diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2020-07-01 08:10:36 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2020-07-01 08:10:36 -0400 |
| commit | 371bb07b0e2c28329a10c91f7dd7e85653d8454c (patch) | |
| tree | 02ecab5b5d99ca76937ed9083434c6b38a943715 /1228_linux-4.9.229.patch | |
| parent | Linux patch 4.9.228 (diff) | |
| download | linux-patches-371bb07b0e2c28329a10c91f7dd7e85653d8454c.tar.gz linux-patches-371bb07b0e2c28329a10c91f7dd7e85653d8454c.tar.bz2 linux-patches-371bb07b0e2c28329a10c91f7dd7e85653d8454c.zip | |
Linux patch 4.9.2294.9-233
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
Diffstat (limited to '1228_linux-4.9.229.patch')
| -rw-r--r-- | 1228_linux-4.9.229.patch | 7171 |
1 files changed, 7171 insertions, 0 deletions
diff --git a/1228_linux-4.9.229.patch b/1228_linux-4.9.229.patch new file mode 100644 index 00000000..53a13fb8 --- /dev/null +++ b/1228_linux-4.9.229.patch @@ -0,0 +1,7171 @@ +diff --git a/Documentation/media/uapi/dvb/fe-get-property.rst b/Documentation/media/uapi/dvb/fe-get-property.rst +index 015d4db597b5..c80c5fc6e916 100644 +--- a/Documentation/media/uapi/dvb/fe-get-property.rst ++++ b/Documentation/media/uapi/dvb/fe-get-property.rst +@@ -48,8 +48,11 @@ depends on the delivery system and on the device: + + - This call requires read/write access to the device. + +- - At return, the values are updated to reflect the actual parameters +- used. ++.. note:: ++ ++ At return, the values aren't updated to reflect the actual ++ parameters used. If the actual parameters are needed, an explicit ++ call to ``FE_GET_PROPERTY`` is needed. + + - ``FE_GET_PROPERTY:`` + +diff --git a/Makefile b/Makefile +index af23d7b67442..a8a9704a6e2e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 228 ++SUBLEVEL = 229 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arm/mach-imx/pm-imx5.c b/arch/arm/mach-imx/pm-imx5.c +index 868781fd460c..14c630c899c5 100644 +--- a/arch/arm/mach-imx/pm-imx5.c ++++ b/arch/arm/mach-imx/pm-imx5.c +@@ -301,14 +301,14 @@ static int __init imx_suspend_alloc_ocram( + if (!ocram_pool) { + pr_warn("%s: ocram pool unavailable!\n", __func__); + ret = -ENODEV; +- goto put_node; ++ goto put_device; + } + + ocram_base = gen_pool_alloc(ocram_pool, size); + if (!ocram_base) { + pr_warn("%s: unable to alloc ocram!\n", __func__); + ret = -ENOMEM; +- goto put_node; ++ goto put_device; + } + + phys = gen_pool_virt_to_phys(ocram_pool, ocram_base); +@@ -318,6 +318,8 @@ static int __init imx_suspend_alloc_ocram( + if (virt_out) + *virt_out = virt; + ++put_device: ++ put_device(&pdev->dev); + put_node: + of_node_put(node); + +diff --git a/arch/arm/mach-integrator/Kconfig b/arch/arm/mach-integrator/Kconfig +index cefe44f6889b..ba124f8704fa 100644 +--- a/arch/arm/mach-integrator/Kconfig ++++ b/arch/arm/mach-integrator/Kconfig +@@ -3,6 +3,8 @@ menuconfig ARCH_INTEGRATOR + depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 || ARCH_MULTI_V6 + select ARM_AMBA + select COMMON_CLK_VERSATILE ++ select CMA ++ select DMA_CMA + select HAVE_TCM + select ICST + select MFD_SYSCON +@@ -34,14 +36,13 @@ config INTEGRATOR_IMPD1 + select ARM_VIC + select GPIO_PL061 + select GPIOLIB ++ select REGULATOR ++ select REGULATOR_FIXED_VOLTAGE + help + The IM-PD1 is an add-on logic module for the Integrator which + allows ARM(R) Ltd PrimeCells to be developed and evaluated. + The IM-PD1 can be found on the Integrator/PP2 platform. + +- To compile this driver as a module, choose M here: the +- module will be called impd1. +- + config INTEGRATOR_CM7TDMI + bool "Integrator/CM7TDMI core module" + depends on ARCH_INTEGRATOR_AP +diff --git a/arch/arm64/kernel/perf_regs.c b/arch/arm64/kernel/perf_regs.c +index 3f62b35fb6f1..815c395a1076 100644 +--- a/arch/arm64/kernel/perf_regs.c ++++ b/arch/arm64/kernel/perf_regs.c +@@ -13,15 +13,34 @@ u64 perf_reg_value(struct pt_regs *regs, int idx) + return 0; + + /* +- * Compat (i.e. 32 bit) mode: +- * - PC has been set in the pt_regs struct in kernel_entry, +- * - Handle SP and LR here. ++ * Our handling of compat tasks (PERF_SAMPLE_REGS_ABI_32) is weird, but ++ * we're stuck with it for ABI compatability reasons. ++ * ++ * For a 32-bit consumer inspecting a 32-bit task, then it will look at ++ * the first 16 registers (see arch/arm/include/uapi/asm/perf_regs.h). ++ * These correspond directly to a prefix of the registers saved in our ++ * 'struct pt_regs', with the exception of the PC, so we copy that down ++ * (x15 corresponds to SP_hyp in the architecture). ++ * ++ * So far, so good. ++ * ++ * The oddity arises when a 64-bit consumer looks at a 32-bit task and ++ * asks for registers beyond PERF_REG_ARM_MAX. In this case, we return ++ * SP_usr, LR_usr and PC in the positions where the AArch64 SP, LR and ++ * PC registers would normally live. The initial idea was to allow a ++ * 64-bit unwinder to unwind a 32-bit task and, although it's not clear ++ * how well that works in practice, somebody might be relying on it. ++ * ++ * At the time we make a sample, we don't know whether the consumer is ++ * 32-bit or 64-bit, so we have to cater for both possibilities. + */ + if (compat_user_mode(regs)) { + if ((u32)idx == PERF_REG_ARM64_SP) + return regs->compat_sp; + if ((u32)idx == PERF_REG_ARM64_LR) + return regs->compat_lr; ++ if (idx == 15) ++ return regs->pc; + } + + if ((u32)idx == PERF_REG_ARM64_SP) +diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S +index c17e8451d997..3fbe420f49c4 100644 +--- a/arch/openrisc/kernel/entry.S ++++ b/arch/openrisc/kernel/entry.S +@@ -1092,13 +1092,13 @@ ENTRY(__sys_clone) + l.movhi r29,hi(sys_clone) + l.ori r29,r29,lo(sys_clone) + l.j _fork_save_extra_regs_and_call +- l.addi r7,r1,0 ++ l.nop + + ENTRY(__sys_fork) + l.movhi r29,hi(sys_fork) + l.ori r29,r29,lo(sys_fork) + l.j _fork_save_extra_regs_and_call +- l.addi r3,r1,0 ++ l.nop + + ENTRY(sys_rt_sigreturn) + l.j _sys_rt_sigreturn +diff --git a/arch/powerpc/include/asm/book3s/64/pgtable.h b/arch/powerpc/include/asm/book3s/64/pgtable.h +index 9fd77f8794a0..315758c84187 100644 +--- a/arch/powerpc/include/asm/book3s/64/pgtable.h ++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h +@@ -754,10 +754,25 @@ extern struct page *pgd_page(pgd_t pgd); + #define pud_page_vaddr(pud) __va(pud_val(pud) & ~PUD_MASKED_BITS) + #define pgd_page_vaddr(pgd) __va(pgd_val(pgd) & ~PGD_MASKED_BITS) + +-#define pgd_index(address) (((address) >> (PGDIR_SHIFT)) & (PTRS_PER_PGD - 1)) +-#define pud_index(address) (((address) >> (PUD_SHIFT)) & (PTRS_PER_PUD - 1)) +-#define pmd_index(address) (((address) >> (PMD_SHIFT)) & (PTRS_PER_PMD - 1)) +-#define pte_index(address) (((address) >> (PAGE_SHIFT)) & (PTRS_PER_PTE - 1)) ++static inline unsigned long pgd_index(unsigned long address) ++{ ++ return (address >> PGDIR_SHIFT) & (PTRS_PER_PGD - 1); ++} ++ ++static inline unsigned long pud_index(unsigned long address) ++{ ++ return (address >> PUD_SHIFT) & (PTRS_PER_PUD - 1); ++} ++ ++static inline unsigned long pmd_index(unsigned long address) ++{ ++ return (address >> PMD_SHIFT) & (PTRS_PER_PMD - 1); ++} ++ ++static inline unsigned long pte_index(unsigned long address) ++{ ++ return (address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1); ++} + + /* + * Find an entry in a page-table-directory. We combine the address region +diff --git a/arch/powerpc/include/asm/kprobes.h b/arch/powerpc/include/asm/kprobes.h +index 2c9759bdb63b..063d64c1c9e8 100644 +--- a/arch/powerpc/include/asm/kprobes.h ++++ b/arch/powerpc/include/asm/kprobes.h +@@ -29,6 +29,7 @@ + #include <linux/types.h> + #include <linux/ptrace.h> + #include <linux/percpu.h> ++#include <linux/module.h> + #include <asm/probes.h> + #include <asm/code-patching.h> + +@@ -60,7 +61,7 @@ typedef ppc_opcode_t kprobe_opcode_t; + #define kprobe_lookup_name(name, addr) \ + { \ + char dot_name[MODULE_NAME_LEN + 1 + KSYM_NAME_LEN]; \ +- char *modsym; \ ++ const char *modsym; \ + bool dot_appended = false; \ + if ((modsym = strchr(name, ':')) != NULL) { \ + modsym++; \ +diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c +index 9dafd7af39b8..cb4d6cd949fc 100644 +--- a/arch/powerpc/kernel/machine_kexec.c ++++ b/arch/powerpc/kernel/machine_kexec.c +@@ -113,11 +113,12 @@ void machine_kexec(struct kimage *image) + + void __init reserve_crashkernel(void) + { +- unsigned long long crash_size, crash_base; ++ unsigned long long crash_size, crash_base, total_mem_sz; + int ret; + ++ total_mem_sz = memory_limit ? memory_limit : memblock_phys_mem_size(); + /* use common parsing */ +- ret = parse_crashkernel(boot_command_line, memblock_phys_mem_size(), ++ ret = parse_crashkernel(boot_command_line, total_mem_sz, + &crash_size, &crash_base); + if (ret == 0 && crash_size > 0) { + crashk_res.start = crash_base; +@@ -176,6 +177,7 @@ void __init reserve_crashkernel(void) + /* Crash kernel trumps memory limit */ + if (memory_limit && memory_limit <= crashk_res.end) { + memory_limit = crashk_res.end + 1; ++ total_mem_sz = memory_limit; + printk("Adjusted memory limit for crashkernel, now 0x%llx\n", + memory_limit); + } +@@ -184,7 +186,7 @@ void __init reserve_crashkernel(void) + "for crashkernel (System RAM: %ldMB)\n", + (unsigned long)(crash_size >> 20), + (unsigned long)(crashk_res.start >> 20), +- (unsigned long)(memblock_phys_mem_size() >> 20)); ++ (unsigned long)(total_mem_sz >> 20)); + + if (!memblock_is_region_memory(crashk_res.start, crash_size) || + memblock_reserve(crashk_res.start, crash_size)) { +diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c +index 991c6a517ddc..2456522583c2 100644 +--- a/arch/powerpc/perf/hv-24x7.c ++++ b/arch/powerpc/perf/hv-24x7.c +@@ -1306,16 +1306,6 @@ static void h_24x7_event_read(struct perf_event *event) + h24x7hw = &get_cpu_var(hv_24x7_hw); + h24x7hw->events[i] = event; + put_cpu_var(h24x7hw); +- /* +- * Clear the event count so we can compute the _change_ +- * in the 24x7 raw counter value at the end of the txn. +- * +- * Note that we could alternatively read the 24x7 value +- * now and save its value in event->hw.prev_count. But +- * that would require issuing a hcall, which would then +- * defeat the purpose of using the txn interface. +- */ +- local64_set(&event->count, 0); + } + + put_cpu_var(hv_24x7_reqb); +diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c +index b0f34663b1ae..19bae78b1f25 100644 +--- a/arch/powerpc/platforms/ps3/mm.c ++++ b/arch/powerpc/platforms/ps3/mm.c +@@ -212,13 +212,14 @@ void ps3_mm_vas_destroy(void) + { + int result; + +- DBG("%s:%d: map.vas_id = %llu\n", __func__, __LINE__, map.vas_id); +- + if (map.vas_id) { + result = lv1_select_virtual_address_space(0); +- BUG_ON(result); +- result = lv1_destruct_virtual_address_space(map.vas_id); +- BUG_ON(result); ++ result += lv1_destruct_virtual_address_space(map.vas_id); ++ ++ if (result) { ++ lv1_panic(0); ++ } ++ + map.vas_id = 0; + } + } +@@ -316,19 +317,20 @@ static void ps3_mm_region_destroy(struct mem_region *r) + int result; + + if (!r->destroy) { +- pr_info("%s:%d: Not destroying high region: %llxh %llxh\n", +- __func__, __LINE__, r->base, r->size); + return; + } + +- DBG("%s:%d: r->base = %llxh\n", __func__, __LINE__, r->base); +- + if (r->base) { + result = lv1_release_memory(r->base); +- BUG_ON(result); ++ ++ if (result) { ++ lv1_panic(0); ++ } ++ + r->size = r->base = r->offset = 0; + map.total = map.rm.size; + } ++ + ps3_mm_set_repository_highmem(NULL); + } + +diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c +index 8799d8a83d56..0af19aa1df57 100644 +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -311,10 +311,11 @@ static irqreturn_t ras_error_interrupt(int irq, void *dev_id) + /* + * Some versions of FWNMI place the buffer inside the 4kB page starting at + * 0x7000. Other versions place it inside the rtas buffer. We check both. ++ * Minimum size of the buffer is 16 bytes. + */ + #define VALID_FWNMI_BUFFER(A) \ +- ((((A) >= 0x7000) && ((A) < 0x7ff0)) || \ +- (((A) >= rtas.base) && ((A) < (rtas.base + rtas.size - 16)))) ++ ((((A) >= 0x7000) && ((A) <= 0x8000 - 16)) || \ ++ (((A) >= rtas.base) && ((A) <= (rtas.base + rtas.size - 16)))) + + /* + * Get the error information for errors coming through the +diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h +index 6bc941be6921..166fbd74e316 100644 +--- a/arch/s390/include/asm/syscall.h ++++ b/arch/s390/include/asm/syscall.h +@@ -41,7 +41,17 @@ static inline void syscall_rollback(struct task_struct *task, + static inline long syscall_get_error(struct task_struct *task, + struct pt_regs *regs) + { +- return IS_ERR_VALUE(regs->gprs[2]) ? regs->gprs[2] : 0; ++ unsigned long error = regs->gprs[2]; ++#ifdef CONFIG_COMPAT ++ if (test_tsk_thread_flag(task, TIF_31BIT)) { ++ /* ++ * Sign-extend the value so (int)-EFOO becomes (long)-EFOO ++ * and will match correctly in comparisons. ++ */ ++ error = (long)(int)error; ++ } ++#endif ++ return IS_ERR_VALUE(error) ? error : 0; + } + + static inline long syscall_get_return_value(struct task_struct *task, +diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c +index fc2974b929c3..ee757d6f585e 100644 +--- a/arch/s390/kernel/ptrace.c ++++ b/arch/s390/kernel/ptrace.c +@@ -308,6 +308,25 @@ static inline void __poke_user_per(struct task_struct *child, + child->thread.per_user.end = data; + } + ++static void fixup_int_code(struct task_struct *child, addr_t data) ++{ ++ struct pt_regs *regs = task_pt_regs(child); ++ int ilc = regs->int_code >> 16; ++ u16 insn; ++ ++ if (ilc > 6) ++ return; ++ ++ if (ptrace_access_vm(child, regs->psw.addr - (regs->int_code >> 16), ++ &insn, sizeof(insn), FOLL_FORCE) != sizeof(insn)) ++ return; ++ ++ /* double check that tracee stopped on svc instruction */ ++ if ((insn >> 8) != 0xa) ++ return; ++ ++ regs->int_code = 0x20000 | (data & 0xffff); ++} + /* + * Write a word to the user area of a process at location addr. This + * operation does have an additional problem compared to peek_user. +@@ -319,7 +338,9 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) + struct user *dummy = NULL; + addr_t offset; + ++ + if (addr < (addr_t) &dummy->regs.acrs) { ++ struct pt_regs *regs = task_pt_regs(child); + /* + * psw and gprs are stored on the stack + */ +@@ -337,7 +358,11 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) + /* Invalid addressing mode bits */ + return -EINVAL; + } +- *(addr_t *)((addr_t) &task_pt_regs(child)->psw + addr) = data; ++ ++ if (test_pt_regs_flag(regs, PIF_SYSCALL) && ++ addr == offsetof(struct user, regs.gprs[2])) ++ fixup_int_code(child, data); ++ *(addr_t *)((addr_t) ®s->psw + addr) = data; + + } else if (addr < (addr_t) (&dummy->regs.orig_gpr2)) { + /* +@@ -703,6 +728,10 @@ static int __poke_user_compat(struct task_struct *child, + regs->psw.mask = (regs->psw.mask & ~PSW_MASK_BA) | + (__u64)(tmp & PSW32_ADDR_AMODE); + } else { ++ ++ if (test_pt_regs_flag(regs, PIF_SYSCALL) && ++ addr == offsetof(struct compat_user, regs.gprs[2])) ++ fixup_int_code(child, data); + /* gpr 0-15 */ + *(__u32*)((addr_t) ®s->psw + addr*2 + 4) = tmp; + } +diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c +index 396dbdea0cfa..2f4316c14266 100644 +--- a/arch/sparc/kernel/ptrace_32.c ++++ b/arch/sparc/kernel/ptrace_32.c +@@ -167,12 +167,17 @@ static int genregs32_set(struct task_struct *target, + if (ret || !count) + return ret; + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, +- ®s->y, ++ ®s->npc, + 34 * sizeof(u32), 35 * sizeof(u32)); + if (ret || !count) + return ret; ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ++ ®s->y, ++ 35 * sizeof(u32), 36 * sizeof(u32)); ++ if (ret || !count) ++ return ret; + return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, +- 35 * sizeof(u32), 38 * sizeof(u32)); ++ 36 * sizeof(u32), 38 * sizeof(u32)); + } + + static int fpregs32_get(struct task_struct *target, +diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile +index 3b16935b22bc..d1df7d2e31b1 100644 +--- a/arch/x86/boot/Makefile ++++ b/arch/x86/boot/Makefile +@@ -87,7 +87,7 @@ $(obj)/vmlinux.bin: $(obj)/compressed/vmlinux FORCE + + SETUP_OBJS = $(addprefix $(obj)/,$(setup-y)) + +-sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [ABCDGRSTVW] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|_ehead\|_text\|z_.*\)$$/\#define ZO_\2 0x\1/p' ++sed-zoffset := -e 's/^\([0-9a-fA-F]*\) [a-zA-Z] \(startup_32\|startup_64\|efi32_stub_entry\|efi64_stub_entry\|efi_pe_entry\|input_data\|_end\|_ehead\|_text\|z_.*\)$$/\#define ZO_\2 0x\1/p' + + quiet_cmd_zoffset = ZOFFSET $@ + cmd_zoffset = $(NM) $< | sed -n $(sed-zoffset) > $@ +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index dcd6df5943d6..86aec286e4f2 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -754,6 +754,13 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) + void *frame_pointer; + bool skipped = false; + ++ /* ++ * Set a dummy kprobe for avoiding kretprobe recursion. ++ * Since kretprobe never run in kprobe handler, kprobe must not ++ * be running at this point. ++ */ ++ kprobe_busy_begin(); ++ + INIT_HLIST_HEAD(&empty_rp); + kretprobe_hash_lock(current, &head, &flags); + /* fixup registers */ +@@ -829,10 +836,9 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) + orig_ret_address = (unsigned long)ri->ret_addr; + if (ri->rp && ri->rp->handler) { + __this_cpu_write(current_kprobe, &ri->rp->kp); +- get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE; + ri->ret_addr = correct_ret_addr; + ri->rp->handler(ri, regs); +- __this_cpu_write(current_kprobe, NULL); ++ __this_cpu_write(current_kprobe, &kprobe_busy); + } + + recycle_rp_inst(ri, &empty_rp); +@@ -848,6 +854,8 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) + + kretprobe_hash_unlock(current, &flags); + ++ kprobe_busy_end(); ++ + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + kfree(ri); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 0f66f7dd8938..6b7faa14c27b 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -2304,7 +2304,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + return kvm_mtrr_set_msr(vcpu, msr, data); + case MSR_IA32_APICBASE: + return kvm_set_apic_base(vcpu, msr_info); +- case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff: ++ case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff: + return kvm_x2apic_msr_write(vcpu, msr, data); + case MSR_IA32_TSCDEADLINE: + kvm_set_lapic_tscdeadline_msr(vcpu, data); +@@ -2576,7 +2576,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + case MSR_IA32_APICBASE: + msr_info->data = kvm_get_apic_base(vcpu); + break; +- case APIC_BASE_MSR ... APIC_BASE_MSR + 0x3ff: ++ case APIC_BASE_MSR ... APIC_BASE_MSR + 0xff: + return kvm_x2apic_msr_read(vcpu, msr_info->index, &msr_info->data); + break; + case MSR_IA32_TSCDEADLINE: +diff --git a/crypto/algboss.c b/crypto/algboss.c +index 6e39d9c05b98..5cbc588555ca 100644 +--- a/crypto/algboss.c ++++ b/crypto/algboss.c +@@ -194,8 +194,6 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval) + if (IS_ERR(thread)) + goto err_put_larval; + +- wait_for_completion_interruptible(&larval->completion); +- + return NOTIFY_STOP; + + err_put_larval: +diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c +index 7502441b1400..764786cfb0d9 100644 +--- a/drivers/acpi/sysfs.c ++++ b/drivers/acpi/sysfs.c +@@ -843,13 +843,13 @@ static void __exit interrupt_stats_exit(void) + } + + static ssize_t +-acpi_show_profile(struct device *dev, struct device_attribute *attr, ++acpi_show_profile(struct kobject *kobj, struct kobj_attribute *attr, + char *buf) + { + return sprintf(buf, "%d\n", acpi_gbl_FADT.preferred_profile); + } + +-static const struct device_attribute pm_profile_attr = ++static const struct kobj_attribute pm_profile_attr = + __ATTR(pm_profile, S_IRUGO, acpi_show_profile, NULL); + + static ssize_t hotplug_enabled_show(struct kobject *kobj, +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index ba0cffbd0bb6..46bf7e9d00ab 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -57,7 +57,6 @@ + #include <linux/workqueue.h> + #include <linux/scatterlist.h> + #include <linux/io.h> +-#include <linux/async.h> + #include <linux/log2.h> + #include <linux/slab.h> + #include <linux/glob.h> +@@ -6410,7 +6409,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht) + /* perform each probe asynchronously */ + for (i = 0; i < host->n_ports; i++) { + struct ata_port *ap = host->ports[i]; +- async_schedule(async_port_probe, ap); ++ ap->cookie = async_schedule(async_port_probe, ap); + } + + return 0; +@@ -6550,11 +6549,11 @@ void ata_host_detach(struct ata_host *host) + { + int i; + +- /* Ensure ata_port probe has completed */ +- async_synchronize_full(); +- +- for (i = 0; i < host->n_ports; i++) ++ for (i = 0; i < host->n_ports; i++) { ++ /* Ensure ata_port probe has completed */ ++ async_synchronize_cookie(host->ports[i]->cookie + 1); + ata_port_detach(host->ports[i]); ++ } + + /* the host is dead now, dissociate ACPI */ + ata_acpi_dissociate(host); +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index c4f2b563c9f0..f4b38adb9d8a 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -3967,12 +3967,13 @@ static unsigned int ata_scsi_mode_select_xlat(struct ata_queued_cmd *qc) + { + struct scsi_cmnd *scmd = qc->scsicmd; + const u8 *cdb = scmd->cmnd; +- const u8 *p; + u8 pg, spg; + unsigned six_byte, pg_len, hdr_len, bd_len; + int len; + u16 fp = (u16)-1; + u8 bp = 0xff; ++ u8 buffer[64]; ++ const u8 *p = buffer; + + VPRINTK("ENTER\n"); + +@@ -4006,12 +4007,14 @@ static unsigned int ata_scsi_mode_select_xlat(struct ata_queued_cmd *qc) + if (!scsi_sg_count(scmd) || scsi_sglist(scmd)->length < len) + goto invalid_param_len; + +- p = page_address(sg_page(scsi_sglist(scmd))); +- + /* Move past header and block descriptors. */ + if (len < hdr_len) + goto invalid_param_len; + ++ if (!sg_copy_to_buffer(scsi_sglist(scmd), scsi_sg_count(scmd), ++ buffer, sizeof(buffer))) ++ goto invalid_param_len; ++ + if (six_byte) + bd_len = p[3]; + else +diff --git a/drivers/base/platform.c b/drivers/base/platform.c +index bef299ef6227..ec2e4b6bc56f 100644 +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -692,6 +692,8 @@ int __init_or_module __platform_driver_probe(struct platform_driver *drv, + /* temporary section violation during probe() */ + drv->probe = probe; + retval = code = __platform_driver_register(drv, module); ++ if (retval) ++ return retval; + + /* + * Fixup that section violation, being paranoid about code scanning +diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c +index 76f33c84ce3d..7ec5e8f0cbe5 100644 +--- a/drivers/block/ps3disk.c ++++ b/drivers/block/ps3disk.c +@@ -464,7 +464,6 @@ static int ps3disk_probe(struct ps3_system_bus_device *_dev) + blk_queue_bounce_limit(queue, BLK_BOUNCE_HIGH); + + blk_queue_max_hw_sectors(queue, dev->bounce_size >> 9); +- blk_queue_segment_boundary(queue, -1UL); + blk_queue_dma_alignment(queue, dev->blk_size-1); + blk_queue_logical_block_size(queue, dev->blk_size); + +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 73aab6e984cd..2b5075298cdc 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1295,13 +1295,13 @@ static struct clk_hw *bcm2835_register_clock(struct bcm2835_cprman *cprman, + return &clock->hw; + } + +-static struct clk *bcm2835_register_gate(struct bcm2835_cprman *cprman, ++static struct clk_hw *bcm2835_register_gate(struct bcm2835_cprman *cprman, + const struct bcm2835_gate_data *data) + { +- return clk_register_gate(cprman->dev, data->name, data->parent, +- CLK_IGNORE_UNUSED | CLK_SET_RATE_GATE, +- cprman->regs + data->ctl_reg, +- CM_GATE_BIT, 0, &cprman->regs_lock); ++ return clk_hw_register_gate(cprman->dev, data->name, data->parent, ++ CLK_IGNORE_UNUSED | CLK_SET_RATE_GATE, ++ cprman->regs + data->ctl_reg, ++ CM_GATE_BIT, 0, &cprman->regs_lock); + } + + typedef struct clk_hw *(*bcm2835_clk_register)(struct bcm2835_cprman *cprman, +diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c +index 8dd71345b5d0..55430c8f1bc2 100644 +--- a/drivers/clk/qcom/gcc-msm8916.c ++++ b/drivers/clk/qcom/gcc-msm8916.c +@@ -270,7 +270,7 @@ static struct clk_pll gpll0 = { + .l_reg = 0x21004, + .m_reg = 0x21008, + .n_reg = 0x2100c, +- .config_reg = 0x21014, ++ .config_reg = 0x21010, + .mode_reg = 0x21000, + .status_reg = 0x2101c, + .status_bit = 17, +@@ -297,7 +297,7 @@ static struct clk_pll gpll1 = { + .l_reg = 0x20004, + .m_reg = 0x20008, + .n_reg = 0x2000c, +- .config_reg = 0x20014, ++ .config_reg = 0x20010, + .mode_reg = 0x20000, + .status_reg = 0x2001c, + .status_bit = 17, +@@ -324,7 +324,7 @@ static struct clk_pll gpll2 = { + .l_reg = 0x4a004, + .m_reg = 0x4a008, + .n_reg = 0x4a00c, +- .config_reg = 0x4a014, ++ .config_reg = 0x4a010, + .mode_reg = 0x4a000, + .status_reg = 0x4a01c, + .status_bit = 17, +@@ -351,7 +351,7 @@ static struct clk_pll bimc_pll = { + .l_reg = 0x23004, + .m_reg = 0x23008, + .n_reg = 0x2300c, +- .config_reg = 0x23014, ++ .config_reg = 0x23010, + .mode_reg = 0x23000, + .status_reg = 0x2301c, + .status_bit = 17, +diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c +index 09cdd35dc434..a082b026791a 100644 +--- a/drivers/clk/samsung/clk-exynos5433.c ++++ b/drivers/clk/samsung/clk-exynos5433.c +@@ -1672,7 +1672,8 @@ static const struct samsung_gate_clock peric_gate_clks[] __initconst = { + GATE(CLK_SCLK_PCM1, "sclk_pcm1", "sclk_pcm1_peric", + ENABLE_SCLK_PERIC, 7, CLK_SET_RATE_PARENT, 0), + GATE(CLK_SCLK_I2S1, "sclk_i2s1", "sclk_i2s1_peric", +- ENABLE_SCLK_PERIC, 6, CLK_SET_RATE_PARENT, 0), ++ ENABLE_SCLK_PERIC, 6, ++ CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED, 0), + GATE(CLK_SCLK_SPI2, "sclk_spi2", "sclk_spi2_peric", ENABLE_SCLK_PERIC, + 5, CLK_SET_RATE_PARENT, 0), + GATE(CLK_SCLK_SPI1, "sclk_spi1", "sclk_spi1_peric", ENABLE_SCLK_PERIC, +diff --git a/drivers/clk/st/clk-flexgen.c b/drivers/clk/st/clk-flexgen.c +index a485f3b284b9..033e6062599d 100644 +--- a/drivers/clk/st/clk-flexgen.c ++++ b/drivers/clk/st/clk-flexgen.c +@@ -371,6 +371,7 @@ static void __init st_of_flexgen_setup(struct device_node *np) + break; + } + ++ flex_flags &= ~CLK_IS_CRITICAL; + of_clk_detect_critical(np, i, &flex_flags); + + /* +diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c +index f2c9274b8bd5..369164f0bd0e 100644 +--- a/drivers/clk/sunxi/clk-sunxi.c ++++ b/drivers/clk/sunxi/clk-sunxi.c +@@ -98,7 +98,7 @@ static void sun6i_a31_get_pll1_factors(struct factors_request *req) + * Round down the frequency to the closest multiple of either + * 6 or 16 + */ +- u32 round_freq_6 = round_down(freq_mhz, 6); ++ u32 round_freq_6 = rounddown(freq_mhz, 6); + u32 round_freq_16 = round_down(freq_mhz, 16); + + if (round_freq_6 > round_freq_16) +diff --git a/drivers/clk/ti/composite.c b/drivers/clk/ti/composite.c +index 1cf70f452e1e..3725b2e0c788 100644 +--- a/drivers/clk/ti/composite.c ++++ b/drivers/clk/ti/composite.c +@@ -226,6 +226,7 @@ cleanup: + if (!cclk->comp_clks[i]) + continue; + list_del(&cclk->comp_clks[i]->link); ++ kfree(cclk->comp_clks[i]->parent_names); + kfree(cclk->comp_clks[i]); + } + +diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c +index ff6ac4e824b5..e7ca922a45e1 100644 +--- a/drivers/crypto/omap-sham.c ++++ b/drivers/crypto/omap-sham.c +@@ -167,8 +167,6 @@ struct omap_sham_hmac_ctx { + }; + + struct omap_sham_ctx { +- struct omap_sham_dev *dd; +- + unsigned long flags; + + /* fallback stuff */ +@@ -915,27 +913,35 @@ static int omap_sham_update_dma_stop(struct omap_sham_dev *dd) + return 0; + } + ++struct omap_sham_dev *omap_sham_find_dev(struct omap_sham_reqctx *ctx) ++{ ++ struct omap_sham_dev *dd; ++ ++ if (ctx->dd) ++ return ctx->dd; ++ ++ spin_lock_bh(&sham.lock); ++ dd = list_first_entry(&sham.dev_list, struct omap_sham_dev, list); ++ list_move_tail(&dd->list, &sham.dev_list); ++ ctx->dd = dd; ++ spin_unlock_bh(&sham.lock); ++ ++ return dd; ++} ++ + static int omap_sham_init(struct ahash_request *req) + { + struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); + struct omap_sham_ctx *tctx = crypto_ahash_ctx(tfm); + struct omap_sham_reqctx *ctx = ahash_request_ctx(req); +- struct omap_sham_dev *dd = NULL, *tmp; ++ struct omap_sham_dev *dd; + int bs = 0; + +- spin_lock_bh(&sham.lock); +- if (!tctx->dd) { +- list_for_each_entry(tmp, &sham.dev_list, list) { +- dd = tmp; +- break; +- } +- tctx->dd = dd; +- } else { +- dd = tctx->dd; +- } +- spin_unlock_bh(&sham.lock); ++ ctx->dd = NULL; + +- ctx->dd = dd; ++ dd = omap_sham_find_dev(ctx); ++ if (!dd) ++ return -ENODEV; + + ctx->flags = 0; + +@@ -1185,8 +1191,7 @@ err1: + static int omap_sham_enqueue(struct ahash_request *req, unsigned int op) + { + struct omap_sham_reqctx *ctx = ahash_request_ctx(req); +- struct omap_sham_ctx *tctx = crypto_tfm_ctx(req->base.tfm); +- struct omap_sham_dev *dd = tctx->dd; ++ struct omap_sham_dev *dd = ctx->dd; + + ctx->op = op; + +@@ -1196,7 +1201,7 @@ static int omap_sham_enqueue(struct ahash_request *req, unsigned int op) + static int omap_sham_update(struct ahash_request *req) + { + struct omap_sham_reqctx *ctx = ahash_request_ctx(req); +- struct omap_sham_dev *dd = ctx->dd; ++ struct omap_sham_dev *dd = omap_sham_find_dev(ctx); + + if (!req->nbytes) + return 0; +@@ -1301,21 +1306,8 @@ static int omap_sham_setkey(struct crypto_ahash *tfm, const u8 *key, + struct omap_sham_hmac_ctx *bctx = tctx->base; + int bs = crypto_shash_blocksize(bctx->shash); + int ds = crypto_shash_digestsize(bctx->shash); +- struct omap_sham_dev *dd = NULL, *tmp; + int err, i; + +- spin_lock_bh(&sham.lock); +- if (!tctx->dd) { +- list_for_each_entry(tmp, &sham.dev_list, list) { +- dd = tmp; +- break; +- } +- tctx->dd = dd; +- } else { +- dd = tctx->dd; +- } +- spin_unlock_bh(&sham.lock); +- + err = crypto_shash_setkey(tctx->fallback, key, keylen); + if (err) + return err; +@@ -1333,7 +1325,7 @@ static int omap_sham_setkey(struct crypto_ahash *tfm, const u8 *key, + + memset(bctx->ipad + keylen, 0, bs - keylen); + +- if (!test_bit(FLAGS_AUTO_XOR, &dd->flags)) { ++ if (!test_bit(FLAGS_AUTO_XOR, &sham.flags)) { + memcpy(bctx->opad, bctx->ipad, bs); + + for (i = 0; i < bs; i++) { +@@ -2072,6 +2064,7 @@ static int omap_sham_probe(struct platform_device *pdev) + } + + dd->flags |= dd->pdata->flags; ++ sham.flags |= dd->pdata->flags; + + pm_runtime_use_autosuspend(dev); + pm_runtime_set_autosuspend_delay(dev, DEFAULT_AUTOSUSPEND_DELAY); +@@ -2097,6 +2090,9 @@ static int omap_sham_probe(struct platform_device *pdev) + spin_unlock(&sham.lock); + + for (i = 0; i < dd->pdata->algs_info_size; i++) { ++ if (dd->pdata->algs_info[i].registered) ++ break; ++ + for (j = 0; j < dd->pdata->algs_info[i].size; j++) { + struct ahash_alg *alg; + +@@ -2142,9 +2138,11 @@ static int omap_sham_remove(struct platform_device *pdev) + list_del(&dd->list); + spin_unlock(&sham.lock); + for (i = dd->pdata->algs_info_size - 1; i >= 0; i--) +- for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) ++ for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) { + crypto_unregister_ahash( + &dd->pdata->algs_info[i].algs_list[j]); ++ dd->pdata->algs_info[i].registered--; ++ } + tasklet_kill(&dd->done_task); + pm_runtime_disable(&pdev->dev); + +diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c +index bc538708c753..cdee6d6d5453 100644 +--- a/drivers/extcon/extcon-adc-jack.c ++++ b/drivers/extcon/extcon-adc-jack.c +@@ -128,7 +128,7 @@ static int adc_jack_probe(struct platform_device *pdev) + for (i = 0; data->adc_conditions[i].id != EXTCON_NONE; i++); + data->num_conditions = i; + +- data->chan = iio_channel_get(&pdev->dev, pdata->consumer_channel); ++ data->chan = devm_iio_channel_get(&pdev->dev, pdata->consumer_channel); + if (IS_ERR(data->chan)) + return PTR_ERR(data->chan); + +@@ -170,7 +170,6 @@ static int adc_jack_remove(struct platform_device *pdev) + + free_irq(data->irq, data); + cancel_work_sync(&data->handler.work); +- iio_channel_release(data->chan); + + return 0; + } +diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c +index 241dd7c63d2c..481b2f0a190b 100644 +--- a/drivers/firmware/efi/esrt.c ++++ b/drivers/firmware/efi/esrt.c +@@ -180,7 +180,7 @@ static int esre_create_sysfs_entry(void *esre, int entry_num) + rc = kobject_init_and_add(&entry->kobj, &esre1_ktype, NULL, + "entry%d", entry_num); + if (rc) { +- kfree(entry); ++ kobject_put(&entry->kobj); + return rc; + } + } +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 41e67e983a7f..bb70c5272fe8 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -29,6 +29,7 @@ + #include <linux/i2c.h> + #include <drm/drm_dp_mst_helper.h> + #include <drm/drmP.h> ++#include <linux/iopoll.h> + + #include <drm/drm_fixed.h> + +@@ -2673,6 +2674,17 @@ fail: + return ret; + } + ++static int do_get_act_status(struct drm_dp_aux *aux) ++{ ++ int ret; ++ u8 status; ++ ++ ret = drm_dp_dpcd_readb(aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status); ++ if (ret < 0) ++ return ret; ++ ++ return status; ++} + + /** + * drm_dp_check_act_status() - Check ACT handled status. +@@ -2682,33 +2694,29 @@ fail: + */ + int drm_dp_check_act_status(struct drm_dp_mst_topology_mgr *mgr) + { +- u8 status; +- int ret; +- int count = 0; +- +- do { +- ret = drm_dp_dpcd_readb(mgr->aux, DP_PAYLOAD_TABLE_UPDATE_STATUS, &status); +- +- if (ret < 0) { +- DRM_DEBUG_KMS("failed to read payload table status %d\n", ret); +- goto fail; +- } +- +- if (status & DP_PAYLOAD_ACT_HANDLED) +- break; +- count++; +- udelay(100); +- +- } while (count < 30); +- +- if (!(status & DP_PAYLOAD_ACT_HANDLED)) { +- DRM_DEBUG_KMS("failed to get ACT bit %d after %d retries\n", status, count); +- ret = -EINVAL; +- goto fail; ++ /* ++ * There doesn't seem to be any recommended retry count or timeout in ++ * the MST specification. Since some hubs have been observed to take ++ * over 1 second to update their payload allocations under certain ++ * conditions, we use a rather large timeout value. ++ */ ++ const int timeout_ms = 3000; ++ int ret, status; ++ ++ ret = readx_poll_timeout(do_get_act_status, mgr->aux, status, ++ status & DP_PAYLOAD_ACT_HANDLED || status < 0, ++ 200, timeout_ms * USEC_PER_MSEC); ++ if (ret < 0 && status >= 0) { ++ DRM_DEBUG_KMS("Failed to get ACT after %dms, last status: %02x\n", ++ timeout_ms, status); ++ return -EINVAL; ++ } else if (status < 0) { ++ DRM_DEBUG_KMS("Failed to read payload table status: %d\n", ++ status); ++ return status; + } ++ + return 0; +-fail: +- return ret; + } + EXPORT_SYMBOL(drm_dp_check_act_status); + +diff --git a/drivers/gpu/drm/drm_encoder_slave.c b/drivers/gpu/drm/drm_encoder_slave.c +index 4484785cd9ac..95d5a5949753 100644 +--- a/drivers/gpu/drm/drm_encoder_slave.c ++++ b/drivers/gpu/drm/drm_encoder_slave.c +@@ -84,7 +84,7 @@ int drm_i2c_encoder_init(struct drm_device *dev, + + err = encoder_drv->encoder_init(client, dev, encoder); + if (err) +- goto fail_unregister; ++ goto fail_module_put; + + if (info->platform_data) + encoder->slave_funcs->set_config(&encoder->base, +@@ -92,9 +92,10 @@ int drm_i2c_encoder_init(struct drm_device *dev, + + return 0; + ++fail_module_put: ++ module_put(module); + fail_unregister: + i2c_unregister_device(client); +- module_put(module); + fail: + return err; + } +diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c +index 1e104518192d..8a98442d494b 100644 +--- a/drivers/gpu/drm/i915/i915_cmd_parser.c ++++ b/drivers/gpu/drm/i915/i915_cmd_parser.c +@@ -570,6 +570,9 @@ struct drm_i915_reg_descriptor { + #define REG32(_reg, ...) \ + { .addr = (_reg), __VA_ARGS__ } + ++#define REG32_IDX(_reg, idx) \ ++ { .addr = _reg(idx) } ++ + /* + * Convenience macro for adding 64-bit registers. + * +@@ -667,6 +670,7 @@ static const struct drm_i915_reg_descriptor gen9_blt_regs[] = { + REG64_IDX(RING_TIMESTAMP, BSD_RING_BASE), + REG32(BCS_SWCTRL), + REG64_IDX(RING_TIMESTAMP, BLT_RING_BASE), ++ REG32_IDX(RING_CTX_TIMESTAMP, BLT_RING_BASE), + REG64_IDX(BCS_GPR, 0), + REG64_IDX(BCS_GPR, 1), + REG64_IDX(BCS_GPR, 2), +diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c +index ed7143d35b25..6224aca7cd29 100644 +--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c ++++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_kms.c +@@ -769,7 +769,8 @@ static int mdp5_init(struct platform_device *pdev, struct drm_device *dev) + + return 0; + fail: +- mdp5_destroy(pdev); ++ if (mdp5_kms) ++ mdp5_destroy(pdev); + return ret; + } + +diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c +index e642242728c0..a886652ed895 100644 +--- a/drivers/gpu/drm/qxl/qxl_kms.c ++++ b/drivers/gpu/drm/qxl/qxl_kms.c +@@ -199,7 +199,7 @@ static int qxl_device_init(struct qxl_device *qdev, + &(qdev->ram_header->cursor_ring_hdr), + sizeof(struct qxl_command), + QXL_CURSOR_RING_SIZE, +- qdev->io_base + QXL_IO_NOTIFY_CMD, ++ qdev->io_base + QXL_IO_NOTIFY_CURSOR, + false, + &qdev->cursor_event); + +diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c +index 4a601f990562..a32cf6dbd3ee 100644 +--- a/drivers/gpu/drm/radeon/ni_dpm.c ++++ b/drivers/gpu/drm/radeon/ni_dpm.c +@@ -2126,7 +2126,7 @@ static int ni_init_smc_spll_table(struct radeon_device *rdev) + if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT)) + ret = -EINVAL; + +- if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT)) ++ if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT)) + ret = -EINVAL; + + if (clk_v & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKV_SHIFT)) +diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c +index 62785aa76b3f..8324d2729088 100644 +--- a/drivers/i2c/busses/i2c-piix4.c ++++ b/drivers/i2c/busses/i2c-piix4.c +@@ -840,7 +840,8 @@ static int piix4_probe(struct pci_dev *dev, const struct pci_device_id *id) + } + + if (dev->vendor == PCI_VENDOR_ID_AMD && +- dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS) { ++ (dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS || ++ dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS)) { + retval = piix4_setup_sb800(dev, id, 1); + } + +diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c +index e28b825b0433..fb191ad8fc3a 100644 +--- a/drivers/i2c/busses/i2c-pxa.c ++++ b/drivers/i2c/busses/i2c-pxa.c +@@ -297,11 +297,10 @@ static void i2c_pxa_scream_blue_murder(struct pxa_i2c *i2c, const char *why) + dev_err(dev, "IBMR: %08x IDBR: %08x ICR: %08x ISR: %08x\n", + readl(_IBMR(i2c)), readl(_IDBR(i2c)), readl(_ICR(i2c)), + readl(_ISR(i2c))); +- dev_dbg(dev, "log: "); ++ dev_err(dev, "log:"); + for (i = 0; i < i2c->irqlogidx; i++) +- pr_debug("[%08x:%08x] ", i2c->isrlog[i], i2c->icrlog[i]); +- +- pr_debug("\n"); ++ pr_cont(" [%03x:%05x]", i2c->isrlog[i], i2c->icrlog[i]); ++ pr_cont("\n"); + } + + #else /* ifdef DEBUG */ +@@ -691,11 +690,9 @@ static inline void i2c_pxa_stop_message(struct pxa_i2c *i2c) + { + u32 icr; + +- /* +- * Clear the STOP and ACK flags +- */ ++ /* Clear the START, STOP, ACK, TB and MA flags */ + icr = readl(_ICR(i2c)); +- icr &= ~(ICR_STOP | ICR_ACKNAK); ++ icr &= ~(ICR_START | ICR_STOP | ICR_ACKNAK | ICR_TB | ICR_MA); + writel(icr, _ICR(i2c)); + } + +diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c +index c9263acc190b..85b90b5939db 100644 +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -182,6 +182,8 @@ static u32 bmp280_compensate_humidity(struct bmp280_data *data, + + (s32)2097152) * H2 + 8192) >> 14); + var -= ((((var >> 15) * (var >> 15)) >> 7) * (s32)H1) >> 4; + ++ var = clamp_val(var, 0, 419430400); ++ + return var >> 12; + }; + +@@ -630,7 +632,7 @@ static int bmp180_measure(struct bmp280_data *data, u8 ctrl_meas) + unsigned int ctrl; + + if (data->use_eoc) +- init_completion(&data->done); ++ reinit_completion(&data->done); + + ret = regmap_write(data->regmap, BMP280_REG_CTRL_MEAS, ctrl_meas); + if (ret) +@@ -886,6 +888,9 @@ static int bmp085_fetch_eoc_irq(struct device *dev, + "trying to enforce it\n"); + irq_trig = IRQF_TRIGGER_RISING; + } ++ ++ init_completion(&data->done); ++ + ret = devm_request_threaded_irq(dev, + irq, + bmp085_eoc_irq, +diff --git a/drivers/infiniband/core/cma_configfs.c b/drivers/infiniband/core/cma_configfs.c +index 41573df1d9fc..692fc42255c9 100644 +--- a/drivers/infiniband/core/cma_configfs.c ++++ b/drivers/infiniband/core/cma_configfs.c +@@ -277,8 +277,21 @@ fail: + return ERR_PTR(err); + } + ++static void drop_cma_dev(struct config_group *cgroup, struct config_item *item) ++{ ++ struct config_group *group = ++ container_of(item, struct config_group, cg_item); ++ struct cma_dev_group *cma_dev_group = ++ container_of(group, struct cma_dev_group, device_group); ++ ++ configfs_remove_default_groups(&cma_dev_group->ports_group); ++ configfs_remove_default_groups(&cma_dev_group->device_group); ++ config_item_put(item); ++} ++ + static struct configfs_group_operations cma_subsys_group_ops = { + .make_group = make_cma_dev, ++ .drop_item = drop_cma_dev, + }; + + static struct config_item_type cma_subsys_type = { +diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c +index a1f059a9c751..f03e10517acc 100644 +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -2885,6 +2885,7 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info, + DMA_FROM_DEVICE); + if (unlikely(ib_dma_mapping_error(qp_info->port_priv->device, + sg_list.addr))) { ++ kfree(mad_priv); + ret = -ENOMEM; + break; + } +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index c8c5e3368b8b..12849829077d 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -1370,7 +1370,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op, + if (__set_blocks(n1, n1->keys + n2->keys, + block_bytes(b->c)) > + btree_blocks(new_nodes[i])) +- goto out_nocoalesce; ++ goto out_unlock_nocoalesce; + + keys = n2->keys; + /* Take the key of the node we're getting rid of */ +@@ -1399,7 +1399,7 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op, + + if (__bch_keylist_realloc(&keylist, + bkey_u64s(&new_nodes[i]->key))) +- goto out_nocoalesce; ++ goto out_unlock_nocoalesce; + + bch_btree_node_write(new_nodes[i], &cl); + bch_keylist_add(&keylist, &new_nodes[i]->key); +@@ -1445,6 +1445,10 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op, + /* Invalidated our iterator */ + return -EINTR; + ++out_unlock_nocoalesce: ++ for (i = 0; i < nodes; i++) ++ mutex_unlock(&new_nodes[i]->write_lock); ++ + out_nocoalesce: + closure_sync(&cl); + bch_keylist_free(&keylist); +diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c +index 372057cabea4..cd45b3894661 100644 +--- a/drivers/media/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb-core/dvb_frontend.c +@@ -41,6 +41,7 @@ + #include <linux/jiffies.h> + #include <linux/kthread.h> + #include <linux/ktime.h> ++#include <linux/compat.h> + #include <asm/processor.h> + + #include "dvb_frontend.h" +@@ -458,7 +459,7 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wra + + static void dvb_frontend_swzigzag(struct dvb_frontend *fe) + { +- enum fe_status s = 0; ++ enum fe_status s = FE_NONE; + int retval = 0; + struct dvb_frontend_private *fepriv = fe->frontend_priv; + struct dtv_frontend_properties *c = &fe->dtv_property_cache, tmp; +@@ -932,8 +933,6 @@ static int dvb_frontend_clear_cache(struct dvb_frontend *fe) + memset(c, 0, offsetof(struct dtv_frontend_properties, strength)); + c->delivery_system = delsys; + +- c->state = DTV_CLEAR; +- + dev_dbg(fe->dvb->device, "%s: Clearing cache for delivery system %d\n", + __func__, c->delivery_system); + +@@ -998,6 +997,17 @@ static int dvb_frontend_clear_cache(struct dvb_frontend *fe) + .buffer = b \ + } + ++struct dtv_cmds_h { ++ char *name; /* A display name for debugging purposes */ ++ ++ __u32 cmd; /* A unique ID */ ++ ++ /* Flags */ ++ __u32 set:1; /* Either a set or get property */ ++ __u32 buffer:1; /* Does this property use the buffer? */ ++ __u32 reserved:30; /* Align */ ++}; ++ + static struct dtv_cmds_h dtv_cmds[DTV_MAX_COMMAND + 1] = { + _DTV_CMD(DTV_TUNE, 1, 0), + _DTV_CMD(DTV_CLEAR, 1, 0), +@@ -1079,22 +1089,19 @@ static struct dtv_cmds_h dtv_cmds[DTV_MAX_COMMAND + 1] = { + _DTV_CMD(DTV_STAT_TOTAL_BLOCK_COUNT, 0, 0), + }; + +-static void dtv_property_dump(struct dvb_frontend *fe, +- bool is_set, ++static void dtv_get_property_dump(struct dvb_frontend *fe, + struct dtv_property *tvp) + { + int i; + + if (tvp->cmd <= 0 || tvp->cmd > DTV_MAX_COMMAND) { +- dev_warn(fe->dvb->device, "%s: %s tvp.cmd = 0x%08x undefined\n", +- __func__, +- is_set ? "SET" : "GET", ++ dev_warn(fe->dvb->device, "%s: GET tvp.cmd = 0x%08x undefined\n" ++ , __func__, + tvp->cmd); + return; + } + +- dev_dbg(fe->dvb->device, "%s: %s tvp.cmd = 0x%08x (%s)\n", __func__, +- is_set ? "SET" : "GET", ++ dev_dbg(fe->dvb->device, "%s: GET tvp.cmd = 0x%08x (%s)\n", __func__, + tvp->cmd, + dtv_cmds[tvp->cmd].name); + +@@ -1285,17 +1292,15 @@ static int dtv_get_frontend(struct dvb_frontend *fe, + return 0; + } + +-static int dvb_frontend_ioctl_legacy(struct file *file, +- unsigned int cmd, void *parg); +-static int dvb_frontend_ioctl_properties(struct file *file, +- unsigned int cmd, void *parg); ++static int dvb_frontend_handle_ioctl(struct file *file, ++ unsigned int cmd, void *parg); + + static int dtv_property_process_get(struct dvb_frontend *fe, + const struct dtv_frontend_properties *c, + struct dtv_property *tvp, + struct file *file) + { +- int r, ncaps; ++ int ncaps; + + switch(tvp->cmd) { + case DTV_ENUM_DELSYS: +@@ -1506,14 +1511,7 @@ static int dtv_property_process_get(struct dvb_frontend *fe, + return -EINVAL; + } + +- /* Allow the frontend to override outgoing properties */ +- if (fe->ops.get_property) { +- r = fe->ops.get_property(fe, tvp); +- if (r < 0) +- return r; +- } +- +- dtv_property_dump(fe, false, tvp); ++ dtv_get_property_dump(fe, tvp); + + return 0; + } +@@ -1740,23 +1738,36 @@ static int dvbv3_set_delivery_system(struct dvb_frontend *fe) + return emulate_delivery_system(fe, delsys); + } + ++/** ++ * dtv_property_process_set - Sets a single DTV property ++ * @fe: Pointer to &struct dvb_frontend ++ * @file: Pointer to &struct file ++ * @cmd: Digital TV command ++ * @data: An unsigned 32-bits number ++ * ++ * This routine assigns the property ++ * value to the corresponding member of ++ * &struct dtv_frontend_properties ++ * ++ * Returns: ++ * Zero on success, negative errno on failure. ++ */ + static int dtv_property_process_set(struct dvb_frontend *fe, +- struct dtv_property *tvp, +- struct file *file) ++ struct file *file, ++ u32 cmd, u32 data) + { + int r = 0; + struct dtv_frontend_properties *c = &fe->dtv_property_cache; + +- /* Allow the frontend to validate incoming properties */ +- if (fe->ops.set_property) { +- r = fe->ops.set_property(fe, tvp); +- if (r < 0) +- return r; +- } +- +- dtv_property_dump(fe, true, tvp); +- +- switch(tvp->cmd) { ++ /** Dump DTV command name and value*/ ++ if (!cmd || cmd > DTV_MAX_COMMAND) ++ dev_warn(fe->dvb->device, "%s: SET cmd 0x%08x undefined\n", ++ __func__, cmd); ++ else ++ dev_dbg(fe->dvb->device, ++ "%s: SET cmd 0x%08x (%s) to 0x%08x\n", ++ __func__, cmd, dtv_cmds[cmd].name, data); ++ switch (cmd) { + case DTV_CLEAR: + /* + * Reset a cache of data specific to the frontend here. This does +@@ -1765,144 +1776,144 @@ static int dtv_property_process_set(struct dvb_frontend *fe, + dvb_frontend_clear_cache(fe); + break; + case DTV_TUNE: +- /* interpret the cache of data, build either a traditional frontend +- * tunerequest so we can pass validation in the FE_SET_FRONTEND +- * ioctl. ++ /* ++ * Use the cached Digital TV properties to tune the ++ * frontend + */ +- c->state = tvp->cmd; +- dev_dbg(fe->dvb->device, "%s: Finalised property cache\n", +- __func__); ++ dev_dbg(fe->dvb->device, ++ "%s: Setting the frontend from property cache\n", ++ __func__); + + r = dtv_set_frontend(fe); + break; + case DTV_FREQUENCY: +- c->frequency = tvp->u.data; ++ c->frequency = data; + break; + case DTV_MODULATION: +- c->modulation = tvp->u.data; ++ c->modulation = data; + break; + case DTV_BANDWIDTH_HZ: +- c->bandwidth_hz = tvp->u.data; ++ c->bandwidth_hz = data; + break; + case DTV_INVERSION: +- c->inversion = tvp->u.data; ++ c->inversion = data; + break; + case DTV_SYMBOL_RATE: +- c->symbol_rate = tvp->u.data; ++ c->symbol_rate = data; + break; + case DTV_INNER_FEC: +- c->fec_inner = tvp->u.data; ++ c->fec_inner = data; + break; + case DTV_PILOT: +- c->pilot = tvp->u.data; ++ c->pilot = data; + break; + case DTV_ROLLOFF: +- c->rolloff = tvp->u.data; ++ c->rolloff = data; + break; + case DTV_DELIVERY_SYSTEM: +- r = dvbv5_set_delivery_system(fe, tvp->u.data); ++ r = dvbv5_set_delivery_system(fe, data); + break; + case DTV_VOLTAGE: +- c->voltage = tvp->u.data; +- r = dvb_frontend_ioctl_legacy(file, FE_SET_VOLTAGE, ++ c->voltage = data; ++ r = dvb_frontend_handle_ioctl(file, FE_SET_VOLTAGE, + (void *)c->voltage); + break; + case DTV_TONE: +- c->sectone = tvp->u.data; +- r = dvb_frontend_ioctl_legacy(file, FE_SET_TONE, ++ c->sectone = data; ++ r = dvb_frontend_handle_ioctl(file, FE_SET_TONE, + (void *)c->sectone); + break; + case DTV_CODE_RATE_HP: +- c->code_rate_HP = tvp->u.data; ++ c->code_rate_HP = data; + break; + case DTV_CODE_RATE_LP: +- c->code_rate_LP = tvp->u.data; ++ c->code_rate_LP = data; + break; + case DTV_GUARD_INTERVAL: +- c->guard_interval = tvp->u.data; ++ c->guard_interval = data; + break; + case DTV_TRANSMISSION_MODE: +- c->transmission_mode = tvp->u.data; ++ c->transmission_mode = data; + break; + case DTV_HIERARCHY: +- c->hierarchy = tvp->u.data; ++ c->hierarchy = data; + break; + case DTV_INTERLEAVING: +- c->interleaving = tvp->u.data; ++ c->interleaving = data; + break; + + /* ISDB-T Support here */ + case DTV_ISDBT_PARTIAL_RECEPTION: +- c->isdbt_partial_reception = tvp->u.data; ++ c->isdbt_partial_reception = data; + break; + case DTV_ISDBT_SOUND_BROADCASTING: +- c->isdbt_sb_mode = tvp->u.data; ++ c->isdbt_sb_mode = data; + break; + case DTV_ISDBT_SB_SUBCHANNEL_ID: +- c->isdbt_sb_subchannel = tvp->u.data; ++ c->isdbt_sb_subchannel = data; + break; + case DTV_ISDBT_SB_SEGMENT_IDX: +- c->isdbt_sb_segment_idx = tvp->u.data; ++ c->isdbt_sb_segment_idx = data; + break; + case DTV_ISDBT_SB_SEGMENT_COUNT: +- c->isdbt_sb_segment_count = tvp->u.data; ++ c->isdbt_sb_segment_count = data; + break; + case DTV_ISDBT_LAYER_ENABLED: +- c->isdbt_layer_enabled = tvp->u.data; ++ c->isdbt_layer_enabled = data; + break; + case DTV_ISDBT_LAYERA_FEC: +- c->layer[0].fec = tvp->u.data; ++ c->layer[0].fec = data; + break; + case DTV_ISDBT_LAYERA_MODULATION: +- c->layer[0].modulation = tvp->u.data; ++ c->layer[0].modulation = data; + break; + case DTV_ISDBT_LAYERA_SEGMENT_COUNT: +- c->layer[0].segment_count = tvp->u.data; ++ c->layer[0].segment_count = data; + break; + case DTV_ISDBT_LAYERA_TIME_INTERLEAVING: +- c->layer[0].interleaving = tvp->u.data; ++ c->layer[0].interleaving = data; + break; + case DTV_ISDBT_LAYERB_FEC: +- c->layer[1].fec = tvp->u.data; ++ c->layer[1].fec = data; + break; + case DTV_ISDBT_LAYERB_MODULATION: +- c->layer[1].modulation = tvp->u.data; ++ c->layer[1].modulation = data; + break; + case DTV_ISDBT_LAYERB_SEGMENT_COUNT: +- c->layer[1].segment_count = tvp->u.data; ++ c->layer[1].segment_count = data; + break; + case DTV_ISDBT_LAYERB_TIME_INTERLEAVING: +- c->layer[1].interleaving = tvp->u.data; ++ c->layer[1].interleaving = data; + break; + case DTV_ISDBT_LAYERC_FEC: +- c->layer[2].fec = tvp->u.data; ++ c->layer[2].fec = data; + break; + case DTV_ISDBT_LAYERC_MODULATION: +- c->layer[2].modulation = tvp->u.data; ++ c->layer[2].modulation = data; + break; + case DTV_ISDBT_LAYERC_SEGMENT_COUNT: +- c->layer[2].segment_count = tvp->u.data; ++ c->layer[2].segment_count = data; + break; + case DTV_ISDBT_LAYERC_TIME_INTERLEAVING: +- c->layer[2].interleaving = tvp->u.data; ++ c->layer[2].interleaving = data; + break; + + /* Multistream support */ + case DTV_STREAM_ID: + case DTV_DVBT2_PLP_ID_LEGACY: +- c->stream_id = tvp->u.data; ++ c->stream_id = data; + break; + + /* ATSC-MH */ + case DTV_ATSCMH_PARADE_ID: +- fe->dtv_property_cache.atscmh_parade_id = tvp->u.data; ++ fe->dtv_property_cache.atscmh_parade_id = data; + break; + case DTV_ATSCMH_RS_FRAME_ENSEMBLE: +- fe->dtv_property_cache.atscmh_rs_frame_ensemble = tvp->u.data; ++ fe->dtv_property_cache.atscmh_rs_frame_ensemble = data; + break; + + case DTV_LNA: +- c->lna = tvp->u.data; ++ c->lna = data; + if (fe->ops.set_lna) + r = fe->ops.set_lna(fe); + if (r < 0) +@@ -1916,14 +1927,13 @@ static int dtv_property_process_set(struct dvb_frontend *fe, + return r; + } + +-static int dvb_frontend_ioctl(struct file *file, +- unsigned int cmd, void *parg) ++static int dvb_frontend_do_ioctl(struct file *file, unsigned int cmd, ++ void *parg) + { + struct dvb_device *dvbdev = file->private_data; + struct dvb_frontend *fe = dvbdev->priv; +- struct dtv_frontend_properties *c = &fe->dtv_property_cache; + struct dvb_frontend_private *fepriv = fe->frontend_priv; +- int err = -EOPNOTSUPP; ++ int err; + + dev_dbg(fe->dvb->device, "%s: (%d)\n", __func__, _IOC_NR(cmd)); + if (down_interruptible(&fepriv->sem)) +@@ -1934,74 +1944,125 @@ static int dvb_frontend_ioctl(struct file *file, + return -ENODEV; + } + +- if ((file->f_flags & O_ACCMODE) == O_RDONLY && +- (_IOC_DIR(cmd) != _IOC_READ || cmd == FE_GET_EVENT || +- cmd == FE_DISEQC_RECV_SLAVE_REPLY)) { ++ /* ++ * If the frontend is opened in read-only mode, only the ioctls ++ * that don't interfere with the tune logic should be accepted. ++ * That allows an external application to monitor the DVB QoS and ++ * statistics parameters. ++ * ++ * That matches all _IOR() ioctls, except for two special cases: ++ * - FE_GET_EVENT is part of the tuning logic on a DVB application; ++ * - FE_DISEQC_RECV_SLAVE_REPLY is part of DiSEqC 2.0 ++ * setup ++ * So, those two ioctls should also return -EPERM, as otherwise ++ * reading from them would interfere with a DVB tune application ++ */ ++ if ((file->f_flags & O_ACCMODE) == O_RDONLY ++ && (_IOC_DIR(cmd) != _IOC_READ ++ || cmd == FE_GET_EVENT ++ || cmd == FE_DISEQC_RECV_SLAVE_REPLY)) { + up(&fepriv->sem); + return -EPERM; + } + +- if ((cmd == FE_SET_PROPERTY) || (cmd == FE_GET_PROPERTY)) +- err = dvb_frontend_ioctl_properties(file, cmd, parg); +- else { +- c->state = DTV_UNDEFINED; +- err = dvb_frontend_ioctl_legacy(file, cmd, parg); +- } ++ err = dvb_frontend_handle_ioctl(file, cmd, parg); + + up(&fepriv->sem); + return err; + } + +-static int dvb_frontend_ioctl_properties(struct file *file, +- unsigned int cmd, void *parg) ++static long dvb_frontend_ioctl(struct file *file, unsigned int cmd, ++ unsigned long arg) ++{ ++ struct dvb_device *dvbdev = file->private_data; ++ ++ if (!dvbdev) ++ return -ENODEV; ++ ++ return dvb_usercopy(file, cmd, arg, dvb_frontend_do_ioctl); ++} ++ ++#ifdef CONFIG_COMPAT ++struct compat_dtv_property { ++ __u32 cmd; ++ __u32 reserved[3]; ++ union { ++ __u32 data; ++ struct dtv_fe_stats st; ++ struct { ++ __u8 data[32]; ++ __u32 len; ++ __u32 reserved1[3]; ++ compat_uptr_t reserved2; ++ } buffer; ++ } u; ++ int result; ++} __attribute__ ((packed)); ++ ++struct compat_dtv_properties { ++ __u32 num; ++ compat_uptr_t props; ++}; ++ ++#define COMPAT_FE_SET_PROPERTY _IOW('o', 82, struct compat_dtv_properties) ++#define COMPAT_FE_GET_PROPERTY _IOR('o', 83, struct compat_dtv_properties) ++ ++static int dvb_frontend_handle_compat_ioctl(struct file *file, unsigned int cmd, ++ unsigned long arg) + { + struct dvb_device *dvbdev = file->private_data; + struct dvb_frontend *fe = dvbdev->priv; + struct dvb_frontend_private *fepriv = fe->frontend_priv; +- struct dtv_frontend_properties *c = &fe->dtv_property_cache; +- int err = 0; ++ int i, err = 0; + +- struct dtv_properties *tvps = parg; +- struct dtv_property *tvp = NULL; +- int i; ++ if (cmd == COMPAT_FE_SET_PROPERTY) { ++ struct compat_dtv_properties prop, *tvps = NULL; ++ struct compat_dtv_property *tvp = NULL; + +- dev_dbg(fe->dvb->device, "%s:\n", __func__); ++ if (copy_from_user(&prop, compat_ptr(arg), sizeof(prop))) ++ return -EFAULT; + +- if (cmd == FE_SET_PROPERTY) { +- dev_dbg(fe->dvb->device, "%s: properties.num = %d\n", __func__, tvps->num); +- dev_dbg(fe->dvb->device, "%s: properties.props = %p\n", __func__, tvps->props); ++ tvps = ∝ + +- /* Put an arbitrary limit on the number of messages that can +- * be sent at once */ +- if ((tvps->num == 0) || (tvps->num > DTV_IOCTL_MAX_MSGS)) ++ /* ++ * Put an arbitrary limit on the number of messages that can ++ * be sent at once ++ */ ++ if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS)) + return -EINVAL; + +- tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp)); ++ tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp)); + if (IS_ERR(tvp)) + return PTR_ERR(tvp); + + for (i = 0; i < tvps->num; i++) { +- err = dtv_property_process_set(fe, tvp + i, file); +- if (err < 0) +- goto out; +- (tvp + i)->result = err; ++ err = dtv_property_process_set(fe, file, ++ (tvp + i)->cmd, ++ (tvp + i)->u.data); ++ if (err < 0) { ++ kfree(tvp); ++ return err; ++ } + } +- +- if (c->state == DTV_TUNE) +- dev_dbg(fe->dvb->device, "%s: Property cache is full, tuning\n", __func__); +- +- } else if (cmd == FE_GET_PROPERTY) { ++ kfree(tvp); ++ } else if (cmd == COMPAT_FE_GET_PROPERTY) { ++ struct compat_dtv_properties prop, *tvps = NULL; ++ struct compat_dtv_property *tvp = NULL; + struct dtv_frontend_properties getp = fe->dtv_property_cache; + +- dev_dbg(fe->dvb->device, "%s: properties.num = %d\n", __func__, tvps->num); +- dev_dbg(fe->dvb->device, "%s: properties.props = %p\n", __func__, tvps->props); ++ if (copy_from_user(&prop, compat_ptr(arg), sizeof(prop))) ++ return -EFAULT; + +- /* Put an arbitrary limit on the number of messages that can +- * be sent at once */ +- if ((tvps->num == 0) || (tvps->num > DTV_IOCTL_MAX_MSGS)) ++ tvps = ∝ ++ ++ /* ++ * Put an arbitrary limit on the number of messages that can ++ * be sent at once ++ */ ++ if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS)) + return -EINVAL; + +- tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp)); ++ tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp)); + if (IS_ERR(tvp)) + return PTR_ERR(tvp); + +@@ -2013,30 +2074,53 @@ static int dvb_frontend_ioctl_properties(struct file *file, + */ + if (fepriv->state != FESTATE_IDLE) { + err = dtv_get_frontend(fe, &getp, NULL); +- if (err < 0) +- goto out; ++ if (err < 0) { ++ kfree(tvp); ++ return err; ++ } + } + for (i = 0; i < tvps->num; i++) { +- err = dtv_property_process_get(fe, &getp, tvp + i, file); +- if (err < 0) +- goto out; +- (tvp + i)->result = err; ++ err = dtv_property_process_get( ++ fe, &getp, (struct dtv_property *)(tvp + i), file); ++ if (err < 0) { ++ kfree(tvp); ++ return err; ++ } + } + +- if (copy_to_user((void __user *)tvps->props, tvp, +- tvps->num * sizeof(struct dtv_property))) { +- err = -EFAULT; +- goto out; ++ if (copy_to_user((void __user *)compat_ptr(tvps->props), tvp, ++ tvps->num * sizeof(struct compat_dtv_property))) { ++ kfree(tvp); ++ return -EFAULT; + } ++ kfree(tvp); ++ } + +- } else +- err = -EOPNOTSUPP; +- +-out: +- kfree(tvp); + return err; + } + ++static long dvb_frontend_compat_ioctl(struct file *file, unsigned int cmd, ++ unsigned long arg) ++{ ++ struct dvb_device *dvbdev = file->private_data; ++ struct dvb_frontend *fe = dvbdev->priv; ++ struct dvb_frontend_private *fepriv = fe->frontend_priv; ++ int err; ++ ++ if (cmd == COMPAT_FE_SET_PROPERTY || cmd == COMPAT_FE_GET_PROPERTY) { ++ if (down_interruptible(&fepriv->sem)) ++ return -ERESTARTSYS; ++ ++ err = dvb_frontend_handle_compat_ioctl(file, cmd, arg); ++ ++ up(&fepriv->sem); ++ return err; ++ } ++ ++ return dvb_frontend_ioctl(file, cmd, (unsigned long)compat_ptr(arg)); ++} ++#endif ++ + static int dtv_set_frontend(struct dvb_frontend *fe) + { + struct dvb_frontend_private *fepriv = fe->frontend_priv; +@@ -2174,16 +2258,103 @@ static int dtv_set_frontend(struct dvb_frontend *fe) + } + + +-static int dvb_frontend_ioctl_legacy(struct file *file, +- unsigned int cmd, void *parg) ++static int dvb_frontend_handle_ioctl(struct file *file, ++ unsigned int cmd, void *parg) + { + struct dvb_device *dvbdev = file->private_data; + struct dvb_frontend *fe = dvbdev->priv; + struct dvb_frontend_private *fepriv = fe->frontend_priv; + struct dtv_frontend_properties *c = &fe->dtv_property_cache; +- int err = -EOPNOTSUPP; ++ int i, err = -ENOTSUPP; ++ ++ dev_dbg(fe->dvb->device, "%s:\n", __func__); ++ ++ switch(cmd) { ++ case FE_SET_PROPERTY: { ++ struct dtv_properties *tvps = parg; ++ struct dtv_property *tvp = NULL; ++ ++ dev_dbg(fe->dvb->device, "%s: properties.num = %d\n", ++ __func__, tvps->num); ++ dev_dbg(fe->dvb->device, "%s: properties.props = %p\n", ++ __func__, tvps->props); ++ ++ /* ++ * Put an arbitrary limit on the number of messages that can ++ * be sent at once ++ */ ++ if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS)) ++ return -EINVAL; ++ ++ tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp)); ++ if (IS_ERR(tvp)) ++ return PTR_ERR(tvp); ++ ++ for (i = 0; i < tvps->num; i++) { ++ err = dtv_property_process_set(fe, file, ++ (tvp + i)->cmd, ++ (tvp + i)->u.data); ++ if (err < 0) { ++ kfree(tvp); ++ return err; ++ } ++ } ++ kfree(tvp); ++ err = 0; ++ break; ++ } ++ case FE_GET_PROPERTY: { ++ struct dtv_properties *tvps = parg; ++ struct dtv_property *tvp = NULL; ++ struct dtv_frontend_properties getp = fe->dtv_property_cache; ++ ++ dev_dbg(fe->dvb->device, "%s: properties.num = %d\n", ++ __func__, tvps->num); ++ dev_dbg(fe->dvb->device, "%s: properties.props = %p\n", ++ __func__, tvps->props); ++ ++ /* ++ * Put an arbitrary limit on the number of messages that can ++ * be sent at once ++ */ ++ if (!tvps->num || (tvps->num > DTV_IOCTL_MAX_MSGS)) ++ return -EINVAL; ++ ++ tvp = memdup_user(tvps->props, tvps->num * sizeof(*tvp)); ++ if (IS_ERR(tvp)) ++ return PTR_ERR(tvp); ++ ++ /* ++ * Let's use our own copy of property cache, in order to ++ * avoid mangling with DTV zigzag logic, as drivers might ++ * return crap, if they don't check if the data is available ++ * before updating the properties cache. ++ */ ++ if (fepriv->state != FESTATE_IDLE) { ++ err = dtv_get_frontend(fe, &getp, NULL); ++ if (err < 0) { ++ kfree(tvp); ++ return err; ++ } ++ } ++ for (i = 0; i < tvps->num; i++) { ++ err = dtv_property_process_get(fe, &getp, tvp + i, file); ++ if (err < 0) { ++ kfree(tvp); ++ return err; ++ } ++ } ++ ++ if (copy_to_user((void __user *)tvps->props, tvp, ++ tvps->num * sizeof(struct dtv_property))) { ++ kfree(tvp); ++ return -EFAULT; ++ } ++ kfree(tvp); ++ err = 0; ++ break; ++ } + +- switch (cmd) { + case FE_GET_INFO: { + struct dvb_frontend_info* info = parg; + +@@ -2247,42 +2418,6 @@ static int dvb_frontend_ioctl_legacy(struct file *file, + break; + } + +- case FE_READ_BER: +- if (fe->ops.read_ber) { +- if (fepriv->thread) +- err = fe->ops.read_ber(fe, (__u32 *) parg); +- else +- err = -EAGAIN; +- } +- break; +- +- case FE_READ_SIGNAL_STRENGTH: +- if (fe->ops.read_signal_strength) { +- if (fepriv->thread) +- err = fe->ops.read_signal_strength(fe, (__u16 *) parg); +- else +- err = -EAGAIN; +- } +- break; +- +- case FE_READ_SNR: +- if (fe->ops.read_snr) { +- if (fepriv->thread) +- err = fe->ops.read_snr(fe, (__u16 *) parg); +- else +- err = -EAGAIN; +- } +- break; +- +- case FE_READ_UNCORRECTED_BLOCKS: +- if (fe->ops.read_ucblocks) { +- if (fepriv->thread) +- err = fe->ops.read_ucblocks(fe, (__u32 *) parg); +- else +- err = -EAGAIN; +- } +- break; +- + case FE_DISEQC_RESET_OVERLOAD: + if (fe->ops.diseqc_reset_overload) { + err = fe->ops.diseqc_reset_overload(fe); +@@ -2334,6 +2469,23 @@ static int dvb_frontend_ioctl_legacy(struct file *file, + } + break; + ++ case FE_DISEQC_RECV_SLAVE_REPLY: ++ if (fe->ops.diseqc_recv_slave_reply) ++ err = fe->ops.diseqc_recv_slave_reply(fe, (struct dvb_diseqc_slave_reply*) parg); ++ break; ++ ++ case FE_ENABLE_HIGH_LNB_VOLTAGE: ++ if (fe->ops.enable_high_lnb_voltage) ++ err = fe->ops.enable_high_lnb_voltage(fe, (long) parg); ++ break; ++ ++ case FE_SET_FRONTEND_TUNE_MODE: ++ fepriv->tune_mode_flags = (unsigned long) parg; ++ err = 0; ++ break; ++ ++ /* DEPRECATED dish control ioctls */ ++ + case FE_DISHNETWORK_SEND_LEGACY_CMD: + if (fe->ops.dishnetwork_send_legacy_command) { + err = fe->ops.dishnetwork_send_legacy_command(fe, +@@ -2398,16 +2550,46 @@ static int dvb_frontend_ioctl_legacy(struct file *file, + } + break; + +- case FE_DISEQC_RECV_SLAVE_REPLY: +- if (fe->ops.diseqc_recv_slave_reply) +- err = fe->ops.diseqc_recv_slave_reply(fe, (struct dvb_diseqc_slave_reply*) parg); ++ /* DEPRECATED statistics ioctls */ ++ ++ case FE_READ_BER: ++ if (fe->ops.read_ber) { ++ if (fepriv->thread) ++ err = fe->ops.read_ber(fe, (__u32 *) parg); ++ else ++ err = -EAGAIN; ++ } + break; + +- case FE_ENABLE_HIGH_LNB_VOLTAGE: +- if (fe->ops.enable_high_lnb_voltage) +- err = fe->ops.enable_high_lnb_voltage(fe, (long) parg); ++ case FE_READ_SIGNAL_STRENGTH: ++ if (fe->ops.read_signal_strength) { ++ if (fepriv->thread) ++ err = fe->ops.read_signal_strength(fe, (__u16 *) parg); ++ else ++ err = -EAGAIN; ++ } ++ break; ++ ++ case FE_READ_SNR: ++ if (fe->ops.read_snr) { ++ if (fepriv->thread) ++ err = fe->ops.read_snr(fe, (__u16 *) parg); ++ else ++ err = -EAGAIN; ++ } ++ break; ++ ++ case FE_READ_UNCORRECTED_BLOCKS: ++ if (fe->ops.read_ucblocks) { ++ if (fepriv->thread) ++ err = fe->ops.read_ucblocks(fe, (__u32 *) parg); ++ else ++ err = -EAGAIN; ++ } + break; + ++ /* DEPRECATED DVBv3 ioctls */ ++ + case FE_SET_FRONTEND: + err = dvbv3_set_delivery_system(fe); + if (err) +@@ -2434,11 +2616,10 @@ static int dvb_frontend_ioctl_legacy(struct file *file, + err = dtv_get_frontend(fe, &getp, parg); + break; + } +- case FE_SET_FRONTEND_TUNE_MODE: +- fepriv->tune_mode_flags = (unsigned long) parg; +- err = 0; +- break; +- } ++ ++ default: ++ return -ENOTSUPP; ++ } /* switch */ + + return err; + } +@@ -2609,7 +2790,10 @@ static int dvb_frontend_release(struct inode *inode, struct file *file) + + static const struct file_operations dvb_frontend_fops = { + .owner = THIS_MODULE, +- .unlocked_ioctl = dvb_generic_ioctl, ++ .unlocked_ioctl = dvb_frontend_ioctl, ++#ifdef CONFIG_COMPAT ++ .compat_ioctl = dvb_frontend_compat_ioctl, ++#endif + .poll = dvb_frontend_poll, + .open = dvb_frontend_open, + .release = dvb_frontend_release, +@@ -2677,7 +2861,6 @@ int dvb_register_frontend(struct dvb_adapter* dvb, + #if defined(CONFIG_MEDIA_CONTROLLER_DVB) + .name = fe->ops.info.name, + #endif +- .kernel_ioctl = dvb_frontend_ioctl + }; + + dev_dbg(dvb->device, "%s:\n", __func__); +diff --git a/drivers/media/dvb-core/dvb_frontend.h b/drivers/media/dvb-core/dvb_frontend.h +index fb6e84811504..8a6267ad56d6 100644 +--- a/drivers/media/dvb-core/dvb_frontend.h ++++ b/drivers/media/dvb-core/dvb_frontend.h +@@ -397,13 +397,8 @@ struct dtv_frontend_properties; + * @search: callback function used on some custom algo search algos. + * @tuner_ops: pointer to struct dvb_tuner_ops + * @analog_ops: pointer to struct analog_demod_ops +- * @set_property: callback function to allow the frontend to validade +- * incoming properties. Should not be used on new drivers. +- * @get_property: callback function to allow the frontend to override +- * outcoming properties. Should not be used on new drivers. + */ + struct dvb_frontend_ops { +- + struct dvb_frontend_info info; + + u8 delsys[MAX_DELSYS]; +@@ -461,9 +456,6 @@ struct dvb_frontend_ops { + + struct dvb_tuner_ops tuner_ops; + struct analog_demod_ops analog_ops; +- +- int (*set_property)(struct dvb_frontend* fe, struct dtv_property* tvp); +- int (*get_property)(struct dvb_frontend* fe, struct dtv_property* tvp); + }; + + #ifdef __DVB_CORE__ +@@ -623,11 +615,6 @@ struct dtv_frontend_properties { + struct dtv_fe_stats post_bit_count; + struct dtv_fe_stats block_error; + struct dtv_fe_stats block_count; +- +- /* private: */ +- /* Cache State */ +- u32 state; +- + }; + + #define DVB_FE_NO_EXIT 0 +diff --git a/drivers/media/dvb-frontends/lg2160.c b/drivers/media/dvb-frontends/lg2160.c +index f51a3a0b3949..1b640651531d 100644 +--- a/drivers/media/dvb-frontends/lg2160.c ++++ b/drivers/media/dvb-frontends/lg2160.c +@@ -1052,16 +1052,6 @@ fail: + return ret; + } + +-static int lg216x_get_property(struct dvb_frontend *fe, +- struct dtv_property *tvp) +-{ +- struct dtv_frontend_properties *c = &fe->dtv_property_cache; +- +- return (DTV_ATSCMH_FIC_VER == tvp->cmd) ? +- lg216x_get_frontend(fe, c) : 0; +-} +- +- + static int lg2160_set_frontend(struct dvb_frontend *fe) + { + struct lg216x_state *state = fe->demodulator_priv; +@@ -1372,8 +1362,6 @@ static struct dvb_frontend_ops lg2160_ops = { + .init = lg216x_init, + .sleep = lg216x_sleep, + #endif +- .get_property = lg216x_get_property, +- + .set_frontend = lg2160_set_frontend, + .get_frontend = lg216x_get_frontend, + .get_tune_settings = lg216x_get_tune_settings, +@@ -1400,8 +1388,6 @@ static struct dvb_frontend_ops lg2161_ops = { + .init = lg216x_init, + .sleep = lg216x_sleep, + #endif +- .get_property = lg216x_get_property, +- + .set_frontend = lg2160_set_frontend, + .get_frontend = lg216x_get_frontend, + .get_tune_settings = lg216x_get_tune_settings, +diff --git a/drivers/media/dvb-frontends/stv0288.c b/drivers/media/dvb-frontends/stv0288.c +index c93d9a45f7f7..2b8c75f28d2e 100644 +--- a/drivers/media/dvb-frontends/stv0288.c ++++ b/drivers/media/dvb-frontends/stv0288.c +@@ -447,12 +447,6 @@ static int stv0288_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks) + return 0; + } + +-static int stv0288_set_property(struct dvb_frontend *fe, struct dtv_property *p) +-{ +- dprintk("%s(..)\n", __func__); +- return 0; +-} +- + static int stv0288_set_frontend(struct dvb_frontend *fe) + { + struct stv0288_state *state = fe->demodulator_priv; +@@ -568,7 +562,6 @@ static struct dvb_frontend_ops stv0288_ops = { + .set_tone = stv0288_set_tone, + .set_voltage = stv0288_set_voltage, + +- .set_property = stv0288_set_property, + .set_frontend = stv0288_set_frontend, + }; + +diff --git a/drivers/media/dvb-frontends/stv6110.c b/drivers/media/dvb-frontends/stv6110.c +index 66a5a7f2295c..93262b13c644 100644 +--- a/drivers/media/dvb-frontends/stv6110.c ++++ b/drivers/media/dvb-frontends/stv6110.c +@@ -263,11 +263,9 @@ static int stv6110_get_frequency(struct dvb_frontend *fe, u32 *frequency) + static int stv6110_set_frequency(struct dvb_frontend *fe, u32 frequency) + { + struct stv6110_priv *priv = fe->tuner_priv; +- struct dtv_frontend_properties *c = &fe->dtv_property_cache; + u8 ret = 0x04; + u32 divider, ref, p, presc, i, result_freq, vco_freq; + s32 p_calc, p_calc_opt = 1000, r_div, r_div_opt = 0, p_val; +- s32 srate; + + dprintk("%s, freq=%d kHz, mclk=%d Hz\n", __func__, + frequency, priv->mclk); +@@ -278,13 +276,6 @@ static int stv6110_set_frequency(struct dvb_frontend *fe, u32 frequency) + ((((priv->mclk / 1000000) - 16) & 0x1f) << 3); + + /* BB_GAIN = db/2 */ +- if (fe->ops.set_property && fe->ops.get_property) { +- srate = c->symbol_rate; +- dprintk("%s: Get Frontend parameters: srate=%d\n", +- __func__, srate); +- } else +- srate = 15000000; +- + priv->regs[RSTV6110_CTRL2] &= ~0x0f; + priv->regs[RSTV6110_CTRL2] |= (priv->gain & 0x0f); + +diff --git a/drivers/media/usb/dvb-usb/friio-fe.c b/drivers/media/usb/dvb-usb/friio-fe.c +index 979f05b4b87c..237f12f9a7f2 100644 +--- a/drivers/media/usb/dvb-usb/friio-fe.c ++++ b/drivers/media/usb/dvb-usb/friio-fe.c +@@ -261,28 +261,6 @@ static int jdvbt90502_read_signal_strength(struct dvb_frontend *fe, + return 0; + } + +- +-/* filter out un-supported properties to notify users */ +-static int jdvbt90502_set_property(struct dvb_frontend *fe, +- struct dtv_property *tvp) +-{ +- int r = 0; +- +- switch (tvp->cmd) { +- case DTV_DELIVERY_SYSTEM: +- if (tvp->u.data != SYS_ISDBT) +- r = -EINVAL; +- break; +- case DTV_CLEAR: +- case DTV_TUNE: +- case DTV_FREQUENCY: +- break; +- default: +- r = -EINVAL; +- } +- return r; +-} +- + static int jdvbt90502_set_frontend(struct dvb_frontend *fe) + { + struct dtv_frontend_properties *p = &fe->dtv_property_cache; +@@ -457,8 +435,6 @@ static struct dvb_frontend_ops jdvbt90502_ops = { + .init = jdvbt90502_init, + .write = _jdvbt90502_write, + +- .set_property = jdvbt90502_set_property, +- + .set_frontend = jdvbt90502_set_frontend, + + .read_status = jdvbt90502_read_status, +diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c +index 8588dbad3301..925c1828ec28 100644 +--- a/drivers/mfd/wm8994-core.c ++++ b/drivers/mfd/wm8994-core.c +@@ -698,3 +698,4 @@ module_i2c_driver(wm8994_i2c_driver); + MODULE_DESCRIPTION("Core support for the WM8994 audio CODEC"); + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Mark Brown <broonie@opensource.wolfsonmicro.com>"); ++MODULE_SOFTDEP("pre: wm8994_regulator"); +diff --git a/drivers/mtd/nand/ams-delta.c b/drivers/mtd/nand/ams-delta.c +index 78e12cc8bac2..02ec2d183607 100644 +--- a/drivers/mtd/nand/ams-delta.c ++++ b/drivers/mtd/nand/ams-delta.c +@@ -264,7 +264,7 @@ static int ams_delta_cleanup(struct platform_device *pdev) + void __iomem *io_base = platform_get_drvdata(pdev); + + /* Release resources, unregister device */ +- nand_release(ams_delta_mtd); ++ nand_release(mtd_to_nand(ams_delta_mtd)); + + gpio_free_array(_mandatory_gpio, ARRAY_SIZE(_mandatory_gpio)); + gpio_free(AMS_DELTA_GPIO_PIN_NAND_RB); +diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c +index 68b9160108c9..45495bc1a70e 100644 +--- a/drivers/mtd/nand/atmel_nand.c ++++ b/drivers/mtd/nand/atmel_nand.c +@@ -2336,7 +2336,7 @@ static int atmel_nand_remove(struct platform_device *pdev) + struct atmel_nand_host *host = platform_get_drvdata(pdev); + struct mtd_info *mtd = nand_to_mtd(&host->nand_chip); + +- nand_release(mtd); ++ nand_release(&host->nand_chip); + + atmel_nand_disable(host); + +diff --git a/drivers/mtd/nand/au1550nd.c b/drivers/mtd/nand/au1550nd.c +index 9bf6d9915694..a0e7789131df 100644 +--- a/drivers/mtd/nand/au1550nd.c ++++ b/drivers/mtd/nand/au1550nd.c +@@ -496,7 +496,7 @@ static int au1550nd_remove(struct platform_device *pdev) + struct au1550nd_ctx *ctx = platform_get_drvdata(pdev); + struct resource *r = platform_get_resource(pdev, IORESOURCE_MEM, 0); + +- nand_release(nand_to_mtd(&ctx->chip)); ++ nand_release(&ctx->chip); + iounmap(ctx->base); + release_mem_region(r->start, 0x1000); + kfree(ctx); +diff --git a/drivers/mtd/nand/bcm47xxnflash/main.c b/drivers/mtd/nand/bcm47xxnflash/main.c +index fb31429b70a9..d79694160845 100644 +--- a/drivers/mtd/nand/bcm47xxnflash/main.c ++++ b/drivers/mtd/nand/bcm47xxnflash/main.c +@@ -65,7 +65,7 @@ static int bcm47xxnflash_remove(struct platform_device *pdev) + { + struct bcm47xxnflash *nflash = platform_get_drvdata(pdev); + +- nand_release(nand_to_mtd(&nflash->nand_chip)); ++ nand_release(&nflash->nand_chip); + + return 0; + } +diff --git a/drivers/mtd/nand/bf5xx_nand.c b/drivers/mtd/nand/bf5xx_nand.c +index 3962f55bd034..020bb350a2db 100644 +--- a/drivers/mtd/nand/bf5xx_nand.c ++++ b/drivers/mtd/nand/bf5xx_nand.c +@@ -688,7 +688,7 @@ static int bf5xx_nand_remove(struct platform_device *pdev) + * and their partitions, then go through freeing the + * resources used + */ +- nand_release(nand_to_mtd(&info->chip)); ++ nand_release(&info->chip); + + peripheral_free_list(bfin_nfc_pin_req); + bf5xx_nand_dma_remove(info); +diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c +index 1291492a1cef..fbee81909d38 100644 +--- a/drivers/mtd/nand/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/brcmnand/brcmnand.c +@@ -2595,7 +2595,7 @@ int brcmnand_remove(struct platform_device *pdev) + struct brcmnand_host *host; + + list_for_each_entry(host, &ctrl->host_list, node) +- nand_release(nand_to_mtd(&host->chip)); ++ nand_release(&host->chip); + + clk_disable_unprepare(ctrl->clk); + +diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c +index 0b0c93702abb..c16e740c01c3 100644 +--- a/drivers/mtd/nand/cafe_nand.c ++++ b/drivers/mtd/nand/cafe_nand.c +@@ -825,7 +825,7 @@ static void cafe_nand_remove(struct pci_dev *pdev) + /* Disable NAND IRQ in global IRQ mask register */ + cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK); + free_irq(pdev->irq, mtd); +- nand_release(mtd); ++ nand_release(chip); + free_rs(cafe->rs); + pci_iounmap(pdev, cafe->mmio); + dma_free_coherent(&cafe->pdev->dev, +diff --git a/drivers/mtd/nand/cmx270_nand.c b/drivers/mtd/nand/cmx270_nand.c +index 49133783ca53..b9667204e711 100644 +--- a/drivers/mtd/nand/cmx270_nand.c ++++ b/drivers/mtd/nand/cmx270_nand.c +@@ -230,7 +230,7 @@ module_init(cmx270_init); + static void __exit cmx270_cleanup(void) + { + /* Release resources, unregister device */ +- nand_release(cmx270_nand_mtd); ++ nand_release(mtd_to_nand(cmx270_nand_mtd)); + + gpio_free(GPIO_NAND_RB); + gpio_free(GPIO_NAND_CS); +diff --git a/drivers/mtd/nand/cs553x_nand.c b/drivers/mtd/nand/cs553x_nand.c +index a65e4e0f57a1..4779dfec3576 100644 +--- a/drivers/mtd/nand/cs553x_nand.c ++++ b/drivers/mtd/nand/cs553x_nand.c +@@ -339,7 +339,7 @@ static void __exit cs553x_cleanup(void) + mmio_base = this->IO_ADDR_R; + + /* Release resources, unregister device */ +- nand_release(mtd); ++ nand_release(this); + kfree(mtd->name); + cs553x_mtd[i] = NULL; + +diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c +index 27fa8b87cd5f..c7f535676e49 100644 +--- a/drivers/mtd/nand/davinci_nand.c ++++ b/drivers/mtd/nand/davinci_nand.c +@@ -840,7 +840,7 @@ static int nand_davinci_remove(struct platform_device *pdev) + ecc4_busy = false; + spin_unlock_irq(&davinci_nand_lock); + +- nand_release(nand_to_mtd(&info->chip)); ++ nand_release(&info->chip); + + clk_disable_unprepare(info->clk); + +diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c +index 0476ae8776d9..982cbc7f412f 100644 +--- a/drivers/mtd/nand/denali.c ++++ b/drivers/mtd/nand/denali.c +@@ -1655,7 +1655,7 @@ void denali_remove(struct denali_nand_info *denali) + */ + int bufsize = mtd->writesize + mtd->oobsize; + +- nand_release(mtd); ++ nand_release(&denali->nand); + denali_irq_cleanup(denali->irq, denali); + dma_unmap_single(denali->dev, denali->buf.dma_buf, bufsize, + DMA_BIDIRECTIONAL); +diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c +index a023ab9e9cbf..374b7a10ba51 100644 +--- a/drivers/mtd/nand/diskonchip.c ++++ b/drivers/mtd/nand/diskonchip.c +@@ -1605,13 +1605,10 @@ static int __init doc_probe(unsigned long physadr) + numchips = doc2001_init(mtd); + + if ((ret = nand_scan(mtd, numchips)) || (ret = doc->late_init(mtd))) { +- /* DBB note: i believe nand_release is necessary here, as ++ /* DBB note: i believe nand_cleanup is necessary here, as + buffers may have been allocated in nand_base. Check with + Thomas. FIX ME! */ +- /* nand_release will call mtd_device_unregister, but we +- haven't yet added it. This is handled without incident by +- mtd_device_unregister, as far as I can tell. */ +- nand_release(mtd); ++ nand_cleanup(nand); + kfree(nand); + goto fail; + } +@@ -1644,7 +1641,7 @@ static void release_nanddoc(void) + doc = nand_get_controller_data(nand); + + nextmtd = doc->nextdoc; +- nand_release(mtd); ++ nand_release(nand); + iounmap(doc->virtadr); + release_mem_region(doc->physadr, DOC_IOREMAP_LEN); + kfree(nand); +diff --git a/drivers/mtd/nand/docg4.c b/drivers/mtd/nand/docg4.c +index 7af2a3cd949e..5798cd87f340 100644 +--- a/drivers/mtd/nand/docg4.c ++++ b/drivers/mtd/nand/docg4.c +@@ -1374,7 +1374,7 @@ static int __init probe_docg4(struct platform_device *pdev) + return 0; + + fail: +- nand_release(mtd); /* deletes partitions and mtd devices */ ++ nand_release(nand); /* deletes partitions and mtd devices */ + free_bch(doc->bch); + kfree(nand); + +@@ -1387,7 +1387,7 @@ fail_unmap: + static int __exit cleanup_docg4(struct platform_device *pdev) + { + struct docg4_priv *doc = platform_get_drvdata(pdev); +- nand_release(doc->mtd); ++ nand_release(mtd_to_nand(doc->mtd)); + free_bch(doc->bch); + kfree(mtd_to_nand(doc->mtd)); + iounmap(doc->virtadr); +diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c +index 113f76e59937..2fc4f2ab89ff 100644 +--- a/drivers/mtd/nand/fsl_elbc_nand.c ++++ b/drivers/mtd/nand/fsl_elbc_nand.c +@@ -811,7 +811,7 @@ static int fsl_elbc_chip_remove(struct fsl_elbc_mtd *priv) + struct fsl_elbc_fcm_ctrl *elbc_fcm_ctrl = priv->ctrl->nand; + struct mtd_info *mtd = nand_to_mtd(&priv->chip); + +- nand_release(mtd); ++ nand_release(&priv->chip); + + kfree(mtd->name); + +diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c +index 4c3b986dd74d..cf0fccb5908e 100644 +--- a/drivers/mtd/nand/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/fsl_ifc_nand.c +@@ -918,7 +918,7 @@ static int fsl_ifc_chip_remove(struct fsl_ifc_mtd *priv) + { + struct mtd_info *mtd = nand_to_mtd(&priv->chip); + +- nand_release(mtd); ++ nand_release(&priv->chip); + + kfree(mtd->name); + +diff --git a/drivers/mtd/nand/fsl_upm.c b/drivers/mtd/nand/fsl_upm.c +index d85fa2555b68..0b4d2489cc71 100644 +--- a/drivers/mtd/nand/fsl_upm.c ++++ b/drivers/mtd/nand/fsl_upm.c +@@ -326,7 +326,7 @@ static int fun_remove(struct platform_device *ofdev) + struct mtd_info *mtd = nand_to_mtd(&fun->chip); + int i; + +- nand_release(mtd); ++ nand_release(&fun->chip); + kfree(mtd->name); + + for (i = 0; i < fun->mchip_count; i++) { +diff --git a/drivers/mtd/nand/fsmc_nand.c b/drivers/mtd/nand/fsmc_nand.c +index d4f454a4b35e..92737deb7845 100644 +--- a/drivers/mtd/nand/fsmc_nand.c ++++ b/drivers/mtd/nand/fsmc_nand.c +@@ -1038,7 +1038,7 @@ static int fsmc_nand_remove(struct platform_device *pdev) + struct fsmc_nand_data *host = platform_get_drvdata(pdev); + + if (host) { +- nand_release(nand_to_mtd(&host->nand)); ++ nand_release(&host->nand); + + if (host->mode == USE_DMA_ACCESS) { + dma_release_channel(host->write_dma_chan); +diff --git a/drivers/mtd/nand/gpio.c b/drivers/mtd/nand/gpio.c +index 6317f6836022..c7461ca1c1a6 100644 +--- a/drivers/mtd/nand/gpio.c ++++ b/drivers/mtd/nand/gpio.c +@@ -197,7 +197,7 @@ static int gpio_nand_remove(struct platform_device *pdev) + { + struct gpiomtd *gpiomtd = platform_get_drvdata(pdev); + +- nand_release(nand_to_mtd(&gpiomtd->nand_chip)); ++ nand_release(&gpiomtd->nand_chip); + + if (gpio_is_valid(gpiomtd->plat.gpio_nwp)) + gpio_set_value(gpiomtd->plat.gpio_nwp, 0); +diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +index d9dab4275859..f4a99e91c250 100644 +--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +@@ -1930,7 +1930,7 @@ static int gpmi_set_geometry(struct gpmi_nand_data *this) + + static void gpmi_nand_exit(struct gpmi_nand_data *this) + { +- nand_release(nand_to_mtd(&this->nand)); ++ nand_release(&this->nand); + gpmi_free_dma_buffer(this); + } + +diff --git a/drivers/mtd/nand/hisi504_nand.c b/drivers/mtd/nand/hisi504_nand.c +index 9432546f4cd4..6c96d9d29a31 100644 +--- a/drivers/mtd/nand/hisi504_nand.c ++++ b/drivers/mtd/nand/hisi504_nand.c +@@ -823,7 +823,7 @@ static int hisi_nfc_probe(struct platform_device *pdev) + return 0; + + err_mtd: +- nand_release(mtd); ++ nand_release(chip); + err_res: + return ret; + } +@@ -831,9 +831,8 @@ err_res: + static int hisi_nfc_remove(struct platform_device *pdev) + { + struct hinfc_host *host = platform_get_drvdata(pdev); +- struct mtd_info *mtd = nand_to_mtd(&host->chip); + +- nand_release(mtd); ++ nand_release(&host->chip); + + return 0; + } +diff --git a/drivers/mtd/nand/jz4740_nand.c b/drivers/mtd/nand/jz4740_nand.c +index 5551c36adbdf..6f323858d51a 100644 +--- a/drivers/mtd/nand/jz4740_nand.c ++++ b/drivers/mtd/nand/jz4740_nand.c +@@ -499,7 +499,7 @@ static int jz_nand_probe(struct platform_device *pdev) + return 0; + + err_nand_release: +- nand_release(mtd); ++ nand_release(chip); + err_unclaim_banks: + while (chipnr--) { + unsigned char bank = nand->banks[chipnr]; +@@ -520,7 +520,7 @@ static int jz_nand_remove(struct platform_device *pdev) + struct jz_nand *nand = platform_get_drvdata(pdev); + size_t i; + +- nand_release(nand_to_mtd(&nand->chip)); ++ nand_release(&nand->chip); + + /* Deassert and disable all chips */ + writel(0, nand->base + JZ_REG_NAND_CTRL); +diff --git a/drivers/mtd/nand/jz4780_nand.c b/drivers/mtd/nand/jz4780_nand.c +index a39bb70175ee..e8aaf2543946 100644 +--- a/drivers/mtd/nand/jz4780_nand.c ++++ b/drivers/mtd/nand/jz4780_nand.c +@@ -293,7 +293,7 @@ static int jz4780_nand_init_chip(struct platform_device *pdev, + + ret = mtd_device_register(mtd, NULL, 0); + if (ret) { +- nand_release(mtd); ++ nand_release(chip); + return ret; + } + +@@ -308,7 +308,7 @@ static void jz4780_nand_cleanup_chips(struct jz4780_nand_controller *nfc) + + while (!list_empty(&nfc->chips)) { + chip = list_first_entry(&nfc->chips, struct jz4780_nand_chip, chip_list); +- nand_release(nand_to_mtd(&chip->chip)); ++ nand_release(&chip->chip); + list_del(&chip->chip_list); + } + } +diff --git a/drivers/mtd/nand/lpc32xx_mlc.c b/drivers/mtd/nand/lpc32xx_mlc.c +index bc6e49af063a..839f8f4ace9e 100644 +--- a/drivers/mtd/nand/lpc32xx_mlc.c ++++ b/drivers/mtd/nand/lpc32xx_mlc.c +@@ -805,7 +805,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev) + if (!res) + return res; + +- nand_release(mtd); ++ nand_release(nand_chip); + + err_exit4: + free_irq(host->irq, host); +@@ -828,9 +828,8 @@ err_exit1: + static int lpc32xx_nand_remove(struct platform_device *pdev) + { + struct lpc32xx_nand_host *host = platform_get_drvdata(pdev); +- struct mtd_info *mtd = nand_to_mtd(&host->nand_chip); + +- nand_release(mtd); ++ nand_release(&host->nand_chip); + free_irq(host->irq, host); + if (use_dma) + dma_release_channel(host->dma_chan); +diff --git a/drivers/mtd/nand/lpc32xx_slc.c b/drivers/mtd/nand/lpc32xx_slc.c +index 8d3edc34958e..0b5fa254ea60 100644 +--- a/drivers/mtd/nand/lpc32xx_slc.c ++++ b/drivers/mtd/nand/lpc32xx_slc.c +@@ -940,7 +940,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev) + if (!res) + return res; + +- nand_release(mtd); ++ nand_release(chip); + + err_exit3: + dma_release_channel(host->dma_chan); +@@ -959,9 +959,8 @@ static int lpc32xx_nand_remove(struct platform_device *pdev) + { + uint32_t tmp; + struct lpc32xx_nand_host *host = platform_get_drvdata(pdev); +- struct mtd_info *mtd = nand_to_mtd(&host->nand_chip); + +- nand_release(mtd); ++ nand_release(&host->nand_chip); + dma_release_channel(host->dma_chan); + + /* Force CE high */ +diff --git a/drivers/mtd/nand/mpc5121_nfc.c b/drivers/mtd/nand/mpc5121_nfc.c +index 7eacb2f545f5..9662f8fe4713 100644 +--- a/drivers/mtd/nand/mpc5121_nfc.c ++++ b/drivers/mtd/nand/mpc5121_nfc.c +@@ -827,7 +827,7 @@ static int mpc5121_nfc_remove(struct platform_device *op) + struct device *dev = &op->dev; + struct mtd_info *mtd = dev_get_drvdata(dev); + +- nand_release(mtd); ++ nand_release(mtd_to_nand(mtd)); + mpc5121_nfc_free(dev, mtd); + + return 0; +diff --git a/drivers/mtd/nand/mtk_nand.c b/drivers/mtd/nand/mtk_nand.c +index ca95ae00215e..2375dce766ef 100644 +--- a/drivers/mtd/nand/mtk_nand.c ++++ b/drivers/mtd/nand/mtk_nand.c +@@ -1327,7 +1327,7 @@ static int mtk_nfc_nand_chip_init(struct device *dev, struct mtk_nfc *nfc, + ret = mtd_device_parse_register(mtd, NULL, NULL, NULL, 0); + if (ret) { + dev_err(dev, "mtd parse partition error\n"); +- nand_release(mtd); ++ nand_cleanup(nand); + return ret; + } + +@@ -1450,7 +1450,7 @@ static int mtk_nfc_remove(struct platform_device *pdev) + while (!list_empty(&nfc->chips)) { + chip = list_first_entry(&nfc->chips, struct mtk_nfc_nand_chip, + node); +- nand_release(nand_to_mtd(&chip->nand)); ++ nand_release(&chip->nand); + list_del(&chip->node); + } + +diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c +index 5c44eb57885b..deb3cbadbc51 100644 +--- a/drivers/mtd/nand/mxc_nand.c ++++ b/drivers/mtd/nand/mxc_nand.c +@@ -1838,7 +1838,7 @@ static int mxcnd_remove(struct platform_device *pdev) + { + struct mxc_nand_host *host = platform_get_drvdata(pdev); + +- nand_release(nand_to_mtd(&host->nand)); ++ nand_release(&host->nand); + if (host->clk_act) + clk_disable_unprepare(host->clk); + +diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c +index 5fb45161789c..bdf40c090acd 100644 +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -4941,12 +4941,12 @@ EXPORT_SYMBOL_GPL(nand_cleanup); + /** + * nand_release - [NAND Interface] Unregister the MTD device and free resources + * held by the NAND device +- * @mtd: MTD device structure ++ * @chip: NAND chip object + */ +-void nand_release(struct mtd_info *mtd) ++void nand_release(struct nand_chip *chip) + { +- mtd_device_unregister(mtd); +- nand_cleanup(mtd_to_nand(mtd)); ++ mtd_device_unregister(nand_to_mtd(chip)); ++ nand_cleanup(chip); + } + EXPORT_SYMBOL_GPL(nand_release); + +diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c +index 1eb934414eb5..fe593f2f1ec7 100644 +--- a/drivers/mtd/nand/nandsim.c ++++ b/drivers/mtd/nand/nandsim.c +@@ -2394,7 +2394,7 @@ static int __init ns_init_module(void) + + err_exit: + free_nandsim(nand); +- nand_release(nsmtd); ++ nand_release(chip); + for (i = 0;i < ARRAY_SIZE(nand->partitions); ++i) + kfree(nand->partitions[i].name); + error: +@@ -2417,7 +2417,7 @@ static void __exit ns_cleanup_module(void) + + nandsim_debugfs_remove(ns); + free_nandsim(ns); /* Free nandsim private resources */ +- nand_release(nsmtd); /* Unregister driver */ ++ nand_release(chip); /* Unregister driver */ + for (i = 0;i < ARRAY_SIZE(ns->partitions); ++i) + kfree(ns->partitions[i].name); + kfree(mtd_to_nand(nsmtd)); /* Free other structures */ +diff --git a/drivers/mtd/nand/ndfc.c b/drivers/mtd/nand/ndfc.c +index 28e6118362f7..d03b47d2664b 100644 +--- a/drivers/mtd/nand/ndfc.c ++++ b/drivers/mtd/nand/ndfc.c +@@ -258,7 +258,7 @@ static int ndfc_remove(struct platform_device *ofdev) + struct ndfc_controller *ndfc = dev_get_drvdata(&ofdev->dev); + struct mtd_info *mtd = nand_to_mtd(&ndfc->chip); + +- nand_release(mtd); ++ nand_release(&ndfc->chip); + kfree(mtd->name); + + return 0; +diff --git a/drivers/mtd/nand/nuc900_nand.c b/drivers/mtd/nand/nuc900_nand.c +index 8f64011d32ef..f7f54b46f246 100644 +--- a/drivers/mtd/nand/nuc900_nand.c ++++ b/drivers/mtd/nand/nuc900_nand.c +@@ -284,7 +284,7 @@ static int nuc900_nand_remove(struct platform_device *pdev) + { + struct nuc900_nand *nuc900_nand = platform_get_drvdata(pdev); + +- nand_release(nand_to_mtd(&nuc900_nand->chip)); ++ nand_release(&nuc900_nand->chip); + clk_disable(nuc900_nand->clk); + + return 0; +diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c +index f3a516b3f108..62c0ca437c91 100644 +--- a/drivers/mtd/nand/omap2.c ++++ b/drivers/mtd/nand/omap2.c +@@ -2307,7 +2307,7 @@ static int omap_nand_remove(struct platform_device *pdev) + } + if (info->dma) + dma_release_channel(info->dma); +- nand_release(mtd); ++ nand_release(nand_chip); + return 0; + } + +diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c +index af2f09135fb0..0acfc0a7d8e0 100644 +--- a/drivers/mtd/nand/orion_nand.c ++++ b/drivers/mtd/nand/orion_nand.c +@@ -167,7 +167,7 @@ static int __init orion_nand_probe(struct platform_device *pdev) + mtd->name = "orion_nand"; + ret = mtd_device_register(mtd, board->parts, board->nr_parts); + if (ret) { +- nand_release(mtd); ++ nand_cleanup(nc); + goto no_dev; + } + +@@ -184,9 +184,8 @@ static int orion_nand_remove(struct platform_device *pdev) + { + struct orion_nand_info *info = platform_get_drvdata(pdev); + struct nand_chip *chip = &info->chip; +- struct mtd_info *mtd = nand_to_mtd(chip); + +- nand_release(mtd); ++ nand_release(chip); + + if (!IS_ERR(info->clk)) + clk_disable_unprepare(info->clk); +diff --git a/drivers/mtd/nand/pasemi_nand.c b/drivers/mtd/nand/pasemi_nand.c +index 80c98eef44d9..3300e43e2cb9 100644 +--- a/drivers/mtd/nand/pasemi_nand.c ++++ b/drivers/mtd/nand/pasemi_nand.c +@@ -194,7 +194,7 @@ static int pasemi_nand_remove(struct platform_device *ofdev) + chip = mtd_to_nand(pasemi_nand_mtd); + + /* Release resources, unregister device */ +- nand_release(pasemi_nand_mtd); ++ nand_release(chip); + + release_region(lpcctl, 4); + +diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c +index 415a53a0deeb..ae2b3c0804ce 100644 +--- a/drivers/mtd/nand/plat_nand.c ++++ b/drivers/mtd/nand/plat_nand.c +@@ -100,7 +100,7 @@ static int plat_nand_probe(struct platform_device *pdev) + if (!err) + return err; + +- nand_release(mtd); ++ nand_cleanup(&data->chip); + out: + if (pdata->ctrl.remove) + pdata->ctrl.remove(pdev); +@@ -115,7 +115,7 @@ static int plat_nand_remove(struct platform_device *pdev) + struct plat_nand_data *data = platform_get_drvdata(pdev); + struct platform_nand_data *pdata = dev_get_platdata(&pdev->dev); + +- nand_release(nand_to_mtd(&data->chip)); ++ nand_release(&data->chip); + if (pdata->ctrl.remove) + pdata->ctrl.remove(pdev); + +diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c +index 3b8911cd3a19..46f13f7e54da 100644 +--- a/drivers/mtd/nand/pxa3xx_nand.c ++++ b/drivers/mtd/nand/pxa3xx_nand.c +@@ -1907,7 +1907,7 @@ static int pxa3xx_nand_remove(struct platform_device *pdev) + clk_disable_unprepare(info->clk); + + for (cs = 0; cs < pdata->num_cs; cs++) +- nand_release(nand_to_mtd(&info->host[cs]->chip)); ++ nand_release(&info->host[cs]->chip); + return 0; + } + +diff --git a/drivers/mtd/nand/qcom_nandc.c b/drivers/mtd/nand/qcom_nandc.c +index 9f6c9a34b9eb..1594770987fd 100644 +--- a/drivers/mtd/nand/qcom_nandc.c ++++ b/drivers/mtd/nand/qcom_nandc.c +@@ -2163,7 +2163,7 @@ static int qcom_nandc_probe(struct platform_device *pdev) + + err_cs_init: + list_for_each_entry(host, &nandc->host_list, node) +- nand_release(nand_to_mtd(&host->chip)); ++ nand_release(&host->chip); + err_setup: + clk_disable_unprepare(nandc->aon_clk); + err_aon_clk: +@@ -2180,7 +2180,7 @@ static int qcom_nandc_remove(struct platform_device *pdev) + struct qcom_nand_host *host; + + list_for_each_entry(host, &nandc->host_list, node) +- nand_release(nand_to_mtd(&host->chip)); ++ nand_release(&host->chip); + + qcom_nandc_unalloc(nandc); + +diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c +index fc9287af4614..2cfa54941395 100644 +--- a/drivers/mtd/nand/r852.c ++++ b/drivers/mtd/nand/r852.c +@@ -656,7 +656,7 @@ static int r852_register_nand_device(struct r852_device *dev) + dev->card_registred = 1; + return 0; + error3: +- nand_release(mtd); ++ nand_release(dev->chip); + error1: + /* Force card redetect */ + dev->card_detected = 0; +@@ -675,7 +675,7 @@ static void r852_unregister_nand_device(struct r852_device *dev) + return; + + device_remove_file(&mtd->dev, &dev_attr_media_type); +- nand_release(mtd); ++ nand_release(dev->chip); + r852_engine_disable(dev); + dev->card_registred = 0; + } +diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c +index d459c19d78de..be9c145b743c 100644 +--- a/drivers/mtd/nand/s3c2410.c ++++ b/drivers/mtd/nand/s3c2410.c +@@ -768,7 +768,7 @@ static int s3c24xx_nand_remove(struct platform_device *pdev) + + for (mtdno = 0; mtdno < info->mtd_count; mtdno++, ptr++) { + pr_debug("releasing mtd %d (%p)\n", mtdno, ptr); +- nand_release(nand_to_mtd(&ptr->chip)); ++ nand_release(&ptr->chip); + } + } + +diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c +index d6c013f93b8c..31f98acdba07 100644 +--- a/drivers/mtd/nand/sh_flctl.c ++++ b/drivers/mtd/nand/sh_flctl.c +@@ -1229,7 +1229,7 @@ static int flctl_remove(struct platform_device *pdev) + struct sh_flctl *flctl = platform_get_drvdata(pdev); + + flctl_release_dma(flctl); +- nand_release(nand_to_mtd(&flctl->chip)); ++ nand_release(&flctl->chip); + pm_runtime_disable(&pdev->dev); + + return 0; +diff --git a/drivers/mtd/nand/sharpsl.c b/drivers/mtd/nand/sharpsl.c +index 064ca1757589..661b4928e0fc 100644 +--- a/drivers/mtd/nand/sharpsl.c ++++ b/drivers/mtd/nand/sharpsl.c +@@ -192,7 +192,7 @@ static int sharpsl_nand_probe(struct platform_device *pdev) + return 0; + + err_add: +- nand_release(mtd); ++ nand_cleanup(this); + + err_scan: + iounmap(sharpsl->io); +@@ -210,7 +210,7 @@ static int sharpsl_nand_remove(struct platform_device *pdev) + struct sharpsl_nand *sharpsl = platform_get_drvdata(pdev); + + /* Release resources, unregister device */ +- nand_release(nand_to_mtd(&sharpsl->chip)); ++ nand_release(&sharpsl->chip); + + iounmap(sharpsl->io); + +diff --git a/drivers/mtd/nand/socrates_nand.c b/drivers/mtd/nand/socrates_nand.c +index 888fd314c62a..957d9597c484 100644 +--- a/drivers/mtd/nand/socrates_nand.c ++++ b/drivers/mtd/nand/socrates_nand.c +@@ -203,7 +203,7 @@ static int socrates_nand_probe(struct platform_device *ofdev) + if (!res) + return res; + +- nand_release(mtd); ++ nand_cleanup(nand_chip); + + out: + iounmap(host->io_base); +@@ -216,9 +216,8 @@ out: + static int socrates_nand_remove(struct platform_device *ofdev) + { + struct socrates_nand_host *host = dev_get_drvdata(&ofdev->dev); +- struct mtd_info *mtd = nand_to_mtd(&host->nand_chip); + +- nand_release(mtd); ++ nand_release(&host->nand_chip); + + iounmap(host->io_base); + +diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c +index 886355bfa761..ddf3e24cc289 100644 +--- a/drivers/mtd/nand/sunxi_nand.c ++++ b/drivers/mtd/nand/sunxi_nand.c +@@ -2108,7 +2108,7 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc, + ret = mtd_device_register(mtd, NULL, 0); + if (ret) { + dev_err(dev, "failed to register mtd device: %d\n", ret); +- nand_release(mtd); ++ nand_release(nand); + return ret; + } + +@@ -2147,7 +2147,7 @@ static void sunxi_nand_chips_cleanup(struct sunxi_nfc *nfc) + while (!list_empty(&nfc->chips)) { + chip = list_first_entry(&nfc->chips, struct sunxi_nand_chip, + node); +- nand_release(nand_to_mtd(&chip->nand)); ++ nand_release(&chip->nand); + sunxi_nand_ecc_cleanup(&chip->nand.ecc); + list_del(&chip->node); + } +diff --git a/drivers/mtd/nand/tmio_nand.c b/drivers/mtd/nand/tmio_nand.c +index 08b30549ec0a..d07c729f5b9b 100644 +--- a/drivers/mtd/nand/tmio_nand.c ++++ b/drivers/mtd/nand/tmio_nand.c +@@ -446,7 +446,7 @@ static int tmio_probe(struct platform_device *dev) + if (!retval) + return retval; + +- nand_release(mtd); ++ nand_cleanup(nand_chip); + + err_irq: + tmio_hw_stop(dev, tmio); +@@ -457,7 +457,7 @@ static int tmio_remove(struct platform_device *dev) + { + struct tmio_nand *tmio = platform_get_drvdata(dev); + +- nand_release(nand_to_mtd(&tmio->chip)); ++ nand_release(&tmio->chip); + tmio_hw_stop(dev, tmio); + return 0; + } +diff --git a/drivers/mtd/nand/txx9ndfmc.c b/drivers/mtd/nand/txx9ndfmc.c +index 0a14fda2e41b..f2ba55b0a1e9 100644 +--- a/drivers/mtd/nand/txx9ndfmc.c ++++ b/drivers/mtd/nand/txx9ndfmc.c +@@ -390,7 +390,7 @@ static int __exit txx9ndfmc_remove(struct platform_device *dev) + chip = mtd_to_nand(mtd); + txx9_priv = nand_get_controller_data(chip); + +- nand_release(mtd); ++ nand_release(chip); + kfree(txx9_priv->mtdname); + kfree(txx9_priv); + } +diff --git a/drivers/mtd/nand/vf610_nfc.c b/drivers/mtd/nand/vf610_nfc.c +index ddc629e3f63a..ec004e0a94a3 100644 +--- a/drivers/mtd/nand/vf610_nfc.c ++++ b/drivers/mtd/nand/vf610_nfc.c +@@ -795,7 +795,7 @@ static int vf610_nfc_remove(struct platform_device *pdev) + struct mtd_info *mtd = platform_get_drvdata(pdev); + struct vf610_nfc *nfc = mtd_to_nfc(mtd); + +- nand_release(mtd); ++ nand_release(mtd_to_nand(mtd)); + clk_disable_unprepare(nfc->clk); + return 0; + } +diff --git a/drivers/mtd/nand/xway_nand.c b/drivers/mtd/nand/xway_nand.c +index 895101a5e686..3d51b8fc5aaf 100644 +--- a/drivers/mtd/nand/xway_nand.c ++++ b/drivers/mtd/nand/xway_nand.c +@@ -211,7 +211,7 @@ static int xway_nand_probe(struct platform_device *pdev) + + err = mtd_device_register(mtd, NULL, 0); + if (err) +- nand_release(mtd); ++ nand_cleanup(&data->chip); + + return err; + } +@@ -223,7 +223,7 @@ static int xway_nand_remove(struct platform_device *pdev) + { + struct xway_nand_data *data = platform_get_drvdata(pdev); + +- nand_release(nand_to_mtd(&data->chip)); ++ nand_release(&data->chip); + + return 0; + } +diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c +index c0f84b73574d..2a5bb1012385 100644 +--- a/drivers/net/ethernet/atheros/alx/main.c ++++ b/drivers/net/ethernet/atheros/alx/main.c +@@ -1056,8 +1056,12 @@ out_disable_adv_intr: + + static void __alx_stop(struct alx_priv *alx) + { +- alx_halt(alx); + alx_free_irq(alx); ++ ++ cancel_work_sync(&alx->link_check_wk); ++ cancel_work_sync(&alx->reset_wk); ++ ++ alx_halt(alx); + alx_free_rings(alx); + } + +@@ -1659,9 +1663,6 @@ static void alx_remove(struct pci_dev *pdev) + struct alx_priv *alx = pci_get_drvdata(pdev); + struct alx_hw *hw = &alx->hw; + +- cancel_work_sync(&alx->link_check_wk); +- cancel_work_sync(&alx->reset_wk); +- + /* restore permanent mac address */ + alx_set_macaddr(hw, hw->perm_addr); + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index c069a04a6e7e..5790b35064a8 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -18174,8 +18174,8 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev, + + rtnl_lock(); + +- /* We probably don't have netdev yet */ +- if (!netdev || !netif_running(netdev)) ++ /* Could be second call or maybe we don't have netdev yet */ ++ if (!netdev || tp->pcierr_recovery || !netif_running(netdev)) + goto done; + + /* We needn't recover from permanent error */ +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index be324b4761eb..3c01bc43889a 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -6315,11 +6315,17 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime) + struct net_device *netdev = pci_get_drvdata(pdev); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; +- u32 ctrl, ctrl_ext, rctl, status; +- /* Runtime suspend should only enable wakeup for link changes */ +- u32 wufc = runtime ? E1000_WUFC_LNKC : adapter->wol; ++ u32 ctrl, ctrl_ext, rctl, status, wufc; + int retval = 0; + ++ /* Runtime suspend should only enable wakeup for link changes */ ++ if (runtime) ++ wufc = E1000_WUFC_LNKC; ++ else if (device_may_wakeup(&pdev->dev)) ++ wufc = adapter->wol; ++ else ++ wufc = 0; ++ + status = er32(STATUS); + if (status & E1000_STATUS_LU) + wufc &= ~E1000_WUFC_LNKC; +@@ -6377,7 +6383,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime) + e1000e_igp3_phy_powerdown_workaround_ich8lan(&adapter->hw); + } else if ((hw->mac.type == e1000_pch_lpt) || + (hw->mac.type == e1000_pch_spt)) { +- if (!(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC))) ++ if (wufc && !(wufc & (E1000_WUFC_EX | E1000_WUFC_MC | E1000_WUFC_BC))) + /* ULP does not support wake from unicast, multicast + * or broadcast. + */ +diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +index f1956c4d02a0..d026da36e47e 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +@@ -339,7 +339,7 @@ static void qed_cxt_qm_iids(struct qed_hwfn *p_hwfn, + vf_tids += segs[NUM_TASK_PF_SEGMENTS].count; + } + +- iids->vf_cids += vf_cids * p_mngr->vf_count; ++ iids->vf_cids = vf_cids; + iids->tids += vf_tids * p_mngr->vf_count; + + DP_VERBOSE(p_hwfn, QED_MSG_ILT, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c +index cf34908ec8e1..170243d3276b 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c +@@ -57,12 +57,17 @@ static void qed_vf_pf_req_end(struct qed_hwfn *p_hwfn, int req_status) + mutex_unlock(&(p_hwfn->vf_iov_info->mutex)); + } + ++#define QED_VF_CHANNEL_USLEEP_ITERATIONS 90 ++#define QED_VF_CHANNEL_USLEEP_DELAY 100 ++#define QED_VF_CHANNEL_MSLEEP_ITERATIONS 10 ++#define QED_VF_CHANNEL_MSLEEP_DELAY 25 ++ + static int qed_send_msg2pf(struct qed_hwfn *p_hwfn, u8 *done, u32 resp_size) + { + union vfpf_tlvs *p_req = p_hwfn->vf_iov_info->vf2pf_request; + struct ustorm_trigger_vf_zone trigger; + struct ustorm_vf_zone *zone_data; +- int rc = 0, time = 100; ++ int iter, rc = 0; + + zone_data = (struct ustorm_vf_zone *)PXP_VF_BAR0_START_USDM_ZONE_B; + +@@ -102,11 +107,19 @@ static int qed_send_msg2pf(struct qed_hwfn *p_hwfn, u8 *done, u32 resp_size) + REG_WR(p_hwfn, (uintptr_t)&zone_data->trigger, *((u32 *)&trigger)); + + /* When PF would be done with the response, it would write back to the +- * `done' address. Poll until then. ++ * `done' address from a coherent DMA zone. Poll until then. + */ +- while ((!*done) && time) { +- msleep(25); +- time--; ++ ++ iter = QED_VF_CHANNEL_USLEEP_ITERATIONS; ++ while (!*done && iter--) { ++ udelay(QED_VF_CHANNEL_USLEEP_DELAY); ++ dma_rmb(); ++ } ++ ++ iter = QED_VF_CHANNEL_MSLEEP_ITERATIONS; ++ while (!*done && iter--) { ++ msleep(QED_VF_CHANNEL_MSLEEP_DELAY); ++ dma_rmb(); + } + + if (!*done) { +diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c +index 24b746406bc7..4640e6c4aecf 100644 +--- a/drivers/net/ethernet/rocker/rocker_main.c ++++ b/drivers/net/ethernet/rocker/rocker_main.c +@@ -648,10 +648,10 @@ static int rocker_dma_rings_init(struct rocker *rocker) + err_dma_event_ring_bufs_alloc: + rocker_dma_ring_destroy(rocker, &rocker->event_ring); + err_dma_event_ring_create: ++ rocker_dma_cmd_ring_waits_free(rocker); ++err_dma_cmd_ring_waits_alloc: + rocker_dma_ring_bufs_free(rocker, &rocker->cmd_ring, + PCI_DMA_BIDIRECTIONAL); +-err_dma_cmd_ring_waits_alloc: +- rocker_dma_cmd_ring_waits_free(rocker); + err_dma_cmd_ring_bufs_alloc: + rocker_dma_ring_destroy(rocker, &rocker->cmd_ring); + return err; +diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c +index aaff07c10058..a453b82d1077 100644 +--- a/drivers/net/hamradio/yam.c ++++ b/drivers/net/hamradio/yam.c +@@ -1160,6 +1160,7 @@ static int __init yam_init_driver(void) + err = register_netdev(dev); + if (err) { + printk(KERN_WARNING "yam: cannot register net device %s\n", dev->name); ++ free_netdev(dev); + goto error; + } + yam_devs[i] = dev; +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 559af8e6ad90..0434ecf67712 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1396,10 +1396,10 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + } + + if (pkt_cnt == 0) { +- /* Skip IP alignment psudo header */ +- skb_pull(skb, 2); + skb->len = pkt_len; +- skb_set_tail_pointer(skb, pkt_len); ++ /* Skip IP alignment pseudo header */ ++ skb_pull(skb, 2); ++ skb_set_tail_pointer(skb, skb->len); + skb->truesize = pkt_len + sizeof(struct sk_buff); + ax88179_rx_checksum(skb, pkt_hdr); + return 1; +@@ -1408,8 +1408,9 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + ax_skb = skb_clone(skb, GFP_ATOMIC); + if (ax_skb) { + ax_skb->len = pkt_len; +- ax_skb->data = skb->data + 2; +- skb_set_tail_pointer(ax_skb, pkt_len); ++ /* Skip IP alignment pseudo header */ ++ skb_pull(ax_skb, 2); ++ skb_set_tail_pointer(ax_skb, ax_skb->len); + ax_skb->truesize = pkt_len + sizeof(struct sk_buff); + ax88179_rx_checksum(ax_skb, pkt_hdr); + usbnet_skb_return(dev, ax_skb); +diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c +index 1dbd09c91a7c..736d9f58438e 100644 +--- a/drivers/pci/host/pci-aardvark.c ++++ b/drivers/pci/host/pci-aardvark.c +@@ -363,10 +363,6 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) + + advk_pcie_wait_for_link(pcie); + +- reg = PCIE_CORE_LINK_L0S_ENTRY | +- (1 << PCIE_CORE_LINK_WIDTH_SHIFT); +- advk_writel(pcie, reg, PCIE_CORE_LINK_CTRL_STAT_REG); +- + reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG); + reg |= PCIE_CORE_CMD_MEM_ACCESS_EN | + PCIE_CORE_CMD_IO_ACCESS_EN | +diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c +index 7f6b454bca65..3ff423220df6 100644 +--- a/drivers/pci/host/pcie-rcar.c ++++ b/drivers/pci/host/pcie-rcar.c +@@ -328,11 +328,12 @@ static struct pci_ops rcar_pcie_ops = { + }; + + static void rcar_pcie_setup_window(int win, struct rcar_pcie *pcie, +- struct resource *res) ++ struct resource_entry *window) + { + /* Setup PCIe address space mappings for each resource */ + resource_size_t size; + resource_size_t res_start; ++ struct resource *res = window->res; + u32 mask; + + rcar_pci_write_reg(pcie, 0x00000000, PCIEPTCTLR(win)); +@@ -346,9 +347,9 @@ static void rcar_pcie_setup_window(int win, struct rcar_pcie *pcie, + rcar_pci_write_reg(pcie, mask << 7, PCIEPAMR(win)); + + if (res->flags & IORESOURCE_IO) +- res_start = pci_pio_to_address(res->start); ++ res_start = pci_pio_to_address(res->start) - window->offset; + else +- res_start = res->start; ++ res_start = res->start - window->offset; + + rcar_pci_write_reg(pcie, upper_32_bits(res_start), PCIEPAUR(win)); + rcar_pci_write_reg(pcie, lower_32_bits(res_start) & ~0x7F, +@@ -377,7 +378,7 @@ static int rcar_pcie_setup(struct list_head *resource, struct rcar_pcie *pci) + switch (resource_type(res)) { + case IORESOURCE_IO: + case IORESOURCE_MEM: +- rcar_pcie_setup_window(i, pci, res); ++ rcar_pcie_setup_window(i, pci, win); + i++; + break; + case IORESOURCE_BUS: +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index 4a5fde58974a..75551a781e88 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -410,16 +410,6 @@ static void pcie_aspm_cap_init(struct pcie_link_state *link, int blacklist) + + /* Setup initial capable state. Will be updated later */ + link->aspm_capable = link->aspm_support; +- /* +- * If the downstream component has pci bridge function, don't +- * do ASPM for now. +- */ +- list_for_each_entry(child, &linkbus->devices, bus_list) { +- if (pci_pcie_type(child) == PCI_EXP_TYPE_PCI_BRIDGE) { +- link->aspm_disable = ASPM_STATE_ALL; +- break; +- } +- } + + /* Get and check endpoint acceptable latencies */ + list_for_each_entry(child, &linkbus->devices, bus_list) { +diff --git a/drivers/pci/pcie/ptm.c b/drivers/pci/pcie/ptm.c +index 3008bba360f3..ec6f6213960b 100644 +--- a/drivers/pci/pcie/ptm.c ++++ b/drivers/pci/pcie/ptm.c +@@ -47,10 +47,6 @@ void pci_ptm_init(struct pci_dev *dev) + if (!pci_is_pcie(dev)) + return; + +- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_PTM); +- if (!pos) +- return; +- + /* + * Enable PTM only on interior devices (root ports, switch ports, + * etc.) on the assumption that it causes no link traffic until an +@@ -60,6 +56,23 @@ void pci_ptm_init(struct pci_dev *dev) + pci_pcie_type(dev) == PCI_EXP_TYPE_RC_END)) + return; + ++ /* ++ * Switch Downstream Ports are not permitted to have a PTM ++ * capability; their PTM behavior is controlled by the Upstream ++ * Port (PCIe r5.0, sec 7.9.16). ++ */ ++ ups = pci_upstream_bridge(dev); ++ if (pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM && ++ ups && ups->ptm_enabled) { ++ dev->ptm_granularity = ups->ptm_granularity; ++ dev->ptm_enabled = 1; ++ return; ++ } ++ ++ pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_PTM); ++ if (!pos) ++ return; ++ + pci_read_config_dword(dev, pos + PCI_PTM_CAP, &cap); + local_clock = (cap & PCI_PTM_GRANULARITY_MASK) >> 8; + +@@ -69,7 +82,6 @@ void pci_ptm_init(struct pci_dev *dev) + * the spec recommendation (PCIe r3.1, sec 7.32.3), select the + * furthest upstream Time Source as the PTM Root. + */ +- ups = pci_upstream_bridge(dev); + if (ups && ups->ptm_enabled) { + ctrl = PCI_PTM_CTRL_ENABLE; + if (ups->ptm_granularity == 0) +diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c +index e2cca91fd266..68108c4c3969 100644 +--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c ++++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c +@@ -642,7 +642,6 @@ int imx1_pinctrl_core_probe(struct platform_device *pdev, + + ret = of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev); + if (ret) { +- pinctrl_unregister(ipctl->pctl); + dev_err(&pdev->dev, "Failed to populate subdevices\n"); + return ret; + } +diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig +index 76806a0be820..0de9a958b29a 100644 +--- a/drivers/power/supply/Kconfig ++++ b/drivers/power/supply/Kconfig +@@ -424,7 +424,7 @@ config CHARGER_BQ24257 + tristate "TI BQ24250/24251/24257 battery charger driver" + depends on I2C + depends on GPIOLIB || COMPILE_TEST +- depends on REGMAP_I2C ++ select REGMAP_I2C + help + Say Y to enable support for the TI BQ24250, BQ24251, and BQ24257 battery + chargers. +diff --git a/drivers/power/supply/lp8788-charger.c b/drivers/power/supply/lp8788-charger.c +index cd614fe69d14..c3075ea011b6 100644 +--- a/drivers/power/supply/lp8788-charger.c ++++ b/drivers/power/supply/lp8788-charger.c +@@ -603,27 +603,14 @@ static void lp8788_setup_adc_channel(struct device *dev, + return; + + /* ADC channel for battery voltage */ +- chan = iio_channel_get(dev, pdata->adc_vbatt); ++ chan = devm_iio_channel_get(dev, pdata->adc_vbatt); + pchg->chan[LP8788_VBATT] = IS_ERR(chan) ? NULL : chan; + + /* ADC channel for battery temperature */ +- chan = iio_channel_get(dev, pdata->adc_batt_temp); ++ chan = devm_iio_channel_get(dev, pdata->adc_batt_temp); + pchg->chan[LP8788_BATT_TEMP] = IS_ERR(chan) ? NULL : chan; + } + +-static void lp8788_release_adc_channel(struct lp8788_charger *pchg) +-{ +- int i; +- +- for (i = 0; i < LP8788_NUM_CHG_ADC; i++) { +- if (!pchg->chan[i]) +- continue; +- +- iio_channel_release(pchg->chan[i]); +- pchg->chan[i] = NULL; +- } +-} +- + static ssize_t lp8788_show_charger_status(struct device *dev, + struct device_attribute *attr, char *buf) + { +@@ -744,7 +731,6 @@ static int lp8788_charger_remove(struct platform_device *pdev) + lp8788_irq_unregister(pdev, pchg); + sysfs_remove_group(&pdev->dev.kobj, &lp8788_attr_group); + lp8788_psy_unregister(pchg); +- lp8788_release_adc_channel(pchg); + + return 0; + } +diff --git a/drivers/power/supply/smb347-charger.c b/drivers/power/supply/smb347-charger.c +index 072c5189bd6d..0655dbdc7000 100644 +--- a/drivers/power/supply/smb347-charger.c ++++ b/drivers/power/supply/smb347-charger.c +@@ -1141,6 +1141,7 @@ static bool smb347_volatile_reg(struct device *dev, unsigned int reg) + switch (reg) { + case IRQSTAT_A: + case IRQSTAT_C: ++ case IRQSTAT_D: + case IRQSTAT_E: + case IRQSTAT_F: + case STAT_A: +diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h +index 7e70f9298cc1..11f6ebd04545 100644 +--- a/drivers/s390/cio/qdio.h ++++ b/drivers/s390/cio/qdio.h +@@ -376,7 +376,6 @@ static inline int multicast_outbound(struct qdio_q *q) + extern u64 last_ai_time; + + /* prototypes for thin interrupt */ +-void qdio_setup_thinint(struct qdio_irq *irq_ptr); + int qdio_establish_thinint(struct qdio_irq *irq_ptr); + void qdio_shutdown_thinint(struct qdio_irq *irq_ptr); + void tiqdio_add_input_queues(struct qdio_irq *irq_ptr); +diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c +index d0090c5c88e7..a64615a10352 100644 +--- a/drivers/s390/cio/qdio_setup.c ++++ b/drivers/s390/cio/qdio_setup.c +@@ -479,7 +479,6 @@ int qdio_setup_irq(struct qdio_initialize *init_data) + setup_queues(irq_ptr, init_data); + + setup_qib(irq_ptr, init_data); +- qdio_setup_thinint(irq_ptr); + set_impl_params(irq_ptr, init_data->qib_param_field_format, + init_data->qib_param_field, + init_data->input_slib_elements, +diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c +index debe69adfc70..aecb6445a567 100644 +--- a/drivers/s390/cio/qdio_thinint.c ++++ b/drivers/s390/cio/qdio_thinint.c +@@ -268,17 +268,19 @@ int __init tiqdio_register_thinints(void) + + int qdio_establish_thinint(struct qdio_irq *irq_ptr) + { ++ int rc; ++ + if (!is_thinint_irq(irq_ptr)) + return 0; +- return set_subchannel_ind(irq_ptr, 0); +-} + +-void qdio_setup_thinint(struct qdio_irq *irq_ptr) +-{ +- if (!is_thinint_irq(irq_ptr)) +- return; + irq_ptr->dsci = get_indicator(); + DBF_HEX(&irq_ptr->dsci, sizeof(void *)); ++ ++ rc = set_subchannel_ind(irq_ptr, 0); ++ if (rc) ++ put_indicator(irq_ptr->dsci); ++ ++ return rc; + } + + void qdio_shutdown_thinint(struct qdio_irq *irq_ptr) +diff --git a/drivers/scsi/arm/acornscsi.c b/drivers/scsi/arm/acornscsi.c +index 12b88294d667..76ad20e49126 100644 +--- a/drivers/scsi/arm/acornscsi.c ++++ b/drivers/scsi/arm/acornscsi.c +@@ -2913,8 +2913,10 @@ static int acornscsi_probe(struct expansion_card *ec, const struct ecard_id *id) + + ashost->base = ecardm_iomap(ec, ECARD_RES_MEMC, 0, 0); + ashost->fast = ecardm_iomap(ec, ECARD_RES_IOCFAST, 0, 0); +- if (!ashost->base || !ashost->fast) ++ if (!ashost->base || !ashost->fast) { ++ ret = -ENOMEM; + goto out_put; ++ } + + host->irq = ec->irq; + ashost->host = host; +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index e1730227b448..f299839698a3 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -425,6 +425,8 @@ static int ibmvscsi_reenable_crq_queue(struct crq_queue *queue, + int rc = 0; + struct vio_dev *vdev = to_vio_dev(hostdata->dev); + ++ set_adapter_info(hostdata); ++ + /* Re-enable the CRQ */ + do { + if (rc) +diff --git a/drivers/scsi/iscsi_boot_sysfs.c b/drivers/scsi/iscsi_boot_sysfs.c +index d453667612f8..15d64f96e623 100644 +--- a/drivers/scsi/iscsi_boot_sysfs.c ++++ b/drivers/scsi/iscsi_boot_sysfs.c +@@ -360,7 +360,7 @@ iscsi_boot_create_kobj(struct iscsi_boot_kset *boot_kset, + boot_kobj->kobj.kset = boot_kset->kset; + if (kobject_init_and_add(&boot_kobj->kobj, &iscsi_boot_ktype, + NULL, name, index)) { +- kfree(boot_kobj); ++ kobject_put(&boot_kobj->kobj); + return NULL; + } + boot_kobj->data = data; +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 4901bf24916b..09dbf3021bb0 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -7606,6 +7606,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, + spin_lock_irq(shost->host_lock); + if (ndlp->nlp_flag & NLP_IN_DEV_LOSS) { + spin_unlock_irq(shost->host_lock); ++ if (newnode) ++ lpfc_nlp_put(ndlp); + goto dropit; + } + spin_unlock_irq(shost->host_lock); +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 6ccde2b41517..601a93953307 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -3166,7 +3166,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->scsi_lookup = NULL; + } + kfree(ioc->hpr_lookup); ++ ioc->hpr_lookup = NULL; + kfree(ioc->internal_lookup); ++ ioc->internal_lookup = NULL; + if (ioc->chain_lookup) { + for (i = 0; i < ioc->chain_depth; i++) { + if (ioc->chain_lookup[i].chain_buffer) +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index abdd6f93c8fe..324cddd4656e 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -855,6 +855,7 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item, + + atomic_set(&tpg->lport_tpg_enabled, 0); + qlt_stop_phase1(vha->vha_tgt.qla_tgt); ++ qlt_stop_phase2(vha->vha_tgt.qla_tgt); + } + + return count; +@@ -1019,6 +1020,7 @@ static ssize_t tcm_qla2xxx_npiv_tpg_enable_store(struct config_item *item, + + atomic_set(&tpg->lport_tpg_enabled, 0); + qlt_stop_phase1(vha->vha_tgt.qla_tgt); ++ qlt_stop_phase2(vha->vha_tgt.qla_tgt); + } + + return count; +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index d596b76eea64..aad9195b356a 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -451,7 +451,8 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, + /* + * vendor strings must be an exact match + */ +- if (vmax != strlen(devinfo->vendor) || ++ if (vmax != strnlen(devinfo->vendor, ++ sizeof(devinfo->vendor)) || + memcmp(devinfo->vendor, vskip, vmax)) + continue; + +@@ -459,7 +460,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor, + * @model specifies the full string, and + * must be larger or equal to devinfo->model + */ +- mlen = strlen(devinfo->model); ++ mlen = strnlen(devinfo->model, sizeof(devinfo->model)); + if (mmax < mlen || memcmp(devinfo->model, mskip, mlen)) + continue; + return devinfo; +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c +index cc484cb287d2..67a73ea0a615 100644 +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -745,7 +745,7 @@ static int sr_probe(struct device *dev) + cd->cdi.disk = disk; + + if (register_cdrom(&cd->cdi)) +- goto fail_put; ++ goto fail_minor; + + /* + * Initialize block layer runtime PM stuffs before the +@@ -763,6 +763,10 @@ static int sr_probe(struct device *dev) + + return 0; + ++fail_minor: ++ spin_lock(&sr_index_lock); ++ clear_bit(minor, sr_index_bits); ++ spin_unlock(&sr_index_lock); + fail_put: + put_disk(disk); + fail_free: +diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c +index 86ace1449309..ee54711cf8e8 100644 +--- a/drivers/staging/sm750fb/sm750.c ++++ b/drivers/staging/sm750fb/sm750.c +@@ -897,6 +897,7 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index) + fix->visual = FB_VISUAL_PSEUDOCOLOR; + break; + case 16: ++ case 24: + case 32: + fix->visual = FB_VISUAL_TRUECOLOR; + break; +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 9e9016e67843..1ab9bd433542 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -681,11 +681,10 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len, + * FIXME: lock against link layer control transmissions + */ + +-static void gsm_data_kick(struct gsm_mux *gsm) ++static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci) + { + struct gsm_msg *msg, *nmsg; + int len; +- int skip_sof = 0; + + list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) { + if (gsm->constipated && msg->addr) +@@ -707,18 +706,23 @@ static void gsm_data_kick(struct gsm_mux *gsm) + print_hex_dump_bytes("gsm_data_kick: ", + DUMP_PREFIX_OFFSET, + gsm->txframe, len); +- +- if (gsm->output(gsm, gsm->txframe + skip_sof, +- len - skip_sof) < 0) ++ if (gsm->output(gsm, gsm->txframe, len) < 0) + break; + /* FIXME: Can eliminate one SOF in many more cases */ + gsm->tx_bytes -= msg->len; +- /* For a burst of frames skip the extra SOF within the +- burst */ +- skip_sof = 1; + + list_del(&msg->list); + kfree(msg); ++ ++ if (dlci) { ++ tty_port_tty_wakeup(&dlci->port); ++ } else { ++ int i = 0; ++ ++ for (i = 0; i < NUM_DLCI; i++) ++ if (gsm->dlci[i]) ++ tty_port_tty_wakeup(&gsm->dlci[i]->port); ++ } + } + } + +@@ -770,7 +774,7 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) + /* Add to the actual output queue */ + list_add_tail(&msg->list, &gsm->tx_list); + gsm->tx_bytes += msg->len; +- gsm_data_kick(gsm); ++ gsm_data_kick(gsm, dlci); + } + + /** +@@ -1231,7 +1235,7 @@ static void gsm_control_message(struct gsm_mux *gsm, unsigned int command, + gsm_control_reply(gsm, CMD_FCON, NULL, 0); + /* Kick the link in case it is idling */ + spin_lock_irqsave(&gsm->tx_lock, flags); +- gsm_data_kick(gsm); ++ gsm_data_kick(gsm, NULL); + spin_unlock_irqrestore(&gsm->tx_lock, flags); + break; + case CMD_FCOFF: +@@ -2414,7 +2418,7 @@ static void gsmld_write_wakeup(struct tty_struct *tty) + /* Queue poll */ + clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); + spin_lock_irqsave(&gsm->tx_lock, flags); +- gsm_data_kick(gsm); ++ gsm_data_kick(gsm, NULL); + if (gsm->tx_bytes < TX_THRESH_LO) { + gsm_dlci_data_sweep(gsm); + } +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index f6586a8681b9..b3b9b3d2cddf 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -2524,6 +2524,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap, + uap->port.fifosize = uap->fifosize; + uap->port.flags = UPF_BOOT_AUTOCONF; + uap->port.line = index; ++ spin_lock_init(&uap->port.lock); + + amba_ports[index] = uap; + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 5b0bffba4aac..2dc563b61b88 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1627,6 +1627,8 @@ static int acm_reset_resume(struct usb_interface *intf) + + static const struct usb_device_id acm_ids[] = { + /* quirky and broken devices */ ++ { USB_DEVICE(0x0424, 0x274e), /* Microchip Technology, Inc. (formerly SMSC) */ ++ .driver_info = DISABLE_ECHO, }, /* DISABLE ECHO in termios flag */ + { USB_DEVICE(0x076d, 0x0006), /* Denso Cradle CU-321 */ + .driver_info = NO_UNION_NORMAL, },/* has no union descriptor */ + { USB_DEVICE(0x17ef, 0x7000), /* Lenovo USB modem */ +diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c +index 07c3c3449147..c578d64edc15 100644 +--- a/drivers/usb/class/usblp.c ++++ b/drivers/usb/class/usblp.c +@@ -481,7 +481,8 @@ static int usblp_release(struct inode *inode, struct file *file) + usb_autopm_put_interface(usblp->intf); + + if (!usblp->present) /* finish cleanup from disconnect */ +- usblp_cleanup(usblp); ++ usblp_cleanup(usblp); /* any URBs must be dead */ ++ + mutex_unlock(&usblp_mutex); + return 0; + } +@@ -1397,9 +1398,11 @@ static void usblp_disconnect(struct usb_interface *intf) + + usblp_unlink_urbs(usblp); + mutex_unlock(&usblp->mut); ++ usb_poison_anchored_urbs(&usblp->urbs); + + if (!usblp->used) + usblp_cleanup(usblp); ++ + mutex_unlock(&usblp_mutex); + } + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 27d05f0134de..e6e0f786547b 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -73,11 +73,12 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Logitech HD Webcam C270 */ + { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME }, + +- /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */ ++ /* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */ + { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x046d, 0x085c), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Logitech ConferenceCam CC3000e */ + { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT }, +diff --git a/drivers/usb/dwc2/core_intr.c b/drivers/usb/dwc2/core_intr.c +index d85c5c9f96c1..f046703f63f2 100644 +--- a/drivers/usb/dwc2/core_intr.c ++++ b/drivers/usb/dwc2/core_intr.c +@@ -365,10 +365,13 @@ static void dwc2_handle_wakeup_detected_intr(struct dwc2_hsotg *hsotg) + if (ret && (ret != -ENOTSUPP)) + dev_err(hsotg->dev, "exit hibernation failed\n"); + ++ /* Change to L0 state */ ++ hsotg->lx_state = DWC2_L0; + call_gadget(hsotg, resume); ++ } else { ++ /* Change to L0 state */ ++ hsotg->lx_state = DWC2_L0; + } +- /* Change to L0 state */ +- hsotg->lx_state = DWC2_L0; + } else { + if (hsotg->core_params->hibernation) + return; +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 3ae27b6ed07c..9381a108a985 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -3947,12 +3947,6 @@ int dwc2_gadget_init(struct dwc2_hsotg *hsotg, int irq) + epnum, 0); + } + +- ret = usb_add_gadget_udc(dev, &hsotg->gadget); +- if (ret) { +- dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, +- hsotg->ctrl_req); +- return ret; +- } + dwc2_hsotg_dump(hsotg); + + return 0; +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index 8e1728b39a49..63178ed7f650 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -661,6 +661,17 @@ static int dwc2_driver_probe(struct platform_device *dev) + if (hsotg->dr_mode == USB_DR_MODE_PERIPHERAL) + dwc2_lowlevel_hw_disable(hsotg); + ++#if IS_ENABLED(CONFIG_USB_DWC2_PERIPHERAL) || \ ++ IS_ENABLED(CONFIG_USB_DWC2_DUAL_ROLE) ++ /* Postponed adding a new gadget to the udc class driver list */ ++ if (hsotg->gadget_enabled) { ++ retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget); ++ if (retval) { ++ dwc2_hsotg_remove(hsotg); ++ goto error; ++ } ++ } ++#endif /* CONFIG_USB_DWC2_PERIPHERAL || CONFIG_USB_DWC2_DUAL_ROLE */ + return 0; + + error: +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 2e545d025030..5a1723d99fe5 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -100,40 +100,43 @@ function_descriptors(struct usb_function *f, + } + + /** +- * next_ep_desc() - advance to the next EP descriptor ++ * next_desc() - advance to the next desc_type descriptor + * @t: currect pointer within descriptor array ++ * @desc_type: descriptor type + * +- * Return: next EP descriptor or NULL ++ * Return: next desc_type descriptor or NULL + * +- * Iterate over @t until either EP descriptor found or ++ * Iterate over @t until either desc_type descriptor found or + * NULL (that indicates end of list) encountered + */ + static struct usb_descriptor_header** +-next_ep_desc(struct usb_descriptor_header **t) ++next_desc(struct usb_descriptor_header **t, u8 desc_type) + { + for (; *t; t++) { +- if ((*t)->bDescriptorType == USB_DT_ENDPOINT) ++ if ((*t)->bDescriptorType == desc_type) + return t; + } + return NULL; + } + + /* +- * for_each_ep_desc()- iterate over endpoint descriptors in the +- * descriptors list +- * @start: pointer within descriptor array. +- * @ep_desc: endpoint descriptor to use as the loop cursor ++ * for_each_desc() - iterate over desc_type descriptors in the ++ * descriptors list ++ * @start: pointer within descriptor array. ++ * @iter_desc: desc_type descriptor to use as the loop cursor ++ * @desc_type: wanted descriptr type + */ +-#define for_each_ep_desc(start, ep_desc) \ +- for (ep_desc = next_ep_desc(start); \ +- ep_desc; ep_desc = next_ep_desc(ep_desc+1)) ++#define for_each_desc(start, iter_desc, desc_type) \ ++ for (iter_desc = next_desc(start, desc_type); \ ++ iter_desc; iter_desc = next_desc(iter_desc + 1, desc_type)) + + /** +- * config_ep_by_speed() - configures the given endpoint ++ * config_ep_by_speed_and_alt() - configures the given endpoint + * according to gadget speed. + * @g: pointer to the gadget + * @f: usb function + * @_ep: the endpoint to configure ++ * @alt: alternate setting number + * + * Return: error code, 0 on success + * +@@ -146,11 +149,13 @@ next_ep_desc(struct usb_descriptor_header **t) + * Note: the supplied function should hold all the descriptors + * for supported speeds + */ +-int config_ep_by_speed(struct usb_gadget *g, +- struct usb_function *f, +- struct usb_ep *_ep) ++int config_ep_by_speed_and_alt(struct usb_gadget *g, ++ struct usb_function *f, ++ struct usb_ep *_ep, ++ u8 alt) + { + struct usb_endpoint_descriptor *chosen_desc = NULL; ++ struct usb_interface_descriptor *int_desc = NULL; + struct usb_descriptor_header **speed_desc = NULL; + + struct usb_ss_ep_comp_descriptor *comp_desc = NULL; +@@ -186,8 +191,21 @@ int config_ep_by_speed(struct usb_gadget *g, + default: + speed_desc = f->fs_descriptors; + } ++ ++ /* find correct alternate setting descriptor */ ++ for_each_desc(speed_desc, d_spd, USB_DT_INTERFACE) { ++ int_desc = (struct usb_interface_descriptor *)*d_spd; ++ ++ if (int_desc->bAlternateSetting == alt) { ++ speed_desc = d_spd; ++ goto intf_found; ++ } ++ } ++ return -EIO; ++ ++intf_found: + /* find descriptors */ +- for_each_ep_desc(speed_desc, d_spd) { ++ for_each_desc(speed_desc, d_spd, USB_DT_ENDPOINT) { + chosen_desc = (struct usb_endpoint_descriptor *)*d_spd; + if (chosen_desc->bEndpointAddress == _ep->address) + goto ep_found; +@@ -240,6 +258,32 @@ ep_found: + } + return 0; + } ++EXPORT_SYMBOL_GPL(config_ep_by_speed_and_alt); ++ ++/** ++ * config_ep_by_speed() - configures the given endpoint ++ * according to gadget speed. ++ * @g: pointer to the gadget ++ * @f: usb function ++ * @_ep: the endpoint to configure ++ * ++ * Return: error code, 0 on success ++ * ++ * This function chooses the right descriptors for a given ++ * endpoint according to gadget speed and saves it in the ++ * endpoint desc field. If the endpoint already has a descriptor ++ * assigned to it - overwrites it with currently corresponding ++ * descriptor. The endpoint maxpacket field is updated according ++ * to the chosen descriptor. ++ * Note: the supplied function should hold all the descriptors ++ * for supported speeds ++ */ ++int config_ep_by_speed(struct usb_gadget *g, ++ struct usb_function *f, ++ struct usb_ep *_ep) ++{ ++ return config_ep_by_speed_and_alt(g, f, _ep, 0); ++} + EXPORT_SYMBOL_GPL(config_ep_by_speed); + + /** +diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c +index ac2aa04ca657..710793161795 100644 +--- a/drivers/usb/gadget/udc/lpc32xx_udc.c ++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c +@@ -1615,17 +1615,17 @@ static int lpc32xx_ep_enable(struct usb_ep *_ep, + const struct usb_endpoint_descriptor *desc) + { + struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep); +- struct lpc32xx_udc *udc = ep->udc; ++ struct lpc32xx_udc *udc; + u16 maxpacket; + u32 tmp; + unsigned long flags; + + /* Verify EP data */ + if ((!_ep) || (!ep) || (!desc) || +- (desc->bDescriptorType != USB_DT_ENDPOINT)) { +- dev_dbg(udc->dev, "bad ep or descriptor\n"); ++ (desc->bDescriptorType != USB_DT_ENDPOINT)) + return -EINVAL; +- } ++ ++ udc = ep->udc; + maxpacket = usb_endpoint_maxp(desc); + if ((maxpacket == 0) || (maxpacket > ep->maxpacket)) { + dev_dbg(udc->dev, "bad ep descriptor's packet size\n"); +@@ -1873,7 +1873,7 @@ static int lpc32xx_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req) + static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value) + { + struct lpc32xx_ep *ep = container_of(_ep, struct lpc32xx_ep, ep); +- struct lpc32xx_udc *udc = ep->udc; ++ struct lpc32xx_udc *udc; + unsigned long flags; + + if ((!ep) || (ep->hwep_num <= 1)) +@@ -1883,6 +1883,7 @@ static int lpc32xx_ep_set_halt(struct usb_ep *_ep, int value) + if (ep->is_in) + return -EAGAIN; + ++ udc = ep->udc; + spin_lock_irqsave(&udc->lock, flags); + + if (value == 1) { +diff --git a/drivers/usb/gadget/udc/m66592-udc.c b/drivers/usb/gadget/udc/m66592-udc.c +index 6e977dc22570..1be409644a48 100644 +--- a/drivers/usb/gadget/udc/m66592-udc.c ++++ b/drivers/usb/gadget/udc/m66592-udc.c +@@ -1672,7 +1672,7 @@ static int m66592_probe(struct platform_device *pdev) + + err_add_udc: + m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req); +- ++ m66592->ep0_req = NULL; + clean_up3: + if (m66592->pdata->on_chip) { + clk_disable(m66592->clk); +diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c +index ce73b3552269..8700db903382 100644 +--- a/drivers/usb/gadget/udc/mv_udc_core.c ++++ b/drivers/usb/gadget/udc/mv_udc_core.c +@@ -2317,7 +2317,8 @@ static int mv_udc_probe(struct platform_device *pdev) + return 0; + + err_create_workqueue: +- destroy_workqueue(udc->qwork); ++ if (udc->qwork) ++ destroy_workqueue(udc->qwork); + err_destroy_dma: + dma_pool_destroy(udc->dtd_pool); + err_free_dma: +diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c +index eb3571ee59e3..08153a48704b 100644 +--- a/drivers/usb/gadget/udc/s3c2410_udc.c ++++ b/drivers/usb/gadget/udc/s3c2410_udc.c +@@ -269,10 +269,6 @@ static void s3c2410_udc_done(struct s3c2410_ep *ep, + static void s3c2410_udc_nuke(struct s3c2410_udc *udc, + struct s3c2410_ep *ep, int status) + { +- /* Sanity check */ +- if (&ep->queue == NULL) +- return; +- + while (!list_empty(&ep->queue)) { + struct s3c2410_request *req; + req = list_entry(ep->queue.next, struct s3c2410_request, +diff --git a/drivers/usb/host/ehci-exynos.c b/drivers/usb/host/ehci-exynos.c +index 7a603f66a9bc..44b7c3e780f6 100644 +--- a/drivers/usb/host/ehci-exynos.c ++++ b/drivers/usb/host/ehci-exynos.c +@@ -199,9 +199,8 @@ skip_phy: + hcd->rsrc_len = resource_size(res); + + irq = platform_get_irq(pdev, 0); +- if (!irq) { +- dev_err(&pdev->dev, "Failed to get IRQ\n"); +- err = -ENODEV; ++ if (irq < 0) { ++ err = irq; + goto fail_io; + } + +diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c +index c7a9b31eeaef..637079a35003 100644 +--- a/drivers/usb/host/ehci-mxc.c ++++ b/drivers/usb/host/ehci-mxc.c +@@ -63,6 +63,8 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return irq; + + hcd = usb_create_hcd(&ehci_mxc_hc_driver, dev, dev_name(dev)); + if (!hcd) +diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c +index 3b3649d88c5f..08b3f8c80601 100644 +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -229,6 +229,13 @@ static int ehci_pci_setup(struct usb_hcd *hcd) + ehci_info(ehci, "applying MosChip frame-index workaround\n"); + ehci->frame_index_bug = 1; + break; ++ case PCI_VENDOR_ID_HUAWEI: ++ /* Synopsys HC bug */ ++ if (pdev->device == 0xa239) { ++ ehci_info(ehci, "applying Synopsys HC workaround\n"); ++ ehci->has_synopsys_hc_bug = 1; ++ } ++ break; + } + + /* optional debug port, normally in the first BAR */ +diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c +index a268d9e8d6cf..1b141e9299f9 100644 +--- a/drivers/usb/host/ehci-platform.c ++++ b/drivers/usb/host/ehci-platform.c +@@ -378,6 +378,11 @@ static int ehci_platform_resume(struct device *dev) + } + + ehci_resume(hcd, priv->reset_on_resume); ++ ++ pm_runtime_disable(dev); ++ pm_runtime_set_active(dev); ++ pm_runtime_enable(dev); ++ + return 0; + } + #endif /* CONFIG_PM_SLEEP */ +diff --git a/drivers/usb/host/ohci-platform.c b/drivers/usb/host/ohci-platform.c +index 898b74086c12..9e3fdb1421f7 100644 +--- a/drivers/usb/host/ohci-platform.c ++++ b/drivers/usb/host/ohci-platform.c +@@ -340,6 +340,11 @@ static int ohci_platform_resume(struct device *dev) + } + + ohci_resume(hcd, false); ++ ++ pm_runtime_disable(dev); ++ pm_runtime_set_active(dev); ++ pm_runtime_enable(dev); ++ + return 0; + } + #endif /* CONFIG_PM_SLEEP */ +diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c +index a8b8d8b8d9f3..a960d2bb8dd1 100644 +--- a/drivers/usb/host/ohci-sm501.c ++++ b/drivers/usb/host/ohci-sm501.c +@@ -196,6 +196,7 @@ static int ohci_hcd_sm501_drv_remove(struct platform_device *pdev) + struct resource *mem; + + usb_remove_hcd(hcd); ++ iounmap(hcd->regs); + release_mem_region(hcd->rsrc_start, hcd->rsrc_len); + usb_put_hcd(hcd); + dma_release_declared_memory(&pdev->dev); +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 781283a5138e..169d7b2feb1f 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -313,8 +313,17 @@ static int xhci_plat_resume(struct device *dev) + { + struct usb_hcd *hcd = dev_get_drvdata(dev); + struct xhci_hcd *xhci = hcd_to_xhci(hcd); ++ int ret; ++ ++ ret = xhci_resume(xhci, 0); ++ if (ret) ++ return ret; ++ ++ pm_runtime_disable(dev); ++ pm_runtime_set_active(dev); ++ pm_runtime_enable(dev); + +- return xhci_resume(xhci, 0); ++ return 0; + } + + static const struct dev_pm_ops xhci_plat_pm_ops = { +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index baacc442ec6a..b27987431079 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1347,6 +1347,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id, + xhci->devs[slot_id]->out_ctx, ep_index); + + ep_ctx = xhci_get_ep_ctx(xhci, command->in_ctx, ep_index); ++ ep_ctx->ep_info &= cpu_to_le32(~EP_STATE_MASK);/* must clear */ + ep_ctx->ep_info2 &= cpu_to_le32(~MAX_PACKET_MASK); + ep_ctx->ep_info2 |= cpu_to_le32(MAX_PACKET(max_packet_size)); + +@@ -4244,6 +4245,9 @@ int xhci_set_usb2_hardware_lpm(struct usb_hcd *hcd, + mutex_lock(hcd->bandwidth_mutex); + xhci_change_max_exit_latency(xhci, udev, 0); + mutex_unlock(hcd->bandwidth_mutex); ++ readl_poll_timeout(port_array[port_num], pm_val, ++ (pm_val & PORT_PLS_MASK) == XDEV_U0, ++ 100, 10000); + return 0; + } + } +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 2b603ef5c10c..2b8df83dad38 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -709,7 +709,7 @@ struct xhci_ep_ctx { + * 4 - TRB error + * 5-7 - reserved + */ +-#define EP_STATE_MASK (0xf) ++#define EP_STATE_MASK (0x7) + #define EP_STATE_DISABLED 0 + #define EP_STATE_RUNNING 1 + #define EP_STATE_HALTED 2 +diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c +index 84905d074c4f..ef45b8f5bf51 100644 +--- a/drivers/vfio/pci/vfio_pci_config.c ++++ b/drivers/vfio/pci/vfio_pci_config.c +@@ -1461,7 +1461,12 @@ static int vfio_cap_init(struct vfio_pci_device *vdev) + if (ret) + return ret; + +- if (cap <= PCI_CAP_ID_MAX) { ++ /* ++ * ID 0 is a NULL capability, conflicting with our fake ++ * PCI_CAP_ID_BASIC. As it has no content, consider it ++ * hidden for now. ++ */ ++ if (cap && cap <= PCI_CAP_ID_MAX) { + len = pci_cap_length[cap]; + if (len == 0xFF) { /* Variable length */ + len = vfio_cap_len(vdev, cap, pos); +@@ -1729,8 +1734,11 @@ void vfio_config_free(struct vfio_pci_device *vdev) + vdev->vconfig = NULL; + kfree(vdev->pci_config_map); + vdev->pci_config_map = NULL; +- kfree(vdev->msi_perm); +- vdev->msi_perm = NULL; ++ if (vdev->msi_perm) { ++ free_perm_bits(vdev->msi_perm); ++ kfree(vdev->msi_perm); ++ vdev->msi_perm = NULL; ++ } + } + + /* +diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c +index 939f057836e1..4cdc7a3f6dc5 100644 +--- a/drivers/video/backlight/lp855x_bl.c ++++ b/drivers/video/backlight/lp855x_bl.c +@@ -460,7 +460,7 @@ static int lp855x_probe(struct i2c_client *cl, const struct i2c_device_id *id) + ret = regulator_enable(lp->enable); + if (ret < 0) { + dev_err(lp->dev, "failed to enable vddio: %d\n", ret); +- return ret; ++ goto disable_supply; + } + + /* +@@ -475,24 +475,34 @@ static int lp855x_probe(struct i2c_client *cl, const struct i2c_device_id *id) + ret = lp855x_configure(lp); + if (ret) { + dev_err(lp->dev, "device config err: %d", ret); +- return ret; ++ goto disable_vddio; + } + + ret = lp855x_backlight_register(lp); + if (ret) { + dev_err(lp->dev, + "failed to register backlight. err: %d\n", ret); +- return ret; ++ goto disable_vddio; + } + + ret = sysfs_create_group(&lp->dev->kobj, &lp855x_attr_group); + if (ret) { + dev_err(lp->dev, "failed to register sysfs. err: %d\n", ret); +- return ret; ++ goto disable_vddio; + } + + backlight_update_status(lp->bl); ++ + return 0; ++ ++disable_vddio: ++ if (lp->enable) ++ regulator_disable(lp->enable); ++disable_supply: ++ if (lp->supply) ++ regulator_disable(lp->supply); ++ ++ return ret; + } + + static int lp855x_remove(struct i2c_client *cl) +@@ -501,6 +511,8 @@ static int lp855x_remove(struct i2c_client *cl) + + lp->bl->props.brightness = 0; + backlight_update_status(lp->bl); ++ if (lp->enable) ++ regulator_disable(lp->enable); + if (lp->supply) + regulator_disable(lp->supply); + sysfs_remove_group(&lp->dev->kobj, &lp855x_attr_group); +diff --git a/drivers/watchdog/da9062_wdt.c b/drivers/watchdog/da9062_wdt.c +index daeb645fcea8..519419136ce8 100644 +--- a/drivers/watchdog/da9062_wdt.c ++++ b/drivers/watchdog/da9062_wdt.c +@@ -94,11 +94,6 @@ static int da9062_wdt_update_timeout_register(struct da9062_watchdog *wdt, + unsigned int regval) + { + struct da9062 *chip = wdt->hw; +- int ret; +- +- ret = da9062_reset_watchdog_timer(wdt); +- if (ret) +- return ret; + + return regmap_update_bits(chip->regmap, + DA9062AA_CONTROL_D, +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 8a894cd4875b..06f7cbe20132 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1255,10 +1255,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + */ + if (!for_part) { + ret = devcgroup_inode_permission(bdev->bd_inode, perm); +- if (ret != 0) { +- bdput(bdev); ++ if (ret != 0) + return ret; +- } + } + + restart: +@@ -1330,8 +1328,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + goto out_clear; + BUG_ON(for_part); + ret = __blkdev_get(whole, mode, 1); +- if (ret) ++ if (ret) { ++ bdput(whole); + goto out_clear; ++ } + bdev->bd_contains = whole; + bdev->bd_part = disk_get_part(disk, partno); + if (!(disk->flags & GENHD_FL_UP) || +@@ -1382,7 +1382,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) + put_disk(disk); + module_put(owner); + out: +- bdput(bdev); + + return ret; + } +@@ -1468,6 +1467,9 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder) + bdput(whole); + } + ++ if (res) ++ bdput(bdev); ++ + return res; + } + EXPORT_SYMBOL(blkdev_get); +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 67d9b7a277a3..edd4c7292be0 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1220,6 +1220,12 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, + inode = d_inode(cfile->dentry); + cifsi = CIFS_I(inode); + ++ /* ++ * We zero the range through ioctl, so we need remove the page caches ++ * first, otherwise the data may be inconsistent with the server. ++ */ ++ truncate_pagecache_range(inode, offset, offset + len - 1); ++ + /* if file not oplocked can't be sure whether asking to extend size */ + if (!CIFS_CACHE_READ(cifsi)) + if (keep_size == false) +@@ -1276,6 +1282,12 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, + if (!smb2_set_sparse(xid, tcon, cfile, inode, set_sparse)) + return -EOPNOTSUPP; + ++ /* ++ * We implement the punch hole through ioctl, so we need remove the page ++ * caches first, otherwise the data may be inconsistent with the server. ++ */ ++ truncate_pagecache_range(inode, offset, offset + len - 1); ++ + cifs_dbg(FYI, "offset %lld len %lld", offset, len); + + fsctl_buf.FileOffset = cpu_to_le64(offset); +diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c +index 02ac9067a354..9fa3285425fe 100644 +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -1340,23 +1340,6 @@ COMPATIBLE_IOCTL(DMX_GET_PES_PIDS) + COMPATIBLE_IOCTL(DMX_GET_CAPS) + COMPATIBLE_IOCTL(DMX_SET_SOURCE) + COMPATIBLE_IOCTL(DMX_GET_STC) +-COMPATIBLE_IOCTL(FE_GET_INFO) +-COMPATIBLE_IOCTL(FE_DISEQC_RESET_OVERLOAD) +-COMPATIBLE_IOCTL(FE_DISEQC_SEND_MASTER_CMD) +-COMPATIBLE_IOCTL(FE_DISEQC_RECV_SLAVE_REPLY) +-COMPATIBLE_IOCTL(FE_DISEQC_SEND_BURST) +-COMPATIBLE_IOCTL(FE_SET_TONE) +-COMPATIBLE_IOCTL(FE_SET_VOLTAGE) +-COMPATIBLE_IOCTL(FE_ENABLE_HIGH_LNB_VOLTAGE) +-COMPATIBLE_IOCTL(FE_READ_STATUS) +-COMPATIBLE_IOCTL(FE_READ_BER) +-COMPATIBLE_IOCTL(FE_READ_SIGNAL_STRENGTH) +-COMPATIBLE_IOCTL(FE_READ_SNR) +-COMPATIBLE_IOCTL(FE_READ_UNCORRECTED_BLOCKS) +-COMPATIBLE_IOCTL(FE_SET_FRONTEND) +-COMPATIBLE_IOCTL(FE_GET_FRONTEND) +-COMPATIBLE_IOCTL(FE_GET_EVENT) +-COMPATIBLE_IOCTL(FE_DISHNETWORK_SEND_LEGACY_CMD) + COMPATIBLE_IOCTL(VIDEO_STOP) + COMPATIBLE_IOCTL(VIDEO_PLAY) + COMPATIBLE_IOCTL(VIDEO_FREEZE) +diff --git a/fs/dlm/dlm_internal.h b/fs/dlm/dlm_internal.h +index 216b61604ef9..c211156aabe2 100644 +--- a/fs/dlm/dlm_internal.h ++++ b/fs/dlm/dlm_internal.h +@@ -100,7 +100,6 @@ do { \ + __LINE__, __FILE__, #x, jiffies); \ + {do} \ + printk("\n"); \ +- BUG(); \ + panic("DLM: Record message above and reboot.\n"); \ + } \ + } +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 51c2713a615a..ab19f61bd04b 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -2916,7 +2916,7 @@ again: + * in use to avoid freeing it when removing blocks. + */ + if (sbi->s_cluster_ratio > 1) { +- pblk = ext4_ext_pblock(ex) + end - ee_block + 2; ++ pblk = ext4_ext_pblock(ex) + end - ee_block + 1; + partial_cluster = + -(long long) EXT4_B2C(sbi, pblk); + } +diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c +index 84e5ac061b17..bb5ddaabc218 100644 +--- a/fs/gfs2/ops_fstype.c ++++ b/fs/gfs2/ops_fstype.c +@@ -920,7 +920,7 @@ fail: + } + + static const match_table_t nolock_tokens = { +- { Opt_jid, "jid=%d\n", }, ++ { Opt_jid, "jid=%d", }, + { Opt_err, NULL }, + }; + +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index de135d2591ff..1affdec23729 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -379,8 +379,6 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq) + { + struct inode *inode = dreq->inode; + +- inode_dio_end(inode); +- + if (dreq->iocb) { + long res = (long) dreq->error; + if (dreq->count != 0) { +@@ -392,7 +390,10 @@ static void nfs_direct_complete(struct nfs_direct_req *dreq) + + complete(&dreq->completion); + ++ igrab(inode); + nfs_direct_req_release(dreq); ++ inode_dio_end(inode); ++ iput(inode); + } + + static void nfs_direct_readpage_release(struct nfs_page *req) +@@ -534,8 +535,10 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * generic layer handle the completion. + */ + if (requested_bytes == 0) { +- inode_dio_end(inode); ++ igrab(inode); + nfs_direct_req_release(dreq); ++ inode_dio_end(inode); ++ iput(inode); + return result < 0 ? result : -EIO; + } + +@@ -953,8 +956,10 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * generic layer handle the completion. + */ + if (requested_bytes == 0) { +- inode_dio_end(inode); ++ igrab(inode); + nfs_direct_req_release(dreq); ++ inode_dio_end(inode); ++ iput(inode); + return result < 0 ? result : -EIO; + } + +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 1eec947c562d..a89d2f793c1b 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -82,6 +82,7 @@ nfs_file_release(struct inode *inode, struct file *filp) + dprintk("NFS: release(%pD2)\n", filp); + + nfs_inc_stats(inode, NFSIOS_VFSRELEASE); ++ inode_dio_wait(inode); + nfs_file_clear_open_context(filp); + return 0; + } +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 4539008502ce..83149cbae093 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -939,9 +939,8 @@ retry: + goto out_mds; + + /* Use a direct mapping of ds_idx to pgio mirror_idx */ +- if (WARN_ON_ONCE(pgio->pg_mirror_count != +- FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg))) +- goto out_mds; ++ if (pgio->pg_mirror_count != FF_LAYOUT_MIRROR_COUNT(pgio->pg_lseg)) ++ goto out_eagain; + + for (i = 0; i < pgio->pg_mirror_count; i++) { + ds = nfs4_ff_layout_prepare_ds(pgio->pg_lseg, i, true); +@@ -960,11 +959,15 @@ retry: + } + + return; +- ++out_eagain: ++ pnfs_generic_pg_cleanup(pgio); ++ pgio->pg_error = -EAGAIN; ++ return; + out_mds: + pnfs_put_lseg(pgio->pg_lseg); + pgio->pg_lseg = NULL; + nfs_pageio_reset_write_mds(pgio); ++ pgio->pg_error = -EAGAIN; + } + + static unsigned int +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 632d3c3f8dfb..c189722bf9c7 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -7151,7 +7151,7 @@ nfs4_bind_one_conn_to_session_done(struct rpc_task *task, void *calldata) + } + + static const struct rpc_call_ops nfs4_bind_one_conn_to_session_ops = { +- .rpc_call_done = &nfs4_bind_one_conn_to_session_done, ++ .rpc_call_done = nfs4_bind_one_conn_to_session_done, + }; + + /* +diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c +index 8d842282111b..172f697864ab 100644 +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -1156,6 +1156,8 @@ static void nfsd4_process_cb_update(struct nfsd4_callback *cb) + err = setup_callback_client(clp, &conn, ses); + if (err) { + nfsd4_mark_cb_down(clp, err); ++ if (c) ++ svc_xprt_put(c->cn_xprt); + return; + } + } +diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h +index 44d178b8d1aa..c3697cf60500 100644 +--- a/fs/ocfs2/ocfs2_fs.h ++++ b/fs/ocfs2/ocfs2_fs.h +@@ -304,7 +304,7 @@ + #define OCFS2_MAX_SLOTS 255 + + /* Slot map indicator for an empty slot */ +-#define OCFS2_INVALID_SLOT -1 ++#define OCFS2_INVALID_SLOT ((u16)-1) + + #define OCFS2_VOL_UUID_LEN 16 + #define OCFS2_MAX_VOL_LABEL_LEN 64 +@@ -340,8 +340,8 @@ struct ocfs2_system_inode_info { + enum { + BAD_BLOCK_SYSTEM_INODE = 0, + GLOBAL_INODE_ALLOC_SYSTEM_INODE, ++#define OCFS2_FIRST_ONLINE_SYSTEM_INODE GLOBAL_INODE_ALLOC_SYSTEM_INODE + SLOT_MAP_SYSTEM_INODE, +-#define OCFS2_FIRST_ONLINE_SYSTEM_INODE SLOT_MAP_SYSTEM_INODE + HEARTBEAT_SYSTEM_INODE, + GLOBAL_BITMAP_SYSTEM_INODE, + USER_QUOTA_SYSTEM_INODE, +diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c +index 6ad3533940ba..00558bc59052 100644 +--- a/fs/ocfs2/suballoc.c ++++ b/fs/ocfs2/suballoc.c +@@ -2891,9 +2891,12 @@ int ocfs2_test_inode_bit(struct ocfs2_super *osb, u64 blkno, int *res) + goto bail; + } + +- inode_alloc_inode = +- ocfs2_get_system_file_inode(osb, INODE_ALLOC_SYSTEM_INODE, +- suballoc_slot); ++ if (suballoc_slot == (u16)OCFS2_INVALID_SLOT) ++ inode_alloc_inode = ocfs2_get_system_file_inode(osb, ++ GLOBAL_INODE_ALLOC_SYSTEM_INODE, suballoc_slot); ++ else ++ inode_alloc_inode = ocfs2_get_system_file_inode(osb, ++ INODE_ALLOC_SYSTEM_INODE, suballoc_slot); + if (!inode_alloc_inode) { + /* the error code could be inaccurate, but we are not able to + * get the correct one. */ +diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c +index e567551402a6..b904d4634355 100644 +--- a/fs/xfs/libxfs/xfs_alloc.c ++++ b/fs/xfs/libxfs/xfs_alloc.c +@@ -2507,6 +2507,13 @@ xfs_agf_verify( + be32_to_cpu(agf->agf_flcount) <= XFS_AGFL_SIZE(mp))) + return false; + ++ if (be32_to_cpu(agf->agf_length) > mp->m_sb.sb_dblocks) ++ return false; ++ ++ if (be32_to_cpu(agf->agf_freeblks) < be32_to_cpu(agf->agf_longest) || ++ be32_to_cpu(agf->agf_freeblks) > be32_to_cpu(agf->agf_length)) ++ return false; ++ + if (be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) < 1 || + be32_to_cpu(agf->agf_levels[XFS_BTNUM_CNT]) < 1 || + be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) > XFS_BTREE_MAXLEVELS || +@@ -2518,6 +2525,10 @@ xfs_agf_verify( + be32_to_cpu(agf->agf_levels[XFS_BTNUM_RMAP]) > XFS_BTREE_MAXLEVELS)) + return false; + ++ if (xfs_sb_version_hasrmapbt(&mp->m_sb) && ++ be32_to_cpu(agf->agf_rmap_blocks) > be32_to_cpu(agf->agf_length)) ++ return false; ++ + /* + * during growfs operations, the perag is not fully initialised, + * so we can't use it for any useful checking. growfs ensures we can't +@@ -2531,6 +2542,11 @@ xfs_agf_verify( + be32_to_cpu(agf->agf_btreeblks) > be32_to_cpu(agf->agf_length)) + return false; + ++ if (xfs_sb_version_hasreflink(&mp->m_sb) && ++ be32_to_cpu(agf->agf_refcount_blocks) > ++ be32_to_cpu(agf->agf_length)) ++ return false; ++ + if (xfs_sb_version_hasreflink(&mp->m_sb) && + (be32_to_cpu(agf->agf_refcount_level) < 1 || + be32_to_cpu(agf->agf_refcount_level) > XFS_BTREE_MAXLEVELS)) +diff --git a/include/linux/bitops.h b/include/linux/bitops.h +index cee74a52b9eb..e1dee6c91ff5 100644 +--- a/include/linux/bitops.h ++++ b/include/linux/bitops.h +@@ -49,7 +49,7 @@ static inline int get_bitmask_order(unsigned int count) + + static __always_inline unsigned long hweight_long(unsigned long w) + { +- return sizeof(w) == 4 ? hweight32(w) : hweight64(w); ++ return sizeof(w) == 4 ? hweight32(w) : hweight64((__u64)w); + } + + /** +diff --git a/include/linux/elfnote.h b/include/linux/elfnote.h +index 278e3ef05336..56c6d9031663 100644 +--- a/include/linux/elfnote.h ++++ b/include/linux/elfnote.h +@@ -53,7 +53,7 @@ + .popsection ; + + #define ELFNOTE(name, type, desc) \ +- ELFNOTE_START(name, type, "") \ ++ ELFNOTE_START(name, type, "a") \ + desc ; \ + ELFNOTE_END + +diff --git a/include/linux/genhd.h b/include/linux/genhd.h +index 3c99fb6727ca..12a2f5ac51c9 100644 +--- a/include/linux/genhd.h ++++ b/include/linux/genhd.h +@@ -716,9 +716,11 @@ static inline sector_t part_nr_sects_read(struct hd_struct *part) + static inline void part_nr_sects_write(struct hd_struct *part, sector_t size) + { + #if BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_SMP) ++ preempt_disable(); + write_seqcount_begin(&part->nr_sects_seq); + part->nr_sects = size; + write_seqcount_end(&part->nr_sects_seq); ++ preempt_enable(); + #elif BITS_PER_LONG==32 && defined(CONFIG_LBDAF) && defined(CONFIG_PREEMPT) + preempt_disable(); + part->nr_sects = size; +diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h +index cb527c78de9f..4db62045f01a 100644 +--- a/include/linux/kprobes.h ++++ b/include/linux/kprobes.h +@@ -366,6 +366,10 @@ static inline struct kprobe_ctlblk *get_kprobe_ctlblk(void) + return this_cpu_ptr(&kprobe_ctlblk); + } + ++extern struct kprobe kprobe_busy; ++void kprobe_busy_begin(void); ++void kprobe_busy_end(void); ++ + int register_kprobe(struct kprobe *p); + void unregister_kprobe(struct kprobe *p); + int register_kprobes(struct kprobe **kps, int num); +diff --git a/include/linux/libata.h b/include/linux/libata.h +index cdfb67b22317..780ccde2c312 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -38,6 +38,7 @@ + #include <linux/acpi.h> + #include <linux/cdrom.h> + #include <linux/sched.h> ++#include <linux/async.h> + + /* + * Define if arch has non-standard setup. This is a _PCI_ standard +@@ -878,6 +879,8 @@ struct ata_port { + struct timer_list fastdrain_timer; + unsigned long fastdrain_cnt; + ++ async_cookie_t cookie; ++ + int em_message_type; + void *private_data; + +diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h +index d8905a229f34..573e744223a2 100644 +--- a/include/linux/mtd/nand.h ++++ b/include/linux/mtd/nand.h +@@ -24,6 +24,7 @@ + #include <linux/mtd/flashchip.h> + #include <linux/mtd/bbm.h> + ++struct nand_chip; + struct mtd_info; + struct nand_flash_dev; + struct device_node; +@@ -39,7 +40,7 @@ int nand_scan_ident(struct mtd_info *mtd, int max_chips, + int nand_scan_tail(struct mtd_info *mtd); + + /* Unregister the MTD device and free resources held by the NAND device */ +-void nand_release(struct mtd_info *mtd); ++void nand_release(struct nand_chip *chip); + + /* Internal helper for board drivers which need to override command function */ + void nand_wait_ready(struct mtd_info *mtd); +@@ -219,9 +220,6 @@ enum nand_ecc_algo { + #define NAND_CI_CELLTYPE_MSK 0x0C + #define NAND_CI_CELLTYPE_SHIFT 2 + +-/* Keep gcc happy */ +-struct nand_chip; +- + /* ONFI features */ + #define ONFI_FEATURE_16_BIT_BUS (1 << 0) + #define ONFI_FEATURE_EXT_PARAM_PAGE (1 << 7) +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 81c85ba6e2b8..4d1b1056ac97 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -2480,7 +2480,7 @@ void synchronize_net(void); + int init_dummy_netdev(struct net_device *dev); + + DECLARE_PER_CPU(int, xmit_recursion); +-#define XMIT_RECURSION_LIMIT 10 ++#define XMIT_RECURSION_LIMIT 8 + + static inline int dev_recursion_level(void) + { +diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h +index 72d88cf3ca25..5a215da57b55 100644 +--- a/include/linux/qed/qed_chain.h ++++ b/include/linux/qed/qed_chain.h +@@ -155,28 +155,34 @@ static inline u32 qed_chain_get_cons_idx_u32(struct qed_chain *p_chain) + + static inline u16 qed_chain_get_elem_left(struct qed_chain *p_chain) + { ++ u16 elem_per_page = p_chain->elem_per_page; ++ u32 prod = p_chain->u.chain16.prod_idx; ++ u32 cons = p_chain->u.chain16.cons_idx; + u16 used; + +- used = (u16) (((u32)0x10000 + +- (u32)p_chain->u.chain16.prod_idx) - +- (u32)p_chain->u.chain16.cons_idx); ++ if (prod < cons) ++ prod += (u32)U16_MAX + 1; ++ ++ used = (u16)(prod - cons); + if (p_chain->mode == QED_CHAIN_MODE_NEXT_PTR) +- used -= p_chain->u.chain16.prod_idx / p_chain->elem_per_page - +- p_chain->u.chain16.cons_idx / p_chain->elem_per_page; ++ used -= prod / elem_per_page - cons / elem_per_page; + + return (u16)(p_chain->capacity - used); + } + + static inline u32 qed_chain_get_elem_left_u32(struct qed_chain *p_chain) + { ++ u16 elem_per_page = p_chain->elem_per_page; ++ u64 prod = p_chain->u.chain32.prod_idx; ++ u64 cons = p_chain->u.chain32.cons_idx; + u32 used; + +- used = (u32) (((u64)0x100000000ULL + +- (u64)p_chain->u.chain32.prod_idx) - +- (u64)p_chain->u.chain32.cons_idx); ++ if (prod < cons) ++ prod += (u64)U32_MAX + 1; ++ ++ used = (u32)(prod - cons); + if (p_chain->mode == QED_CHAIN_MODE_NEXT_PTR) +- used -= p_chain->u.chain32.prod_idx / p_chain->elem_per_page - +- p_chain->u.chain32.cons_idx / p_chain->elem_per_page; ++ used -= (u32)(prod / elem_per_page - cons / elem_per_page); + + return p_chain->capacity - used; + } +diff --git a/include/linux/usb/composite.h b/include/linux/usb/composite.h +index 667d20454a21..0ec7185e5ddf 100644 +--- a/include/linux/usb/composite.h ++++ b/include/linux/usb/composite.h +@@ -248,6 +248,9 @@ int usb_function_activate(struct usb_function *); + + int usb_interface_id(struct usb_configuration *, struct usb_function *); + ++int config_ep_by_speed_and_alt(struct usb_gadget *g, struct usb_function *f, ++ struct usb_ep *_ep, u8 alt); ++ + int config_ep_by_speed(struct usb_gadget *g, struct usb_function *f, + struct usb_ep *_ep); + +diff --git a/include/net/sctp/constants.h b/include/net/sctp/constants.h +index 5b847e49f7e9..8890fd66021d 100644 +--- a/include/net/sctp/constants.h ++++ b/include/net/sctp/constants.h +@@ -357,11 +357,13 @@ typedef enum { + ipv4_is_anycast_6to4(a)) + + /* Flags used for the bind address copy functions. */ +-#define SCTP_ADDR6_ALLOWED 0x00000001 /* IPv6 address is allowed by ++#define SCTP_ADDR4_ALLOWED 0x00000001 /* IPv4 address is allowed by + local sock family */ +-#define SCTP_ADDR4_PEERSUPP 0x00000002 /* IPv4 address is supported by ++#define SCTP_ADDR6_ALLOWED 0x00000002 /* IPv6 address is allowed by ++ local sock family */ ++#define SCTP_ADDR4_PEERSUPP 0x00000004 /* IPv4 address is supported by + peer */ +-#define SCTP_ADDR6_PEERSUPP 0x00000004 /* IPv6 address is supported by ++#define SCTP_ADDR6_PEERSUPP 0x00000008 /* IPv6 address is supported by + peer */ + + /* Reasons to retransmit. */ +diff --git a/include/net/sock.h b/include/net/sock.h +index d6bce19ca261..db68c72126d5 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1631,7 +1631,6 @@ static inline int sk_tx_queue_get(const struct sock *sk) + + static inline void sk_set_socket(struct sock *sk, struct socket *sock) + { +- sk_tx_queue_clear(sk); + sk->sk_socket = sock; + } + +diff --git a/include/uapi/linux/dvb/frontend.h b/include/uapi/linux/dvb/frontend.h +index afc3972b0879..b653754ee9cf 100644 +--- a/include/uapi/linux/dvb/frontend.h ++++ b/include/uapi/linux/dvb/frontend.h +@@ -28,13 +28,46 @@ + + #include <linux/types.h> + +-enum fe_type { +- FE_QPSK, +- FE_QAM, +- FE_OFDM, +- FE_ATSC +-}; +- ++/** ++ * enum fe_caps - Frontend capabilities ++ * ++ * @FE_IS_STUPID: There's something wrong at the ++ * frontend, and it can't report its ++ * capabilities. ++ * @FE_CAN_INVERSION_AUTO: Can auto-detect frequency spectral ++ * band inversion ++ * @FE_CAN_FEC_1_2: Supports FEC 1/2 ++ * @FE_CAN_FEC_2_3: Supports FEC 2/3 ++ * @FE_CAN_FEC_3_4: Supports FEC 3/4 ++ * @FE_CAN_FEC_4_5: Supports FEC 4/5 ++ * @FE_CAN_FEC_5_6: Supports FEC 5/6 ++ * @FE_CAN_FEC_6_7: Supports FEC 6/7 ++ * @FE_CAN_FEC_7_8: Supports FEC 7/8 ++ * @FE_CAN_FEC_8_9: Supports FEC 8/9 ++ * @FE_CAN_FEC_AUTO: Can auto-detect FEC ++ * @FE_CAN_QPSK: Supports QPSK modulation ++ * @FE_CAN_QAM_16: Supports 16-QAM modulation ++ * @FE_CAN_QAM_32: Supports 32-QAM modulation ++ * @FE_CAN_QAM_64: Supports 64-QAM modulation ++ * @FE_CAN_QAM_128: Supports 128-QAM modulation ++ * @FE_CAN_QAM_256: Supports 256-QAM modulation ++ * @FE_CAN_QAM_AUTO: Can auto-detect QAM modulation ++ * @FE_CAN_TRANSMISSION_MODE_AUTO: Can auto-detect transmission mode ++ * @FE_CAN_BANDWIDTH_AUTO: Can auto-detect bandwidth ++ * @FE_CAN_GUARD_INTERVAL_AUTO: Can auto-detect guard interval ++ * @FE_CAN_HIERARCHY_AUTO: Can auto-detect hierarchy ++ * @FE_CAN_8VSB: Supports 8-VSB modulation ++ * @FE_CAN_16VSB: Supporta 16-VSB modulation ++ * @FE_HAS_EXTENDED_CAPS: Unused ++ * @FE_CAN_MULTISTREAM: Supports multistream filtering ++ * @FE_CAN_TURBO_FEC: Supports "turbo FEC" modulation ++ * @FE_CAN_2G_MODULATION: Supports "2nd generation" modulation, ++ * e. g. DVB-S2, DVB-T2, DVB-C2 ++ * @FE_NEEDS_BENDING: Unused ++ * @FE_CAN_RECOVER: Can recover from a cable unplug ++ * automatically ++ * @FE_CAN_MUTE_TS: Can stop spurious TS data output ++ */ + enum fe_caps { + FE_IS_STUPID = 0, + FE_CAN_INVERSION_AUTO = 0x1, +@@ -60,15 +93,55 @@ enum fe_caps { + FE_CAN_HIERARCHY_AUTO = 0x100000, + FE_CAN_8VSB = 0x200000, + FE_CAN_16VSB = 0x400000, +- FE_HAS_EXTENDED_CAPS = 0x800000, /* We need more bitspace for newer APIs, indicate this. */ +- FE_CAN_MULTISTREAM = 0x4000000, /* frontend supports multistream filtering */ +- FE_CAN_TURBO_FEC = 0x8000000, /* frontend supports "turbo fec modulation" */ +- FE_CAN_2G_MODULATION = 0x10000000, /* frontend supports "2nd generation modulation" (DVB-S2) */ +- FE_NEEDS_BENDING = 0x20000000, /* not supported anymore, don't use (frontend requires frequency bending) */ +- FE_CAN_RECOVER = 0x40000000, /* frontend can recover from a cable unplug automatically */ +- FE_CAN_MUTE_TS = 0x80000000 /* frontend can stop spurious TS data output */ ++ FE_HAS_EXTENDED_CAPS = 0x800000, ++ FE_CAN_MULTISTREAM = 0x4000000, ++ FE_CAN_TURBO_FEC = 0x8000000, ++ FE_CAN_2G_MODULATION = 0x10000000, ++ FE_NEEDS_BENDING = 0x20000000, ++ FE_CAN_RECOVER = 0x40000000, ++ FE_CAN_MUTE_TS = 0x80000000 ++}; ++ ++/* ++ * DEPRECATED: Should be kept just due to backward compatibility. ++ */ ++enum fe_type { ++ FE_QPSK, ++ FE_QAM, ++ FE_OFDM, ++ FE_ATSC + }; + ++/** ++ * struct dvb_frontend_info - Frontend properties and capabilities ++ * ++ * @name: Name of the frontend ++ * @type: **DEPRECATED**. ++ * Should not be used on modern programs, ++ * as a frontend may have more than one type. ++ * In order to get the support types of a given ++ * frontend, use :c:type:`DTV_ENUM_DELSYS` ++ * instead. ++ * @frequency_min: Minimal frequency supported by the frontend. ++ * @frequency_max: Minimal frequency supported by the frontend. ++ * @frequency_stepsize: All frequencies are multiple of this value. ++ * @frequency_tolerance: Frequency tolerance. ++ * @symbol_rate_min: Minimal symbol rate, in bauds ++ * (for Cable/Satellite systems). ++ * @symbol_rate_max: Maximal symbol rate, in bauds ++ * (for Cable/Satellite systems). ++ * @symbol_rate_tolerance: Maximal symbol rate tolerance, in ppm ++ * (for Cable/Satellite systems). ++ * @notifier_delay: **DEPRECATED**. Not used by any driver. ++ * @caps: Capabilities supported by the frontend, ++ * as specified in &enum fe_caps. ++ * ++ * .. note: ++ * ++ * #. The frequencies are specified in Hz for Terrestrial and Cable ++ * systems. ++ * #. The frequencies are specified in kHz for Satellite systems. ++ */ + struct dvb_frontend_info { + char name[128]; + enum fe_type type; /* DEPRECATED. Use DTV_ENUM_DELSYS instead */ +@@ -78,53 +151,102 @@ struct dvb_frontend_info { + __u32 frequency_tolerance; + __u32 symbol_rate_min; + __u32 symbol_rate_max; +- __u32 symbol_rate_tolerance; /* ppm */ ++ __u32 symbol_rate_tolerance; + __u32 notifier_delay; /* DEPRECATED */ + enum fe_caps caps; + }; + +- + /** +- * Check out the DiSEqC bus spec available on http://www.eutelsat.org/ for +- * the meaning of this struct... ++ * struct dvb_diseqc_master_cmd - DiSEqC master command ++ * ++ * @msg: ++ * DiSEqC message to be sent. It contains a 3 bytes header with: ++ * framing + address + command, and an optional argument ++ * of up to 3 bytes of data. ++ * @msg_len: ++ * Length of the DiSEqC message. Valid values are 3 to 6. ++ * ++ * Check out the DiSEqC bus spec available on http://www.eutelsat.org/ for ++ * the possible messages that can be used. + */ + struct dvb_diseqc_master_cmd { +- __u8 msg [6]; /* { framing, address, command, data [3] } */ +- __u8 msg_len; /* valid values are 3...6 */ ++ __u8 msg[6]; ++ __u8 msg_len; + }; + ++/** ++ * struct dvb_diseqc_slave_reply - DiSEqC received data ++ * ++ * @msg: ++ * DiSEqC message buffer to store a message received via DiSEqC. ++ * It contains one byte header with: framing and ++ * an optional argument of up to 3 bytes of data. ++ * @msg_len: ++ * Length of the DiSEqC message. Valid values are 0 to 4, ++ * where 0 means no message. ++ * @timeout: ++ * Return from ioctl after timeout ms with errorcode when ++ * no message was received. ++ * ++ * Check out the DiSEqC bus spec available on http://www.eutelsat.org/ for ++ * the possible messages that can be used. ++ */ + struct dvb_diseqc_slave_reply { +- __u8 msg [4]; /* { framing, data [3] } */ +- __u8 msg_len; /* valid values are 0...4, 0 means no msg */ +- int timeout; /* return from ioctl after timeout ms with */ +-}; /* errorcode when no message was received */ ++ __u8 msg[4]; ++ __u8 msg_len; ++ int timeout; ++}; + ++/** ++ * enum fe_sec_voltage - DC Voltage used to feed the LNBf ++ * ++ * @SEC_VOLTAGE_13: Output 13V to the LNBf ++ * @SEC_VOLTAGE_18: Output 18V to the LNBf ++ * @SEC_VOLTAGE_OFF: Don't feed the LNBf with a DC voltage ++ */ + enum fe_sec_voltage { + SEC_VOLTAGE_13, + SEC_VOLTAGE_18, + SEC_VOLTAGE_OFF + }; + ++/** ++ * enum fe_sec_tone_mode - Type of tone to be send to the LNBf. ++ * @SEC_TONE_ON: Sends a 22kHz tone burst to the antenna. ++ * @SEC_TONE_OFF: Don't send a 22kHz tone to the antenna (except ++ * if the ``FE_DISEQC_*`` ioctls are called). ++ */ + enum fe_sec_tone_mode { + SEC_TONE_ON, + SEC_TONE_OFF + }; + ++/** ++ * enum fe_sec_mini_cmd - Type of mini burst to be sent ++ * ++ * @SEC_MINI_A: Sends a mini-DiSEqC 22kHz '0' Tone Burst to select ++ * satellite-A ++ * @SEC_MINI_B: Sends a mini-DiSEqC 22kHz '1' Data Burst to select ++ * satellite-B ++ */ + enum fe_sec_mini_cmd { + SEC_MINI_A, + SEC_MINI_B + }; + + /** +- * enum fe_status - enumerates the possible frontend status +- * @FE_HAS_SIGNAL: found something above the noise level +- * @FE_HAS_CARRIER: found a DVB signal +- * @FE_HAS_VITERBI: FEC is stable +- * @FE_HAS_SYNC: found sync bytes +- * @FE_HAS_LOCK: everything's working +- * @FE_TIMEDOUT: no lock within the last ~2 seconds +- * @FE_REINIT: frontend was reinitialized, application is recommended +- * to reset DiSEqC, tone and parameters ++ * enum fe_status - Enumerates the possible frontend status. ++ * @FE_NONE: The frontend doesn't have any kind of lock. ++ * That's the initial frontend status ++ * @FE_HAS_SIGNAL: Has found something above the noise level. ++ * @FE_HAS_CARRIER: Has found a DVB signal. ++ * @FE_HAS_VITERBI: FEC inner coding (Viterbi, LDPC or other inner code). ++ * is stable. ++ * @FE_HAS_SYNC: Synchronization bytes was found. ++ * @FE_HAS_LOCK: DVB were locked and everything is working. ++ * @FE_TIMEDOUT: Fo lock within the last about 2 seconds. ++ * @FE_REINIT: Frontend was reinitialized, application is recommended ++ * to reset DiSEqC, tone and parameters. + */ + enum fe_status { + FE_NONE = 0x00, +@@ -137,12 +259,45 @@ enum fe_status { + FE_REINIT = 0x40, + }; + ++/** ++ * enum fe_spectral_inversion - Type of inversion band ++ * ++ * @INVERSION_OFF: Don't do spectral band inversion. ++ * @INVERSION_ON: Do spectral band inversion. ++ * @INVERSION_AUTO: Autodetect spectral band inversion. ++ * ++ * This parameter indicates if spectral inversion should be presumed or ++ * not. In the automatic setting (``INVERSION_AUTO``) the hardware will try ++ * to figure out the correct setting by itself. If the hardware doesn't ++ * support, the DVB core will try to lock at the carrier first with ++ * inversion off. If it fails, it will try to enable inversion. ++ */ + enum fe_spectral_inversion { + INVERSION_OFF, + INVERSION_ON, + INVERSION_AUTO + }; + ++/** ++ * enum fe_code_rate - Type of Forward Error Correction (FEC) ++ * ++ * ++ * @FEC_NONE: No Forward Error Correction Code ++ * @FEC_1_2: Forward Error Correction Code 1/2 ++ * @FEC_2_3: Forward Error Correction Code 2/3 ++ * @FEC_3_4: Forward Error Correction Code 3/4 ++ * @FEC_4_5: Forward Error Correction Code 4/5 ++ * @FEC_5_6: Forward Error Correction Code 5/6 ++ * @FEC_6_7: Forward Error Correction Code 6/7 ++ * @FEC_7_8: Forward Error Correction Code 7/8 ++ * @FEC_8_9: Forward Error Correction Code 8/9 ++ * @FEC_AUTO: Autodetect Error Correction Code ++ * @FEC_3_5: Forward Error Correction Code 3/5 ++ * @FEC_9_10: Forward Error Correction Code 9/10 ++ * @FEC_2_5: Forward Error Correction Code 2/5 ++ * ++ * Please note that not all FEC types are supported by a given standard. ++ */ + enum fe_code_rate { + FEC_NONE = 0, + FEC_1_2, +@@ -159,6 +314,26 @@ enum fe_code_rate { + FEC_2_5, + }; + ++/** ++ * enum fe_modulation - Type of modulation/constellation ++ * @QPSK: QPSK modulation ++ * @QAM_16: 16-QAM modulation ++ * @QAM_32: 32-QAM modulation ++ * @QAM_64: 64-QAM modulation ++ * @QAM_128: 128-QAM modulation ++ * @QAM_256: 256-QAM modulation ++ * @QAM_AUTO: Autodetect QAM modulation ++ * @VSB_8: 8-VSB modulation ++ * @VSB_16: 16-VSB modulation ++ * @PSK_8: 8-PSK modulation ++ * @APSK_16: 16-APSK modulation ++ * @APSK_32: 32-APSK modulation ++ * @DQPSK: DQPSK modulation ++ * @QAM_4_NR: 4-QAM-NR modulation ++ * ++ * Please note that not all modulations are supported by a given standard. ++ * ++ */ + enum fe_modulation { + QPSK, + QAM_16, +@@ -176,6 +351,32 @@ enum fe_modulation { + QAM_4_NR, + }; + ++/** ++ * enum fe_transmit_mode - Transmission mode ++ * ++ * @TRANSMISSION_MODE_AUTO: ++ * Autodetect transmission mode. The hardware will try to find the ++ * correct FFT-size (if capable) to fill in the missing parameters. ++ * @TRANSMISSION_MODE_1K: ++ * Transmission mode 1K ++ * @TRANSMISSION_MODE_2K: ++ * Transmission mode 2K ++ * @TRANSMISSION_MODE_8K: ++ * Transmission mode 8K ++ * @TRANSMISSION_MODE_4K: ++ * Transmission mode 4K ++ * @TRANSMISSION_MODE_16K: ++ * Transmission mode 16K ++ * @TRANSMISSION_MODE_32K: ++ * Transmission mode 32K ++ * @TRANSMISSION_MODE_C1: ++ * Single Carrier (C=1) transmission mode (DTMB only) ++ * @TRANSMISSION_MODE_C3780: ++ * Multi Carrier (C=3780) transmission mode (DTMB only) ++ * ++ * Please note that not all transmission modes are supported by a given ++ * standard. ++ */ + enum fe_transmit_mode { + TRANSMISSION_MODE_2K, + TRANSMISSION_MODE_8K, +@@ -188,6 +389,23 @@ enum fe_transmit_mode { + TRANSMISSION_MODE_C3780, + }; + ++/** ++ * enum fe_guard_interval - Guard interval ++ * ++ * @GUARD_INTERVAL_AUTO: Autodetect the guard interval ++ * @GUARD_INTERVAL_1_128: Guard interval 1/128 ++ * @GUARD_INTERVAL_1_32: Guard interval 1/32 ++ * @GUARD_INTERVAL_1_16: Guard interval 1/16 ++ * @GUARD_INTERVAL_1_8: Guard interval 1/8 ++ * @GUARD_INTERVAL_1_4: Guard interval 1/4 ++ * @GUARD_INTERVAL_19_128: Guard interval 19/128 ++ * @GUARD_INTERVAL_19_256: Guard interval 19/256 ++ * @GUARD_INTERVAL_PN420: PN length 420 (1/4) ++ * @GUARD_INTERVAL_PN595: PN length 595 (1/6) ++ * @GUARD_INTERVAL_PN945: PN length 945 (1/9) ++ * ++ * Please note that not all guard intervals are supported by a given standard. ++ */ + enum fe_guard_interval { + GUARD_INTERVAL_1_32, + GUARD_INTERVAL_1_16, +@@ -202,6 +420,16 @@ enum fe_guard_interval { + GUARD_INTERVAL_PN945, + }; + ++/** ++ * enum fe_hierarchy - Hierarchy ++ * @HIERARCHY_NONE: No hierarchy ++ * @HIERARCHY_AUTO: Autodetect hierarchy (if supported) ++ * @HIERARCHY_1: Hierarchy 1 ++ * @HIERARCHY_2: Hierarchy 2 ++ * @HIERARCHY_4: Hierarchy 4 ++ * ++ * Please note that not all hierarchy types are supported by a given standard. ++ */ + enum fe_hierarchy { + HIERARCHY_NONE, + HIERARCHY_1, +@@ -210,6 +438,15 @@ enum fe_hierarchy { + HIERARCHY_AUTO + }; + ++/** ++ * enum fe_interleaving - Interleaving ++ * @INTERLEAVING_NONE: No interleaving. ++ * @INTERLEAVING_AUTO: Auto-detect interleaving. ++ * @INTERLEAVING_240: Interleaving of 240 symbols. ++ * @INTERLEAVING_720: Interleaving of 720 symbols. ++ * ++ * Please note that, currently, only DTMB uses it. ++ */ + enum fe_interleaving { + INTERLEAVING_NONE, + INTERLEAVING_AUTO, +@@ -217,7 +454,8 @@ enum fe_interleaving { + INTERLEAVING_720, + }; + +-/* S2API Commands */ ++/* DVBv5 property Commands */ ++ + #define DTV_UNDEFINED 0 + #define DTV_TUNE 1 + #define DTV_CLEAR 2 +@@ -310,19 +548,79 @@ enum fe_interleaving { + + #define DTV_MAX_COMMAND DTV_STAT_TOTAL_BLOCK_COUNT + ++/** ++ * enum fe_pilot - Type of pilot tone ++ * ++ * @PILOT_ON: Pilot tones enabled ++ * @PILOT_OFF: Pilot tones disabled ++ * @PILOT_AUTO: Autodetect pilot tones ++ */ + enum fe_pilot { + PILOT_ON, + PILOT_OFF, + PILOT_AUTO, + }; + ++/** ++ * enum fe_rolloff - Rolloff factor (also known as alpha) ++ * @ROLLOFF_35: Roloff factor: 35% ++ * @ROLLOFF_20: Roloff factor: 20% ++ * @ROLLOFF_25: Roloff factor: 25% ++ * @ROLLOFF_AUTO: Auto-detect the roloff factor. ++ * ++ * .. note: ++ * ++ * Roloff factor of 35% is implied on DVB-S. On DVB-S2, it is default. ++ */ + enum fe_rolloff { +- ROLLOFF_35, /* Implied value in DVB-S, default for DVB-S2 */ ++ ROLLOFF_35, + ROLLOFF_20, + ROLLOFF_25, + ROLLOFF_AUTO, + }; + ++/** ++ * enum fe_delivery_system - Type of the delivery system ++ * ++ * @SYS_UNDEFINED: ++ * Undefined standard. Generally, indicates an error ++ * @SYS_DVBC_ANNEX_A: ++ * Cable TV: DVB-C following ITU-T J.83 Annex A spec ++ * @SYS_DVBC_ANNEX_B: ++ * Cable TV: DVB-C following ITU-T J.83 Annex B spec (ClearQAM) ++ * @SYS_DVBC_ANNEX_C: ++ * Cable TV: DVB-C following ITU-T J.83 Annex C spec ++ * @SYS_ISDBC: ++ * Cable TV: ISDB-C (no drivers yet) ++ * @SYS_DVBT: ++ * Terrestrial TV: DVB-T ++ * @SYS_DVBT2: ++ * Terrestrial TV: DVB-T2 ++ * @SYS_ISDBT: ++ * Terrestrial TV: ISDB-T ++ * @SYS_ATSC: ++ * Terrestrial TV: ATSC ++ * @SYS_ATSCMH: ++ * Terrestrial TV (mobile): ATSC-M/H ++ * @SYS_DTMB: ++ * Terrestrial TV: DTMB ++ * @SYS_DVBS: ++ * Satellite TV: DVB-S ++ * @SYS_DVBS2: ++ * Satellite TV: DVB-S2 ++ * @SYS_TURBO: ++ * Satellite TV: DVB-S Turbo ++ * @SYS_ISDBS: ++ * Satellite TV: ISDB-S ++ * @SYS_DAB: ++ * Digital audio: DAB (not fully supported) ++ * @SYS_DSS: ++ * Satellite TV: DSS (not fully supported) ++ * @SYS_CMMB: ++ * Terrestrial TV (mobile): CMMB (not fully supported) ++ * @SYS_DVBH: ++ * Terrestrial TV (mobile): DVB-H (standard deprecated) ++ */ + enum fe_delivery_system { + SYS_UNDEFINED, + SYS_DVBC_ANNEX_A, +@@ -345,35 +643,85 @@ enum fe_delivery_system { + SYS_DVBC_ANNEX_C, + }; + +-/* backward compatibility */ ++/* backward compatibility definitions for delivery systems */ + #define SYS_DVBC_ANNEX_AC SYS_DVBC_ANNEX_A +-#define SYS_DMBTH SYS_DTMB /* DMB-TH is legacy name, use DTMB instead */ ++#define SYS_DMBTH SYS_DTMB /* DMB-TH is legacy name, use DTMB */ + +-/* ATSC-MH */ ++/* ATSC-MH specific parameters */ + ++/** ++ * enum atscmh_sccc_block_mode - Type of Series Concatenated Convolutional ++ * Code Block Mode. ++ * ++ * @ATSCMH_SCCC_BLK_SEP: ++ * Separate SCCC: the SCCC outer code mode shall be set independently ++ * for each Group Region (A, B, C, D) ++ * @ATSCMH_SCCC_BLK_COMB: ++ * Combined SCCC: all four Regions shall have the same SCCC outer ++ * code mode. ++ * @ATSCMH_SCCC_BLK_RES: ++ * Reserved. Shouldn't be used. ++ */ + enum atscmh_sccc_block_mode { + ATSCMH_SCCC_BLK_SEP = 0, + ATSCMH_SCCC_BLK_COMB = 1, + ATSCMH_SCCC_BLK_RES = 2, + }; + ++/** ++ * enum atscmh_sccc_code_mode - Type of Series Concatenated Convolutional ++ * Code Rate. ++ * ++ * @ATSCMH_SCCC_CODE_HLF: ++ * The outer code rate of a SCCC Block is 1/2 rate. ++ * @ATSCMH_SCCC_CODE_QTR: ++ * The outer code rate of a SCCC Block is 1/4 rate. ++ * @ATSCMH_SCCC_CODE_RES: ++ * Reserved. Should not be used. ++ */ + enum atscmh_sccc_code_mode { + ATSCMH_SCCC_CODE_HLF = 0, + ATSCMH_SCCC_CODE_QTR = 1, + ATSCMH_SCCC_CODE_RES = 2, + }; + ++/** ++ * enum atscmh_rs_frame_ensemble - Reed Solomon(RS) frame ensemble. ++ * ++ * @ATSCMH_RSFRAME_ENS_PRI: Primary Ensemble. ++ * @ATSCMH_RSFRAME_ENS_SEC: Secondary Ensemble. ++ */ + enum atscmh_rs_frame_ensemble { + ATSCMH_RSFRAME_ENS_PRI = 0, + ATSCMH_RSFRAME_ENS_SEC = 1, + }; + ++/** ++ * enum atscmh_rs_frame_mode - Reed Solomon (RS) frame mode. ++ * ++ * @ATSCMH_RSFRAME_PRI_ONLY: ++ * Single Frame: There is only a primary RS Frame for all Group ++ * Regions. ++ * @ATSCMH_RSFRAME_PRI_SEC: ++ * Dual Frame: There are two separate RS Frames: Primary RS Frame for ++ * Group Region A and B and Secondary RS Frame for Group Region C and ++ * D. ++ * @ATSCMH_RSFRAME_RES: ++ * Reserved. Shouldn't be used. ++ */ + enum atscmh_rs_frame_mode { + ATSCMH_RSFRAME_PRI_ONLY = 0, + ATSCMH_RSFRAME_PRI_SEC = 1, + ATSCMH_RSFRAME_RES = 2, + }; + ++/** ++ * enum atscmh_rs_code_mode ++ * @ATSCMH_RSCODE_211_187: Reed Solomon code (211,187). ++ * @ATSCMH_RSCODE_223_187: Reed Solomon code (223,187). ++ * @ATSCMH_RSCODE_235_187: Reed Solomon code (235,187). ++ * @ATSCMH_RSCODE_RES: Reserved. Shouldn't be used. ++ */ + enum atscmh_rs_code_mode { + ATSCMH_RSCODE_211_187 = 0, + ATSCMH_RSCODE_223_187 = 1, +@@ -384,28 +732,18 @@ enum atscmh_rs_code_mode { + #define NO_STREAM_ID_FILTER (~0U) + #define LNA_AUTO (~0U) + +-struct dtv_cmds_h { +- char *name; /* A display name for debugging purposes */ +- +- __u32 cmd; /* A unique ID */ +- +- /* Flags */ +- __u32 set:1; /* Either a set or get property */ +- __u32 buffer:1; /* Does this property use the buffer? */ +- __u32 reserved:30; /* Align */ +-}; +- + /** +- * Scale types for the quality parameters. ++ * enum fecap_scale_params - scale types for the quality parameters. ++ * + * @FE_SCALE_NOT_AVAILABLE: That QoS measure is not available. That + * could indicate a temporary or a permanent + * condition. + * @FE_SCALE_DECIBEL: The scale is measured in 0.001 dB steps, typically +- * used on signal measures. ++ * used on signal measures. + * @FE_SCALE_RELATIVE: The scale is a relative percentual measure, +- * ranging from 0 (0%) to 0xffff (100%). ++ * ranging from 0 (0%) to 0xffff (100%). + * @FE_SCALE_COUNTER: The scale counts the occurrence of an event, like +- * bit error, block error, lapsed time. ++ * bit error, block error, lapsed time. + */ + enum fecap_scale_params { + FE_SCALE_NOT_AVAILABLE = 0, +@@ -417,24 +755,38 @@ enum fecap_scale_params { + /** + * struct dtv_stats - Used for reading a DTV status property + * +- * @value: value of the measure. Should range from 0 to 0xffff; + * @scale: Filled with enum fecap_scale_params - the scale + * in usage for that parameter + * ++ * The ``{unnamed_union}`` may have either one of the values below: ++ * ++ * %svalue ++ * integer value of the measure, for %FE_SCALE_DECIBEL, ++ * used for dB measures. The unit is 0.001 dB. ++ * ++ * %uvalue ++ * unsigned integer value of the measure, used when @scale is ++ * either %FE_SCALE_RELATIVE or %FE_SCALE_COUNTER. ++ * + * For most delivery systems, this will return a single value for each + * parameter. ++ * + * It should be noticed, however, that new OFDM delivery systems like + * ISDB can use different modulation types for each group of carriers. + * On such standards, up to 8 groups of statistics can be provided, one + * for each carrier group (called "layer" on ISDB). ++ * + * In order to be consistent with other delivery systems, the first + * value refers to the entire set of carriers ("global"). +- * dtv_status:scale should use the value FE_SCALE_NOT_AVAILABLE when ++ * ++ * @scale should use the value %FE_SCALE_NOT_AVAILABLE when + * the value for the entire group of carriers or from one specific layer + * is not provided by the hardware. +- * st.len should be filled with the latest filled status + 1. + * +- * In other words, for ISDB, those values should be filled like: ++ * @len should be filled with the latest filled status + 1. ++ * ++ * In other words, for ISDB, those values should be filled like:: ++ * + * u.st.stat.svalue[0] = global statistics; + * u.st.stat.scale[0] = FE_SCALE_DECIBEL; + * u.st.stat.value[1] = layer A statistics; +@@ -456,11 +808,39 @@ struct dtv_stats { + + #define MAX_DTV_STATS 4 + ++/** ++ * struct dtv_fe_stats - store Digital TV frontend statistics ++ * ++ * @len: length of the statistics - if zero, stats is disabled. ++ * @stat: array with digital TV statistics. ++ * ++ * On most standards, @len can either be 0 or 1. However, for ISDB, each ++ * layer is modulated in separate. So, each layer may have its own set ++ * of statistics. If so, stat[0] carries on a global value for the property. ++ * Indexes 1 to 3 means layer A to B. ++ */ + struct dtv_fe_stats { + __u8 len; + struct dtv_stats stat[MAX_DTV_STATS]; + } __attribute__ ((packed)); + ++/** ++ * struct dtv_property - store one of frontend command and its value ++ * ++ * @cmd: Digital TV command. ++ * @reserved: Not used. ++ * @u: Union with the values for the command. ++ * @result: Unused ++ * ++ * The @u union may have either one of the values below: ++ * ++ * %data ++ * an unsigned 32-bits number. ++ * %st ++ * a &struct dtv_fe_stats array of statistics. ++ * %buffer ++ * a buffer of up to 32 characters (currently unused). ++ */ + struct dtv_property { + __u32 cmd; + __u32 reserved[3]; +@@ -480,17 +860,70 @@ struct dtv_property { + /* num of properties cannot exceed DTV_IOCTL_MAX_MSGS per ioctl */ + #define DTV_IOCTL_MAX_MSGS 64 + ++/** ++ * struct dtv_properties - a set of command/value pairs. ++ * ++ * @num: amount of commands stored at the struct. ++ * @props: a pointer to &struct dtv_property. ++ */ + struct dtv_properties { + __u32 num; + struct dtv_property *props; + }; + ++/* ++ * When set, this flag will disable any zigzagging or other "normal" tuning ++ * behavior. Additionally, there will be no automatic monitoring of the lock ++ * status, and hence no frontend events will be generated. If a frontend device ++ * is closed, this flag will be automatically turned off when the device is ++ * reopened read-write. ++ */ ++#define FE_TUNE_MODE_ONESHOT 0x01 ++ ++/* Digital TV Frontend API calls */ ++ ++#define FE_GET_INFO _IOR('o', 61, struct dvb_frontend_info) ++ ++#define FE_DISEQC_RESET_OVERLOAD _IO('o', 62) ++#define FE_DISEQC_SEND_MASTER_CMD _IOW('o', 63, struct dvb_diseqc_master_cmd) ++#define FE_DISEQC_RECV_SLAVE_REPLY _IOR('o', 64, struct dvb_diseqc_slave_reply) ++#define FE_DISEQC_SEND_BURST _IO('o', 65) /* fe_sec_mini_cmd_t */ ++ ++#define FE_SET_TONE _IO('o', 66) /* fe_sec_tone_mode_t */ ++#define FE_SET_VOLTAGE _IO('o', 67) /* fe_sec_voltage_t */ ++#define FE_ENABLE_HIGH_LNB_VOLTAGE _IO('o', 68) /* int */ ++ ++#define FE_READ_STATUS _IOR('o', 69, fe_status_t) ++#define FE_READ_BER _IOR('o', 70, __u32) ++#define FE_READ_SIGNAL_STRENGTH _IOR('o', 71, __u16) ++#define FE_READ_SNR _IOR('o', 72, __u16) ++#define FE_READ_UNCORRECTED_BLOCKS _IOR('o', 73, __u32) ++ ++#define FE_SET_FRONTEND_TUNE_MODE _IO('o', 81) /* unsigned int */ ++#define FE_GET_EVENT _IOR('o', 78, struct dvb_frontend_event) ++ ++#define FE_DISHNETWORK_SEND_LEGACY_CMD _IO('o', 80) /* unsigned int */ ++ ++#define FE_SET_PROPERTY _IOW('o', 82, struct dtv_properties) ++#define FE_GET_PROPERTY _IOR('o', 83, struct dtv_properties) ++ + #if defined(__DVB_CORE__) || !defined (__KERNEL__) + + /* +- * DEPRECATED: The DVBv3 ioctls, structs and enums should not be used on +- * newer programs, as it doesn't support the second generation of digital +- * TV standards, nor supports newer delivery systems. ++ * DEPRECATED: Everything below is deprecated in favor of DVBv5 API ++ * ++ * The DVBv3 only ioctls, structs and enums should not be used on ++ * newer programs, as it doesn't support the second generation of ++ * digital TV standards, nor supports newer delivery systems. ++ * They also don't support modern frontends with usually support multiple ++ * delivery systems. ++ * ++ * Drivers shouldn't use them. ++ * ++ * New applications should use DVBv5 delivery system instead ++ */ ++ ++/* + */ + + enum fe_bandwidth { +@@ -503,7 +936,7 @@ enum fe_bandwidth { + BANDWIDTH_1_712_MHZ, + }; + +-/* This is needed for legacy userspace support */ ++/* This is kept for legacy userspace support */ + typedef enum fe_sec_voltage fe_sec_voltage_t; + typedef enum fe_caps fe_caps_t; + typedef enum fe_type fe_type_t; +@@ -521,6 +954,8 @@ typedef enum fe_pilot fe_pilot_t; + typedef enum fe_rolloff fe_rolloff_t; + typedef enum fe_delivery_system fe_delivery_system_t; + ++/* DVBv3 structs */ ++ + struct dvb_qpsk_parameters { + __u32 symbol_rate; /* symbol rate in Symbols per second */ + fe_code_rate_t fec_inner; /* forward error correction (see above) */ +@@ -562,42 +997,12 @@ struct dvb_frontend_event { + fe_status_t status; + struct dvb_frontend_parameters parameters; + }; +-#endif + +-#define FE_SET_PROPERTY _IOW('o', 82, struct dtv_properties) +-#define FE_GET_PROPERTY _IOR('o', 83, struct dtv_properties) +- +-/** +- * When set, this flag will disable any zigzagging or other "normal" tuning +- * behaviour. Additionally, there will be no automatic monitoring of the lock +- * status, and hence no frontend events will be generated. If a frontend device +- * is closed, this flag will be automatically turned off when the device is +- * reopened read-write. +- */ +-#define FE_TUNE_MODE_ONESHOT 0x01 +- +-#define FE_GET_INFO _IOR('o', 61, struct dvb_frontend_info) +- +-#define FE_DISEQC_RESET_OVERLOAD _IO('o', 62) +-#define FE_DISEQC_SEND_MASTER_CMD _IOW('o', 63, struct dvb_diseqc_master_cmd) +-#define FE_DISEQC_RECV_SLAVE_REPLY _IOR('o', 64, struct dvb_diseqc_slave_reply) +-#define FE_DISEQC_SEND_BURST _IO('o', 65) /* fe_sec_mini_cmd_t */ +- +-#define FE_SET_TONE _IO('o', 66) /* fe_sec_tone_mode_t */ +-#define FE_SET_VOLTAGE _IO('o', 67) /* fe_sec_voltage_t */ +-#define FE_ENABLE_HIGH_LNB_VOLTAGE _IO('o', 68) /* int */ +- +-#define FE_READ_STATUS _IOR('o', 69, fe_status_t) +-#define FE_READ_BER _IOR('o', 70, __u32) +-#define FE_READ_SIGNAL_STRENGTH _IOR('o', 71, __u16) +-#define FE_READ_SNR _IOR('o', 72, __u16) +-#define FE_READ_UNCORRECTED_BLOCKS _IOR('o', 73, __u32) ++/* DVBv3 API calls */ + + #define FE_SET_FRONTEND _IOW('o', 76, struct dvb_frontend_parameters) + #define FE_GET_FRONTEND _IOR('o', 77, struct dvb_frontend_parameters) +-#define FE_SET_FRONTEND_TUNE_MODE _IO('o', 81) /* unsigned int */ +-#define FE_GET_EVENT _IOR('o', 78, struct dvb_frontend_event) + +-#define FE_DISHNETWORK_SEND_LEGACY_CMD _IO('o', 80) /* unsigned int */ ++#endif + + #endif /*_DVBFRONTEND_H_*/ +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index 1b75fb8c7735..a864e94ecb6b 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -561,11 +561,12 @@ static void kprobe_optimizer(struct work_struct *work) + do_free_cleaned_kprobes(); + + mutex_unlock(&module_mutex); +- mutex_unlock(&kprobe_mutex); + + /* Step 5: Kick optimizer again if needed */ + if (!list_empty(&optimizing_list) || !list_empty(&unoptimizing_list)) + kick_kprobe_optimizer(); ++ ++ mutex_unlock(&kprobe_mutex); + } + + /* Wait for completing optimization and unoptimization */ +@@ -1149,6 +1150,26 @@ __releases(hlist_lock) + } + NOKPROBE_SYMBOL(kretprobe_table_unlock); + ++struct kprobe kprobe_busy = { ++ .addr = (void *) get_kprobe, ++}; ++ ++void kprobe_busy_begin(void) ++{ ++ struct kprobe_ctlblk *kcb; ++ ++ preempt_disable(); ++ __this_cpu_write(current_kprobe, &kprobe_busy); ++ kcb = get_kprobe_ctlblk(); ++ kcb->kprobe_status = KPROBE_HIT_ACTIVE; ++} ++ ++void kprobe_busy_end(void) ++{ ++ __this_cpu_write(current_kprobe, NULL); ++ preempt_enable(); ++} ++ + /* + * This function is called from finish_task_switch when task tk becomes dead, + * so that we can recycle any function-return probe instances associated +@@ -1166,6 +1187,8 @@ void kprobe_flush_task(struct task_struct *tk) + /* Early boot. kretprobe_table_locks not yet initialized. */ + return; + ++ kprobe_busy_begin(); ++ + INIT_HLIST_HEAD(&empty_rp); + hash = hash_ptr(tk, KPROBE_HASH_BITS); + head = &kretprobe_inst_table[hash]; +@@ -1179,6 +1202,8 @@ void kprobe_flush_task(struct task_struct *tk) + hlist_del(&ri->hlist); + kfree(ri); + } ++ ++ kprobe_busy_end(); + } + NOKPROBE_SYMBOL(kprobe_flush_task); + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 82cec9a666e7..870d802c46f9 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -3697,7 +3697,8 @@ void rt_mutex_setprio(struct task_struct *p, int prio) + if (dl_prio(prio)) { + struct task_struct *pi_task = rt_mutex_get_top_task(p); + if (!dl_prio(p->normal_prio) || +- (pi_task && dl_entity_preempt(&pi_task->dl, &p->dl))) { ++ (pi_task && dl_prio(pi_task->prio) && ++ dl_entity_preempt(&pi_task->dl, &p->dl))) { + p->dl.dl_boosted = 1; + queue_flag |= ENQUEUE_REPLENISH; + } else +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index 6d3b432a748a..88eb9261c7b5 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -15,6 +15,9 @@ + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + * + */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ + #include <linux/kernel.h> + #include <linux/blkdev.h> + #include <linux/blktrace_api.h> +@@ -481,6 +484,16 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, + */ + strreplace(buts->name, '/', '_'); + ++ /* ++ * bdev can be NULL, as with scsi-generic, this is a helpful as ++ * we can be. ++ */ ++ if (q->blk_trace) { ++ pr_warn("Concurrent blktraces are not allowed on %s\n", ++ buts->name); ++ return -EBUSY; ++ } ++ + bt = kzalloc(sizeof(*bt), GFP_KERNEL); + if (!bt) + return -ENOMEM; +diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c +index c9ca2ed50c0e..a371c7def875 100644 +--- a/kernel/trace/trace_events_trigger.c ++++ b/kernel/trace/trace_events_trigger.c +@@ -222,11 +222,17 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file) + + static int trigger_process_regex(struct trace_event_file *file, char *buff) + { +- char *command, *next = buff; ++ char *command, *next; + struct event_command *p; + int ret = -EINVAL; + ++ next = buff = skip_spaces(buff); + command = strsep(&next, ": \t"); ++ if (next) { ++ next = skip_spaces(next); ++ if (!*next) ++ next = NULL; ++ } + command = (command[0] != '!') ? command : command + 1; + + mutex_lock(&trigger_cmd_mutex); +@@ -629,8 +635,14 @@ event_trigger_callback(struct event_command *cmd_ops, + int ret; + + /* separate the trigger from the filter (t:n [if filter]) */ +- if (param && isdigit(param[0])) ++ if (param && isdigit(param[0])) { + trigger = strsep(¶m, " \t"); ++ if (param) { ++ param = skip_spaces(param); ++ if (!*param) ++ param = NULL; ++ } ++ } + + trigger_ops = cmd_ops->get_trigger_ops(cmd, trigger); + +@@ -1335,6 +1347,11 @@ int event_enable_trigger_func(struct event_command *cmd_ops, + trigger = strsep(¶m, " \t"); + if (!trigger) + return -EINVAL; ++ if (param) { ++ param = skip_spaces(param); ++ if (!*param) ++ param = NULL; ++ } + + system = strsep(&trigger, ":"); + if (!trigger) +diff --git a/lib/zlib_inflate/inffast.c b/lib/zlib_inflate/inffast.c +index 2c13ecc5bb2c..ed1f3df27260 100644 +--- a/lib/zlib_inflate/inffast.c ++++ b/lib/zlib_inflate/inffast.c +@@ -10,17 +10,6 @@ + + #ifndef ASMINF + +-/* Allow machine dependent optimization for post-increment or pre-increment. +- Based on testing to date, +- Pre-increment preferred for: +- - PowerPC G3 (Adler) +- - MIPS R5000 (Randers-Pehrson) +- Post-increment preferred for: +- - none +- No measurable difference: +- - Pentium III (Anderson) +- - M68060 (Nikl) +- */ + union uu { + unsigned short us; + unsigned char b[2]; +@@ -38,16 +27,6 @@ get_unaligned16(const unsigned short *p) + return mm.us; + } + +-#ifdef POSTINC +-# define OFF 0 +-# define PUP(a) *(a)++ +-# define UP_UNALIGNED(a) get_unaligned16((a)++) +-#else +-# define OFF 1 +-# define PUP(a) *++(a) +-# define UP_UNALIGNED(a) get_unaligned16(++(a)) +-#endif +- + /* + Decode literal, length, and distance codes and write out the resulting + literal and match bytes until either not enough input or output is +@@ -115,9 +94,9 @@ void inflate_fast(z_streamp strm, unsigned start) + + /* copy state to local variables */ + state = (struct inflate_state *)strm->state; +- in = strm->next_in - OFF; ++ in = strm->next_in; + last = in + (strm->avail_in - 5); +- out = strm->next_out - OFF; ++ out = strm->next_out; + beg = out - (start - strm->avail_out); + end = out + (strm->avail_out - 257); + #ifdef INFLATE_STRICT +@@ -138,9 +117,9 @@ void inflate_fast(z_streamp strm, unsigned start) + input data or output space */ + do { + if (bits < 15) { +- hold += (unsigned long)(PUP(in)) << bits; ++ hold += (unsigned long)(*in++) << bits; + bits += 8; +- hold += (unsigned long)(PUP(in)) << bits; ++ hold += (unsigned long)(*in++) << bits; + bits += 8; + } + this = lcode[hold & lmask]; +@@ -150,14 +129,14 @@ void inflate_fast(z_streamp strm, unsigned start) + bits -= op; + op = (unsigned)(this.op); + if (op == 0) { /* literal */ +- PUP(out) = (unsigned char)(this.val); ++ *out++ = (unsigned char)(this.val); + } + else if (op & 16) { /* length base */ + len = (unsigned)(this.val); + op &= 15; /* number of extra bits */ + if (op) { + if (bits < op) { +- hold += (unsigned long)(PUP(in)) << bits; ++ hold += (unsigned long)(*in++) << bits; + bits += 8; + } + len += (unsigned)hold & ((1U << op) - 1); +@@ -165,9 +144,9 @@ void inflate_fast(z_streamp strm, unsigned start) + bits -= op; + } + if (bits < 15) { +- hold += (unsigned long)(PUP(in)) << bits; ++ hold += (unsigned long)(*in++) << bits; + bits += 8; +- hold += (unsigned long)(PUP(in)) << bits; ++ hold += (unsigned long)(*in++) << bits; + bits += 8; + } + this = dcode[hold & dmask]; +@@ -180,10 +159,10 @@ void inflate_fast(z_streamp strm, unsigned start) + dist = (unsigned)(this.val); + op &= 15; /* number of extra bits */ + if (bits < op) { +- hold += (unsigned long)(PUP(in)) << bits; ++ hold += (unsigned long)(*in++) << bits; + bits += 8; + if (bits < op) { +- hold += (unsigned long)(PUP(in)) << bits; ++ hold += (unsigned long)(*in++) << bits; + bits += 8; + } + } +@@ -205,13 +184,13 @@ void inflate_fast(z_streamp strm, unsigned start) + state->mode = BAD; + break; + } +- from = window - OFF; ++ from = window; + if (write == 0) { /* very common case */ + from += wsize - op; + if (op < len) { /* some from window */ + len -= op; + do { +- PUP(out) = PUP(from); ++ *out++ = *from++; + } while (--op); + from = out - dist; /* rest from output */ + } +@@ -222,14 +201,14 @@ void inflate_fast(z_streamp strm, unsigned start) + if (op < len) { /* some from end of window */ + len -= op; + do { +- PUP(out) = PUP(from); ++ *out++ = *from++; + } while (--op); +- from = window - OFF; ++ from = window; + if (write < len) { /* some from start of window */ + op = write; + len -= op; + do { +- PUP(out) = PUP(from); ++ *out++ = *from++; + } while (--op); + from = out - dist; /* rest from output */ + } +@@ -240,21 +219,21 @@ void inflate_fast(z_streamp strm, unsigned start) + if (op < len) { /* some from window */ + len -= op; + do { +- PUP(out) = PUP(from); ++ *out++ = *from++; + } while (--op); + from = out - dist; /* rest from output */ + } + } + while (len > 2) { +- PUP(out) = PUP(from); +- PUP(out) = PUP(from); +- PUP(out) = PUP(from); ++ *out++ = *from++; ++ *out++ = *from++; ++ *out++ = *from++; + len -= 3; + } + if (len) { +- PUP(out) = PUP(from); ++ *out++ = *from++; + if (len > 1) +- PUP(out) = PUP(from); ++ *out++ = *from++; + } + } + else { +@@ -264,29 +243,29 @@ void inflate_fast(z_streamp strm, unsigned start) + from = out - dist; /* copy direct from output */ + /* minimum length is three */ + /* Align out addr */ +- if (!((long)(out - 1 + OFF) & 1)) { +- PUP(out) = PUP(from); ++ if (!((long)(out - 1) & 1)) { ++ *out++ = *from++; + len--; + } +- sout = (unsigned short *)(out - OFF); ++ sout = (unsigned short *)(out); + if (dist > 2) { + unsigned short *sfrom; + +- sfrom = (unsigned short *)(from - OFF); ++ sfrom = (unsigned short *)(from); + loops = len >> 1; + do + #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS +- PUP(sout) = PUP(sfrom); ++ *sout++ = *sfrom++; + #else +- PUP(sout) = UP_UNALIGNED(sfrom); ++ *sout++ = get_unaligned16(sfrom++); + #endif + while (--loops); +- out = (unsigned char *)sout + OFF; +- from = (unsigned char *)sfrom + OFF; ++ out = (unsigned char *)sout; ++ from = (unsigned char *)sfrom; + } else { /* dist == 1 or dist == 2 */ + unsigned short pat16; + +- pat16 = *(sout-1+OFF); ++ pat16 = *(sout-1); + if (dist == 1) { + union uu mm; + /* copy one char pattern to both bytes */ +@@ -296,12 +275,12 @@ void inflate_fast(z_streamp strm, unsigned start) + } + loops = len >> 1; + do +- PUP(sout) = pat16; ++ *sout++ = pat16; + while (--loops); +- out = (unsigned char *)sout + OFF; ++ out = (unsigned char *)sout; + } + if (len & 1) +- PUP(out) = PUP(from); ++ *out++ = *from++; + } + } + else if ((op & 64) == 0) { /* 2nd level distance code */ +@@ -336,8 +315,8 @@ void inflate_fast(z_streamp strm, unsigned start) + hold &= (1U << bits) - 1; + + /* update state and return */ +- strm->next_in = in + OFF; +- strm->next_out = out + OFF; ++ strm->next_in = in; ++ strm->next_out = out; + strm->avail_in = (unsigned)(in < last ? 5 + (last - in) : 5 - (in - last)); + strm->avail_out = (unsigned)(out < end ? + 257 + (end - out) : 257 - (out - end)); +diff --git a/mm/slab_common.c b/mm/slab_common.c +index 13f1926f8fcd..26c4d4722927 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -1345,7 +1345,7 @@ void kzfree(const void *p) + if (unlikely(ZERO_OR_NULL_PTR(mem))) + return; + ks = ksize(mem); +- memset(mem, 0, ks); ++ memzero_explicit(mem, ks); + kfree(mem); + } + EXPORT_SYMBOL(kzfree); +diff --git a/net/core/dev.c b/net/core/dev.c +index 1041523aaa76..267b648a0645 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -82,6 +82,7 @@ + #include <linux/slab.h> + #include <linux/sched.h> + #include <linux/mutex.h> ++#include <linux/rwsem.h> + #include <linux/string.h> + #include <linux/mm.h> + #include <linux/socket.h> +@@ -189,7 +190,7 @@ static DEFINE_SPINLOCK(napi_hash_lock); + static unsigned int napi_gen_id = NR_CPUS; + static DEFINE_READ_MOSTLY_HASHTABLE(napi_hash, 8); + +-static seqcount_t devnet_rename_seq; ++static DECLARE_RWSEM(devnet_rename_sem); + + static inline void dev_base_seq_inc(struct net *net) + { +@@ -866,33 +867,28 @@ EXPORT_SYMBOL(dev_get_by_index); + * @net: network namespace + * @name: a pointer to the buffer where the name will be stored. + * @ifindex: the ifindex of the interface to get the name from. +- * +- * The use of raw_seqcount_begin() and cond_resched() before +- * retrying is required as we want to give the writers a chance +- * to complete when CONFIG_PREEMPT is not set. + */ + int netdev_get_name(struct net *net, char *name, int ifindex) + { + struct net_device *dev; +- unsigned int seq; ++ int ret; + +-retry: +- seq = raw_seqcount_begin(&devnet_rename_seq); ++ down_read(&devnet_rename_sem); + rcu_read_lock(); ++ + dev = dev_get_by_index_rcu(net, ifindex); + if (!dev) { +- rcu_read_unlock(); +- return -ENODEV; ++ ret = -ENODEV; ++ goto out; + } + + strcpy(name, dev->name); +- rcu_read_unlock(); +- if (read_seqcount_retry(&devnet_rename_seq, seq)) { +- cond_resched(); +- goto retry; +- } + +- return 0; ++ ret = 0; ++out: ++ rcu_read_unlock(); ++ up_read(&devnet_rename_sem); ++ return ret; + } + + /** +@@ -1157,10 +1153,10 @@ int dev_change_name(struct net_device *dev, const char *newname) + if (dev->flags & IFF_UP) + return -EBUSY; + +- write_seqcount_begin(&devnet_rename_seq); ++ down_write(&devnet_rename_sem); + + if (strncmp(newname, dev->name, IFNAMSIZ) == 0) { +- write_seqcount_end(&devnet_rename_seq); ++ up_write(&devnet_rename_sem); + return 0; + } + +@@ -1168,7 +1164,7 @@ int dev_change_name(struct net_device *dev, const char *newname) + + err = dev_get_valid_name(net, dev, newname); + if (err < 0) { +- write_seqcount_end(&devnet_rename_seq); ++ up_write(&devnet_rename_sem); + return err; + } + +@@ -1183,11 +1179,11 @@ rollback: + if (ret) { + memcpy(dev->name, oldname, IFNAMSIZ); + dev->name_assign_type = old_assign_type; +- write_seqcount_end(&devnet_rename_seq); ++ up_write(&devnet_rename_sem); + return ret; + } + +- write_seqcount_end(&devnet_rename_seq); ++ up_write(&devnet_rename_sem); + + netdev_adjacent_rename_links(dev, oldname); + +@@ -1208,7 +1204,7 @@ rollback: + /* err >= 0 after dev_alloc_name() or stores the first errno */ + if (err >= 0) { + err = ret; +- write_seqcount_begin(&devnet_rename_seq); ++ down_write(&devnet_rename_sem); + memcpy(dev->name, oldname, IFNAMSIZ); + memcpy(oldname, newname, IFNAMSIZ); + dev->name_assign_type = old_assign_type; +@@ -7359,6 +7355,13 @@ int register_netdevice(struct net_device *dev) + rcu_barrier(); + + dev->reg_state = NETREG_UNREGISTERED; ++ /* We should put the kobject that hold in ++ * netdev_unregister_kobject(), otherwise ++ * the net device cannot be freed when ++ * driver calls free_netdev(), because the ++ * kobject is being hold. ++ */ ++ kobject_put(&dev->dev.kobj); + } + /* + * Prevent userspace races by waiting until the network +diff --git a/net/core/sock.c b/net/core/sock.c +index 41794a698da6..dac9365151df 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1403,6 +1403,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority, + cgroup_sk_alloc(&sk->sk_cgrp_data); + sock_update_classid(&sk->sk_cgrp_data); + sock_update_netprioidx(&sk->sk_cgrp_data); ++ sk_tx_queue_clear(sk); + } + + return sk; +@@ -1587,6 +1588,7 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) + */ + sk_refcnt_debug_inc(newsk); + sk_set_socket(newsk, NULL); ++ sk_tx_queue_clear(newsk); + newsk->sk_wq = NULL; + + if (newsk->sk_prot->sockets_allocated) +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 6aec95e1fc13..305104d116d6 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -776,7 +776,7 @@ static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi, + if (fl4.flowi4_scope < RT_SCOPE_LINK) + fl4.flowi4_scope = RT_SCOPE_LINK; + +- if (cfg->fc_table) ++ if (cfg->fc_table && cfg->fc_table != RT_TABLE_MAIN) + tbl = fib_get_table(net, cfg->fc_table); + + if (tbl) +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index dd5db4cc7d06..5f2e3334ccce 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -98,9 +98,10 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + __be32 remote, __be32 local, + __be32 key) + { +- unsigned int hash; + struct ip_tunnel *t, *cand = NULL; + struct hlist_head *head; ++ struct net_device *ndev; ++ unsigned int hash; + + hash = ip_tunnel_hash(key, remote); + head = &itn->tunnels[hash]; +@@ -175,8 +176,9 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + if (t) + return t; + +- if (itn->fb_tunnel_dev && itn->fb_tunnel_dev->flags & IFF_UP) +- return netdev_priv(itn->fb_tunnel_dev); ++ ndev = READ_ONCE(itn->fb_tunnel_dev); ++ if (ndev && ndev->flags & IFF_UP) ++ return netdev_priv(ndev); + + return NULL; + } +@@ -1193,9 +1195,9 @@ void ip_tunnel_uninit(struct net_device *dev) + struct ip_tunnel_net *itn; + + itn = net_generic(net, tunnel->ip_tnl_net_id); +- /* fb_tunnel_dev will be unregisted in net-exit call. */ +- if (itn->fb_tunnel_dev != dev) +- ip_tunnel_del(itn, netdev_priv(dev)); ++ ip_tunnel_del(itn, netdev_priv(dev)); ++ if (itn->fb_tunnel_dev == dev) ++ WRITE_ONCE(itn->fb_tunnel_dev, NULL); + + dst_cache_reset(&tunnel->dst_cache); + } +diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c +index c99230efcd52..00397c6add20 100644 +--- a/net/ipv4/tcp_cubic.c ++++ b/net/ipv4/tcp_cubic.c +@@ -414,6 +414,8 @@ static void hystart_update(struct sock *sk, u32 delay) + + if (hystart_detect & HYSTART_DELAY) { + /* obtain the minimum delay of more than sampling packets */ ++ if (ca->curr_rtt > delay) ++ ca->curr_rtt = delay; + if (ca->sample_cnt < HYSTART_MIN_SAMPLES) { + if (ca->curr_rtt == 0 || ca->curr_rtt > delay) + ca->curr_rtt = delay; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 52014c5312b9..b3953f789891 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4537,7 +4537,11 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) + if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb, + skb, &fragstolen)) { + coalesce_done: +- tcp_grow_window(sk, skb); ++ /* For non sack flows, do not grow window to force DUPACK ++ * and trigger fast retransmit. ++ */ ++ if (tcp_is_sack(tp)) ++ tcp_grow_window(sk, skb); + kfree_skb_partial(skb, fragstolen); + skb = NULL; + goto add_sack; +@@ -4621,7 +4625,11 @@ add_sack: + tcp_sack_new_ofo_skb(sk, seq, end_seq); + end: + if (skb) { +- tcp_grow_window(sk, skb); ++ /* For non sack flows, do not grow window to force DUPACK ++ * and trigger fast retransmit. ++ */ ++ if (tcp_is_sack(tp)) ++ tcp_grow_window(sk, skb); + skb_set_owner_r(skb, sk); + } + } +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index caee5530ae2c..ca001ecb7197 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -124,6 +124,7 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev, + int dev_type = (gre_proto == htons(ETH_P_TEB)) ? + ARPHRD_ETHER : ARPHRD_IP6GRE; + int score, cand_score = 4; ++ struct net_device *ndev; + + for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) { + if (!ipv6_addr_equal(local, &t->parms.laddr) || +@@ -226,9 +227,9 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev, + if (cand) + return cand; + +- dev = ign->fb_tunnel_dev; +- if (dev->flags & IFF_UP) +- return netdev_priv(dev); ++ ndev = READ_ONCE(ign->fb_tunnel_dev); ++ if (ndev && ndev->flags & IFF_UP) ++ return netdev_priv(ndev); + + return NULL; + } +@@ -364,6 +365,8 @@ static void ip6gre_tunnel_uninit(struct net_device *dev) + struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id); + + ip6gre_tunnel_unlink(ign, t); ++ if (ign->fb_tunnel_dev == dev) ++ WRITE_ONCE(ign->fb_tunnel_dev, NULL); + dst_cache_reset(&t->dst_cache); + dev_put(dev); + } +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index e065d48b31b9..f904b9b24027 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -2601,6 +2601,7 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev) + idev->mc_list = i->next; + + write_unlock_bh(&idev->lock); ++ ip6_mc_clear_src(i); + ma_put(i); + write_lock_bh(&idev->lock); + } +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index fdc1de1cb4fa..c191ea65a6c7 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -351,8 +351,13 @@ int l2tp_session_register(struct l2tp_session *session, + + spin_lock_bh(&pn->l2tp_session_hlist_lock); + ++ /* IP encap expects session IDs to be globally unique, while ++ * UDP encap doesn't. ++ */ + hlist_for_each_entry(session_walk, g_head, global_hlist) +- if (session_walk->session_id == session->session_id) { ++ if (session_walk->session_id == session->session_id && ++ (session_walk->tunnel->encap == L2TP_ENCAPTYPE_IP || ++ tunnel->encap == L2TP_ENCAPTYPE_IP)) { + err = -EEXIST; + goto err_tlock_pnlock; + } +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index f64660e9ff87..511496278262 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -379,6 +379,8 @@ ip_set_elem_len(struct ip_set *set, struct nlattr *tb[], size_t len, + for (id = 0; id < IPSET_EXT_ID_MAX; id++) { + if (!add_extension(id, cadt_flags, tb)) + continue; ++ if (align < ip_set_extensions[id].align) ++ align = ip_set_extensions[id].align; + len = ALIGN(len, ip_set_extensions[id].align); + set->offset[id] = len; + set->extensions |= ip_set_extensions[id].type; +diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c +index 832d854c2d5c..01ad588144e3 100644 +--- a/net/rxrpc/call_accept.c ++++ b/net/rxrpc/call_accept.c +@@ -26,6 +26,11 @@ + #include <net/ip.h> + #include "ar-internal.h" + ++static void rxrpc_dummy_notify(struct sock *sk, struct rxrpc_call *call, ++ unsigned long user_call_ID) ++{ ++} ++ + /* + * Preallocate a single service call, connection and peer and, if possible, + * give them a user ID and attach the user's side of the ID to them. +@@ -224,6 +229,8 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx) + if (rx->discard_new_call) { + _debug("discard %lx", call->user_call_ID); + rx->discard_new_call(call, call->user_call_ID); ++ if (call->notify_rx) ++ call->notify_rx = rxrpc_dummy_notify; + rxrpc_put_call(call, rxrpc_call_put_kernel); + } + rxrpc_call_completed(call); +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 88ce8edf1261..04ca08f85220 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -337,6 +337,7 @@ void __netdev_watchdog_up(struct net_device *dev) + dev_hold(dev); + } + } ++EXPORT_SYMBOL_GPL(__netdev_watchdog_up); + + static void dev_watchdog_up(struct net_device *dev) + { +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index 16e120b84118..8c5597d07240 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -1583,12 +1583,15 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len) + int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc, + sctp_scope_t scope, gfp_t gfp) + { ++ struct sock *sk = asoc->base.sk; + int flags; + + /* Use scoping rules to determine the subset of addresses from + * the endpoint. + */ +- flags = (PF_INET6 == asoc->base.sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0; ++ flags = (PF_INET6 == sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0; ++ if (!inet_v6_ipv6only(sk)) ++ flags |= SCTP_ADDR4_ALLOWED; + if (asoc->peer.ipv4_address) + flags |= SCTP_ADDR4_PEERSUPP; + if (asoc->peer.ipv6_address) +diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c +index 401c60750b20..dc4335d817d8 100644 +--- a/net/sctp/bind_addr.c ++++ b/net/sctp/bind_addr.c +@@ -451,6 +451,7 @@ static int sctp_copy_one_addr(struct net *net, struct sctp_bind_addr *dest, + * well as the remote peer. + */ + if ((((AF_INET == addr->sa.sa_family) && ++ (flags & SCTP_ADDR4_ALLOWED) && + (flags & SCTP_ADDR4_PEERSUPP))) || + (((AF_INET6 == addr->sa.sa_family) && + (flags & SCTP_ADDR6_ALLOWED) && +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index c5a2a538279b..b2c242facf1b 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -210,6 +210,7 @@ int sctp_copy_local_addr_list(struct net *net, struct sctp_bind_addr *bp, + * sock as well as the remote peer. + */ + if ((((AF_INET == addr->a.sa.sa_family) && ++ (copy_flags & SCTP_ADDR4_ALLOWED) && + (copy_flags & SCTP_ADDR4_PEERSUPP))) || + (((AF_INET6 == addr->a.sa.sa_family) && + (copy_flags & SCTP_ADDR6_ALLOWED) && +diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c +index 2e0a6f92e563..8391c2785550 100644 +--- a/net/sunrpc/addr.c ++++ b/net/sunrpc/addr.c +@@ -81,11 +81,11 @@ static size_t rpc_ntop6(const struct sockaddr *sap, + + rc = snprintf(scopebuf, sizeof(scopebuf), "%c%u", + IPV6_SCOPE_DELIMITER, sin6->sin6_scope_id); +- if (unlikely((size_t)rc > sizeof(scopebuf))) ++ if (unlikely((size_t)rc >= sizeof(scopebuf))) + return 0; + + len += rc; +- if (unlikely(len > buflen)) ++ if (unlikely(len >= buflen)) + return 0; + + strcat(buf, scopebuf); +diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c +index 34f94052c519..137f92bfafac 100644 +--- a/net/sunrpc/rpc_pipe.c ++++ b/net/sunrpc/rpc_pipe.c +@@ -1347,6 +1347,7 @@ rpc_gssd_dummy_populate(struct dentry *root, struct rpc_pipe *pipe_data) + q.len = strlen(gssd_dummy_clnt_dir[0].name); + clnt_dentry = d_hash_and_lookup(gssd_dentry, &q); + if (!clnt_dentry) { ++ __rpc_depopulate(gssd_dentry, gssd_dummy_clnt_dir, 0, 1); + pipe_dentry = ERR_PTR(-ENOENT); + goto out; + } +diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c +index 69846c6574ef..dd547edee59f 100644 +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -1036,6 +1036,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, + base = 0; + } else { + base -= buf->head[0].iov_len; ++ subbuf->head[0].iov_base = buf->head[0].iov_base; + subbuf->head[0].iov_len = 0; + } + +@@ -1048,6 +1049,8 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, + base = 0; + } else { + base -= buf->page_len; ++ subbuf->pages = buf->pages; ++ subbuf->page_base = 0; + subbuf->page_len = 0; + } + +@@ -1059,6 +1062,7 @@ xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf, + base = 0; + } else { + base -= buf->tail[0].iov_len; ++ subbuf->tail[0].iov_base = buf->tail[0].iov_base; + subbuf->tail[0].iov_len = 0; + } + +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index 558dea61db11..1920b9e2d251 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -82,20 +82,21 @@ cc-cross-prefix = \ + fi))) + + # output directory for tests below +-TMPOUT := $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/) ++TMPOUT = $(if $(KBUILD_EXTMOD),$(firstword $(KBUILD_EXTMOD))/).tmp_$$$$ + + # try-run + # Usage: option = $(call try-run, $(CC)...-o "$$TMP",option-ok,otherwise) + # Exit code chooses option. "$$TMP" is can be used as temporary file and + # is automatically cleaned up. + try-run = $(shell set -e; \ +- TMP="$(TMPOUT).$$$$.tmp"; \ +- TMPO="$(TMPOUT).$$$$.o"; \ ++ TMP=$(TMPOUT)/tmp; \ ++ TMPO=$(TMPOUT)/tmp.o; \ ++ mkdir -p $(TMPOUT); \ ++ trap "rm -rf $(TMPOUT)" EXIT; \ + if ($(1)) >/dev/null 2>&1; \ + then echo "$(2)"; \ + else echo "$(3)"; \ +- fi; \ +- rm -f "$$TMP" "$$TMPO") ++ fi) + + # as-option + # Usage: cflags-y += $(call as-option,-Wa$(comma)-isa=foo,) +diff --git a/scripts/mksysmap b/scripts/mksysmap +index a35acc0d0b82..9aa23d15862a 100755 +--- a/scripts/mksysmap ++++ b/scripts/mksysmap +@@ -41,4 +41,4 @@ + # so we just ignore them to let readprofile continue to work. + # (At least sparc64 has __crc_ in the middle). + +-$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( .L\)' > $2 ++$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2 +diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c +index bfc4ffa1fa1a..6ca297821d45 100644 +--- a/security/selinux/ss/services.c ++++ b/security/selinux/ss/services.c +@@ -2616,8 +2616,12 @@ err: + if (*names) { + for (i = 0; i < *len; i++) + kfree((*names)[i]); ++ kfree(*names); + } + kfree(*values); ++ *len = 0; ++ *names = NULL; ++ *values = NULL; + goto out; + } + +diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c +index 718d5e3b7806..6c06d0645779 100644 +--- a/sound/isa/wavefront/wavefront_synth.c ++++ b/sound/isa/wavefront/wavefront_synth.c +@@ -1174,7 +1174,10 @@ wavefront_send_alias (snd_wavefront_t *dev, wavefront_patch_info *header) + "alias for %d\n", + header->number, + header->hdr.a.OriginalSample); +- ++ ++ if (header->number >= WF_MAX_SAMPLE) ++ return -EINVAL; ++ + munge_int32 (header->number, &alias_hdr[0], 2); + munge_int32 (header->hdr.a.OriginalSample, &alias_hdr[2], 2); + munge_int32 (*((unsigned int *)&header->hdr.a.sampleStartOffset), +@@ -1205,6 +1208,9 @@ wavefront_send_multisample (snd_wavefront_t *dev, wavefront_patch_info *header) + int num_samples; + unsigned char *msample_hdr; + ++ if (header->number >= WF_MAX_SAMPLE) ++ return -EINVAL; ++ + msample_hdr = kmalloc(WF_MSAMPLE_BYTES, GFP_KERNEL); + if (! msample_hdr) + return -ENOMEM; +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index a866a20349c3..2def4ad579cc 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -3687,6 +3687,11 @@ HDA_CODEC_ENTRY(0x10de0095, "GPU 95 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0097, "GPU 97 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0098, "GPU 98 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de0099, "GPU 99 HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de009a, "GPU 9a HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de009d, "GPU 9d HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de009e, "GPU 9e HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de009f, "GPU 9f HDMI/DP", patch_nvhdmi), ++HDA_CODEC_ENTRY(0x10de00a0, "GPU a0 HDMI/DP", patch_nvhdmi), + HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch), + HDA_CODEC_ENTRY(0x10de8067, "MCP67/68 HDMI", patch_nvhdmi_2ch), + HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi), +diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c +index dc30d780f874..3fcf174b99d3 100644 +--- a/sound/soc/fsl/fsl_asrc_dma.c ++++ b/sound/soc/fsl/fsl_asrc_dma.c +@@ -243,6 +243,7 @@ static int fsl_asrc_dma_hw_params(struct snd_pcm_substream *substream, + ret = dmaengine_slave_config(pair->dma_chan[dir], &config_be); + if (ret) { + dev_err(dev, "failed to config DMA channel for Back-End\n"); ++ dma_release_channel(pair->dma_chan[dir]); + return ret; + } + +diff --git a/sound/usb/card.h b/sound/usb/card.h +index 111b0f009afa..c4599cf0ddc9 100644 +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -80,6 +80,10 @@ struct snd_usb_endpoint { + dma_addr_t sync_dma; /* DMA address of syncbuf */ + + unsigned int pipe; /* the data i/o pipe */ ++ unsigned int framesize[2]; /* small/large frame sizes in samples */ ++ unsigned int sample_rem; /* remainder from division fs/fps */ ++ unsigned int sample_accum; /* sample accumulator */ ++ unsigned int fps; /* frames per second */ + unsigned int freqn; /* nominal sampling rate in fs/fps in Q16.16 format */ + unsigned int freqm; /* momentary sampling rate in fs/fps in Q16.16 format */ + int freqshift; /* how much to shift the feedback value to get Q16.16 */ +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index 30aa5f2df6da..b5207e71ed72 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -137,12 +137,12 @@ int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep) + + /* + * For streaming based on information derived from sync endpoints, +- * prepare_outbound_urb_sizes() will call next_packet_size() to ++ * prepare_outbound_urb_sizes() will call slave_next_packet_size() to + * determine the number of samples to be sent in the next packet. + * +- * For implicit feedback, next_packet_size() is unused. ++ * For implicit feedback, slave_next_packet_size() is unused. + */ +-int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) ++int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep) + { + unsigned long flags; + int ret; +@@ -159,6 +159,29 @@ int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) + return ret; + } + ++/* ++ * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes() ++ * will call next_packet_size() to determine the number of samples to be ++ * sent in the next packet. ++ */ ++int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) ++{ ++ int ret; ++ ++ if (ep->fill_max) ++ return ep->maxframesize; ++ ++ ep->sample_accum += ep->sample_rem; ++ if (ep->sample_accum >= ep->fps) { ++ ep->sample_accum -= ep->fps; ++ ret = ep->framesize[1]; ++ } else { ++ ret = ep->framesize[0]; ++ } ++ ++ return ret; ++} ++ + static void retire_outbound_urb(struct snd_usb_endpoint *ep, + struct snd_urb_ctx *urb_ctx) + { +@@ -203,6 +226,8 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, + + if (ctx->packet_size[i]) + counts = ctx->packet_size[i]; ++ else if (ep->sync_master) ++ counts = snd_usb_endpoint_slave_next_packet_size(ep); + else + counts = snd_usb_endpoint_next_packet_size(ep); + +@@ -875,10 +900,17 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep, + ep->maxpacksize = fmt->maxpacksize; + ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX); + +- if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) ++ if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) { + ep->freqn = get_usb_full_speed_rate(rate); +- else ++ ep->fps = 1000; ++ } else { + ep->freqn = get_usb_high_speed_rate(rate); ++ ep->fps = 8000; ++ } ++ ++ ep->sample_rem = rate % ep->fps; ++ ep->framesize[0] = rate / ep->fps; ++ ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps; + + /* calculate the frequency in 16.16 format */ + ep->freqm = ep->freqn; +@@ -937,6 +969,7 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep) + ep->active_mask = 0; + ep->unlink_mask = 0; + ep->phase = 0; ++ ep->sample_accum = 0; + + snd_usb_endpoint_start_quirk(ep); + +diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h +index 584f295d7c77..4aad49cbeb5f 100644 +--- a/sound/usb/endpoint.h ++++ b/sound/usb/endpoint.h +@@ -27,6 +27,7 @@ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep); + void snd_usb_endpoint_free(struct snd_usb_endpoint *ep); + + int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep); ++int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep); + int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep); + + void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep, +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 024864ce3f76..6913ea27e978 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -585,8 +585,9 @@ static int check_matrix_bitmap(unsigned char *bmap, + * if failed, give up and free the control instance. + */ + +-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, +- struct snd_kcontrol *kctl) ++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list, ++ struct snd_kcontrol *kctl, ++ bool is_std_info) + { + struct usb_mixer_interface *mixer = list->mixer; + int err; +@@ -599,6 +600,7 @@ int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, + return err; + } + list->kctl = kctl; ++ list->is_std_info = is_std_info; + list->next_id_elem = mixer->id_elems[list->id]; + mixer->id_elems[list->id] = list; + return 0; +@@ -2397,15 +2399,23 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid) + { + struct usb_mixer_elem_list *list; + +- for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) ++ for_each_mixer_elem(list, mixer, unitid) { ++ struct usb_mixer_elem_info *info; ++ ++ if (!list->is_std_info) ++ continue; ++ info = mixer_elem_list_to_info(list); ++ /* invalidate cache, so the value is read from the device */ ++ info->cached = 0; + snd_ctl_notify(mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE, + &list->kctl->id); ++ } + } + + static void snd_usb_mixer_dump_cval(struct snd_info_buffer *buffer, + struct usb_mixer_elem_list *list) + { +- struct usb_mixer_elem_info *cval = (struct usb_mixer_elem_info *)list; ++ struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list); + static char *val_types[] = {"BOOLEAN", "INV_BOOLEAN", + "S8", "U8", "S16", "U16"}; + snd_iprintf(buffer, " Info: id=%i, control=%i, cmask=0x%x, " +@@ -2431,8 +2441,7 @@ static void snd_usb_mixer_proc_read(struct snd_info_entry *entry, + mixer->ignore_ctl_error); + snd_iprintf(buffer, "Card: %s\n", chip->card->longname); + for (unitid = 0; unitid < MAX_ID_ELEMS; unitid++) { +- for (list = mixer->id_elems[unitid]; list; +- list = list->next_id_elem) { ++ for_each_mixer_elem(list, mixer, unitid) { + snd_iprintf(buffer, " Unit: %i\n", list->id); + if (list->kctl) + snd_iprintf(buffer, +@@ -2462,19 +2471,21 @@ static void snd_usb_mixer_interrupt_v2(struct usb_mixer_interface *mixer, + return; + } + +- for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) ++ for_each_mixer_elem(list, mixer, unitid) + count++; + + if (count == 0) + return; + +- for (list = mixer->id_elems[unitid]; list; list = list->next_id_elem) { ++ for_each_mixer_elem(list, mixer, unitid) { + struct usb_mixer_elem_info *info; + + if (!list->kctl) + continue; ++ if (!list->is_std_info) ++ continue; + +- info = (struct usb_mixer_elem_info *)list; ++ info = mixer_elem_list_to_info(list); + if (count > 1 && info->control != control) + continue; + +@@ -2694,7 +2705,7 @@ int snd_usb_mixer_suspend(struct usb_mixer_interface *mixer) + + static int restore_mixer_value(struct usb_mixer_elem_list *list) + { +- struct usb_mixer_elem_info *cval = (struct usb_mixer_elem_info *)list; ++ struct usb_mixer_elem_info *cval = mixer_elem_list_to_info(list); + int c, err, idx; + + if (cval->cmask) { +@@ -2730,8 +2741,7 @@ int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume) + if (reset_resume) { + /* restore cached mixer values */ + for (id = 0; id < MAX_ID_ELEMS; id++) { +- for (list = mixer->id_elems[id]; list; +- list = list->next_id_elem) { ++ for_each_mixer_elem(list, mixer, id) { + if (list->resume) { + err = list->resume(list); + if (err < 0) +diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h +index 545d99b09706..7d16a9221070 100644 +--- a/sound/usb/mixer.h ++++ b/sound/usb/mixer.h +@@ -48,10 +48,17 @@ struct usb_mixer_elem_list { + struct usb_mixer_elem_list *next_id_elem; /* list of controls with same id */ + struct snd_kcontrol *kctl; + unsigned int id; ++ bool is_std_info; + usb_mixer_elem_dump_func_t dump; + usb_mixer_elem_resume_func_t resume; + }; + ++/* iterate over mixer element list of the given unit id */ ++#define for_each_mixer_elem(list, mixer, id) \ ++ for ((list) = (mixer)->id_elems[id]; (list); (list) = (list)->next_id_elem) ++#define mixer_elem_list_to_info(list) \ ++ container_of(list, struct usb_mixer_elem_info, head) ++ + struct usb_mixer_elem_info { + struct usb_mixer_elem_list head; + unsigned int control; /* CS or ICN (high byte) */ +@@ -79,8 +86,12 @@ void snd_usb_mixer_notify_id(struct usb_mixer_interface *mixer, int unitid); + int snd_usb_mixer_set_ctl_value(struct usb_mixer_elem_info *cval, + int request, int validx, int value_set); + +-int snd_usb_mixer_add_control(struct usb_mixer_elem_list *list, +- struct snd_kcontrol *kctl); ++int snd_usb_mixer_add_list(struct usb_mixer_elem_list *list, ++ struct snd_kcontrol *kctl, ++ bool is_std_info); ++ ++#define snd_usb_mixer_add_control(list, kctl) \ ++ snd_usb_mixer_add_list(list, kctl, true) + + void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list, + struct usb_mixer_interface *mixer, +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index 723b535ca2ec..198515f86fcc 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -168,7 +168,8 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer, + return -ENOMEM; + } + kctl->private_free = snd_usb_mixer_elem_free; +- return snd_usb_mixer_add_control(list, kctl); ++ /* don't use snd_usb_mixer_add_control() here, this is a special list element */ ++ return snd_usb_mixer_add_list(list, kctl, false); + } + + /* +@@ -1170,7 +1171,7 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip, + int unitid = 12; /* SamleRate ExtensionUnit ID */ + + list_for_each_entry(mixer, &chip->mixer_list, list) { +- cval = (struct usb_mixer_elem_info *)mixer->id_elems[unitid]; ++ cval = mixer_elem_list_to_info(mixer->id_elems[unitid]); + if (cval) { + snd_usb_mixer_set_ctl_value(cval, UAC_SET_CUR, + cval->control << 8, +diff --git a/sound/usb/mixer_scarlett.c b/sound/usb/mixer_scarlett.c +index 7438e7c4a842..2876cd9b35b3 100644 +--- a/sound/usb/mixer_scarlett.c ++++ b/sound/usb/mixer_scarlett.c +@@ -287,8 +287,7 @@ static int scarlett_ctl_switch_put(struct snd_kcontrol *kctl, + + static int scarlett_ctl_resume(struct usb_mixer_elem_list *list) + { +- struct usb_mixer_elem_info *elem = +- container_of(list, struct usb_mixer_elem_info, head); ++ struct usb_mixer_elem_info *elem = mixer_elem_list_to_info(list); + int i; + + for (i = 0; i < elem->channels; i++) +@@ -447,8 +446,7 @@ static int scarlett_ctl_enum_put(struct snd_kcontrol *kctl, + + static int scarlett_ctl_enum_resume(struct usb_mixer_elem_list *list) + { +- struct usb_mixer_elem_info *elem = +- container_of(list, struct usb_mixer_elem_info, head); ++ struct usb_mixer_elem_info *elem = mixer_elem_list_to_info(list); + + if (elem->cached) + snd_usb_set_cur_mix_value(elem, 0, 0, *elem->cache_val); +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 9bc995f9b4e1..615213aeda33 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1483,6 +1483,8 @@ static void prepare_playback_urb(struct snd_usb_substream *subs, + for (i = 0; i < ctx->packets; i++) { + if (ctx->packet_size[i]) + counts = ctx->packet_size[i]; ++ else if (ep->sync_master) ++ counts = snd_usb_endpoint_slave_next_packet_size(ep); + else + counts = snd_usb_endpoint_next_packet_size(ep); + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 0484a8d8a5bb..486d27129ac3 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1162,6 +1162,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + static bool is_itf_usb_dsd_2alts_dac(unsigned int id) + { + switch (id) { ++ case USB_ID(0x154e, 0x1002): /* Denon DCD-1500RE */ + case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */ + case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */ + case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */ +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index 0abca8783bb3..78485edb9467 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -341,8 +341,7 @@ static size_t hists__fprintf_nr_sample_events(struct hists *hists, struct report + if (evname != NULL) + ret += fprintf(fp, " of event '%s'", evname); + +- if (symbol_conf.show_ref_callgraph && +- strstr(evname, "call-graph=no")) { ++ if (symbol_conf.show_ref_callgraph && evname && strstr(evname, "call-graph=no")) { + ret += fprintf(fp, ", show reference callgraph"); + } + +diff --git a/tools/testing/selftests/networking/timestamping/timestamping.c b/tools/testing/selftests/networking/timestamping/timestamping.c +index 5cdfd743447b..900ed4b47899 100644 +--- a/tools/testing/selftests/networking/timestamping/timestamping.c ++++ b/tools/testing/selftests/networking/timestamping/timestamping.c +@@ -332,10 +332,16 @@ int main(int argc, char **argv) + int val; + socklen_t len; + struct timeval next; ++ size_t if_len; + + if (argc < 2) + usage(0); + interface = argv[1]; ++ if_len = strlen(interface); ++ if (if_len >= IFNAMSIZ) { ++ printf("interface name exceeds IFNAMSIZ\n"); ++ exit(1); ++ } + + for (i = 2; i < argc; i++) { + if (!strcasecmp(argv[i], "SO_TIMESTAMP")) +@@ -369,12 +375,12 @@ int main(int argc, char **argv) + bail("socket"); + + memset(&device, 0, sizeof(device)); +- strncpy(device.ifr_name, interface, sizeof(device.ifr_name)); ++ memcpy(device.ifr_name, interface, if_len + 1); + if (ioctl(sock, SIOCGIFADDR, &device) < 0) + bail("getting interface IP address"); + + memset(&hwtstamp, 0, sizeof(hwtstamp)); +- strncpy(hwtstamp.ifr_name, interface, sizeof(hwtstamp.ifr_name)); ++ memcpy(hwtstamp.ifr_name, interface, if_len + 1); + hwtstamp.ifr_data = (void *)&hwconfig; + memset(&hwconfig, 0, sizeof(hwconfig)); + hwconfig.tx_type = +diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c +index 874972ccfc95..5338e668b5e6 100644 +--- a/tools/testing/selftests/x86/protection_keys.c ++++ b/tools/testing/selftests/x86/protection_keys.c +@@ -23,6 +23,7 @@ + #define _GNU_SOURCE + #include <errno.h> + #include <linux/futex.h> ++#include <time.h> + #include <sys/time.h> + #include <sys/syscall.h> + #include <string.h> +@@ -608,10 +609,10 @@ int alloc_random_pkey(void) + int nr_alloced = 0; + int random_index; + memset(alloced_pkeys, 0, sizeof(alloced_pkeys)); ++ srand((unsigned int)time(NULL)); + + /* allocate every possible key and make a note of which ones we got */ + max_nr_pkey_allocs = NR_PKEYS; +- max_nr_pkey_allocs = 1; + for (i = 0; i < max_nr_pkey_allocs; i++) { + int new_pkey = alloc_pkey(); + if (new_pkey < 0) |