterlist's page
    228 - * has a valid virtual memory mapping
    229 - */
    230 - it_page = kmap_atomic(sg_page(it));
    231 - if (unlikely(!it_page)) {
    232 - printk(KERN_ERR "dbg_dump_sg: kmap failed\n");
    233 - return;
    234 - }
    235 -
    236 - buf = it_page + it->offset;
    237 - len = min_t(size_t, tlen, it->length);
    238 - print_hex_dump(level, prefix_str, prefix_type, rowsize,
    239 - groupsize, buf, len, ascii);
    240 - tlen -= len;
    241 -
    242 - kunmap_atomic(it_page);
    243 - }
    244 -}
    245 -#endif
    246 -
    247 static struct list_head alg_list;
    248
    249 struct caam_alg_entry {
    250 @@ -898,10 +864,10 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err,
    251 print_hex_dump(KERN_ERR, "dstiv @"__stringify(__LINE__)": ",
    252 DUMP_PREFIX_ADDRESS, 16, 4, req->info,
    253 edesc->src_nents > 1 ? 100 : ivsize, 1);
    254 - dbg_dump_sg(KERN_ERR, "dst @"__stringify(__LINE__)": ",
    255 - DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    256 - edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    257 #endif
    258 + caam_dump_sg(KERN_ERR, "dst @" __stringify(__LINE__)": ",
    259 + DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    260 + edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    261
    262 ablkcipher_unmap(jrdev, edesc, req);
    263
    264 @@ -937,10 +903,10 @@ static void ablkcipher_decrypt_done(struct device *jrdev, u32 *desc, u32 err,
    265 print_hex_dump(KERN_ERR, "dstiv @"__stringify(__LINE__)": ",
    266 DUMP_PREFIX_ADDRESS, 16, 4, req->info,
    267 ivsize, 1);
    268 - dbg_dump_sg(KERN_ERR, "dst @"__stringify(__LINE__)": ",
    269 - DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    270 - edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    271 #endif
    272 + caam_dump_sg(KERN_ERR, "dst @" __stringify(__LINE__)": ",
    273 + DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    274 + edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    275
    276 ablkcipher_unmap(jrdev, edesc, req);
    277
    278 @@ -1107,10 +1073,10 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr,
    279 ivsize, 1);
    280 pr_err("asked=%d, nbytes%d\n",
    281 (int)edesc->src_nents > 1 ? 100 : req->nbytes, req->nbytes);
    282 - dbg_dump_sg(KERN_ERR, "src @"__stringify(__LINE__)": ",
    283 - DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    284 - edesc->src_nents > 1 ? 100 : req->nbytes, 1);
    285 #endif
    286 + caam_dump_sg(KERN_ERR, "src @" __stringify(__LINE__)": ",
    287 + DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    288 + edesc->src_nents > 1 ? 100 : req->nbytes, 1);
    289
    290 len = desc_len(sh_desc);
    291 init_job_desc_shared(desc, ptr, len, HDR_SHARE_DEFER | HDR_REVERSE);
    292 @@ -1164,10 +1130,10 @@ static void init_ablkcipher_giv_job(u32 *sh_desc, dma_addr_t ptr,
    293 print_hex_dump(KERN_ERR, "presciv@" __stringify(__LINE__) ": ",
    294 DUMP_PREFIX_ADDRESS, 16, 4, req->info,
    295 ivsize, 1);
    296 - dbg_dump_sg(KERN_ERR, "src @" __stringify(__LINE__) ": ",
    297 - DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    298 - edesc->src_nents > 1 ? 100 : req->nbytes, 1);
    299 #endif
    300 + caam_dump_sg(KERN_ERR, "src @" __stringify(__LINE__) ": ",
    301 + DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    302 + edesc->src_nents > 1 ? 100 : req->nbytes, 1);
    303
    304 len = desc_len(sh_desc);
    305 init_job_desc_shared(desc, ptr, len, HDR_SHARE_DEFER | HDR_REVERSE);
    306 @@ -1449,11 +1415,9 @@ static int aead_decrypt(struct aead_request *req)
    307 u32 *desc;
    308 int ret = 0;
    309
    310 -#ifdef DEBUG
    311 - dbg_dump_sg(KERN_ERR, "dec src@"__stringify(__LINE__)": ",
    312 - DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    313 - req->assoclen + req->cryptlen, 1);
    314 -#endif
    315 + caam_dump_sg(KERN_ERR, "dec src@" __stringify(__LINE__)": ",
    316 + DUMP_PREFIX_ADDRESS, 16, 4, req->src,
    317 + req->assoclen + req->cryptlen, 1);
    318
    319 /* allocate extended descriptor */
    320 edesc = aead_edesc_alloc(req, AUTHENC_DESC_JOB_IO_LEN,
    321 diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c
    322 index 78c4c0485c58..3425f2d9a2a1 100644
    323 --- a/drivers/crypto/caam/caamalg_qi.c
    324 +++ b/drivers/crypto/caam/caamalg_qi.c
    325 @@ -791,9 +791,9 @@ static void ablkcipher_done(struct caam_drv_req *drv_req, u32 status)
    326 print_hex_dump(KERN_ERR, "dstiv @" __stringify(__LINE__)": ",
    327 DUMP_PREFIX_ADDRESS, 16, 4, req->info,
    328 edesc->src_nents > 1 ? 100 : ivsize, 1);
    329 - dbg_dump_sg(KERN_ERR, "dst @" __stringify(__LINE__)": ",
    330 - DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    331 - edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    332 + caam_dump_sg(KERN_ERR, "dst @" __stringify(__LINE__)": ",
    333 + DUMP_PREFIX_ADDRESS, 16, 4, req->dst,
    334 + edesc->dst_nents > 1 ? 100 : req->nbytes, 1);
    335 #endif
    336
    337 ablkcipher_unmap(qidev, edesc, req);
    338 diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
    339 index 6f44ccb55c63..3d639f3b45aa 100644
    340 --- a/drivers/crypto/caam/error.c
    341 +++ b/drivers/crypto/caam/error.c
    342 @@ -9,6 +9,46 @@
    343 #include "desc.h"
    344 #include "error.h"
    345
    346 +#ifdef DEBUG
    347 +#include <linux/highmem.h>
    348 +
    349 +void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
    350 + int rowsize, int groupsize, struct scatterlist *sg,
    351 + size_t tlen, bool ascii)
    352 +{
    353 + struct scatterlist *it;
    354 + void *it_page;
    355 + size_t len;
    356 + void *buf;
    357 +
    358 + for (it = sg; it && tlen > 0 ; it = sg_next(sg)) {
    359 + /*
    360 + * make sure the scatterlist's page
    361 + * has a valid virtual memory mapping
    362 + */
    363 + it_page = kmap_atomic(sg_page(it));
    364 + if (unlikely(!it_page)) {
    365 + pr_err("caam_dump_sg: kmap failed\n");
    366 + return;
    367 + }
    368 +
    369 + buf = it_page + it->offset;
    370 + len = min_t(size_t, tlen, it->length);
    371 + print_hex_dump(level, prefix_str, prefix_type, rowsize,
    372 + groupsize, buf, len, ascii);
    373 + tlen -= len;
    374 +
    375 + kunmap_atomic(it_page);
    376 + }
    377 +}
    378 +#else
    379 +void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
    380 + int rowsize, int groupsize, struct scatterlist *sg,
    381 + size_t tlen, bool ascii)
    382 +{}
    383 +#endif /* DEBUG */
    384 +EXPORT_SYMBOL(caam_dump_sg);
    385 +
    386 static const struct {
    387 u8 value;
    388 const char *error_text;
    389 diff --git a/drivers/crypto/caam/error.h b/drivers/crypto/caam/error.h
    390 index b6350b0d9153..250e1a21c473 100644
    391 --- a/drivers/crypto/caam/error.h
    392 +++ b/drivers/crypto/caam/error.h
    393 @@ -8,4 +8,8 @@
    394 #define CAAM_ERROR_H
    395 #define CAAM_ERROR_STR_MAX 302
    396 void caam_jr_strstatus(struct device *jrdev, u32 status);
    397 +
    398 +void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
    399 + int rowsize, int groupsize, struct scatterlist *sg,
    400 + size_t tlen, bool ascii);
    401 #endif /* CAAM_ERROR_H */
    402 diff --git a/drivers/crypto/caam/qi.c b/drivers/crypto/caam/qi.c
    403 index 1990ed460c46..53aed5816416 100644
    404 --- a/drivers/crypto/caam/qi.c
    405 +++ b/drivers/crypto/caam/qi.c
    406 @@ -55,6 +55,7 @@ struct caam_qi_pcpu_priv {
    407 } ____cacheline_aligned;
    408
    409 static DEFINE_PER_CPU(struct caam_qi_pcpu_priv, pcpu_qipriv);
    410 +static DEFINE_PER_CPU(int, last_cpu);
    411
    412 /*
    413 * caam_qi_priv - CAAM QI backend private params
    414 @@ -392,7 +393,6 @@ struct caam_drv_ctx *caam_drv_ctx_init(struct device *qidev,
    415 dma_addr_t hwdesc;
    416 struct caam_drv_ctx *drv_ctx;
    417 const cpumask_t *cpus = qman_affine_cpus();
    418 - static DEFINE_PER_CPU(int, last_cpu);
    419
    420 num_words = desc_len(sh_desc);
    421 if (num_words > MAX_SDLEN) {
    422 diff --git a/drivers/fpga/altera-hps2fpga.c b/drivers/fpga/altera-hps2fpga.c
    423 index 3066b805f2d0..08c0ecb7d109 100644
    424 --- a/drivers/fpga/altera-hps2fpga.c
    425 +++ b/drivers/fpga/altera-hps2fpga.c
    426 @@ -66,7 +66,7 @@ static int alt_hps2fpga_enable_show(struct fpga_bridge *bridge)
    427
    428 /* The L3 REMAP register is write only, so keep a cached value. */
    429 static unsigned int l3_remap_shadow;
    430 -static spinlock_t l3_remap_lock;
    431 +static DEFINE_SPINLOCK(l3_remap_lock);
    432
    433 static int _alt_hps2fpga_enable_set(struct altera_hps2fpga_data *priv,
    434 bool enable)
    435 @@ -171,8 +171,6 @@ static int alt_fpga_bridge_probe(struct platform_device *pdev)
    436 return -EBUSY;
    437 }
    438
    439 - spin_lock_init(&l3_remap_lock);
    440 -
    441 if (!of_property_read_u32(dev->of_node, "bridge-enable", &enable)) {
    442 if (enable > 1) {
    443 dev_warn(dev, "invalid bridge-enable %u > 1\n", enable);
    444 diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
    445 index ae5f06895562..da2745b3d0a7 100644
    446 --- a/drivers/gpu/drm/drm_dp_mst_topology.c
    447 +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
    448 @@ -2540,8 +2540,8 @@ int drm_dp_atomic_find_vcpi_slots(struct drm_atomic_state *state,
    449 int req_slots;
    450
    451 topology_state = drm_atomic_get_mst_topology_state(state, mgr);
    452 - if (topology_state == NULL)
    453 - return -ENOMEM;
    454 + if (IS_ERR(topology_state))
    455 + return PTR_ERR(topology_state);
    456
    457 port = drm_dp_get_validated_port_ref(mgr, port);
    458 if (port == NULL)
    459 @@ -2580,8 +2580,8 @@ int drm_dp_atomic_release_vcpi_slots(struct drm_atomic_state *state,
    460 struct drm_dp_mst_topology_state *topology_state;
    461
    462 topology_state = drm_atomic_get_mst_topology_state(state, mgr);
    463 - if (topology_state == NULL)
    464 - return -ENOMEM;
    465 + if (IS_ERR(topology_state))
    466 + return PTR_ERR(topology_state);
    467
    468 /* We cannot rely on port->vcpi.num_slots to update
    469 * topology_state->avail_slots as the port may not exist if the parent
    470 diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
    471 index 2bc0dc985214..3d35ea3e95db 100644
    472 --- a/drivers/gpu/drm/nouveau/nv50_display.c
    473 +++ b/drivers/gpu/drm/nouveau/nv50_display.c
    474 @@ -4134,7 +4134,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
    475 if (!nonblock) {
    476 ret = drm_atomic_helper_wait_for_fences(dev, state, true);
    477 if (ret)
    478 - goto done;
    479 + goto err_cleanup;
    480 }
    481
    482 for_each_plane_in_state(state, plane, plane_state, i) {
    483 @@ -4162,7 +4162,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
    484 if (crtc->state->enable) {
    485 if (!drm->have_disp_power_ref) {
    486 drm->have_disp_power_ref = true;
    487 - return ret;
    488 + return 0;
    489 }
    490 active = true;
    491 break;
    492 @@ -4174,6 +4174,9 @@ nv50_disp_atomic_commit(struct drm_device *dev,
    493 drm->have_disp_power_ref = false;
    494 }
    495
    496 +err_cleanup:
    497 + if (ret)
    498 + drm_atomic_helper_cleanup_planes(dev, state);
    499 done:
    500 pm_runtime_put_autosuspend(dev->dev);
    501 return ret;
    502 diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
    503 index eb9b278198b2..a4cb82495cee 100644
    504 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
    505 +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
    506 @@ -192,6 +192,10 @@ nvkm_pci_new_(const struct nvkm_pci_func *func, struct nvkm_device *device,
    507 }
    508 }
    509
    510 +#ifdef __BIG_ENDIAN
    511 + pci->msi = false;
    512 +#endif
    513 +
    514 pci->msi = nvkm_boolopt(device->cfgopt, "NvMSI", pci->msi);
    515 if (pci->msi && func->msi_rearm) {
    516 pci->msi = pci_enable_msi(pci->pdev) == 0;
    517 diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
    518 index eeddc1e48409..871599826773 100644
    519 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
    520 +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
    521 @@ -615,7 +615,7 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool,
    522 } else {
    523 pr_err("Failed to fill pool (%p)\n", pool);
    524 /* If we have any pages left put them to the pool. */
    525 - list_for_each_entry(p, &pool->list, lru) {
    526 + list_for_each_entry(p, &new_pages, lru) {
    527 ++cpages;
    528 }
    529 list_splice(&new_pages, &pool->list);
    530 diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
    531 index 18f401b442c2..c938af8c40cf 100644
    532 --- a/drivers/gpu/drm/vgem/vgem_drv.c
    533 +++ b/drivers/gpu/drm/vgem/vgem_drv.c
    534 @@ -52,6 +52,7 @@ static void vgem_gem_free_object(struct drm_gem_object *obj)
    535 struct drm_vgem_gem_object *vgem_obj = to_vgem_bo(obj);
    536
    537 kvfree(vgem_obj->pages);
    538 + mutex_destroy(&vgem_obj->pages_lock);
    539
    540 if (obj->import_attach)
    541 drm_prime_gem_destroy(obj, vgem_obj->table);
    542 @@ -76,11 +77,15 @@ static int vgem_gem_fault(struct vm_fault *vmf)
    543 if (page_offset > num_pages)
    544 return VM_FAULT_SIGBUS;
    545
    546 + ret = -ENOENT;
    547 + mutex_lock(&obj->pages_lock);
    548 if (obj->pages) {
    549 get_page(obj->pages[page_offset]);
    550 vmf->page = obj->pages[page_offset];
    551 ret = 0;
    552 - } else {
    553 + }
    554 + mutex_unlock(&obj->pages_lock);
    555 + if (ret) {
    556 struct page *page;
    557
    558 page = shmem_read_mapping_page(
    559 @@ -161,6 +166,8 @@ static struct drm_vgem_gem_object *__vgem_gem_create(struct drm_device *dev,
    560 return ERR_PTR(ret);
    561 }
    562
    563 + mutex_init(&obj->pages_lock);
    564 +
    565 return obj;
    566 }
    567
    568 @@ -274,37 +281,66 @@ static const struct file_operations vgem_driver_fops = {
    569 .release = drm_release,
    570 };
    571
    572 +static struct page **vgem_pin_pages(struct drm_vgem_gem_object *bo)
    573 +{
    574 + mutex_lock(&bo->pages_lock);
    575 + if (bo->pages_pin_count++ == 0) {
    576 + struct page **pages;
    577 +
    578 + pages = drm_gem_get_pages(&bo->base);
    579 + if (IS_ERR(pages)) {
    580 + bo->pages_pin_count--;
    581 + mutex_unlock(&bo->pages_lock);
    582 + return pages;
    583 + }
    584 +
    585 + bo->pages = pages;
    586 + }
    587 + mutex_unlock(&bo->pages_lock);
    588 +
    589 + return bo->pages;
    590 +}
    591 +
    592 +static void vgem_unpin_pages(struct drm_vgem_gem_object *bo)
    593 +{
    594 + mutex_lock(&bo->pages_lock);
    595 + if (--bo->pages_pin_count == 0) {
    596 + drm_gem_put_pages(&bo->base, bo->pages, true, true);
    597 + bo->pages = NULL;
    598 + }
    599 + mutex_unlock(&bo->pages_lock);
    600 +}
    601 +
    602 static int vgem_prime_pin(struct drm_gem_object *obj)
    603 {
    604 + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    605 long n_pages = obj->size >> PAGE_SHIFT;
    606 struct page **pages;
    607
    608 - /* Flush the object from the CPU cache so that importers can rely
    609 - * on coherent indirect access via the exported dma-address.
    610 - */
    611 - pages = drm_gem_get_pages(obj);
    612 + pages = vgem_pin_pages(bo);
    613 if (IS_ERR(pages))
    614 return PTR_ERR(pages);
    615
    616 + /* Flush the object from the CPU cache so that importers can rely
    617 + * on coherent indirect access via the exported dma-address.
    618 + */
    619 drm_clflush_pages(pages, n_pages);
    620 - drm_gem_put_pages(obj, pages, true, false);
    621
    622 return 0;
    623 }
    624
    625 -static struct sg_table *vgem_prime_get_sg_table(struct drm_gem_object *obj)
    626 +static void vgem_prime_unpin(struct drm_gem_object *obj)
    627 {
    628 - struct sg_table *st;
    629 - struct page **pages;
    630 + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    631
    632 - pages = drm_gem_get_pages(obj);
    633 - if (IS_ERR(pages))
    634 - return ERR_CAST(pages);
    635 + vgem_unpin_pages(bo);
    636 +}
    637
    638 - st = drm_prime_pages_to_sg(pages, obj->size >> PAGE_SHIFT);
    639 - drm_gem_put_pages(obj, pages, false, false);
    640 +static struct sg_table *vgem_prime_get_sg_table(struct drm_gem_object *obj)
    641 +{
    642 + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    643
    644 - return st;
    645 + return drm_prime_pages_to_sg(bo->pages, bo->base.size >> PAGE_SHIFT);
    646 }
    647
    648 static struct drm_gem_object* vgem_prime_import(struct drm_device *dev,
    649 @@ -333,6 +369,8 @@ static struct drm_gem_object *vgem_prime_import_sg_table(struct drm_device *dev,
    650 __vgem_gem_destroy(obj);
    651 return ERR_PTR(-ENOMEM);
    652 }
    653 +
    654 + obj->pages_pin_count++; /* perma-pinned */
    655 drm_prime_sg_to_page_addr_arrays(obj->table, obj->pages, NULL,
    656 npages);
    657 return &obj->base;
    658 @@ -340,23 +378,23 @@ static struct drm_gem_object *vgem_prime_import_sg_table(struct drm_device *dev,
    659
    660 static void *vgem_prime_vmap(struct drm_gem_object *obj)
    661 {
    662 + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    663 long n_pages = obj->size >> PAGE_SHIFT;
    664 struct page **pages;
    665 - void *addr;
    666
    667 - pages = drm_gem_get_pages(obj);
    668 + pages = vgem_pin_pages(bo);
    669 if (IS_ERR(pages))
    670 return NULL;
    671
    672 - addr = vmap(pages, n_pages, 0, pgprot_writecombine(PAGE_KERNEL));
    673 - drm_gem_put_pages(obj, pages, false, false);
    674 -
    675 - return addr;
    676 + return vmap(pages, n_pages, 0, pgprot_writecombine(PAGE_KERNEL));
    677 }
    678
    679 static void vgem_prime_vunmap(struct drm_gem_object *obj, void *vaddr)
    680 {
    681 + struct drm_vgem_gem_object *bo = to_vgem_bo(obj);
    682 +
    683 vunmap(vaddr);
    684 + vgem_unpin_pages(bo);
    685 }
    686
    687 static int vgem_prime_mmap(struct drm_gem_object *obj,
    688 @@ -409,6 +447,7 @@ static struct drm_driver vgem_driver = {
    689 .prime_handle_to_fd = drm_gem_prime_handle_to_fd,
    690 .prime_fd_to_handle = drm_gem_prime_fd_to_handle,
    691 .gem_prime_pin = vgem_prime_pin,
    692 + .gem_prime_unpin = vgem_prime_unpin,
    693 .gem_prime_import = vgem_prime_import,
    694 .gem_prime_export = drm_gem_prime_export,
    695 .gem_prime_import_sg_table = vgem_prime_import_sg_table,
    696 diff --git a/drivers/gpu/drm/vgem/vgem_drv.h b/drivers/gpu/drm/vgem/vgem_drv.h
    697 index 1aae01419112..5c8f6d619ff3 100644
    698 --- a/drivers/gpu/drm/vgem/vgem_drv.h
    699 +++ b/drivers/gpu/drm/vgem/vgem_drv.h
    700 @@ -43,7 +43,11 @@ struct vgem_file {
    701 #define to_vgem_bo(x) container_of(x, struct drm_vgem_gem_object, base)
    702 struct drm_vgem_gem_object {
    703 struct drm_gem_object base;
    704 +
    705 struct page **pages;
    706 + unsigned int pages_pin_count;
    707 + struct mutex pages_lock;
    708 +
    709 struct sg_table *table;
    710 };
    711
    712 diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
    713 index 9f940293ede4..bb17d7bbefd3 100644
    714 --- a/drivers/hid/wacom_wac.c
    715 +++ b/drivers/hid/wacom_wac.c
    716 @@ -1846,7 +1846,13 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
    717 features->device_type |= WACOM_DEVICETYPE_PAD;
    718 break;
    719 case WACOM_HID_WD_TOUCHRINGSTATUS:
    720 - wacom_map_usage(input, usage, field, EV_ABS, ABS_WHEEL, 0);
    721 + /*
    722 + * Only set up type/code association. Completely mapping
    723 + * this usage may overwrite the axis resolution and range.
    724 + */
    725 + usage->type = EV_ABS;
    726 + usage->code = ABS_WHEEL;
    727 + set_bit(EV_ABS, input->evbit);
    728 features->device_type |= WACOM_DEVICETYPE_PAD;
    729 break;
    730 case WACOM_HID_WD_BUTTONCONFIG:
    731 diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
    732 index 590cf90dd21a..da40df2ff27d 100644
    733 --- a/drivers/hwtracing/intel_th/pci.c
    734 +++ b/drivers/hwtracing/intel_th/pci.c
    735 @@ -95,6 +95,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
    736 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e),
    737 .driver_data = (kernel_ulong_t)0,
    738 },
    739 + {
    740 + /* Cannon Lake H */
    741 + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa326),
    742 + .driver_data = (kernel_ulong_t)0,
    743 + },
    744 + {
    745 + /* Cannon Lake LP */
    746 + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6),
    747 + .driver_data = (kernel_ulong_t)0,
    748 + },
    749 { 0 },
    750 };
    751
    752 diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
    753 index 884b8e461b17..9c501e5042fb 100644
    754 --- a/drivers/iio/adc/ti-ads1015.c
    755 +++ b/drivers/iio/adc/ti-ads1015.c
    756 @@ -81,18 +81,12 @@ static const unsigned int ads1115_data_rate[] = {
    757 8, 16, 32, 64, 128, 250, 475, 860
    758 };
    759
    760 -static const struct {
    761 - int scale;
    762 - int uscale;
    763 -} ads1015_scale[] = {
    764 - {3, 0},
    765 - {2, 0},
    766 - {1, 0},
    767 - {0, 500000},
    768 - {0, 250000},
    769 - {0, 125000},
    770 - {0, 125000},
    771 - {0, 125000},
    772 +/*
    773 + * Translation from PGA bits to full-scale positive and negative input voltage
    774 + * range in mV
    775 + */
    776 +static int ads1015_fullscale_range[] = {
    777 + 6144, 4096, 2048, 1024, 512, 256, 256, 256
    778 };
    779
    780 #define ADS1015_V_CHAN(_chan, _addr) { \
    781 @@ -183,6 +177,12 @@ struct ads1015_data {
    782 struct ads1015_channel_data channel_data[ADS1015_CHANNELS];
    783
    784 unsigned int *data_rate;
    785 + /*
    786 + * Set to true when the ADC is switched to the continuous-conversion
    787 + * mode and exits from a power-down state. This flag is used to avoid
    788 + * getting the stale result from the conversion register.
    789 + */
    790 + bool conv_invalid;
    791 };
    792
    793 static bool ads1015_is_writeable_reg(struct device *dev, unsigned int reg)
    794 @@ -235,33 +235,43 @@ static int ads1015_set_power_state(struct ads1015_data *data, bool on)
    795 ret = pm_runtime_put_autosuspend(dev);
    796 }
    797
    798 - return ret;
    799 + return ret < 0 ? ret : 0;
    800 }
    801
    802 static
    803 int ads1015_get_adc_result(struct ads1015_data *data, int chan, int *val)
    804 {
    805 int ret, pga, dr, conv_time;
    806 - bool change;
    807 + unsigned int old, mask, cfg;
    808
    809 if (chan < 0 || chan >= ADS1015_CHANNELS)
    810 return -EINVAL;
    811
    812 + ret = regmap_read(data->regmap, ADS1015_CFG_REG, &old);
    813 + if (ret)
    814 + return ret;
    815 +
    816 pga = data->channel_data[chan].pga;
    817 dr = data->channel_data[chan].data_rate;
    818 + mask = ADS1015_CFG_MUX_MASK | ADS1015_CFG_PGA_MASK |
    819 + ADS1015_CFG_DR_MASK;
    820 + cfg = chan << ADS1015_CFG_MUX_SHIFT | pga << ADS1015_CFG_PGA_SHIFT |
    821 + dr << ADS1015_CFG_DR_SHIFT;
    822
    823 - ret = regmap_update_bits_check(data->regmap, ADS1015_CFG_REG,
    824 - ADS1015_CFG_MUX_MASK |
    825 - ADS1015_CFG_PGA_MASK,
    826 - chan << ADS1015_CFG_MUX_SHIFT |
    827 - pga << ADS1015_CFG_PGA_SHIFT,
    828 - &change);
    829 - if (ret < 0)
    830 + cfg = (old & ~mask) | (cfg & mask);
    831 +
    832 + ret = regmap_write(data->regmap, ADS1015_CFG_REG, cfg);
    833 + if (ret)
    834 return ret;
    835
    836 - if (change) {
    837 - conv_time = DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr]);
    838 + if (old != cfg || data->conv_invalid) {
    839 + int dr_old = (old & ADS1015_CFG_DR_MASK) >>
    840 + ADS1015_CFG_DR_SHIFT;
    841 +
    842 + conv_time = DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr_old]);
    843 + conv_time += DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr]);
    844 usleep_range(conv_time, conv_time + 1);
    845 + data->conv_invalid = false;
    846 }
    847
    848 return regmap_read(data->regmap, ADS1015_CONV_REG, val);
    849 @@ -298,17 +308,20 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p)
    850 return IRQ_HANDLED;
    851 }
    852
    853 -static int ads1015_set_scale(struct ads1015_data *data, int chan,
    854 +static int ads1015_set_scale(struct ads1015_data *data,
    855 + struct iio_chan_spec const *chan,
    856 int scale, int uscale)
    857 {
    858 int i, ret, rindex = -1;
    859 + int fullscale = div_s64((scale * 1000000LL + uscale) <<
    860 + (chan->scan_type.realbits - 1), 1000000);
    861
    862 - for (i = 0; i < ARRAY_SIZE(ads1015_scale); i++)
    863 - if (ads1015_scale[i].scale == scale &&
    864 - ads1015_scale[i].uscale == uscale) {
    865 + for (i = 0; i < ARRAY_SIZE(ads1015_fullscale_range); i++) {
    866 + if (ads1015_fullscale_range[i] == fullscale) {
    867 rindex = i;
    868 break;
    869 }
    870 + }
    871 if (rindex < 0)
    872 return -EINVAL;
    873
    874 @@ -318,32 +331,23 @@ static int ads1015_set_scale(struct ads1015_data *data, int chan,
    875 if (ret < 0)
    876 return ret;
    877
    878 - data->channel_data[chan].pga = rindex;
    879 + data->channel_data[chan->address].pga = rindex;
    880
    881 return 0;
    882 }
    883
    884 static int ads1015_set_data_rate(struct ads1015_data *data, int chan, int rate)
    885 {
    886 - int i, ret, rindex = -1;
    887 + int i;
    888
    889 - for (i = 0; i < ARRAY_SIZE(ads1015_data_rate); i++)
    890 + for (i = 0; i < ARRAY_SIZE(ads1015_data_rate); i++) {
    891 if (data->data_rate[i] == rate) {
    892 - rindex = i;
    893 - break;
    894 + data->channel_data[chan].data_rate = i;
    895 + return 0;
    896 }
    897 - if (rindex < 0)
    898 - return -EINVAL;
    899 -
    900 - ret = regmap_update_bits(data->regmap, ADS1015_CFG_REG,
    901 - ADS1015_CFG_DR_MASK,
    902 - rindex << ADS1015_CFG_DR_SHIFT);
    903 - if (ret < 0)
    904 - return ret;
    905 -
    906 - data->channel_data[chan].data_rate = rindex;
    907 + }
    908
    909 - return 0;
    910 + return -EINVAL;
    911 }
    912
    913 static int ads1015_read_raw(struct iio_dev *indio_dev,
    914 @@ -385,9 +389,9 @@ static int ads1015_read_raw(struct iio_dev *indio_dev,
    915 }
    916 case IIO_CHAN_INFO_SCALE:
    917 idx = data->channel_data[chan->address].pga;
    918 - *val = ads1015_scale[idx].scale;
    919 - *val2 = ads1015_scale[idx].uscale;
    920 - ret = IIO_VAL_INT_PLUS_MICRO;
    921 + *val = ads1015_fullscale_range[idx];
    922 + *val2 = chan->scan_type.realbits - 1;
    923 + ret = IIO_VAL_FRACTIONAL_LOG2;
    924 break;
    925 case IIO_CHAN_INFO_SAMP_FREQ:
    926 idx = data->channel_data[chan->address].data_rate;
    927 @@ -414,7 +418,7 @@ static int ads1015_write_raw(struct iio_dev *indio_dev,
    928 mutex_lock(&data->lock);
    929 switch (mask) {
    930 case IIO_CHAN_INFO_SCALE:
    931 - ret = ads1015_set_scale(data, chan->address, val, val2);
    932 + ret = ads1015_set_scale(data, chan, val, val2);
    933 break;
    934 case IIO_CHAN_INFO_SAMP_FREQ:
    935 ret = ads1015_set_data_rate(data, chan->address, val);
    936 @@ -446,7 +450,10 @@ static const struct iio_buffer_setup_ops ads1015_buffer_setup_ops = {
    937 .validate_scan_mask = &iio_validate_scan_mask_onehot,
    938 };
    939
    940 -static IIO_CONST_ATTR(scale_available, "3 2 1 0.5 0.25 0.125");
    941 +static IIO_CONST_ATTR_NAMED(ads1015_scale_available, scale_available,
    942 + "3 2 1 0.5 0.25 0.125");
    943 +static IIO_CONST_ATTR_NAMED(ads1115_scale_available, scale_available,
    944 + "0.1875 0.125 0.0625 0.03125 0.015625 0.007813");
    945
    946 static IIO_CONST_ATTR_NAMED(ads1015_sampling_frequency_available,
    947 sampling_frequency_available, "128 250 490 920 1600 2400 3300");
    948 @@ -454,7 +461,7 @@ static IIO_CONST_ATTR_NAMED(ads1115_sampling_frequency_available,
    949 sampling_frequency_available, "8 16 32 64 128 250 475 860");
    950
    951 static struct attribute *ads1015_attributes[] = {
    952 - &iio_const_attr_scale_available.dev_attr.attr,
    953 + &iio_const_attr_ads1015_scale_available.dev_attr.attr,
    954 &iio_const_attr_ads1015_sampling_frequency_available.dev_attr.attr,
    955 NULL,
    956 };
    957 @@ -464,7 +471,7 @@ static const struct attribute_group ads1015_attribute_group = {
    958 };
    959
    960 static struct attribute *ads1115_attributes[] = {
    961 - &iio_const_attr_scale_available.dev_attr.attr,
    962 + &iio_const_attr_ads1115_scale_available.dev_attr.attr,
    963 &iio_const_attr_ads1115_sampling_frequency_available.dev_attr.attr,
    964 NULL,
    965 };
    966 @@ -630,6 +637,15 @@ static int ads1015_probe(struct i2c_client *client,
    967 dev_err(&client->dev, "iio triggered buffer setup failed\n");
    968 return ret;
    969 }
    970 +
    971 + ret = regmap_update_bits(data->regmap, ADS1015_CFG_REG,
    972 + ADS1015_CFG_MOD_MASK,
    973 + ADS1015_CONTINUOUS << ADS1015_CFG_MOD_SHIFT);
    974 + if (ret)
    975 + return ret;
    976 +
    977 + data->conv_invalid = true;
    978 +
    979 ret = pm_runtime_set_active(&client->dev);
    980 if (ret)
    981 goto err_buffer_cleanup;
    982 @@ -685,10 +701,15 @@ static int ads1015_runtime_resume(struct device *dev)
    983 {
    984 struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
    985 struct ads1015_data *data = iio_priv(indio_dev);
    986 + int ret;
    987
    988 - return regmap_update_bits(data->regmap, ADS1015_CFG_REG,
    989 + ret = regmap_update_bits(data->regmap, ADS1015_CFG_REG,
    990 ADS1015_CFG_MOD_MASK,
    991 ADS1015_CONTINUOUS << ADS1015_CFG_MOD_SHIFT);
    992 + if (!ret)
    993 + data->conv_invalid = true;
    994 +
    995 + return ret;
    996 }
    997 #endif
    998
    999 diff --git a/drivers/mcb/mcb-lpc.c b/drivers/mcb/mcb-lpc.c
    1000 index d072c088ce73..945091a88354 100644
    1001 --- a/drivers/mcb/mcb-lpc.c
    1002 +++ b/drivers/mcb/mcb-lpc.c
    1003 @@ -114,6 +114,12 @@ static struct resource sc24_fpga_resource = {
    1004 .flags = IORESOURCE_MEM,
    1005 };
    1006
    1007 +static struct resource sc31_fpga_resource = {
    1008 + .start = 0xf000e000,
    1009 + .end = 0xf000e000 + CHAM_HEADER_SIZE,
    1010 + .flags = IORESOURCE_MEM,
    1011 +};
    1012 +
    1013 static struct platform_driver mcb_lpc_driver = {
    1014 .driver = {
    1015 .name = "mcb-lpc",
    1016 @@ -132,6 +138,15 @@ static const struct dmi_system_id mcb_lpc_dmi_table[] = {
    1017 .driver_data = (void *)&sc24_fpga_resource,
    1018 .callback = mcb_lpc_create_platform_device,
    1019 },
    1020 + {
    1021 + .ident = "SC31",
    1022 + .matches = {
    1023 + DMI_MATCH(DMI_SYS_VENDOR, "MEN"),
    1024 + DMI_MATCH(DMI_PRODUCT_VERSION, "14SC31"),
    1025 + },
    1026 + .driver_data = (void *)&sc31_fpga_resource,
    1027 + .callback = mcb_lpc_create_platform_device,
    1028 + },
    1029 {}
    1030 };
    1031 MODULE_DEVICE_TABLE(dmi, mcb_lpc_dmi_table);
    1032 diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
    1033 index 75c5c903c8a6..53fa5b7380ff 100644
    1034 --- a/drivers/net/wireless/ath/ath10k/core.c
    1035 +++ b/drivers/net/wireless/ath/ath10k/core.c
    1036 @@ -2055,6 +2055,12 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode,
    1037 goto err_wmi_detach;
    1038 }
    1039
    1040 + /* If firmware indicates Full Rx Reorder support it must be used in a
    1041 + * slightly different manner. Let HTT code know.
    1042 + */
    1043 + ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
    1044 + ar->wmi.svc_map));
    1045 +
    1046 status = ath10k_htt_rx_alloc(&ar->htt);
    1047 if (status) {
    1048 ath10k_err(ar, "failed to alloc htt rx: %d\n", status);
    1049 @@ -2167,12 +2173,6 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode,
    1050 }
    1051 }
    1052
    1053 - /* If firmware indicates Full Rx Reorder support it must be used in a
    1054 - * slightly different manner. Let HTT code know.
    1055 - */
    1056 - ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
    1057 - ar->wmi.svc_map));
    1058 -
    1059 status = ath10k_htt_rx_ring_refill(ar);
    1060 if (status) {
    1061 ath10k_err(ar, "failed to refill htt rx ring: %d\n", status);
    1062 diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
    1063 index 84f4ba01e14f..875374e4747d 100644
    1064 --- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
    1065 +++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
    1066 @@ -430,6 +430,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
    1067 {IWL_PCI_DEVICE(0x095B, 0x520A, iwl7265_2ac_cfg)},
    1068 {IWL_PCI_DEVICE(0x095A, 0x9000, iwl7265_2ac_cfg)},
    1069 {IWL_PCI_DEVICE(0x095A, 0x9400, iwl7265_2ac_cfg)},
    1070 + {IWL_PCI_DEVICE(0x095A, 0x9E10, iwl7265_2ac_cfg)},
    1071
    1072 /* 8000 Series */
    1073 {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
    1074 diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
    1075 index 06ad2d50f9b0..fdfdf2371986 100644
    1076 --- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
    1077 +++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
    1078 @@ -4215,7 +4215,7 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
    1079 if (adapter->config_bands & BAND_A)
    1080 n_channels_a = mwifiex_band_5ghz.n_channels;
    1081
    1082 - adapter->num_in_chan_stats = max_t(u32, n_channels_bg, n_channels_a);
    1083 + adapter->num_in_chan_stats = n_channels_bg + n_channels_a;
    1084 adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) *
    1085 adapter->num_in_chan_stats);
    1086
    1087 diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
    1088 index ae9630b49342..9900855746ac 100644
    1089 --- a/drivers/net/wireless/marvell/mwifiex/scan.c
    1090 +++ b/drivers/net/wireless/marvell/mwifiex/scan.c
    1091 @@ -2492,6 +2492,12 @@ mwifiex_update_chan_statistics(struct mwifiex_private *priv,
    1092 sizeof(struct mwifiex_chan_stats);
    1093
    1094 for (i = 0 ; i < num_chan; i++) {
    1095 + if (adapter->survey_idx >= adapter->num_in_chan_stats) {
    1096 + mwifiex_dbg(adapter, WARN,
    1097 + "FW reported too many channel results (max %d)\n",
    1098 + adapter->num_in_chan_stats);
    1099 + return;
    1100 + }
    1101 chan_stats.chan_num = fw_chan_stats->chan_num;
    1102 chan_stats.bandcfg = fw_chan_stats->bandcfg;
    1103 chan_stats.flags = fw_chan_stats->flags;
    1104 diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
    1105 index 032b6317690d..08dc8919ef60 100644
    1106 --- a/drivers/net/wireless/realtek/rtlwifi/pci.c
    1107 +++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
    1108 @@ -2257,7 +2257,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
    1109 /* find adapter */
    1110 if (!_rtl_pci_find_adapter(pdev, hw)) {
    1111 err = -ENODEV;
    1112 - goto fail3;
    1113 + goto fail2;
    1114 }
    1115
    1116 /* Init IO handler */
    1117 @@ -2318,10 +2318,10 @@ int rtl_pci_probe(struct pci_dev *pdev,
    1118 pci_set_drvdata(pdev, NULL);
    1119 rtl_deinit_core(hw);
    1120
    1121 +fail2:
    1122 if (rtlpriv->io.pci_mem_start != 0)
    1123 pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
    1124
    1125 -fail2:
    1126 pci_release_regions(pdev);
    1127 complete(&rtlpriv->firmware_loading_complete);
    1128
    1129 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
    1130 index 774e72058d24..bddd5a5ebe52 100644
    1131 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
    1132 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.c
    1133 @@ -175,6 +175,8 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
    1134 rtl_fw_cb);
    1135 if (err) {
    1136 pr_info("Failed to request firmware!\n");
    1137 + vfree(rtlpriv->rtlhal.pfirmware);
    1138 + rtlpriv->rtlhal.pfirmware = NULL;
    1139 return 1;
    1140 }
    1141
    1142 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
    1143 index bcbb0c60f1f1..38f85bfdf0c7 100644
    1144 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
    1145 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
    1146 @@ -176,6 +176,8 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
    1147 rtl_fw_cb);
    1148 if (err) {
    1149 pr_err("Failed to request firmware!\n");
    1150 + vfree(rtlpriv->rtlhal.pfirmware);
    1151 + rtlpriv->rtlhal.pfirmware = NULL;
    1152 return 1;
    1153 }
    1154
    1155 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
    1156 index 96c923b3feb4..e3eb850bb1de 100644
    1157 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
    1158 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/sw.c
    1159 @@ -85,6 +85,10 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
    1160 err = request_firmware_nowait(THIS_MODULE, 1,
    1161 fw_name, rtlpriv->io.dev,
    1162 GFP_KERNEL, hw, rtl_fw_cb);
    1163 + if (err) {
    1164 + vfree(rtlpriv->rtlhal.pfirmware);
    1165 + rtlpriv->rtlhal.pfirmware = NULL;
    1166 + }
    1167 return err;
    1168 }
    1169
    1170 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
    1171 index 16132c66e5e1..e38d6f7370aa 100644
    1172 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
    1173 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c
    1174 @@ -183,6 +183,8 @@ static int rtl92d_init_sw_vars(struct ieee80211_hw *hw)
    1175 rtl_fw_cb);
    1176 if (err) {
    1177 pr_err("Failed to request firmware!\n");
    1178 + vfree(rtlpriv->rtlhal.pfirmware);
    1179 + rtlpriv->rtlhal.pfirmware = NULL;
    1180 return 1;
    1181 }
    1182
    1183 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
    1184 index eaa503b7c4b4..745e9c32655c 100644
    1185 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
    1186 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/sw.c
    1187 @@ -177,6 +177,8 @@ int rtl92ee_init_sw_vars(struct ieee80211_hw *hw)
    1188 rtl_fw_cb);
    1189 if (err) {
    1190 pr_err("Failed to request firmware!\n");
    1191 + vfree(rtlpriv->rtlhal.pfirmware);
    1192 + rtlpriv->rtlhal.pfirmware = NULL;
    1193 return 1;
    1194 }
    1195
    1196 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
    1197 index 2006b09ea74f..1ec20efb9ce1 100644
    1198 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
    1199 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
    1200 @@ -216,6 +216,8 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
    1201 rtl92se_fw_cb);
    1202 if (err) {
    1203 pr_err("Failed to request firmware!\n");
    1204 + vfree(rtlpriv->rtlhal.pfirmware);
    1205 + rtlpriv->rtlhal.pfirmware = NULL;
    1206 return 1;
    1207 }
    1208
    1209 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
    1210 index 7bf9f2557920..aab86667a7f3 100644
    1211 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
    1212 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/sw.c
    1213 @@ -184,6 +184,8 @@ int rtl8723e_init_sw_vars(struct ieee80211_hw *hw)
    1214 rtl_fw_cb);
    1215 if (err) {
    1216 pr_err("Failed to request firmware!\n");
    1217 + vfree(rtlpriv->rtlhal.pfirmware);
    1218 + rtlpriv->rtlhal.pfirmware = NULL;
    1219 return 1;
    1220 }
    1221 return 0;
    1222 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
    1223 index f9d10f1e7cf8..f47d839f388d 100644
    1224 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
    1225 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/sw.c
    1226 @@ -187,16 +187,10 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
    1227 rtlpriv->io.dev, GFP_KERNEL, hw,
    1228 rtl_fw_cb);
    1229 if (err) {
    1230 - /* Failed to get firmware. Check if old version available */
    1231 - fw_name = "rtlwifi/rtl8723befw.bin";
    1232 - pr_info("Using firmware %s\n", fw_name);
    1233 - err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
    1234 - rtlpriv->io.dev, GFP_KERNEL, hw,
    1235 - rtl_fw_cb);
    1236 - if (err) {
    1237 - pr_err("Failed to request firmware!\n");
    1238 - return 1;
    1239 - }
    1240 + pr_err("Failed to request firmware!\n");
    1241 + vfree(rtlpriv->rtlhal.pfirmware);
    1242 + rtlpriv->rtlhal.pfirmware = NULL;
    1243 + return 1;
    1244 }
    1245 return 0;
    1246 }
    1247 @@ -287,6 +281,7 @@ static const struct rtl_hal_cfg rtl8723be_hal_cfg = {
    1248 .bar_id = 2,
    1249 .write_readback = true,
    1250 .name = "rtl8723be_pci",
    1251 + .alt_fw_name = "rtlwifi/rtl8723befw.bin",
    1252 .ops = &rtl8723be_hal_ops,
    1253 .mod_params = &rtl8723be_mod_params,
    1254 .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
    1255 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
    1256 index d71d2776ca03..5925edf7877f 100644
    1257 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
    1258 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/sw.c
    1259 @@ -196,6 +196,8 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
    1260 rtlpriv->rtlhal.wowlan_firmware = vzalloc(0x8000);
    1261 if (!rtlpriv->rtlhal.wowlan_firmware) {
    1262 pr_err("Can't alloc buffer for wowlan fw.\n");
    1263 + vfree(rtlpriv->rtlhal.pfirmware);
    1264 + rtlpriv->rtlhal.pfirmware = NULL;
    1265 return 1;
    1266 }
    1267
    1268 @@ -214,16 +216,10 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
    1269 rtlpriv->io.dev, GFP_KERNEL, hw,
    1270 rtl_fw_cb);
    1271 if (err) {
    1272 - /* Failed to get firmware. Check if old version available */
    1273 - fw_name = "rtlwifi/rtl8821aefw.bin";
    1274 - pr_info("Using firmware %s\n", fw_name);
    1275 - err = request_firmware_nowait(THIS_MODULE, 1, fw_name,
    1276 - rtlpriv->io.dev, GFP_KERNEL, hw,
    1277 - rtl_fw_cb);
    1278 - if (err) {
    1279 - pr_err("Failed to request normal firmware!\n");
    1280 - return 1;
    1281 - }
    1282 + pr_err("Failed to request normal firmware!\n");
    1283 + vfree(rtlpriv->rtlhal.wowlan_firmware);
    1284 + vfree(rtlpriv->rtlhal.pfirmware);
    1285 + return 1;
    1286 }
    1287 /*load wowlan firmware*/
    1288 pr_info("Using firmware %s\n", wowlan_fw_name);
    1289 @@ -233,6 +229,8 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
    1290 rtl_wowlan_fw_cb);
    1291 if (err) {
    1292 pr_err("Failed to request wowlan firmware!\n");
    1293 + vfree(rtlpriv->rtlhal.wowlan_firmware);
    1294 + vfree(rtlpriv->rtlhal.pfirmware);
    1295 return 1;
    1296 }
    1297 return 0;
    1298 @@ -325,6 +323,7 @@ static const struct rtl_hal_cfg rtl8821ae_hal_cfg = {
    1299 .bar_id = 2,
    1300 .write_readback = true,
    1301 .name = "rtl8821ae_pci",
    1302 + .alt_fw_name = "rtlwifi/rtl8821aefw.bin",
    1303 .ops = &rtl8821ae_hal_ops,
    1304 .mod_params = &rtl8821ae_mod_params,
    1305 .maps[SYS_ISO_CTRL] = REG_SYS_ISO_CTRL,
    1306 diff --git a/drivers/of/device.c b/drivers/of/device.c
    1307 index e0a28ea341fe..eabfa36383ce 100644
    1308 --- a/drivers/of/device.c
    1309 +++ b/drivers/of/device.c
    1310 @@ -274,6 +274,8 @@ ssize_t of_device_modalias(struct device *dev, char *str, ssize_t len)
    1311 ssize_t sl = of_device_get_modalias(dev, str, len - 2);
    1312 if (sl < 0)
    1313 return sl;
    1314 + if (sl > len - 2)
    1315 + return -ENOMEM;
    1316
    1317 str[sl++] = '\n';
    1318 str[sl] = 0;
    1319 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
    1320 index 84e782d8e7c3..aad6ebb51735 100644
    1321 --- a/drivers/scsi/sg.c
    1322 +++ b/drivers/scsi/sg.c
    1323 @@ -1233,6 +1233,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
    1324 unsigned long req_sz, len, sa;
    1325 Sg_scatter_hold *rsv_schp;
    1326 int k, length;
    1327 + int ret = 0;
    1328
    1329 if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
    1330 return -ENXIO;
    1331 @@ -1243,8 +1244,11 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
    1332 if (vma->vm_pgoff)
    1333 return -EINVAL; /* want no offset */
    1334 rsv_schp = &sfp->reserve;
    1335 - if (req_sz > rsv_schp->bufflen)
    1336 - return -ENOMEM; /* cannot map more than reserved buffer */
    1337 + mutex_lock(&sfp->f_mutex);
    1338 + if (req_sz > rsv_schp->bufflen) {
    1339 + ret = -ENOMEM; /* cannot map more than reserved buffer */
    1340 + goto out;
    1341 + }
    1342
    1343 sa = vma->vm_start;
    1344 length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
    1345 @@ -1258,7 +1262,9 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma)
    1346 vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
    1347 vma->vm_private_data = sfp;
    1348 vma->vm_ops = &sg_mmap_vm_ops;
    1349 - return 0;
    1350 +out:
    1351 + mutex_unlock(&sfp->f_mutex);
    1352 + return ret;
    1353 }
    1354
    1355 static void
    1356 @@ -1735,9 +1741,12 @@ sg_start_req(Sg_request *srp, unsigned char *cmd)
    1357 !sfp->res_in_use) {
    1358 sfp->res_in_use = 1;
    1359 sg_link_reserve(sfp, srp, dxfer_len);
    1360 - } else if ((hp->flags & SG_FLAG_MMAP_IO) && sfp->res_in_use) {
    1361 + } else if (hp->flags & SG_FLAG_MMAP_IO) {
    1362 + res = -EBUSY; /* sfp->res_in_use == 1 */
    1363 + if (dxfer_len > rsv_schp->bufflen)
    1364 + res = -ENOMEM;
    1365 mutex_unlock(&sfp->f_mutex);
    1366 - return -EBUSY;
    1367 + return res;
    1368 } else {
    1369 res = sg_build_indirect(req_schp, sfp, dxfer_len);
    1370 if (res) {
    1371 diff --git a/drivers/staging/ccree/ssi_cipher.c b/drivers/staging/ccree/ssi_cipher.c
    1372 index cd2eafc04232..bdc68830389f 100644
    1373 --- a/drivers/staging/ccree/ssi_cipher.c
    1374 +++ b/drivers/staging/ccree/ssi_cipher.c
    1375 @@ -23,6 +23,7 @@
    1376 #include <crypto/aes.h>
    1377 #include <crypto/ctr.h>
    1378 #include <crypto/des.h>
    1379 +#include <crypto/scatterwalk.h>
    1380
    1381 #include "ssi_config.h"
    1382 #include "ssi_driver.h"
    1383 @@ -716,6 +717,7 @@ static int ssi_blkcipher_complete(struct device *dev,
    1384 {
    1385 int completion_error = 0;
    1386 u32 inflight_counter;
    1387 + struct ablkcipher_request *req = (struct ablkcipher_request *)areq;
    1388
    1389 ssi_buffer_mgr_unmap_blkcipher_request(dev, req_ctx, ivsize, src, dst);
    1390
    1391 @@ -726,6 +728,22 @@ static int ssi_blkcipher_complete(struct device *dev,
    1392 ctx_p->drvdata->inflight_counter--;
    1393
    1394 if (areq) {
    1395 + /*
    1396 + * The crypto API expects us to set the req->info to the last
    1397 + * ciphertext block. For encrypt, simply copy from the result.
    1398 + * For decrypt, we must copy from a saved buffer since this
    1399 + * could be an in-place decryption operation and the src is
    1400 + * lost by this point.
    1401 + */
    1402 + if (req_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_DECRYPT) {
    1403 + memcpy(req->info, req_ctx->backup_info, ivsize);
    1404 + kfree(req_ctx->backup_info);
    1405 + } else {
    1406 + scatterwalk_map_and_copy(req->info, req->dst,
    1407 + (req->nbytes - ivsize),
    1408 + ivsize, 0);
    1409 + }
    1410 +
    1411 ablkcipher_request_complete(areq, completion_error);
    1412 return 0;
    1413 }
    1414 @@ -759,11 +777,13 @@ static int ssi_blkcipher_process(
    1415 if (unlikely(validate_data_size(ctx_p, nbytes))) {
    1416 SSI_LOG_ERR("Unsupported data size %d.\n", nbytes);
    1417 crypto_tfm_set_flags(tfm, CRYPTO_TFM_RES_BAD_BLOCK_LEN);
    1418 - return -EINVAL;
    1419 + rc = -EINVAL;
    1420 + goto exit_process;
    1421 }
    1422 if (nbytes == 0) {
    1423 /* No data to process is valid */
    1424 - return 0;
    1425 + rc = 0;
    1426 + goto exit_process;
    1427 }
    1428 /*For CTS in case of data size aligned to 16 use CBC mode*/
    1429 if (((nbytes % AES_BLOCK_SIZE) == 0) && (ctx_p->cipher_mode == DRV_CIPHER_CBC_CTS)) {
    1430 @@ -842,6 +862,9 @@ static int ssi_blkcipher_process(
    1431 if (cts_restore_flag != 0)
    1432 ctx_p->cipher_mode = DRV_CIPHER_CBC_CTS;
    1433
    1434 + if (rc != -EINPROGRESS)
    1435 + kfree(req_ctx->backup_info);
    1436 +
    1437 return rc;
    1438 }
    1439
    1440 @@ -884,7 +907,6 @@ static int ssi_ablkcipher_encrypt(struct ablkcipher_request *req)
    1441 struct blkcipher_req_ctx *req_ctx = ablkcipher_request_ctx(req);
    1442 unsigned int ivsize = crypto_ablkcipher_ivsize(ablk_tfm);
    1443
    1444 - req_ctx->backup_info = req->info;
    1445 req_ctx->is_giv = false;
    1446
    1447 return ssi_blkcipher_process(tfm, req_ctx, req->dst, req->src, req->nbytes, req->info, ivsize, (void *)req, DRV_CRYPTO_DIRECTION_ENCRYPT);
    1448 @@ -897,8 +919,18 @@ static int ssi_ablkcipher_decrypt(struct ablkcipher_request *req)
    1449 struct blkcipher_req_ctx *req_ctx = ablkcipher_request_ctx(req);
    1450 unsigned int ivsize = crypto_ablkcipher_ivsize(ablk_tfm);
    1451
    1452 - req_ctx->backup_info = req->info;
    1453 + /*
    1454 + * Allocate and save the last IV sized bytes of the source, which will
    1455 + * be lost in case of in-place decryption and might be needed for CTS.
    1456 + */
    1457 + req_ctx->backup_info = kmalloc(ivsize, GFP_KERNEL);
    1458 + if (!req_ctx->backup_info)
    1459 + return -ENOMEM;
    1460 +
    1461 + scatterwalk_map_and_copy(req_ctx->backup_info, req->src,
    1462 + (req->nbytes - ivsize), ivsize, 0);
    1463 req_ctx->is_giv = false;
    1464 +
    1465 return ssi_blkcipher_process(tfm, req_ctx, req->dst, req->src, req->nbytes, req->info, ivsize, (void *)req, DRV_CRYPTO_DIRECTION_DECRYPT);
    1466 }
    1467
    1468 diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h
    1469 index e6d28a249fc1..bfbabae1aad8 100644
    1470 --- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h
    1471 +++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h
    1472 @@ -123,8 +123,8 @@ struct dpaa2_eth_swa {
    1473 /* Error bits in FD CTRL */
    1474 #define DPAA2_FD_CTRL_UFD 0x00000004
    1475 #define DPAA2_FD_CTRL_SBE 0x00000008
    1476 -#define DPAA2_FD_CTRL_FSE 0x00000010
    1477 -#define DPAA2_FD_CTRL_FAERR 0x00000020
    1478 +#define DPAA2_FD_CTRL_FSE 0x00000020
    1479 +#define DPAA2_FD_CTRL_FAERR 0x00000040
    1480
    1481 #define DPAA2_FD_RX_ERR_MASK (DPAA2_FD_CTRL_SBE | \
    1482 DPAA2_FD_CTRL_FAERR)
    1483 diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c
    1484 index 36b5a11f21d2..a401b13f5f5e 100644
    1485 --- a/drivers/staging/rts5208/rtsx_scsi.c
    1486 +++ b/drivers/staging/rts5208/rtsx_scsi.c
    1487 @@ -414,7 +414,7 @@ void set_sense_data(struct rtsx_chip *chip, unsigned int lun, u8 err_code,
    1488 sense->ascq = ascq;
    1489 if (sns_key_info0 != 0) {
    1490 sense->sns_key_info[0] = SKSV | sns_key_info0;
    1491 - sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 8;
    1492 + sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 4;
    1493 sense->sns_key_info[2] = sns_key_info1 & 0x0f;
    1494 }
    1495 }
    1496 diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c
    1497 index 69c0232a22f8..fb40dd0588b9 100644
    1498 --- a/drivers/thunderbolt/ctl.c
    1499 +++ b/drivers/thunderbolt/ctl.c
    1500 @@ -804,7 +804,7 @@ struct tb_cfg_result tb_cfg_reset(struct tb_ctl *ctl, u64 route,
    1501 req->request_type = TB_CFG_PKG_RESET;
    1502 req->response = &reply;
    1503 req->response_size = sizeof(reply);
    1504 - req->response_type = sizeof(TB_CFG_PKG_RESET);
    1505 + req->response_type = TB_CFG_PKG_RESET;
    1506
    1507 res = tb_cfg_request_sync(ctl, req, timeout_msec);
    1508
    1509 diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    1510 index ebe27595c4af..0ff0feddfd1f 100644
    1511 --- a/drivers/usb/core/devio.c
    1512 +++ b/drivers/usb/core/devio.c
    1513 @@ -623,6 +623,8 @@ static void async_completed(struct urb *urb)
    1514 if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
    1515 as->status != -ENOENT)
    1516 cancel_bulk_urbs(ps, as->bulk_addr);
    1517 +
    1518 + wake_up(&ps->wait);
    1519 spin_unlock(&ps->lock);
    1520
    1521 if (signr) {
    1522 @@ -630,8 +632,6 @@ static void async_completed(struct urb *urb)
    1523 put_pid(pid);
    1524 put_cred(cred);
    1525 }
    1526 -
    1527 - wake_up(&ps->wait);
    1528 }
    1529
    1530 static void destroy_async(struct usb_dev_state *ps, struct list_head *list)
    1531 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    1532 index 574da2b4529c..82806e311202 100644
    1533 --- a/drivers/usb/core/quirks.c
    1534 +++ b/drivers/usb/core/quirks.c
    1535 @@ -57,8 +57,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    1536 /* Microsoft LifeCam-VX700 v2.0 */
    1537 { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
    1538
    1539 - /* Logitech HD Pro Webcams C920 and C930e */
    1540 + /* Logitech HD Pro Webcams C920, C920-C and C930e */
    1541 { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
    1542 + { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
    1543 { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
    1544
    1545 /* Logitech ConferenceCam CC3000e */
    1546 @@ -217,6 +218,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    1547 { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
    1548 USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
    1549
    1550 + /* Corsair Strafe RGB */
    1551 + { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
    1552 +
    1553 /* Acer C120 LED Projector */
    1554 { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
    1555
    1556 diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
    1557 index c8f38649f749..658d9d1f9ea3 100644
    1558 --- a/drivers/usb/host/pci-quirks.c
    1559 +++ b/drivers/usb/host/pci-quirks.c
    1560 @@ -142,29 +142,30 @@ static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo)
    1561 pinfo->sb_type.gen = AMD_CHIPSET_SB700;
    1562 else if (rev >= 0x40 && rev <= 0x4f)
    1563 pinfo->sb_type.gen = AMD_CHIPSET_SB800;
    1564 - }
    1565 - pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
    1566 - 0x145c, NULL);
    1567 - if (pinfo->smbus_dev) {
    1568 - pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
    1569 } else {
    1570 pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
    1571 PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL);
    1572
    1573 - if (!pinfo->smbus_dev) {
    1574 - pinfo->sb_type.gen = NOT_AMD_CHIPSET;
    1575 - return 0;
    1576 + if (pinfo->smbus_dev) {
    1577 + rev = pinfo->smbus_dev->revision;
    1578 + if (rev >= 0x11 && rev <= 0x14)
    1579 + pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
    1580 + else if (rev >= 0x15 && rev <= 0x18)
    1581 + pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
    1582 + else if (rev >= 0x39 && rev <= 0x3a)
    1583 + pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
    1584 + } else {
    1585 + pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD,
    1586 + 0x145c, NULL);
    1587 + if (pinfo->smbus_dev) {
    1588 + rev = pinfo->smbus_dev->revision;
    1589 + pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN;
    1590 + } else {
    1591 + pinfo->sb_type.gen = NOT_AMD_CHIPSET;
    1592 + return 0;
    1593 + }
    1594 }
    1595 -
    1596 - rev = pinfo->smbus_dev->revision;
    1597 - if (rev >= 0x11 && rev <= 0x14)
    1598 - pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2;
    1599 - else if (rev >= 0x15 && rev <= 0x18)
    1600 - pinfo->sb_type.gen = AMD_CHIPSET_BOLTON;
    1601 - else if (rev >= 0x39 && rev <= 0x3a)
    1602 - pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE;
    1603 }
    1604 -
    1605 pinfo->sb_type.rev = rev;
    1606 return 1;
    1607 }
    1608 diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
    1609 index 87cbd56cc761..b67692857daf 100644
    1610 --- a/drivers/usb/musb/musb_core.c
    1611 +++ b/drivers/usb/musb/musb_core.c
    1612 @@ -2671,6 +2671,13 @@ static int musb_suspend(struct device *dev)
    1613 {
    1614 struct musb *musb = dev_to_musb(dev);
    1615 unsigned long flags;
    1616 + int ret;
    1617 +
    1618 + ret = pm_runtime_get_sync(dev);
    1619 + if (ret < 0) {
    1620 + pm_runtime_put_noidle(dev);
    1621 + return ret;
    1622 + }
    1623
    1624 musb_platform_disable(musb);
    1625 musb_disable_interrupts(musb);
    1626 @@ -2721,14 +2728,6 @@ static int musb_resume(struct device *dev)
    1627 if ((devctl & mask) != (musb->context.devctl & mask))
    1628 musb->port1_status = 0;
    1629
    1630 - /*
    1631 - * The USB HUB code expects the device to be in RPM_ACTIVE once it came
    1632 - * out of suspend
    1633 - */
    1634 - pm_runtime_disable(dev);
    1635 - pm_runtime_set_active(dev);
    1636 - pm_runtime_enable(dev);
    1637 -
    1638 musb_start(musb);
    1639
    1640 spin_lock_irqsave(&musb->lock, flags);
    1641 @@ -2738,6 +2737,9 @@ static int musb_resume(struct device *dev)
    1642 error);
    1643 spin_unlock_irqrestore(&musb->lock, flags);
    1644
    1645 + pm_runtime_mark_last_busy(dev);
    1646 + pm_runtime_put_autosuspend(dev);
    1647 +
    1648 return 0;
    1649 }
    1650
    1651 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    1652 index fe123153b1a5..2a9944326210 100644
    1653 --- a/drivers/usb/serial/option.c
    1654 +++ b/drivers/usb/serial/option.c
    1655 @@ -2023,6 +2023,7 @@ static const struct usb_device_id option_ids[] = {
    1656 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
    1657 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
    1658 { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */
    1659 + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) }, /* D-Link DWM-157 C1 */
    1660 { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */
    1661 .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
    1662 { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */
    1663 diff --git a/fs/dlm/user.c b/fs/dlm/user.c
    1664 index 23488f559cf9..84199151b64b 100644
    1665 --- a/fs/dlm/user.c
    1666 +++ b/fs/dlm/user.c
    1667 @@ -355,6 +355,10 @@ static int dlm_device_register(struct dlm_ls *ls, char *name)
    1668 error = misc_register(&ls->ls_device);
    1669 if (error) {
    1670 kfree(ls->ls_device.name);
    1671 + /* this has to be set to NULL
    1672 + * to avoid a double-free in dlm_device_deregister
    1673 + */
    1674 + ls->ls_device.name = NULL;
    1675 }
    1676 fail:
    1677 return error;
    1678 diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
    1679 index c71e532da458..4adf6161ec77 100644
    1680 --- a/include/linux/pci_ids.h
    1681 +++ b/include/linux/pci_ids.h
    1682 @@ -576,6 +576,7 @@
    1683 #define PCI_DEVICE_ID_AMD_CS5536_EHC 0x2095
    1684 #define PCI_DEVICE_ID_AMD_CS5536_UDC 0x2096
    1685 #define PCI_DEVICE_ID_AMD_CS5536_UOC 0x2097
    1686 +#define PCI_DEVICE_ID_AMD_CS5536_DEV_IDE 0x2092
    1687 #define PCI_DEVICE_ID_AMD_CS5536_IDE 0x209A
    1688 #define PCI_DEVICE_ID_AMD_LX_VIDEO 0x2081
    1689 #define PCI_DEVICE_ID_AMD_LX_AES 0x2082
    1690 diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
    1691 index db6dc9dc0482..1c49431f3121 100644
    1692 --- a/include/linux/workqueue.h
    1693 +++ b/include/linux/workqueue.h
    1694 @@ -323,8 +323,8 @@ enum {
    1695
    1696 __WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */
    1697 __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */
    1698 - __WQ_ORDERED_EXPLICIT = 1 << 18, /* internal: alloc_ordered_workqueue() */
    1699 __WQ_LEGACY = 1 << 18, /* internal: create*_workqueue() */
    1700 + __WQ_ORDERED_EXPLICIT = 1 << 19, /* internal: alloc_ordered_workqueue() */
    1701
    1702 WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */
    1703 WQ_MAX_UNBOUND_PER_CPU = 4, /* 4 * #cpus for unbound wq */
    1704 diff --git a/include/uapi/linux/android/binder.h b/include/uapi/linux/android/binder.h
    1705 index 51f891fb1b18..7668b5791c91 100644
    1706 --- a/include/uapi/linux/android/binder.h
    1707 +++ b/include/uapi/linux/android/binder.h
    1708 @@ -132,6 +132,7 @@ enum {
    1709
    1710 /* struct binder_fd_array_object - object describing an array of fds in a buffer
    1711 * @hdr: common header structure
    1712 + * @pad: padding to ensure correct alignment
    1713 * @num_fds: number of file descriptors in the buffer
    1714 * @parent: index in offset array to buffer holding the fd array
    1715 * @parent_offset: start offset of fd array in the buffer
    1716 @@ -152,6 +153,7 @@ enum {
    1717 */
    1718 struct binder_fd_array_object {
    1719 struct binder_object_header hdr;
    1720 + __u32 pad;
    1721 binder_size_t num_fds;
    1722 binder_size_t parent;
    1723 binder_size_t parent_offset;
    1724 diff --git a/kernel/configs/android-base.config b/kernel/configs/android-base.config
    1725 index d70829033bb7..d3fd428f4b92 100644
    1726 --- a/kernel/configs/android-base.config
    1727 +++ b/kernel/configs/android-base.config
    1728 @@ -10,6 +10,7 @@
    1729 # CONFIG_USELIB is not set
    1730 CONFIG_ANDROID=y
    1731 CONFIG_ANDROID_BINDER_IPC=y
    1732 +CONFIG_ANDROID_BINDER_DEVICES=binder,hwbinder,vndbinder
    1733 CONFIG_ANDROID_LOW_MEMORY_KILLER=y
    1734 CONFIG_ARMV8_DEPRECATED=y
    1735 CONFIG_ASHMEM=y