Home Home > GIT Browse > SLE15
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2017-08-14 16:14:02 +0200
committerTakashi Iwai <tiwai@suse.de>2017-08-14 16:14:02 +0200
commit4c7248488b39dc9155e5fc4af86eafbdbd99ed37 (patch)
treef410b6289dccea00a498b3a766c7c7745b402c7c
parent7bb74ad5ccb7ee06f5c1a3272ad701a9e67e75c7 (diff)
parentc03614818df70be0b8f942a557a86677ecdc7885 (diff)
Merge branch 'users/jslaby/SLE12-SP3/for-next' into SLE12-SP3rpm-4.4.82-6.3
Pull stable kernel updates from Jiri Slaby.
-rw-r--r--patches.arch/0022-mm-don-t-dereference-struct-page-fields-of-invalid-p.patch58
-rw-r--r--patches.arch/43-x86-mce-amd-update-sysfs-bank-names-for-smca-systems.patch2
-rw-r--r--patches.arch/arm64-bsc1031492-0077-KVM-arm-arm64-Move-shared-files-to-virt-kvm-arm.patch18
-rw-r--r--patches.arch/x86-mpx-move-bd_addr-to-mm_context_t12
-rw-r--r--patches.drivers/0001-kaweth-fix-firmware-download.patch40
-rw-r--r--patches.drivers/0002-kaweth-fix-oops-upon-failed-memory-allocation.patch50
-rw-r--r--patches.drivers/0003-iscsi-target-add-void-iscsit_get_rx_pdu4
-rw-r--r--patches.drivers/0004-iscsi-target-split-iscsi_target_rx_thread27
-rw-r--r--patches.drivers/0006-scsi-fnic-Avoid-sending-reset-to-firmware-when-anoth.patch71
-rw-r--r--patches.drivers/0010-iscsi-target-clear-tx_thread_active25
-rw-r--r--patches.drivers/0011-snic-Return-error-code-on-memory-allocation-fai.patch55
-rw-r--r--patches.drivers/0015-iscsi-target-convert-transport-drivers-to-signal-rdma_shutdown24
-rw-r--r--patches.drivers/0034-target-remove-enum-transport_lunflags_table40
-rw-r--r--patches.drivers/0073-qla2xxx-Get-mutex-lock-before-checking-optrom_s.patch105
-rw-r--r--patches.drivers/0171-mm-block-convert-rw_page-users-to-bio-op-use.patch26
-rw-r--r--patches.drivers/0172-block-mm-make-bdev_ops-rw_page-take-a-bool-for-read-.patch34
-rw-r--r--patches.drivers/hfi1-qib-0362-IB-uverbs-Extend-modify_qp-and-support-packet-pacing.patch18
-rw-r--r--patches.drivers/iscsi-target-Fix-early-sk_data_ready-LOGIN_FLAGS_REA.patch70
-rw-r--r--patches.drivers/iser-target-Convert-to-new-CQ-API.patch102
-rw-r--r--patches.drivers/mpt3sas-Don-t-overreach-ioc-reply_post-during-initia.patch123
-rw-r--r--patches.drivers/mpt3sas-Make-use-of-additional-HighPriority-credit-m.patch53
-rw-r--r--patches.drivers/net-mlx4-Remove-BUG_ON-from-ICM-allocation-routine.patch38
-rw-r--r--patches.drivers/net-mlx5-Add-timeout-handle-to-commands-with-callbac.patch14
-rw-r--r--patches.drivers/phy-Add-an-mdio_device-structure.patch37
-rw-r--r--patches.drivers/phy-Centralize-setting-driver-module-owner.patch74
-rw-r--r--patches.drivers/phy-phy_-read-write-_mmd_indirect-get-addr-from-phyd.patch26
-rw-r--r--patches.drivers/target-iscsi-Fix-indentation-in-iscsi_target_start_n.patch29
-rw-r--r--patches.drivers/tg3-Fix-race-condition-in-tg3_get_stats64.patch38
-rw-r--r--patches.drivers/tpm-019-fix-return-rc-when-devm_add_action-fails.patch8
-rw-r--r--patches.drivers/tpm-035-Get-rid-of-devname.patch49
-rw-r--r--patches.drivers/tpm-039-Replace-device-number-bitmap-with-IDR.patch230
-rw-r--r--patches.drivers/tpm-062-Remove-all-uses-of-drvdata-from-the-TPM-Core.patch67
-rw-r--r--patches.drivers/tpm-137-Check-size-of-response-before-accessing-data.patch117
-rw-r--r--patches.fixes/ACPI-scan-Prefer-devices-without-_HID-for-_ADR-match.patch56
-rw-r--r--patches.fixes/Revert-powerpc-numa-Fix-percpu-allocations-to-be-NUM82
-rw-r--r--patches.fixes/af_key-add-lock-to-key-dump.patch143
-rw-r--r--patches.fixes/dentry-name-snapshots.patch231
-rw-r--r--patches.fixes/ipv4-Should-use-consistent-conditional-judgement-for.patch45
-rw-r--r--patches.fixes/ipv6-Don-t-use-ufo-handling-on-later-transformed-pac.patch15
-rw-r--r--patches.fixes/ipv6-Should-use-consistent-conditional-judgement-for.patch45
-rw-r--r--patches.fixes/ipv6-avoid-overflow-of-offset-in-ip6_find_1stfragopt.patch58
-rw-r--r--patches.fixes/media-saa7164-fix-double-fetch-PCIe-access-condition76
-rw-r--r--patches.fixes/net-account-for-current-skb-length-when-deciding-abo.patch81
-rw-r--r--patches.fixes/net-packet-fix-race-in-packet_set_ring-on-PACKET_RES.patch63
-rw-r--r--patches.fixes/net-phy-Do-not-perform-software-reset-for-Generic-PH.patch51
-rw-r--r--patches.fixes/udp-avoid-ufo-handling-on-IP-payload-compression-pac.patch27
-rw-r--r--patches.fixes/udp-consistently-apply-ufo-or-fragmentation.patch79
-rw-r--r--patches.fixes/xfs-don-t-bug-on-mixed-direct-and-mapped-i-o.patch86
-rw-r--r--patches.kabi/kabi-protect-struct-mm_struct.patch40
-rw-r--r--patches.kabi/kabi-protect-struct-se_lun.patch34
-rw-r--r--patches.kabi/revert-Make-file-credentials-available-to-the-seqfil.patch71
-rw-r--r--patches.kabi/revert-proc-iomem-only-expose-physical-resource-addr.patch48
-rw-r--r--patches.kernel.org/patch-4.4.79-803383
-rw-r--r--patches.kernel.org/patch-4.4.80-812176
-rw-r--r--patches.kernel.org/patch-4.4.81-82350
-rw-r--r--patches.suse/mm-mprotect.c-don-t-touch-single-threaded-PTEs-which-are-on-the-right-node.patch10
-rw-r--r--patches.suse/mm-printk-introduce-new-format-string-for-flags.patch4
-rw-r--r--patches.suse/sched-cputime-Fix-prev-steal-time-accouting-during-CPU-hotplug.patch74
-rw-r--r--patches.suse/workqueue-skip-flush-dependency-checks-for-legacy-workqueues.patch12
-rw-r--r--series.conf35
60 files changed, 6568 insertions, 2491 deletions
diff --git a/patches.arch/0022-mm-don-t-dereference-struct-page-fields-of-invalid-p.patch b/patches.arch/0022-mm-don-t-dereference-struct-page-fields-of-invalid-p.patch
deleted file mode 100644
index 446703ffbd..0000000000
--- a/patches.arch/0022-mm-don-t-dereference-struct-page-fields-of-invalid-p.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From bc96e3a183856c9567d323ef6f897e1735c18416 Mon Sep 17 00:00:00 2001
-From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
-Date: Tue, 10 Jan 2017 16:58:00 -0800
-Subject: [PATCH 22/64] mm: don't dereference struct page fields of invalid
- pages
-
-Git-commit: f073bdc51771f5a5c7a8d1191bfc3ae371d44de7
-Patch-mainline: v4.10-rc4
-References: fate#321947
-
-The VM_BUG_ON() check in move_freepages() checks whether the node id of
-a page matches the node id of its zone. However, it does this before
-having checked whether the struct page pointer refers to a valid struct
-page to begin with. This is guaranteed in most cases, but may not be
-the case if CONFIG_HOLES_IN_ZONE=y.
-
-So reorder the VM_BUG_ON() with the pfn_valid_within() check.
-
-Link: http://lkml.kernel.org/r/1481706707-6211-2-git-send-email-ard.biesheuvel@linaro.org
-Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
-Acked-by: Will Deacon <will.deacon@arm.com>
-Cc: Catalin Marinas <catalin.marinas@arm.com>
-Cc: Hanjun Guo <hanjun.guo@linaro.org>
-Cc: Yisheng Xie <xieyisheng1@huawei.com>
-Cc: Robert Richter <rrichter@cavium.com>
-Cc: James Morse <james.morse@arm.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@suse.com>
----
- mm/page_alloc.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 407ae566e18c..3954babe57ee 100644
---- a/mm/page_alloc.c
-+++ b/mm/page_alloc.c
-@@ -1817,14 +1817,14 @@ int move_freepages(struct zone *zone,
- #endif
-
- for (page = start_page; page <= end_page;) {
-- /* Make sure we are not inadvertently changing nodes */
-- VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
--
- if (!pfn_valid_within(page_to_pfn(page))) {
- page++;
- continue;
- }
-
-+ /* Make sure we are not inadvertently changing nodes */
-+ VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
-+
- if (!PageBuddy(page)) {
- page++;
- continue;
---
-2.11.0
-
diff --git a/patches.arch/43-x86-mce-amd-update-sysfs-bank-names-for-smca-systems.patch b/patches.arch/43-x86-mce-amd-update-sysfs-bank-names-for-smca-systems.patch
index ed8e4c99b2..62723efe26 100644
--- a/patches.arch/43-x86-mce-amd-update-sysfs-bank-names-for-smca-systems.patch
+++ b/patches.arch/43-x86-mce-amd-update-sysfs-bank-names-for-smca-systems.patch
@@ -112,4 +112,4 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+ const char *name = get_name(bank, NULL);
int err = 0;
- if (is_shared_bank(bank)) {
+ if (!dev)
diff --git a/patches.arch/arm64-bsc1031492-0077-KVM-arm-arm64-Move-shared-files-to-virt-kvm-arm.patch b/patches.arch/arm64-bsc1031492-0077-KVM-arm-arm64-Move-shared-files-to-virt-kvm-arm.patch
index 0df489c841..c15baa8073 100644
--- a/patches.arch/arm64-bsc1031492-0077-KVM-arm-arm64-Move-shared-files-to-virt-kvm-arm.patch
+++ b/patches.arch/arm64-bsc1031492-0077-KVM-arm-arm64-Move-shared-files-to-virt-kvm-arm.patch
@@ -27,20 +27,20 @@ Signed-off-by: Alexander Graf <agraf@suse.de>
arch/arm/kvm/Makefile | 7
arch/arm/kvm/arm.c | 1483 ----------------------------------
arch/arm/kvm/mmio.c | 217 -----
- arch/arm/kvm/mmu.c | 1977 ----------------------------------------------
+ arch/arm/kvm/mmu.c | 1981 ----------------------------------------------
arch/arm/kvm/perf.c | 68 -
arch/arm/kvm/psci.c | 332 -------
arch/arm/kvm/trace.h | 247 -----
arch/arm64/kvm/Makefile | 5
virt/kvm/arm/arm.c | 1483 ++++++++++++++++++++++++++++++++++
virt/kvm/arm/mmio.c | 217 +++++
- virt/kvm/arm/mmu.c | 1977 ++++++++++++++++++++++++++++++++++++++++++++++
+ virt/kvm/arm/mmu.c | 1981 ++++++++++++++++++++++++++++++++++++++++++++++
virt/kvm/arm/perf.c | 68 +
virt/kvm/arm/psci.c | 332 +++++++
virt/kvm/arm/trace.h | 246 +++++
virt/kvm/arm/vgic/trace.h | 37
virt/kvm/arm/vgic/vgic.c | 2
- 16 files changed, 4357 insertions(+), 4341 deletions(-)
+ 16 files changed, 4361 insertions(+), 4345 deletions(-)
delete mode 100644 arch/arm/kvm/arm.c
delete mode 100644 arch/arm/kvm/mmio.c
delete mode 100644 arch/arm/kvm/mmu.c
@@ -1778,7 +1778,7 @@ Signed-off-by: Alexander Graf <agraf@suse.de>
-}
--- a/arch/arm/kvm/mmu.c
+++ /dev/null
-@@ -1,1977 +0,0 @@
+@@ -1,1981 +0,0 @@
-/*
- * Copyright (C) 2012 - Virtual Open Systems and Columbia University
- * Author: Christoffer Dall <c.dall@virtualopensystems.com>
@@ -3436,12 +3436,16 @@ Signed-off-by: Alexander Graf <agraf@suse.de>
-
-int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end)
-{
+- if (!kvm->arch.pgd)
+- return 0;
- trace_kvm_age_hva(start, end);
- return handle_hva_to_gpa(kvm, start, end, kvm_age_hva_handler, NULL);
-}
-
-int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
-{
+- if (!kvm->arch.pgd)
+- return 0;
- trace_kvm_test_age_hva(hva);
- return handle_hva_to_gpa(kvm, hva, hva, kvm_test_age_hva_handler, NULL);
-}
@@ -6159,7 +6163,7 @@ Signed-off-by: Alexander Graf <agraf@suse.de>
+}
--- /dev/null
+++ b/virt/kvm/arm/mmu.c
-@@ -0,0 +1,1977 @@
+@@ -0,0 +1,1981 @@
+/*
+ * Copyright (C) 2012 - Virtual Open Systems and Columbia University
+ * Author: Christoffer Dall <c.dall@virtualopensystems.com>
@@ -7817,12 +7821,16 @@ Signed-off-by: Alexander Graf <agraf@suse.de>
+
+int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end)
+{
++ if (!kvm->arch.pgd)
++ return 0;
+ trace_kvm_age_hva(start, end);
+ return handle_hva_to_gpa(kvm, start, end, kvm_age_hva_handler, NULL);
+}
+
+int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
+{
++ if (!kvm->arch.pgd)
++ return 0;
+ trace_kvm_test_age_hva(hva);
+ return handle_hva_to_gpa(kvm, hva, hva, kvm_test_age_hva_handler, NULL);
+}
diff --git a/patches.arch/x86-mpx-move-bd_addr-to-mm_context_t b/patches.arch/x86-mpx-move-bd_addr-to-mm_context_t
index 36bf7768d8..c05720024b 100644
--- a/patches.arch/x86-mpx-move-bd_addr-to-mm_context_t
+++ b/patches.arch/x86-mpx-move-bd_addr-to-mm_context_t
@@ -21,10 +21,10 @@ Link: http://lkml.kernel.org/r/1481892055-24596-1-git-send-email-mark.rutland@ar
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Joerg Roedel <jroedel@suse.de>
---
- arch/x86/include/asm/mmu.h | 4 ++++
- arch/x86/include/asm/mpx.h | 4 ++--
- arch/x86/mm/mpx.c | 10 +++++-----
- include/linux/mm_types.h | 4 ----
+ arch/x86/include/asm/mmu.h | 4 ++++
+ arch/x86/include/asm/mpx.h | 4 ++--
+ arch/x86/mm/mpx.c | 10 +++++-----
+ include/linux/mm_types.h | 4 ----
4 files changed, 11 insertions(+), 11 deletions(-)
--- a/arch/x86/include/asm/mmu.h
@@ -87,7 +87,7 @@ Acked-by: Joerg Roedel <jroedel@suse.de>
up_write(&mm->mmap_sem);
return 0;
}
-@@ -947,7 +947,7 @@ static int try_unmap_single_bt(struct mm
+@@ -940,7 +940,7 @@ static int try_unmap_single_bt(struct mm
end = bta_end_vaddr;
}
@@ -99,7 +99,7 @@ Acked-by: Joerg Roedel <jroedel@suse.de>
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -512,10 +512,6 @@ struct mm_struct {
- bool tlb_flush_pending;
+ #endif
#endif
struct uprobes_state uprobes_state;
-#ifdef CONFIG_X86_INTEL_MPX
diff --git a/patches.drivers/0001-kaweth-fix-firmware-download.patch b/patches.drivers/0001-kaweth-fix-firmware-download.patch
deleted file mode 100644
index 0fdadf1013..0000000000
--- a/patches.drivers/0001-kaweth-fix-firmware-download.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 032b733171366d576edcba8beec7731c40c519eb Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Wed, 17 Aug 2016 11:42:22 +0200
-Subject: [PATCH v2 1/2] kaweth: fix firmware download
-Git-commit: 60bcabd080f53561efa9288be45c128feda1a8bb
-Patch-Mainline: v4.8
-References: bsc#993890
-
-This fixes the oops discovered by the Umap2 project and Alan Stern.
-The intf member needs to be set before the firmware is downloaded.
-
-Signed-off-by: Oliver Neukum <oneukum@suse.com>
----
- drivers/net/usb/kaweth.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
-index 770212b..37bf715 100644
---- a/drivers/net/usb/kaweth.c
-+++ b/drivers/net/usb/kaweth.c
-@@ -1029,6 +1029,7 @@ static int kaweth_probe(
- kaweth = netdev_priv(netdev);
- kaweth->dev = udev;
- kaweth->net = netdev;
-+ kaweth->intf = intf;
-
- spin_lock_init(&kaweth->device_lock);
- init_waitqueue_head(&kaweth->term_wait);
-@@ -1139,8 +1140,6 @@ err_fw:
-
- dev_dbg(dev, "Initializing net device.\n");
-
-- kaweth->intf = intf;
--
- kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
- if (!kaweth->tx_urb)
- goto err_free_netdev;
---
-2.1.4
-
diff --git a/patches.drivers/0002-kaweth-fix-oops-upon-failed-memory-allocation.patch b/patches.drivers/0002-kaweth-fix-oops-upon-failed-memory-allocation.patch
deleted file mode 100644
index c13b6d3611..0000000000
--- a/patches.drivers/0002-kaweth-fix-oops-upon-failed-memory-allocation.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 32634825f43a1edbc016f175eb61dcd390e625df Mon Sep 17 00:00:00 2001
-From: Oliver Neukum <oneukum@suse.com>
-Date: Wed, 17 Aug 2016 11:48:59 +0200
-Subject: [PATCH v2 2/2] kaweth: fix oops upon failed memory allocation
-Patch-Mainline: v4.8
-References: bsc#993890
-Git-commit: 575ced7f8090c1a4e91e2daf8da9352a6a1fc7a7
-
-Just return an error upon failure.
-
-Signed-off-by: Oliver Neukum <oneukum@suse.com>
----
- drivers/net/usb/kaweth.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
-index 37bf715..528b9c9 100644
---- a/drivers/net/usb/kaweth.c
-+++ b/drivers/net/usb/kaweth.c
-@@ -1009,6 +1009,7 @@ static int kaweth_probe(
- struct net_device *netdev;
- const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
- int result = 0;
-+ int rv = -EIO;
-
- dev_dbg(dev,
- "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
-@@ -1049,6 +1050,10 @@ static int kaweth_probe(
- /* Download the firmware */
- dev_info(dev, "Downloading firmware...\n");
- kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
-+ if (!kaweth->firmware_buf) {
-+ rv = -ENOMEM;
-+ goto err_free_netdev;
-+ }
- if ((result = kaweth_download_firmware(kaweth,
- "kaweth/new_code.bin",
- 100,
-@@ -1203,7 +1208,7 @@ err_only_tx:
- err_free_netdev:
- free_netdev(netdev);
-
-- return -EIO;
-+ return rv;
- }
-
- /****************************************************************
---
-2.1.4
-
diff --git a/patches.drivers/0003-iscsi-target-add-void-iscsit_get_rx_pdu b/patches.drivers/0003-iscsi-target-add-void-iscsit_get_rx_pdu
index 35b76904d4..55aca4b136 100644
--- a/patches.drivers/0003-iscsi-target-add-void-iscsit_get_rx_pdu
+++ b/patches.drivers/0003-iscsi-target-add-void-iscsit_get_rx_pdu
@@ -51,9 +51,9 @@ Acked-by: Lee Duncan <lduncan@suse.com>
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -3951,14 +3951,8 @@ int iscsi_target_rx_thread(void *arg)
+@@ -3974,14 +3974,8 @@ int iscsi_target_rx_thread(void *arg)
if (rc < 0 || iscsi_target_check_conn_state(conn))
- return 0;
+ goto out;
- if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
- struct completion comp;
diff --git a/patches.drivers/0004-iscsi-target-split-iscsi_target_rx_thread b/patches.drivers/0004-iscsi-target-split-iscsi_target_rx_thread
index dcc7377ef9..a2eb45fe9e 100644
--- a/patches.drivers/0004-iscsi-target-split-iscsi_target_rx_thread
+++ b/patches.drivers/0004-iscsi-target-split-iscsi_target_rx_thread
@@ -17,11 +17,9 @@ Signed-off-by: Varun Prakash <varun@chelsio.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Acked-by: Lee Duncan <lduncan@suse.com>
---
- drivers/target/iscsi/iscsi_target.c | 59 +++++++++++++++++++++----------------
- 1 file changed, 33 insertions(+), 26 deletions(-)
+ drivers/target/iscsi/iscsi_target.c | 61 ++++++++++++++++++++----------------
+ 1 file changed, 34 insertions(+), 27 deletions(-)
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index 9fa9f0b3a0f4..a827b7afe42c 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -480,6 +480,7 @@ int iscsit_del_np(struct iscsi_np *np)
@@ -32,7 +30,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
static int iscsit_queue_rsp(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
{
-@@ -682,6 +683,7 @@ static struct iscsit_transport iscsi_target_transport = {
+@@ -683,6 +684,7 @@ static struct iscsit_transport iscsi_tar
.iscsit_queue_status = iscsit_queue_rsp,
.iscsit_aborted_task = iscsit_aborted_task,
.iscsit_xmit_pdu = iscsit_xmit_pdu,
@@ -40,7 +38,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
.iscsit_get_sup_prot_ops = iscsit_get_sup_prot_ops,
};
-@@ -3931,30 +3933,12 @@ static bool iscsi_target_check_conn_state(struct iscsi_conn *conn)
+@@ -3953,31 +3955,12 @@ static bool iscsi_target_check_conn_stat
return ret;
}
@@ -53,6 +51,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
u32 checksum = 0, digest = 0;
- struct iscsi_conn *conn = arg;
struct kvec iov;
+- bool conn_freed = false;
- /*
- * Allow ourselves to be interrupted by SIGINT so that a
- * connection recovery / failure event can be triggered externally.
@@ -64,7 +63,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
- */
- rc = wait_for_completion_interruptible(&conn->rx_login_comp);
- if (rc < 0 || iscsi_target_check_conn_state(conn))
-- return 0;
+- goto out;
-
- if (conn->conn_transport->iscsit_get_rx_pdu) {
- conn->conn_transport->iscsit_get_rx_pdu(conn);
@@ -73,7 +72,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
while (!kthread_should_stop()) {
/*
-@@ -3972,7 +3956,7 @@ int iscsi_target_rx_thread(void *arg)
+@@ -3995,7 +3978,7 @@ int iscsi_target_rx_thread(void *arg)
ret = rx_data(conn, &iov, 1, ISCSI_HDR_LEN);
if (ret != ISCSI_HDR_LEN) {
iscsit_rx_thread_wait_for_tcp(conn);
@@ -82,7 +81,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
}
if (conn->conn_ops->HeaderDigest) {
-@@ -3982,7 +3966,7 @@ int iscsi_target_rx_thread(void *arg)
+@@ -4005,7 +3988,7 @@ int iscsi_target_rx_thread(void *arg)
ret = rx_data(conn, &iov, 1, ISCSI_CRC_LEN);
if (ret != ISCSI_CRC_LEN) {
iscsit_rx_thread_wait_for_tcp(conn);
@@ -91,7 +90,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
}
iscsit_do_crypto_hash_buf(conn->conn_rx_hash,
-@@ -4006,7 +3990,7 @@ int iscsi_target_rx_thread(void *arg)
+@@ -4029,7 +4012,7 @@ int iscsi_target_rx_thread(void *arg)
}
if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT)
@@ -100,7 +99,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
opcode = buffer[0] & ISCSI_OPCODE_MASK;
-@@ -4017,15 +4001,38 @@ int iscsi_target_rx_thread(void *arg)
+@@ -4040,15 +4023,39 @@ int iscsi_target_rx_thread(void *arg)
" while in Discovery Session, rejecting.\n", opcode);
iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
buffer);
@@ -119,6 +118,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
+{
+ int rc;
+ struct iscsi_conn *conn = arg;
++ bool conn_freed = false;
+
+ /*
+ * Allow ourselves to be interrupted by SIGINT so that a
@@ -131,7 +131,7 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
+ */
+ rc = wait_for_completion_interruptible(&conn->rx_login_comp);
+ if (rc < 0 || iscsi_target_check_conn_state(conn))
-+ return 0;
++ goto out;
+
+ if (!conn->conn_transport->iscsit_get_rx_pdu)
+ return 0;
@@ -141,5 +141,4 @@ index 9fa9f0b3a0f4..a827b7afe42c 100644
-transport_err:
if (!signal_pending(current))
atomic_set(&conn->transport_failed, 1);
- iscsit_take_action_for_connection_exit(conn);
-
+ iscsit_take_action_for_connection_exit(conn, &conn_freed);
diff --git a/patches.drivers/0006-scsi-fnic-Avoid-sending-reset-to-firmware-when-anoth.patch b/patches.drivers/0006-scsi-fnic-Avoid-sending-reset-to-firmware-when-anoth.patch
deleted file mode 100644
index 60a55862a7..0000000000
--- a/patches.drivers/0006-scsi-fnic-Avoid-sending-reset-to-firmware-when-anoth.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 525b9c52190d2ec1310190ae8913a1b7c125819d Mon Sep 17 00:00:00 2001
-From: Satish Kharat <satishkh@cisco.com>
-Date: Wed, 14 Dec 2016 13:20:41 -0800
-Subject: scsi: fnic: Avoid sending reset to firmware when another reset is in
- progress
-References: bsc#1030195, FATE#319759
-Git-commit: 9698b6f473555a722bf81a3371998427d5d27bde
-Patch-mainline: v4.10-rc7
-
-This fix is to avoid calling fnic_fw_reset_handler through
-fnic_host_reset when a finc reset is alreay in progress.
-
-Signed-off-by: Satish Kharat <satishkh@cisco.com>
-Signed-off-by: Sesidhar Baddela <sebaddel@cisco.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
-
----
- drivers/scsi/fnic/fnic.h | 1 +
- drivers/scsi/fnic/fnic_scsi.c | 16 ++++++++++++++++
- 2 files changed, 17 insertions(+)
-
-diff --git a/drivers/scsi/fnic/fnic.h b/drivers/scsi/fnic/fnic.h
-index 9ddc920..9e4b770 100644
---- a/drivers/scsi/fnic/fnic.h
-+++ b/drivers/scsi/fnic/fnic.h
-@@ -248,6 +248,7 @@ struct fnic {
- struct completion *remove_wait; /* device remove thread blocks */
-
- atomic_t in_flight; /* io counter */
-+ bool internal_reset_inprogress;
- u32 _reserved; /* fill hole */
- unsigned long state_flags; /* protected by host lock */
- enum fnic_state state;
-diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
-index c28414b..d8a1af5 100644
---- a/drivers/scsi/fnic/fnic_scsi.c
-+++ b/drivers/scsi/fnic/fnic_scsi.c
-@@ -2584,6 +2584,19 @@ int fnic_host_reset(struct scsi_cmnd *sc)
- unsigned long wait_host_tmo;
- struct Scsi_Host *shost = sc->device->host;
- struct fc_lport *lp = shost_priv(shost);
-+ struct fnic *fnic = lport_priv(lp);
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&fnic->fnic_lock, flags);
-+ if (fnic->internal_reset_inprogress == 0) {
-+ fnic->internal_reset_inprogress = 1;
-+ } else {
-+ spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-+ FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
-+ "host reset in progress skipping another host reset\n");
-+ return SUCCESS;
-+ }
-+ spin_unlock_irqrestore(&fnic->fnic_lock, flags);
-
- /*
- * If fnic_reset is successful, wait for fabric login to complete
-@@ -2604,6 +2617,9 @@ int fnic_host_reset(struct scsi_cmnd *sc)
- }
- }
-
-+ spin_lock_irqsave(&fnic->fnic_lock, flags);
-+ fnic->internal_reset_inprogress = 0;
-+ spin_unlock_irqrestore(&fnic->fnic_lock, flags);
- return ret;
- }
-
---
-1.8.5.6
-
diff --git a/patches.drivers/0010-iscsi-target-clear-tx_thread_active b/patches.drivers/0010-iscsi-target-clear-tx_thread_active
index a529eeebd1..364ea63a58 100644
--- a/patches.drivers/0010-iscsi-target-clear-tx_thread_active
+++ b/patches.drivers/0010-iscsi-target-clear-tx_thread_active
@@ -12,31 +12,28 @@ Signed-off-by: Varun Prakash <varun@chelsio.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Acked-by: Lee Duncan <lduncan@suse.com>
---
- drivers/target/iscsi/iscsi_target.c | 6 ++++--
+ drivers/target/iscsi/iscsi_target.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index 348337c539f0..29df956ed0cc 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -4379,7 +4379,8 @@ static void iscsit_logout_post_handler_closesession(
+@@ -4417,7 +4417,8 @@ static void iscsit_logout_post_handler_c
* always sleep waiting for RX/TX thread shutdown to complete
* within iscsit_close_connection().
*/
-- if (conn->conn_transport->transport_type == ISCSI_TCP)
+- if (conn->conn_transport->transport_type == ISCSI_TCP) {
+ if ((conn->conn_transport->transport_type == ISCSI_TCP) ||
-+ (conn->conn_transport->transport_type == ISCSI_HW_OFFLOAD))
++ (conn->conn_transport->transport_type == ISCSI_HW_OFFLOAD)) {
sleep = cmpxchg(&conn->tx_thread_active, true, false);
-
- atomic_set(&conn->conn_logout_remove, 0);
-@@ -4396,7 +4397,8 @@ static void iscsit_logout_post_handler_samecid(
+ if (!sleep)
+ return;
+@@ -4437,7 +4438,8 @@ static void iscsit_logout_post_handler_s
{
int sleep = 1;
-- if (conn->conn_transport->transport_type == ISCSI_TCP)
+- if (conn->conn_transport->transport_type == ISCSI_TCP) {
+ if ((conn->conn_transport->transport_type == ISCSI_TCP) ||
-+ (conn->conn_transport->transport_type == ISCSI_HW_OFFLOAD))
++ (conn->conn_transport->transport_type == ISCSI_HW_OFFLOAD)) {
sleep = cmpxchg(&conn->tx_thread_active, true, false);
-
- atomic_set(&conn->conn_logout_remove, 0);
-
+ if (!sleep)
+ return;
diff --git a/patches.drivers/0011-snic-Return-error-code-on-memory-allocation-fai.patch b/patches.drivers/0011-snic-Return-error-code-on-memory-allocation-fai.patch
deleted file mode 100644
index 7aafc205b4..0000000000
--- a/patches.drivers/0011-snic-Return-error-code-on-memory-allocation-fai.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From: Burak Ok <burak-kernel@bur0k.de>
-Date: Wed, 21 Dec 2016 14:45:53 +0100
-Subject: scsi: snic: Return error code on memory allocation failure
-References: FATE#319760
-Git-commit: 0371adcdaca92912baaa3256ed13e058a016e62d
-Patch-Mainline: v4.8
-
-If a call to mempool_create_slab_pool() in snic_probe() returns NULL,
-return -ENOMEM to indicate failure. mempool_creat_slab_pool() only fails
-if it cannot allocate memory.
-
-https://bugzilla.kernel.org/show_bug.cgi?id=189061
-
-Reported-by: bianpan2010@ruc.edu.cn
-Signed-off-by: Burak Ok <burak-kernel@bur0k.de>
-Signed-off-by: Andreas Schaertl <andreas.schaertl@fau.de>
-Acked-by: Narsimhulu Musini <nmusini@cisco.com>
-Reviewed-by: Ewan D. Milne <emilne@redhat.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Hannes Reinecke <hare@suse.de>
----
- drivers/scsi/snic/snic_main.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/scsi/snic/snic_main.c b/drivers/scsi/snic/snic_main.c
-index 396b32d..7cf70aa 100644
---- a/drivers/scsi/snic/snic_main.c
-+++ b/drivers/scsi/snic/snic_main.c
-@@ -591,6 +591,7 @@ snic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- if (!pool) {
- SNIC_HOST_ERR(shost, "dflt sgl pool creation failed\n");
-
-+ ret = -ENOMEM;
- goto err_free_res;
- }
-
-@@ -601,6 +602,7 @@ snic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- if (!pool) {
- SNIC_HOST_ERR(shost, "max sgl pool creation failed\n");
-
-+ ret = -ENOMEM;
- goto err_free_dflt_sgl_pool;
- }
-
-@@ -611,6 +613,7 @@ snic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- if (!pool) {
- SNIC_HOST_ERR(shost, "snic tmreq info pool creation failed.\n");
-
-+ ret = -ENOMEM;
- goto err_free_max_sgl_pool;
- }
-
---
-1.8.5.6
-
diff --git a/patches.drivers/0015-iscsi-target-convert-transport-drivers-to-signal-rdma_shutdown b/patches.drivers/0015-iscsi-target-convert-transport-drivers-to-signal-rdma_shutdown
index cd6a9fb782..8f0ded16fb 100644
--- a/patches.drivers/0015-iscsi-target-convert-transport-drivers-to-signal-rdma_shutdown
+++ b/patches.drivers/0015-iscsi-target-convert-transport-drivers-to-signal-rdma_shutdown
@@ -46,7 +46,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
.iscsit_setup_np = cxgbit_setup_np,
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -670,6 +670,7 @@ static enum target_prot_op iscsit_get_su
+@@ -671,6 +671,7 @@ static enum target_prot_op iscsit_get_su
static struct iscsit_transport iscsi_target_transport = {
.name = "iSCSI/TCP",
.transport_type = ISCSI_TCP,
@@ -54,7 +54,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
.owner = NULL,
.iscsit_setup_np = iscsit_setup_np,
.iscsit_accept_np = iscsit_accept_np,
-@@ -4080,8 +4081,7 @@ int iscsit_close_connection(
+@@ -4118,8 +4119,7 @@ int iscsit_close_connection(
* this for iser since isert_rx_opcode() does not wait on logout failure,
* and to avoid iscsi_conn pointer dereference in iser-target code.
*/
@@ -64,26 +64,26 @@ Acked-by: Lee Duncan <lduncan@suse.com>
complete(&conn->conn_logout_comp);
if (!strcmp(current->comm, ISCSI_RX_THREAD_NAME)) {
-@@ -4388,8 +4388,7 @@ static void iscsit_logout_post_handler_c
+@@ -4426,8 +4426,7 @@ static void iscsit_logout_post_handler_c
* always sleep waiting for RX/TX thread shutdown to complete
* within iscsit_close_connection().
*/
- if ((conn->conn_transport->transport_type == ISCSI_TCP) ||
-- (conn->conn_transport->transport_type == ISCSI_HW_OFFLOAD))
-+ if (!conn->conn_transport->rdma_shutdown)
+- (conn->conn_transport->transport_type == ISCSI_HW_OFFLOAD)) {
++ if (!conn->conn_transport->rdma_shutdown) {
sleep = cmpxchg(&conn->tx_thread_active, true, false);
-
- atomic_set(&conn->conn_logout_remove, 0);
-@@ -4406,8 +4405,7 @@ static void iscsit_logout_post_handler_s
+ if (!sleep)
+ return;
+@@ -4447,8 +4446,7 @@ static void iscsit_logout_post_handler_s
{
int sleep = 1;
- if ((conn->conn_transport->transport_type == ISCSI_TCP) ||
-- (conn->conn_transport->transport_type == ISCSI_HW_OFFLOAD))
-+ if (!conn->conn_transport->rdma_shutdown)
+- (conn->conn_transport->transport_type == ISCSI_HW_OFFLOAD)) {
++ if (!conn->conn_transport->rdma_shutdown) {
sleep = cmpxchg(&conn->tx_thread_active, true, false);
-
- atomic_set(&conn->conn_logout_remove, 0);
+ if (!sleep)
+ return;
--- a/include/target/iscsi/iscsi_transport.h
+++ b/include/target/iscsi/iscsi_transport.h
@@ -6,6 +6,7 @@ struct iscsit_transport {
diff --git a/patches.drivers/0034-target-remove-enum-transport_lunflags_table b/patches.drivers/0034-target-remove-enum-transport_lunflags_table
index 9df26ba14e..a2537df5c2 100644
--- a/patches.drivers/0034-target-remove-enum-transport_lunflags_table
+++ b/patches.drivers/0034-target-remove-enum-transport_lunflags_table
@@ -30,7 +30,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
-@@ -86,7 +86,7 @@ transport_lookup_cmd_lun(struct se_cmd *
+@@ -90,7 +90,7 @@ transport_lookup_cmd_lun(struct se_cmd *
se_cmd->lun_ref_active = true;
if ((se_cmd->data_direction == DMA_TO_DEVICE) &&
@@ -39,7 +39,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
pr_err("TARGET_CORE[%s]: Detected WRITE_PROTECTED LUN"
" Access for 0x%08llx\n",
se_cmd->se_tfo->get_fabric_name(),
-@@ -199,7 +199,7 @@ bool target_lun_is_rdonly(struct se_cmd
+@@ -204,7 +204,7 @@ bool target_lun_is_rdonly(struct se_cmd
rcu_read_lock();
deve = target_nacl_find_deve(se_sess->se_node_acl, cmd->orig_fe_lun);
@@ -48,7 +48,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
rcu_read_unlock();
return ret;
-@@ -258,22 +258,15 @@ void core_free_device_list_for_node(
+@@ -263,22 +263,15 @@ void core_free_device_list_for_node(
void core_update_device_list_access(
u64 mapped_lun,
@@ -74,7 +74,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
mutex_unlock(&nacl->lun_entry_mutex);
}
-@@ -319,7 +312,7 @@ int core_enable_device_list_for_node(
+@@ -324,7 +317,7 @@ int core_enable_device_list_for_node(
struct se_lun *lun,
struct se_lun_acl *lun_acl,
u64 mapped_lun,
@@ -83,7 +83,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
struct se_node_acl *nacl,
struct se_portal_group *tpg)
{
-@@ -340,11 +333,7 @@ int core_enable_device_list_for_node(
+@@ -345,11 +338,7 @@ int core_enable_device_list_for_node(
kref_init(&new->pr_kref);
init_completion(&new->pr_comp);
@@ -96,7 +96,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
new->creation_time = get_jiffies_64();
new->attach_count++;
-@@ -441,7 +430,7 @@ void core_disable_device_list_for_node(
+@@ -446,7 +435,7 @@ void core_disable_device_list_for_node(
hlist_del_rcu(&orig->link);
clear_bit(DEF_PR_REG_ACTIVE, &orig->deve_flags);
@@ -105,7 +105,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
orig->creation_time = 0;
orig->attach_count--;
/*
-@@ -566,8 +555,7 @@ int core_dev_add_lun(
+@@ -571,8 +560,7 @@ int core_dev_add_lun(
{
int rc;
@@ -115,7 +115,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
if (rc < 0)
return rc;
-@@ -643,7 +631,7 @@ int core_dev_add_initiator_node_lun_acl(
+@@ -648,7 +636,7 @@ int core_dev_add_initiator_node_lun_acl(
struct se_portal_group *tpg,
struct se_lun_acl *lacl,
struct se_lun *lun,
@@ -124,7 +124,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
{
struct se_node_acl *nacl = lacl->se_lun_nacl;
/*
-@@ -655,20 +643,19 @@ int core_dev_add_initiator_node_lun_acl(
+@@ -660,20 +648,19 @@ int core_dev_add_initiator_node_lun_acl(
if (!nacl)
return -EINVAL;
@@ -160,7 +160,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
if (lun->lun_link_magic != SE_LUN_LINK_MAGIC) {
pr_err("Bad lun->lun_link_magic, not a valid lun_ci pointer:"
-@@ -115,19 +115,18 @@ static int target_fabric_mappedlun_link(
+@@ -120,19 +120,18 @@ static int target_fabric_mappedlun_link(
}
/*
* If this struct se_node_acl was dynamically generated with
@@ -185,7 +185,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
rcu_read_unlock();
/*
* Determine the actual mapped LUN value user wants..
-@@ -135,7 +134,7 @@ static int target_fabric_mappedlun_link(
+@@ -140,7 +139,7 @@ static int target_fabric_mappedlun_link(
* This value is what the SCSI Initiator actually sees the
* $FABRIC/$WWPN/$TPGT/lun/lun_* as on their SCSI Initiator Ports.
*/
@@ -194,7 +194,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
}
static void target_fabric_mappedlun_unlink(
-@@ -167,8 +166,7 @@ static ssize_t target_fabric_mappedlun_w
+@@ -172,8 +171,7 @@ static ssize_t target_fabric_mappedlun_w
rcu_read_lock();
deve = target_nacl_find_deve(se_nacl, lacl->mapped_lun);
if (deve) {
@@ -204,7 +204,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
}
rcu_read_unlock();
-@@ -181,25 +179,23 @@ static ssize_t target_fabric_mappedlun_w
+@@ -186,25 +184,23 @@ static ssize_t target_fabric_mappedlun_w
struct se_lun_acl *lacl = item_to_lun_acl(item);
struct se_node_acl *se_nacl = lacl->se_lun_nacl;
struct se_portal_group *se_tpg = se_nacl->se_tpg;
@@ -341,7 +341,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
if (ret < 0) {
kfree(se_tpg->tpg_virt_lun0);
return ret;
-@@ -616,7 +615,7 @@ struct se_lun *core_tpg_alloc_lun(
+@@ -617,7 +616,7 @@ struct se_lun *core_tpg_alloc_lun(
int core_tpg_add_lun(
struct se_portal_group *tpg,
struct se_lun *lun,
@@ -350,7 +350,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
struct se_device *dev)
{
int ret;
-@@ -644,9 +643,9 @@ int core_tpg_add_lun(
+@@ -645,9 +644,9 @@ int core_tpg_add_lun(
spin_unlock(&dev->se_port_lock);
if (dev->dev_flags & DF_READ_ONLY)
@@ -377,7 +377,7 @@ Acked-by: Lee Duncan <lduncan@suse.com>
/*
* Used by transport_send_check_condition_and_sense()
* to signal which ASC/ASCQ sense payload should be built.
-@@ -643,11 +637,10 @@ struct se_lun_acl {
+@@ -644,11 +638,10 @@ struct se_lun_acl {
};
struct se_dev_entry {
@@ -390,12 +390,12 @@ Acked-by: Lee Duncan <lduncan@suse.com>
u32 attach_count;
atomic_long_t total_cmds;
atomic_long_t read_bytes;
-@@ -721,7 +714,7 @@ struct se_lun {
+@@ -722,7 +715,7 @@ struct se_lun {
u64 unpacked_lun;
#define SE_LUN_LINK_MAGIC 0xffff7771
u32 lun_link_magic;
- u32 lun_access;
+ bool lun_access_ro;
- u32 lun_index;
-
- /* RELATIVE TARGET PORT IDENTIFER */
+ #ifndef __GENKSYMS__
+ bool lun_shutdown;
+ #endif
diff --git a/patches.drivers/0073-qla2xxx-Get-mutex-lock-before-checking-optrom_s.patch b/patches.drivers/0073-qla2xxx-Get-mutex-lock-before-checking-optrom_s.patch
deleted file mode 100644
index 22c30a1f09..0000000000
--- a/patches.drivers/0073-qla2xxx-Get-mutex-lock-before-checking-optrom_s.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From: "Milan P. Gandhi" <mgandhi@redhat.com>
-Date: Sat, 24 Dec 2016 22:02:46 +0530
-Subject: scsi: qla2xxx: Get mutex lock before checking optrom_state
-References: bsc#1019675,FATE#321701
-Git-commit: c7702b8c22712a06080e10f1d2dee1a133ec8809
-Patch-Mainline: v4.10-rc7
-
-There is a race condition with qla2xxx optrom functions where one thread
-might modify optrom buffer, optrom_state while other thread is still
-reading from it.
-
-In couple of crashes, it was found that we had successfully passed the
-following 'if' check where we confirm optrom_state to be
-QLA_SREADING. But by the time we acquired mutex lock to proceed with
-memory_read_from_buffer function, some other thread/process had already
-modified that option rom buffer and optrom_state from QLA_SREADING to
-QLA_SWAITING. Then we got ha->optrom_buffer 0x0 and crashed the system:
-
- if (ha->optrom_state != QLA_SREADING)
- return 0;
-
- mutex_lock(&ha->optrom_mutex);
- rval = memory_read_from_buffer(buf, count, &off, ha->optrom_buffer,
- ha->optrom_region_size);
- mutex_unlock(&ha->optrom_mutex);
-
-With current optrom function we get following crash due to a race
-condition:
-
-[ 1479.466679] BUG: unable to handle kernel NULL pointer dereference at (null)
-[ 1479.466707] IP: [<ffffffff81326756>] memcpy+0x6/0x110
-[...]
-[ 1479.473673] Call Trace:
-[ 1479.474296] [<ffffffff81225cbc>] ? memory_read_from_buffer+0x3c/0x60
-[ 1479.474941] [<ffffffffa01574dc>] qla2x00_sysfs_read_optrom+0x9c/0xc0 [qla2xxx]
-[ 1479.475571] [<ffffffff8127e76b>] read+0xdb/0x1f0
-[ 1479.476206] [<ffffffff811fdf9e>] vfs_read+0x9e/0x170
-[ 1479.476839] [<ffffffff811feb6f>] SyS_read+0x7f/0xe0
-[ 1479.477466] [<ffffffff816964c9>] system_call_fastpath+0x16/0x1b
-
-Below patch modifies qla2x00_sysfs_read_optrom,
-qla2x00_sysfs_write_optrom functions to get the mutex_lock before
-checking ha->optrom_state to avoid similar crashes.
-
-The patch was applied and tested and same crashes were no longer
-observed again.
-
-Tested-by: Milan P. Gandhi <mgandhi@redhat.com>
-Signed-off-by: Milan P. Gandhi <mgandhi@redhat.com>
-Reviewed-by: Laurence Oberman <loberman@redhat.com>
-Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Hannes Reinecke <hare@suse.de>
----
- drivers/scsi/qla2xxx/qla_attr.c | 18 +++++++++++++-----
- 1 file changed, 13 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
-index 47eb4d5..83f8527 100644
---- a/drivers/scsi/qla2xxx/qla_attr.c
-+++ b/drivers/scsi/qla2xxx/qla_attr.c
-@@ -243,12 +243,15 @@ qla2x00_sysfs_read_optrom(struct file *filp, struct kobject *kobj,
- struct qla_hw_data *ha = vha->hw;
- ssize_t rval = 0;
-
-+ mutex_lock(&ha->optrom_mutex);
-+
- if (ha->optrom_state != QLA_SREADING)
-- return 0;
-+ goto out;
-
-- mutex_lock(&ha->optrom_mutex);
- rval = memory_read_from_buffer(buf, count, &off, ha->optrom_buffer,
- ha->optrom_region_size);
-+
-+out:
- mutex_unlock(&ha->optrom_mutex);
-
- return rval;
-@@ -263,14 +266,19 @@ qla2x00_sysfs_write_optrom(struct file *filp, struct kobject *kobj,
- struct device, kobj)));
- struct qla_hw_data *ha = vha->hw;
-
-- if (ha->optrom_state != QLA_SWRITING)
-+ mutex_lock(&ha->optrom_mutex);
-+
-+ if (ha->optrom_state != QLA_SWRITING) {
-+ mutex_unlock(&ha->optrom_mutex);
- return -EINVAL;
-- if (off > ha->optrom_region_size)
-+ }
-+ if (off > ha->optrom_region_size) {
-+ mutex_unlock(&ha->optrom_mutex);
- return -ERANGE;
-+ }
- if (off + count > ha->optrom_region_size)
- count = ha->optrom_region_size - off;
-
-- mutex_lock(&ha->optrom_mutex);
- memcpy(&ha->optrom_buffer[off], buf, count);
- mutex_unlock(&ha->optrom_mutex);
-
---
-1.8.5.6
-
diff --git a/patches.drivers/0171-mm-block-convert-rw_page-users-to-bio-op-use.patch b/patches.drivers/0171-mm-block-convert-rw_page-users-to-bio-op-use.patch
index b8cefcf9fe..4e0f0f20e0 100644
--- a/patches.drivers/0171-mm-block-convert-rw_page-users-to-bio-op-use.patch
+++ b/patches.drivers/0171-mm-block-convert-rw_page-users-to-bio-op-use.patch
@@ -246,7 +246,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
(unsigned long long) iter.bi_sector, len);
bio->bi_error = err;
break;
-@@ -1200,12 +1200,12 @@ out:
+@@ -1200,14 +1200,14 @@ out:
}
static int btt_rw_page(struct block_device *bdev, sector_t sector,
@@ -254,14 +254,16 @@ Acked-by: Hannes Reinecke <hare@suse.de>
+ struct page *page, int op)
{
struct btt *btt = bdev->bd_disk->private_data;
+ int rc;
-- btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector);
-- page_endio(page, rw & WRITE, 0);
-+ btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, op, sector);
-+ page_endio(page, op, 0);
- return 0;
- }
+- rc = btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector);
++ rc = btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, op, sector);
+ if (rc == 0)
+- page_endio(page, rw & WRITE, 0);
++ page_endio(page, op, 0);
+ return rc;
+ }
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -98,7 +98,7 @@ static int read_pmem(struct page *page,
@@ -319,7 +321,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
}
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
-@@ -415,7 +415,8 @@ int bdev_read_page(struct block_device *
+@@ -414,7 +414,8 @@ int bdev_read_page(struct block_device *
result = blk_queue_enter(bdev->bd_queue, false);
if (result)
return result;
@@ -329,7 +331,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
blk_queue_exit(bdev->bd_queue);
return result;
}
-@@ -444,7 +445,6 @@ int bdev_write_page(struct block_device
+@@ -443,7 +444,6 @@ int bdev_write_page(struct block_device
struct page *page, struct writeback_control *wbc)
{
int result;
@@ -337,7 +339,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
const struct block_device_operations *ops = bdev->bd_disk->fops;
if (!ops->rw_page || bdev_get_integrity(bdev))
-@@ -454,7 +454,8 @@ int bdev_write_page(struct block_device
+@@ -453,7 +453,8 @@ int bdev_write_page(struct block_device
return result;
set_page_writeback(page);
@@ -409,7 +411,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
long (*direct_access)(struct block_device *, sector_t, void **, pfn_t *,
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
-@@ -2430,12 +2430,13 @@ extern void init_special_inode(struct in
+@@ -2435,12 +2435,13 @@ extern void init_special_inode(struct in
extern void make_bad_inode(struct inode *);
extern int is_bad_inode(struct inode *);
@@ -426,7 +428,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
*/
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
-@@ -549,7 +549,7 @@ static inline void wait_on_page_writebac
+@@ -548,7 +548,7 @@ static inline void wait_on_page_writebac
extern void end_page_writeback(struct page *page);
void wait_for_stable_page(struct page *page);
diff --git a/patches.drivers/0172-block-mm-make-bdev_ops-rw_page-take-a-bool-for-read-.patch b/patches.drivers/0172-block-mm-make-bdev_ops-rw_page-take-a-bool-for-read-.patch
index a661ed390b..273812c013 100644
--- a/patches.drivers/0172-block-mm-make-bdev_ops-rw_page-take-a-bool-for-read-.patch
+++ b/patches.drivers/0172-block-mm-make-bdev_ops-rw_page-take-a-bool-for-read-.patch
@@ -191,7 +191,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
if (err) {
dev_info(&btt->nd_btt->dev,
"io error in %s sector %lld, len %d,\n",
-@@ -1200,12 +1200,12 @@ out:
+@@ -1200,14 +1200,14 @@ out:
}
static int btt_rw_page(struct block_device *bdev, sector_t sector,
@@ -199,17 +199,19 @@ Acked-by: Hannes Reinecke <hare@suse.de>
+ struct page *page, bool is_write)
{
struct btt *btt = bdev->bd_disk->private_data;
+ int rc;
-- btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, op, sector);
-- page_endio(page, op, 0);
-+ btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, is_write, sector);
-+ page_endio(page, is_write, 0);
- return 0;
- }
+- rc = btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, op, sector);
++ rc = btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, is_write, sector);
+ if (rc == 0)
+- page_endio(page, op, 0);
++ page_endio(page, is_write, 0);
+ return rc;
+ }
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
-@@ -67,7 +67,7 @@ static void pmem_clear_poison(struct pme
+@@ -98,7 +98,7 @@ static int read_pmem(struct page *page,
}
static int pmem_do_bvec(struct pmem_device *pmem, struct page *page,
@@ -218,7 +220,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
sector_t sector)
{
int rc = 0;
-@@ -79,7 +79,7 @@ static int pmem_do_bvec(struct pmem_devi
+@@ -109,7 +109,7 @@ static int pmem_do_bvec(struct pmem_devi
if (unlikely(is_bad_pmem(&pmem->bb, sector, len)))
bad_pmem = true;
@@ -227,7 +229,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
if (unlikely(bad_pmem))
rc = -EIO;
else {
-@@ -134,7 +134,7 @@ static blk_qc_t pmem_make_request(struct
+@@ -163,7 +163,7 @@ static blk_qc_t pmem_make_request(struct
do_acct = nd_iostat_start(bio, &start);
bio_for_each_segment(bvec, bio, iter) {
rc = pmem_do_bvec(pmem, bvec.bv_page, bvec.bv_len,
@@ -236,7 +238,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
iter.bi_sector);
if (rc) {
bio->bi_error = rc;
-@@ -152,13 +152,13 @@ static blk_qc_t pmem_make_request(struct
+@@ -181,13 +181,13 @@ static blk_qc_t pmem_make_request(struct
}
static int pmem_rw_page(struct block_device *bdev, sector_t sector,
@@ -253,7 +255,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
wmb_pmem();
/*
-@@ -168,7 +168,7 @@ static int pmem_rw_page(struct block_dev
+@@ -197,7 +197,7 @@ static int pmem_rw_page(struct block_dev
* caused by double completion.
*/
if (rc == 0)
@@ -264,7 +266,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
}
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
-@@ -425,8 +425,7 @@ int bdev_read_page(struct block_device *
+@@ -414,8 +414,7 @@ int bdev_read_page(struct block_device *
result = blk_queue_enter(bdev->bd_queue, false);
if (result)
return result;
@@ -274,7 +276,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
blk_queue_exit(bdev->bd_queue);
return result;
}
-@@ -464,8 +463,7 @@ int bdev_write_page(struct block_device
+@@ -453,8 +452,7 @@ int bdev_write_page(struct block_device
return result;
set_page_writeback(page);
@@ -346,7 +348,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
long (*direct_access)(struct block_device *, sector_t, void **, pfn_t *,
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
-@@ -2430,13 +2430,12 @@ extern void init_special_inode(struct in
+@@ -2435,13 +2435,12 @@ extern void init_special_inode(struct in
extern void make_bad_inode(struct inode *);
extern int is_bad_inode(struct inode *);
@@ -363,7 +365,7 @@ Acked-by: Hannes Reinecke <hare@suse.de>
*/
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
-@@ -549,7 +549,7 @@ static inline void wait_on_page_writebac
+@@ -548,7 +548,7 @@ static inline void wait_on_page_writebac
extern void end_page_writeback(struct page *page);
void wait_for_stable_page(struct page *page);
diff --git a/patches.drivers/hfi1-qib-0362-IB-uverbs-Extend-modify_qp-and-support-packet-pacing.patch b/patches.drivers/hfi1-qib-0362-IB-uverbs-Extend-modify_qp-and-support-packet-pacing.patch
index 3394f1f6f8..faaa2d870b 100644
--- a/patches.drivers/hfi1-qib-0362-IB-uverbs-Extend-modify_qp-and-support-packet-pacing.patch
+++ b/patches.drivers/hfi1-qib-0362-IB-uverbs-Extend-modify_qp-and-support-packet-pacing.patch
@@ -25,10 +25,10 @@ Signed-off-by: Doug Ledford <dledford@redhat.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
drivers/infiniband/core/uverbs.h | 1
- drivers/infiniband/core/uverbs_cmd.c | 200 +++++++++++++++++++++-------------
+ drivers/infiniband/core/uverbs_cmd.c | 202 +++++++++++++++++++++-------------
drivers/infiniband/core/uverbs_main.c | 1
include/uapi/rdma/ib_user_verbs.h | 21 +++
- 4 files changed, 150 insertions(+), 73 deletions(-)
+ 4 files changed, 151 insertions(+), 74 deletions(-)
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -41,7 +41,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
#endif /* UVERBS_H */
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
-@@ -2328,100 +2328,92 @@ static int modify_qp_mask(enum ib_qp_typ
+@@ -2328,101 +2328,93 @@ static int modify_qp_mask(enum ib_qp_typ
}
}
@@ -61,8 +61,9 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
- if (copy_from_user(&cmd, buf, sizeof cmd))
- return -EFAULT;
-
-- if (cmd.port_num < rdma_start_port(ib_dev) ||
-- cmd.port_num > rdma_end_port(ib_dev))
+- if ((cmd.attr_mask & IB_QP_PORT) &&
+- (cmd.port_num < rdma_start_port(ib_dev) ||
+- cmd.port_num > rdma_end_port(ib_dev)))
- return -EINVAL;
-
- INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
@@ -127,8 +128,9 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
- attr->alt_ah_attr.static_rate = cmd.alt_dest.static_rate;
- attr->alt_ah_attr.ah_flags = cmd.alt_dest.is_global ? IB_AH_GRH : 0;
- attr->alt_ah_attr.port_num = cmd.alt_dest.port_num;
-+ if (cmd->base.port_num < rdma_start_port(qp->device) ||
-+ cmd->base.port_num > rdma_end_port(qp->device))
++ if ((cmd->base.attr_mask & IB_QP_PORT) &&
++ (cmd->base.port_num < rdma_start_port(qp->device) ||
++ cmd->base.port_num > rdma_end_port(qp->device)))
+ goto release_qp;
+
+ attr->qp_state = cmd->base.qp_state;
@@ -207,7 +209,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
release_qp:
put_qp_read(qp);
-@@ -2430,6 +2422,68 @@ out:
+@@ -2431,6 +2423,68 @@ out:
return ret;
}
diff --git a/patches.drivers/iscsi-target-Fix-early-sk_data_ready-LOGIN_FLAGS_REA.patch b/patches.drivers/iscsi-target-Fix-early-sk_data_ready-LOGIN_FLAGS_REA.patch
deleted file mode 100644
index 643cbd0297..0000000000
--- a/patches.drivers/iscsi-target-Fix-early-sk_data_ready-LOGIN_FLAGS_REA.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From: Nicholas Bellinger <nab@linux-iscsi.org>
-Date: Sat, 27 Feb 2016 18:15:46 -0800
-Subject: iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race
-References: bsc#1036489
-Git-commit: 8f0dfb3d8b1120c61f6e2cc3729290db10772b2d
-Patch-Mainline: v4.7-rc1
-
-There is a iscsi-target/tcp login race in LOGIN_FLAGS_READY
-state assignment that can result in frequent errors during
-iscsi discovery:
-
- "iSCSI Login negotiation failed."
-
-To address this bug, move the initial LOGIN_FLAGS_READY
-assignment ahead of iscsi_target_do_login() when handling
-the initial iscsi_target_start_negotiation() request PDU
-during connection login.
-
-As iscsi_target_do_login_rx() work_struct callback is
-clearing LOGIN_FLAGS_READ_ACTIVE after subsequent calls
-to iscsi_target_do_login(), the early sk_data_ready
-ahead of the first iscsi_target_do_login() expects
-LOGIN_FLAGS_READY to also be set for the initial
-login request PDU.
-
-As reported by Maged, this was first obsered using an
-MSFT initiator running across multiple VMWare host
-virtual machines with iscsi-target/tcp.
-
-Reported-by: Maged Mokhtar <mmokhtar@binarykinetics.com>
-Tested-by: Maged Mokhtar <mmokhtar@binarykinetics.com>
-Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
-Signed-off-by: Hannes Reinecke <hare@suse.de>
----
- drivers/target/iscsi/iscsi_target_nego.c | 18 +++++++++---------
- 1 file changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
-index ca06132..89d34bd 100644
---- a/drivers/target/iscsi/iscsi_target_nego.c
-+++ b/drivers/target/iscsi/iscsi_target_nego.c
-@@ -1247,16 +1247,16 @@ int iscsi_target_start_negotiation(
- {
- int ret;
-
-- ret = iscsi_target_do_login(conn, login);
-- if (!ret) {
-- if (conn->sock) {
-- struct sock *sk = conn->sock->sk;
-+ if (conn->sock) {
-+ struct sock *sk = conn->sock->sk;
-
-- write_lock_bh(&sk->sk_callback_lock);
-- set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
-- write_unlock_bh(&sk->sk_callback_lock);
-- }
-- } else if (ret < 0) {
-+ write_lock_bh(&sk->sk_callback_lock);
-+ set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
-+ write_unlock_bh(&sk->sk_callback_lock);
-+ }
-+
-+ ret = iscsi_target_do_login(conn, login);
-+ if (ret < 0) {
- cancel_delayed_work_sync(&conn->login_work);
- cancel_delayed_work_sync(&conn->login_cleanup_work);
- iscsi_target_restore_sock_callbacks(conn);
---
-1.8.5.6
-
diff --git a/patches.drivers/iser-target-Convert-to-new-CQ-API.patch b/patches.drivers/iser-target-Convert-to-new-CQ-API.patch
index 4209c25676..cb7e50f04c 100644
--- a/patches.drivers/iser-target-Convert-to-new-CQ-API.patch
+++ b/patches.drivers/iser-target-Convert-to-new-CQ-API.patch
@@ -22,15 +22,13 @@ Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Acked-by: Hannes Reinecke <hare@suse.de>
---
- drivers/infiniband/ulp/isert/ib_isert.c | 405 +++++++++++++-------------------
- drivers/infiniband/ulp/isert/ib_isert.h | 22 +-
- 2 files changed, 184 insertions(+), 243 deletions(-)
+ drivers/infiniband/ulp/isert/ib_isert.c | 415 +++++++++++++-------------------
+ drivers/infiniband/ulp/isert/ib_isert.h | 22 +
+ 2 files changed, 189 insertions(+), 248 deletions(-)
-diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
-index ca8853a..b7d6cc5 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
-@@ -59,13 +59,17 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+@@ -59,13 +59,17 @@ isert_reg_rdma(struct iscsi_conn *conn,
static int
isert_put_response(struct iscsi_conn *conn, struct iscsi_cmd *cmd);
static int
@@ -62,7 +60,7 @@ index ca8853a..b7d6cc5 100644
static int
isert_alloc_rx_descriptors(struct isert_conn *isert_conn)
{
-@@ -213,6 +211,7 @@ isert_alloc_rx_descriptors(struct isert_conn *isert_conn)
+@@ -213,6 +211,7 @@ isert_alloc_rx_descriptors(struct isert_
rx_sg->addr = rx_desc->dma_addr;
rx_sg->length = ISER_RX_PAYLOAD_SIZE;
rx_sg->lkey = device->pd->local_dma_lkey;
@@ -70,7 +68,7 @@ index ca8853a..b7d6cc5 100644
}
return 0;
-@@ -251,9 +250,6 @@ isert_free_rx_descriptors(struct isert_conn *isert_conn)
+@@ -251,9 +250,6 @@ isert_free_rx_descriptors(struct isert_c
isert_conn->rx_descs = NULL;
}
@@ -80,7 +78,7 @@ index ca8853a..b7d6cc5 100644
static void
isert_free_comps(struct isert_device *device)
{
-@@ -262,10 +258,8 @@ isert_free_comps(struct isert_device *device)
+@@ -262,10 +258,8 @@ isert_free_comps(struct isert_device *de
for (i = 0; i < device->comps_used; i++) {
struct isert_comp *comp = &device->comps[i];
@@ -93,7 +91,7 @@ index ca8853a..b7d6cc5 100644
}
kfree(device->comps);
}
-@@ -294,28 +288,17 @@ isert_alloc_comps(struct isert_device *device)
+@@ -294,28 +288,17 @@ isert_alloc_comps(struct isert_device *d
max_cqe = min(ISER_MAX_CQ_LEN, device->ib_device->attrs.max_cqe);
for (i = 0; i < device->comps_used; i++) {
@@ -124,7 +122,7 @@ index ca8853a..b7d6cc5 100644
}
return 0;
-@@ -723,7 +706,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
+@@ -723,7 +706,7 @@ isert_connect_request(struct rdma_cm_id
if (ret)
goto out_conn_dev;
@@ -133,7 +131,7 @@ index ca8853a..b7d6cc5 100644
if (ret)
goto out_conn_dev;
-@@ -981,7 +964,8 @@ isert_post_recvm(struct isert_conn *isert_conn, u32 count)
+@@ -981,7 +964,8 @@ isert_post_recvm(struct isert_conn *iser
for (rx_wr = isert_conn->rx_wr, i = 0; i < count; i++, rx_wr++) {
rx_desc = &isert_conn->rx_descs[i];
@@ -143,7 +141,7 @@ index ca8853a..b7d6cc5 100644
rx_wr->sg_list = &rx_desc->rx_sg;
rx_wr->num_sge = 1;
rx_wr->next = rx_wr + 1;
-@@ -1003,7 +987,7 @@ isert_post_recv(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc)
+@@ -1003,7 +987,7 @@ isert_post_recv(struct isert_conn *isert
struct ib_recv_wr *rx_wr_failed, rx_wr;
int ret;
@@ -152,7 +150,7 @@ index ca8853a..b7d6cc5 100644
rx_wr.sg_list = &rx_desc->rx_sg;
rx_wr.num_sge = 1;
rx_wr.next = NULL;
-@@ -1016,7 +1000,7 @@ isert_post_recv(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc)
+@@ -1016,7 +1000,7 @@ isert_post_recv(struct isert_conn *isert
}
static int
@@ -161,7 +159,7 @@ index ca8853a..b7d6cc5 100644
{
struct ib_device *ib_dev = isert_conn->cm_id->device;
struct ib_send_wr send_wr, *send_wr_failed;
-@@ -1025,8 +1009,10 @@ isert_post_send(struct isert_conn *isert_conn, struct iser_tx_desc *tx_desc)
+@@ -1025,8 +1009,10 @@ isert_post_send(struct isert_conn *isert
ib_dma_sync_single_for_device(ib_dev, tx_desc->dma_addr,
ISER_HEADERS_LEN, DMA_TO_DEVICE);
@@ -173,7 +171,7 @@ index ca8853a..b7d6cc5 100644
send_wr.sg_list = tx_desc->tx_sg;
send_wr.num_sge = tx_desc->num_sge;
send_wr.opcode = IB_WR_SEND;
-@@ -1096,7 +1082,8 @@ isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
+@@ -1096,7 +1082,8 @@ isert_init_send_wr(struct isert_conn *is
struct iser_tx_desc *tx_desc = &isert_cmd->tx_desc;
isert_cmd->rdma_wr.iser_ib_op = ISER_IB_SEND;
@@ -183,7 +181,7 @@ index ca8853a..b7d6cc5 100644
if (isert_conn->snd_w_inv && isert_cmd->inv_rkey) {
send_wr->opcode = IB_WR_SEND_WITH_INV;
-@@ -1111,7 +1098,7 @@ isert_init_send_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
+@@ -1111,7 +1098,7 @@ isert_init_send_wr(struct isert_conn *is
}
static int
@@ -192,7 +190,7 @@ index ca8853a..b7d6cc5 100644
{
struct ib_recv_wr rx_wr, *rx_wr_fail;
struct ib_sge sge;
-@@ -1125,8 +1112,10 @@ isert_rdma_post_recvl(struct isert_conn *isert_conn)
+@@ -1125,8 +1112,10 @@ isert_rdma_post_recvl(struct isert_conn
isert_dbg("Setup sge: addr: %llx length: %d 0x%08x\n",
sge.addr, sge.length, sge.lkey);
@@ -204,7 +202,7 @@ index ca8853a..b7d6cc5 100644
rx_wr.sg_list = &sge;
rx_wr.num_sge = 1;
-@@ -1198,12 +1187,12 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login,
+@@ -1198,12 +1187,12 @@ isert_put_login_tx(struct iscsi_conn *co
goto post_send;
}
@@ -219,7 +217,7 @@ index ca8853a..b7d6cc5 100644
if (ret)
return ret;
-@@ -1546,12 +1535,42 @@ isert_rx_opcode(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc,
+@@ -1546,12 +1535,42 @@ isert_rx_opcode(struct isert_conn *isert
}
static void
@@ -263,7 +261,7 @@ index ca8853a..b7d6cc5 100644
switch (iser_ctrl->flags & 0xF0) {
case ISCSI_CTRL:
if (iser_ctrl->flags & ISER_RSV) {
-@@ -1579,55 +1598,40 @@ isert_rx_do_work(struct iser_rx_desc *rx_desc, struct isert_conn *isert_conn)
+@@ -1579,55 +1598,40 @@ isert_rx_do_work(struct iser_rx_desc *rx
isert_rx_opcode(isert_conn, rx_desc,
read_stag, read_va, write_stag, write_va);
@@ -279,7 +277,7 @@ index ca8853a..b7d6cc5 100644
+isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc)
{
+ struct isert_conn *isert_conn = wc->qp->qp_context;
- struct ib_device *ib_dev = isert_conn->cm_id->device;
+ struct ib_device *ib_dev = isert_conn->device->ib_device;
- struct iscsi_hdr *hdr;
- u64 rx_dma;
- int rx_buflen;
@@ -294,29 +292,20 @@ index ca8853a..b7d6cc5 100644
- rx_buflen = ISER_RX_PAYLOAD_SIZE;
- isert_dbg("req_buf: Using rx_dma: 0x%llx, rx_buflen: %d\n",
- rx_dma, rx_buflen);
-+
-+ if (unlikely(wc->status != IB_WC_SUCCESS)) {
-+ isert_print_wc(wc, "login recv");
-+ return;
- }
-
+- }
+-
- ib_dma_sync_single_for_cpu(ib_dev, rx_dma, rx_buflen, DMA_FROM_DEVICE);
-+ ib_dma_sync_single_for_cpu(ib_dev, isert_conn->login_req_dma,
-+ ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
-
+-
- hdr = &desc->iscsi_header;
- isert_dbg("iSCSI opcode: 0x%02x, ITT: 0x%08x, flags: 0x%02x dlen: %d\n",
- hdr->opcode, hdr->itt, hdr->flags,
- (int)(xfer_len - ISER_HEADERS_LEN));
-+ isert_conn->login_req_len = wc->byte_len - ISER_HEADERS_LEN;
-
+-
- if (desc == isert_conn->login_req_buf) {
- isert_conn->login_req_len = xfer_len - ISER_HEADERS_LEN;
- if (isert_conn->conn) {
- struct iscsi_login *login = isert_conn->conn->conn_login;
-+ if (isert_conn->conn) {
-+ struct iscsi_login *login = isert_conn->conn->conn_login;
-
+-
- if (login && !login->first_request)
- isert_rx_login_req(isert_conn);
- }
@@ -325,16 +314,30 @@ index ca8853a..b7d6cc5 100644
- mutex_unlock(&isert_conn->mutex);
- } else {
- isert_rx_do_work(desc, isert_conn);
-+ if (login && !login->first_request)
-+ isert_rx_login_req(isert_conn);
++
++ if (unlikely(wc->status != IB_WC_SUCCESS)) {
++ isert_print_wc(wc, "login recv");
++ return;
}
- ib_dma_sync_single_for_device(ib_dev, rx_dma, rx_buflen,
- DMA_FROM_DEVICE);
++ ib_dma_sync_single_for_cpu(ib_dev, isert_conn->login_req_dma,
++ ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++
++ isert_conn->login_req_len = wc->byte_len - ISER_HEADERS_LEN;
++
++ if (isert_conn->conn) {
++ struct iscsi_login *login = isert_conn->conn->conn_login;
+
++ if (login && !login->first_request)
++ isert_rx_login_req(isert_conn);
++ }
++
+ mutex_lock(&isert_conn->mutex);
+ complete(&isert_conn->login_req_comp);
+ mutex_unlock(&isert_conn->mutex);
-
++
+ ib_dma_sync_single_for_device(ib_dev, isert_conn->login_req_dma,
+ ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
}
@@ -417,7 +420,7 @@ index ca8853a..b7d6cc5 100644
if (wr->fr_desc && wr->fr_desc->ind & ISERT_PROTECTED) {
ret = isert_check_pi_status(se_cmd,
wr->fr_desc->pi_ctx->sig_mr);
-@@ -1969,167 +1992,56 @@ isert_do_control_comp(struct work_struct *work)
+@@ -1969,167 +1992,56 @@ isert_do_control_comp(struct work_struct
}
static void
@@ -615,7 +618,7 @@ index ca8853a..b7d6cc5 100644
static int
isert_post_response(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd)
{
-@@ -2386,7 +2298,8 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
+@@ -2386,7 +2298,8 @@ isert_build_rdma_wr(struct isert_conn *i
page_off = offset % PAGE_SIZE;
rdma_wr->wr.sg_list = ib_sge;
@@ -625,7 +628,7 @@ index ca8853a..b7d6cc5 100644
/*
* Perform mapping of TCM scatterlist memory ib_sge dma_addr.
*/
-@@ -2469,6 +2382,8 @@ isert_map_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+@@ -2469,6 +2382,8 @@ isert_map_rdma(struct iscsi_conn *conn,
rdma_wr->wr.send_flags = 0;
if (wr->iser_ib_op == ISER_IB_RDMA_WRITE) {
@@ -634,7 +637,7 @@ index ca8853a..b7d6cc5 100644
rdma_wr->wr.opcode = IB_WR_RDMA_WRITE;
rdma_wr->remote_addr = isert_cmd->read_va + offset;
rdma_wr->rkey = isert_cmd->read_stag;
-@@ -2477,6 +2392,8 @@ isert_map_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+@@ -2477,6 +2392,8 @@ isert_map_rdma(struct iscsi_conn *conn,
else
rdma_wr->wr.next = &wr->rdma_wr[i + 1].wr;
} else {
@@ -643,7 +646,7 @@ index ca8853a..b7d6cc5 100644
rdma_wr->wr.opcode = IB_WR_RDMA_READ;
rdma_wr->remote_addr = isert_cmd->write_va + va_offset;
rdma_wr->rkey = isert_cmd->write_stag;
-@@ -2508,7 +2425,7 @@ isert_inv_rkey(struct ib_send_wr *inv_wr, struct ib_mr *mr)
+@@ -2508,7 +2425,7 @@ isert_inv_rkey(struct ib_send_wr *inv_wr
u32 rkey;
memset(inv_wr, 0, sizeof(*inv_wr));
@@ -652,7 +655,7 @@ index ca8853a..b7d6cc5 100644
inv_wr->opcode = IB_WR_LOCAL_INV;
inv_wr->ex.invalidate_rkey = mr->rkey;
-@@ -2564,7 +2481,7 @@ isert_fast_reg_mr(struct isert_conn *isert_conn,
+@@ -2564,7 +2481,7 @@ isert_fast_reg_mr(struct isert_conn *ise
reg_wr.wr.next = NULL;
reg_wr.wr.opcode = IB_WR_REG_MR;
@@ -661,7 +664,7 @@ index ca8853a..b7d6cc5 100644
reg_wr.wr.send_flags = 0;
reg_wr.wr.num_sge = 0;
reg_wr.mr = mr;
-@@ -2675,7 +2592,7 @@ isert_reg_sig_mr(struct isert_conn *isert_conn,
+@@ -2675,7 +2592,7 @@ isert_reg_sig_mr(struct isert_conn *iser
memset(&sig_wr, 0, sizeof(sig_wr));
sig_wr.wr.opcode = IB_WR_REG_SIG_MR;
@@ -670,7 +673,7 @@ index ca8853a..b7d6cc5 100644
sig_wr.wr.sg_list = &rdma_wr->ib_sg[DATA];
sig_wr.wr.num_sge = 1;
sig_wr.access_flags = IB_ACCESS_LOCAL_WRITE;
-@@ -2830,14 +2747,18 @@ isert_reg_rdma(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+@@ -2830,14 +2747,18 @@ isert_reg_rdma(struct iscsi_conn *conn,
rdma_wr = &isert_cmd->rdma_wr.s_rdma_wr;
rdma_wr->wr.sg_list = &wr->s_ib_sge;
rdma_wr->wr.num_sge = 1;
@@ -718,8 +721,6 @@ index ca8853a..b7d6cc5 100644
/* post an indication that all flush errors were consumed */
if (ib_post_recv(isert_conn->qp, &isert_conn->beacon, &bad_wr)) {
isert_err("conn %p failed to post beacon", isert_conn);
-diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
-index 6c2c5fa..5a5becd 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -61,11 +61,10 @@
@@ -788,6 +789,3 @@ index 6c2c5fa..5a5becd 100644
};
struct isert_device {
---
-1.8.5.6
-
diff --git a/patches.drivers/mpt3sas-Don-t-overreach-ioc-reply_post-during-initia.patch b/patches.drivers/mpt3sas-Don-t-overreach-ioc-reply_post-during-initia.patch
deleted file mode 100644
index c30ce8b849..0000000000
--- a/patches.drivers/mpt3sas-Don-t-overreach-ioc-reply_post-during-initia.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-From: Calvin Owens <calvinowens@fb.com>
-Date: Fri, 18 Mar 2016 12:45:42 -0700
-Subject: mpt3sas: Don't overreach ioc->reply_post[] during initialization
-References: bsc#1017972,FATE#321666
-Git-commit: 5ec8a1753bc29efa7e4b1391d691c9c719b30257
-Patch-Mainline: v4.6-rc3
-
-In _base_make_ioc_operational(), we walk ioc->reply_queue_list and pull
-a pointer out of successive elements of ioc->reply_post[] for each entry
-in that list if RDPQ is enabled.
-
-Since the code pulls the pointer for the next iteration at the bottom of
-the loop, it triggers the a KASAN dump on the final iteration:
-
- BUG: KASAN: slab-out-of-bounds in _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] at addr ffff880754816ab0
- Read of size 8 by task modprobe/305
- <snip>
- Call Trace:
- [<ffffffff81dfc591>] dump_stack+0x4d/0x6c
- [<ffffffff814c9689>] print_trailer+0xf9/0x150
- [<ffffffff814ceda4>] object_err+0x34/0x40
- [<ffffffff814d1231>] kasan_report_error+0x221/0x530
- [<ffffffff814d1673>] __asan_report_load8_noabort+0x43/0x50
- [<ffffffffa0043637>] _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas]
- [<ffffffffa0049a51>] mpt3sas_base_attach+0x1991/0x2120 [mpt3sas]
- [<ffffffffa0053c93>] _scsih_probe+0xeb3/0x16b0 [mpt3sas]
- [<ffffffff81ebd047>] local_pci_probe+0xc7/0x170
- [<ffffffff81ebf2cf>] pci_device_probe+0x20f/0x290
- [<ffffffff820d50cd>] really_probe+0x17d/0x600
- [<ffffffff820d56a3>] __driver_attach+0x153/0x190
- [<ffffffff820cffac>] bus_for_each_dev+0x11c/0x1a0
- [<ffffffff820d421d>] driver_attach+0x3d/0x50
- [<ffffffff820d378a>] bus_add_driver+0x44a/0x5f0
- [<ffffffff820d666c>] driver_register+0x18c/0x3b0
- [<ffffffff81ebcb76>] __pci_register_driver+0x156/0x200
- [<ffffffffa00c8135>] _mpt3sas_init+0x135/0x1000 [mpt3sas]
- [<ffffffff81000423>] do_one_initcall+0x113/0x2b0
- [<ffffffff813caa5a>] do_init_module+0x1d0/0x4d8
- [<ffffffff81273909>] load_module+0x6729/0x8dc0
- [<ffffffff81276123>] SYSC_init_module+0x183/0x1a0
- [<ffffffff8127625e>] SyS_init_module+0xe/0x10
- [<ffffffff828fe7d7>] entry_SYSCALL_64_fastpath+0x12/0x6a
-
-Fix this by pulling the value at the beginning of the loop.
-
-Signed-off-by: Calvin Owens <calvinowens@fb.com>
-Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
-Reviewed-by: Jens Axboe <axboe@fb.com>
-Acked-by: Chaitra Basappa <chaitra.basappa@broadcom.com>
-Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-Signed-off-by: Hannes Reinecke <hare@suse.de>
----
- drivers/scsi/mpt3sas/mpt3sas_base.c | 33 ++++++++++++++++-----------------
- 1 file changed, 16 insertions(+), 17 deletions(-)
-
-diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
-index 7b1c64e..475646c 100644
---- a/drivers/scsi/mpt3sas/mpt3sas_base.c
-+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
-@@ -5041,7 +5041,7 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, int sleep_flag,
- static int
- _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
- {
-- int r, i;
-+ int r, i, index;
- unsigned long flags;
- u32 reply_address;
- u16 smid;
-@@ -5050,8 +5050,7 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
- struct _event_ack_list *delayed_event_ack, *delayed_event_ack_next;
- u8 hide_flag;
- struct adapter_reply_queue *reply_q;
-- long reply_post_free;
-- u32 reply_post_free_sz, index = 0;
-+ Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig;
-
- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name,
- __func__));
-@@ -5135,27 +5134,27 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
- _base_assign_reply_queues(ioc);
-
- /* initialize Reply Post Free Queue */
-- reply_post_free_sz = ioc->reply_post_queue_depth *
-- sizeof(Mpi2DefaultReplyDescriptor_t);
-- reply_post_free = (long)ioc->reply_post[index].reply_post_free;
-+ index = 0;
-+ reply_post_free_contig = ioc->reply_post[0].reply_post_free;
- list_for_each_entry(reply_q, &ioc->reply_queue_list, list) {
-+ /*
-+ * If RDPQ is enabled, switch to the next allocation.
-+ * Otherwise advance within the contiguous region.
-+ */
-+ if (ioc->rdpq_array_enable) {
-+ reply_q->reply_post_free =
-+ ioc->reply_post[index++].reply_post_free;
-+ } else {
-+ reply_q->reply_post_free = reply_post_free_contig;
-+ reply_post_free_contig += ioc->reply_post_queue_depth;
-+ }
-+
- reply_q->reply_post_host_index = 0;
-- reply_q->reply_post_free = (Mpi2ReplyDescriptorsUnion_t *)
-- reply_post_free;
- for (i = 0; i < ioc->reply_post_queue_depth; i++)
- reply_q->reply_post_free[i].Words =
- cpu_to_le64(ULLONG_MAX);
- if (!_base_is_controller_msix_enabled(ioc))
- goto skip_init_reply_post_free_queue;
-- /*
-- * If RDPQ is enabled, switch to the next allocation.
-- * Otherwise advance within the contiguous region.
-- */
-- if (ioc->rdpq_array_enable)
-- reply_post_free = (long)
-- ioc->reply_post[++index].reply_post_free;
-- else
-- reply_post_free += reply_post_free_sz;
- }
- skip_init_reply_post_free_queue:
-
---
-1.8.5.6
-
diff --git a/patches.drivers/mpt3sas-Make-use-of-additional-HighPriority-credit-m.patch b/patches.drivers/mpt3sas-Make-use-of-additional-HighPriority-credit-m.patch
index a54b871425..c0a751687d 100644
--- a/patches.drivers/mpt3sas-Make-use-of-additional-HighPriority-credit-m.patch
+++ b/patches.drivers/mpt3sas-Make-use-of-additional-HighPriority-credit-m.patch
@@ -16,16 +16,14 @@ Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Acked-by: Hannes Reinecke <hare@suse.de>
---
- drivers/scsi/mpt3sas/mpt3sas_base.c | 63 +++++++++++---
- drivers/scsi/mpt3sas/mpt3sas_base.h | 27 ++++++
- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 154 ++++++++++++++++++++++++++++++++++-
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 63 +++++++++++---
+ drivers/scsi/mpt3sas/mpt3sas_base.h | 27 ++++++
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 154 ++++++++++++++++++++++++++++++++++-
3 files changed, 228 insertions(+), 16 deletions(-)
-diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
-index f59495b..31838d9a 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
-@@ -775,7 +775,7 @@ mpt3sas_base_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
+@@ -775,7 +775,7 @@ mpt3sas_base_done(struct MPT3SAS_ADAPTER
mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply);
if (mpi_reply && mpi_reply->Function == MPI2_FUNCTION_EVENT_ACK)
@@ -34,7 +32,7 @@ index f59495b..31838d9a 100644
if (ioc->base_cmds.status == MPT3_CMD_NOT_USED)
return 1;
-@@ -806,6 +806,7 @@ _base_async_event(struct MPT3SAS_ADAPTER *ioc, u8 msix_index, u32 reply)
+@@ -806,6 +806,7 @@ _base_async_event(struct MPT3SAS_ADAPTER
Mpi2EventNotificationReply_t *mpi_reply;
Mpi2EventAckRequest_t *ack_request;
u16 smid;
@@ -42,7 +40,7 @@ index f59495b..31838d9a 100644
mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply);
if (!mpi_reply)
-@@ -819,8 +820,18 @@ _base_async_event(struct MPT3SAS_ADAPTER *ioc, u8 msix_index, u32 reply)
+@@ -819,8 +820,18 @@ _base_async_event(struct MPT3SAS_ADAPTER
goto out;
smid = mpt3sas_base_get_smid(ioc, ioc->base_cb_idx);
if (!smid) {
@@ -63,7 +61,7 @@ index f59495b..31838d9a 100644
goto out;
}
-@@ -3189,20 +3200,35 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
+@@ -3202,20 +3213,35 @@ _base_allocate_memory_pools(struct MPT3S
}
ioc->shost->sg_tablesize = sg_tablesize;
@@ -104,7 +102,7 @@ index f59495b..31838d9a 100644
/* request frame size */
ioc->request_sz = facts->IOCRequestFrameSize * 4;
-@@ -3249,7 +3275,6 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
+@@ -3262,7 +3288,6 @@ _base_allocate_memory_pools(struct MPT3S
ioc->reply_post_queue_depth += 16 -
(ioc->reply_post_queue_depth % 16);
@@ -112,7 +110,7 @@ index f59495b..31838d9a 100644
if (ioc->reply_post_queue_depth >
facts->MaxReplyDescriptorPostQueueDepth) {
ioc->reply_post_queue_depth =
-@@ -3331,7 +3356,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
+@@ -3344,7 +3369,7 @@ _base_allocate_memory_pools(struct MPT3S
/* set the scsi host can_queue depth
* with some internal commands that could be outstanding
*/
@@ -121,7 +119,7 @@ index f59495b..31838d9a 100644
dinitprintk(ioc, pr_info(MPT3SAS_FMT
"scsi host: can_queue depth (%d)\n",
ioc->name, ioc->shost->can_queue));
-@@ -3358,8 +3383,8 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
+@@ -3371,8 +3396,8 @@ _base_allocate_memory_pools(struct MPT3S
ioc->chains_needed_per_io, ioc->request_sz, sz/1024);
if (ioc->scsiio_depth < MPT3SAS_SAS_QUEUE_DEPTH)
goto out;
@@ -132,7 +130,7 @@ index f59495b..31838d9a 100644
goto retry_allocation;
}
-@@ -4977,6 +5002,8 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
+@@ -4990,6 +5015,8 @@ _base_make_ioc_operational(struct MPT3SA
u32 reply_address;
u16 smid;
struct _tr_list *delayed_tr, *delayed_tr_next;
@@ -140,8 +138,8 @@ index f59495b..31838d9a 100644
+ struct _event_ack_list *delayed_event_ack, *delayed_event_ack_next;
u8 hide_flag;
struct adapter_reply_queue *reply_q;
- long reply_post_free;
-@@ -4999,6 +5026,18 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
+ Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig;
+@@ -5011,6 +5038,18 @@ _base_make_ioc_operational(struct MPT3SA
kfree(delayed_tr);
}
@@ -160,8 +158,6 @@ index f59495b..31838d9a 100644
/* initialize the scsi lookup free list */
spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
INIT_LIST_HEAD(&ioc->free_list);
-diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h
-index 2786222..4b52a07 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.h
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.h
@@ -122,6 +122,8 @@
@@ -173,7 +169,7 @@ index 2786222..4b52a07 100644
#define MPI3_HIM_MASK 0xFFFFFFFF /* mask every bit*/
-@@ -677,6 +679,25 @@ struct _tr_list {
+@@ -691,6 +693,25 @@ struct _tr_list {
u16 state;
};
@@ -199,7 +195,7 @@ index 2786222..4b52a07 100644
/**
* struct adapter_reply_queue - the reply queue struct
-@@ -922,6 +943,8 @@ typedef void (*MPT3SAS_FLUSH_RUNNING_CMDS)(struct MPT3SAS_ADAPTER *ioc);
+@@ -936,6 +957,8 @@ typedef void (*MPT3SAS_FLUSH_RUNNING_CMD
* @replyPostRegisterIndex: index of next position in Reply Desc Post Queue
* @delayed_tr_list: target reset link list
* @delayed_tr_volume_list: volume target reset link list
@@ -208,7 +204,7 @@ index 2786222..4b52a07 100644
* @temp_sensors_count: flag to carry the number of temperature sensors
* @pci_access_mutex: Mutex to synchronize ioctl,sysfs show path and
* pci resource handling. PCI resource freeing will lead to free
-@@ -1143,6 +1166,8 @@ struct MPT3SAS_ADAPTER {
+@@ -1157,6 +1180,8 @@ struct MPT3SAS_ADAPTER {
struct list_head delayed_tr_list;
struct list_head delayed_tr_volume_list;
@@ -217,7 +213,7 @@ index 2786222..4b52a07 100644
u8 temp_sensors_count;
struct mutex pci_access_mutex;
-@@ -1260,6 +1285,8 @@ void mpt3sas_scsih_clear_tm_flag(struct MPT3SAS_ADAPTER *ioc, u16 handle);
+@@ -1275,6 +1300,8 @@ void mpt3sas_scsih_clear_tm_flag(struct
void mpt3sas_expander_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address);
void mpt3sas_device_remove_by_sas_address(struct MPT3SAS_ADAPTER *ioc,
u64 sas_address);
@@ -226,11 +222,9 @@ index 2786222..4b52a07 100644
struct _sas_node *mpt3sas_scsih_expander_find_by_handle(
struct MPT3SAS_ADAPTER *ioc, u16 handle);
-diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-index dcb4c18..b12cada 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-@@ -3222,6 +3222,7 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
+@@ -3229,6 +3229,7 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADA
Mpi2SasIoUnitControlRequest_t *mpi_request;
u16 smid_sas_ctrl;
u32 ioc_state;
@@ -238,7 +232,7 @@ index dcb4c18..b12cada 100644
if (ioc->remove_host) {
dewtprintk(ioc, pr_info(MPT3SAS_FMT
-@@ -3264,9 +3265,16 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
+@@ -3271,9 +3272,16 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADA
smid_sas_ctrl = mpt3sas_base_get_smid(ioc, ioc->tm_sas_control_cb_idx);
if (!smid_sas_ctrl) {
@@ -258,7 +252,7 @@ index dcb4c18..b12cada 100644
}
dewtprintk(ioc, pr_info(MPT3SAS_FMT
-@@ -3317,7 +3325,7 @@ _scsih_sas_control_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid,
+@@ -3324,7 +3332,7 @@ _scsih_sas_control_complete(struct MPT3S
pr_err(MPT3SAS_FMT "mpi_reply not valid at %s:%d/%s()!\n",
ioc->name, __FILE__, __LINE__, __func__);
}
@@ -267,7 +261,7 @@ index dcb4c18..b12cada 100644
}
/**
-@@ -3424,6 +3432,142 @@ _scsih_tm_volume_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid,
+@@ -3431,6 +3439,142 @@ _scsih_tm_volume_tr_complete(struct MPT3
return _scsih_check_for_pending_tm(ioc, smid);
}
@@ -410,7 +404,7 @@ index dcb4c18..b12cada 100644
/**
* _scsih_check_for_pending_tm - check for pending task management
-@@ -8589,6 +8733,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+@@ -8641,6 +8785,8 @@ _scsih_probe(struct pci_dev *pdev, const
INIT_LIST_HEAD(&ioc->raid_device_list);
INIT_LIST_HEAD(&ioc->sas_hba.sas_port_list);
INIT_LIST_HEAD(&ioc->delayed_tr_list);
@@ -419,6 +413,3 @@ index dcb4c18..b12cada 100644
INIT_LIST_HEAD(&ioc->delayed_tr_volume_list);
INIT_LIST_HEAD(&ioc->reply_queue_list);
---
-1.8.5.6
-
diff --git a/patches.drivers/net-mlx4-Remove-BUG_ON-from-ICM-allocation-routine.patch b/patches.drivers/net-mlx4-Remove-BUG_ON-from-ICM-allocation-routine.patch
deleted file mode 100644
index 236bcace72..0000000000
--- a/patches.drivers/net-mlx4-Remove-BUG_ON-from-ICM-allocation-routine.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: Leon Romanovsky <leonro@mellanox.com>
-Date: Thu, 29 Dec 2016 18:37:11 +0200
-Subject: net/mlx4: Remove BUG_ON from ICM allocation routine
-Patch-mainline: v4.10-rc3
-Git-commit: c1d5f8ff80ea84768f5fae1ca9d1abfbb5e6bbaa
-References: bsc#1015336 FATE#321685 bsc#1015337 FATE#321686 bsc#1015340 FATE#321687
-
-This patch removes BUG_ON() macro from mlx4_alloc_icm_coherent()
-by checking DMA address alignment in advance and performing proper
-folding in case of error.
-
-Fixes: 5b0bf5e25efe ("mlx4_core: Support ICM tables in coherent memory")
-Reported-by: Ozgur Karatas <okaratas@member.fsf.org>
-Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
-Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Acked-by: Benjamin Poirier <bpoirier@suse.com>
----
- drivers/net/ethernet/mellanox/mlx4/icm.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
---- a/drivers/net/ethernet/mellanox/mlx4/icm.c
-+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
-@@ -118,8 +118,13 @@ static int mlx4_alloc_icm_coherent(struc
- if (!buf)
- return -ENOMEM;
-
-+ if (offset_in_page(buf)) {
-+ dma_free_coherent(dev, PAGE_SIZE << order,
-+ buf, sg_dma_address(mem));
-+ return -ENOMEM;
-+ }
-+
- sg_set_buf(mem, buf, PAGE_SIZE << order);
-- BUG_ON(mem->offset);
- sg_dma_len(mem) = PAGE_SIZE << order;
- return 0;
- }
diff --git a/patches.drivers/net-mlx5-Add-timeout-handle-to-commands-with-callbac.patch b/patches.drivers/net-mlx5-Add-timeout-handle-to-commands-with-callbac.patch
index ec3381ceaf..d7d7aeb5df 100644
--- a/patches.drivers/net-mlx5-Add-timeout-handle-to-commands-with-callbac.patch
+++ b/patches.drivers/net-mlx5-Add-timeout-handle-to-commands-with-callbac.patch
@@ -25,9 +25,9 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
-@@ -620,11 +620,36 @@ static void dump_command(struct mlx5_cor
- pr_debug("\n");
- }
+@@ -624,11 +624,36 @@ static void free_msg(struct mlx5_core_de
+ static void mlx5_free_cmd_msg(struct mlx5_core_dev *dev,
+ struct mlx5_cmd_msg *msg);
+static u16 msg_to_opcode(struct mlx5_cmd_msg *in)
+{
@@ -62,7 +62,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
struct mlx5_cmd_layout *lay;
struct semaphore *sem;
unsigned long flags;
-@@ -664,6 +689,9 @@ static void cmd_work_handler(struct work
+@@ -679,6 +704,9 @@ static void cmd_work_handler(struct work
dump_command(dev, ent, 1);
ent->ts1 = ktime_get_ns();
@@ -72,7 +72,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
/* ring doorbell after the descriptor is valid */
mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx);
wmb();
-@@ -708,13 +736,6 @@ static const char *deliv_status_to_str(u
+@@ -723,13 +751,6 @@ static const char *deliv_status_to_str(u
}
}
@@ -86,7 +86,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
{
unsigned long timeout = msecs_to_jiffies(MLX5_CMD_TIMEOUT_MSEC);
-@@ -781,6 +802,7 @@ static int mlx5_cmd_invoke(struct mlx5_c
+@@ -796,6 +817,7 @@ static int mlx5_cmd_invoke(struct mlx5_c
if (!callback)
init_completion(&ent->done);
@@ -94,7 +94,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
INIT_WORK(&ent->work, cmd_work_handler);
if (page_queue) {
cmd_work_handler(&ent->work);
-@@ -1262,6 +1284,8 @@ void mlx5_cmd_comp_handler(struct mlx5_c
+@@ -1277,6 +1299,8 @@ void mlx5_cmd_comp_handler(struct mlx5_c
struct semaphore *sem;
ent = cmd->ent_arr[i];
diff --git a/patches.drivers/phy-Add-an-mdio_device-structure.patch b/patches.drivers/phy-Add-an-mdio_device-structure.patch
index b3afd66a44..e425394641 100644
--- a/patches.drivers/phy-Add-an-mdio_device-structure.patch
+++ b/patches.drivers/phy-Add-an-mdio_device-structure.patch
@@ -39,14 +39,14 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
drivers/net/phy/mdio_bus.c | 12 ++--
drivers/net/phy/micrel.c | 12 ++--
drivers/net/phy/microchip.c | 4 -
- drivers/net/phy/phy.c | 25 ++++-----
+ drivers/net/phy/phy.c | 27 +++++-----
drivers/net/phy/phy_device.c | 62 +++++++++++------------
drivers/net/phy/smsc.c | 2
drivers/of/of_mdio.c | 6 +-
include/linux/mdio.h | 9 +++
include/linux/phy.h | 26 ++++-----
net/dsa/dsa.c | 2
- 33 files changed, 159 insertions(+), 145 deletions(-)
+ 33 files changed, 160 insertions(+), 146 deletions(-)
--- a/drivers/net/ethernet/agere/et131x.c
+++ b/drivers/net/ethernet/agere/et131x.c
@@ -152,7 +152,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
-@@ -401,7 +401,7 @@ int bcmgenet_mii_probe(struct net_device
+@@ -386,7 +386,7 @@ int bcmgenet_mii_probe(struct net_device
* Ethernet MAC ISRs
*/
if (priv->internal_phy)
@@ -249,7 +249,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -3714,7 +3714,7 @@ static int mvneta_probe(struct platform_
+@@ -3712,7 +3712,7 @@ static int mvneta_probe(struct platform_
mvneta_fixed_link_update(pp, phy);
@@ -336,7 +336,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
-@@ -827,7 +827,7 @@ static int xemaclite_mdio_setup(struct n
+@@ -839,7 +839,7 @@ static int xemaclite_mdio_setup(struct n
dev_info(dev,
"MDIO of the phy is not registered yet\n");
else
@@ -452,7 +452,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
enable_status_frames(phydev, false);
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
-@@ -102,7 +102,7 @@ static int dp83867_config_intr(struct ph
+@@ -105,7 +105,7 @@ static int dp83867_config_intr(struct ph
static int dp83867_of_init(struct phy_device *phydev)
{
struct dp83867_private *dp83867 = phydev->priv;
@@ -461,7 +461,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
struct device_node *of_node = dev->of_node;
int ret;
-@@ -130,7 +130,7 @@ static int dp83867_config_init(struct ph
+@@ -133,7 +133,7 @@ static int dp83867_config_init(struct ph
u16 val, delay;
if (!phydev->priv) {
@@ -582,7 +582,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
return 0;
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
-@@ -300,10 +300,11 @@ static int marvell_of_reg_init(struct ph
+@@ -308,10 +308,11 @@ static int marvell_of_reg_init(struct ph
const __be32 *paddr;
int len, i, saved_page, current_page, page_changed, ret;
@@ -596,7 +596,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
if (!paddr || len < (4 * sizeof(*paddr)))
return 0;
-@@ -1060,7 +1061,7 @@ static int marvell_probe(struct phy_devi
+@@ -1066,7 +1067,7 @@ static int marvell_probe(struct phy_devi
{
struct marvell_priv *priv;
@@ -675,7 +675,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
const struct device_node *of_node = dev->of_node;
static const char *clk_skews[2] = {"rxc-skew-ps", "txc-skew-ps"};
static const char *rx_data_skews[4] = {
-@@ -573,12 +573,12 @@ ksz9021_wr_mmd_phyreg(struct phy_device
+@@ -575,12 +575,12 @@ ksz9021_wr_mmd_phyreg(struct phy_device
static int kszphy_probe(struct phy_device *phydev)
{
const struct kszphy_type *type = phydev->drv->driver_data;
@@ -690,7 +690,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
if (!priv)
return -ENOMEM;
-@@ -601,7 +601,7 @@ static int kszphy_probe(struct phy_devic
+@@ -603,7 +603,7 @@ static int kszphy_probe(struct phy_devic
priv->led_mode = -1;
}
@@ -773,7 +773,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
mii_data->reg_num == MII_BMCR &&
val & BMCR_RESET)
return phy_init_hw(phydev);
-@@ -645,7 +646,7 @@ int phy_start_interrupts(struct phy_devi
+@@ -648,7 +649,7 @@ int phy_start_interrupts(struct phy_devi
"phy_interrupt",
phydev) < 0) {
pr_warn("%s: Can't get IRQ %d (PHY)\n",
@@ -782,7 +782,16 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
phydev->irq = PHY_POLL;
return 0;
}
-@@ -1043,11 +1044,11 @@ static inline void mmd_phy_indirect(stru
+@@ -928,7 +929,7 @@ void phy_state_machine(struct work_struc
+ */
+ if (!phydev->link && phydev->state == PHY_RUNNING) {
+ phydev->state = PHY_CHANGELINK;
+- dev_err(&phydev->dev, "no link in PHY_RUNNING\n");
++ dev_err(&phydev->mdio.dev, "no link in PHY_RUNNING\n");
+ }
+ break;
+ case PHY_CHANGELINK:
+@@ -1055,11 +1056,11 @@ static inline void mmd_phy_indirect(stru
int phy_read_mmd_indirect(struct phy_device *phydev, int prtad, int devad)
{
struct phy_driver *phydrv = phydev->drv;
@@ -796,7 +805,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
mutex_lock(&bus->mdio_lock);
mmd_phy_indirect(bus, prtad, devad, addr);
-@@ -1081,10 +1082,10 @@ void phy_write_mmd_indirect(struct phy_d
+@@ -1093,10 +1094,10 @@ void phy_write_mmd_indirect(struct phy_d
int devad, u32 data)
{
struct phy_driver *phydrv = phydev->drv;
diff --git a/patches.drivers/phy-Centralize-setting-driver-module-owner.patch b/patches.drivers/phy-Centralize-setting-driver-module-owner.patch
index 2bcb70a151..1795ad0f6d 100644
--- a/patches.drivers/phy-Centralize-setting-driver-module-owner.patch
+++ b/patches.drivers/phy-Centralize-setting-driver-module-owner.patch
@@ -349,7 +349,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
module_phy_driver(dm91xx_driver);
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
-@@ -1509,12 +1509,11 @@ static struct phy_driver dp83640_driver
+@@ -1507,12 +1507,11 @@ static struct phy_driver dp83640_driver
.hwtstamp = dp83640_hwtstamp,
.rxtstamp = dp83640_rxtstamp,
.txtstamp = dp83640_txtstamp,
@@ -376,7 +376,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
module_phy_driver(dp83848_driver);
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
-@@ -207,8 +207,6 @@ static struct phy_driver dp83867_driver[
+@@ -217,8 +217,6 @@ static struct phy_driver dp83867_driver[
.read_status = genphy_read_status,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -457,7 +457,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
module_phy_driver(lxt97x_driver);
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
-@@ -1087,7 +1087,6 @@ static struct phy_driver marvell_drivers
+@@ -1093,7 +1093,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -465,7 +465,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1112,
-@@ -1106,7 +1105,6 @@ static struct phy_driver marvell_drivers
+@@ -1112,7 +1111,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -473,7 +473,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1111,
-@@ -1125,7 +1123,6 @@ static struct phy_driver marvell_drivers
+@@ -1131,7 +1129,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -481,7 +481,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1118,
-@@ -1144,7 +1141,6 @@ static struct phy_driver marvell_drivers
+@@ -1150,7 +1147,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -489,7 +489,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1121R,
-@@ -1163,7 +1159,6 @@ static struct phy_driver marvell_drivers
+@@ -1169,7 +1165,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -497,7 +497,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1318S,
-@@ -1184,7 +1179,6 @@ static struct phy_driver marvell_drivers
+@@ -1190,7 +1185,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -505,7 +505,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1145,
-@@ -1203,7 +1197,6 @@ static struct phy_driver marvell_drivers
+@@ -1209,7 +1203,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -513,7 +513,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1149R,
-@@ -1222,7 +1215,6 @@ static struct phy_driver marvell_drivers
+@@ -1228,7 +1221,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -521,7 +521,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1240,
-@@ -1241,7 +1233,6 @@ static struct phy_driver marvell_drivers
+@@ -1247,7 +1239,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -529,7 +529,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1116R,
-@@ -1260,7 +1251,6 @@ static struct phy_driver marvell_drivers
+@@ -1266,7 +1257,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -537,7 +537,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1510,
-@@ -1279,7 +1269,6 @@ static struct phy_driver marvell_drivers
+@@ -1285,7 +1275,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -545,7 +545,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E1540,
-@@ -1298,7 +1287,6 @@ static struct phy_driver marvell_drivers
+@@ -1304,7 +1293,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -553,7 +553,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
},
{
.phy_id = MARVELL_PHY_ID_88E3016,
-@@ -1319,7 +1307,6 @@ static struct phy_driver marvell_drivers
+@@ -1325,7 +1313,6 @@ static struct phy_driver marvell_drivers
.get_sset_count = marvell_get_sset_count,
.get_strings = marvell_get_strings,
.get_stats = marvell_get_stats,
@@ -563,7 +563,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
-@@ -646,7 +646,6 @@ static struct phy_driver ksphy_driver[]
+@@ -648,7 +648,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -571,7 +571,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ8021,
.phy_id_mask = 0x00ffffff,
-@@ -663,7 +662,6 @@ static struct phy_driver ksphy_driver[]
+@@ -665,7 +664,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -579,7 +579,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ8031,
.phy_id_mask = 0x00ffffff,
-@@ -680,7 +678,6 @@ static struct phy_driver ksphy_driver[]
+@@ -682,7 +680,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -587,7 +587,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ8041,
.phy_id_mask = 0x00fffff0,
-@@ -697,7 +694,6 @@ static struct phy_driver ksphy_driver[]
+@@ -699,7 +696,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -595,7 +595,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ8041RNLI,
.phy_id_mask = 0x00fffff0,
-@@ -714,7 +710,6 @@ static struct phy_driver ksphy_driver[]
+@@ -716,7 +712,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -603,7 +603,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ8051,
.phy_id_mask = 0x00fffff0,
-@@ -731,7 +726,6 @@ static struct phy_driver ksphy_driver[]
+@@ -733,7 +728,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -611,7 +611,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ8001,
.name = "Micrel KSZ8001 or KS8721",
-@@ -747,7 +741,6 @@ static struct phy_driver ksphy_driver[]
+@@ -749,7 +743,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -619,7 +619,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ8081,
.name = "Micrel KSZ8081 or KSZ8091",
-@@ -763,7 +756,6 @@ static struct phy_driver ksphy_driver[]
+@@ -765,7 +758,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -627,7 +627,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ8061,
.name = "Micrel KSZ8061",
-@@ -777,7 +769,6 @@ static struct phy_driver ksphy_driver[]
+@@ -779,7 +771,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -635,7 +635,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ9021,
.phy_id_mask = 0x000ffffe,
-@@ -794,7 +785,6 @@ static struct phy_driver ksphy_driver[]
+@@ -796,7 +787,6 @@ static struct phy_driver ksphy_driver[]
.resume = genphy_resume,
.read_mmd_indirect = ksz9021_rd_mmd_phyreg,
.write_mmd_indirect = ksz9021_wr_mmd_phyreg,
@@ -643,7 +643,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ9031,
.phy_id_mask = 0x00fffff0,
-@@ -809,7 +799,6 @@ static struct phy_driver ksphy_driver[]
+@@ -811,7 +801,6 @@ static struct phy_driver ksphy_driver[]
.config_intr = kszphy_config_intr,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -651,7 +651,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ8873MLL,
.phy_id_mask = 0x00fffff0,
-@@ -821,7 +810,6 @@ static struct phy_driver ksphy_driver[]
+@@ -823,7 +812,6 @@ static struct phy_driver ksphy_driver[]
.read_status = ksz8873mll_read_status,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -659,7 +659,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = PHY_ID_KSZ886X,
.phy_id_mask = 0x00fffff0,
-@@ -833,7 +821,6 @@ static struct phy_driver ksphy_driver[]
+@@ -835,7 +823,6 @@ static struct phy_driver ksphy_driver[]
.read_status = genphy_read_status,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -690,7 +690,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
module_phy_driver(dp83865_driver);
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
-@@ -1564,8 +1564,9 @@ static int phy_remove(struct device *dev
+@@ -1566,8 +1566,9 @@ static int phy_remove(struct device *dev
/**
* phy_driver_register - register a phy_driver with the PHY layer
* @new_driver: new phy_driver to register
@@ -701,7 +701,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
{
int retval;
-@@ -1573,6 +1574,7 @@ int phy_driver_register(struct phy_drive
+@@ -1575,6 +1576,7 @@ int phy_driver_register(struct phy_drive
new_driver->driver.bus = &mdio_bus_type;
new_driver->driver.probe = phy_probe;
new_driver->driver.remove = phy_remove;
@@ -709,7 +709,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
retval = driver_register(&new_driver->driver);
if (retval) {
-@@ -1588,12 +1590,13 @@ int phy_driver_register(struct phy_drive
+@@ -1590,12 +1592,13 @@ int phy_driver_register(struct phy_drive
}
EXPORT_SYMBOL(phy_driver_register);
@@ -725,7 +725,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
if (ret) {
while (i-- > 0)
phy_driver_unregister(new_driver + i);
-@@ -1634,7 +1637,6 @@ static struct phy_driver genphy_driver[]
+@@ -1636,7 +1639,6 @@ static struct phy_driver genphy_driver[]
.read_status = genphy_read_status,
.suspend = genphy_suspend,
.resume = genphy_resume,
@@ -733,7 +733,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}, {
.phy_id = 0xffffffff,
.phy_id_mask = 0xffffffff,
-@@ -1646,7 +1648,6 @@ static struct phy_driver genphy_driver[]
+@@ -1648,7 +1650,6 @@ static struct phy_driver genphy_driver[]
.read_status = gen10g_read_status,
.suspend = gen10g_suspend,
.resume = gen10g_resume,
@@ -741,7 +741,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
} };
static int __init phy_init(void)
-@@ -1658,7 +1659,7 @@ static int __init phy_init(void)
+@@ -1660,7 +1661,7 @@ static int __init phy_init(void)
return rc;
rc = phy_drivers_register(genphy_driver,
@@ -945,8 +945,8 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
module_phy_driver(vsc82xx_driver);
--- a/include/linux/phy.h
+++ b/include/linux/phy.h
-@@ -797,8 +797,9 @@ int genphy_resume(struct phy_device *phy
- int genphy_soft_reset(struct phy_device *phydev);
+@@ -801,8 +801,9 @@ static inline int genphy_no_soft_reset(s
+ }
void phy_driver_unregister(struct phy_driver *drv);
void phy_drivers_unregister(struct phy_driver *drv, int n);
-int phy_driver_register(struct phy_driver *new_driver);
@@ -957,7 +957,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
void phy_state_machine(struct work_struct *work);
void phy_change(struct work_struct *work);
void phy_mac_interrupt(struct phy_device *phydev, int new_link);
-@@ -843,7 +844,7 @@ extern struct bus_type mdio_bus_type;
+@@ -847,7 +848,7 @@ extern struct bus_type mdio_bus_type;
#define phy_module_driver(__phy_drivers, __count) \
static int __init phy_module_init(void) \
{ \
diff --git a/patches.drivers/phy-phy_-read-write-_mmd_indirect-get-addr-from-phyd.patch b/patches.drivers/phy-phy_-read-write-_mmd_indirect-get-addr-from-phyd.patch
index 4d9e7b95ea..fd1e643e65 100644
--- a/patches.drivers/phy-phy_-read-write-_mmd_indirect-get-addr-from-phyd.patch
+++ b/patches.drivers/phy-phy_-read-write-_mmd_indirect-get-addr-from-phyd.patch
@@ -54,7 +54,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
-@@ -153,7 +153,7 @@ static int dp83867_config_init(struct ph
+@@ -156,7 +156,7 @@ static int dp83867_config_init(struct ph
if ((phydev->interface >= PHY_INTERFACE_MODE_RGMII_ID) &&
(phydev->interface <= PHY_INTERFACE_MODE_RGMII_RXID)) {
val = phy_read_mmd_indirect(phydev, DP83867_RGMIICTL,
@@ -63,7 +63,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
val |= (DP83867_RGMII_TX_CLK_DELAY_EN | DP83867_RGMII_RX_CLK_DELAY_EN);
-@@ -165,13 +165,13 @@ static int dp83867_config_init(struct ph
+@@ -168,13 +168,13 @@ static int dp83867_config_init(struct ph
val |= DP83867_RGMII_RX_CLK_DELAY_EN;
phy_write_mmd_indirect(phydev, DP83867_RGMIICTL,
@@ -78,7 +78,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
+ DP83867_DEVADDR, delay);
}
- return 0;
+ /* Enable Interrupt output INT_OE in CFG3 register */
--- a/drivers/net/phy/microchip.c
+++ b/drivers/net/phy/microchip.c
@@ -78,10 +78,9 @@ static int lan88xx_probe(struct phy_devi
@@ -96,7 +96,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
-@@ -1031,7 +1031,6 @@ static inline void mmd_phy_indirect(stru
+@@ -1043,7 +1043,6 @@ static inline void mmd_phy_indirect(stru
* @phydev: The PHY device bus
* @prtad: MMD Address
* @devad: MMD DEVAD
@@ -104,7 +104,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
*
* Description: it reads data from the MMD registers (clause 22 to access to
* clause 45) of the specified phy address.
-@@ -1041,10 +1040,10 @@ static inline void mmd_phy_indirect(stru
+@@ -1053,10 +1052,10 @@ static inline void mmd_phy_indirect(stru
* 3) Write reg 13 // MMD Data Command for MMD DEVAD
* 3) Read reg 14 // Read MMD data
*/
@@ -117,7 +117,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
int value = -1;
if (!phydrv->read_mmd_indirect) {
-@@ -1068,7 +1067,6 @@ EXPORT_SYMBOL(phy_read_mmd_indirect);
+@@ -1080,7 +1079,6 @@ EXPORT_SYMBOL(phy_read_mmd_indirect);
* @phydev: The PHY device
* @prtad: MMD Address
* @devad: MMD DEVAD
@@ -125,7 +125,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
* @data: data to write in the MMD register
*
* Description: Write data from the MMD registers of the specified
-@@ -1080,9 +1078,10 @@ EXPORT_SYMBOL(phy_read_mmd_indirect);
+@@ -1092,9 +1090,10 @@ EXPORT_SYMBOL(phy_read_mmd_indirect);
* 3) Write reg 14 // Write MMD data
*/
void phy_write_mmd_indirect(struct phy_device *phydev, int prtad,
@@ -137,7 +137,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
if (!phydrv->write_mmd_indirect) {
struct mii_bus *bus = phydev->bus;
-@@ -1132,7 +1131,7 @@ int phy_init_eee(struct phy_device *phyd
+@@ -1144,7 +1143,7 @@ int phy_init_eee(struct phy_device *phyd
/* First check if the EEE ability is supported */
eee_cap = phy_read_mmd_indirect(phydev, MDIO_PCS_EEE_ABLE,
@@ -146,7 +146,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
if (eee_cap <= 0)
goto eee_exit_err;
-@@ -1144,12 +1143,12 @@ int phy_init_eee(struct phy_device *phyd
+@@ -1156,12 +1155,12 @@ int phy_init_eee(struct phy_device *phyd
* the EEE advertising registers.
*/
eee_lp = phy_read_mmd_indirect(phydev, MDIO_AN_EEE_LPABLE,
@@ -161,7 +161,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
if (eee_adv <= 0)
goto eee_exit_err;
-@@ -1163,15 +1162,13 @@ int phy_init_eee(struct phy_device *phyd
+@@ -1175,15 +1174,13 @@ int phy_init_eee(struct phy_device *phyd
* clock while it is signaling LPI.
*/
int val = phy_read_mmd_indirect(phydev, MDIO_CTRL1,
@@ -179,7 +179,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}
return 0; /* EEE supported */
-@@ -1190,8 +1187,7 @@ EXPORT_SYMBOL(phy_init_eee);
+@@ -1202,8 +1199,7 @@ EXPORT_SYMBOL(phy_init_eee);
*/
int phy_get_eee_err(struct phy_device *phydev)
{
@@ -189,7 +189,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
}
EXPORT_SYMBOL(phy_get_eee_err);
-@@ -1208,22 +1204,19 @@ int phy_ethtool_get_eee(struct phy_devic
+@@ -1220,22 +1216,19 @@ int phy_ethtool_get_eee(struct phy_devic
int val;
/* Get Supported EEE */
@@ -215,7 +215,7 @@ Acked-by: Benjamin Poirier <bpoirier@suse.com>
if (val < 0)
return val;
data->lp_advertised = mmd_eee_adv_to_ethtool_adv_t(val);
-@@ -1243,8 +1236,7 @@ int phy_ethtool_set_eee(struct phy_devic
+@@ -1255,8 +1248,7 @@ int phy_ethtool_set_eee(struct phy_devic
{
int val = ethtool_adv_to_mmd_eee_adv_t(data->advertised);
diff --git a/patches.drivers/target-iscsi-Fix-indentation-in-iscsi_target_start_n.patch b/patches.drivers/target-iscsi-Fix-indentation-in-iscsi_target_start_n.patch
index 0401c0bbaf..746e7707f5 100644
--- a/patches.drivers/target-iscsi-Fix-indentation-in-iscsi_target_start_n.patch
+++ b/patches.drivers/target-iscsi-Fix-indentation-in-iscsi_target_start_n.patch
@@ -15,14 +15,12 @@ Cc: Nicholas A. Bellinger <nab@linux-iscsi.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Hannes Reinecke <hare@suse.de>
---
- drivers/target/iscsi/iscsi_target_nego.c | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
+ drivers/target/iscsi/iscsi_target_nego.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
-index 89d34bd..19bb8df 100644
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
-@@ -1247,16 +1247,16 @@ int iscsi_target_start_negotiation(
+@@ -1307,8 +1307,8 @@ int iscsi_target_start_negotiation(
{
int ret;
@@ -31,22 +29,5 @@ index 89d34bd..19bb8df 100644
+ if (conn->sock) {
+ struct sock *sk = conn->sock->sk;
-- write_lock_bh(&sk->sk_callback_lock);
-- set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
-- write_unlock_bh(&sk->sk_callback_lock);
-- }
-+ write_lock_bh(&sk->sk_callback_lock);
-+ set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
-+ write_unlock_bh(&sk->sk_callback_lock);
-+ }
-
-- ret = iscsi_target_do_login(conn, login);
-- if (ret < 0) {
-+ ret = iscsi_target_do_login(conn, login);
-+ if (ret < 0) {
- cancel_delayed_work_sync(&conn->login_work);
- cancel_delayed_work_sync(&conn->login_cleanup_work);
- iscsi_target_restore_sock_callbacks(conn);
---
-1.8.5.6
-
+ write_lock_bh(&sk->sk_callback_lock);
+ set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
diff --git a/patches.drivers/tg3-Fix-race-condition-in-tg3_get_stats64.patch b/patches.drivers/tg3-Fix-race-condition-in-tg3_get_stats64.patch
deleted file mode 100644
index cb76f0468d..0000000000
--- a/patches.drivers/tg3-Fix-race-condition-in-tg3_get_stats64.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From: Michael Chan <michael.chan@broadcom.com>
-Date: Fri, 6 Jan 2017 16:18:53 -0500
-Subject: tg3: Fix race condition in tg3_get_stats64().
-Patch-mainline: v4.10-rc4
-Git-commit: f5992b72ebe0dde488fa8f706b887194020c66fc
-References: bsc#1026030 FATE#321670
-
-The driver's ndo_get_stats64() method is not always called under RTNL.
-So it can race with driver close or ethtool reconfigurations. Fix the
-race condition by taking tp->lock spinlock in tg3_free_consistent()
-when freeing the tp->hw_stats memory block. tg3_get_stats64() is
-already taking tp->lock.
-
-Reported-by: Wang Yufen <wangyufen@huawei.com>
-Signed-off-by: Michael Chan <michael.chan@broadcom.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Acked-by: Benjamin Poirier <bpoirier@suse.com>
----
- drivers/net/ethernet/broadcom/tg3.c | 3 +++
- 1 file changed, 3 insertions(+)
-
---- a/drivers/net/ethernet/broadcom/tg3.c
-+++ b/drivers/net/ethernet/broadcom/tg3.c
-@@ -8720,11 +8720,14 @@ static void tg3_free_consistent(struct t
- tg3_mem_rx_release(tp);
- tg3_mem_tx_release(tp);
-
-+ /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */
-+ tg3_full_lock(tp, 0);
- if (tp->hw_stats) {
- dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats),
- tp->hw_stats, tp->stats_mapping);
- tp->hw_stats = NULL;
- }
-+ tg3_full_unlock(tp);
- }
-
- /*
diff --git a/patches.drivers/tpm-019-fix-return-rc-when-devm_add_action-fails.patch b/patches.drivers/tpm-019-fix-return-rc-when-devm_add_action-fails.patch
index b1b9510546..0a285e2600 100644
--- a/patches.drivers/tpm-019-fix-return-rc-when-devm_add_action-fails.patch
+++ b/patches.drivers/tpm-019-fix-return-rc-when-devm_add_action-fails.patch
@@ -19,14 +19,6 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
-@@ -138,6 +138,7 @@ struct tpm_chip *tpmm_chip_alloc(struct
- const struct tpm_class_ops *ops)
- {
- struct tpm_chip *chip;
-+ int rc;
-
- chip = kzalloc(sizeof(*chip), GFP_KERNEL);
- if (chip == NULL)
@@ -185,7 +186,11 @@ struct tpm_chip *tpmm_chip_alloc(struct
chip->cdev.owner = dev->driver->owner;
chip->cdev.kobj.parent = &chip->dev.kobj;
diff --git a/patches.drivers/tpm-035-Get-rid-of-devname.patch b/patches.drivers/tpm-035-Get-rid-of-devname.patch
index 2893a60455..06a22a1351 100644
--- a/patches.drivers/tpm-035-Get-rid-of-devname.patch
+++ b/patches.drivers/tpm-035-Get-rid-of-devname.patch
@@ -17,28 +17,26 @@ Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- drivers/char/tpm/tpm-chip.c | 18 +++++++++++-------
- drivers/char/tpm/tpm.h | 1 -
- drivers/char/tpm/tpm_eventlog.c | 2 +-
- drivers/char/tpm/tpm_eventlog.h | 2 +-
- drivers/char/tpm/tpm_i2c_nuvoton.c | 2 +-
- drivers/char/tpm/tpm_tis.c | 2 +-
+ drivers/char/tpm/tpm-chip.c | 18 +++++++++++-------
+ drivers/char/tpm/tpm.h | 1 -
+ drivers/char/tpm/tpm_eventlog.c | 2 +-
+ drivers/char/tpm/tpm_eventlog.h | 2 +-
+ drivers/char/tpm/tpm_i2c_nuvoton.c | 2 +-
+ drivers/char/tpm/tpm_tis.c | 2 +-
6 files changed, 15 insertions(+), 12 deletions(-)
-diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
-index 12829dd..c21d81c 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
-@@ -111,7 +111,7 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
-
- set_bit(chip->dev_num, dev_mask);
+@@ -169,7 +169,7 @@ struct tpm_chip *tpmm_chip_alloc(struct
+ }
+ chip->dev_num = rc;
- scnprintf(chip->devname, sizeof(chip->devname), "tpm%d", chip->dev_num);
+ device_initialize(&chip->dev);
dev_set_drvdata(dev, chip);
-@@ -127,9 +127,9 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
+@@ -185,9 +185,9 @@ struct tpm_chip *tpmm_chip_alloc(struct
else
chip->dev.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num);
@@ -51,7 +49,7 @@ index 12829dd..c21d81c 100644
cdev_init(&chip->cdev, &tpm_fops);
chip->cdev.owner = dev->driver->owner;
-@@ -142,6 +142,10 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
+@@ -200,6 +200,10 @@ struct tpm_chip *tpmm_chip_alloc(struct
}
return chip;
@@ -62,7 +60,7 @@ index 12829dd..c21d81c 100644
}
EXPORT_SYMBOL_GPL(tpmm_chip_alloc);
-@@ -153,7 +157,7 @@ static int tpm_add_char_device(struct tpm_chip *chip)
+@@ -211,7 +215,7 @@ static int tpm_add_char_device(struct tp
if (rc) {
dev_err(&chip->dev,
"unable to cdev_add() %s, major %d, minor %d, err=%d\n",
@@ -71,7 +69,7 @@ index 12829dd..c21d81c 100644
MINOR(chip->dev.devt), rc);
return rc;
-@@ -163,7 +167,7 @@ static int tpm_add_char_device(struct tpm_chip *chip)
+@@ -221,7 +225,7 @@ static int tpm_add_char_device(struct tp
if (rc) {
dev_err(&chip->dev,
"unable to device_register() %s, major %d, minor %d, err=%d\n",
@@ -80,7 +78,7 @@ index 12829dd..c21d81c 100644
MINOR(chip->dev.devt), rc);
cdev_del(&chip->cdev);
-@@ -190,7 +194,7 @@ static int tpm1_chip_register(struct tpm_chip *chip)
+@@ -263,7 +267,7 @@ static int tpm1_chip_register(struct tpm
if (rc)
return rc;
@@ -89,11 +87,9 @@ index 12829dd..c21d81c 100644
return 0;
}
-diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
-index 66d37bf..6d72e1d2 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
-@@ -174,7 +174,6 @@ struct tpm_chip {
+@@ -180,7 +180,6 @@ struct tpm_chip {
unsigned int flags;
int dev_num; /* /dev/tpm# */
@@ -101,8 +97,6 @@ index 66d37bf..6d72e1d2 100644
unsigned long is_open; /* only one allowed */
int time_expired;
-diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm_eventlog.c
-index 4e6940a..e722886 100644
--- a/drivers/char/tpm/tpm_eventlog.c
+++ b/drivers/char/tpm/tpm_eventlog.c
@@ -403,7 +403,7 @@ static int is_bad(void *p)
@@ -114,8 +108,6 @@ index 4e6940a..e722886 100644
{
struct dentry **ret = NULL, *tpm_dir, *bin_file, *ascii_file;
-diff --git a/drivers/char/tpm/tpm_eventlog.h b/drivers/char/tpm/tpm_eventlog.h
-index 267bfbd..cc9672f 100644
--- a/drivers/char/tpm/tpm_eventlog.h
+++ b/drivers/char/tpm/tpm_eventlog.h
@@ -77,7 +77,7 @@ int read_log(struct tpm_bios_log *log);
@@ -127,11 +119,9 @@ index 267bfbd..cc9672f 100644
extern void tpm_bios_log_teardown(struct dentry **);
#else
static inline struct dentry **tpm_bios_log_setup(char *name)
-diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c
-index a1e1474..d61d43f 100644
--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
+++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
-@@ -560,7 +560,7 @@ static int i2c_nuvoton_probe(struct i2c_client *client,
+@@ -560,7 +560,7 @@ static int i2c_nuvoton_probe(struct i2c_
rc = devm_request_irq(dev, chip->vendor.irq,
i2c_nuvoton_int_handler,
IRQF_TRIGGER_LOW,
@@ -140,11 +130,9 @@ index a1e1474..d61d43f 100644
chip);
if (rc) {
dev_err(dev, "%s() Unable to request irq: %d for use\n",
-diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
-index 0a9aee9..eed3bf5 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
-@@ -577,7 +577,7 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+@@ -577,7 +577,7 @@ static int tpm_tis_probe_irq_single(stru
u8 original_int_vec;
if (devm_request_irq(&chip->dev, irq, tis_int_handler, flags,
@@ -153,6 +141,3 @@ index 0a9aee9..eed3bf5 100644
dev_info(&chip->dev, "Unable to request irq: %d for probe\n",
irq);
return -1;
---
-2.10.2
-
diff --git a/patches.drivers/tpm-039-Replace-device-number-bitmap-with-IDR.patch b/patches.drivers/tpm-039-Replace-device-number-bitmap-with-IDR.patch
deleted file mode 100644
index f135aeefe1..0000000000
--- a/patches.drivers/tpm-039-Replace-device-number-bitmap-with-IDR.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-From 5130665b1e6072bfe485317e411cb793d72f7423 Mon Sep 17 00:00:00 2001
-From: Stefan Berger <stefanb@linux.vnet.ibm.com>
-Date: Mon, 29 Feb 2016 08:53:02 -0500
-Subject: [PATCH] tpm: Replace device number bitmap with IDR
-
-References: bsc#1020645, fate#321435, fate#321507, fate#321600
-Patch-mainline: v4.8-rc1
-Git-commit: 15516788e581eb32ec1c50e5f00aba3faf95d817
-
-Replace the device number bitmap with IDR. Extend the number of devices we
-can create to 64k.
-Since an IDR allows us to associate a pointer with an ID, we use this now
-to rewrite tpm_chip_find_get() to simply look up the chip pointer by the
-given device ID.
-
-Protect the IDR calls with a mutex.
-
-Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
-Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
-Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
-Acked-by: Michal Suchanek <msuchanek@suse.de>
----
- drivers/char/tpm/tpm-chip.c | 84 +++++++++++++++++++++-------------------
- drivers/char/tpm/tpm-interface.c | 1 +
- drivers/char/tpm/tpm.h | 5 +--
- 3 files changed, 48 insertions(+), 42 deletions(-)
-
-diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
-index 5880377..f62c851 100644
---- a/drivers/char/tpm/tpm-chip.c
-+++ b/drivers/char/tpm/tpm-chip.c
-@@ -29,9 +29,8 @@
- #include "tpm.h"
- #include "tpm_eventlog.h"
-
--static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
--static LIST_HEAD(tpm_chip_list);
--static DEFINE_SPINLOCK(driver_lock);
-+DEFINE_IDR(dev_nums_idr);
-+static DEFINE_MUTEX(idr_lock);
-
- struct class *tpm_class;
- dev_t tpm_devt;
-@@ -88,20 +87,30 @@ EXPORT_SYMBOL_GPL(tpm_put_ops);
- */
- struct tpm_chip *tpm_chip_find_get(int chip_num)
- {
-- struct tpm_chip *pos, *chip = NULL;
-+ struct tpm_chip *chip, *res = NULL;
-+ int chip_prev;
-+
-+ mutex_lock(&idr_lock);
-+
-+ if (chip_num == TPM_ANY_NUM) {
-+ chip_num = 0;
-+ do {
-+ chip_prev = chip_num;
-+ chip = idr_get_next(&dev_nums_idr, &chip_num);
-+ if (chip && !tpm_try_get_ops(chip)) {
-+ res = chip;
-+ break;
-+ }
-+ } while (chip_prev != chip_num);
-+ } else {
-+ chip = idr_find_slowpath(&dev_nums_idr, chip_num);
-+ if (chip && !tpm_try_get_ops(chip))
-+ res = chip;
-+ }
-
-- rcu_read_lock();
-- list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
-- if (chip_num != TPM_ANY_NUM && chip_num != pos->dev_num)
-- continue;
-+ mutex_unlock(&idr_lock);
-
-- /* rcu prevents chip from being free'd */
-- if (!tpm_try_get_ops(pos))
-- chip = pos;
-- break;
-- }
-- rcu_read_unlock();
-- return chip;
-+ return res;
- }
-
- /**
-@@ -114,9 +123,10 @@ static void tpm_dev_release(struct device *dev)
- {
- struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev);
-
-- spin_lock(&driver_lock);
-- clear_bit(chip->dev_num, dev_mask);
-- spin_unlock(&driver_lock);
-+ mutex_lock(&idr_lock);
-+ idr_remove(&dev_nums_idr, chip->dev_num);
-+ mutex_unlock(&idr_lock);
-+
- kfree(chip);
- }
-
-@@ -142,21 +152,18 @@ struct tpm_chip *tpm_chip_alloc(struct device *dev,
-
- mutex_init(&chip->tpm_mutex);
- init_rwsem(&chip->ops_sem);
-- INIT_LIST_HEAD(&chip->list);
-
- chip->ops = ops;
-
-- spin_lock(&driver_lock);
-- chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
-- spin_unlock(&driver_lock);
--
-- if (chip->dev_num >= TPM_NUM_DEVICES) {
-+ mutex_lock(&idr_lock);
-+ rc = idr_alloc(&dev_nums_idr, NULL, 0, TPM_NUM_DEVICES, GFP_KERNEL);
-+ mutex_unlock(&idr_lock);
-+ if (rc < 0) {
- dev_err(dev, "No available tpm device numbers\n");
- kfree(chip);
-- return ERR_PTR(-ENOMEM);
-+ return ERR_PTR(rc);
- }
--
-- set_bit(chip->dev_num, dev_mask);
-+ chip->dev_num = rc;
-
- device_initialize(&chip->dev);
-
-@@ -242,19 +249,28 @@ static int tpm_add_char_device(struct tpm_chip *chip)
- return rc;
- }
-
-+ /* Make the chip available. */
-+ mutex_lock(&idr_lock);
-+ idr_replace(&dev_nums_idr, chip, chip->dev_num);
-+ mutex_unlock(&idr_lock);
-+
- return rc;
- }
-
- static void tpm_del_char_device(struct tpm_chip *chip)
- {
- cdev_del(&chip->cdev);
-+ device_del(&chip->dev);
-+
-+ /* Make the chip unavailable. */
-+ mutex_lock(&idr_lock);
-+ idr_replace(&dev_nums_idr, NULL, chip->dev_num);
-+ mutex_unlock(&idr_lock);
-
- /* Make the driver uncallable. */
- down_write(&chip->ops_sem);
- chip->ops = NULL;
- up_write(&chip->ops_sem);
--
-- device_del(&chip->dev);
- }
-
- static int tpm1_chip_register(struct tpm_chip *chip)
-@@ -309,11 +325,6 @@ int tpm_chip_register(struct tpm_chip *chip)
- if (rc)
- goto out_err;
-
-- /* Make the chip available. */
-- spin_lock(&driver_lock);
-- list_add_tail_rcu(&chip->list, &tpm_chip_list);
-- spin_unlock(&driver_lock);
--
- chip->flags |= TPM_CHIP_FLAG_REGISTERED;
-
- if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
-@@ -350,11 +361,6 @@ void tpm_chip_unregister(struct tpm_chip *chip)
- if (!(chip->flags & TPM_CHIP_FLAG_REGISTERED))
- return;
-
-- spin_lock(&driver_lock);
-- list_del_rcu(&chip->list);
-- spin_unlock(&driver_lock);
-- synchronize_rcu();
--
- if (!(chip->flags & TPM_CHIP_FLAG_TPM2))
- sysfs_remove_link(&chip->dev.parent->kobj, "ppi");
-
-diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
-index 620ad1f..d509b32 100644
---- a/drivers/char/tpm/tpm-interface.c
-+++ b/drivers/char/tpm/tpm-interface.c
-@@ -1144,6 +1144,7 @@ static int __init tpm_init(void)
-
- static void __exit tpm_exit(void)
- {
-+ idr_destroy(&dev_nums_idr);
- class_destroy(tpm_class);
- unregister_chrdev_region(tpm_devt, TPM_NUM_DEVICES);
- }
-diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
-index 1816ab6..a561482 100644
---- a/drivers/char/tpm/tpm.h
-+++ b/drivers/char/tpm/tpm.h
-@@ -34,7 +34,7 @@
- enum tpm_const {
- TPM_MINOR = 224, /* officially assigned */
- TPM_BUFSIZE = 4096,
-- TPM_NUM_DEVICES = 256,
-+ TPM_NUM_DEVICES = 65536,
- TPM_RETRY = 50, /* 5 seconds */
- };
-
-@@ -195,8 +195,6 @@ struct tpm_chip {
- acpi_handle acpi_dev_handle;
- char ppi_version[TPM_PPI_VERSION_LEN + 1];
- #endif /* CONFIG_ACPI */
--
-- struct list_head list;
- };
-
- #define to_tpm_chip(d) container_of(d, struct tpm_chip, dev)
-@@ -492,6 +490,7 @@ static inline void tpm_buf_append_u32(struct tpm_buf *buf, const u32 value)
- extern struct class *tpm_class;
- extern dev_t tpm_devt;
- extern const struct file_operations tpm_fops;
-+extern struct idr dev_nums_idr;
-
- enum tpm_transmit_flags {
- TPM_TRANSMIT_UNLOCKED = BIT(0),
---
-2.10.2
-
diff --git a/patches.drivers/tpm-062-Remove-all-uses-of-drvdata-from-the-TPM-Core.patch b/patches.drivers/tpm-062-Remove-all-uses-of-drvdata-from-the-TPM-Core.patch
index 7568d53cf5..3b3a3d5dde 100644
--- a/patches.drivers/tpm-062-Remove-all-uses-of-drvdata-from-the-TPM-Core.patch
+++ b/patches.drivers/tpm-062-Remove-all-uses-of-drvdata-from-the-TPM-Core.patch
@@ -20,17 +20,15 @@ Tested-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- drivers/char/tpm/tpm-chip.c | 73 ++++++++++++++++++++++++++++------------
- drivers/char/tpm/tpm-interface.c | 7 ++--
- drivers/char/tpm/tpm-sysfs.c | 61 ++++++++++++++-------------------
- drivers/char/tpm/tpm.h | 10 +++---
+ drivers/char/tpm/tpm-chip.c | 73 +++++++++++++++++++++++++++------------
+ drivers/char/tpm/tpm-interface.c | 7 +--
+ drivers/char/tpm/tpm-sysfs.c | 61 +++++++++++++-------------------
+ drivers/char/tpm/tpm.h | 10 ++---
4 files changed, 84 insertions(+), 67 deletions(-)
-diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
-index 2ea2f15..57d9794 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
-@@ -170,9 +170,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *dev,
+@@ -170,9 +170,7 @@ struct tpm_chip *tpm_chip_alloc(struct d
chip->dev.class = tpm_class;
chip->dev.release = tpm_dev_release;
chip->dev.parent = dev;
@@ -40,7 +38,7 @@ index 2ea2f15..57d9794 100644
if (chip->dev_num == 0)
chip->dev.devt = MKDEV(MISC_MAJOR, TPM_MINOR);
-@@ -277,14 +275,10 @@ static void tpm_del_char_device(struct tpm_chip *chip)
+@@ -277,14 +275,10 @@ static void tpm_del_char_device(struct t
static int tpm1_chip_register(struct tpm_chip *chip)
{
@@ -56,7 +54,7 @@ index 2ea2f15..57d9794 100644
chip->bios_dir = tpm_bios_log_setup(dev_name(&chip->dev));
-@@ -298,10 +292,50 @@ static void tpm1_chip_unregister(struct tpm_chip *chip)
+@@ -298,10 +292,50 @@ static void tpm1_chip_unregister(struct
if (chip->bios_dir)
tpm_bios_log_teardown(chip->bios_dir);
@@ -108,7 +106,7 @@ index 2ea2f15..57d9794 100644
/*
* tpm_chip_register() - create a character device for the TPM chip
* @chip: TPM chip to use.
-@@ -324,24 +358,20 @@ int tpm_chip_register(struct tpm_chip *chip)
+@@ -324,24 +358,20 @@ int tpm_chip_register(struct tpm_chip *c
tpm_add_ppi(chip);
rc = tpm_add_char_device(chip);
@@ -141,7 +139,7 @@ index 2ea2f15..57d9794 100644
}
EXPORT_SYMBOL_GPL(tpm_chip_register);
-@@ -363,8 +393,7 @@ void tpm_chip_unregister(struct tpm_chip *chip)
+@@ -363,8 +393,7 @@ void tpm_chip_unregister(struct tpm_chip
if (!(chip->flags & TPM_CHIP_FLAG_REGISTERED))
return;
@@ -151,11 +149,9 @@ index 2ea2f15..57d9794 100644
tpm1_chip_unregister(chip);
tpm_del_char_device(chip);
-diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
-index 83361e5..b25a7e2 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
-@@ -434,12 +434,11 @@ static const struct tpm_input_header tpm_getcap_header = {
+@@ -434,12 +434,11 @@ static const struct tpm_input_header tpm
.ordinal = TPM_ORD_GET_CAP
};
@@ -169,7 +165,7 @@ index 83361e5..b25a7e2 100644
tpm_cmd.header.in = tpm_getcap_header;
if (subcap_id == CAP_VERSION_1_1 || subcap_id == CAP_VERSION_1_2) {
-@@ -939,7 +938,7 @@ static struct tpm_input_header savestate_header = {
+@@ -939,7 +938,7 @@ static struct tpm_input_header savestate
*/
int tpm_pm_suspend(struct device *dev)
{
@@ -187,20 +183,18 @@ index 83361e5..b25a7e2 100644
if (chip == NULL)
return -ENODEV;
-diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
-index 0f44b07..e1f7236 100644
--- a/drivers/char/tpm/tpm-sysfs.c
+++ b/drivers/char/tpm/tpm-sysfs.c
-@@ -36,7 +36,7 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
+@@ -36,7 +36,7 @@ static ssize_t pubek_show(struct device
int i, rc;
char *str = buf;
- struct tpm_chip *chip = dev_get_drvdata(dev);
+ struct tpm_chip *chip = to_tpm_chip(dev);
- tpm_cmd.header.in = tpm_readpubek_header;
- err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0,
-@@ -92,9 +92,9 @@ static ssize_t pcrs_show(struct device *dev, struct device_attribute *attr,
+ memset(&tpm_cmd, 0, sizeof(tpm_cmd));
+
+@@ -94,9 +94,9 @@ static ssize_t pcrs_show(struct device *
ssize_t rc;
int i, j, num_pcrs;
char *str = buf;
@@ -212,7 +206,7 @@ index 0f44b07..e1f7236 100644
"attempting to determine the number of PCRS");
if (rc)
return 0;
-@@ -119,8 +119,8 @@ static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
+@@ -121,8 +121,8 @@ static ssize_t enabled_show(struct devic
cap_t cap;
ssize_t rc;
@@ -223,7 +217,7 @@ index 0f44b07..e1f7236 100644
if (rc)
return 0;
-@@ -135,8 +135,8 @@ static ssize_t active_show(struct device *dev, struct device_attribute *attr,
+@@ -137,8 +137,8 @@ static ssize_t active_show(struct device
cap_t cap;
ssize_t rc;
@@ -234,7 +228,7 @@ index 0f44b07..e1f7236 100644
if (rc)
return 0;
-@@ -151,8 +151,8 @@ static ssize_t owned_show(struct device *dev, struct device_attribute *attr,
+@@ -153,8 +153,8 @@ static ssize_t owned_show(struct device
cap_t cap;
ssize_t rc;
@@ -245,7 +239,7 @@ index 0f44b07..e1f7236 100644
if (rc)
return 0;
-@@ -167,8 +167,8 @@ static ssize_t temp_deactivated_show(struct device *dev,
+@@ -169,8 +169,8 @@ static ssize_t temp_deactivated_show(str
cap_t cap;
ssize_t rc;
@@ -256,7 +250,7 @@ index 0f44b07..e1f7236 100644
if (rc)
return 0;
-@@ -180,11 +180,12 @@ static DEVICE_ATTR_RO(temp_deactivated);
+@@ -182,11 +182,12 @@ static DEVICE_ATTR_RO(temp_deactivated);
static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
@@ -270,7 +264,7 @@ index 0f44b07..e1f7236 100644
"attempting to determine the manufacturer");
if (rc)
return 0;
-@@ -192,8 +193,8 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
+@@ -194,8 +195,8 @@ static ssize_t caps_show(struct device *
be32_to_cpu(cap.manufacturer_id));
/* Try to get a TPM version 1.2 TPM_CAP_VERSION_INFO */
@@ -281,7 +275,7 @@ index 0f44b07..e1f7236 100644
if (!rc) {
str += sprintf(str,
"TCG version: %d.%d\nFirmware version: %d.%d\n",
-@@ -203,7 +204,7 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
+@@ -205,7 +206,7 @@ static ssize_t caps_show(struct device *
cap.tpm_version_1_2.revMinor);
} else {
/* Otherwise just use TPM_STRUCT_VER */
@@ -290,7 +284,7 @@ index 0f44b07..e1f7236 100644
"attempting to determine the 1.1 version");
if (rc)
return 0;
-@@ -222,7 +223,7 @@ static DEVICE_ATTR_RO(caps);
+@@ -224,7 +225,7 @@ static DEVICE_ATTR_RO(caps);
static ssize_t cancel_store(struct device *dev, struct device_attribute *attr,
const char *buf, size_t count)
{
@@ -299,7 +293,7 @@ index 0f44b07..e1f7236 100644
if (chip == NULL)
return 0;
-@@ -234,7 +235,7 @@ static DEVICE_ATTR_WO(cancel);
+@@ -236,7 +237,7 @@ static DEVICE_ATTR_WO(cancel);
static ssize_t durations_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
@@ -308,7 +302,7 @@ index 0f44b07..e1f7236 100644
if (chip->duration[TPM_LONG] == 0)
return 0;
-@@ -251,7 +252,7 @@ static DEVICE_ATTR_RO(durations);
+@@ -253,7 +254,7 @@ static DEVICE_ATTR_RO(durations);
static ssize_t timeouts_show(struct device *dev, struct device_attribute *attr,
char *buf)
{
@@ -317,7 +311,7 @@ index 0f44b07..e1f7236 100644
return sprintf(buf, "%d %d %d %d [%s]\n",
jiffies_to_usecs(chip->timeout_a),
-@@ -281,24 +282,12 @@ static const struct attribute_group tpm_dev_group = {
+@@ -283,24 +284,12 @@ static const struct attribute_group tpm_
.attrs = tpm_dev_attrs,
};
@@ -348,8 +342,6 @@ index 0f44b07..e1f7236 100644
+ WARN_ON(chip->groups_cnt != 0);
+ chip->groups[chip->groups_cnt++] = &tpm_dev_group;
}
-diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
-index c88cf48..5fcfebd 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -168,9 +168,9 @@ struct tpm_chip {
@@ -364,7 +356,7 @@ index c88cf48..5fcfebd 100644
acpi_handle acpi_dev_handle;
char ppi_version[TPM_PPI_VERSION_LEN + 1];
#endif /* CONFIG_ACPI */
-@@ -479,7 +479,8 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
+@@ -479,7 +479,8 @@ ssize_t tpm_transmit(struct tpm_chip *ch
unsigned int flags);
ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, int len,
unsigned int flags, const char *desc);
@@ -374,7 +366,7 @@ index c88cf48..5fcfebd 100644
extern int tpm_get_timeouts(struct tpm_chip *);
extern void tpm_gen_interrupt(struct tpm_chip *);
extern int tpm_do_selftest(struct tpm_chip *);
-@@ -500,8 +501,7 @@ extern struct tpm_chip *tpmm_chip_alloc(struct device *pdev,
+@@ -500,8 +501,7 @@ extern struct tpm_chip *tpmm_chip_alloc(
extern int tpm_chip_register(struct tpm_chip *chip);
extern void tpm_chip_unregister(struct tpm_chip *chip);
@@ -384,6 +376,3 @@ index c88cf48..5fcfebd 100644
int tpm_pcr_read_dev(struct tpm_chip *chip, int pcr_idx, u8 *res_buf);
---
-2.10.2
-
diff --git a/patches.drivers/tpm-137-Check-size-of-response-before-accessing-data.patch b/patches.drivers/tpm-137-Check-size-of-response-before-accessing-data.patch
index 65cd4134b7..16d85d406f 100644
--- a/patches.drivers/tpm-137-Check-size-of-response-before-accessing-data.patch
+++ b/patches.drivers/tpm-137-Check-size-of-response-before-accessing-data.patch
@@ -17,18 +17,16 @@ Tested-by: Jarkko Sakkinen <jarkko.sakkine@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkine@linux.intel.com>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- drivers/char/tpm/tpm-interface.c | 70 ++++++++++++++++++++++++++++------------
- drivers/char/tpm/tpm-sysfs.c | 28 ++++++++++------
- drivers/char/tpm/tpm.h | 7 ++--
- drivers/char/tpm/tpm2-cmd.c | 66 +++++++++++++++++++++++++++----------
- drivers/char/tpm/tpm_tis_core.c | 3 +-
+ drivers/char/tpm/tpm-interface.c | 70 +++++++++++++++++++++++++++------------
+ drivers/char/tpm/tpm-sysfs.c | 28 ++++++++++-----
+ drivers/char/tpm/tpm.h | 7 ++-
+ drivers/char/tpm/tpm2-cmd.c | 66 +++++++++++++++++++++++++++---------
+ drivers/char/tpm/tpm_tis_core.c | 3 +
5 files changed, 123 insertions(+), 51 deletions(-)
-diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
-index a3461cbdde5f..2ea16abb5dc9 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
-@@ -423,8 +423,9 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
+@@ -423,8 +423,9 @@ out:
* The function extracts tpm out header return code
*
* @chip: TPM chip to use
@@ -40,7 +38,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
* @flags: tpm transmit flags - bitmap
* @desc: command description used in the error message
*
-@@ -433,26 +434,35 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
+@@ -433,26 +434,35 @@ out:
* A negative number for system errors (errno).
* A positive number for a TPM error.
*/
@@ -72,16 +70,16 @@ index a3461cbdde5f..2ea16abb5dc9 100644
desc);
+ if (err)
+ return err;
-+
-+ if (len < min_rsp_body_length + TPM_HEADER_SIZE)
-+ return -EFAULT;
- return err;
++ if (len < min_rsp_body_length + TPM_HEADER_SIZE)
++ return -EFAULT;
++
+ return 0;
}
#define TPM_DIGEST_SIZE 20
-@@ -468,7 +478,7 @@ static const struct tpm_input_header tpm_getcap_header = {
+@@ -468,7 +478,7 @@ static const struct tpm_input_header tpm
};
ssize_t tpm_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap,
@@ -90,7 +88,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
{
struct tpm_cmd_t tpm_cmd;
int rc;
-@@ -491,8 +501,8 @@ ssize_t tpm_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap,
+@@ -491,8 +501,8 @@ ssize_t tpm_getcap(struct tpm_chip *chip
tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
tpm_cmd.params.getcap_in.subcap = cpu_to_be32(subcap_id);
}
@@ -101,7 +99,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
if (!rc)
*cap = tpm_cmd.params.getcap_out.cap;
return rc;
-@@ -516,7 +526,7 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type)
+@@ -516,7 +526,7 @@ static int tpm_startup(struct tpm_chip *
start_cmd.params.startup_in.startup_type = startup_type;
return tpm_transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
@@ -110,7 +108,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
}
int tpm_get_timeouts(struct tpm_chip *chip)
-@@ -545,7 +555,8 @@ int tpm_get_timeouts(struct tpm_chip *chip)
+@@ -545,7 +555,8 @@ int tpm_get_timeouts(struct tpm_chip *ch
return 0;
}
@@ -120,7 +118,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
if (rc == TPM_ERR_INVALID_POSTINIT) {
/* The TPM is not started, we are the first to talk to it.
Execute a startup command. */
-@@ -554,8 +565,10 @@ int tpm_get_timeouts(struct tpm_chip *chip)
+@@ -554,8 +565,10 @@ int tpm_get_timeouts(struct tpm_chip *ch
return rc;
rc = tpm_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap,
@@ -132,7 +130,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
if (rc) {
dev_err(&chip->dev,
"A TPM error (%zd) occurred attempting to determine the timeouts\n",
-@@ -617,7 +630,8 @@ int tpm_get_timeouts(struct tpm_chip *chip)
+@@ -617,7 +630,8 @@ int tpm_get_timeouts(struct tpm_chip *ch
chip->timeout_d = usecs_to_jiffies(timeout_eff[3]);
rc = tpm_getcap(chip, TPM_CAP_PROP_TIS_DURATION, &cap,
@@ -142,7 +140,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
if (rc)
return rc;
-@@ -668,13 +682,14 @@ static int tpm_continue_selftest(struct tpm_chip *chip)
+@@ -668,13 +682,14 @@ static int tpm_continue_selftest(struct
struct tpm_cmd_t cmd;
cmd.header.in = continue_selftest_header;
@@ -158,7 +156,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
static const struct tpm_input_header pcrread_header = {
.tag = TPM_TAG_RQU_COMMAND,
.length = cpu_to_be32(14),
-@@ -688,7 +703,8 @@ int tpm_pcr_read_dev(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
+@@ -688,7 +703,8 @@ int tpm_pcr_read_dev(struct tpm_chip *ch
cmd.header.in = pcrread_header;
cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
@@ -176,7 +174,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
static const struct tpm_input_header pcrextend_header = {
.tag = TPM_TAG_RQU_COMMAND,
.length = cpu_to_be32(34),
-@@ -786,7 +803,8 @@ int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash)
+@@ -786,7 +803,8 @@ int tpm_pcr_extend(u32 chip_num, int pcr
cmd.header.in = pcrextend_header;
cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
@@ -186,7 +184,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
"attempting extend a PCR value");
tpm_put_ops(chip);
-@@ -890,7 +908,7 @@ int tpm_send(u32 chip_num, void *cmd, size_t buflen)
+@@ -890,7 +908,7 @@ int tpm_send(u32 chip_num, void *cmd, si
if (chip == NULL)
return -ENODEV;
@@ -214,7 +212,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
/*
* If the TPM indicates that it is too busy to respond to
-@@ -1062,7 +1081,7 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
+@@ -1062,7 +1081,7 @@ int tpm_get_random(u32 chip_num, u8 *out
{
struct tpm_chip *chip;
struct tpm_cmd_t tpm_cmd;
@@ -223,7 +221,7 @@ index a3461cbdde5f..2ea16abb5dc9 100644
int err, total = 0, retries = 5;
u8 *dest = out;
-@@ -1085,11 +1104,20 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
+@@ -1085,11 +1104,20 @@ int tpm_get_random(u32 chip_num, u8 *out
err = tpm_transmit_cmd(chip, &tpm_cmd,
TPM_GETRANDOM_RESULT_SIZE + num_bytes,
@@ -244,8 +242,6 @@ index a3461cbdde5f..2ea16abb5dc9 100644
memcpy(dest, tpm_cmd.params.getrandom_out.rng_data, recd);
dest += recd;
-diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
-index 848ad6580b46..2f596d74f80c 100644
--- a/drivers/char/tpm/tpm-sysfs.c
+++ b/drivers/char/tpm/tpm-sysfs.c
@@ -21,6 +21,7 @@
@@ -256,8 +252,8 @@ index 848ad6580b46..2f596d74f80c 100644
#define TPM_ORD_READPUBEK cpu_to_be32(124)
static const struct tpm_input_header tpm_readpubek_header = {
.tag = TPM_TAG_RQU_COMMAND,
-@@ -39,7 +40,8 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
- struct tpm_chip *chip = to_tpm_chip(dev);
+@@ -41,7 +42,8 @@ static ssize_t pubek_show(struct device
+ memset(&tpm_cmd, 0, sizeof(tpm_cmd));
tpm_cmd.header.in = tpm_readpubek_header;
- err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0,
@@ -266,7 +262,7 @@ index 848ad6580b46..2f596d74f80c 100644
"attempting to read the PUBEK");
if (err)
goto out;
-@@ -95,7 +97,8 @@ static ssize_t pcrs_show(struct device *dev, struct device_attribute *attr,
+@@ -97,7 +99,8 @@ static ssize_t pcrs_show(struct device *
struct tpm_chip *chip = to_tpm_chip(dev);
rc = tpm_getcap(chip, TPM_CAP_PROP_PCR, &cap,
@@ -276,7 +272,7 @@ index 848ad6580b46..2f596d74f80c 100644
if (rc)
return 0;
-@@ -120,7 +123,8 @@ static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
+@@ -122,7 +125,8 @@ static ssize_t enabled_show(struct devic
ssize_t rc;
rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_PERM, &cap,
@@ -286,7 +282,7 @@ index 848ad6580b46..2f596d74f80c 100644
if (rc)
return 0;
-@@ -136,7 +140,8 @@ static ssize_t active_show(struct device *dev, struct device_attribute *attr,
+@@ -138,7 +142,8 @@ static ssize_t active_show(struct device
ssize_t rc;
rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_PERM, &cap,
@@ -296,7 +292,7 @@ index 848ad6580b46..2f596d74f80c 100644
if (rc)
return 0;
-@@ -152,7 +157,8 @@ static ssize_t owned_show(struct device *dev, struct device_attribute *attr,
+@@ -154,7 +159,8 @@ static ssize_t owned_show(struct device
ssize_t rc;
rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_PROP_OWNER, &cap,
@@ -306,7 +302,7 @@ index 848ad6580b46..2f596d74f80c 100644
if (rc)
return 0;
-@@ -168,7 +174,8 @@ static ssize_t temp_deactivated_show(struct device *dev,
+@@ -170,7 +176,8 @@ static ssize_t temp_deactivated_show(str
ssize_t rc;
rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_VOL, &cap,
@@ -316,7 +312,7 @@ index 848ad6580b46..2f596d74f80c 100644
if (rc)
return 0;
-@@ -186,7 +193,8 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
+@@ -188,7 +195,8 @@ static ssize_t caps_show(struct device *
char *str = buf;
rc = tpm_getcap(chip, TPM_CAP_PROP_MANUFACTURER, &cap,
@@ -326,7 +322,7 @@ index 848ad6580b46..2f596d74f80c 100644
if (rc)
return 0;
str += sprintf(str, "Manufacturer: 0x%x\n",
-@@ -194,7 +202,8 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
+@@ -196,7 +204,8 @@ static ssize_t caps_show(struct device *
/* Try to get a TPM version 1.2 TPM_CAP_VERSION_INFO */
rc = tpm_getcap(chip, TPM_CAP_VERSION_1_2, &cap,
@@ -336,7 +332,7 @@ index 848ad6580b46..2f596d74f80c 100644
if (!rc) {
str += sprintf(str,
"TCG version: %d.%d\nFirmware version: %d.%d\n",
-@@ -205,7 +214,8 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
+@@ -207,7 +216,8 @@ static ssize_t caps_show(struct device *
} else {
/* Otherwise just use TPM_STRUCT_VER */
rc = tpm_getcap(chip, TPM_CAP_VERSION_1_1, &cap,
@@ -346,8 +342,6 @@ index 848ad6580b46..2f596d74f80c 100644
if (rc)
return 0;
str += sprintf(str,
-diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
-index 1ae976894257..7216bd78b643 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -493,10 +493,11 @@ enum tpm_transmit_flags {
@@ -365,11 +359,9 @@ index 1ae976894257..7216bd78b643 100644
int tpm_get_timeouts(struct tpm_chip *);
int tpm1_auto_startup(struct tpm_chip *chip);
int tpm_do_selftest(struct tpm_chip *chip);
-diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
-index 6eda2395f2cf..a0199f18f7fb 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
-@@ -248,6 +248,9 @@ static const u8 tpm2_ordinal_duration[TPM2_CC_LAST - TPM2_CC_FIRST + 1] = {
+@@ -248,6 +248,9 @@ static const u8 tpm2_ordinal_duration[TP
(sizeof(struct tpm_input_header) + \
sizeof(struct tpm2_pcr_read_in))
@@ -379,7 +371,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
static const struct tpm_input_header tpm2_pcrread_header = {
.tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
.length = cpu_to_be32(TPM2_PCR_READ_IN_SIZE),
-@@ -280,8 +283,9 @@ int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
+@@ -280,8 +283,9 @@ int tpm2_pcr_read(struct tpm_chip *chip,
sizeof(cmd.params.pcrread_in.pcr_select));
cmd.params.pcrread_in.pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
@@ -391,7 +383,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
if (rc == 0) {
buf = cmd.params.pcrread_out.digest;
memcpy(res_buf, buf, TPM_DIGEST_SIZE);
-@@ -327,7 +331,7 @@ int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, const u8 *hash)
+@@ -327,7 +331,7 @@ int tpm2_pcr_extend(struct tpm_chip *chi
cmd.params.pcrextend_in.hash_alg = cpu_to_be16(TPM2_ALG_SHA1);
memcpy(cmd.params.pcrextend_in.digest, hash, TPM_DIGEST_SIZE);
@@ -400,7 +392,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
"attempting extend a PCR value");
return rc;
-@@ -356,7 +360,7 @@ static const struct tpm_input_header tpm2_getrandom_header = {
+@@ -356,7 +360,7 @@ static const struct tpm_input_header tpm
int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
{
struct tpm2_cmd cmd;
@@ -409,7 +401,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
u32 num_bytes;
int err;
int total = 0;
-@@ -373,13 +377,19 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
+@@ -373,13 +377,19 @@ int tpm2_get_random(struct tpm_chip *chi
cmd.header.in = tpm2_getrandom_header;
cmd.params.getrandom_in.size = cpu_to_be16(num_bytes);
@@ -431,7 +423,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
memcpy(dest, cmd.params.getrandom_out.buffer, recd);
dest += recd;
-@@ -394,6 +404,9 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
+@@ -394,6 +404,9 @@ int tpm2_get_random(struct tpm_chip *chi
(sizeof(struct tpm_input_header) + \
sizeof(struct tpm2_get_tpm_pt_in))
@@ -441,7 +433,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
static const struct tpm_input_header tpm2_get_tpm_pt_header = {
.tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
.length = cpu_to_be32(TPM2_GET_TPM_PT_IN_SIZE),
-@@ -445,7 +458,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
+@@ -445,7 +458,7 @@ int tpm2_seal_trusted(struct tpm_chip *c
{
unsigned int blob_len;
struct tpm_buf buf;
@@ -450,7 +442,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
int i;
int rc;
-@@ -510,7 +523,8 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
+@@ -510,7 +523,8 @@ int tpm2_seal_trusted(struct tpm_chip *c
goto out;
}
@@ -460,7 +452,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
if (rc)
goto out;
-@@ -519,6 +533,11 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
+@@ -519,6 +533,11 @@ int tpm2_seal_trusted(struct tpm_chip *c
rc = -E2BIG;
goto out;
}
@@ -472,7 +464,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
memcpy(payload->blob, &buf.data[TPM_HEADER_SIZE + 4], blob_len);
payload->blob_len = blob_len;
-@@ -588,7 +607,8 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
+@@ -588,7 +607,8 @@ static int tpm2_load_cmd(struct tpm_chip
goto out;
}
@@ -482,7 +474,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
if (!rc)
*blob_handle = be32_to_cpup(
(__be32 *) &buf.data[TPM_HEADER_SIZE]);
-@@ -626,7 +646,7 @@ static void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle,
+@@ -626,7 +646,7 @@ static void tpm2_flush_context_cmd(struc
tpm_buf_append_u32(&buf, handle);
@@ -491,7 +483,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
"flushing context");
if (rc)
dev_warn(&chip->dev, "0x%08x was not flushed, rc=%d\n", handle,
-@@ -657,6 +677,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
+@@ -657,6 +677,7 @@ static int tpm2_unseal_cmd(struct tpm_ch
u16 data_len;
u8 *data;
int rc;
@@ -499,7 +491,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_UNSEAL);
if (rc)
-@@ -671,13 +692,21 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
+@@ -671,13 +692,21 @@ static int tpm2_unseal_cmd(struct tpm_ch
options->blobauth /* hmac */,
TPM_DIGEST_SIZE);
@@ -522,7 +514,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
data = &buf.data[TPM_HEADER_SIZE + 6];
memcpy(payload->key, data, data_len - 1);
-@@ -685,6 +714,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
+@@ -685,6 +714,7 @@ static int tpm2_unseal_cmd(struct tpm_ch
payload->migratable = data[data_len - 1];
}
@@ -530,7 +522,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
tpm_buf_destroy(&buf);
return rc;
}
-@@ -739,7 +769,8 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id, u32 *value,
+@@ -739,7 +769,8 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip
cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(property_id);
cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
@@ -540,7 +532,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
if (!rc)
*value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
-@@ -773,7 +804,7 @@ static int tpm2_startup(struct tpm_chip *chip, u16 startup_type)
+@@ -773,7 +804,7 @@ static int tpm2_startup(struct tpm_chip
cmd.header.in = tpm2_startup_header;
cmd.params.startup_in.startup_type = cpu_to_be16(startup_type);
@@ -549,7 +541,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
"attempting to start the TPM");
}
-@@ -802,7 +833,8 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
+@@ -802,7 +833,8 @@ void tpm2_shutdown(struct tpm_chip *chip
cmd.header.in = tpm2_shutdown_header;
cmd.params.startup_in.startup_type = cpu_to_be16(shutdown_type);
@@ -559,7 +551,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
/* In places where shutdown command is sent there's no much we can do
* except print the error code on a system failure.
-@@ -865,7 +897,7 @@ static int tpm2_start_selftest(struct tpm_chip *chip, bool full)
+@@ -865,7 +897,7 @@ static int tpm2_start_selftest(struct tp
cmd.header.in = tpm2_selftest_header;
cmd.params.selftest_in.full_test = full;
@@ -568,7 +560,7 @@ index 6eda2395f2cf..a0199f18f7fb 100644
"continue selftest");
/* At least some prototype chips seem to give RC_TESTING error
-@@ -916,7 +948,7 @@ static int tpm2_do_selftest(struct tpm_chip *chip)
+@@ -916,7 +948,7 @@ static int tpm2_do_selftest(struct tpm_c
cmd.params.pcrread_in.pcr_select[1] = 0x00;
cmd.params.pcrread_in.pcr_select[2] = 0x00;
@@ -586,11 +578,9 @@ index 6eda2395f2cf..a0199f18f7fb 100644
if (rc < 0)
return rc;
-diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
-index 0cfc0eed8525..45f8840ee678 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
-@@ -552,7 +552,8 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
+@@ -552,7 +552,8 @@ static int tpm_tis_gen_interrupt(struct
if (chip->flags & TPM_CHIP_FLAG_TPM2)
return tpm2_get_tpm_pt(chip, 0x100, &cap2, desc);
else
@@ -600,6 +590,3 @@ index 0cfc0eed8525..45f8840ee678 100644
}
/* Register the IRQ and issue a command that will cause an interrupt. If an
---
-2.10.2
-
diff --git a/patches.fixes/ACPI-scan-Prefer-devices-without-_HID-for-_ADR-match.patch b/patches.fixes/ACPI-scan-Prefer-devices-without-_HID-for-_ADR-match.patch
new file mode 100644
index 0000000000..102ab3d670
--- /dev/null
+++ b/patches.fixes/ACPI-scan-Prefer-devices-without-_HID-for-_ADR-match.patch
@@ -0,0 +1,56 @@
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Sat, 1 Apr 2017 00:45:52 +0200
+Subject: ACPI / scan: Prefer devices without _HID for _ADR matching
+Git-commit: fdad4e7a876a2cb3d2c1f04e5418c324e79fffef
+Patch-mainline: v4.11-rc6
+References: git-fixes
+
+Commit c2a6bbaf0c5f (ACPI / scan: Prefer devices without _HID/_CID
+for _ADR matching) added a list_empty(&adev->pnp.ids) check to
+find_child_checks() so as to catch situations in which the ACPI
+core attempts to decode _ADR for a device having a _HID too which
+is strictly against the spec. However, it overlooked the fact that
+the adev->pnp.ids list for the devices taken into account by
+find_child_checks() may contain device IDs set internally by the
+kernel, like "LNXVIDEO" (thanks to Zhang Rui for that realization),
+and it broke the enumeration of those devices as a result.
+
+To unbreak it, replace the overly coarse grained list_empty()
+check with a much more precise check against the pnp.type.platform_id
+flag which is only set for devices having a _HID (that's how it
+should be done from the start, as having both _ADR and _CID is
+actually permitted).
+
+Fixes: c2a6bbaf0c5f (ACPI / scan: Prefer devices without _HID/_CID for _ADR matching)
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=194889
+Reported-and-tested-by: Mike <mike@mikewilson.me.uk>
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Cc: 4.10+ <stable@vger.kernel.org> # 4.10+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/acpi/glue.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/acpi/glue.c
++++ b/drivers/acpi/glue.c
+@@ -99,13 +99,13 @@ static int find_child_checks(struct acpi
+ return -ENODEV;
+
+ /*
+- * If the device has a _HID (or _CID) returning a valid ACPI/PNP
+- * device ID, it is better to make it look less attractive here, so that
+- * the other device with the same _ADR value (that may not have a valid
+- * device ID) can be matched going forward. [This means a second spec
+- * violation in a row, so whatever we do here is best effort anyway.]
++ * If the device has a _HID returning a valid ACPI/PNP device ID, it is
++ * better to make it look less attractive here, so that the other device
++ * with the same _ADR value (that may not have a valid device ID) can be
++ * matched going forward. [This means a second spec violation in a row,
++ * so whatever we do here is best effort anyway.]
+ */
+- return sta_present && list_empty(&adev->pnp.ids) ?
++ return sta_present && !adev->pnp.type.platform_id ?
+ FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE;
+ }
+
diff --git a/patches.fixes/Revert-powerpc-numa-Fix-percpu-allocations-to-be-NUM b/patches.fixes/Revert-powerpc-numa-Fix-percpu-allocations-to-be-NUM
deleted file mode 100644
index a3d6eeef85..0000000000
--- a/patches.fixes/Revert-powerpc-numa-Fix-percpu-allocations-to-be-NUM
+++ /dev/null
@@ -1,82 +0,0 @@
-From 3e475ebf8b669d9d9f879460f84533f53f2eecc2 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Fri, 21 Jul 2017 15:15:21 +0200
-Subject: [PATCH] Revert "powerpc/numa: Fix percpu allocations to be NUMA
- aware"
-References: bsc#1048914
-Patch-mainline: No, a quick stop-gap solution
-
-This reverts commit 8c92870bdbf2 ("powerpc/numa: Fix percpu
-allocations to be NUMA aware") included in 4.4.72 stable, as it
-introduced a regression on 192core + 32TB brazos as found in
-bsc#1048914.
-
-As Jiri Kosina explained in the bugzilla:
-"Which basically means, that prior to this commit, percpu allocator on
- powerpc was (wrongly) allocating all percpu areas on NUMA node 0. With
- this commit applied, the percpu allocations are properly spread across
- all the NUMA nodes.
-
- I believe this might potentially have other side-effects, especially
- with respect to how the distance is being calculated in
- pcpu_get_vm_areas(); it might be that the calculation gets confused
- (it's also possible that pcpu_get_vm_areas() is running so early that
- not all NUMA structures have been properly initialized -- this would
- have to be confirmed by someone more familiar with the ppc arch
- code)."
-
-Ideally this should be done in the stable tree, but we're in hurry so
-we take this now as a quick stop-gap fix.
-
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-
----
- arch/powerpc/include/asm/topology.h | 14 --------------
- arch/powerpc/kernel/setup_64.c | 4 ++--
- 2 files changed, 2 insertions(+), 16 deletions(-)
-
---- a/arch/powerpc/include/asm/topology.h
-+++ b/arch/powerpc/include/asm/topology.h
-@@ -44,22 +44,8 @@ extern void __init dump_numa_cpu_topolog
- extern int sysfs_add_device_to_node(struct device *dev, int nid);
- extern void sysfs_remove_device_from_node(struct device *dev, int nid);
-
--static inline int early_cpu_to_node(int cpu)
--{
-- int nid;
--
-- nid = numa_cpu_lookup_table[cpu];
--
-- /*
-- * Fall back to node 0 if nid is unset (it should be, except bugs).
-- * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)).
-- */
-- return (nid < 0) ? 0 : nid;
--}
- #else
-
--static inline int early_cpu_to_node(int cpu) { return 0; }
--
- static inline void dump_numa_cpu_topology(void) {}
-
- static inline int sysfs_add_device_to_node(struct device *dev, int nid)
---- a/arch/powerpc/kernel/setup_64.c
-+++ b/arch/powerpc/kernel/setup_64.c
-@@ -763,7 +763,7 @@ void __init setup_arch(char **cmdline_p)
-
- static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align)
- {
-- return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align,
-+ return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align,
- __pa(MAX_DMA_ADDRESS));
- }
-
-@@ -774,7 +774,7 @@ static void __init pcpu_fc_free(void *pt
-
- static int pcpu_cpu_distance(unsigned int from, unsigned int to)
- {
-- if (early_cpu_to_node(from) == early_cpu_to_node(to))
-+ if (cpu_to_node(from) == cpu_to_node(to))
- return LOCAL_DISTANCE;
- else
- return REMOTE_DISTANCE;
diff --git a/patches.fixes/af_key-add-lock-to-key-dump.patch b/patches.fixes/af_key-add-lock-to-key-dump.patch
deleted file mode 100644
index 47766931e5..0000000000
--- a/patches.fixes/af_key-add-lock-to-key-dump.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From: Yuejie Shi <syjcnss@gmail.com>
-Date: Fri, 31 Mar 2017 15:10:20 +0800
-Subject: af_key: Add lock to key dump
-Git-commit: 89e357d83c06b6fac581c3ca7f0ee3ae7e67109e
-Patch-mainline: v4.11-rc8
-References: bsc#1047653
-
-A dump may come in the middle of another dump, modifying its dump
-structure members. This race condition will result in NULL pointer
-dereference in kernel. So add a lock to prevent that race.
-
-Fixes: 83321d6b9872 ("[AF_KEY]: Dump SA/SP entries non-atomically")
-Signed-off-by: Yuejie Shi <syjcnss@gmail.com>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-Acked-by: Luis Henriques <lhenriques@suse.com>
----
- net/key/af_key.c | 46 ++++++++++++++++++++++++++++++++++++++--------
- 1 file changed, 38 insertions(+), 8 deletions(-)
-
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -63,6 +63,7 @@ struct pfkey_sock {
- } u;
- struct sk_buff *skb;
- } dump;
-+ struct mutex dump_lock;
- };
-
- static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
-@@ -143,6 +144,7 @@ static int pfkey_create(struct net *net,
- {
- struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
- struct sock *sk;
-+ struct pfkey_sock *pfk;
- int err;
-
- if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
-@@ -157,6 +159,9 @@ static int pfkey_create(struct net *net,
- if (sk == NULL)
- goto out;
-
-+ pfk = pfkey_sk(sk);
-+ mutex_init(&pfk->dump_lock);
-+
- sock->ops = &pfkey_ops;
- sock_init_data(sock, sk);
-
-@@ -285,13 +290,23 @@ static int pfkey_do_dump(struct pfkey_so
- struct sadb_msg *hdr;
- int rc;
-
-+ mutex_lock(&pfk->dump_lock);
-+ if (!pfk->dump.dump) {
-+ rc = 0;
-+ goto out;
-+ }
-+
- rc = pfk->dump.dump(pfk);
-- if (rc == -ENOBUFS)
-- return 0;
-+ if (rc == -ENOBUFS) {
-+ rc = 0;
-+ goto out;
-+ }
-
- if (pfk->dump.skb) {
-- if (!pfkey_can_dump(&pfk->sk))
-- return 0;
-+ if (!pfkey_can_dump(&pfk->sk)) {
-+ rc = 0;
-+ goto out;
-+ }
-
- hdr = (struct sadb_msg *) pfk->dump.skb->data;
- hdr->sadb_msg_seq = 0;
-@@ -302,6 +317,9 @@ static int pfkey_do_dump(struct pfkey_so
- }
-
- pfkey_terminate_dump(pfk);
-+
-+out:
-+ mutex_unlock(&pfk->dump_lock);
- return rc;
- }
-
-@@ -1806,19 +1824,26 @@ static int pfkey_dump(struct sock *sk, s
- struct xfrm_address_filter *filter = NULL;
- struct pfkey_sock *pfk = pfkey_sk(sk);
-
-- if (pfk->dump.dump != NULL)
-+ mutex_lock(&pfk->dump_lock);
-+ if (pfk->dump.dump != NULL) {
-+ mutex_unlock(&pfk->dump_lock);
- return -EBUSY;
-+ }
-
- proto = pfkey_satype2proto(hdr->sadb_msg_satype);
-- if (proto == 0)
-+ if (proto == 0) {
-+ mutex_unlock(&pfk->dump_lock);
- return -EINVAL;
-+ }
-
- if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
- struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
-
- filter = kmalloc(sizeof(*filter), GFP_KERNEL);
-- if (filter == NULL)
-+ if (filter == NULL) {
-+ mutex_unlock(&pfk->dump_lock);
- return -ENOMEM;
-+ }
-
- memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr,
- sizeof(xfrm_address_t));
-@@ -1834,6 +1859,7 @@ static int pfkey_dump(struct sock *sk, s
- pfk->dump.dump = pfkey_dump_sa;
- pfk->dump.done = pfkey_dump_sa_done;
- xfrm_state_walk_init(&pfk->dump.u.state, proto, filter);
-+ mutex_unlock(&pfk->dump_lock);
-
- return pfkey_do_dump(pfk);
- }
-@@ -2693,14 +2719,18 @@ static int pfkey_spddump(struct sock *sk
- {
- struct pfkey_sock *pfk = pfkey_sk(sk);
-
-- if (pfk->dump.dump != NULL)
-+ mutex_lock(&pfk->dump_lock);
-+ if (pfk->dump.dump != NULL) {
-+ mutex_unlock(&pfk->dump_lock);
- return -EBUSY;
-+ }
-
- pfk->dump.msg_version = hdr->sadb_msg_version;
- pfk->dump.msg_portid = hdr->sadb_msg_pid;
- pfk->dump.dump = pfkey_dump_sp;
- pfk->dump.done = pfkey_dump_sp_done;
- xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN);
-+ mutex_unlock(&pfk->dump_lock);
-
- return pfkey_do_dump(pfk);
- }
diff --git a/patches.fixes/dentry-name-snapshots.patch b/patches.fixes/dentry-name-snapshots.patch
deleted file mode 100644
index b9028ae641..0000000000
--- a/patches.fixes/dentry-name-snapshots.patch
+++ /dev/null
@@ -1,231 +0,0 @@
-From 49d31c2f389acfe83417083e1208422b4091cd9e Mon Sep 17 00:00:00 2001
-From: Al Viro <viro@zeniv.linux.org.uk>
-Date: Fri, 7 Jul 2017 14:51:19 -0400
-Subject: [PATCH] dentry name snapshots
-Git-commit: 49d31c2f389acfe83417083e1208422b4091cd9e
-Patch-mainline: v4.13-rc1
-References: CVE-2017-7533 bsc#1049483
-
-take_dentry_name_snapshot() takes a safe snapshot of dentry name;
-if the name is a short one, it gets copied into caller-supplied
-structure, otherwise an extra reference to external name is grabbed
-(those are never modified). In either case the pointer to stable
-string is stored into the same structure.
-
-dentry must be held by the caller of take_dentry_name_snapshot(),
-but may be freely dropped afterwards - the snapshot will stay
-until destroyed by release_dentry_name_snapshot().
-
-Intended use:
- struct name_snapshot s;
-
- take_dentry_name_snapshot(&s, dentry);
- ...
- access s.name
- ...
- release_dentry_name_snapshot(&s);
-
-Replaces fsnotify_oldname_...(), gets used in fsnotify to obtain the name
-to pass down with event.
-
-Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-Acked-by: Jan Kara <jack@suse.cz>
-
----
- fs/dcache.c | 27 +++++++++++++++++++++++++++
- fs/debugfs/inode.c | 10 +++++-----
- fs/namei.c | 8 ++++----
- fs/notify/fsnotify.c | 8 ++++++--
- include/linux/dcache.h | 6 ++++++
- include/linux/fsnotify.h | 31 -------------------------------
- 6 files changed, 48 insertions(+), 42 deletions(-)
-
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -271,6 +271,33 @@ static inline int dname_external(const s
- return dentry->d_name.name != dentry->d_iname;
- }
-
-+void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry)
-+{
-+ spin_lock(&dentry->d_lock);
-+ if (unlikely(dname_external(dentry))) {
-+ struct external_name *p = external_name(dentry);
-+ atomic_inc(&p->u.count);
-+ spin_unlock(&dentry->d_lock);
-+ name->name = p->name;
-+ } else {
-+ memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN);
-+ spin_unlock(&dentry->d_lock);
-+ name->name = name->inline_name;
-+ }
-+}
-+EXPORT_SYMBOL(take_dentry_name_snapshot);
-+
-+void release_dentry_name_snapshot(struct name_snapshot *name)
-+{
-+ if (unlikely(name->name != name->inline_name)) {
-+ struct external_name *p;
-+ p = container_of(name->name, struct external_name, name[0]);
-+ if (unlikely(atomic_dec_and_test(&p->u.count)))
-+ kfree_rcu(p, u.head);
-+ }
-+}
-+EXPORT_SYMBOL(release_dentry_name_snapshot);
-+
- static inline void __d_set_inode_and_type(struct dentry *dentry,
- struct inode *inode,
- unsigned type_flags)
---- a/fs/debugfs/inode.c
-+++ b/fs/debugfs/inode.c
-@@ -669,7 +669,7 @@ struct dentry *debugfs_rename(struct den
- {
- int error;
- struct dentry *dentry = NULL, *trap;
-- const char *old_name;
-+ struct name_snapshot old_name;
-
- trap = lock_rename(new_dir, old_dir);
- /* Source or destination directories don't exist? */
-@@ -684,19 +684,19 @@ struct dentry *debugfs_rename(struct den
- if (IS_ERR(dentry) || dentry == trap || d_really_is_positive(dentry))
- goto exit;
-
-- old_name = fsnotify_oldname_init(old_dentry->d_name.name);
-+ take_dentry_name_snapshot(&old_name, old_dentry);
-
- error = simple_rename(d_inode(old_dir), old_dentry, d_inode(new_dir),
- dentry);
- if (error) {
-- fsnotify_oldname_free(old_name);
-+ release_dentry_name_snapshot(&old_name);
- goto exit;
- }
- d_move(old_dentry, dentry);
-- fsnotify_move(d_inode(old_dir), d_inode(new_dir), old_name,
-+ fsnotify_move(d_inode(old_dir), d_inode(new_dir), old_name.name,
- d_is_dir(old_dentry),
- NULL, old_dentry);
-- fsnotify_oldname_free(old_name);
-+ release_dentry_name_snapshot(&old_name);
- unlock_rename(new_dir, old_dir);
- dput(dentry);
- return old_dentry;
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -4179,11 +4179,11 @@ int vfs_rename(struct inode *old_dir, st
- {
- int error;
- bool is_dir = d_is_dir(old_dentry);
-- const unsigned char *old_name;
- struct inode *source = old_dentry->d_inode;
- struct inode *target = new_dentry->d_inode;
- bool new_is_dir = false;
- unsigned max_links = new_dir->i_sb->s_max_links;
-+ struct name_snapshot old_name;
-
- /*
- * Check source == target.
-@@ -4237,7 +4237,7 @@ int vfs_rename(struct inode *old_dir, st
- if (error)
- return error;
-
-- old_name = fsnotify_oldname_init(old_dentry->d_name.name);
-+ take_dentry_name_snapshot(&old_name, old_dentry);
- dget(new_dentry);
- if (!is_dir || (flags & RENAME_EXCHANGE))
- lock_two_nondirectories(source, target);
-@@ -4298,14 +4298,14 @@ out:
- mutex_unlock(&target->i_mutex);
- dput(new_dentry);
- if (!error) {
-- fsnotify_move(old_dir, new_dir, old_name, is_dir,
-+ fsnotify_move(old_dir, new_dir, old_name.name, is_dir,
- !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
- if (flags & RENAME_EXCHANGE) {
- fsnotify_move(new_dir, old_dir, old_dentry->d_name.name,
- new_is_dir, NULL, new_dentry);
- }
- }
-- fsnotify_oldname_free(old_name);
-+ release_dentry_name_snapshot(&old_name);
-
- return error;
- }
---- a/fs/notify/fsnotify.c
-+++ b/fs/notify/fsnotify.c
-@@ -104,16 +104,20 @@ int __fsnotify_parent(struct path *path,
- if (unlikely(!fsnotify_inode_watches_children(p_inode)))
- __fsnotify_update_child_dentry_flags(p_inode);
- else if (p_inode->i_fsnotify_mask & mask) {
-+ struct name_snapshot name;
-+
- /* we are notifying a parent so come up with the new mask which
- * specifies these are events which came from a child. */
- mask |= FS_EVENT_ON_CHILD;
-
-+ take_dentry_name_snapshot(&name, dentry);
- if (path)
- ret = fsnotify(p_inode, mask, path, FSNOTIFY_EVENT_PATH,
-- dentry->d_name.name, 0);
-+ name.name, 0);
- else
- ret = fsnotify(p_inode, mask, dentry->d_inode, FSNOTIFY_EVENT_INODE,
-- dentry->d_name.name, 0);
-+ name.name, 0);
-+ release_dentry_name_snapshot(&name);
- }
-
- dput(parent);
---- a/include/linux/dcache.h
-+++ b/include/linux/dcache.h
-@@ -615,5 +615,11 @@ static inline struct inode *d_real_inode
- return d_backing_inode(d_real(dentry));
- }
-
-+struct name_snapshot {
-+ const char *name;
-+ char inline_name[DNAME_INLINE_LEN];
-+};
-+void take_dentry_name_snapshot(struct name_snapshot *, struct dentry *);
-+void release_dentry_name_snapshot(struct name_snapshot *);
-
- #endif /* __LINUX_DCACHE_H */
---- a/include/linux/fsnotify.h
-+++ b/include/linux/fsnotify.h
-@@ -310,35 +310,4 @@ static inline void fsnotify_change(struc
- }
- }
-
--#if defined(CONFIG_FSNOTIFY) /* notify helpers */
--
--/*
-- * fsnotify_oldname_init - save off the old filename before we change it
-- */
--static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
--{
-- return kstrdup(name, GFP_KERNEL);
--}
--
--/*
-- * fsnotify_oldname_free - free the name we got from fsnotify_oldname_init
-- */
--static inline void fsnotify_oldname_free(const unsigned char *old_name)
--{
-- kfree(old_name);
--}
--
--#else /* CONFIG_FSNOTIFY */
--
--static inline const char *fsnotify_oldname_init(const unsigned char *name)
--{
-- return NULL;
--}
--
--static inline void fsnotify_oldname_free(const unsigned char *old_name)
--{
--}
--
--#endif /* CONFIG_FSNOTIFY */
--
- #endif /* _LINUX_FS_NOTIFY_H */
diff --git a/patches.fixes/ipv4-Should-use-consistent-conditional-judgement-for.patch b/patches.fixes/ipv4-Should-use-consistent-conditional-judgement-for.patch
deleted file mode 100644
index 0352f7abb7..0000000000
--- a/patches.fixes/ipv4-Should-use-consistent-conditional-judgement-for.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From: zheng li <james.z.li@ericsson.com>
-Date: Mon, 12 Dec 2016 09:56:05 +0800
-Subject: ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output
-Patch-mainline: v4.10-rc1
-Git-commit: 0a28cfd51e17f4f0a056bcf66bfbe492c3b99f38
-References: bsc#1041958
-
-There is an inconsistent conditional judgement in __ip_append_data and
-ip_finish_output functions, the variable length in __ip_append_data just
-include the length of application's payload and udp header, don't include
-the length of ip header, but in ip_finish_output use
-(skb->len > ip_skb_dst_mtu(skb)) as judgement, and skb->len include the
-length of ip header.
-
-That causes some particular application's udp payload whose length is
-between (MTU - IP Header) and MTU were fragmented by ip_fragment even
-though the rst->dev support UFO feature.
-
-Add the length of ip header to length in __ip_append_data to keep
-consistent conditional judgement as ip_finish_output for ip fragment.
-
-Signed-off-by: Zheng Li <james.z.li@ericsson.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Acked-by: Michal Kubecek <mkubecek@suse.cz>
-
----
- net/ipv4/ip_output.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index cd0b17f35513..1faf1993f4fd 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -922,7 +922,7 @@ static int __ip_append_data(struct sock *sk,
- csummode = CHECKSUM_PARTIAL;
-
- cork->length += length;
-- if (((length > mtu) || (skb && skb_is_gso(skb))) &&
-+ if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) &&
- (sk->sk_protocol == IPPROTO_UDP) &&
- (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
- (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
---
-2.13.2
-
diff --git a/patches.fixes/ipv6-Don-t-use-ufo-handling-on-later-transformed-pac.patch b/patches.fixes/ipv6-Don-t-use-ufo-handling-on-later-transformed-pac.patch
index 9977503398..0e1574cfaf 100644
--- a/patches.fixes/ipv6-Don-t-use-ufo-handling-on-later-transformed-pac.patch
+++ b/patches.fixes/ipv6-Don-t-use-ufo-handling-on-later-transformed-pac.patch
@@ -46,22 +46,17 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Michal Kubecek <mkubecek@suse.cz>
---
- net/ipv6/ip6_output.c | 2 +-
+ net/ipv6/ip6_output.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 1db17efe36c1..dc5859472991 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
-@@ -1359,7 +1359,7 @@ emsgsize:
- if (((length > mtu) ||
- (skb && skb_is_gso(skb))) &&
+@@ -1361,7 +1361,7 @@ emsgsize:
+ (((length + (skb ? skb->len : headersize)) > mtu) &&
+ (skb_queue_len(queue) <= 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
- (rt->dst.dev->features & NETIF_F_UFO) &&
+ (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
- (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
+ (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
hh_len, fragheaderlen, exthdrlen,
---
-2.13.0
-
diff --git a/patches.fixes/ipv6-Should-use-consistent-conditional-judgement-for.patch b/patches.fixes/ipv6-Should-use-consistent-conditional-judgement-for.patch
deleted file mode 100644
index 6fca8ec1db..0000000000
--- a/patches.fixes/ipv6-Should-use-consistent-conditional-judgement-for.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From: Zheng Li <james.z.li@ericsson.com>
-Date: Wed, 28 Dec 2016 23:23:46 +0800
-Subject: ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output
-Patch-mainline: v4.10-rc3
-Git-commit: e4c5e13aa45c23692e4acf56f0b3533f328199b2
-References: bsc#1041958
-
-There is an inconsistent conditional judgement between __ip6_append_data
-and ip6_finish_output functions, the variable length in __ip6_append_data
-just include the length of application's payload and udp6 header, don't
-include the length of ipv6 header, but in ip6_finish_output use
-(skb->len > ip6_skb_dst_mtu(skb)) as judgement, and skb->len include the
-length of ipv6 header.
-
-That causes some particular application's udp6 payloads whose length are
-between (MTU - IPv6 Header) and MTU were fragmented by ip6_fragment even
-though the rst->dev support UFO feature.
-
-Add the length of ipv6 header to length in __ip6_append_data to keep
-consistent conditional judgement as ip6_finish_output for ip6 fragment.
-
-Signed-off-by: Zheng Li <james.z.li@ericsson.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Acked-by: Michal Kubecek <mkubecek@suse.cz>
-
----
- net/ipv6/ip6_output.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index cd37f1f06871..d51526a47b61 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -1361,7 +1361,7 @@ emsgsize:
- */
-
- cork->length += length;
-- if (((length > mtu) ||
-+ if ((((length + fragheaderlen) > mtu) ||
- (skb && skb_is_gso(skb))) &&
- (sk->sk_protocol == IPPROTO_UDP) &&
- (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
---
-2.13.2
-
diff --git a/patches.fixes/ipv6-avoid-overflow-of-offset-in-ip6_find_1stfragopt.patch b/patches.fixes/ipv6-avoid-overflow-of-offset-in-ip6_find_1stfragopt.patch
deleted file mode 100644
index 5c01d0ecf3..0000000000
--- a/patches.fixes/ipv6-avoid-overflow-of-offset-in-ip6_find_1stfragopt.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From: Sabrina Dubroca <sd@queasysnail.net>
-Date: Wed, 19 Jul 2017 22:28:55 +0200
-Subject: ipv6: avoid overflow of offset in ip6_find_1stfragopt
-Patch-mainline: v4.13-rc2
-Git-commit: 6399f1fae4ec29fab5ec76070435555e256ca3a6
-References: CVE-2017-7542 bsc#1049882
-
-In some cases, offset can overflow and can cause an infinite loop in
-ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
-cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.
-
-This problem has been here since before the beginning of git history.
-
-Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
-Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Acked-by: Michal Kubecek <mkubecek@suse.cz>
-
----
- net/ipv6/output_core.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
-index 8b56c5240429..f9f02581c4ca 100644
---- a/net/ipv6/output_core.c
-+++ b/net/ipv6/output_core.c
-@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
-
- int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
- {
-- u16 offset = sizeof(struct ipv6hdr);
-+ unsigned int offset = sizeof(struct ipv6hdr);
- unsigned int packet_len = skb_tail_pointer(skb) -
- skb_network_header(skb);
- int found_rhdr = 0;
-@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
-
- while (offset <= packet_len) {
- struct ipv6_opt_hdr *exthdr;
-+ unsigned int len;
-
- switch (**nexthdr) {
-
-@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
-
- exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
- offset);
-- offset += ipv6_optlen(exthdr);
-+ len = ipv6_optlen(exthdr);
-+ if (len + offset >= IPV6_MAXPLEN)
-+ return -EINVAL;
-+ offset += len;
- *nexthdr = &exthdr->nexthdr;
- }
-
---
-2.13.3
-
diff --git a/patches.fixes/media-saa7164-fix-double-fetch-PCIe-access-condition b/patches.fixes/media-saa7164-fix-double-fetch-PCIe-access-condition
deleted file mode 100644
index 6e2431dc96..0000000000
--- a/patches.fixes/media-saa7164-fix-double-fetch-PCIe-access-condition
+++ /dev/null
@@ -1,76 +0,0 @@
-From 6fb05e0dd32e566facb96ea61a48c7488daa5ac3 Mon Sep 17 00:00:00 2001
-From: Steven Toth <stoth@kernellabs.com>
-Date: Tue, 6 Jun 2017 09:30:27 -0300
-Subject: [PATCH] [media] saa7164: fix double fetch PCIe access condition
-Git-commit: 6fb05e0dd32e566facb96ea61a48c7488daa5ac3
-Patch-mainline: 4.13-rc1
-References: CVE-2017-8831 bsc#1037994
-
-Avoid a double fetch by reusing the values from the prior transfer.
-
-Originally reported via https://bugzilla.kernel.org/show_bug.cgi?id=195559
-
-Thanks to Pengfei Wang <wpengfeinudt@gmail.com> for reporting.
-
-Signed-off-by: Steven Toth <stoth@kernellabs.com>
-Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
-Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
----
- drivers/media/pci/saa7164/saa7164-bus.c | 13 +------------
- 1 file changed, 1 insertion(+), 12 deletions(-)
-
---- a/drivers/media/pci/saa7164/saa7164-bus.c
-+++ b/drivers/media/pci/saa7164/saa7164-bus.c
-@@ -393,11 +393,11 @@ int saa7164_bus_get(struct saa7164_dev *
- msg_tmp.size = le16_to_cpu((__force __le16)msg_tmp.size);
- msg_tmp.command = le32_to_cpu((__force __le32)msg_tmp.command);
- msg_tmp.controlselector = le16_to_cpu((__force __le16)msg_tmp.controlselector);
-+ memcpy(msg, &msg_tmp, sizeof(*msg));
-
- /* No need to update the read positions, because this was a peek */
- /* If the caller specifically want to peek, return */
- if (peekonly) {
-- memcpy(msg, &msg_tmp, sizeof(*msg));
- goto peekout;
- }
-
-@@ -442,21 +442,15 @@ int saa7164_bus_get(struct saa7164_dev *
- space_rem = bus->m_dwSizeGetRing - curr_grp;
-
- if (space_rem < sizeof(*msg)) {
-- /* msg wraps around the ring */
-- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, space_rem);
-- memcpy_fromio((u8 *)msg + space_rem, bus->m_pdwGetRing,
-- sizeof(*msg) - space_rem);
- if (buf)
- memcpy_fromio(buf, bus->m_pdwGetRing + sizeof(*msg) -
- space_rem, buf_size);
-
- } else if (space_rem == sizeof(*msg)) {
-- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
- if (buf)
- memcpy_fromio(buf, bus->m_pdwGetRing, buf_size);
- } else {
- /* Additional data wraps around the ring */
-- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
- if (buf) {
- memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp +
- sizeof(*msg), space_rem - sizeof(*msg));
-@@ -469,15 +463,10 @@ int saa7164_bus_get(struct saa7164_dev *
-
- } else {
- /* No wrapping */
-- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
- if (buf)
- memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp + sizeof(*msg),
- buf_size);
- }
-- /* Convert from little endian to CPU */
-- msg->size = le16_to_cpu((__force __le16)msg->size);
-- msg->command = le32_to_cpu((__force __le32)msg->command);
-- msg->controlselector = le16_to_cpu((__force __le16)msg->controlselector);
-
- /* Update the read positions, adjusting the ring */
- saa7164_writel(bus->m_dwGetReadPos, new_grp);
diff --git a/patches.fixes/net-account-for-current-skb-length-when-deciding-abo.patch b/patches.fixes/net-account-for-current-skb-length-when-deciding-abo.patch
deleted file mode 100644
index 9565684a13..0000000000
--- a/patches.fixes/net-account-for-current-skb-length-when-deciding-abo.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From: =?UTF-8?q?Michal=20Kube=C4=8Dek?= <mkubecek@suse.cz>
-Date: Mon, 19 Jun 2017 13:03:43 +0200
-Subject: net: account for current skb length when deciding about UFO
-Patch-mainline: v4.12
-Git-commit: a5cb659bbc1c8644efa0c3138a757a1e432a4880
-References: bsc#1041958
-
-Our customer encountered stuck NFS writes for blocks starting at specific
-offsets w.r.t. page boundary caused by networking stack sending packets via
-UFO enabled device with wrong checksum. The problem can be reproduced by
-composing a long UDP datagram from multiple parts using MSG_MORE flag:
-
- sendto(sd, buff, 1000, MSG_MORE, ...);
- sendto(sd, buff, 1000, MSG_MORE, ...);
- sendto(sd, buff, 3000, 0, ...);
-
-Assume this packet is to be routed via a device with MTU 1500 and
-NETIF_F_UFO enabled. When second sendto() gets into __ip_append_data(),
-this condition is tested (among others) to decide whether to call
-ip_ufo_append_data():
-
- ((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))
-
-At the moment, we already have skb with 1028 bytes of data which is not
-marked for GSO so that the test is false (fragheaderlen is usually 20).
-Thus we append second 1000 bytes to this skb without invoking UFO. Third
-sendto(), however, has sufficient length to trigger the UFO path so that we
-end up with non-UFO skb followed by a UFO one. Later on, udp_send_skb()
-uses udp_csum() to calculate the checksum but that assumes all fragments
-have correct checksum in skb->csum which is not true for UFO fragments.
-
-When checking against MTU, we need to add skb->len to length of new segment
-if we already have a partially filled skb and fragheaderlen only if there
-isn't one.
-
-In the IPv6 case, skb can only be null if this is the first segment so that
-we have to use headersize (length of the first IPv6 header) rather than
-fragheaderlen (length of IPv6 header of further fragments) for skb == NULL.
-
-Fixes: e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach")
-Fixes: e4c5e13aa45c ("ipv6: Should use consistent conditional judgement for
- ip6 fragment between __ip6_append_data and ip6_finish_output")
-Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
-Acked-by: Vlad Yasevich <vyasevic@redhat.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-
----
- net/ipv4/ip_output.c | 3 ++-
- net/ipv6/ip6_output.c | 2 +-
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 1faf1993f4fd..423558b546ea 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -922,7 +922,8 @@ static int __ip_append_data(struct sock *sk,
- csummode = CHECKSUM_PARTIAL;
-
- cork->length += length;
-- if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) &&
-+ if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
-+ (skb && skb_is_gso(skb))) &&
- (sk->sk_protocol == IPPROTO_UDP) &&
- (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
- (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index d51526a47b61..c9f62e2d4c08 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -1361,7 +1361,7 @@ emsgsize:
- */
-
- cork->length += length;
-- if ((((length + fragheaderlen) > mtu) ||
-+ if ((((length + (skb ? skb->len : headersize)) > mtu) ||
- (skb && skb_is_gso(skb))) &&
- (sk->sk_protocol == IPPROTO_UDP) &&
- (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
---
-2.13.2
-
diff --git a/patches.fixes/net-packet-fix-race-in-packet_set_ring-on-PACKET_RES.patch b/patches.fixes/net-packet-fix-race-in-packet_set_ring-on-PACKET_RES.patch
deleted file mode 100644
index 6a00a58b29..0000000000
--- a/patches.fixes/net-packet-fix-race-in-packet_set_ring-on-PACKET_RES.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From: Willem de Bruijn <willemb@google.com>
-Date: Sat, 5 Aug 2017 23:57:59 +0200
-Subject: net-packet: fix race in packet_set_ring on PACKET_RESERVE
-Patch-mainline: Not yet, embargo
-References: CVE-2017-1000111 bsc#1052365
-
-PACKET_RESERVE reserves headroom in memory mapped packet ring frames.
-The value po->tp_reserve must is verified to be safe in packet_set_ring
-
- if (unlikely(req->tp_frame_size < po->tp_hdrlen + po->tp_reserve))
-
-and the setsockopt fails once a ring is set.
-
- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
- return -EBUSY;
-
-This operation does not take the socket lock. This leads to a race
-similar to the one with PACKET_VERSION fixed in commit 84ac7260236a
-("packet: fix race condition in packet_set_ring").
-
-Fix this issue in the same manner: take the socket lock, which as of
-that patch is held for the duration of packet_set_ring.
-
-This bug was discovered with syzkaller.
-
-Reported-by: Andrey Konovalov <andreyknvl@google.com>
-Signed-off-by: Willem de Bruijn <willemb@google.com>
-Acked-by: Michal Kubecek <mkubecek@suse.cz>
----
- net/packet/af_packet.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index f8d6a0ca9c03..d50867eb87cd 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -3622,14 +3622,19 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
-
- if (optlen != sizeof(val))
- return -EINVAL;
-- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-- return -EBUSY;
- if (copy_from_user(&val, optval, sizeof(val)))
- return -EFAULT;
- if (val > INT_MAX)
- return -EINVAL;
-- po->tp_reserve = val;
-- return 0;
-+ lock_sock(sk);
-+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-+ ret = -EBUSY;
-+ else {
-+ po->tp_reserve = val;
-+ ret = 0;
-+ }
-+ release_sock(sk);
-+ return ret;
- }
- case PACKET_LOSS:
- {
---
-2.13.4
-
diff --git a/patches.fixes/net-phy-Do-not-perform-software-reset-for-Generic-PH.patch b/patches.fixes/net-phy-Do-not-perform-software-reset-for-Generic-PH.patch
deleted file mode 100644
index 56269ea16b..0000000000
--- a/patches.fixes/net-phy-Do-not-perform-software-reset-for-Generic-PH.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: Florian Fainelli <f.fainelli@gmail.com>
-Date: Sun, 5 Mar 2017 12:34:49 -0800
-Subject: net: phy: Do not perform software reset for Generic PHY
-Patch-mainline: v4.11-rc3
-Git-commit: 0878fff1f42c18e448ab5b8b4f6a3eb32365b5b6
-References: bsc#1042286
-
-The Generic PHY driver is a catch-all PHY driver and it should preserve
-whatever prior initialization has been done by boot loader or firmware
-agents. For specific PHY device configuration it is expected that a
-specialized PHY driver would take over that role.
-
-Resetting the generic PHY was a bad idea that has lead to several
-complaints and downstream workarounds e.g: in OpenWrt/LEDE so restore
-the behavior prior to 87aa9f9c61ad ("net: phy: consolidate PHY
-reset in phy_init_hw()").
-
-Reported-by: Felix Fietkau <nbd@nbd.name>
-Fixes: 87aa9f9c61ad ("net: phy: consolidate PHY reset in phy_init_hw()")
-Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Acked-by: Benjamin Poirier <bpoirier@suse.com>
----
- drivers/net/phy/phy_device.c | 2 +-
- include/linux/phy.h | 4 ++++
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
---- a/drivers/net/phy/phy_device.c
-+++ b/drivers/net/phy/phy_device.c
-@@ -1699,7 +1699,7 @@ static struct phy_driver genphy_driver[]
- .phy_id = 0xffffffff,
- .phy_id_mask = 0xffffffff,
- .name = "Generic PHY",
-- .soft_reset = genphy_soft_reset,
-+ .soft_reset = genphy_no_soft_reset,
- .config_init = genphy_config_init,
- .features = PHY_GBIT_FEATURES | SUPPORTED_MII |
- SUPPORTED_AUI | SUPPORTED_FIBRE |
---- a/include/linux/phy.h
-+++ b/include/linux/phy.h
-@@ -794,6 +794,10 @@ int genphy_read_status(struct phy_device
- int genphy_suspend(struct phy_device *phydev);
- int genphy_resume(struct phy_device *phydev);
- int genphy_soft_reset(struct phy_device *phydev);
-+static inline int genphy_no_soft_reset(struct phy_device *phydev)
-+{
-+ return 0;
-+}
- void phy_driver_unregister(struct phy_driver *drv);
- void phy_drivers_unregister(struct phy_driver *drv, int n);
- int phy_driver_register(struct phy_driver *new_driver, struct module *owner);
diff --git a/patches.fixes/udp-avoid-ufo-handling-on-IP-payload-compression-pac.patch b/patches.fixes/udp-avoid-ufo-handling-on-IP-payload-compression-pac.patch
index 1cabf2824f..206ed0c91f 100644
--- a/patches.fixes/udp-avoid-ufo-handling-on-IP-payload-compression-pac.patch
+++ b/patches.fixes/udp-avoid-ufo-handling-on-IP-payload-compression-pac.patch
@@ -45,36 +45,29 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Michal Kubecek <mkubecek@suse.cz>
---
- net/ipv4/ip_output.c | 2 +-
- net/ipv6/ip6_output.c | 2 +-
+ net/ipv4/ip_output.c | 2 +-
+ net/ipv6/ip6_output.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 2b7283303650..cd0b17f35513 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
-@@ -924,7 +924,7 @@ static int __ip_append_data(struct sock *sk,
- cork->length += length;
- if (((length > mtu) || (skb && skb_is_gso(skb))) &&
+@@ -926,7 +926,7 @@ static int __ip_append_data(struct sock
+ (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
+ (skb_queue_len(queue) <= 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
- (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+ (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
- (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
+ (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
err = ip_ufo_append_data(sk, queue, getfrag, from, length,
hh_len, fragheaderlen, transhdrlen,
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index dc5859472991..ab09f731b458 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
-@@ -1359,7 +1359,7 @@ emsgsize:
- if (((length > mtu) ||
- (skb && skb_is_gso(skb))) &&
+@@ -1361,7 +1361,7 @@ emsgsize:
+ (((length + (skb ? skb->len : headersize)) > mtu) &&
+ (skb_queue_len(queue) <= 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
- (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+ (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
- (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
+ (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
hh_len, fragheaderlen, exthdrlen,
---
-2.13.0
-
diff --git a/patches.fixes/udp-consistently-apply-ufo-or-fragmentation.patch b/patches.fixes/udp-consistently-apply-ufo-or-fragmentation.patch
deleted file mode 100644
index 7f95da3cc9..0000000000
--- a/patches.fixes/udp-consistently-apply-ufo-or-fragmentation.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: Willem de Bruijn <willemb@google.com>
-Date: Fri, 14 Jul 2017 10:19:00 +0200
-Subject: udp: consistently apply ufo or fragmentation
-Patch-mainline: Not yet, embargo
-References: CVE-2017-1000112 bsc#1052311
-
-When iteratively building a UDP datagram with MSG_MORE and that
-datagram exceeds MTU, consistently choose UFO or fragmentation.
-
-Once skb_is_gso, always apply ufo. Conversely, once a datagram is
-split across multiple skbs, do not consider ufo.
-
-Sendpage already maintains the first invariant, only add the second.
-IPv6 does not have a sendpage implementation to modify.
-
-Fixes: e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach")
-Reported-by: Andrey Konovalov <andreyknvl@google.com>
-Signed-off-by: Willem de Bruijn <willemb@google.com>
-Acked-by: Michal Kubecek <mkubecek@suse.cz>
----
- net/ipv4/ip_output.c | 12 +++++++-----
- net/ipv6/ip6_output.c | 11 ++++++-----
- 2 files changed, 13 insertions(+), 10 deletions(-)
-
-diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 423558b546ea..5fe79867d8e2 100644
---- a/net/ipv4/ip_output.c
-+++ b/net/ipv4/ip_output.c
-@@ -922,11 +922,12 @@ static int __ip_append_data(struct sock *sk,
- csummode = CHECKSUM_PARTIAL;
-
- cork->length += length;
-- if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
-- (skb && skb_is_gso(skb))) &&
-- (sk->sk_protocol == IPPROTO_UDP) &&
-- (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-- (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
-+ if ((skb && skb_is_gso(skb)) ||
-+ (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
-+ (skb_queue_len(queue) <= 1) &&
-+ (sk->sk_protocol == IPPROTO_UDP) &&
-+ (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-+ (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
- err = ip_ufo_append_data(sk, queue, getfrag, from, length,
- hh_len, fragheaderlen, transhdrlen,
- maxfraglen, flags);
-@@ -1243,6 +1244,7 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
-
- if ((size + skb->len > mtu) &&
- (sk->sk_protocol == IPPROTO_UDP) &&
-+ (skb_queue_len(&sk->sk_write_queue) == 1) &&
- (rt->dst.dev->features & NETIF_F_UFO)) {
- if (skb->ip_summed != CHECKSUM_PARTIAL)
- return -EOPNOTSUPP;
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index c9f62e2d4c08..5e84ae7ff621 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -1361,11 +1361,12 @@ emsgsize:
- */
-
- cork->length += length;
-- if ((((length + (skb ? skb->len : headersize)) > mtu) ||
-- (skb && skb_is_gso(skb))) &&
-- (sk->sk_protocol == IPPROTO_UDP) &&
-- (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-- (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
-+ if ((skb && skb_is_gso(skb)) ||
-+ (((length + (skb ? skb->len : headersize)) > mtu) &&
-+ (skb_queue_len(queue) <= 1) &&
-+ (sk->sk_protocol == IPPROTO_UDP) &&
-+ (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-+ (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
- err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
- hh_len, fragheaderlen, exthdrlen,
- transhdrlen, mtu, flags, fl6);
---
-2.13.4
-
diff --git a/patches.fixes/xfs-don-t-bug-on-mixed-direct-and-mapped-i-o.patch b/patches.fixes/xfs-don-t-bug-on-mixed-direct-and-mapped-i-o.patch
deleted file mode 100644
index d47bfaa3ca..0000000000
--- a/patches.fixes/xfs-don-t-bug-on-mixed-direct-and-mapped-i-o.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From: Brian Foster <bfoster@redhat.com>
-Date: Tue, 8 Nov 2016 12:54:14 +1100
-Subject: xfs: don't BUG() on mixed direct and mapped I/O
-Git-commit: 04197b341f23b908193308b8d63d17ff23232598
-Patch-mainline: v4.10-rc1
-References: bsc#1050188
-
-We've had reports of generic/095 causing XFS to BUG() in
-__xfs_get_blocks() due to the existence of delalloc blocks on a
-direct I/O read. generic/095 issues a mix of various types of I/O,
-including direct and memory mapped I/O to a single file. This is
-clearly not supported behavior and is known to lead to such
-problems. E.g., the lack of exclusion between the direct I/O and
-write fault paths means that a write fault can allocate delalloc
-blocks in a region of a file that was previously a hole after the
-direct read has attempted to flush/inval the file range, but before
-it actually reads the block mapping. In turn, the direct read
-discovers a delalloc extent and cannot proceed.
-
-While the appropriate solution here is to not mix direct and memory
-mapped I/O to the same regions of the same file, the current
-BUG_ON() behavior is probably overkill as it can crash the entire
-system. Instead, localize the failure to the I/O in question by
-returning an error for a direct I/O that cannot be handled safely
-due to delalloc blocks. Be careful to allow the case of a direct
-write to post-eof delalloc blocks. This can occur due to speculative
-preallocation and is safe as post-eof blocks are not accompanied by
-dirty pages in pagecache (conversely, preallocation within eof must
-have been zeroed, and thus dirtied, before the inode size could have
-been increased beyond said blocks).
-
-Finally, provide an additional warning if a direct I/O write occurs
-while the file is memory mapped. This may not catch all problematic
-scenarios, but provides a hint that some known-to-be-problematic I/O
-methods are in use.
-
-Signed-off-by: Brian Foster <bfoster@redhat.com>
-Reviewed-by: Dave Chinner <dchinner@redhat.com>
-Signed-off-by: Dave Chinner <david@fromorbit.com>
-Acked-by: Nikolay Borisov <nborisov@suse.com>
----
- fs/xfs/xfs_aops.c | 21 ++++++++++++++++++++-
- 1 file changed, 20 insertions(+), 1 deletion(-)
-
-diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
-index d4752078b471..11fa73d8be78 100644
---- a/fs/xfs/xfs_aops.c
-+++ b/fs/xfs/xfs_aops.c
-@@ -1439,6 +1439,26 @@ __xfs_get_blocks(
- if (error)
- goto out_unlock;
-
-+ /*
-+ * The only time we can ever safely find delalloc blocks on direct I/O
-+ * is a dio write to post-eof speculative preallocation. All other
-+ * scenarios are indicative of a problem or misuse (such as mixing
-+ * direct and mapped I/O).
-+ *
-+ * The file may be unmapped by the time we get here so we cannot
-+ * reliably fail the I/O based on mapping. Instead, fail the I/O if this
-+ * is a read or a write within eof. Otherwise, carry on but warn as a
-+ * precuation if the file happens to be mapped.
-+ */
-+ if (direct && imap.br_startblock == DELAYSTARTBLOCK) {
-+ if (!create || offset < i_size_read(VFS_I(ip))) {
-+ WARN_ON_ONCE(1);
-+ error = -EIO;
-+ goto out_unlock;
-+ }
-+ WARN_ON_ONCE(mapping_mapped(VFS_I(ip)->i_mapping));
-+ }
-+
- /* for DAX, we convert unwritten extents directly */
- if (create &&
- (!nimaps ||
-@@ -1538,7 +1558,6 @@ __xfs_get_blocks(
- set_buffer_new(bh_result);
-
- if (imap.br_startblock == DELAYSTARTBLOCK) {
-- BUG_ON(direct);
- if (create) {
- set_buffer_uptodate(bh_result);
- set_buffer_mapped(bh_result);
---
-2.7.4
-
diff --git a/patches.kabi/kabi-protect-struct-mm_struct.patch b/patches.kabi/kabi-protect-struct-mm_struct.patch
new file mode 100644
index 0000000000..25306c2216
--- /dev/null
+++ b/patches.kabi/kabi-protect-struct-mm_struct.patch
@@ -0,0 +1,40 @@
+From: Jiri Slaby <jslaby@suse.cz>
+Subject: kABI: protect struct mm_struct
+Patch-mainline: never, kabi
+References: kabi
+
+In 4.4.40, commit 03eed7afbc09e061f66b448daf7863174c3dc3f3 (mm: Add a
+user_ns owner to mm_struct and fix ptrace permission checks), upstream
+commit bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 added user_ns member to
+struct mm_struct.
+
+In 4.4.81, commit f1181047ff29d4d4d364435040bd347eb54483ca (mm,
+mprotect: flush TLB if potentially racing with a parallel reclaim
+leaving stale TLB entries), upstream commit
+3ea277194daaeaa84ce75180ec7c7a2075027a68 added tlb_flush_batched member
+to struct mm_struct.
+
+It indeed changed kABI of literally everything.
+
+Use suse_kabi_padding to cover the former and use a hole for the latter.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/linux/mm_types.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -505,10 +504,12 @@ struct mm_struct {
+ */
+ bool tlb_flush_pending;
+ #endif
++#ifndef __GENKSYMS__
+ #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
+ /* See flush_tlb_batched_pending() */
+ bool tlb_flush_batched;
+ #endif
++#endif
+ struct uprobes_state uprobes_state;
+ #ifdef CONFIG_X86_INTEL_MPX
+ /* address of the bounds directory */
diff --git a/patches.kabi/kabi-protect-struct-se_lun.patch b/patches.kabi/kabi-protect-struct-se_lun.patch
new file mode 100644
index 0000000000..ba800aebe4
--- /dev/null
+++ b/patches.kabi/kabi-protect-struct-se_lun.patch
@@ -0,0 +1,34 @@
+From: Jiri Slaby <jslaby@suse.cz>
+Subject: kABI: protect struct se_lun
+Patch-mainline: never, kabi
+References: kabi
+
+In 4.4.81, commit 2bf7791c6a5ec21228383f5a1fb5c443c3336622 (target:
+Avoid mappedlun symlink creation during lun shutdown), upstream commit
+49cb77e297dc611a1b795cfeb79452b3002bd331 added a bool to struct se_lun.
+This indeed changed the layout of the structure and the kABI checker now
+complains.
+
+Given this is only a boolean and it is next to another bool in SP2
+(after
+patches.drivers/0034-target-remove-enum-transport_lunflags_table), we
+use the hole and just make the changes invisible to the kABI checker by
+the usual #ifndef.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/target/target_core_base.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -716,7 +716,9 @@ struct se_lun {
+ #define SE_LUN_LINK_MAGIC 0xffff7771
+ u32 lun_link_magic;
+ u32 lun_access;
++#ifndef __GENKSYMS__
+ bool lun_shutdown;
++#endif
+ u32 lun_index;
+
+ /* RELATIVE TARGET PORT IDENTIFER */
diff --git a/patches.kabi/revert-Make-file-credentials-available-to-the-seqfil.patch b/patches.kabi/revert-Make-file-credentials-available-to-the-seqfil.patch
new file mode 100644
index 0000000000..87e5142c0d
--- /dev/null
+++ b/patches.kabi/revert-Make-file-credentials-available-to-the-seqfil.patch
@@ -0,0 +1,71 @@
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Mon, 14 Aug 2017 09:31:23 +0200
+Subject: Revert "Make file credentials available to the seqfile interfaces"
+Patch-mainline: never, kabi
+References: kabi
+
+This reverts commit 14ae9c4b5ae235bdaa74bb1c40de9a42ca691566, upstream
+commit 34dbbcdbf63360661ff7bda6c5f52f99ac515f92. It breaks kABI of
+seq_file. Especially, the inline helper relies on the user_ns member of
+seq_file.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/seq_file.c | 7 +++----
+ include/linux/seq_file.h | 13 +++++++++----
+ 2 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -72,10 +72,9 @@ int seq_open(struct file *file, const st
+
+ mutex_init(&p->lock);
+ p->op = op;
+-
+- // No refcounting: the lifetime of 'p' is constrained
+- // to the lifetime of the file.
+- p->file = file;
++#ifdef CONFIG_USER_NS
++ p->user_ns = file->f_cred->user_ns;
++#endif
+
+ /*
+ * Wrappers around seq_open(e.g. swaps_open) need to be
+--- a/include/linux/seq_file.h
++++ b/include/linux/seq_file.h
+@@ -7,10 +7,13 @@
+ #include <linux/mutex.h>
+ #include <linux/cpumask.h>
+ #include <linux/nodemask.h>
+-#include <linux/fs.h>
+-#include <linux/cred.h>
+
+ struct seq_operations;
++struct file;
++struct path;
++struct inode;
++struct dentry;
++struct user_namespace;
+
+ struct seq_file {
+ char *buf;
+@@ -24,7 +27,9 @@ struct seq_file {
+ struct mutex lock;
+ const struct seq_operations *op;
+ int poll_event;
+- const struct file *file;
++#ifdef CONFIG_USER_NS
++ struct user_namespace *user_ns;
++#endif
+ void *private;
+ };
+
+@@ -142,7 +147,7 @@ int seq_release_private(struct inode *,
+ static inline struct user_namespace *seq_user_ns(struct seq_file *seq)
+ {
+ #ifdef CONFIG_USER_NS
+- return seq->file->f_cred->user_ns;
++ return seq->user_ns;
+ #else
+ extern struct user_namespace init_user_ns;
+ return &init_user_ns;
diff --git a/patches.kabi/revert-proc-iomem-only-expose-physical-resource-addr.patch b/patches.kabi/revert-proc-iomem-only-expose-physical-resource-addr.patch
new file mode 100644
index 0000000000..03daa29437
--- /dev/null
+++ b/patches.kabi/revert-proc-iomem-only-expose-physical-resource-addr.patch
@@ -0,0 +1,48 @@
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Mon, 14 Aug 2017 09:47:31 +0200
+Subject: Revert "/proc/iomem: only expose physical resource addresses to
+ privileged users"
+Patch-mainline: never, kabi
+References: kabi
+
+This reverts commit e8aff60373182f48f5191b147894e954a591a521, upstream
+commit 51d7b120418e99d6b3bf8df9eb3cc31e8171dee4. It relies on commit
+14ae9c4b5ae235bdaa74bb1c40de9a42ca691566, upstream commit
+34dbbcdbf63360661ff7bda6c5f52f99ac515f92 which was reverted due to kABI
+breakage.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/resource.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -105,25 +105,16 @@ static int r_show(struct seq_file *m, vo
+ {
+ struct resource *root = m->private;
+ struct resource *r = v, *p;
+- unsigned long long start, end;
+ int width = root->end < 0x10000 ? 4 : 8;
+ int depth;
+
+ for (depth = 0, p = r; depth < MAX_IORES_LEVEL; depth++, p = p->parent)
+ if (p->parent == root)
+ break;
+-
+- if (file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) {
+- start = r->start;
+- end = r->end;
+- } else {
+- start = end = 0;
+- }
+-
+ seq_printf(m, "%*s%0*llx-%0*llx : %s\n",
+ depth * 2, "",
+- width, start,
+- width, end,
++ width, (unsigned long long) r->start,
++ width, (unsigned long long) r->end,
+ r->name ? r->name : "<BAD>");
+ return 0;
+ }
diff --git a/patches.kernel.org/patch-4.4.79-80 b/patches.kernel.org/patch-4.4.79-80
new file mode 100644
index 0000000000..119fcc56e4
--- /dev/null
+++ b/patches.kernel.org/patch-4.4.79-80
@@ -0,0 +1,3383 @@
+From: Jiri Slaby <jslaby@suse.cz>
+Subject: Linux 4.4.80
+Patch-mainline: 4.4.80
+References: CVE-2017-7533 bnc#1012382 bnc#1022476 bsc#1041958 bsc#1042286 bsc#1047653 bsc#1049483 bsc#1050188 bsc#993890 bsc#1048914 FATE#319759 FATE#319760 FATE#321435 FATE#321507 FATE#321600 FATE#321666 FATE#321685 FATE#321686 FATE#321687 bsc#1015336 bsc#1015337 bsc#1015340 bsc#1017972 bsc#1020645 bsc#1030195
+Git-commit: 9f169b9f52a4afccdab7a7d2311b0c53a78a1e6b
+Git-commit: 0371adcdaca92912baaa3256ed13e058a016e62d
+Git-commit: 9698b6f473555a722bf81a3371998427d5d27bde
+Git-commit: 08f9572671c8047e7234cbf150869aa3c3d59a97
+Git-commit: 13a6c8328e6056932dc680e447d4c5e8ad9add17
+Git-commit: 71eae1ca77fd6be218d8a952d97bba827e56516d
+Git-commit: 14ba972842f9e84e6d3264bc0302101b8a792288
+Git-commit: 6ef4fb387d50fa8f3bffdffc868b57e981cdd709
+Git-commit: e19f32da5ded958238eac1bbe001192acef191a2
+Git-commit: 4dcd19bfabaee8f9f4bcf203afba09b98ccbaf76
+Git-commit: 7934c98a6e04028eb34c1293bfb5a6b0ab630b66
+Git-commit: 30a9c6444810429aa2b7cbfbd453ce339baaadbf
+Git-commit: 4c86d77743a54fb2d8a4d18a037a074c892bb3be
+Git-commit: 074859184d770824f4437dca716bdeb625ae8b1c
+Git-commit: c2931667c83ded6504b3857e99cc45b21fa496fb
+Git-commit: 43aef5c2ca90535b3227e97e71604291875444ed
+Git-commit: c2a6bbaf0c5f90463a7011a295bbdb7e33c80b51
+Git-commit: 3ef01c968fbfb21c2f16281445d30a865ee4412c
+Git-commit: c415f9e8304a1d235ef118d912f374ee2e46c45d
+Git-commit: 4ea2a6be9565455f152c12f80222af1582ede0c7
+Git-commit: 75bdc7f31a3a6e9a12e218b31a44a1f54a91554c
+Git-commit: 34a31f0af84158955a9747fb5c6712da5bbb5331
+Git-commit: 1594c18fd297a8edcc72bc4b161f3f52603ebb92
+Git-commit: 086cc1c31a0ec075dac02425367c871bb65bc2c9
+Git-commit: 88e20c74ee020f9e0c99dfce0dd9aa61c3f0cca0
+Git-commit: a1792cda51300e15b03549cccf0b09f3be82e697
+Git-commit: 13288bdf4adbaa6bd1267f10044c1bc25d90ce7f
+Git-commit: 63c3194b82530bd71fd49db84eb7ab656b8d404a
+Git-commit: 2f884e6e688a0deb69e6c9552e51aef8b7e3f5f1
+Git-commit: 45e869714489431625c569d21fc952428d761476
+Git-commit: a6cb3b864b21b7345f824a4faa12b723c8aaf099
+Git-commit: 88b333b0ed790f9433ff542b163bf972953b74d3
+Git-commit: c1d5f8ff80ea84768f5fae1ca9d1abfbb5e6bbaa
+Git-commit: e4c5e13aa45c23692e4acf56f0b3533f328199b2
+Git-commit: 4cf48f1d7520a4d325af58eded4d8090e1b40be7
+Git-commit: 610c908773d30907c950ca3b2ee8ac4b2813537b
+Git-commit: 0dad3a3014a0b9e72521ff44f17e0054f43dcdea
+Git-commit: 15516788e581eb32ec1c50e5f00aba3faf95d817
+Git-commit: 13b47cfcfc60495cde216eef4c01040d76174cbe
+Git-commit: a24fa22ce22ae302b3bf8f7008896d52d5d57b8d
+Git-commit: 71df1d7ccad1c36f7321d6b3b48f2ea42681c363
+Git-commit: 3d89e5478bf550a50c99e93adf659369798263b0
+Git-commit: 6e7bc478c9a006c701c14476ec9d389a484b4864
+Git-commit: e9a330c4289f2ba1ca4bf98c2b430ab165a8931b
+Git-commit: 76d5692a58031696e282384cbd893832bc92bd76
+Git-commit: 663deb47880f2283809669563c5a52ac7c6aef1a
+Git-commit: 308453aa9156a3b8ee382c0949befb507a32b0c1
+Git-commit: 51d7b120418e99d6b3bf8df9eb3cc31e8171dee4
+Git-commit: 34dbbcdbf63360661ff7bda6c5f52f99ac515f92
+Git-commit: a2370ba2752538404e363346b339869c9973aeac
+Git-commit: 49d31c2f389acfe83417083e1208422b4091cd9e
+Git-commit: 860f01e96981a68553f3ca49f574ff14fe955e72
+Git-commit: c13c43d54f2c6a3be1c675766778ac1ad8dfbfcc
+Git-commit: 5a7a88f1b488e4ee49eb3d5b82612d4d9ffdf2c3
+Git-commit: 975e83cfb8dc16e7a2fdc58188c77c0c605876c2
+Git-commit: 96b777452d8881480fd5be50112f791c17db4b6b
+Git-commit: 575ced7f8090c1a4e91e2daf8da9352a6a1fc7a7
+Git-commit: 60bcabd080f53561efa9288be45c128feda1a8bb
+Git-commit: 5ec8a1753bc29efa7e4b1391d691c9c719b30257
+Git-commit: cb710ab1d8a23f68ff8f45aedf3e552bb90e70de
+Git-commit: cc6eeaa3029a6dbcb4ad41b1f92876483bd88965
+Git-commit: c61b781ee084e69855477d23dd33e7e6caad652c
+Git-commit: dfb5b098e0f40b68aa07f2ec55f4dd762efefbfa
+Git-commit: 18ae68fff392e445af3c2d8be9bef8a16e1c72a7
+Git-commit: 9f5af546e6acc30f075828cb58c7f09665033967
+Git-commit: e8f4ae85439f34bec3b0ab69223a41809dab28c9
+Git-commit: 0878fff1f42c18e448ab5b8b4f6a3eb32365b5b6
+Git-commit: b6355fb3f5f40bbce165847d277e64896cab8f95
+Git-commit: 04197b341f23b908193308b8d63d17ff23232598
+Git-commit: f952eaceb089b691eba7c4e13686e742a8f26bf5
+Git-commit: 622b7a47b843c78626f40c1d1aeef8483383fba2
+Git-commit: ee14ac0ef6827cd6f9a572cc83dd0191ea17812c
+Git-commit: e1717e0485af4f47fc4da1e979ac817f9ad61b0f
+Git-commit: 4f7b0d263833928e947e172eff2d2997179c5cb9
+Git-commit: c1d4b38c93069dca6b419a3b88907e01e2c3abf7
+Git-commit: 0a346629f5304a8390004a91e8d4f1206b87792b
+Git-commit: bf279ece37d2a3eaaa9813fcd7a1d8a81eb29c20
+Git-commit: ba4a648f12f4cd0a8003dd229b6ca8a53348ee4b
+Git-commit: 7ceaa6dcd8c6f59588428cec37f3c8093dd1011f
+Git-commit: 4c3bb4ccd074e1a0552078c0bf94c662367a1658
+Git-commit: ca8efa1df1d15a1795a2da57f9f6aada6ed6b946
+Git-commit: 38bcb208f60924a031b9f809f7cd252ea4a94e5f
+Git-commit: fcfffdd8f98ac305285dca568b5065ef86be6458
+Git-commit: 7e96d559634b73a8158ee99a7abece2eacec2668
+Git-commit: 41cdf7a45389e01991ee31e3301ed83cb3e3f7dc
+Git-commit: 4fd1bd443e80b12f0a01a45fb9a793206b41cb72
+Git-commit: b2504a5dbef3305ef41988ad270b0e8ec289331c
+Git-commit: 109704492ef637956265ec2eb72ae7b3b39eb6f4
+Git-commit: 89e357d83c06b6fac581c3ca7f0ee3ae7e67109e
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+diff --git a/Makefile b/Makefile
+index 1440a94b2474..dddd55adde24 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 79
++SUBLEVEL = 80
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index 5f5e0f3d5b64..27cd4abfc74d 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -697,6 +697,8 @@
+ vmmc_aux-supply = <&vsim>;
+ bus-width = <8>;
+ non-removable;
++ no-sdio;
++ no-sd;
+ };
+
+ &mmc3 {
+diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
+index f3142369f594..01116ee1284b 100644
+--- a/arch/arm/configs/s3c2410_defconfig
++++ b/arch/arm/configs/s3c2410_defconfig
+@@ -87,9 +87,9 @@ CONFIG_IPV6_TUNNEL=m
+ CONFIG_NETFILTER=y
+ CONFIG_NF_CONNTRACK=m
+ CONFIG_NF_CONNTRACK_EVENTS=y
+-CONFIG_NF_CT_PROTO_DCCP=m
+-CONFIG_NF_CT_PROTO_SCTP=m
+-CONFIG_NF_CT_PROTO_UDPLITE=m
++CONFIG_NF_CT_PROTO_DCCP=y
++CONFIG_NF_CT_PROTO_SCTP=y
++CONFIG_NF_CT_PROTO_UDPLITE=y
+ CONFIG_NF_CONNTRACK_AMANDA=m
+ CONFIG_NF_CONNTRACK_FTP=m
+ CONFIG_NF_CONNTRACK_H323=m
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
+index ce5d848251fa..7b34822d61e9 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts
+@@ -26,7 +26,7 @@
+ stdout-path = "serial0:115200n8";
+ };
+
+- memory {
++ memory@0 {
+ device_type = "memory";
+ reg = <0x0 0x0 0x40000000>;
+ };
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index 857eda5c7217..172402cc1a0f 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -71,7 +71,7 @@
+ <1 10 0xf01>;
+ };
+
+- amba_apu {
++ amba_apu: amba_apu@0 {
+ compatible = "simple-bus";
+ #address-cells = <2>;
+ #size-cells = <1>;
+@@ -191,7 +191,7 @@
+ };
+
+ i2c0: i2c@ff020000 {
+- compatible = "cdns,i2c-r1p10";
++ compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
+ status = "disabled";
+ interrupt-parent = <&gic>;
+ interrupts = <0 17 4>;
+@@ -202,7 +202,7 @@
+ };
+
+ i2c1: i2c@ff030000 {
+- compatible = "cdns,i2c-r1p10";
++ compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
+ status = "disabled";
+ interrupt-parent = <&gic>;
+ interrupts = <0 18 4>;
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index 247bae758e1e..a4b466424a32 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -66,21 +66,21 @@ void show_pte(struct mm_struct *mm, unsigned long addr)
+ break;
+
+ pud = pud_offset(pgd, addr);
+- printk(", *pud=%016llx", pud_val(*pud));
++ pr_cont(", *pud=%016llx", pud_val(*pud));
+ if (pud_none(*pud) || pud_bad(*pud))
+ break;
+
+ pmd = pmd_offset(pud, addr);
+- printk(", *pmd=%016llx", pmd_val(*pmd));
++ pr_cont(", *pmd=%016llx", pmd_val(*pmd));
+ if (pmd_none(*pmd) || pmd_bad(*pmd))
+ break;
+
+ pte = pte_offset_map(pmd, addr);
+- printk(", *pte=%016llx", pte_val(*pte));
++ pr_cont(", *pte=%016llx", pte_val(*pte));
+ pte_unmap(pte);
+ } while(0);
+
+- printk("\n");
++ pr_cont("\n");
+ }
+
+ #ifdef CONFIG_ARM64_HW_AFDBM
+diff --git a/arch/openrisc/kernel/vmlinux.lds.S b/arch/openrisc/kernel/vmlinux.lds.S
+index 2d69a853b742..3a08b55609b6 100644
+--- a/arch/openrisc/kernel/vmlinux.lds.S
++++ b/arch/openrisc/kernel/vmlinux.lds.S
+@@ -38,6 +38,8 @@ SECTIONS
+ /* Read-only sections, merged into text segment: */
+ . = LOAD_BASE ;
+
++ _text = .;
++
+ /* _s_kernel_ro must be page aligned */
+ . = ALIGN(PAGE_SIZE);
+ _s_kernel_ro = .;
+diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
+index 329771559cbb..8b3b46b7b0f2 100644
+--- a/arch/powerpc/include/asm/topology.h
++++ b/arch/powerpc/include/asm/topology.h
+@@ -44,22 +44,8 @@ extern void __init dump_numa_cpu_topology(void);
+ extern int sysfs_add_device_to_node(struct device *dev, int nid);
+ extern void sysfs_remove_device_from_node(struct device *dev, int nid);
+
+-static inline int early_cpu_to_node(int cpu)
+-{
+- int nid;
+-
+- nid = numa_cpu_lookup_table[cpu];
+-
+- /*
+- * Fall back to node 0 if nid is unset (it should be, except bugs).
+- * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)).
+- */
+- return (nid < 0) ? 0 : nid;
+-}
+ #else
+
+-static inline int early_cpu_to_node(int cpu) { return 0; }
+-
+ static inline void dump_numa_cpu_topology(void) {}
+
+ static inline int sysfs_add_device_to_node(struct device *dev, int nid)
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index fe6e800c1357..a20823210ac0 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -751,7 +751,7 @@ void __init setup_arch(char **cmdline_p)
+
+ static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align)
+ {
+- return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align,
++ return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align,
+ __pa(MAX_DMA_ADDRESS));
+ }
+
+@@ -762,7 +762,7 @@ static void __init pcpu_fc_free(void *ptr, size_t size)
+
+ static int pcpu_cpu_distance(unsigned int from, unsigned int to)
+ {
+- if (early_cpu_to_node(from) == early_cpu_to_node(to))
++ if (cpu_to_node(from) == cpu_to_node(to))
+ return LOCAL_DISTANCE;
+ else
+ return REMOTE_DISTANCE;
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 396dc44e783b..428563b195c3 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -2687,6 +2687,10 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
+ {
+ int r;
+ int srcu_idx;
++ unsigned long ebb_regs[3] = {}; /* shut up GCC */
++ unsigned long user_tar = 0;
++ unsigned long proc_fscr = 0;
++ unsigned int user_vrsave;
+
+ if (!vcpu->arch.sane) {
+ run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+@@ -2707,10 +2711,11 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
+ run->fail_entry.hardware_entry_failure_reason = 0;
+ return -EINVAL;
+ }
++ /* Enable TM so we can read the TM SPRs */
++ mtmsr(mfmsr() | MSR_TM);
+ current->thread.tm_tfhar = mfspr(SPRN_TFHAR);
+ current->thread.tm_tfiar = mfspr(SPRN_TFIAR);
+ current->thread.tm_texasr = mfspr(SPRN_TEXASR);
+- current->thread.regs->msr &= ~MSR_TM;
+ }
+ #endif
+
+@@ -2736,6 +2741,17 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
+ flush_fp_to_thread(current);
+ flush_altivec_to_thread(current);
+ flush_vsx_to_thread(current);
++
++ /* Save userspace EBB and other register values */
++ if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
++ ebb_regs[0] = mfspr(SPRN_EBBHR);
++ ebb_regs[1] = mfspr(SPRN_EBBRR);
++ ebb_regs[2] = mfspr(SPRN_BESCR);
++ user_tar = mfspr(SPRN_TAR);
++ proc_fscr = mfspr(SPRN_FSCR);
++ }
++ user_vrsave = mfspr(SPRN_VRSAVE);
++
+ vcpu->arch.wqp = &vcpu->arch.vcore->wq;
+ vcpu->arch.pgdir = current->mm->pgd;
+ vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST;
+@@ -2757,6 +2773,29 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu)
+ }
+ } while (is_kvmppc_resume_guest(r));
+
++ /* Restore userspace EBB and other register values */
++ if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
++ mtspr(SPRN_EBBHR, ebb_regs[0]);
++ mtspr(SPRN_EBBRR, ebb_regs[1]);
++ mtspr(SPRN_BESCR, ebb_regs[2]);
++ mtspr(SPRN_TAR, user_tar);
++ mtspr(SPRN_FSCR, proc_fscr);
++ }
++ mtspr(SPRN_VRSAVE, user_vrsave);
++
++ /*
++ * Since we don't do lazy TM reload, we need to reload
++ * the TM registers here.
++ */
++#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
++ if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs &&
++ (current->thread.regs->msr & MSR_TM)) {
++ mtspr(SPRN_TFHAR, current->thread.tm_tfhar);
++ mtspr(SPRN_TFIAR, current->thread.tm_tfiar);
++ mtspr(SPRN_TEXASR, current->thread.tm_texasr);
++ }
++#endif
++
+ out:
+ vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
+ atomic_dec(&vcpu->kvm->arch.vcpus_running);
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 1a743f87b37d..ffab9269bfe4 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -36,6 +36,13 @@
+ #define NAPPING_CEDE 1
+ #define NAPPING_NOVCPU 2
+
++/* Stack frame offsets for kvmppc_hv_entry */
++#define SFS 112
++#define STACK_SLOT_TRAP (SFS-4)
++#define STACK_SLOT_CIABR (SFS-16)
++#define STACK_SLOT_DAWR (SFS-24)
++#define STACK_SLOT_DAWRX (SFS-32)
++
+ /*
+ * Call kvmppc_hv_entry in real mode.
+ * Must be called with interrupts hard-disabled.
+@@ -274,10 +281,10 @@ kvm_novcpu_exit:
+ bl kvmhv_accumulate_time
+ #endif
+ 13: mr r3, r12
+- stw r12, 112-4(r1)
++ stw r12, STACK_SLOT_TRAP(r1)
+ bl kvmhv_commence_exit
+ nop
+- lwz r12, 112-4(r1)
++ lwz r12, STACK_SLOT_TRAP(r1)
+ b kvmhv_switch_to_host
+
+ /*
+@@ -489,7 +496,7 @@ kvmppc_hv_entry:
+ */
+ mflr r0
+ std r0, PPC_LR_STKOFF(r1)
+- stdu r1, -112(r1)
++ stdu r1, -SFS(r1)
+
+ /* Save R1 in the PACA */
+ std r1, HSTATE_HOST_R1(r13)
+@@ -643,6 +650,16 @@ kvmppc_got_guest:
+ mtspr SPRN_PURR,r7
+ mtspr SPRN_SPURR,r8
+
++ /* Save host values of some registers */
++BEGIN_FTR_SECTION
++ mfspr r5, SPRN_CIABR
++ mfspr r6, SPRN_DAWR
++ mfspr r7, SPRN_DAWRX
++ std r5, STACK_SLOT_CIABR(r1)
++ std r6, STACK_SLOT_DAWR(r1)
++ std r7, STACK_SLOT_DAWRX(r1)
++END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
++
+ BEGIN_FTR_SECTION
+ /* Set partition DABR */
+ /* Do this before re-enabling PMU to avoid P7 DABR corruption bug */
+@@ -1266,8 +1283,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
+ */
+ li r0, 0
+ mtspr SPRN_IAMR, r0
+- mtspr SPRN_CIABR, r0
+- mtspr SPRN_DAWRX, r0
++ mtspr SPRN_PSPB, r0
+ mtspr SPRN_TCSCR, r0
+ mtspr SPRN_WORT, r0
+ /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
+@@ -1283,6 +1299,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
+ std r6,VCPU_UAMOR(r9)
+ li r6,0
+ mtspr SPRN_AMR,r6
++ mtspr SPRN_UAMOR, r6
+
+ /* Switch DSCR back to host value */
+ mfspr r8, SPRN_DSCR
+@@ -1424,6 +1441,16 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+ slbia
+ ptesync
+
++ /* Restore host values of some registers */
++BEGIN_FTR_SECTION
++ ld r5, STACK_SLOT_CIABR(r1)
++ ld r6, STACK_SLOT_DAWR(r1)
++ ld r7, STACK_SLOT_DAWRX(r1)
++ mtspr SPRN_CIABR, r5
++ mtspr SPRN_DAWR, r6
++ mtspr SPRN_DAWRX, r7
++END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
++
+ /*
+ * POWER7/POWER8 guest -> host partition switch code.
+ * We don't have to lock against tlbies but we do
+@@ -1533,8 +1560,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+ li r0, KVM_GUEST_MODE_NONE
+ stb r0, HSTATE_IN_GUEST(r13)
+
+- ld r0, 112+PPC_LR_STKOFF(r1)
+- addi r1, r1, 112
++ ld r0, SFS+PPC_LR_STKOFF(r1)
++ addi r1, r1, SFS
+ mtlr r0
+ blr
+
+diff --git a/arch/powerpc/platforms/pseries/reconfig.c b/arch/powerpc/platforms/pseries/reconfig.c
+index 7c7fcc042549..fb695f142563 100644
+--- a/arch/powerpc/platforms/pseries/reconfig.c
++++ b/arch/powerpc/platforms/pseries/reconfig.c
+@@ -82,7 +82,6 @@ static int pSeries_reconfig_remove_node(struct device_node *np)
+
+ of_detach_node(np);
+ of_node_put(parent);
+- of_node_put(np); /* Must decrement the refcount */
+ return 0;
+ }
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index 62aca448726a..2116176c1721 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -682,6 +682,9 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank)
+ const char *name = th_names[bank];
+ int err = 0;
+
++ if (!dev)
++ return -ENODEV;
++
+ if (is_shared_bank(bank)) {
+ nb = node_to_amd_nb(amd_get_nb_id(cpu));
+
+diff --git a/crypto/authencesn.c b/crypto/authencesn.c
+index 0c0468869e25..52154ef21b5e 100644
+--- a/crypto/authencesn.c
++++ b/crypto/authencesn.c
+@@ -245,6 +245,9 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req,
+ u8 *ihash = ohash + crypto_ahash_digestsize(auth);
+ u32 tmp[2];
+
++ if (!authsize)
++ goto decrypt;
++
+ /* Move high-order bits of sequence number back. */
+ scatterwalk_map_and_copy(tmp, dst, 4, 4, 0);
+ scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0);
+@@ -253,6 +256,8 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req,
+ if (crypto_memneq(ihash, ohash, authsize))
+ return -EBADMSG;
+
++decrypt:
++
+ sg_init_table(areq_ctx->dst, 2);
+ dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen);
+
+diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
+index 5ea5dc219f56..73c9c7fa9001 100644
+--- a/drivers/acpi/glue.c
++++ b/drivers/acpi/glue.c
+@@ -98,7 +98,15 @@ static int find_child_checks(struct acpi_device *adev, bool check_children)
+ if (check_children && list_empty(&adev->children))
+ return -ENODEV;
+
+- return sta_present ? FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE;
++ /*
++ * If the device has a _HID (or _CID) returning a valid ACPI/PNP
++ * device ID, it is better to make it look less attractive here, so that
++ * the other device with the same _ADR value (that may not have a valid
++ * device ID) can be matched going forward. [This means a second spec
++ * violation in a row, so whatever we do here is best effort anyway.]
++ */
++ return sta_present && list_empty(&adev->pnp.ids) ?
++ FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE;
+ }
+
+ struct acpi_device *acpi_find_child_device(struct acpi_device *parent,
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index 3f94e5fc110a..78b0ece0c867 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -1188,7 +1188,6 @@ static struct generic_pm_domain_data *genpd_alloc_dev_data(struct device *dev,
+ }
+
+ dev->power.subsys_data->domain_data = &gpd_data->base;
+- dev->pm_domain = &genpd->domain;
+
+ spin_unlock_irq(&dev->power.lock);
+
+@@ -1207,7 +1206,6 @@ static void genpd_free_dev_data(struct device *dev,
+ {
+ spin_lock_irq(&dev->power.lock);
+
+- dev->pm_domain = NULL;
+ dev->power.subsys_data->domain_data = NULL;
+
+ spin_unlock_irq(&dev->power.lock);
+@@ -1248,6 +1246,8 @@ int __pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
+ if (ret)
+ goto out;
+
++ dev->pm_domain = &genpd->domain;
++
+ genpd->device_count++;
+ genpd->max_off_time_changed = true;
+
+@@ -1299,6 +1299,8 @@ int pm_genpd_remove_device(struct generic_pm_domain *genpd,
+ if (genpd->detach_dev)
+ genpd->detach_dev(genpd, dev);
+
++ dev->pm_domain = NULL;
++
+ list_del_init(&pdd->list_node);
+
+ mutex_unlock(&genpd->lock);
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index 41fb1a917b17..33e23a7a691f 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -595,8 +595,6 @@ int xen_blkif_schedule(void *arg)
+ unsigned long timeout;
+ int ret;
+
+- xen_blkif_get(blkif);
+-
+ while (!kthread_should_stop()) {
+ if (try_to_freeze())
+ continue;
+@@ -650,7 +648,6 @@ int xen_blkif_schedule(void *arg)
+ print_stats(blkif);
+
+ blkif->xenblkd = NULL;
+- xen_blkif_put(blkif);
+
+ return 0;
+ }
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index f53cff42f8da..923308201375 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -221,7 +221,6 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
+ if (blkif->xenblkd) {
+ kthread_stop(blkif->xenblkd);
+ wake_up(&blkif->shutdown_wq);
+- blkif->xenblkd = NULL;
+ }
+
+ /* The above kthread_stop() guarantees that at this point we
+@@ -266,9 +265,10 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
+
+ static void xen_blkif_free(struct xen_blkif *blkif)
+ {
+-
+- xen_blkif_disconnect(blkif);
++ WARN_ON(xen_blkif_disconnect(blkif));
+ xen_vbd_free(&blkif->vbd);
++ kfree(blkif->be->mode);
++ kfree(blkif->be);
+
+ /* Make sure everything is drained before shutting down */
+ BUG_ON(blkif->persistent_gnt_c != 0);
+@@ -445,8 +445,6 @@ static int xen_blkbk_remove(struct xenbus_device *dev)
+ xen_blkif_put(be->blkif);
+ }
+
+- kfree(be->mode);
+- kfree(be);
+ return 0;
+ }
+
+diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
+index 096f0cef4da1..40d400fe5bb7 100644
+--- a/drivers/char/ipmi/ipmi_watchdog.c
++++ b/drivers/char/ipmi/ipmi_watchdog.c
+@@ -1162,10 +1162,11 @@ static int wdog_reboot_handler(struct notifier_block *this,
+ ipmi_watchdog_state = WDOG_TIMEOUT_NONE;
+ ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
+ } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) {
+- /* Set a long timer to let the reboot happens, but
+- reboot if it hangs, but only if the watchdog
++ /* Set a long timer to let the reboot happen or
++ reset if it hangs, but only if the watchdog
+ timer was already running. */
+- timeout = 120;
++ if (timeout < 120)
++ timeout = 120;
+ pretimeout = 0;
+ ipmi_watchdog_state = WDOG_TIMEOUT_RESET;
+ ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
+diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
+index 6d56877b2e0a..a0d9ac6b6cc9 100644
+--- a/drivers/char/tpm/tpm-chip.c
++++ b/drivers/char/tpm/tpm-chip.c
+@@ -29,9 +29,8 @@
+ #include "tpm.h"
+ #include "tpm_eventlog.h"
+
+-static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
+-static LIST_HEAD(tpm_chip_list);
+-static DEFINE_SPINLOCK(driver_lock);
++DEFINE_IDR(dev_nums_idr);
++static DEFINE_MUTEX(idr_lock);
+
+ struct class *tpm_class;
+ dev_t tpm_devt;
+@@ -92,20 +91,30 @@ EXPORT_SYMBOL_GPL(tpm_put_ops);
+ */
+ struct tpm_chip *tpm_chip_find_get(int chip_num)
+ {
+- struct tpm_chip *pos, *chip = NULL;
++ struct tpm_chip *chip, *res = NULL;
++ int chip_prev;
++
++ mutex_lock(&idr_lock);
++
++ if (chip_num == TPM_ANY_NUM) {
++ chip_num = 0;
++ do {
++ chip_prev = chip_num;
++ chip = idr_get_next(&dev_nums_idr, &chip_num);
++ if (chip && !tpm_try_get_ops(chip)) {
++ res = chip;
++ break;
++ }
++ } while (chip_prev != chip_num);
++ } else {
++ chip = idr_find_slowpath(&dev_nums_idr, chip_num);
++ if (chip && !tpm_try_get_ops(chip))
++ res = chip;
++ }
+
+- rcu_read_lock();
+- list_for_each_entry_rcu(pos, &tpm_chip_list, list) {
+- if (chip_num != TPM_ANY_NUM && chip_num != pos->dev_num)
+- continue;
++ mutex_unlock(&idr_lock);
+
+- /* rcu prevents chip from being free'd */
+- if (!tpm_try_get_ops(pos))
+- chip = pos;
+- break;
+- }
+- rcu_read_unlock();
+- return chip;
++ return res;
+ }
+
+ /**
+@@ -118,9 +127,10 @@ static void tpm_dev_release(struct device *dev)
+ {
+ struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev);
+
+- spin_lock(&driver_lock);
+- clear_bit(chip->dev_num, dev_mask);
+- spin_unlock(&driver_lock);
++ mutex_lock(&idr_lock);
++ idr_remove(&dev_nums_idr, chip->dev_num);
++ mutex_unlock(&idr_lock);
++
+ kfree(chip);
+ }
+
+@@ -173,6 +183,7 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
+ const struct tpm_class_ops *ops)
+ {
+ struct tpm_chip *chip;
++ int rc;
+
+ chip = kzalloc(sizeof(*chip), GFP_KERNEL);
+ if (chip == NULL)
+@@ -180,21 +191,18 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
+
+ mutex_init(&chip->tpm_mutex);
+ init_rwsem(&chip->ops_sem);
+- INIT_LIST_HEAD(&chip->list);
+
+ chip->ops = ops;
+
+- spin_lock(&driver_lock);
+- chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
+- spin_unlock(&driver_lock);
+-
+- if (chip->dev_num >= TPM_NUM_DEVICES) {
++ mutex_lock(&idr_lock);
++ rc = idr_alloc(&dev_nums_idr, NULL, 0, TPM_NUM_DEVICES, GFP_KERNEL);
++ mutex_unlock(&idr_lock);
++ if (rc < 0) {
+ dev_err(dev, "No available tpm device numbers\n");
+ kfree(chip);
+- return ERR_PTR(-ENOMEM);
++ return ERR_PTR(rc);
+ }
+-
+- set_bit(chip->dev_num, dev_mask);
++ chip->dev_num = rc;
+
+ scnprintf(chip->devname, sizeof(chip->devname), "tpm%d", chip->dev_num);
+
+@@ -252,19 +260,28 @@ static int tpm_add_char_device(struct tpm_chip *chip)
+ return rc;
+ }
+
++ /* Make the chip available. */
++ mutex_lock(&idr_lock);
++ idr_replace(&dev_nums_idr, chip, chip->dev_num);
++ mutex_unlock(&idr_lock);
++
+ return rc;
+ }
+
+ static void tpm_del_char_device(struct tpm_chip *chip)
+ {
+ cdev_del(&chip->cdev);
++ device_del(&chip->dev);
++
++ /* Make the chip unavailable. */
++ mutex_lock(&idr_lock);
++ idr_replace(&dev_nums_idr, NULL, chip->dev_num);
++ mutex_unlock(&idr_lock);
+
+ /* Make the driver uncallable. */
+ down_write(&chip->ops_sem);
+ chip->ops = NULL;
+ up_write(&chip->ops_sem);
+-
+- device_del(&chip->dev);
+ }
+
+ static int tpm1_chip_register(struct tpm_chip *chip)
+@@ -319,11 +336,6 @@ int tpm_chip_register(struct tpm_chip *chip)
+ if (rc)
+ goto out_err;
+
+- /* Make the chip available. */
+- spin_lock(&driver_lock);
+- list_add_tail_rcu(&chip->list, &tpm_chip_list);
+- spin_unlock(&driver_lock);
+-
+ chip->flags |= TPM_CHIP_FLAG_REGISTERED;
+
+ if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
+@@ -360,11 +372,6 @@ void tpm_chip_unregister(struct tpm_chip *chip)
+ if (!(chip->flags & TPM_CHIP_FLAG_REGISTERED))
+ return;
+
+- spin_lock(&driver_lock);
+- list_del_rcu(&chip->list);
+- spin_unlock(&driver_lock);
+- synchronize_rcu();
+-
+ if (!(chip->flags & TPM_CHIP_FLAG_TPM2))
+ sysfs_remove_link(&chip->dev.parent->kobj, "ppi");
+
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 8588f2e4b9af..aaa5fa95dede 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -1127,6 +1127,7 @@ static int __init tpm_init(void)
+
+ static void __exit tpm_exit(void)
+ {
++ idr_destroy(&dev_nums_idr);
+ class_destroy(tpm_class);
+ unregister_chrdev_region(tpm_devt, TPM_NUM_DEVICES);
+ }
+diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
+index 6a4056a3f7ee..06ac6e9657d2 100644
+--- a/drivers/char/tpm/tpm-sysfs.c
++++ b/drivers/char/tpm/tpm-sysfs.c
+@@ -38,6 +38,8 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
+
+ struct tpm_chip *chip = dev_get_drvdata(dev);
+
++ memset(&tpm_cmd, 0, sizeof(tpm_cmd));
++
+ tpm_cmd.header.in = tpm_readpubek_header;
+ err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0,
+ "attempting to read the PUBEK");
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index e21e2c599e66..772d99b3a8e4 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -34,7 +34,7 @@
+ enum tpm_const {
+ TPM_MINOR = 224, /* officially assigned */
+ TPM_BUFSIZE = 4096,
+- TPM_NUM_DEVICES = 256,
++ TPM_NUM_DEVICES = 65536,
+ TPM_RETRY = 50, /* 5 seconds */
+ };
+
+@@ -200,8 +200,6 @@ struct tpm_chip {
+ acpi_handle acpi_dev_handle;
+ char ppi_version[TPM_PPI_VERSION_LEN + 1];
+ #endif /* CONFIG_ACPI */
+-
+- struct list_head list;
+ };
+
+ #define to_tpm_chip(d) container_of(d, struct tpm_chip, dev)
+@@ -497,6 +495,7 @@ static inline void tpm_buf_append_u32(struct tpm_buf *buf, const u32 value)
+ extern struct class *tpm_class;
+ extern dev_t tpm_devt;
+ extern const struct file_operations tpm_fops;
++extern struct idr dev_nums_idr;
+
+ enum tpm_transmit_flags {
+ TPM_TRANSMIT_UNLOCKED = BIT(0),
+diff --git a/drivers/dma/ioat/hw.h b/drivers/dma/ioat/hw.h
+index 690e3b4f8202..b36da3c1073f 100644
+--- a/drivers/dma/ioat/hw.h
++++ b/drivers/dma/ioat/hw.h
+@@ -64,6 +64,8 @@
+ #define PCI_DEVICE_ID_INTEL_IOAT_BDX8 0x6f2e
+ #define PCI_DEVICE_ID_INTEL_IOAT_BDX9 0x6f2f
+
++#define PCI_DEVICE_ID_INTEL_IOAT_SKX 0x2021
++
+ #define IOAT_VER_1_2 0x12 /* Version 1.2 */
+ #define IOAT_VER_2_0 0x20 /* Version 2.0 */
+ #define IOAT_VER_3_0 0x30 /* Version 3.0 */
+diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
+index 4ef0c5e07912..abb75ebd65ea 100644
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -105,6 +105,8 @@ static struct pci_device_id ioat_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_BDX8) },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_BDX9) },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_SKX) },
++
+ /* I/OAT v3.3 platforms */
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_BWD0) },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_BWD1) },
+@@ -250,10 +252,15 @@ static bool is_bdx_ioat(struct pci_dev *pdev)
+ }
+ }
+
++static inline bool is_skx_ioat(struct pci_dev *pdev)
++{
++ return (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_SKX) ? true : false;
++}
++
+ static bool is_xeon_cb32(struct pci_dev *pdev)
+ {
+ return is_jf_ioat(pdev) || is_snb_ioat(pdev) || is_ivb_ioat(pdev) ||
+- is_hsw_ioat(pdev) || is_bdx_ioat(pdev);
++ is_hsw_ioat(pdev) || is_bdx_ioat(pdev) || is_skx_ioat(pdev);
+ }
+
+ bool is_bwd_ioat(struct pci_dev *pdev)
+@@ -1350,6 +1357,8 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ device->version = readb(device->reg_base + IOAT_VER_OFFSET);
+ if (device->version >= IOAT_VER_3_0) {
++ if (is_skx_ioat(pdev))
++ device->version = IOAT_VER_3_2;
+ err = ioat3_dma_probe(device, ioat_dca_enabled);
+
+ if (device->version >= IOAT_VER_3_3)
+diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c
+index a415edbe61b1..149ec2bd9bc6 100644
+--- a/drivers/dma/ti-dma-crossbar.c
++++ b/drivers/dma/ti-dma-crossbar.c
+@@ -146,6 +146,7 @@ static int ti_am335x_xbar_probe(struct platform_device *pdev)
+ match = of_match_node(ti_am335x_master_match, dma_node);
+ if (!match) {
+ dev_err(&pdev->dev, "DMA master is not supported\n");
++ of_node_put(dma_node);
+ return -EINVAL;
+ }
+
+@@ -310,6 +311,7 @@ static int ti_dra7_xbar_probe(struct platform_device *pdev)
+ match = of_match_node(ti_dra7_master_match, dma_node);
+ if (!match) {
+ dev_err(&pdev->dev, "DMA master is not supported\n");
++ of_node_put(dma_node);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index a3b54cc76495..b66ffd44ff26 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -204,7 +204,14 @@ int adreno_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
+ void adreno_flush(struct msm_gpu *gpu)
+ {
+ struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+- uint32_t wptr = get_wptr(gpu->rb);
++ uint32_t wptr;
++
++ /*
++ * Mask wptr value that we calculate to fit in the HW range. This is
++ * to account for the possibility that the last command fit exactly into
++ * the ringbuffer and rb->next hasn't wrapped to zero yet
++ */
++ wptr = get_wptr(gpu->rb) & ((gpu->rb->size / 4) - 1);
+
+ /* ensure writes to ringbuffer have hit system memory: */
+ mb();
+diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
+index 1847f83b1e33..fed44d4e5b72 100644
+--- a/drivers/gpu/drm/msm/msm_gem_submit.c
++++ b/drivers/gpu/drm/msm/msm_gem_submit.c
+@@ -90,7 +90,8 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
+ pagefault_disable();
+ }
+
+- if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
++ if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) ||
++ !(submit_bo.flags & MSM_SUBMIT_BO_FLAGS)) {
+ DRM_ERROR("invalid flags: %x\n", submit_bo.flags);
+ ret = -EINVAL;
+ goto out_unlock;
+diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c
+index 1f14b908b221..ae317271cf81 100644
+--- a/drivers/gpu/drm/msm/msm_ringbuffer.c
++++ b/drivers/gpu/drm/msm/msm_ringbuffer.c
+@@ -23,7 +23,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int size)
+ struct msm_ringbuffer *ring;
+ int ret;
+
+- size = ALIGN(size, 4); /* size should be dword aligned */
++ if (WARN_ON(!is_power_of_2(size)))
++ return ERR_PTR(-EINVAL);
+
+ ring = kzalloc(sizeof(*ring), GFP_KERNEL);
+ if (!ring) {
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
+index c794b2c2d21e..6d8f21290aa2 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
+@@ -129,7 +129,7 @@ gf100_bar_init(struct nvkm_bar *base)
+
+ if (bar->bar[0].mem) {
+ addr = nvkm_memory_addr(bar->bar[0].mem) >> 12;
+- nvkm_wr32(device, 0x001714, 0xc0000000 | addr);
++ nvkm_wr32(device, 0x001714, 0x80000000 | addr);
+ }
+
+ return 0;
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+index 48cb19949ca3..9255b9c096b6 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -282,26 +282,6 @@ static void rcar_du_crtc_update_planes(struct rcar_du_crtc *rcrtc)
+ * Page Flip
+ */
+
+-void rcar_du_crtc_cancel_page_flip(struct rcar_du_crtc *rcrtc,
+- struct drm_file *file)
+-{
+- struct drm_pending_vblank_event *event;
+- struct drm_device *dev = rcrtc->crtc.dev;
+- unsigned long flags;
+-
+- /* Destroy the pending vertical blanking event associated with the
+- * pending page flip, if any, and disable vertical blanking interrupts.
+- */
+- spin_lock_irqsave(&dev->event_lock, flags);
+- event = rcrtc->event;
+- if (event && event->base.file_priv == file) {
+- rcrtc->event = NULL;
+- event->base.destroy(&event->base);
+- drm_crtc_vblank_put(&rcrtc->crtc);
+- }
+- spin_unlock_irqrestore(&dev->event_lock, flags);
+-}
+-
+ static void rcar_du_crtc_finish_page_flip(struct rcar_du_crtc *rcrtc)
+ {
+ struct drm_pending_vblank_event *event;
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h
+index 4b95d9d08c49..2bbe3f5aab65 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h
+@@ -67,8 +67,6 @@ enum rcar_du_output {
+
+ int rcar_du_crtc_create(struct rcar_du_group *rgrp, unsigned int index);
+ void rcar_du_crtc_enable_vblank(struct rcar_du_crtc *rcrtc, bool enable);
+-void rcar_du_crtc_cancel_page_flip(struct rcar_du_crtc *rcrtc,
+- struct drm_file *file);
+ void rcar_du_crtc_suspend(struct rcar_du_crtc *rcrtc);
+ void rcar_du_crtc_resume(struct rcar_du_crtc *rcrtc);
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+index 40422f6b645e..bf4674aa6405 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+@@ -144,91 +144,6 @@ MODULE_DEVICE_TABLE(of, rcar_du_of_table);
+ * DRM operations
+ */
+
+-static int rcar_du_unload(struct drm_device *dev)
+-{
+- struct rcar_du_device *rcdu = dev->dev_private;
+-
+- if (rcdu->fbdev)
+- drm_fbdev_cma_fini(rcdu->fbdev);
+-
+- drm_kms_helper_poll_fini(dev);
+- drm_mode_config_cleanup(dev);
+- drm_vblank_cleanup(dev);
+-
+- dev->irq_enabled = 0;
+- dev->dev_private = NULL;
+-
+- return 0;
+-}
+-
+-static int rcar_du_load(struct drm_device *dev, unsigned long flags)
+-{
+- struct platform_device *pdev = dev->platformdev;
+- struct device_node *np = pdev->dev.of_node;
+- struct rcar_du_device *rcdu;
+- struct resource *mem;
+- int ret;
+-
+- if (np == NULL) {
+- dev_err(dev->dev, "no platform data\n");
+- return -ENODEV;
+- }
+-
+- rcdu = devm_kzalloc(&pdev->dev, sizeof(*rcdu), GFP_KERNEL);
+- if (rcdu == NULL) {
+- dev_err(dev->dev, "failed to allocate private data\n");
+- return -ENOMEM;
+- }
+-
+- init_waitqueue_head(&rcdu->commit.wait);
+-
+- rcdu->dev = &pdev->dev;
+- rcdu->info = of_match_device(rcar_du_of_table, rcdu->dev)->data;
+- rcdu->ddev = dev;
+- dev->dev_private = rcdu;
+-
+- /* I/O resources */
+- mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- rcdu->mmio = devm_ioremap_resource(&pdev->dev, mem);
+- if (IS_ERR(rcdu->mmio))
+- return PTR_ERR(rcdu->mmio);
+-
+- /* Initialize vertical blanking interrupts handling. Start with vblank
+- * disabled for all CRTCs.
+- */
+- ret = drm_vblank_init(dev, (1 << rcdu->info->num_crtcs) - 1);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "failed to initialize vblank\n");
+- goto done;
+- }
+-
+- /* DRM/KMS objects */
+- ret = rcar_du_modeset_init(rcdu);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "failed to initialize DRM/KMS (%d)\n", ret);
+- goto done;
+- }
+-
+- dev->irq_enabled = 1;
+-
+- platform_set_drvdata(pdev, rcdu);
+-
+-done:
+- if (ret)
+- rcar_du_unload(dev);
+-
+- return ret;
+-}
+-
+-static void rcar_du_preclose(struct drm_device *dev, struct drm_file *file)
+-{
+- struct rcar_du_device *rcdu = dev->dev_private;
+- unsigned int i;
+-
+- for (i = 0; i < rcdu->num_crtcs; ++i)
+- rcar_du_crtc_cancel_page_flip(&rcdu->crtcs[i], file);
+-}
+-
+ static void rcar_du_lastclose(struct drm_device *dev)
+ {
+ struct rcar_du_device *rcdu = dev->dev_private;
+@@ -269,11 +184,7 @@ static const struct file_operations rcar_du_fops = {
+ static struct drm_driver rcar_du_driver = {
+ .driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME
+ | DRIVER_ATOMIC,
+- .load = rcar_du_load,
+- .unload = rcar_du_unload,
+- .preclose = rcar_du_preclose,
+ .lastclose = rcar_du_lastclose,
+- .set_busid = drm_platform_set_busid,
+ .get_vblank_counter = drm_vblank_no_hw_counter,
+ .enable_vblank = rcar_du_enable_vblank,
+ .disable_vblank = rcar_du_disable_vblank,
+@@ -333,18 +244,104 @@ static const struct dev_pm_ops rcar_du_pm_ops = {
+ * Platform driver
+ */
+
+-static int rcar_du_probe(struct platform_device *pdev)
++static int rcar_du_remove(struct platform_device *pdev)
+ {
+- return drm_platform_init(&rcar_du_driver, pdev);
++ struct rcar_du_device *rcdu = platform_get_drvdata(pdev);
++ struct drm_device *ddev = rcdu->ddev;
++
++ mutex_lock(&ddev->mode_config.mutex);
++ drm_connector_unplug_all(ddev);
++ mutex_unlock(&ddev->mode_config.mutex);
++
++ drm_dev_unregister(ddev);
++
++ if (rcdu->fbdev)
++ drm_fbdev_cma_fini(rcdu->fbdev);
++
++ drm_kms_helper_poll_fini(ddev);
++ drm_mode_config_cleanup(ddev);
++
++ drm_dev_unref(ddev);
++
++ return 0;
+ }
+
+-static int rcar_du_remove(struct platform_device *pdev)
++static int rcar_du_probe(struct platform_device *pdev)
+ {
+- struct rcar_du_device *rcdu = platform_get_drvdata(pdev);
++ struct device_node *np = pdev->dev.of_node;
++ struct rcar_du_device *rcdu;
++ struct drm_connector *connector;
++ struct drm_device *ddev;
++ struct resource *mem;
++ int ret;
++
++ if (np == NULL) {
++ dev_err(&pdev->dev, "no device tree node\n");
++ return -ENODEV;
++ }
++
++ /* Allocate and initialize the DRM and R-Car device structures. */
++ rcdu = devm_kzalloc(&pdev->dev, sizeof(*rcdu), GFP_KERNEL);
++ if (rcdu == NULL)
++ return -ENOMEM;
++
++ init_waitqueue_head(&rcdu->commit.wait);
++
++ rcdu->dev = &pdev->dev;
++ rcdu->info = of_match_device(rcar_du_of_table, rcdu->dev)->data;
++
++ platform_set_drvdata(pdev, rcdu);
+
+- drm_put_dev(rcdu->ddev);
++ /* I/O resources */
++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ rcdu->mmio = devm_ioremap_resource(&pdev->dev, mem);
++ if (IS_ERR(rcdu->mmio))
++ ret = PTR_ERR(rcdu->mmio);
++
++ /* DRM/KMS objects */
++ ddev = drm_dev_alloc(&rcar_du_driver, &pdev->dev);
++ if (!ddev)
++ return -ENOMEM;
++
++ drm_dev_set_unique(ddev, dev_name(&pdev->dev));
++
++ rcdu->ddev = ddev;
++ ddev->dev_private = rcdu;
++
++ ret = rcar_du_modeset_init(rcdu);
++ if (ret < 0) {
++ dev_err(&pdev->dev, "failed to initialize DRM/KMS (%d)\n", ret);
++ goto error;
++ }
++
++ ddev->irq_enabled = 1;
++
++ /* Register the DRM device with the core and the connectors with
++ * sysfs.
++ */
++ ret = drm_dev_register(ddev, 0);
++ if (ret)
++ goto error;
++
++ mutex_lock(&ddev->mode_config.mutex);
++ drm_for_each_connector(connector, ddev) {
++ ret = drm_connector_register(connector);
++ if (ret < 0)
++ break;
++ }
++ mutex_unlock(&ddev->mode_config.mutex);
++
++ if (ret < 0)
++ goto error;
++
++ DRM_INFO("Device %s probed\n", dev_name(&pdev->dev));
+
+ return 0;
++
++error:
++ rcar_du_remove(pdev);
++
++ return ret;
+ }
+
+ static struct platform_driver rcar_du_platform_driver = {
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_hdmicon.c b/drivers/gpu/drm/rcar-du/rcar_du_hdmicon.c
+index 96f2eb43713c..6038be93c58d 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_hdmicon.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_hdmicon.c
+@@ -55,12 +55,6 @@ static const struct drm_connector_helper_funcs connector_helper_funcs = {
+ .best_encoder = rcar_du_connector_best_encoder,
+ };
+
+-static void rcar_du_hdmi_connector_destroy(struct drm_connector *connector)
+-{
+- drm_connector_unregister(connector);
+- drm_connector_cleanup(connector);
+-}
+-
+ static enum drm_connector_status
+ rcar_du_hdmi_connector_detect(struct drm_connector *connector, bool force)
+ {
+@@ -79,7 +73,7 @@ static const struct drm_connector_funcs connector_funcs = {
+ .reset = drm_atomic_helper_connector_reset,
+ .detect = rcar_du_hdmi_connector_detect,
+ .fill_modes = drm_helper_probe_single_connector_modes,
+- .destroy = rcar_du_hdmi_connector_destroy,
++ .destroy = drm_connector_cleanup,
+ .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+ .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+ };
+@@ -108,9 +102,6 @@ int rcar_du_hdmi_connector_init(struct rcar_du_device *rcdu,
+ return ret;
+
+ drm_connector_helper_add(connector, &connector_helper_funcs);
+- ret = drm_connector_register(connector);
+- if (ret < 0)
+- return ret;
+
+ connector->dpms = DRM_MODE_DPMS_OFF;
+ drm_object_property_set_value(&connector->base,
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index ca12e8ca5552..46429c4be8e5 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -761,6 +761,13 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu)
+ if (ret < 0)
+ return ret;
+
++ /* Initialize vertical blanking interrupts handling. Start with vblank
++ * disabled for all CRTCs.
++ */
++ ret = drm_vblank_init(dev, (1 << rcdu->info->num_crtcs) - 1);
++ if (ret < 0)
++ return ret;
++
+ /* Initialize the groups. */
+ num_groups = DIV_ROUND_UP(rcdu->num_crtcs, 2);
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_lvdscon.c b/drivers/gpu/drm/rcar-du/rcar_du_lvdscon.c
+index 0c43032fc693..e905f5da7aaa 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_lvdscon.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_lvdscon.c
+@@ -62,12 +62,6 @@ static const struct drm_connector_helper_funcs connector_helper_funcs = {
+ .best_encoder = rcar_du_connector_best_encoder,
+ };
+
+-static void rcar_du_lvds_connector_destroy(struct drm_connector *connector)
+-{
+- drm_connector_unregister(connector);
+- drm_connector_cleanup(connector);
+-}
+-
+ static enum drm_connector_status
+ rcar_du_lvds_connector_detect(struct drm_connector *connector, bool force)
+ {
+@@ -79,7 +73,7 @@ static const struct drm_connector_funcs connector_funcs = {
+ .reset = drm_atomic_helper_connector_reset,
+ .detect = rcar_du_lvds_connector_detect,
+ .fill_modes = drm_helper_probe_single_connector_modes,
+- .destroy = rcar_du_lvds_connector_destroy,
++ .destroy = drm_connector_cleanup,
+ .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+ .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+ };
+@@ -117,9 +111,6 @@ int rcar_du_lvds_connector_init(struct rcar_du_device *rcdu,
+ return ret;
+
+ drm_connector_helper_add(connector, &connector_helper_funcs);
+- ret = drm_connector_register(connector);
+- if (ret < 0)
+- return ret;
+
+ connector->dpms = DRM_MODE_DPMS_OFF;
+ drm_object_property_set_value(&connector->base,
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vgacon.c b/drivers/gpu/drm/rcar-du/rcar_du_vgacon.c
+index e0a5d8f93963..9d7e5c99caf6 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_vgacon.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_vgacon.c
+@@ -31,12 +31,6 @@ static const struct drm_connector_helper_funcs connector_helper_funcs = {
+ .best_encoder = rcar_du_connector_best_encoder,
+ };
+
+-static void rcar_du_vga_connector_destroy(struct drm_connector *connector)
+-{
+- drm_connector_unregister(connector);
+- drm_connector_cleanup(connector);
+-}
+-
+ static enum drm_connector_status
+ rcar_du_vga_connector_detect(struct drm_connector *connector, bool force)
+ {
+@@ -48,7 +42,7 @@ static const struct drm_connector_funcs connector_funcs = {
+ .reset = drm_atomic_helper_connector_reset,
+ .detect = rcar_du_vga_connector_detect,
+ .fill_modes = drm_helper_probe_single_connector_modes,
+- .destroy = rcar_du_vga_connector_destroy,
++ .destroy = drm_connector_cleanup,
+ .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
+ .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
+ };
+@@ -76,9 +70,6 @@ int rcar_du_vga_connector_init(struct rcar_du_device *rcdu,
+ return ret;
+
+ drm_connector_helper_add(connector, &connector_helper_funcs);
+- ret = drm_connector_register(connector);
+- if (ret < 0)
+- return ret;
+
+ connector->dpms = DRM_MODE_DPMS_OFF;
+ drm_object_property_set_value(&connector->base,
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index ecf15cf0c3fd..04fd0f2b6af0 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -471,7 +471,7 @@ static int vmw_cmd_invalid(struct vmw_private *dev_priv,
+ struct vmw_sw_context *sw_context,
+ SVGA3dCmdHeader *header)
+ {
+- return capable(CAP_SYS_ADMIN) ? : -EINVAL;
++ return -EINVAL;
+ }
+
+ static int vmw_cmd_ok(struct vmw_private *dev_priv,
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 936960202cf4..11a051bd8a8b 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -2427,6 +2427,7 @@ static const struct hid_device_id hid_ignore_list[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0002) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0003) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0004) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_PETZL, USB_DEVICE_ID_PETZL_HEADLAMP) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PHILIPS, USB_DEVICE_ID_PHILIPS_IEEE802154_DONGLE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_POWERCOM, USB_DEVICE_ID_POWERCOM_UPS) },
+ #if defined(CONFIG_MOUSE_SYNAPTICS_USB) || defined(CONFIG_MOUSE_SYNAPTICS_USB_MODULE)
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index c7f8b70d15ee..37cbc2ecfc5f 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -777,6 +777,9 @@
+ #define USB_VENDOR_ID_PETALYNX 0x18b1
+ #define USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE 0x0037
+
++#define USB_VENDOR_ID_PETZL 0x2122
++#define USB_DEVICE_ID_PETZL_HEADLAMP 0x1234
++
+ #define USB_VENDOR_ID_PHILIPS 0x0471
+ #define USB_DEVICE_ID_PHILIPS_IEEE802154_DONGLE 0x0617
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 9eca4b41fa0a..b7a73f1a8beb 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -2287,8 +2287,9 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
+ if (copy_from_user(&cmd, buf, sizeof cmd))
+ return -EFAULT;
+
+- if (cmd.port_num < rdma_start_port(ib_dev) ||
+- cmd.port_num > rdma_end_port(ib_dev))
++ if ((cmd.attr_mask & IB_QP_PORT) &&
++ (cmd.port_num < rdma_start_port(ib_dev) ||
++ cmd.port_num > rdma_end_port(ib_dev)))
+ return -EINVAL;
+
+ INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
+diff --git a/drivers/irqchip/irq-keystone.c b/drivers/irqchip/irq-keystone.c
+index deb89d63a728..e684be1bb7c0 100644
+--- a/drivers/irqchip/irq-keystone.c
++++ b/drivers/irqchip/irq-keystone.c
+@@ -19,9 +19,9 @@
+ #include <linux/bitops.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
++#include <linux/interrupt.h>
+ #include <linux/irqdomain.h>
+ #include <linux/irqchip.h>
+-#include <linux/irqchip/chained_irq.h>
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+ #include <linux/mfd/syscon.h>
+@@ -39,6 +39,7 @@ struct keystone_irq_device {
+ struct irq_domain *irqd;
+ struct regmap *devctrl_regs;
+ u32 devctrl_offset;
++ raw_spinlock_t wa_lock;
+ };
+
+ static inline u32 keystone_irq_readl(struct keystone_irq_device *kirq)
+@@ -83,17 +84,15 @@ static void keystone_irq_ack(struct irq_data *d)
+ /* nothing to do here */
+ }
+
+-static void keystone_irq_handler(struct irq_desc *desc)
++static irqreturn_t keystone_irq_handler(int irq, void *keystone_irq)
+ {
+- unsigned int irq = irq_desc_get_irq(desc);
+- struct keystone_irq_device *kirq = irq_desc_get_handler_data(desc);
++ struct keystone_irq_device *kirq = keystone_irq;
++ unsigned long wa_lock_flags;
+ unsigned long pending;
+ int src, virq;
+
+ dev_dbg(kirq->dev, "start irq %d\n", irq);
+
+- chained_irq_enter(irq_desc_get_chip(desc), desc);
+-
+ pending = keystone_irq_readl(kirq);
+ keystone_irq_writel(kirq, pending);
+
+@@ -111,13 +110,15 @@ static void keystone_irq_handler(struct irq_desc *desc)
+ if (!virq)
+ dev_warn(kirq->dev, "sporious irq detected hwirq %d, virq %d\n",
+ src, virq);
++ raw_spin_lock_irqsave(&kirq->wa_lock, wa_lock_flags);
+ generic_handle_irq(virq);
++ raw_spin_unlock_irqrestore(&kirq->wa_lock,
++ wa_lock_flags);
+ }
+ }
+
+- chained_irq_exit(irq_desc_get_chip(desc), desc);
+-
+ dev_dbg(kirq->dev, "end irq %d\n", irq);
++ return IRQ_HANDLED;
+ }
+
+ static int keystone_irq_map(struct irq_domain *h, unsigned int virq,
+@@ -182,9 +183,16 @@ static int keystone_irq_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
++ raw_spin_lock_init(&kirq->wa_lock);
++
+ platform_set_drvdata(pdev, kirq);
+
+- irq_set_chained_handler_and_data(kirq->irq, keystone_irq_handler, kirq);
++ ret = request_irq(kirq->irq, keystone_irq_handler,
++ 0, dev_name(dev), kirq);
++ if (ret) {
++ irq_domain_remove(kirq->irqd);
++ return ret;
++ }
+
+ /* clear all source bits */
+ keystone_irq_writel(kirq, ~0x0);
+@@ -199,6 +207,8 @@ static int keystone_irq_remove(struct platform_device *pdev)
+ struct keystone_irq_device *kirq = platform_get_drvdata(pdev);
+ int hwirq;
+
++ free_irq(kirq->irq, kirq);
++
+ for (hwirq = 0; hwirq < KEYSTONE_N_IRQ; hwirq++)
+ irq_dispose_mapping(irq_find_mapping(kirq->irqd, hwirq));
+
+diff --git a/drivers/irqchip/irq-mxs.c b/drivers/irqchip/irq-mxs.c
+index 17304705f2cf..05fa9f7af53c 100644
+--- a/drivers/irqchip/irq-mxs.c
++++ b/drivers/irqchip/irq-mxs.c
+@@ -131,12 +131,16 @@ static struct irq_chip mxs_icoll_chip = {
+ .irq_ack = icoll_ack_irq,
+ .irq_mask = icoll_mask_irq,
+ .irq_unmask = icoll_unmask_irq,
++ .flags = IRQCHIP_MASK_ON_SUSPEND |
++ IRQCHIP_SKIP_SET_WAKE,
+ };
+
+ static struct irq_chip asm9260_icoll_chip = {
+ .irq_ack = icoll_ack_irq,
+ .irq_mask = asm9260_mask_irq,
+ .irq_unmask = asm9260_unmask_irq,
++ .flags = IRQCHIP_MASK_ON_SUSPEND |
++ IRQCHIP_SKIP_SET_WAKE,
+ };
+
+ asmlinkage void __exception_irq_entry icoll_handle_irq(struct pt_regs *regs)
+diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
+index 9b856e1890d1..e4c43a17b333 100644
+--- a/drivers/isdn/i4l/isdn_common.c
++++ b/drivers/isdn/i4l/isdn_common.c
+@@ -1379,6 +1379,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
+ if (arg) {
+ if (copy_from_user(bname, argp, sizeof(bname) - 1))
+ return -EFAULT;
++ bname[sizeof(bname)-1] = 0;
+ } else
+ return -EINVAL;
+ ret = mutex_lock_interruptible(&dev->mtx);
+diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
+index aa5dd5668528..dbad5c431bcb 100644
+--- a/drivers/isdn/i4l/isdn_net.c
++++ b/drivers/isdn/i4l/isdn_net.c
+@@ -2611,10 +2611,9 @@ isdn_net_newslave(char *parm)
+ char newname[10];
+
+ if (p) {
+- /* Slave-Name MUST not be empty */
+- if (!strlen(p + 1))
++ /* Slave-Name MUST not be empty or overflow 'newname' */
++ if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
+ return NULL;
+- strcpy(newname, p + 1);
+ *p = 0;
+ /* Master must already exist */
+ if (!(n = isdn_net_findif(parm)))
+diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
+index 9c1e8adaf4fc..bf3fbd00a091 100644
+--- a/drivers/isdn/i4l/isdn_ppp.c
++++ b/drivers/isdn/i4l/isdn_ppp.c
+@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn_ppp_ccp_reset_alloc_state(struct ippp_s
+ id);
+ return NULL;
+ } else {
+- rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL);
++ rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC);
+ if (!rs)
+ return NULL;
+ rs->state = CCPResetIdle;
+diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
+index 6a4811f85705..9cf826df89b1 100644
+--- a/drivers/mailbox/mailbox.c
++++ b/drivers/mailbox/mailbox.c
+@@ -104,11 +104,14 @@ static void tx_tick(struct mbox_chan *chan, int r)
+ /* Submit next message */
+ msg_submit(chan);
+
++ if (!mssg)
++ return;
++
+ /* Notify the client */
+- if (mssg && chan->cl->tx_done)
++ if (chan->cl->tx_done)
+ chan->cl->tx_done(chan->cl, mssg, r);
+
+- if (chan->cl->tx_block)
++ if (r != -ETIME && chan->cl->tx_block)
+ complete(&chan->tx_complete);
+ }
+
+@@ -261,7 +264,7 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg)
+
+ msg_submit(chan);
+
+- if (chan->cl->tx_block && chan->active_req) {
++ if (chan->cl->tx_block) {
+ unsigned long wait;
+ int ret;
+
+@@ -272,8 +275,8 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg)
+
+ ret = wait_for_completion_timeout(&chan->tx_complete, wait);
+ if (ret == 0) {
+- t = -EIO;
+- tx_tick(chan, -EIO);
++ t = -ETIME;
++ tx_tick(chan, t);
+ }
+ }
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index fc182c4f2619..8f60520c8392 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5821,6 +5821,8 @@ static void raid5_do_work(struct work_struct *work)
+ pr_debug("%d stripes handled\n", handled);
+
+ spin_unlock_irq(&conf->device_lock);
++
++ async_tx_issue_pending_all();
+ blk_finish_plug(&plug);
+
+ pr_debug("--- raid5worker inactive\n");
+diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c b/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c
+index 8001cde1db1e..503135a4f47a 100644
+--- a/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c
++++ b/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c
+@@ -211,7 +211,7 @@ static int s5c73m3_3a_lock(struct s5c73m3 *state, struct v4l2_ctrl *ctrl)
+ }
+
+ if ((ctrl->val ^ ctrl->cur.val) & V4L2_LOCK_FOCUS)
+- ret = s5c73m3_af_run(state, ~af_lock);
++ ret = s5c73m3_af_run(state, !af_lock);
+
+ return ret;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
+index 2a9dd460a95f..e1f9e7cebf8f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
++++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
+@@ -118,8 +118,13 @@ static int mlx4_alloc_icm_coherent(struct device *dev, struct scatterlist *mem,
+ if (!buf)
+ return -ENOMEM;
+
++ if (offset_in_page(buf)) {
++ dma_free_coherent(dev, PAGE_SIZE << order,
++ buf, sg_dma_address(mem));
++ return -ENOMEM;
++ }
++
+ sg_set_buf(mem, buf, PAGE_SIZE << order);
+- BUG_ON(mem->offset);
+ sg_dma_len(mem) = PAGE_SIZE << order;
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 79ef799f88ab..c5ea1018cb47 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -326,6 +326,7 @@ enum cfg_version {
+ static const struct pci_device_id rtl8169_pci_tbl[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8129), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8136), 0, 0, RTL_CFG_2 },
++ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8161), 0, 0, RTL_CFG_1 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8167), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_1 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 },
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 480f3dae0780..4296066a7ad3 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -750,6 +750,7 @@ static struct sh_eth_cpu_data sh7734_data = {
+ .tsu = 1,
+ .hw_crc = 1,
+ .select_mii = 1,
++ .shift_rd0 = 1,
+ };
+
+ /* SH7763 */
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 0bfbabad4431..1d1e5f7723ab 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1442,7 +1442,7 @@ static struct phy_driver genphy_driver[] = {
+ .phy_id = 0xffffffff,
+ .phy_id_mask = 0xffffffff,
+ .name = "Generic PHY",
+- .soft_reset = genphy_soft_reset,
++ .soft_reset = genphy_no_soft_reset,
+ .config_init = genphy_config_init,
+ .features = PHY_GBIT_FEATURES | SUPPORTED_MII |
+ SUPPORTED_AUI | SUPPORTED_FIBRE |
+diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
+index f64b25c221e8..cd93220c9b45 100644
+--- a/drivers/net/usb/kaweth.c
++++ b/drivers/net/usb/kaweth.c
+@@ -1009,6 +1009,7 @@ static int kaweth_probe(
+ struct net_device *netdev;
+ const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
+ int result = 0;
++ int rv = -EIO;
+
+ dev_dbg(dev,
+ "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
+@@ -1029,6 +1030,7 @@ static int kaweth_probe(
+ kaweth = netdev_priv(netdev);
+ kaweth->dev = udev;
+ kaweth->net = netdev;
++ kaweth->intf = intf;
+
+ spin_lock_init(&kaweth->device_lock);
+ init_waitqueue_head(&kaweth->term_wait);
+@@ -1048,6 +1050,10 @@ static int kaweth_probe(
+ /* Download the firmware */
+ dev_info(dev, "Downloading firmware...\n");
+ kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
++ if (!kaweth->firmware_buf) {
++ rv = -ENOMEM;
++ goto err_free_netdev;
++ }
+ if ((result = kaweth_download_firmware(kaweth,
+ "kaweth/new_code.bin",
+ 100,
+@@ -1139,8 +1145,6 @@ static int kaweth_probe(
+
+ dev_dbg(dev, "Initializing net device.\n");
+
+- kaweth->intf = intf;
+-
+ kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!kaweth->tx_urb)
+ goto err_free_netdev;
+@@ -1204,7 +1208,7 @@ static int kaweth_probe(
+ err_free_netdev:
+ free_netdev(netdev);
+
+- return -EIO;
++ return rv;
+ }
+
+ /****************************************************************
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-ops.h b/drivers/net/wireless/ath/ath10k/wmi-ops.h
+index 8f4f6a892581..cfed5808bc4e 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-ops.h
++++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
+@@ -639,6 +639,9 @@ ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
+ struct sk_buff *skb;
+ u32 cmd_id;
+
++ if (!ar->wmi.ops->gen_vdev_spectral_conf)
++ return -EOPNOTSUPP;
++
+ skb = ar->wmi.ops->gen_vdev_spectral_conf(ar, arg);
+ if (IS_ERR(skb))
+ return PTR_ERR(skb);
+@@ -654,6 +657,9 @@ ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
+ struct sk_buff *skb;
+ u32 cmd_id;
+
++ if (!ar->wmi.ops->gen_vdev_spectral_enable)
++ return -EOPNOTSUPP;
++
+ skb = ar->wmi.ops->gen_vdev_spectral_enable(ar, vdev_id, trigger,
+ enable);
+ if (IS_ERR(skb))
+diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
+index bb69a5949aea..85bca557a339 100644
+--- a/drivers/net/wireless/ath/wil6210/main.c
++++ b/drivers/net/wireless/ath/wil6210/main.c
+@@ -330,18 +330,19 @@ static void wil_fw_error_worker(struct work_struct *work)
+
+ wil->last_fw_recovery = jiffies;
+
++ wil_info(wil, "fw error recovery requested (try %d)...\n",
++ wil->recovery_count);
++ if (!no_fw_recovery)
++ wil->recovery_state = fw_recovery_running;
++ if (wil_wait_for_recovery(wil) != 0)
++ return;
++
+ mutex_lock(&wil->mutex);
+ switch (wdev->iftype) {
+ case NL80211_IFTYPE_STATION:
+ case NL80211_IFTYPE_P2P_CLIENT:
+ case NL80211_IFTYPE_MONITOR:
+- wil_info(wil, "fw error recovery requested (try %d)...\n",
+- wil->recovery_count);
+- if (!no_fw_recovery)
+- wil->recovery_state = fw_recovery_running;
+- if (0 != wil_wait_for_recovery(wil))
+- break;
+-
++ /* silent recovery, upper layers will see disconnect */
+ __wil_down(wil);
+ __wil_up(wil);
+ break;
+diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
+index 532db28145c7..a5d7332dfce5 100644
+--- a/drivers/nfc/fdp/i2c.c
++++ b/drivers/nfc/fdp/i2c.c
+@@ -210,14 +210,14 @@ static irqreturn_t fdp_nci_i2c_irq_thread_fn(int irq, void *phy_id)
+ struct sk_buff *skb;
+ int r;
+
+- client = phy->i2c_dev;
+- dev_dbg(&client->dev, "%s\n", __func__);
+-
+ if (!phy || irq != phy->i2c_dev->irq) {
+ WARN_ON_ONCE(1);
+ return IRQ_NONE;
+ }
+
++ client = phy->i2c_dev;
++ dev_dbg(&client->dev, "%s\n", __func__);
++
+ r = fdp_nci_i2c_read(phy, &skb);
+
+ if (r == -EREMOTEIO)
+diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
+index efb2c1ceef98..957234272ef7 100644
+--- a/drivers/nvdimm/btt.c
++++ b/drivers/nvdimm/btt.c
+@@ -1205,10 +1205,13 @@ static int btt_rw_page(struct block_device *bdev, sector_t sector,
+ struct page *page, int rw)
+ {
+ struct btt *btt = bdev->bd_disk->private_data;
++ int rc;
+
+- btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector);
+- page_endio(page, rw & WRITE, 0);
+- return 0;
++ rc = btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector);
++ if (rc == 0)
++ page_endio(page, rw & WRITE, 0);
++
++ return rc;
+ }
+
+
+diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
+index b7971d410b60..74e5360c53f0 100644
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -88,7 +88,7 @@ static struct nvmem_config imx_ocotp_nvmem_config = {
+
+ static const struct of_device_id imx_ocotp_dt_ids[] = {
+ { .compatible = "fsl,imx6q-ocotp", (void *)128 },
+- { .compatible = "fsl,imx6sl-ocotp", (void *)32 },
++ { .compatible = "fsl,imx6sl-ocotp", (void *)64 },
+ { .compatible = "fsl,imx6sx-ocotp", (void *)128 },
+ { },
+ };
+diff --git a/drivers/scsi/fnic/fnic.h b/drivers/scsi/fnic/fnic.h
+index ce129e595b55..5c935847599c 100644
+--- a/drivers/scsi/fnic/fnic.h
++++ b/drivers/scsi/fnic/fnic.h
+@@ -248,6 +248,7 @@ struct fnic {
+ struct completion *remove_wait; /* device remove thread blocks */
+
+ atomic_t in_flight; /* io counter */
++ bool internal_reset_inprogress;
+ u32 _reserved; /* fill hole */
+ unsigned long state_flags; /* protected by host lock */
+ enum fnic_state state;
+diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
+index 266b909fe854..82e4bc8c11c5 100644
+--- a/drivers/scsi/fnic/fnic_scsi.c
++++ b/drivers/scsi/fnic/fnic_scsi.c
+@@ -2533,6 +2533,19 @@ int fnic_host_reset(struct scsi_cmnd *sc)
+ unsigned long wait_host_tmo;
+ struct Scsi_Host *shost = sc->device->host;
+ struct fc_lport *lp = shost_priv(shost);
++ struct fnic *fnic = lport_priv(lp);
++ unsigned long flags;
++
++ spin_lock_irqsave(&fnic->fnic_lock, flags);
++ if (fnic->internal_reset_inprogress == 0) {
++ fnic->internal_reset_inprogress = 1;
++ } else {
++ spin_unlock_irqrestore(&fnic->fnic_lock, flags);
++ FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
++ "host reset in progress skipping another host reset\n");
++ return SUCCESS;
++ }
++ spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+
+ /*
+ * If fnic_reset is successful, wait for fabric login to complete
+@@ -2553,6 +2566,9 @@ int fnic_host_reset(struct scsi_cmnd *sc)
+ }
+ }
+
++ spin_lock_irqsave(&fnic->fnic_lock, flags);
++ fnic->internal_reset_inprogress = 0;
++ spin_unlock_irqrestore(&fnic->fnic_lock, flags);
+ return ret;
+ }
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 5b2c37f1e908..9b5367294116 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -4981,15 +4981,14 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, int sleep_flag,
+ static int
+ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
+ {
+- int r, i;
++ int r, i, index;
+ unsigned long flags;
+ u32 reply_address;
+ u16 smid;
+ struct _tr_list *delayed_tr, *delayed_tr_next;
+ u8 hide_flag;
+ struct adapter_reply_queue *reply_q;
+- long reply_post_free;
+- u32 reply_post_free_sz, index = 0;
++ Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig;
+
+ dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name,
+ __func__));
+@@ -5061,27 +5060,27 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag)
+ _base_assign_reply_queues(ioc);
+
+ /* initialize Reply Post Free Queue */
+- reply_post_free_sz = ioc->reply_post_queue_depth *
+- sizeof(Mpi2DefaultReplyDescriptor_t);
+- reply_post_free = (long)ioc->reply_post[index].reply_post_free;
++ index = 0;
++ reply_post_free_contig = ioc->reply_post[0].reply_post_free;
+ list_for_each_entry(reply_q, &ioc->reply_queue_list, list) {
++ /*
++ * If RDPQ is enabled, switch to the next allocation.
++ * Otherwise advance within the contiguous region.
++ */
++ if (ioc->rdpq_array_enable) {
++ reply_q->reply_post_free =
++ ioc->reply_post[index++].reply_post_free;
++ } else {
++ reply_q->reply_post_free = reply_post_free_contig;
++ reply_post_free_contig += ioc->reply_post_queue_depth;
++ }
++
+ reply_q->reply_post_host_index = 0;
+- reply_q->reply_post_free = (Mpi2ReplyDescriptorsUnion_t *)
+- reply_post_free;
+ for (i = 0; i < ioc->reply_post_queue_depth; i++)
+ reply_q->reply_post_free[i].Words =
+ cpu_to_le64(ULLONG_MAX);
+ if (!_base_is_controller_msix_enabled(ioc))
+ goto skip_init_reply_post_free_queue;
+- /*
+- * If RDPQ is enabled, switch to the next allocation.
+- * Otherwise advance within the contiguous region.
+- */
+- if (ioc->rdpq_array_enable)
+- reply_post_free = (long)
+- ioc->reply_post[++index].reply_post_free;
+- else
+- reply_post_free += reply_post_free_sz;
+ }
+ skip_init_reply_post_free_queue:
+
+diff --git a/drivers/scsi/snic/snic_main.c b/drivers/scsi/snic/snic_main.c
+index 2b3c25371d76..8175f997e82c 100644
+--- a/drivers/scsi/snic/snic_main.c
++++ b/drivers/scsi/snic/snic_main.c
+@@ -584,6 +584,7 @@ snic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (!pool) {
+ SNIC_HOST_ERR(shost, "dflt sgl pool creation failed\n");
+
++ ret = -ENOMEM;
+ goto err_free_res;
+ }
+
+@@ -594,6 +595,7 @@ snic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (!pool) {
+ SNIC_HOST_ERR(shost, "max sgl pool creation failed\n");
+
++ ret = -ENOMEM;
+ goto err_free_dflt_sgl_pool;
+ }
+
+@@ -604,6 +606,7 @@ snic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (!pool) {
+ SNIC_HOST_ERR(shost, "snic tmreq info pool creation failed.\n");
+
++ ret = -ENOMEM;
+ goto err_free_max_sgl_pool;
+ }
+
+diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
+index 882cd6618cd5..87a0e47eeae6 100644
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -107,7 +107,10 @@ static const struct file_operations dw_spi_regs_ops = {
+
+ static int dw_spi_debugfs_init(struct dw_spi *dws)
+ {
+- dws->debugfs = debugfs_create_dir("dw_spi", NULL);
++ char name[128];
++
++ snprintf(name, 128, "dw_spi-%s", dev_name(&dws->master->dev));
++ dws->debugfs = debugfs_create_dir(name, NULL);
+ if (!dws->debugfs)
+ return -ENOMEM;
+
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 8fed55342b0f..b831f08e2769 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -2901,9 +2901,6 @@ static int __init comedi_init(void)
+
+ comedi_class->dev_groups = comedi_dev_groups;
+
+- /* XXX requires /proc interface */
+- comedi_proc_init();
+-
+ /* create devices files for legacy/manual use */
+ for (i = 0; i < comedi_num_legacy_minors; i++) {
+ struct comedi_device *dev;
+@@ -2921,6 +2918,9 @@ static int __init comedi_init(void)
+ mutex_unlock(&dev->mutex);
+ }
+
++ /* XXX requires /proc interface */
++ comedi_proc_init();
++
+ return 0;
+ }
+ module_init(comedi_init);
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index 99285b416308..ee579ba2b59e 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -539,7 +539,7 @@ static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+ }
+ status = usb_ep_enable(hidg->out_ep);
+ if (status < 0) {
+- ERROR(cdev, "Enable IN endpoint FAILED!\n");
++ ERROR(cdev, "Enable OUT endpoint FAILED!\n");
+ goto fail;
+ }
+ hidg->out_ep->driver_data = hidg;
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 830e2fd47642..b31b84f56e8f 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -902,6 +902,10 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma)
+ return ret;
+
+ vdev->barmap[index] = pci_iomap(pdev, index, 0);
++ if (!vdev->barmap[index]) {
++ pci_release_selected_regions(pdev, 1 << index);
++ return -ENOMEM;
++ }
+ }
+
+ vma->vm_private_data = vdev;
+diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
+index 210db24d2204..4d39f7959adf 100644
+--- a/drivers/vfio/pci/vfio_pci_rdwr.c
++++ b/drivers/vfio/pci/vfio_pci_rdwr.c
+@@ -190,7 +190,10 @@ ssize_t vfio_pci_vga_rw(struct vfio_pci_device *vdev, char __user *buf,
+ if (!vdev->has_vga)
+ return -EINVAL;
+
+- switch (pos) {
++ if (pos > 0xbfffful)
++ return -EINVAL;
++
++ switch ((u32)pos) {
+ case 0xa0000 ... 0xbffff:
+ count = min(count, (size_t)(0xc0000 - pos));
+ iomem = ioremap_nocache(0xa0000, 0xbffff - 0xa0000 + 1);
+diff --git a/drivers/video/fbdev/cobalt_lcdfb.c b/drivers/video/fbdev/cobalt_lcdfb.c
+index 07675d6f323e..d4530b54479c 100644
+--- a/drivers/video/fbdev/cobalt_lcdfb.c
++++ b/drivers/video/fbdev/cobalt_lcdfb.c
+@@ -350,6 +350,11 @@ static int cobalt_lcdfb_probe(struct platform_device *dev)
+ info->screen_size = resource_size(res);
+ info->screen_base = devm_ioremap(&dev->dev, res->start,
+ info->screen_size);
++ if (!info->screen_base) {
++ framebuffer_release(info);
++ return -ENOMEM;
++ }
++
+ info->fbops = &cobalt_lcd_fbops;
+ info->fix = cobalt_lcdfb_fix;
+ info->fix.smem_start = res->start;
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index a61926cb01c0..bebd6517355d 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -7521,11 +7521,18 @@ static void adjust_dio_outstanding_extents(struct inode *inode,
+ * within our reservation, otherwise we need to adjust our inode
+ * counter appropriately.
+ */
+- if (dio_data->outstanding_extents) {
++ if (dio_data->outstanding_extents >= num_extents) {
+ dio_data->outstanding_extents -= num_extents;
+ } else {
++ /*
++ * If dio write length has been split due to no large enough
++ * contiguous space, we need to compensate our inode counter
++ * appropriately.
++ */
++ u64 num_needed = num_extents - dio_data->outstanding_extents;
++
+ spin_lock(&BTRFS_I(inode)->lock);
+- BTRFS_I(inode)->outstanding_extents += num_extents;
++ BTRFS_I(inode)->outstanding_extents += num_needed;
+ spin_unlock(&BTRFS_I(inode)->lock);
+ }
+ }
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 3000cbb54949..3ed642e0a0c2 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -269,6 +269,33 @@ static inline int dname_external(const struct dentry *dentry)
+ return dentry->d_name.name != dentry->d_iname;
+ }
+
++void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry)
++{
++ spin_lock(&dentry->d_lock);
++ if (unlikely(dname_external(dentry))) {
++ struct external_name *p = external_name(dentry);
++ atomic_inc(&p->u.count);
++ spin_unlock(&dentry->d_lock);
++ name->name = p->name;
++ } else {
++ memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN);
++ spin_unlock(&dentry->d_lock);
++ name->name = name->inline_name;
++ }
++}
++EXPORT_SYMBOL(take_dentry_name_snapshot);
++
++void release_dentry_name_snapshot(struct name_snapshot *name)
++{
++ if (unlikely(name->name != name->inline_name)) {
++ struct external_name *p;
++ p = container_of(name->name, struct external_name, name[0]);
++ if (unlikely(atomic_dec_and_test(&p->u.count)))
++ kfree_rcu(p, u.head);
++ }
++}
++EXPORT_SYMBOL(release_dentry_name_snapshot);
++
+ static inline void __d_set_inode_and_type(struct dentry *dentry,
+ struct inode *inode,
+ unsigned type_flags)
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 0f5d05bf2131..e49ba072bd64 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -669,7 +669,7 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
+ {
+ int error;
+ struct dentry *dentry = NULL, *trap;
+- const char *old_name;
++ struct name_snapshot old_name;
+
+ trap = lock_rename(new_dir, old_dir);
+ /* Source or destination directories don't exist? */
+@@ -684,19 +684,19 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
+ if (IS_ERR(dentry) || dentry == trap || d_really_is_positive(dentry))
+ goto exit;
+
+- old_name = fsnotify_oldname_init(old_dentry->d_name.name);
++ take_dentry_name_snapshot(&old_name, old_dentry);
+
+ error = simple_rename(d_inode(old_dir), old_dentry, d_inode(new_dir),
+ dentry);
+ if (error) {
+- fsnotify_oldname_free(old_name);
++ release_dentry_name_snapshot(&old_name);
+ goto exit;
+ }
+ d_move(old_dentry, dentry);
+- fsnotify_move(d_inode(old_dir), d_inode(new_dir), old_name,
++ fsnotify_move(d_inode(old_dir), d_inode(new_dir), old_name.name,
+ d_is_dir(old_dentry),
+ NULL, old_dentry);
+- fsnotify_oldname_free(old_name);
++ release_dentry_name_snapshot(&old_name);
+ unlock_rename(new_dir, old_dir);
+ dput(dentry);
+ return old_dentry;
+diff --git a/fs/namei.c b/fs/namei.c
+index 0b0acba72a71..3f96ae087488 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -4179,11 +4179,11 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ {
+ int error;
+ bool is_dir = d_is_dir(old_dentry);
+- const unsigned char *old_name;
+ struct inode *source = old_dentry->d_inode;
+ struct inode *target = new_dentry->d_inode;
+ bool new_is_dir = false;
+ unsigned max_links = new_dir->i_sb->s_max_links;
++ struct name_snapshot old_name;
+
+ /*
+ * Check source == target.
+@@ -4237,7 +4237,7 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (error)
+ return error;
+
+- old_name = fsnotify_oldname_init(old_dentry->d_name.name);
++ take_dentry_name_snapshot(&old_name, old_dentry);
+ dget(new_dentry);
+ if (!is_dir || (flags & RENAME_EXCHANGE))
+ lock_two_nondirectories(source, target);
+@@ -4298,14 +4298,14 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ mutex_unlock(&target->i_mutex);
+ dput(new_dentry);
+ if (!error) {
+- fsnotify_move(old_dir, new_dir, old_name, is_dir,
++ fsnotify_move(old_dir, new_dir, old_name.name, is_dir,
+ !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
+ if (flags & RENAME_EXCHANGE) {
+ fsnotify_move(new_dir, old_dir, old_dentry->d_name.name,
+ new_is_dir, NULL, new_dentry);
+ }
+ }
+- fsnotify_oldname_free(old_name);
++ release_dentry_name_snapshot(&old_name);
+
+ return error;
+ }
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index db39de2dd4cb..a64adc2fced9 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -104,16 +104,20 @@ int __fsnotify_parent(struct path *path, struct dentry *dentry, __u32 mask)
+ if (unlikely(!fsnotify_inode_watches_children(p_inode)))
+ __fsnotify_update_child_dentry_flags(p_inode);
+ else if (p_inode->i_fsnotify_mask & mask) {
++ struct name_snapshot name;
++
+ /* we are notifying a parent so come up with the new mask which
+ * specifies these are events which came from a child. */
+ mask |= FS_EVENT_ON_CHILD;
+
++ take_dentry_name_snapshot(&name, dentry);
+ if (path)
+ ret = fsnotify(p_inode, mask, path, FSNOTIFY_EVENT_PATH,
+- dentry->d_name.name, 0);
++ name.name, 0);
+ else
+ ret = fsnotify(p_inode, mask, dentry->d_inode, FSNOTIFY_EVENT_INODE,
+- dentry->d_name.name, 0);
++ name.name, 0);
++ release_dentry_name_snapshot(&name);
+ }
+
+ dput(parent);
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 905caba36529..59d93acc29c7 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -413,7 +413,7 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt,
+ for (i = 0; i < cxt->max_dump_cnt; i++) {
+ cxt->przs[i] = persistent_ram_new(*paddr, cxt->record_size, 0,
+ &cxt->ecc_info,
+- cxt->memtype);
++ cxt->memtype, 0);
+ if (IS_ERR(cxt->przs[i])) {
+ err = PTR_ERR(cxt->przs[i]);
+ dev_err(dev, "failed to request mem region (0x%zx@0x%llx): %d\n",
+@@ -450,7 +450,8 @@ static int ramoops_init_prz(struct device *dev, struct ramoops_context *cxt,
+ return -ENOMEM;
+ }
+
+- *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, cxt->memtype);
++ *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info,
++ cxt->memtype, 0);
+ if (IS_ERR(*prz)) {
+ int err = PTR_ERR(*prz);
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 364d2dffe5a6..27300533c2dd 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -47,16 +47,15 @@ static inline size_t buffer_start(struct persistent_ram_zone *prz)
+ return atomic_read(&prz->buffer->start);
+ }
+
+-static DEFINE_RAW_SPINLOCK(buffer_lock);
+-
+ /* increase and wrap the start pointer, returning the old value */
+ static size_t buffer_start_add(struct persistent_ram_zone *prz, size_t a)
+ {
+ int old;
+ int new;
+- unsigned long flags;
++ unsigned long flags = 0;
+
+- raw_spin_lock_irqsave(&buffer_lock, flags);
++ if (!(prz->flags & PRZ_FLAG_NO_LOCK))
++ raw_spin_lock_irqsave(&prz->buffer_lock, flags);
+
+ old = atomic_read(&prz->buffer->start);
+ new = old + a;
+@@ -64,7 +63,8 @@ static size_t buffer_start_add(struct persistent_ram_zone *prz, size_t a)
+ new -= prz->buffer_size;
+ atomic_set(&prz->buffer->start, new);
+
+- raw_spin_unlock_irqrestore(&buffer_lock, flags);
++ if (!(prz->flags & PRZ_FLAG_NO_LOCK))
++ raw_spin_unlock_irqrestore(&prz->buffer_lock, flags);
+
+ return old;
+ }
+@@ -74,9 +74,10 @@ static void buffer_size_add(struct persistent_ram_zone *prz, size_t a)
+ {
+ size_t old;
+ size_t new;
+- unsigned long flags;
++ unsigned long flags = 0;
+
+- raw_spin_lock_irqsave(&buffer_lock, flags);
++ if (!(prz->flags & PRZ_FLAG_NO_LOCK))
++ raw_spin_lock_irqsave(&prz->buffer_lock, flags);
+
+ old = atomic_read(&prz->buffer->size);
+ if (old == prz->buffer_size)
+@@ -88,7 +89,8 @@ static void buffer_size_add(struct persistent_ram_zone *prz, size_t a)
+ atomic_set(&prz->buffer->size, new);
+
+ exit:
+- raw_spin_unlock_irqrestore(&buffer_lock, flags);
++ if (!(prz->flags & PRZ_FLAG_NO_LOCK))
++ raw_spin_unlock_irqrestore(&prz->buffer_lock, flags);
+ }
+
+ static void notrace persistent_ram_encode_rs8(struct persistent_ram_zone *prz,
+@@ -448,6 +450,7 @@ static int persistent_ram_post_init(struct persistent_ram_zone *prz, u32 sig,
+ prz->buffer->sig);
+ }
+
++ /* Rewind missing or invalid memory area. */
+ prz->buffer->sig = sig;
+ persistent_ram_zap(prz);
+
+@@ -474,7 +477,7 @@ void persistent_ram_free(struct persistent_ram_zone *prz)
+
+ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
+ u32 sig, struct persistent_ram_ecc_info *ecc_info,
+- unsigned int memtype)
++ unsigned int memtype, u32 flags)
+ {
+ struct persistent_ram_zone *prz;
+ int ret = -ENOMEM;
+@@ -485,6 +488,10 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
+ goto err;
+ }
+
++ /* Initialize general buffer state. */
++ raw_spin_lock_init(&prz->buffer_lock);
++ prz->flags = flags;
++
+ ret = persistent_ram_buffer_map(start, size, prz, memtype);
+ if (ret)
+ goto err;
+diff --git a/fs/seq_file.c b/fs/seq_file.c
+index d672e2fec459..6dc4296eed62 100644
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -72,9 +72,10 @@ int seq_open(struct file *file, const struct seq_operations *op)
+
+ mutex_init(&p->lock);
+ p->op = op;
+-#ifdef CONFIG_USER_NS
+- p->user_ns = file->f_cred->user_ns;
+-#endif
++
++ // No refcounting: the lifetime of 'p' is constrained
++ // to the lifetime of the file.
++ p->file = file;
+
+ /*
+ * Wrappers around seq_open(e.g. swaps_open) need to be
+diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
+index 187b80267ff9..a9063ac50c4e 100644
+--- a/fs/xfs/xfs_aops.c
++++ b/fs/xfs/xfs_aops.c
+@@ -1426,6 +1426,26 @@ __xfs_get_blocks(
+ if (error)
+ goto out_unlock;
+
++ /*
++ * The only time we can ever safely find delalloc blocks on direct I/O
++ * is a dio write to post-eof speculative preallocation. All other
++ * scenarios are indicative of a problem or misuse (such as mixing
++ * direct and mapped I/O).
++ *
++ * The file may be unmapped by the time we get here so we cannot
++ * reliably fail the I/O based on mapping. Instead, fail the I/O if this
++ * is a read or a write within eof. Otherwise, carry on but warn as a
++ * precuation if the file happens to be mapped.
++ */
++ if (direct && imap.br_startblock == DELAYSTARTBLOCK) {
++ if (!create || offset < i_size_read(VFS_I(ip))) {
++ WARN_ON_ONCE(1);
++ error = -EIO;
++ goto out_unlock;
++ }
++ WARN_ON_ONCE(mapping_mapped(VFS_I(ip)->i_mapping));
++ }
++
+ /* for DAX, we convert unwritten extents directly */
+ if (create &&
+ (!nimaps ||
+@@ -1525,7 +1545,6 @@ __xfs_get_blocks(
+ set_buffer_new(bh_result);
+
+ if (imap.br_startblock == DELAYSTARTBLOCK) {
+- BUG_ON(direct);
+ if (create) {
+ set_buffer_uptodate(bh_result);
+ set_buffer_mapped(bh_result);
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 8d7151eb6ceb..d516847e0fae 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -615,5 +615,11 @@ static inline struct inode *d_real_inode(struct dentry *dentry)
+ return d_backing_inode(d_real(dentry));
+ }
+
++struct name_snapshot {
++ const char *name;
++ char inline_name[DNAME_INLINE_LEN];
++};
++void take_dentry_name_snapshot(struct name_snapshot *, struct dentry *);
++void release_dentry_name_snapshot(struct name_snapshot *);
+
+ #endif /* __LINUX_DCACHE_H */
+diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
+index 7ee1774edee5..a7789559078b 100644
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -310,35 +310,4 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
+ }
+ }
+
+-#if defined(CONFIG_FSNOTIFY) /* notify helpers */
+-
+-/*
+- * fsnotify_oldname_init - save off the old filename before we change it
+- */
+-static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
+-{
+- return kstrdup(name, GFP_KERNEL);
+-}
+-
+-/*
+- * fsnotify_oldname_free - free the name we got from fsnotify_oldname_init
+- */
+-static inline void fsnotify_oldname_free(const unsigned char *old_name)
+-{
+- kfree(old_name);
+-}
+-
+-#else /* CONFIG_FSNOTIFY */
+-
+-static inline const char *fsnotify_oldname_init(const unsigned char *name)
+-{
+- return NULL;
+-}
+-
+-static inline void fsnotify_oldname_free(const unsigned char *old_name)
+-{
+-}
+-
+-#endif /* CONFIG_FSNOTIFY */
+-
+ #endif /* _LINUX_FS_NOTIFY_H */
+diff --git a/include/linux/phy.h b/include/linux/phy.h
+index 05fde31b6dc6..b64825d6ad26 100644
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -785,6 +785,10 @@ int genphy_read_status(struct phy_device *phydev);
+ int genphy_suspend(struct phy_device *phydev);
+ int genphy_resume(struct phy_device *phydev);
+ int genphy_soft_reset(struct phy_device *phydev);
++static inline int genphy_no_soft_reset(struct phy_device *phydev)
++{
++ return 0;
++}
+ void phy_driver_unregister(struct phy_driver *drv);
+ void phy_drivers_unregister(struct phy_driver *drv, int n);
+ int phy_driver_register(struct phy_driver *new_driver);
+diff --git a/include/linux/pstore_ram.h b/include/linux/pstore_ram.h
+index 9c9d6c154c8e..6f4520a82197 100644
+--- a/include/linux/pstore_ram.h
++++ b/include/linux/pstore_ram.h
+@@ -23,6 +23,13 @@
+ #include <linux/types.h>
+ #include <linux/init.h>
+
++/*
++ * Choose whether access to the RAM zone requires locking or not. If a zone
++ * can be written to from different CPUs like with ftrace for example, then
++ * PRZ_FLAG_NO_LOCK is used. For all other cases, locking is required.
++ */
++#define PRZ_FLAG_NO_LOCK BIT(0)
++
+ struct persistent_ram_buffer;
+ struct rs_control;
+
+@@ -39,6 +46,8 @@ struct persistent_ram_zone {
+ void *vaddr;
+ struct persistent_ram_buffer *buffer;
+ size_t buffer_size;
++ u32 flags;
++ raw_spinlock_t buffer_lock;
+
+ /* ECC correction */
+ char *par_buffer;
+@@ -54,7 +63,7 @@ struct persistent_ram_zone {
+
+ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size,
+ u32 sig, struct persistent_ram_ecc_info *ecc_info,
+- unsigned int memtype);
++ unsigned int memtype, u32 flags);
+ void persistent_ram_free(struct persistent_ram_zone *prz);
+ void persistent_ram_zap(struct persistent_ram_zone *prz);
+
+diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
+index dde00defbaa5..f3d45dd42695 100644
+--- a/include/linux/seq_file.h
++++ b/include/linux/seq_file.h
+@@ -7,13 +7,10 @@
+ #include <linux/mutex.h>
+ #include <linux/cpumask.h>
+ #include <linux/nodemask.h>
++#include <linux/fs.h>
++#include <linux/cred.h>
+
+ struct seq_operations;
+-struct file;
+-struct path;
+-struct inode;
+-struct dentry;
+-struct user_namespace;
+
+ struct seq_file {
+ char *buf;
+@@ -27,9 +24,7 @@ struct seq_file {
+ struct mutex lock;
+ const struct seq_operations *op;
+ int poll_event;
+-#ifdef CONFIG_USER_NS
+- struct user_namespace *user_ns;
+-#endif
++ const struct file *file;
+ void *private;
+ };
+
+@@ -147,7 +142,7 @@ int seq_release_private(struct inode *, struct file *);
+ static inline struct user_namespace *seq_user_ns(struct seq_file *seq)
+ {
+ #ifdef CONFIG_USER_NS
+- return seq->user_ns;
++ return seq->file->f_cred->user_ns;
+ #else
+ extern struct user_namespace init_user_ns;
+ return &init_user_ns;
+diff --git a/kernel/resource.c b/kernel/resource.c
+index 249b1eb1e6e1..a4a94e700fb9 100644
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -105,16 +105,25 @@ static int r_show(struct seq_file *m, void *v)
+ {
+ struct resource *root = m->private;
+ struct resource *r = v, *p;
++ unsigned long long start, end;
+ int width = root->end < 0x10000 ? 4 : 8;
+ int depth;
+
+ for (depth = 0, p = r; depth < MAX_IORES_LEVEL; depth++, p = p->parent)
+ if (p->parent == root)
+ break;
++
++ if (file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) {
++ start = r->start;
++ end = r->end;
++ } else {
++ start = end = 0;
++ }
++
+ seq_printf(m, "%*s%0*llx-%0*llx : %s\n",
+ depth * 2, "",
+- width, (unsigned long long) r->start,
+- width, (unsigned long long) r->end,
++ width, start,
++ width, end,
+ r->name ? r->name : "<BAD>");
+ return 0;
+ }
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index c436426a80dd..dece705b7f8c 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5553,7 +5553,6 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
+
+ case CPU_UP_PREPARE:
+ rq->calc_load_update = calc_load_update;
+- account_reset_rq(rq);
+ break;
+
+ case CPU_ONLINE:
+@@ -8253,11 +8252,20 @@ cpu_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)
+ if (IS_ERR(tg))
+ return ERR_PTR(-ENOMEM);
+
+- sched_online_group(tg, parent);
+-
+ return &tg->css;
+ }
+
++/* Expose task group only after completing cgroup initialization */
++static int cpu_cgroup_css_online(struct cgroup_subsys_state *css)
++{
++ struct task_group *tg = css_tg(css);
++ struct task_group *parent = css_tg(css->parent);
++
++ if (parent)
++ sched_online_group(tg, parent);
++ return 0;
++}
++
+ static void cpu_cgroup_css_released(struct cgroup_subsys_state *css)
+ {
+ struct task_group *tg = css_tg(css);
+@@ -8632,6 +8640,7 @@ static struct cftype cpu_files[] = {
+
+ struct cgroup_subsys cpu_cgrp_subsys = {
+ .css_alloc = cpu_cgroup_css_alloc,
++ .css_online = cpu_cgroup_css_online,
+ .css_released = cpu_cgroup_css_released,
+ .css_free = cpu_cgroup_css_free,
+ .fork = cpu_cgroup_fork,
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 4e5db65d1aab..55d92a1ca070 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1770,16 +1770,3 @@ static inline u64 irq_time_read(int cpu)
+ }
+ #endif /* CONFIG_64BIT */
+ #endif /* CONFIG_IRQ_TIME_ACCOUNTING */
+-
+-static inline void account_reset_rq(struct rq *rq)
+-{
+-#ifdef CONFIG_IRQ_TIME_ACCOUNTING
+- rq->prev_irq_time = 0;
+-#endif
+-#ifdef CONFIG_PARAVIRT
+- rq->prev_steal_time = 0;
+-#endif
+-#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING
+- rq->prev_steal_time_rq = 0;
+-#endif
+-}
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index e20ae2d3c498..5e4199d5a388 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -292,6 +292,10 @@ static void vlan_sync_address(struct net_device *dev,
+ if (ether_addr_equal(vlan->real_dev_addr, dev->dev_addr))
+ return;
+
++ /* vlan continues to inherit address of lower device */
++ if (vlan_dev_inherit_address(vlandev, dev))
++ goto out;
++
+ /* vlan address was different from the old address and is equal to
+ * the new address */
+ if (!ether_addr_equal(vlandev->dev_addr, vlan->real_dev_addr) &&
+@@ -304,6 +308,7 @@ static void vlan_sync_address(struct net_device *dev,
+ !ether_addr_equal(vlandev->dev_addr, dev->dev_addr))
+ dev_uc_add(dev, vlandev->dev_addr);
+
++out:
+ ether_addr_copy(vlan->real_dev_addr, dev->dev_addr);
+ }
+
+diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
+index 9d010a09ab98..cc1557978066 100644
+--- a/net/8021q/vlan.h
++++ b/net/8021q/vlan.h
+@@ -109,6 +109,8 @@ int vlan_check_real_dev(struct net_device *real_dev,
+ void vlan_setup(struct net_device *dev);
+ int register_vlan_dev(struct net_device *dev);
+ void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
++bool vlan_dev_inherit_address(struct net_device *dev,
++ struct net_device *real_dev);
+
+ static inline u32 vlan_get_ingress_priority(struct net_device *dev,
+ u16 vlan_tci)
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index fded86508117..ca4dc9031073 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -244,6 +244,17 @@ void vlan_dev_get_realdev_name(const struct net_device *dev, char *result)
+ strncpy(result, vlan_dev_priv(dev)->real_dev->name, 23);
+ }
+
++bool vlan_dev_inherit_address(struct net_device *dev,
++ struct net_device *real_dev)
++{
++ if (dev->addr_assign_type != NET_ADDR_STOLEN)
++ return false;
++
++ ether_addr_copy(dev->dev_addr, real_dev->dev_addr);
++ call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
++ return true;
++}
++
+ static int vlan_dev_open(struct net_device *dev)
+ {
+ struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+@@ -254,7 +265,8 @@ static int vlan_dev_open(struct net_device *dev)
+ !(vlan->flags & VLAN_FLAG_LOOSE_BINDING))
+ return -ENETDOWN;
+
+- if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr)) {
++ if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr) &&
++ !vlan_dev_inherit_address(dev, real_dev)) {
+ err = dev_uc_add(real_dev, dev->dev_addr);
+ if (err < 0)
+ goto out;
+@@ -558,8 +570,10 @@ static int vlan_dev_init(struct net_device *dev)
+ /* ipv6 shared card related stuff */
+ dev->dev_id = real_dev->dev_id;
+
+- if (is_zero_ether_addr(dev->dev_addr))
+- eth_hw_addr_inherit(dev, real_dev);
++ if (is_zero_ether_addr(dev->dev_addr)) {
++ ether_addr_copy(dev->dev_addr, real_dev->dev_addr);
++ dev->addr_assign_type = NET_ADDR_STOLEN;
++ }
+ if (is_zero_ether_addr(dev->broadcast))
+ memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index dc5d3d546150..4b0853194a03 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2550,9 +2550,10 @@ EXPORT_SYMBOL(skb_mac_gso_segment);
+ static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
+ {
+ if (tx_path)
+- return skb->ip_summed != CHECKSUM_PARTIAL;
+- else
+- return skb->ip_summed == CHECKSUM_NONE;
++ return skb->ip_summed != CHECKSUM_PARTIAL &&
++ skb->ip_summed != CHECKSUM_NONE;
++
++ return skb->ip_summed == CHECKSUM_NONE;
+ }
+
+ /**
+@@ -2571,11 +2572,12 @@ static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
+ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
+ netdev_features_t features, bool tx_path)
+ {
++ struct sk_buff *segs;
++
+ if (unlikely(skb_needs_check(skb, tx_path))) {
+ int err;
+
+- skb_warn_bad_offload(skb);
+-
++ /* We're going to init ->check field in TCP or UDP header */
+ err = skb_cow_head(skb, 0);
+ if (err < 0)
+ return ERR_PTR(err);
+@@ -2590,7 +2592,12 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
+ skb_reset_mac_header(skb);
+ skb_reset_mac_len(skb);
+
+- return skb_mac_gso_segment(skb, features);
++ segs = skb_mac_gso_segment(skb, features);
++
++ if (unlikely(skb_needs_check(skb, tx_path)))
++ skb_warn_bad_offload(skb);
++
++ return segs;
+ }
+ EXPORT_SYMBOL(__skb_gso_segment);
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 7d339fc1057f..150b4923fb72 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1361,7 +1361,7 @@ static int __ip6_append_data(struct sock *sk,
+ */
+
+ cork->length += length;
+- if (((length > mtu) ||
++ if ((((length + fragheaderlen) > mtu) ||
+ (skb && skb_is_gso(skb))) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+ (rt->dst.dev->features & NETIF_F_UFO) &&
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index d8d95b6415e4..2e1050ec2cf0 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -63,6 +63,7 @@ struct pfkey_sock {
+ } u;
+ struct sk_buff *skb;
+ } dump;
++ struct mutex dump_lock;
+ };
+
+ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
+@@ -143,6 +144,7 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
+ {
+ struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
+ struct sock *sk;
++ struct pfkey_sock *pfk;
+ int err;
+
+ if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+@@ -157,6 +159,9 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
+ if (sk == NULL)
+ goto out;
+
++ pfk = pfkey_sk(sk);
++ mutex_init(&pfk->dump_lock);
++
+ sock->ops = &pfkey_ops;
+ sock_init_data(sock, sk);
+
+@@ -285,13 +290,23 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
+ struct sadb_msg *hdr;
+ int rc;
+
++ mutex_lock(&pfk->dump_lock);
++ if (!pfk->dump.dump) {
++ rc = 0;
++ goto out;
++ }
++
+ rc = pfk->dump.dump(pfk);
+- if (rc == -ENOBUFS)
+- return 0;
++ if (rc == -ENOBUFS) {
++ rc = 0;
++ goto out;
++ }
+
+ if (pfk->dump.skb) {
+- if (!pfkey_can_dump(&pfk->sk))
+- return 0;
++ if (!pfkey_can_dump(&pfk->sk)) {
++ rc = 0;
++ goto out;
++ }
+
+ hdr = (struct sadb_msg *) pfk->dump.skb->data;
+ hdr->sadb_msg_seq = 0;
+@@ -302,6 +317,9 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
+ }
+
+ pfkey_terminate_dump(pfk);
++
++out:
++ mutex_unlock(&pfk->dump_lock);
+ return rc;
+ }
+
+@@ -1806,19 +1824,26 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
+ struct xfrm_address_filter *filter = NULL;
+ struct pfkey_sock *pfk = pfkey_sk(sk);
+
+- if (pfk->dump.dump != NULL)
++ mutex_lock(&pfk->dump_lock);
++ if (pfk->dump.dump != NULL) {
++ mutex_unlock(&pfk->dump_lock);
+ return -EBUSY;
++ }
+
+ proto = pfkey_satype2proto(hdr->sadb_msg_satype);
+- if (proto == 0)
++ if (proto == 0) {
++ mutex_unlock(&pfk->dump_lock);
+ return -EINVAL;
++ }
+
+ if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
+ struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
+
+ filter = kmalloc(sizeof(*filter), GFP_KERNEL);
+- if (filter == NULL)
++ if (filter == NULL) {
++ mutex_unlock(&pfk->dump_lock);
+ return -ENOMEM;
++ }
+
+ memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr,
+ sizeof(xfrm_address_t));
+@@ -1834,6 +1859,7 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
+ pfk->dump.dump = pfkey_dump_sa;
+ pfk->dump.done = pfkey_dump_sa_done;
+ xfrm_state_walk_init(&pfk->dump.u.state, proto, filter);
++ mutex_unlock(&pfk->dump_lock);
+
+ return pfkey_do_dump(pfk);
+ }
+@@ -2693,14 +2719,18 @@ static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, const struct sadb
+ {
+ struct pfkey_sock *pfk = pfkey_sk(sk);
+
+- if (pfk->dump.dump != NULL)
++ mutex_lock(&pfk->dump_lock);
++ if (pfk->dump.dump != NULL) {
++ mutex_unlock(&pfk->dump_lock);
+ return -EBUSY;
++ }
+
+ pfk->dump.msg_version = hdr->sadb_msg_version;
+ pfk->dump.msg_portid = hdr->sadb_msg_pid;
+ pfk->dump.dump = pfkey_dump_sp;
+ pfk->dump.done = pfkey_dump_sp_done;
+ xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN);
++ mutex_unlock(&pfk->dump_lock);
+
+ return pfkey_do_dump(pfk);
+ }
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 8a0fdd870395..77055a362041 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -1216,7 +1216,7 @@ static inline int policy_to_flow_dir(int dir)
+ }
+
+ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
+- const struct flowi *fl)
++ const struct flowi *fl, u16 family)
+ {
+ struct xfrm_policy *pol;
+ struct net *net = sock_net(sk);
+@@ -1225,8 +1225,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
+ read_lock_bh(&net->xfrm.xfrm_policy_lock);
+ pol = rcu_dereference(sk->sk_policy[dir]);
+ if (pol != NULL) {
+- bool match = xfrm_selector_match(&pol->selector, fl,
+- sk->sk_family);
++ bool match = xfrm_selector_match(&pol->selector, fl, family);
+ int err = 0;
+
+ if (match) {
+@@ -2174,7 +2173,7 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
+ sk = sk_const_to_full_sk(sk);
+ if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
+ num_pols = 1;
+- pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
++ pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family);
+ err = xfrm_expand_policies(fl, family, pols,
+ &num_pols, &num_xfrms);
+ if (err < 0)
+@@ -2453,7 +2452,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ pol = NULL;
+ sk = sk_to_full_sk(sk);
+ if (sk && sk->sk_policy[dir]) {
+- pol = xfrm_sk_policy_lookup(sk, dir, &fl);
++ pol = xfrm_sk_policy_lookup(sk, dir, &fl, family);
+ if (IS_ERR(pol)) {
+ XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
+ return 0;
+diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c
+index c1b87c5800b1..b3fddba4c084 100644
+--- a/sound/soc/codecs/nau8825.c
++++ b/sound/soc/codecs/nau8825.c
+@@ -936,7 +936,8 @@ static void nau8825_fll_apply(struct nau8825 *nau8825,
+ NAU8825_FLL_INTEGER_MASK, fll_param->fll_int);
+ /* FLL pre-scaler */
+ regmap_update_bits(nau8825->regmap, NAU8825_REG_FLL4,
+- NAU8825_FLL_REF_DIV_MASK, fll_param->clk_ref_div);
++ NAU8825_FLL_REF_DIV_MASK,
++ fll_param->clk_ref_div << NAU8825_FLL_REF_DIV_SFT);
+ /* select divided VCO input */
+ regmap_update_bits(nau8825->regmap, NAU8825_REG_FLL5,
+ NAU8825_FLL_FILTER_SW_MASK, 0x0000);
+diff --git a/sound/soc/codecs/nau8825.h b/sound/soc/codecs/nau8825.h
+index dff8edb83bfd..a0b220726a63 100644
+--- a/sound/soc/codecs/nau8825.h
++++ b/sound/soc/codecs/nau8825.h
+@@ -114,7 +114,8 @@
+ #define NAU8825_FLL_INTEGER_MASK (0x3ff << 0)
+
+ /* FLL4 (0x07) */
+-#define NAU8825_FLL_REF_DIV_MASK (0x3 << 10)
++#define NAU8825_FLL_REF_DIV_SFT 10
++#define NAU8825_FLL_REF_DIV_MASK (0x3 << NAU8825_FLL_REF_DIV_SFT)
+
+ /* FLL5 (0x08) */
+ #define NAU8825_FLL_FILTER_SW_MASK (0x1 << 14)
+diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
+index a564759845f9..5a3f544bb3a8 100644
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -126,6 +126,16 @@ static const struct reg_default aic3x_reg[] = {
+ { 108, 0x00 }, { 109, 0x00 },
+ };
+
++static bool aic3x_volatile_reg(struct device *dev, unsigned int reg)
++{
++ switch (reg) {
++ case AIC3X_RESET:
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static const struct regmap_config aic3x_regmap = {
+ .reg_bits = 8,
+ .val_bits = 8,
+@@ -133,6 +143,9 @@ static const struct regmap_config aic3x_regmap = {
+ .max_register = DAC_ICC_ADJ,
+ .reg_defaults = aic3x_reg,
+ .num_reg_defaults = ARRAY_SIZE(aic3x_reg),
++
++ .volatile_reg = aic3x_volatile_reg,
++
+ .cache_type = REGCACHE_RBTREE,
+ };
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 65b936e251ea..a1e605bbc465 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2073,9 +2073,11 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+- case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+ fe->dpcm[stream].state = SND_SOC_DPCM_STATE_STOP;
+ break;
++ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++ fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PAUSED;
++ break;
+ }
+
+ out:
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index be1f511e4f54..ae2981460cd8 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -384,6 +384,9 @@ static void snd_complete_urb(struct urb *urb)
+ if (unlikely(atomic_read(&ep->chip->shutdown)))
+ goto exit_clear;
+
++ if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags)))
++ goto exit_clear;
++
+ if (usb_pipeout(ep->pipe)) {
+ retire_outbound_urb(ep, ctx);
+ /* can be stopped during retire callback */
+diff --git a/tools/lib/traceevent/plugin_sched_switch.c b/tools/lib/traceevent/plugin_sched_switch.c
+index f1ce60065258..ec30c2fcbac0 100644
+--- a/tools/lib/traceevent/plugin_sched_switch.c
++++ b/tools/lib/traceevent/plugin_sched_switch.c
+@@ -111,7 +111,7 @@ static int sched_switch_handler(struct trace_seq *s,
+ trace_seq_printf(s, "%lld ", val);
+
+ if (pevent_get_field_val(s, event, "prev_prio", record, &val, 0) == 0)
+- trace_seq_printf(s, "[%lld] ", val);
++ trace_seq_printf(s, "[%d] ", (int) val);
+
+ if (pevent_get_field_val(s, event, "prev_state", record, &val, 0) == 0)
+ write_state(s, val);
+@@ -129,7 +129,7 @@ static int sched_switch_handler(struct trace_seq *s,
+ trace_seq_printf(s, "%lld", val);
+
+ if (pevent_get_field_val(s, event, "next_prio", record, &val, 0) == 0)
+- trace_seq_printf(s, " [%lld]", val);
++ trace_seq_printf(s, " [%d]", (int) val);
+
+ return 0;
+ }
+diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
+index 929a32ba15f5..b67e006d56cc 100644
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -563,9 +563,9 @@ install-tests: all install-gtk
+ $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests/attr'; \
+ $(INSTALL) tests/attr/* '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests/attr'
+
+-install-bin: install-tools install-tests
++install-bin: install-tools install-tests install-traceevent-plugins
+
+-install: install-bin try-install-man install-traceevent-plugins
++install: install-bin try-install-man
+
+ install-python_ext:
+ $(PYTHON_WORD) util/setup.py --quiet install --root='/$(DESTDIR_SQ)'
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 67282a759496..eeeae0629ad3 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -110,6 +110,7 @@ struct intel_pt_decoder {
+ bool have_tma;
+ bool have_cyc;
+ bool fixup_last_mtc;
++ bool have_last_ip;
+ uint64_t pos;
+ uint64_t last_ip;
+ uint64_t ip;
+@@ -145,8 +146,6 @@ struct intel_pt_decoder {
+ bool have_calc_cyc_to_tsc;
+ int exec_mode;
+ unsigned int insn_bytes;
+- uint64_t sign_bit;
+- uint64_t sign_bits;
+ uint64_t period;
+ enum intel_pt_period_type period_type;
+ uint64_t tot_insn_cnt;
+@@ -214,9 +213,6 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params)
+ decoder->data = params->data;
+ decoder->return_compression = params->return_compression;
+
+- decoder->sign_bit = (uint64_t)1 << 47;
+- decoder->sign_bits = ~(((uint64_t)1 << 48) - 1);
+-
+ decoder->period = params->period;
+ decoder->period_type = params->period_type;
+
+@@ -385,21 +381,30 @@ int intel_pt__strerror(int code, char *buf, size_t buflen)
+ return 0;
+ }
+
+-static uint64_t intel_pt_calc_ip(struct intel_pt_decoder *decoder,
+- const struct intel_pt_pkt *packet,
++static uint64_t intel_pt_calc_ip(const struct intel_pt_pkt *packet,
+ uint64_t last_ip)
+ {
+ uint64_t ip;
+
+ switch (packet->count) {
+- case 2:
++ case 1:
+ ip = (last_ip & (uint64_t)0xffffffffffff0000ULL) |
+ packet->payload;
+ break;
+- case 4:
++ case 2:
+ ip = (last_ip & (uint64_t)0xffffffff00000000ULL) |
+ packet->payload;
+ break;
++ case 3:
++ ip = packet->payload;
++ /* Sign-extend 6-byte ip */
++ if (ip & (uint64_t)0x800000000000ULL)
++ ip |= (uint64_t)0xffff000000000000ULL;
++ break;
++ case 4:
++ ip = (last_ip & (uint64_t)0xffff000000000000ULL) |
++ packet->payload;
++ break;
+ case 6:
+ ip = packet->payload;
+ break;
+@@ -407,16 +412,13 @@ static uint64_t intel_pt_calc_ip(struct intel_pt_decoder *decoder,
+ return 0;
+ }
+
+- if (ip & decoder->sign_bit)
+- return ip | decoder->sign_bits;
+-
+ return ip;
+ }
+
+ static inline void intel_pt_set_last_ip(struct intel_pt_decoder *decoder)
+ {
+- decoder->last_ip = intel_pt_calc_ip(decoder, &decoder->packet,
+- decoder->last_ip);
++ decoder->last_ip = intel_pt_calc_ip(&decoder->packet, decoder->last_ip);
++ decoder->have_last_ip = true;
+ }
+
+ static inline void intel_pt_set_ip(struct intel_pt_decoder *decoder)
+@@ -1436,7 +1438,8 @@ static int intel_pt_walk_psbend(struct intel_pt_decoder *decoder)
+
+ case INTEL_PT_FUP:
+ decoder->pge = true;
+- intel_pt_set_last_ip(decoder);
++ if (decoder->packet.count)
++ intel_pt_set_last_ip(decoder);
+ break;
+
+ case INTEL_PT_MODE_TSX:
+@@ -1640,6 +1643,8 @@ static int intel_pt_walk_trace(struct intel_pt_decoder *decoder)
+ break;
+
+ case INTEL_PT_PSB:
++ decoder->last_ip = 0;
++ decoder->have_last_ip = true;
+ intel_pt_clear_stack(&decoder->stack);
+ err = intel_pt_walk_psbend(decoder);
+ if (err == -EAGAIN)
+@@ -1718,6 +1723,13 @@ static int intel_pt_walk_trace(struct intel_pt_decoder *decoder)
+ }
+ }
+
++static inline bool intel_pt_have_ip(struct intel_pt_decoder *decoder)
++{
++ return decoder->packet.count &&
++ (decoder->have_last_ip || decoder->packet.count == 3 ||
++ decoder->packet.count == 6);
++}
++
+ /* Walk PSB+ packets to get in sync. */
+ static int intel_pt_walk_psb(struct intel_pt_decoder *decoder)
+ {
+@@ -1739,8 +1751,7 @@ static int intel_pt_walk_psb(struct intel_pt_decoder *decoder)
+
+ case INTEL_PT_FUP:
+ decoder->pge = true;
+- if (decoder->last_ip || decoder->packet.count == 6 ||
+- decoder->packet.count == 0) {
++ if (intel_pt_have_ip(decoder)) {
+ uint64_t current_ip = decoder->ip;
+
+ intel_pt_set_ip(decoder);
+@@ -1832,24 +1843,17 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder)
+ case INTEL_PT_TIP_PGE:
+ case INTEL_PT_TIP:
+ decoder->pge = decoder->packet.type != INTEL_PT_TIP_PGD;
+- if (decoder->last_ip || decoder->packet.count == 6 ||
+- decoder->packet.count == 0)
++ if (intel_pt_have_ip(decoder))
+ intel_pt_set_ip(decoder);
+ if (decoder->ip)
+ return 0;
+ break;
+
+ case INTEL_PT_FUP:
+- if (decoder->overflow) {
+- if (decoder->last_ip ||
+- decoder->packet.count == 6 ||
+- decoder->packet.count == 0)
+- intel_pt_set_ip(decoder);
+- if (decoder->ip)
+- return 0;
+- }
+- if (decoder->packet.count)
+- intel_pt_set_last_ip(decoder);
++ if (intel_pt_have_ip(decoder))
++ intel_pt_set_ip(decoder);
++ if (decoder->ip)
++ return 0;
+ break;
+
+ case INTEL_PT_MTC:
+@@ -1898,6 +1902,8 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder)
+ break;
+
+ case INTEL_PT_PSB:
++ decoder->last_ip = 0;
++ decoder->have_last_ip = true;
+ intel_pt_clear_stack(&decoder->stack);
+ err = intel_pt_walk_psb(decoder);
+ if (err)
+@@ -2034,6 +2040,7 @@ static int intel_pt_sync(struct intel_pt_decoder *decoder)
+
+ decoder->pge = false;
+ decoder->continuous_period = false;
++ decoder->have_last_ip = false;
+ decoder->last_ip = 0;
+ decoder->ip = 0;
+ intel_pt_clear_stack(&decoder->stack);
+@@ -2042,6 +2049,7 @@ static int intel_pt_sync(struct intel_pt_decoder *decoder)
+ if (err)
+ return err;
+
++ decoder->have_last_ip = true;
+ decoder->pkt_state = INTEL_PT_STATE_NO_IP;
+
+ err = intel_pt_walk_psb(decoder);
+@@ -2084,6 +2092,7 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder)
+ err = intel_pt_sync(decoder);
+ break;
+ case INTEL_PT_STATE_NO_IP:
++ decoder->have_last_ip = false;
+ decoder->last_ip = 0;
+ decoder->ip = 0;
+ /* Fall through */
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
+index 9b2fce25162b..7528ae4f7e28 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
+@@ -293,36 +293,46 @@ static int intel_pt_get_ip(enum intel_pt_pkt_type type, unsigned int byte,
+ const unsigned char *buf, size_t len,
+ struct intel_pt_pkt *packet)
+ {
+- switch (byte >> 5) {
++ int ip_len;
++
++ packet->count = byte >> 5;
++
++ switch (packet->count) {
+ case 0:
+- packet->count = 0;
++ ip_len = 0;
+ break;
+ case 1:
+ if (len < 3)
+ return INTEL_PT_NEED_MORE_BYTES;
+- packet->count = 2;
++ ip_len = 2;
+ packet->payload = le16_to_cpu(*(uint16_t *)(buf + 1));
+ break;
+ case 2:
+ if (len < 5)
+ return INTEL_PT_NEED_MORE_BYTES;
+- packet->count = 4;
++ ip_len = 4;
+ packet->payload = le32_to_cpu(*(uint32_t *)(buf + 1));
+ break;
+ case 3:
+- case 6:
++ case 4:
+ if (len < 7)
+ return INTEL_PT_NEED_MORE_BYTES;
+- packet->count = 6;
++ ip_len = 6;
+ memcpy_le64(&packet->payload, buf + 1, 6);
+ break;
++ case 6:
++ if (len < 9)
++ return INTEL_PT_NEED_MORE_BYTES;
++ ip_len = 8;
++ packet->payload = le64_to_cpu(*(uint64_t *)(buf + 1));
++ break;
+ default:
+ return INTEL_PT_BAD_PACKET;
+ }
+
+ packet->type = type;
+
+- return packet->count + 1;
++ return ip_len + 1;
+ }
+
+ static int intel_pt_get_mode(const unsigned char *buf, size_t len,
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 27ae382feb2d..7c97ecaeae48 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -488,6 +488,12 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size)
+ break;
+ } else {
+ int n = namesz + descsz;
++
++ if (n > (int)sizeof(bf)) {
++ n = sizeof(bf);
++ pr_debug("%s: truncating reading of build id in sysfs file %s: n_namesz=%u, n_descsz=%u.\n",
++ __func__, filename, nhdr.n_namesz, nhdr.n_descsz);
++ }
+ if (read(fd, bf, n) != n)
+ break;
+ }
diff --git a/patches.kernel.org/patch-4.4.80-81 b/patches.kernel.org/patch-4.4.80-81
new file mode 100644
index 0000000000..ddc0e249ed
--- /dev/null
+++ b/patches.kernel.org/patch-4.4.80-81
@@ -0,0 +1,2176 @@
+From: Jiri Slaby <jslaby@suse.cz>
+Subject: Linux 4.4.81
+Patch-mainline: 4.4.81
+References: CVE-2017-7542 CVE-2017-8831 bnc#1012382 bsc#1037994 bsc#1041958 bsc#1049882 FATE#321670 FATE#321701 FATE#321947 bsc#1019675 bsc#1026030 bsc#1036489
+Git-commit: 0a94efb5acbb6980d7c9ab604372d93cd507e4d8
+Git-commit: a5cb659bbc1c8644efa0c3138a757a1e432a4880
+Git-commit: 0a28cfd51e17f4f0a056bcf66bfbe492c3b99f38
+Git-commit: f073bdc51771f5a5c7a8d1191bfc3ae371d44de7
+Git-commit: 2d39b3cd34e6d323720d4c61bd714f5ae202c022
+Git-commit: da0510c47519fe0999cffe316e1d370e29f952be
+Git-commit: bb1107f7c6052c863692a41f78c000db792334bf
+Git-commit: 270c8cf1cacc69cb8d99dea812f06067a45e4609
+Git-commit: 6bf6b0aa3da84a3d9126919a94c49c0fb7ee2fb3
+Git-commit: 71d3f6ef7f5af38dea2975ec5715c88bae92e92d
+Git-commit: c7702b8c22712a06080e10f1d2dee1a133ec8809
+Git-commit: 811a919135b980bac8009d042acdccf10dc1ef5e
+Git-commit: fac69d0efad08fc15e4dbfc116830782acc0dc9a
+Git-commit: f5992b72ebe0dde488fa8f706b887194020c66fc
+Git-commit: 5ca7d1ca77dc23934504b95a96d2660d345f83c2
+Git-commit: 0f1f9cbc04dbb3cc310f70a11cba0cf1f2109d9c
+Git-commit: 93be2b74279c15c2844684b1a027fdc71dd5d9bf
+Git-commit: 9d53caec84c7c5700e7c1ed744ea584fff55f9ac
+Git-commit: dfa523ae9f2542bee4cddaea37b3be3e157f6e6b
+Git-commit: 7b9a88a390dacb37b051a7b09b9a08f546edf5eb
+Git-commit: 7ad813f208533cebfcc32d3d7474dc1677d1b09a
+Git-commit: 219c81f7d1d5a89656cb3b53d3b4e11e93608d80
+Git-commit: 6b84202c946cd3da3a8daa92c682510e9ed80321
+Git-commit: b1f5bfc27a19f214006b9b4db7b9126df2dfdf5a
+Git-commit: e90ce2fc27cad7e7b1e72b9e66201a7a4c124c2b
+Git-commit: b7953d3c0e30a5fc944f6b7bd0bcceb0794bcd85
+Git-commit: 0c2232b0a71db0ac1d22f751aa1ac0cadb950fd2
+Git-commit: 4813497b537c6208c90d6cbecac5072d347de900
+Git-commit: afce615aaabfbaad02550e75c0bec106dafa1adf
+Git-commit: c800aaf8d869f2b9b47b10c5c312fe19f0a94042
+Git-commit: 69ec932e364b1ba9c3a2085fe96b76c8a3f71e7c
+Git-commit: 9476d393667968b4a02afbe9d35a3558482b943e
+Git-commit: 153711f9421be5dbc973dc57a4109dc9d54c89b1
+Git-commit: 8799a221f5944a7d74516ecf46d58c28ec1d1f75
+Git-commit: 6399f1fae4ec29fab5ec76070435555e256ca3a6
+Git-commit: 63679112c536289826fec61c917621de95ba2ade
+Git-commit: 18bcf2907df935981266532e1e0d052aff2e6fae
+Git-commit: 6fb05e0dd32e566facb96ea61a48c7488daa5ac3
+Git-commit: 15d3042a937c13f5d9244241c7a9c8416ff6e82a
+Git-commit: 9f5039ba440e499d85c29b1ddbc3cbc9dc90e44b
+Git-commit: 3ea277194daaeaa84ce75180ec7c7a2075027a68
+Git-commit: fce50a2fa4e9c6e103915c351b6d4a98661341d6
+Git-commit: 105fa2f44e504c830697b0c794822112d79808dc
+Git-commit: 25cdda95fda78d22d44157da15aa7ea34be3c804
+Git-commit: 8f0dfb3d8b1120c61f6e2cc3729290db10772b2d
+Git-commit: 5e0cf5e6c43b9e19fc0284f69e5cd2b4a47523b0
+Git-commit: 49cb77e297dc611a1b795cfeb79452b3002bd331
+Git-commit: da05d52d2f0f6bd61094a0cd045fed94bf7d673a
+Git-commit: 8d4514173211586c6238629b1ef1e071927735f5
+Git-commit: aec51758ce10a9c847a62a48a168f8c804c6e053
+Git-commit: fcf5ea10992fbac3c7473a1db33d56a139333cd1
+Git-commit: adb1fe9ae2ee6ef6bc10f3d5a588020e7664dfa7
+Git-commit: 337c017ccdf2653d0040099433fc1a2b1beb5926
+Git-commit: b1cd2e34c69a2f3988786af451b6e17967c293a0
+Git-commit: 3f3c371421e601fa93b6cb7fb52da9ad59ec90b4
+Git-commit: 5c0338c68706be53b3dc472e4308961c36e4ece1
+Git-commit: 59a5e266c3f5c1567508888dd61a45b86daed0fa
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+diff --git a/Makefile b/Makefile
+index dddd55adde24..d049e53a6960 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 80
++SUBLEVEL = 81
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+
+diff --git a/arch/arm/boot/dts/armada-388-gp.dts b/arch/arm/boot/dts/armada-388-gp.dts
+index cd316021d6ce..6c1b45c1af66 100644
+--- a/arch/arm/boot/dts/armada-388-gp.dts
++++ b/arch/arm/boot/dts/armada-388-gp.dts
+@@ -89,7 +89,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&pca0_pins>;
+ interrupt-parent = <&gpio0>;
+- interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+@@ -101,7 +101,7 @@
+ compatible = "nxp,pca9555";
+ pinctrl-names = "default";
+ interrupt-parent = <&gpio0>;
+- interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h
+index bfe2a2f5a644..22b73112b75f 100644
+--- a/arch/arm/include/asm/ftrace.h
++++ b/arch/arm/include/asm/ftrace.h
+@@ -54,6 +54,24 @@ static inline void *return_address(unsigned int level)
+
+ #define ftrace_return_address(n) return_address(n)
+
++#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
++
++static inline bool arch_syscall_match_sym_name(const char *sym,
++ const char *name)
++{
++ if (!strcmp(sym, "sys_mmap2"))
++ sym = "sys_mmap_pgoff";
++ else if (!strcmp(sym, "sys_statfs64_wrapper"))
++ sym = "sys_statfs64";
++ else if (!strcmp(sym, "sys_fstatfs64_wrapper"))
++ sym = "sys_fstatfs64";
++ else if (!strcmp(sym, "sys_arm_fadvise64_64"))
++ sym = "sys_fadvise64_64";
++
++ /* Ignore case since sym may start with "SyS" instead of "sys" */
++ return !strcasecmp(sym, name);
++}
++
+ #endif /* ifndef __ASSEMBLY__ */
+
+ #endif /* _ASM_ARM_FTRACE */
+diff --git a/arch/sparc/include/asm/trap_block.h b/arch/sparc/include/asm/trap_block.h
+index ec9c04de3664..ff05992dae7a 100644
+--- a/arch/sparc/include/asm/trap_block.h
++++ b/arch/sparc/include/asm/trap_block.h
+@@ -54,6 +54,7 @@ extern struct trap_per_cpu trap_block[NR_CPUS];
+ void init_cur_cpu_trap(struct thread_info *);
+ void setup_tba(void);
+ extern int ncpus_probed;
++extern u64 cpu_mondo_counter[NR_CPUS];
+
+ unsigned long real_hard_smp_processor_id(void);
+
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index 95a9fa0d2195..4511caa3b7e9 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -617,22 +617,48 @@ static void cheetah_xcall_deliver(struct trap_per_cpu *tb, int cnt)
+ }
+ }
+
+-/* Multi-cpu list version. */
++#define CPU_MONDO_COUNTER(cpuid) (cpu_mondo_counter[cpuid])
++#define MONDO_USEC_WAIT_MIN 2
++#define MONDO_USEC_WAIT_MAX 100
++#define MONDO_RETRY_LIMIT 500000
++
++/* Multi-cpu list version.
++ *
++ * Deliver xcalls to 'cnt' number of cpus in 'cpu_list'.
++ * Sometimes not all cpus receive the mondo, requiring us to re-send
++ * the mondo until all cpus have received, or cpus are truly stuck
++ * unable to receive mondo, and we timeout.
++ * Occasionally a target cpu strand is borrowed briefly by hypervisor to
++ * perform guest service, such as PCIe error handling. Consider the
++ * service time, 1 second overall wait is reasonable for 1 cpu.
++ * Here two in-between mondo check wait time are defined: 2 usec for
++ * single cpu quick turn around and up to 100usec for large cpu count.
++ * Deliver mondo to large number of cpus could take longer, we adjusts
++ * the retry count as long as target cpus are making forward progress.
++ */
+ static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
+ {
+- int retries, this_cpu, prev_sent, i, saw_cpu_error;
++ int this_cpu, tot_cpus, prev_sent, i, rem;
++ int usec_wait, retries, tot_retries;
++ u16 first_cpu = 0xffff;
++ unsigned long xc_rcvd = 0;
+ unsigned long status;
++ int ecpuerror_id = 0;
++ int enocpu_id = 0;
+ u16 *cpu_list;
++ u16 cpu;
+
+ this_cpu = smp_processor_id();
+-
+ cpu_list = __va(tb->cpu_list_pa);
+-
+- saw_cpu_error = 0;
+- retries = 0;
++ usec_wait = cnt * MONDO_USEC_WAIT_MIN;
++ if (usec_wait > MONDO_USEC_WAIT_MAX)
++ usec_wait = MONDO_USEC_WAIT_MAX;
++ retries = tot_retries = 0;
++ tot_cpus = cnt;
+ prev_sent = 0;
++
+ do {
+- int forward_progress, n_sent;
++ int n_sent, mondo_delivered, target_cpu_busy;
+
+ status = sun4v_cpu_mondo_send(cnt,
+ tb->cpu_list_pa,
+@@ -640,94 +666,113 @@ static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
+
+ /* HV_EOK means all cpus received the xcall, we're done. */
+ if (likely(status == HV_EOK))
+- break;
++ goto xcall_done;
++
++ /* If not these non-fatal errors, panic */
++ if (unlikely((status != HV_EWOULDBLOCK) &&
++ (status != HV_ECPUERROR) &&
++ (status != HV_ENOCPU)))
++ goto fatal_errors;
+
+ /* First, see if we made any forward progress.
++ *
++ * Go through the cpu_list, count the target cpus that have
++ * received our mondo (n_sent), and those that did not (rem).
++ * Re-pack cpu_list with the cpus remain to be retried in the
++ * front - this simplifies tracking the truly stalled cpus.
+ *
+ * The hypervisor indicates successful sends by setting
+ * cpu list entries to the value 0xffff.
++ *
++ * EWOULDBLOCK means some target cpus did not receive the
++ * mondo and retry usually helps.
++ *
++ * ECPUERROR means at least one target cpu is in error state,
++ * it's usually safe to skip the faulty cpu and retry.
++ *
++ * ENOCPU means one of the target cpu doesn't belong to the
++ * domain, perhaps offlined which is unexpected, but not
++ * fatal and it's okay to skip the offlined cpu.
+ */
++ rem = 0;
+ n_sent = 0;
+ for (i = 0; i < cnt; i++) {
+- if (likely(cpu_list[i] == 0xffff))
++ cpu = cpu_list[i];
++ if (likely(cpu == 0xffff)) {
+ n_sent++;
++ } else if ((status == HV_ECPUERROR) &&
++ (sun4v_cpu_state(cpu) == HV_CPU_STATE_ERROR)) {
++ ecpuerror_id = cpu + 1;
++ } else if (status == HV_ENOCPU && !cpu_online(cpu)) {
++ enocpu_id = cpu + 1;
++ } else {
++ cpu_list[rem++] = cpu;
++ }
+ }
+
+- forward_progress = 0;
+- if (n_sent > prev_sent)
+- forward_progress = 1;
++ /* No cpu remained, we're done. */
++ if (rem == 0)
++ break;
+
+- prev_sent = n_sent;
++ /* Otherwise, update the cpu count for retry. */
++ cnt = rem;
+
+- /* If we get a HV_ECPUERROR, then one or more of the cpus
+- * in the list are in error state. Use the cpu_state()
+- * hypervisor call to find out which cpus are in error state.
++ /* Record the overall number of mondos received by the
++ * first of the remaining cpus.
+ */
+- if (unlikely(status == HV_ECPUERROR)) {
+- for (i = 0; i < cnt; i++) {
+- long err;
+- u16 cpu;
++ if (first_cpu != cpu_list[0]) {
++ first_cpu = cpu_list[0];
++ xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
++ }
+
+- cpu = cpu_list[i];
+- if (cpu == 0xffff)
+- continue;
++ /* Was any mondo delivered successfully? */
++ mondo_delivered = (n_sent > prev_sent);
++ prev_sent = n_sent;
+
+- err = sun4v_cpu_state(cpu);
+- if (err == HV_CPU_STATE_ERROR) {
+- saw_cpu_error = (cpu + 1);
+- cpu_list[i] = 0xffff;
+- }
+- }
+- } else if (unlikely(status != HV_EWOULDBLOCK))
+- goto fatal_mondo_error;
++ /* or, was any target cpu busy processing other mondos? */
++ target_cpu_busy = (xc_rcvd < CPU_MONDO_COUNTER(first_cpu));
++ xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
+
+- /* Don't bother rewriting the CPU list, just leave the
+- * 0xffff and non-0xffff entries in there and the
+- * hypervisor will do the right thing.
+- *
+- * Only advance timeout state if we didn't make any
+- * forward progress.
++ /* Retry count is for no progress. If we're making progress,
++ * reset the retry count.
+ */
+- if (unlikely(!forward_progress)) {
+- if (unlikely(++retries > 10000))
+- goto fatal_mondo_timeout;
+-
+- /* Delay a little bit to let other cpus catch up
+- * on their cpu mondo queue work.
+- */
+- udelay(2 * cnt);
++ if (likely(mondo_delivered || target_cpu_busy)) {
++ tot_retries += retries;
++ retries = 0;
++ } else if (unlikely(retries > MONDO_RETRY_LIMIT)) {
++ goto fatal_mondo_timeout;
+ }
+- } while (1);
+
+- if (unlikely(saw_cpu_error))
+- goto fatal_mondo_cpu_error;
++ /* Delay a little bit to let other cpus catch up on
++ * their cpu mondo queue work.
++ */
++ if (!mondo_delivered)
++ udelay(usec_wait);
+
+- return;
++ retries++;
++ } while (1);
+
+-fatal_mondo_cpu_error:
+- printk(KERN_CRIT "CPU[%d]: SUN4V mondo cpu error, some target cpus "
+- "(including %d) were in error state\n",
+- this_cpu, saw_cpu_error - 1);
++xcall_done:
++ if (unlikely(ecpuerror_id > 0)) {
++ pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) was in error state\n",
++ this_cpu, ecpuerror_id - 1);
++ } else if (unlikely(enocpu_id > 0)) {
++ pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) does not belong to the domain\n",
++ this_cpu, enocpu_id - 1);
++ }
+ return;
+
++fatal_errors:
++ /* fatal errors include bad alignment, etc */
++ pr_crit("CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) mondo_block_pa(%lx)\n",
++ this_cpu, tot_cpus, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
++ panic("Unexpected SUN4V mondo error %lu\n", status);
++
+ fatal_mondo_timeout:
+- printk(KERN_CRIT "CPU[%d]: SUN4V mondo timeout, no forward "
+- " progress after %d retries.\n",
+- this_cpu, retries);
+- goto dump_cpu_list_and_out;
+-
+-fatal_mondo_error:
+- printk(KERN_CRIT "CPU[%d]: Unexpected SUN4V mondo error %lu\n",
+- this_cpu, status);
+- printk(KERN_CRIT "CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) "
+- "mondo_block_pa(%lx)\n",
+- this_cpu, cnt, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
+-
+-dump_cpu_list_and_out:
+- printk(KERN_CRIT "CPU[%d]: CPU list [ ", this_cpu);
+- for (i = 0; i < cnt; i++)
+- printk("%u ", cpu_list[i]);
+- printk("]\n");
++ /* some cpus being non-responsive to the cpu mondo */
++ pr_crit("CPU[%d]: SUN4V mondo timeout, cpu(%d) made no forward progress after %d retries. Total target cpus(%d).\n",
++ this_cpu, first_cpu, (tot_retries + retries), tot_cpus);
++ panic("SUN4V mondo timeout panic\n");
+ }
+
+ static void (*xcall_deliver_impl)(struct trap_per_cpu *, int);
+diff --git a/arch/sparc/kernel/sun4v_ivec.S b/arch/sparc/kernel/sun4v_ivec.S
+index 559bc5e9c199..34631995859a 100644
+--- a/arch/sparc/kernel/sun4v_ivec.S
++++ b/arch/sparc/kernel/sun4v_ivec.S
+@@ -26,6 +26,21 @@ sun4v_cpu_mondo:
+ ldxa [%g0] ASI_SCRATCHPAD, %g4
+ sub %g4, TRAP_PER_CPU_FAULT_INFO, %g4
+
++ /* Get smp_processor_id() into %g3 */
++ sethi %hi(trap_block), %g5
++ or %g5, %lo(trap_block), %g5
++ sub %g4, %g5, %g3
++ srlx %g3, TRAP_BLOCK_SZ_SHIFT, %g3
++
++ /* Increment cpu_mondo_counter[smp_processor_id()] */
++ sethi %hi(cpu_mondo_counter), %g5
++ or %g5, %lo(cpu_mondo_counter), %g5
++ sllx %g3, 3, %g3
++ add %g5, %g3, %g5
++ ldx [%g5], %g3
++ add %g3, 1, %g3
++ stx %g3, [%g5]
++
+ /* Get CPU mondo queue base phys address into %g7. */
+ ldx [%g4 + TRAP_PER_CPU_CPU_MONDO_PA], %g7
+
+diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
+index cc97a43268ee..d883c5951e8b 100644
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -2659,6 +2659,7 @@ void do_getpsr(struct pt_regs *regs)
+ }
+ }
+
++u64 cpu_mondo_counter[NR_CPUS] = {0};
+ struct trap_per_cpu trap_block[NR_CPUS];
+ EXPORT_SYMBOL(trap_block);
+
+diff --git a/arch/x86/boot/string.c b/arch/x86/boot/string.c
+index 318b8465d302..06ceddb3a22e 100644
+--- a/arch/x86/boot/string.c
++++ b/arch/x86/boot/string.c
+@@ -14,6 +14,7 @@
+
+ #include <linux/types.h>
+ #include "ctype.h"
++#include "string.h"
+
+ int memcmp(const void *s1, const void *s2, size_t len)
+ {
+diff --git a/arch/x86/boot/string.h b/arch/x86/boot/string.h
+index 725e820602b1..113588ddb43f 100644
+--- a/arch/x86/boot/string.h
++++ b/arch/x86/boot/string.h
+@@ -18,4 +18,13 @@ int memcmp(const void *s1, const void *s2, size_t len);
+ #define memset(d,c,l) __builtin_memset(d,c,l)
+ #define memcmp __builtin_memcmp
+
++extern int strcmp(const char *str1, const char *str2);
++extern int strncmp(const char *cs, const char *ct, size_t count);
++extern size_t strlen(const char *s);
++extern char *strstr(const char *s1, const char *s2);
++extern size_t strnlen(const char *s, size_t maxlen);
++extern unsigned int atou(const char *s);
++extern unsigned long long simple_strtoull(const char *cp, char **endp,
++ unsigned int base);
++
+ #endif /* BOOT_STRING_H */
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index cec49ecf5f31..32187f8a49b4 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -151,6 +151,8 @@ void kvm_async_pf_task_wait(u32 token)
+ if (hlist_unhashed(&n.link))
+ break;
+
++ rcu_irq_exit();
++
+ if (!n.halted) {
+ local_irq_enable();
+ schedule();
+@@ -159,11 +161,11 @@ void kvm_async_pf_task_wait(u32 token)
+ /*
+ * We cannot reschedule. So halt.
+ */
+- rcu_irq_exit();
+ native_safe_halt();
+ local_irq_disable();
+- rcu_irq_enter();
+ }
++
++ rcu_irq_enter();
+ }
+ if (!n.halted)
+ finish_wait(&n.wq, &wait);
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index e417e1a1d02c..5b2aee83d776 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2832,10 +2832,12 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
+ static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
+ {
+ if (!sata_pmp_attached(ap)) {
+- if (likely(devno < ata_link_max_devices(&ap->link)))
++ if (likely(devno >= 0 &&
++ devno < ata_link_max_devices(&ap->link)))
+ return &ap->link.device[devno];
+ } else {
+- if (likely(devno < ap->nr_pmp_links))
++ if (likely(devno >= 0 &&
++ devno < ap->nr_pmp_links))
+ return &ap->pmp_link[devno].device[0];
+ }
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 6ca35495a5be..1e5cd39d0cc2 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -641,11 +641,12 @@ static int virtblk_probe(struct virtio_device *vdev)
+ if (err)
+ goto out_put_disk;
+
+- q = vblk->disk->queue = blk_mq_init_queue(&vblk->tag_set);
++ q = blk_mq_init_queue(&vblk->tag_set);
+ if (IS_ERR(q)) {
+ err = -ENOMEM;
+ goto out_free_tags;
+ }
++ vblk->disk->queue = q;
+
+ q->queuedata = vblk;
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+index bf4674aa6405..bb9cd35d7fdf 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+@@ -296,7 +296,7 @@ static int rcar_du_probe(struct platform_device *pdev)
+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ rcdu->mmio = devm_ioremap_resource(&pdev->dev, mem);
+ if (IS_ERR(rcdu->mmio))
+- ret = PTR_ERR(rcdu->mmio);
++ return PTR_ERR(rcdu->mmio);
+
+ /* DRM/KMS objects */
+ ddev = drm_dev_alloc(&rcar_du_driver, &pdev->dev);
+diff --git a/drivers/gpu/drm/virtio/virtgpu_fb.c b/drivers/gpu/drm/virtio/virtgpu_fb.c
+index 6a81e084593b..2b59d80a09b8 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_fb.c
++++ b/drivers/gpu/drm/virtio/virtgpu_fb.c
+@@ -338,7 +338,7 @@ static int virtio_gpufb_create(struct drm_fb_helper *helper,
+ info->fbops = &virtio_gpufb_ops;
+ info->pixmap.flags = FB_PIXMAP_SYSTEM;
+
+- info->screen_base = obj->vmap;
++ info->screen_buffer = obj->vmap;
+ info->screen_size = obj->gem_base.size;
+ drm_fb_helper_fill_fix(info, fb->pitches[0], fb->depth);
+ drm_fb_helper_fill_var(info, &vfbdev->helper,
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index b0edb66a291b..0b7f5a701c60 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -1581,7 +1581,7 @@ isert_rcv_completion(struct iser_rx_desc *desc,
+ struct isert_conn *isert_conn,
+ u32 xfer_len)
+ {
+- struct ib_device *ib_dev = isert_conn->cm_id->device;
++ struct ib_device *ib_dev = isert_conn->device->ib_device;
+ struct iscsi_hdr *hdr;
+ u64 rx_dma;
+ int rx_buflen;
+diff --git a/drivers/media/pci/saa7164/saa7164-bus.c b/drivers/media/pci/saa7164/saa7164-bus.c
+index a18fe5d47238..b4857cd7069e 100644
+--- a/drivers/media/pci/saa7164/saa7164-bus.c
++++ b/drivers/media/pci/saa7164/saa7164-bus.c
+@@ -393,11 +393,11 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
+ msg_tmp.size = le16_to_cpu((__force __le16)msg_tmp.size);
+ msg_tmp.command = le32_to_cpu((__force __le32)msg_tmp.command);
+ msg_tmp.controlselector = le16_to_cpu((__force __le16)msg_tmp.controlselector);
++ memcpy(msg, &msg_tmp, sizeof(*msg));
+
+ /* No need to update the read positions, because this was a peek */
+ /* If the caller specifically want to peek, return */
+ if (peekonly) {
+- memcpy(msg, &msg_tmp, sizeof(*msg));
+ goto peekout;
+ }
+
+@@ -442,21 +442,15 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
+ space_rem = bus->m_dwSizeGetRing - curr_grp;
+
+ if (space_rem < sizeof(*msg)) {
+- /* msg wraps around the ring */
+- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, space_rem);
+- memcpy_fromio((u8 *)msg + space_rem, bus->m_pdwGetRing,
+- sizeof(*msg) - space_rem);
+ if (buf)
+ memcpy_fromio(buf, bus->m_pdwGetRing + sizeof(*msg) -
+ space_rem, buf_size);
+
+ } else if (space_rem == sizeof(*msg)) {
+- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
+ if (buf)
+ memcpy_fromio(buf, bus->m_pdwGetRing, buf_size);
+ } else {
+ /* Additional data wraps around the ring */
+- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
+ if (buf) {
+ memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp +
+ sizeof(*msg), space_rem - sizeof(*msg));
+@@ -469,15 +463,10 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
+
+ } else {
+ /* No wrapping */
+- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
+ if (buf)
+ memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp + sizeof(*msg),
+ buf_size);
+ }
+- /* Convert from little endian to CPU */
+- msg->size = le16_to_cpu((__force __le16)msg->size);
+- msg->command = le32_to_cpu((__force __le32)msg->command);
+- msg->controlselector = le16_to_cpu((__force __le16)msg->controlselector);
+
+ /* Update the read positions, adjusting the ring */
+ saa7164_writel(bus->m_dwGetReadPos, new_grp);
+diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c
+index 7767e072d623..1f656a3a84b9 100644
+--- a/drivers/media/platform/davinci/vpfe_capture.c
++++ b/drivers/media/platform/davinci/vpfe_capture.c
+@@ -1709,27 +1709,9 @@ static long vpfe_param_handler(struct file *file, void *priv,
+
+ switch (cmd) {
+ case VPFE_CMD_S_CCDC_RAW_PARAMS:
++ ret = -EINVAL;
+ v4l2_warn(&vpfe_dev->v4l2_dev,
+- "VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n");
+- if (ccdc_dev->hw_ops.set_params) {
+- ret = ccdc_dev->hw_ops.set_params(param);
+- if (ret) {
+- v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+- "Error setting parameters in CCDC\n");
+- goto unlock_out;
+- }
+- ret = vpfe_get_ccdc_image_format(vpfe_dev,
+- &vpfe_dev->fmt);
+- if (ret < 0) {
+- v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+- "Invalid image format at CCDC\n");
+- goto unlock_out;
+- }
+- } else {
+- ret = -EINVAL;
+- v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+- "VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
+- }
++ "VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
+ break;
+ default:
+ ret = -ENOTTY;
+diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
+index a32659fcd266..efc21b1da211 100644
+--- a/drivers/media/rc/ir-lirc-codec.c
++++ b/drivers/media/rc/ir-lirc-codec.c
+@@ -254,7 +254,7 @@ static long ir_lirc_ioctl(struct file *filep, unsigned int cmd,
+ return 0;
+
+ case LIRC_GET_REC_RESOLUTION:
+- val = dev->rx_resolution;
++ val = dev->rx_resolution / 1000;
+ break;
+
+ case LIRC_SET_WIDEBAND_RECEIVER:
+diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
+index ecc4a334c507..0a54e7dac0ab 100644
+--- a/drivers/net/ethernet/aurora/nb8800.c
++++ b/drivers/net/ethernet/aurora/nb8800.c
+@@ -608,7 +608,7 @@ static void nb8800_mac_config(struct net_device *dev)
+ mac_mode |= HALF_DUPLEX;
+
+ if (gigabit) {
+- if (priv->phy_mode == PHY_INTERFACE_MODE_RGMII)
++ if (phy_interface_is_rgmii(dev->phydev))
+ mac_mode |= RGMII_MODE;
+
+ mac_mode |= GMAC_MODE;
+@@ -1295,11 +1295,10 @@ static int nb8800_tangox_init(struct net_device *dev)
+ break;
+
+ case PHY_INTERFACE_MODE_RGMII:
+- pad_mode = PAD_MODE_RGMII;
+- break;
+-
++ case PHY_INTERFACE_MODE_RGMII_ID:
++ case PHY_INTERFACE_MODE_RGMII_RXID:
+ case PHY_INTERFACE_MODE_RGMII_TXID:
+- pad_mode = PAD_MODE_RGMII | PAD_MODE_GTX_CLK_DELAY;
++ pad_mode = PAD_MODE_RGMII;
+ break;
+
+ default:
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 21e5b9ed1ead..3613469dc5c6 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -8722,11 +8722,14 @@ static void tg3_free_consistent(struct tg3 *tp)
+ tg3_mem_rx_release(tp);
+ tg3_mem_tx_release(tp);
+
++ /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */
++ tg3_full_lock(tp, 0);
+ if (tp->hw_stats) {
+ dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats),
+ tp->hw_stats, tp->stats_mapping);
+ tp->hw_stats = NULL;
+ }
++ tg3_full_unlock(tp);
+ }
+
+ /*
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index cc199063612a..6c66d2979795 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -630,6 +630,10 @@ static void dump_command(struct mlx5_core_dev *dev,
+ pr_debug("\n");
+ }
+
++static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg);
++static void mlx5_free_cmd_msg(struct mlx5_core_dev *dev,
++ struct mlx5_cmd_msg *msg);
++
+ static void cmd_work_handler(struct work_struct *work)
+ {
+ struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work);
+@@ -638,16 +642,27 @@ static void cmd_work_handler(struct work_struct *work)
+ struct mlx5_cmd_layout *lay;
+ struct semaphore *sem;
+ unsigned long flags;
++ int alloc_ret;
+
+ sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;
+ down(sem);
+ if (!ent->page_queue) {
+- ent->idx = alloc_ent(cmd);
+- if (ent->idx < 0) {
++ alloc_ret = alloc_ent(cmd);
++ if (alloc_ret < 0) {
++ if (ent->callback) {
++ ent->callback(-EAGAIN, ent->context);
++ mlx5_free_cmd_msg(dev, ent->out);
++ free_msg(dev, ent->in);
++ free_cmd(ent);
++ } else {
++ ent->ret = -EAGAIN;
++ complete(&ent->done);
++ }
+ mlx5_core_err(dev, "failed to allocate command entry\n");
+ up(sem);
+ return;
+ }
++ ent->idx = alloc_ret;
+ } else {
+ ent->idx = cmd->max_reg_cmds;
+ spin_lock_irqsave(&cmd->alloc_lock, flags);
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 4296066a7ad3..479af106aaeb 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -819,6 +819,7 @@ static struct sh_eth_cpu_data r8a7740_data = {
+ .rpadir_value = 2 << 16,
+ .no_trimd = 1,
+ .no_ade = 1,
++ .hw_crc = 1,
+ .tsu = 1,
+ .select_mii = 1,
+ .shift_rd0 = 1,
+diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c
+index bca6a1e72d1d..e1bb802d4a4d 100644
+--- a/drivers/net/irda/mcs7780.c
++++ b/drivers/net/irda/mcs7780.c
+@@ -141,9 +141,19 @@ static int mcs_set_reg(struct mcs_cb *mcs, __u16 reg, __u16 val)
+ static int mcs_get_reg(struct mcs_cb *mcs, __u16 reg, __u16 * val)
+ {
+ struct usb_device *dev = mcs->usbdev;
+- int ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
+- MCS_RD_RTYPE, 0, reg, val, 2,
+- msecs_to_jiffies(MCS_CTRL_TIMEOUT));
++ void *dmabuf;
++ int ret;
++
++ dmabuf = kmalloc(sizeof(__u16), GFP_KERNEL);
++ if (!dmabuf)
++ return -ENOMEM;
++
++ ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
++ MCS_RD_RTYPE, 0, reg, dmabuf, 2,
++ msecs_to_jiffies(MCS_CTRL_TIMEOUT));
++
++ memcpy(val, dmabuf, sizeof(__u16));
++ kfree(dmabuf);
+
+ return ret;
+ }
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index 32f10662f4ac..7242dd4b3238 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -29,6 +29,7 @@
+ #define MII_DP83867_MICR 0x12
+ #define MII_DP83867_ISR 0x13
+ #define DP83867_CTRL 0x1f
++#define DP83867_CFG3 0x1e
+
+ /* Extended Registers */
+ #define DP83867_RGMIICTL 0x0032
+@@ -89,6 +90,8 @@ static int dp83867_config_intr(struct phy_device *phydev)
+ micr_status |=
+ (MII_DP83867_MICR_AN_ERR_INT_EN |
+ MII_DP83867_MICR_SPEED_CHNG_INT_EN |
++ MII_DP83867_MICR_AUTONEG_COMP_INT_EN |
++ MII_DP83867_MICR_LINK_STS_CHNG_INT_EN |
+ MII_DP83867_MICR_DUP_MODE_CHNG_INT_EN |
+ MII_DP83867_MICR_SLEEP_MODE_CHNG_INT_EN);
+
+@@ -184,6 +187,13 @@ static int dp83867_config_init(struct phy_device *phydev)
+ DP83867_DEVADDR, phydev->addr, delay);
+ }
+
++ /* Enable Interrupt output INT_OE in CFG3 register */
++ if (phy_interrupt_is_valid(phydev)) {
++ val = phy_read(phydev, DP83867_CFG3);
++ val |= BIT(7);
++ phy_write(phydev, DP83867_CFG3, val);
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index 851c0e121807..49d9f0a789fe 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -541,6 +541,9 @@ void phy_stop_machine(struct phy_device *phydev)
+ if (phydev->state > PHY_UP && phydev->state != PHY_HALTED)
+ phydev->state = PHY_UP;
+ mutex_unlock(&phydev->lock);
++
++ /* Now we can run the state machine synchronously */
++ phy_state_machine(&phydev->state_queue.work);
+ }
+
+ /**
+@@ -918,6 +921,15 @@ void phy_state_machine(struct work_struct *work)
+ if (old_link != phydev->link)
+ phydev->state = PHY_CHANGELINK;
+ }
++ /*
++ * Failsafe: check that nobody set phydev->link=0 between two
++ * poll cycles, otherwise we won't leave RUNNING state as long
++ * as link remains down.
++ */
++ if (!phydev->link && phydev->state == PHY_RUNNING) {
++ phydev->state = PHY_CHANGELINK;
++ dev_err(&phydev->dev, "no link in PHY_RUNNING\n");
++ }
+ break;
+ case PHY_CHANGELINK:
+ err = phy_read_status(phydev);
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 1d1e5f7723ab..8179727d3423 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1368,6 +1368,8 @@ static int phy_remove(struct device *dev)
+ {
+ struct phy_device *phydev = to_phy_device(dev);
+
++ cancel_delayed_work_sync(&phydev->state_queue);
++
+ mutex_lock(&phydev->lock);
+ phydev->state = PHY_DOWN;
+ mutex_unlock(&phydev->lock);
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 0333ab0fd926..34173b5e886f 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -201,6 +201,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */
+ unsigned long remaining_credit;
+ struct timer_list credit_timeout;
+ u64 credit_window_start;
++ bool rate_limited;
+
+ /* Statistics */
+ struct xenvif_stats stats;
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index e7bd63eb2876..60b26f32d31d 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -105,7 +105,11 @@ static int xenvif_poll(struct napi_struct *napi, int budget)
+
+ if (work_done < budget) {
+ napi_complete(napi);
+- xenvif_napi_schedule_or_enable_events(queue);
++ /* If the queue is rate-limited, it shall be
++ * rescheduled in the timer callback.
++ */
++ if (likely(!queue->rate_limited))
++ xenvif_napi_schedule_or_enable_events(queue);
+ }
+
+ return work_done;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 1049c34e7d43..72ee1c305cc4 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -687,6 +687,7 @@ static void tx_add_credit(struct xenvif_queue *queue)
+ max_credit = ULONG_MAX; /* wrapped: clamp to ULONG_MAX */
+
+ queue->remaining_credit = min(max_credit, max_burst);
++ queue->rate_limited = false;
+ }
+
+ void xenvif_tx_credit_callback(unsigned long data)
+@@ -1184,8 +1185,10 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
+ msecs_to_jiffies(queue->credit_usec / 1000);
+
+ /* Timer could already be pending in rare cases. */
+- if (timer_pending(&queue->credit_timeout))
++ if (timer_pending(&queue->credit_timeout)) {
++ queue->rate_limited = true;
+ return true;
++ }
+
+ /* Passed the point where we can replenish credit? */
+ if (time_after_eq64(now, next_credit)) {
+@@ -1200,6 +1203,7 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
+ mod_timer(&queue->credit_timeout,
+ next_credit);
+ queue->credit_window_start = next_credit;
++ queue->rate_limited = true;
+
+ return true;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 6b942d9e5b74..1ed85dfc008d 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -329,12 +329,15 @@ qla2x00_sysfs_read_optrom(struct file *filp, struct kobject *kobj,
+ struct qla_hw_data *ha = vha->hw;
+ ssize_t rval = 0;
+
++ mutex_lock(&ha->optrom_mutex);
++
+ if (ha->optrom_state != QLA_SREADING)
+- return 0;
++ goto out;
+
+- mutex_lock(&ha->optrom_mutex);
+ rval = memory_read_from_buffer(buf, count, &off, ha->optrom_buffer,
+ ha->optrom_region_size);
++
++out:
+ mutex_unlock(&ha->optrom_mutex);
+
+ return rval;
+@@ -349,14 +352,19 @@ qla2x00_sysfs_write_optrom(struct file *filp, struct kobject *kobj,
+ struct device, kobj)));
+ struct qla_hw_data *ha = vha->hw;
+
+- if (ha->optrom_state != QLA_SWRITING)
++ mutex_lock(&ha->optrom_mutex);
++
++ if (ha->optrom_state != QLA_SWRITING) {
++ mutex_unlock(&ha->optrom_mutex);
+ return -EINVAL;
+- if (off > ha->optrom_region_size)
++ }
++ if (off > ha->optrom_region_size) {
++ mutex_unlock(&ha->optrom_mutex);
+ return -ERANGE;
++ }
+ if (off + count > ha->optrom_region_size)
+ count = ha->optrom_region_size - off;
+
+- mutex_lock(&ha->optrom_mutex);
+ memcpy(&ha->optrom_buffer[off], buf, count);
+ mutex_unlock(&ha->optrom_mutex);
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index a180c000e246..31d5d9c0e10b 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -3965,6 +3965,8 @@ int iscsi_target_tx_thread(void *arg)
+ {
+ int ret = 0;
+ struct iscsi_conn *conn = arg;
++ bool conn_freed = false;
++
+ /*
+ * Allow ourselves to be interrupted by SIGINT so that a
+ * connection recovery / failure event can be triggered externally.
+@@ -3990,12 +3992,14 @@ int iscsi_target_tx_thread(void *arg)
+ goto transport_err;
+
+ ret = iscsit_handle_response_queue(conn);
+- if (ret == 1)
++ if (ret == 1) {
+ goto get_immediate;
+- else if (ret == -ECONNRESET)
++ } else if (ret == -ECONNRESET) {
++ conn_freed = true;
+ goto out;
+- else if (ret < 0)
++ } else if (ret < 0) {
+ goto transport_err;
++ }
+ }
+
+ transport_err:
+@@ -4005,8 +4009,13 @@ int iscsi_target_tx_thread(void *arg)
+ * responsible for cleaning up the early connection failure.
+ */
+ if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
+- iscsit_take_action_for_connection_exit(conn);
++ iscsit_take_action_for_connection_exit(conn, &conn_freed);
+ out:
++ if (!conn_freed) {
++ while (!kthread_should_stop()) {
++ msleep(100);
++ }
++ }
+ return 0;
+ }
+
+@@ -4105,6 +4114,7 @@ int iscsi_target_rx_thread(void *arg)
+ u32 checksum = 0, digest = 0;
+ struct iscsi_conn *conn = arg;
+ struct kvec iov;
++ bool conn_freed = false;
+ /*
+ * Allow ourselves to be interrupted by SIGINT so that a
+ * connection recovery / failure event can be triggered externally.
+@@ -4116,7 +4126,7 @@ int iscsi_target_rx_thread(void *arg)
+ */
+ rc = wait_for_completion_interruptible(&conn->rx_login_comp);
+ if (rc < 0 || iscsi_target_check_conn_state(conn))
+- return 0;
++ goto out;
+
+ if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
+ struct completion comp;
+@@ -4201,7 +4211,13 @@ int iscsi_target_rx_thread(void *arg)
+ transport_err:
+ if (!signal_pending(current))
+ atomic_set(&conn->transport_failed, 1);
+- iscsit_take_action_for_connection_exit(conn);
++ iscsit_take_action_for_connection_exit(conn, &conn_freed);
++out:
++ if (!conn_freed) {
++ while (!kthread_should_stop()) {
++ msleep(100);
++ }
++ }
+ return 0;
+ }
+
+@@ -4575,8 +4591,11 @@ static void iscsit_logout_post_handler_closesession(
+ * always sleep waiting for RX/TX thread shutdown to complete
+ * within iscsit_close_connection().
+ */
+- if (conn->conn_transport->transport_type == ISCSI_TCP)
++ if (conn->conn_transport->transport_type == ISCSI_TCP) {
+ sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ if (!sleep)
++ return;
++ }
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+@@ -4592,8 +4611,11 @@ static void iscsit_logout_post_handler_samecid(
+ {
+ int sleep = 1;
+
+- if (conn->conn_transport->transport_type == ISCSI_TCP)
++ if (conn->conn_transport->transport_type == ISCSI_TCP) {
+ sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ if (!sleep)
++ return;
++ }
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
+index 210f6e4830e3..6c88fb021444 100644
+--- a/drivers/target/iscsi/iscsi_target_erl0.c
++++ b/drivers/target/iscsi/iscsi_target_erl0.c
+@@ -930,8 +930,10 @@ static void iscsit_handle_connection_cleanup(struct iscsi_conn *conn)
+ }
+ }
+
+-void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
++void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn, bool *conn_freed)
+ {
++ *conn_freed = false;
++
+ spin_lock_bh(&conn->state_lock);
+ if (atomic_read(&conn->connection_exit)) {
+ spin_unlock_bh(&conn->state_lock);
+@@ -942,6 +944,7 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
+ if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
+ spin_unlock_bh(&conn->state_lock);
+ iscsit_close_connection(conn);
++ *conn_freed = true;
+ return;
+ }
+
+@@ -955,4 +958,5 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
+ spin_unlock_bh(&conn->state_lock);
+
+ iscsit_handle_connection_cleanup(conn);
++ *conn_freed = true;
+ }
+diff --git a/drivers/target/iscsi/iscsi_target_erl0.h b/drivers/target/iscsi/iscsi_target_erl0.h
+index a9e2f9497fb2..fbc1d84a63c3 100644
+--- a/drivers/target/iscsi/iscsi_target_erl0.h
++++ b/drivers/target/iscsi/iscsi_target_erl0.h
+@@ -9,6 +9,6 @@ extern int iscsit_stop_time2retain_timer(struct iscsi_session *);
+ extern void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *);
+ extern void iscsit_cause_connection_reinstatement(struct iscsi_conn *, int);
+ extern void iscsit_fall_back_to_erl0(struct iscsi_session *);
+-extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *);
++extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *, bool *);
+
+ #endif /*** ISCSI_TARGET_ERL0_H ***/
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 4a137b0ae3dc..b19edffa7d98 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -1436,5 +1436,9 @@ int iscsi_target_login_thread(void *arg)
+ break;
+ }
+
++ while (!kthread_should_stop()) {
++ msleep(100);
++ }
++
+ return 0;
+ }
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index 549a2bbbf4df..58c629aec73c 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -489,14 +489,60 @@ static void iscsi_target_restore_sock_callbacks(struct iscsi_conn *conn)
+
+ static int iscsi_target_do_login(struct iscsi_conn *, struct iscsi_login *);
+
+-static bool iscsi_target_sk_state_check(struct sock *sk)
++static bool __iscsi_target_sk_check_close(struct sock *sk)
+ {
+ if (sk->sk_state == TCP_CLOSE_WAIT || sk->sk_state == TCP_CLOSE) {
+- pr_debug("iscsi_target_sk_state_check: TCP_CLOSE_WAIT|TCP_CLOSE,"
++ pr_debug("__iscsi_target_sk_check_close: TCP_CLOSE_WAIT|TCP_CLOSE,"
+ "returning FALSE\n");
+- return false;
++ return true;
+ }
+- return true;
++ return false;
++}
++
++static bool iscsi_target_sk_check_close(struct iscsi_conn *conn)
++{
++ bool state = false;
++
++ if (conn->sock) {
++ struct sock *sk = conn->sock->sk;
++
++ read_lock_bh(&sk->sk_callback_lock);
++ state = (__iscsi_target_sk_check_close(sk) ||
++ test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
++ read_unlock_bh(&sk->sk_callback_lock);
++ }
++ return state;
++}
++
++static bool iscsi_target_sk_check_flag(struct iscsi_conn *conn, unsigned int flag)
++{
++ bool state = false;
++
++ if (conn->sock) {
++ struct sock *sk = conn->sock->sk;
++
++ read_lock_bh(&sk->sk_callback_lock);
++ state = test_bit(flag, &conn->login_flags);
++ read_unlock_bh(&sk->sk_callback_lock);
++ }
++ return state;
++}
++
++static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned int flag)
++{
++ bool state = false;
++
++ if (conn->sock) {
++ struct sock *sk = conn->sock->sk;
++
++ write_lock_bh(&sk->sk_callback_lock);
++ state = (__iscsi_target_sk_check_close(sk) ||
++ test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
++ if (!state)
++ clear_bit(flag, &conn->login_flags);
++ write_unlock_bh(&sk->sk_callback_lock);
++ }
++ return state;
+ }
+
+ static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login)
+@@ -536,6 +582,20 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
+
+ pr_debug("entering iscsi_target_do_login_rx, conn: %p, %s:%d\n",
+ conn, current->comm, current->pid);
++ /*
++ * If iscsi_target_do_login_rx() has been invoked by ->sk_data_ready()
++ * before initial PDU processing in iscsi_target_start_negotiation()
++ * has completed, go ahead and retry until it's cleared.
++ *
++ * Otherwise if the TCP connection drops while this is occuring,
++ * iscsi_target_start_negotiation() will detect the failure, call
++ * cancel_delayed_work_sync(&conn->login_work), and cleanup the
++ * remaining iscsi connection resources from iscsi_np process context.
++ */
++ if (iscsi_target_sk_check_flag(conn, LOGIN_FLAGS_INITIAL_PDU)) {
++ schedule_delayed_work(&conn->login_work, msecs_to_jiffies(10));
++ return;
++ }
+
+ spin_lock(&tpg->tpg_state_lock);
+ state = (tpg->tpg_state == TPG_STATE_ACTIVE);
+@@ -543,26 +603,12 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
+
+ if (!state) {
+ pr_debug("iscsi_target_do_login_rx: tpg_state != TPG_STATE_ACTIVE\n");
+- iscsi_target_restore_sock_callbacks(conn);
+- iscsi_target_login_drop(conn, login);
+- iscsit_deaccess_np(np, tpg, tpg_np);
+- return;
++ goto err;
+ }
+
+- if (conn->sock) {
+- struct sock *sk = conn->sock->sk;
+-
+- read_lock_bh(&sk->sk_callback_lock);
+- state = iscsi_target_sk_state_check(sk);
+- read_unlock_bh(&sk->sk_callback_lock);
+-
+- if (!state) {
+- pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
+- iscsi_target_restore_sock_callbacks(conn);
+- iscsi_target_login_drop(conn, login);
+- iscsit_deaccess_np(np, tpg, tpg_np);
+- return;
+- }
++ if (iscsi_target_sk_check_close(conn)) {
++ pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
++ goto err;
+ }
+
+ conn->login_kworker = current;
+@@ -580,34 +626,29 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
+ flush_signals(current);
+ conn->login_kworker = NULL;
+
+- if (rc < 0) {
+- iscsi_target_restore_sock_callbacks(conn);
+- iscsi_target_login_drop(conn, login);
+- iscsit_deaccess_np(np, tpg, tpg_np);
+- return;
+- }
++ if (rc < 0)
++ goto err;
+
+ pr_debug("iscsi_target_do_login_rx after rx_login_io, %p, %s:%d\n",
+ conn, current->comm, current->pid);
+
+ rc = iscsi_target_do_login(conn, login);
+ if (rc < 0) {
+- iscsi_target_restore_sock_callbacks(conn);
+- iscsi_target_login_drop(conn, login);
+- iscsit_deaccess_np(np, tpg, tpg_np);
++ goto err;
+ } else if (!rc) {
+- if (conn->sock) {
+- struct sock *sk = conn->sock->sk;
+-
+- write_lock_bh(&sk->sk_callback_lock);
+- clear_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags);
+- write_unlock_bh(&sk->sk_callback_lock);
+- }
++ if (iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_READ_ACTIVE))
++ goto err;
+ } else if (rc == 1) {
+ iscsi_target_nego_release(conn);
+ iscsi_post_login_handler(np, conn, zero_tsih);
+ iscsit_deaccess_np(np, tpg, tpg_np);
+ }
++ return;
++
++err:
++ iscsi_target_restore_sock_callbacks(conn);
++ iscsi_target_login_drop(conn, login);
++ iscsit_deaccess_np(np, tpg, tpg_np);
+ }
+
+ static void iscsi_target_do_cleanup(struct work_struct *work)
+@@ -655,31 +696,54 @@ static void iscsi_target_sk_state_change(struct sock *sk)
+ orig_state_change(sk);
+ return;
+ }
++ state = __iscsi_target_sk_check_close(sk);
++ pr_debug("__iscsi_target_sk_close_change: state: %d\n", state);
++
+ if (test_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags)) {
+ pr_debug("Got LOGIN_FLAGS_READ_ACTIVE=1 sk_state_change"
+ " conn: %p\n", conn);
++ if (state)
++ set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
+ write_unlock_bh(&sk->sk_callback_lock);
+ orig_state_change(sk);
+ return;
+ }
+- if (test_and_set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
++ if (test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
+ pr_debug("Got LOGIN_FLAGS_CLOSED=1 sk_state_change conn: %p\n",
+ conn);
+ write_unlock_bh(&sk->sk_callback_lock);
+ orig_state_change(sk);
+ return;
+ }
++ /*
++ * If the TCP connection has dropped, go ahead and set LOGIN_FLAGS_CLOSED,
++ * but only queue conn->login_work -> iscsi_target_do_login_rx()
++ * processing if LOGIN_FLAGS_INITIAL_PDU has already been cleared.
++ *
++ * When iscsi_target_do_login_rx() runs, iscsi_target_sk_check_close()
++ * will detect the dropped TCP connection from delayed workqueue context.
++ *
++ * If LOGIN_FLAGS_INITIAL_PDU is still set, which means the initial
++ * iscsi_target_start_negotiation() is running, iscsi_target_do_login()
++ * via iscsi_target_sk_check_close() or iscsi_target_start_negotiation()
++ * via iscsi_target_sk_check_and_clear() is responsible for detecting the
++ * dropped TCP connection in iscsi_np process context, and cleaning up
++ * the remaining iscsi connection resources.
++ */
++ if (state) {
++ pr_debug("iscsi_target_sk_state_change got failed state\n");
++ set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
++ state = test_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
++ write_unlock_bh(&sk->sk_callback_lock);
+
+- state = iscsi_target_sk_state_check(sk);
+- write_unlock_bh(&sk->sk_callback_lock);
+-
+- pr_debug("iscsi_target_sk_state_change: state: %d\n", state);
++ orig_state_change(sk);
+
+- if (!state) {
+- pr_debug("iscsi_target_sk_state_change got failed state\n");
+- schedule_delayed_work(&conn->login_cleanup_work, 0);
++ if (!state)
++ schedule_delayed_work(&conn->login_work, 0);
+ return;
+ }
++ write_unlock_bh(&sk->sk_callback_lock);
++
+ orig_state_change(sk);
+ }
+
+@@ -944,6 +1008,15 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
+ if (iscsi_target_handle_csg_one(conn, login) < 0)
+ return -1;
+ if (login_rsp->flags & ISCSI_FLAG_LOGIN_TRANSIT) {
++ /*
++ * Check to make sure the TCP connection has not
++ * dropped asynchronously while session reinstatement
++ * was occuring in this kthread context, before
++ * transitioning to full feature phase operation.
++ */
++ if (iscsi_target_sk_check_close(conn))
++ return -1;
++
+ login->tsih = conn->sess->tsih;
+ login->login_complete = 1;
+ iscsi_target_restore_sock_callbacks(conn);
+@@ -970,21 +1043,6 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
+ break;
+ }
+
+- if (conn->sock) {
+- struct sock *sk = conn->sock->sk;
+- bool state;
+-
+- read_lock_bh(&sk->sk_callback_lock);
+- state = iscsi_target_sk_state_check(sk);
+- read_unlock_bh(&sk->sk_callback_lock);
+-
+- if (!state) {
+- pr_debug("iscsi_target_do_login() failed state for"
+- " conn: %p\n", conn);
+- return -1;
+- }
+- }
+-
+ return 0;
+ }
+
+@@ -1248,16 +1306,28 @@ int iscsi_target_start_negotiation(
+ {
+ int ret;
+
++ if (conn->sock) {
++ struct sock *sk = conn->sock->sk;
++
++ write_lock_bh(&sk->sk_callback_lock);
++ set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
++ set_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
++ write_unlock_bh(&sk->sk_callback_lock);
++ }
++ /*
++ * If iscsi_target_do_login returns zero to signal more PDU
++ * exchanges are required to complete the login, go ahead and
++ * clear LOGIN_FLAGS_INITIAL_PDU but only if the TCP connection
++ * is still active.
++ *
++ * Otherwise if TCP connection dropped asynchronously, go ahead
++ * and perform connection cleanup now.
++ */
+ ret = iscsi_target_do_login(conn, login);
+- if (!ret) {
+- if (conn->sock) {
+- struct sock *sk = conn->sock->sk;
++ if (!ret && iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_INITIAL_PDU))
++ ret = -1;
+
+- write_lock_bh(&sk->sk_callback_lock);
+- set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
+- write_unlock_bh(&sk->sk_callback_lock);
+- }
+- } else if (ret < 0) {
++ if (ret < 0) {
+ cancel_delayed_work_sync(&conn->login_work);
+ cancel_delayed_work_sync(&conn->login_cleanup_work);
+ iscsi_target_restore_sock_callbacks(conn);
+diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
+index f916d18ccb48..b070ddf1dc37 100644
+--- a/drivers/target/target_core_fabric_configfs.c
++++ b/drivers/target/target_core_fabric_configfs.c
+@@ -92,6 +92,11 @@ static int target_fabric_mappedlun_link(
+ pr_err("Source se_lun->lun_se_dev does not exist\n");
+ return -EINVAL;
+ }
++ if (lun->lun_shutdown) {
++ pr_err("Unable to create mappedlun symlink because"
++ " lun->lun_shutdown=true\n");
++ return -EINVAL;
++ }
+ se_tpg = lun->lun_tpg;
+
+ nacl_ci = &lun_acl_ci->ci_parent->ci_group->cg_item;
+diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
+index 899c33b3c734..f69f4902dc07 100644
+--- a/drivers/target/target_core_tpg.c
++++ b/drivers/target/target_core_tpg.c
+@@ -673,6 +673,8 @@ void core_tpg_remove_lun(
+ */
+ struct se_device *dev = rcu_dereference_raw(lun->lun_se_dev);
+
++ lun->lun_shutdown = true;
++
+ core_clear_lun_from_tpg(lun, tpg);
+ /*
+ * Wait for any active I/O references to percpu se_lun->lun_ref to
+@@ -694,6 +696,8 @@ void core_tpg_remove_lun(
+ }
+ if (!(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
+ hlist_del_rcu(&lun->link);
++
++ lun->lun_shutdown = false;
+ mutex_unlock(&tpg->tpg_lun_mutex);
+
+ percpu_ref_exit(&lun->lun_ref);
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 8772bfc3415b..45ef9975caec 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -500,6 +500,8 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
+ lastoff = page_offset(page);
+ bh = head = page_buffers(page);
+ do {
++ if (lastoff + bh->b_size <= startoff)
++ goto next;
+ if (buffer_uptodate(bh) ||
+ buffer_unwritten(bh)) {
+ if (whence == SEEK_DATA)
+@@ -514,6 +516,7 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
+ unlock_page(page);
+ goto out;
+ }
++next:
+ lastoff += bh->b_size;
+ bh = bh->b_this_page;
+ } while (bh != head);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 34038e3598d5..74516efd874c 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1926,7 +1926,8 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
+ n_desc_blocks = o_desc_blocks +
+ le16_to_cpu(es->s_reserved_gdt_blocks);
+ n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb);
+- n_blocks_count = n_group * EXT4_BLOCKS_PER_GROUP(sb);
++ n_blocks_count = (ext4_fsblk_t)n_group *
++ EXT4_BLOCKS_PER_GROUP(sb);
+ n_group--; /* set to last group number */
+ }
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 86e1cb899957..4f666368aa85 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1078,6 +1078,8 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ unsigned int total, fsmeta;
+ struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
+ struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
++ unsigned int main_segs, blocks_per_seg;
++ int i;
+
+ total = le32_to_cpu(raw_super->segment_count);
+ fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
+@@ -1089,6 +1091,20 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ if (unlikely(fsmeta >= total))
+ return 1;
+
++ main_segs = le32_to_cpu(raw_super->segment_count_main);
++ blocks_per_seg = sbi->blocks_per_seg;
++
++ for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
++ if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs ||
++ le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg)
++ return 1;
++ }
++ for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {
++ if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||
++ le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)
++ return 1;
++ }
++
+ if (unlikely(f2fs_cp_error(sbi))) {
+ f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");
+ return 1;
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 2ccccbfcd532..36f4695aa604 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -503,6 +503,10 @@ struct mm_struct {
+ * PROT_NONE or PROT_NUMA mapped page.
+ */
+ bool tlb_flush_pending;
++#endif
++#ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
++ /* See flush_tlb_batched_pending() */
++ bool tlb_flush_batched;
+ #endif
+ struct uprobes_state uprobes_state;
+ #ifdef CONFIG_X86_INTEL_MPX
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 352213b360d7..eff7c1fad26f 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -801,6 +801,16 @@ struct signal_struct {
+
+ #define SIGNAL_UNKILLABLE 0x00000040 /* for init: ignore fatal signals */
+
++#define SIGNAL_STOP_MASK (SIGNAL_CLD_MASK | SIGNAL_STOP_STOPPED | \
++ SIGNAL_STOP_CONTINUED)
++
++static inline void signal_set_stop_flags(struct signal_struct *sig,
++ unsigned int flags)
++{
++ WARN_ON(sig->flags & (SIGNAL_GROUP_EXIT|SIGNAL_GROUP_COREDUMP));
++ sig->flags = (sig->flags & ~SIGNAL_STOP_MASK) | flags;
++}
++
+ /* If true, all threads except ->group_exit_task have pending SIGKILL */
+ static inline int signal_group_exit(const struct signal_struct *sig)
+ {
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index 2037a861e367..8a2a9ffaf5de 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -203,7 +203,7 @@ size_t ksize(const void *);
+ * (PAGE_SIZE*2). Larger requests are passed to the page allocator.
+ */
+ #define KMALLOC_SHIFT_HIGH (PAGE_SHIFT + 1)
+-#define KMALLOC_SHIFT_MAX (MAX_ORDER + PAGE_SHIFT)
++#define KMALLOC_SHIFT_MAX (MAX_ORDER + PAGE_SHIFT - 1)
+ #ifndef KMALLOC_SHIFT_LOW
+ #define KMALLOC_SHIFT_LOW 3
+ #endif
+@@ -216,7 +216,7 @@ size_t ksize(const void *);
+ * be allocated from the same page.
+ */
+ #define KMALLOC_SHIFT_HIGH PAGE_SHIFT
+-#define KMALLOC_SHIFT_MAX 30
++#define KMALLOC_SHIFT_MAX (MAX_ORDER + PAGE_SHIFT - 1)
+ #ifndef KMALLOC_SHIFT_LOW
+ #define KMALLOC_SHIFT_LOW 3
+ #endif
+diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
+index 0197358f1e81..262d5c95dfc8 100644
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -311,6 +311,7 @@ enum {
+
+ __WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */
+ __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */
++ __WQ_ORDERED_EXPLICIT = 1 << 18, /* internal: alloc_ordered_workqueue() */
+
+ WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */
+ WQ_MAX_UNBOUND_PER_CPU = 4, /* 4 * #cpus for unbound wq */
+@@ -408,7 +409,8 @@ __alloc_workqueue_key(const char *fmt, unsigned int flags, int max_active,
+ * Pointer to the allocated workqueue on success, %NULL on failure.
+ */
+ #define alloc_ordered_workqueue(fmt, flags, args...) \
+- alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | (flags), 1, ##args)
++ alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | \
++ __WQ_ORDERED_EXPLICIT | (flags), 1, ##args)
+
+ #define create_workqueue(name) \
+ alloc_workqueue("%s", WQ_MEM_RECLAIM, 1, (name))
+diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
+index e0f4109e64c6..c2aa73e5e6bb 100644
+--- a/include/net/iw_handler.h
++++ b/include/net/iw_handler.h
+@@ -556,7 +556,8 @@ iwe_stream_add_point(struct iw_request_info *info, char *stream, char *ends,
+ memcpy(stream + lcp_len,
+ ((char *) &iwe->u) + IW_EV_POINT_OFF,
+ IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
+- memcpy(stream + point_len, extra, iwe->u.data.length);
++ if (iwe->u.data.length && extra)
++ memcpy(stream + point_len, extra, iwe->u.data.length);
+ stream += event_len;
+ }
+ return stream;
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index ce13cf20f625..d33b17ba51d2 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -444,6 +444,8 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
+
+ #define _sctp_walk_params(pos, chunk, end, member)\
+ for (pos.v = chunk->member;\
++ (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\
++ (void *)chunk + end) &&\
+ pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
+ ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
+ pos.v += WORD_ROUND(ntohs(pos.p->length)))
+@@ -454,6 +456,8 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length))
+ #define _sctp_walk_errors(err, chunk_hdr, end)\
+ for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
+ sizeof(sctp_chunkhdr_t));\
++ ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\
++ (void *)chunk_hdr + end) &&\
+ (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
+ ntohs(err->length) >= sizeof(sctp_errhdr_t); \
+ err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))
+diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
+index e0efe3fcf739..fdda45f26f75 100644
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -562,6 +562,7 @@ struct iscsi_conn {
+ #define LOGIN_FLAGS_READ_ACTIVE 1
+ #define LOGIN_FLAGS_CLOSED 2
+ #define LOGIN_FLAGS_READY 4
++#define LOGIN_FLAGS_INITIAL_PDU 8
+ unsigned long login_flags;
+ struct delayed_work login_work;
+ struct delayed_work login_cleanup_work;
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index ed66414b91f0..1adf8739980c 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -714,6 +714,7 @@ struct se_lun {
+ #define SE_LUN_LINK_MAGIC 0xffff7771
+ u32 lun_link_magic;
+ u32 lun_access;
++ bool lun_shutdown;
+ u32 lun_index;
+
+ /* RELATIVE TARGET PORT IDENTIFER */
+diff --git a/kernel/signal.c b/kernel/signal.c
+index b92a047ddc82..5d50ea899b6d 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -346,7 +346,7 @@ static bool task_participate_group_stop(struct task_struct *task)
+ * fresh group stop. Read comment in do_signal_stop() for details.
+ */
+ if (!sig->group_stop_count && !(sig->flags & SIGNAL_STOP_STOPPED)) {
+- sig->flags = SIGNAL_STOP_STOPPED;
++ signal_set_stop_flags(sig, SIGNAL_STOP_STOPPED);
+ return true;
+ }
+ return false;
+@@ -845,7 +845,7 @@ static bool prepare_signal(int sig, struct task_struct *p, bool force)
+ * will take ->siglock, notice SIGNAL_CLD_MASK, and
+ * notify its parent. See get_signal_to_deliver().
+ */
+- signal->flags = why | SIGNAL_STOP_CONTINUED;
++ signal_set_stop_flags(signal, why | SIGNAL_STOP_CONTINUED);
+ signal->group_stop_count = 0;
+ signal->group_exit_code = 0;
+ }
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 2c2f971f3e75..23231237f2e2 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3647,8 +3647,12 @@ static int apply_workqueue_attrs_locked(struct workqueue_struct *wq,
+ return -EINVAL;
+
+ /* creating multiple pwqs breaks ordering guarantee */
+- if (WARN_ON((wq->flags & __WQ_ORDERED) && !list_empty(&wq->pwqs)))
+- return -EINVAL;
++ if (!list_empty(&wq->pwqs)) {
++ if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
++ return -EINVAL;
++
++ wq->flags &= ~__WQ_ORDERED;
++ }
+
+ ctx = apply_wqattrs_prepare(wq, attrs);
+
+@@ -3834,6 +3838,16 @@ struct workqueue_struct *__alloc_workqueue_key(const char *fmt,
+ struct workqueue_struct *wq;
+ struct pool_workqueue *pwq;
+
++ /*
++ * Unbound && max_active == 1 used to imply ordered, which is no
++ * longer the case on NUMA machines due to per-node pools. While
++ * alloc_ordered_workqueue() is the right way to create an ordered
++ * workqueue, keep the previous behavior to avoid subtle breakages
++ * on NUMA.
++ */
++ if ((flags & WQ_UNBOUND) && max_active == 1)
++ flags |= __WQ_ORDERED;
++
+ /* see the comment above the definition of WQ_POWER_EFFICIENT */
+ if ((flags & WQ_POWER_EFFICIENT) && wq_power_efficient)
+ flags |= WQ_UNBOUND;
+@@ -4022,13 +4036,14 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active)
+ struct pool_workqueue *pwq;
+
+ /* disallow meddling with max_active for ordered workqueues */
+- if (WARN_ON(wq->flags & __WQ_ORDERED))
++ if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
+ return;
+
+ max_active = wq_clamp_max_active(max_active, wq->flags, wq->name);
+
+ mutex_lock(&wq->mutex);
+
++ wq->flags &= ~__WQ_ORDERED;
+ wq->saved_max_active = max_active;
+
+ for_each_pwq(pwq, wq)
+@@ -5154,7 +5169,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq)
+ * attributes breaks ordering guarantee. Disallow exposing ordered
+ * workqueues.
+ */
+- if (WARN_ON(wq->flags & __WQ_ORDERED))
++ if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
+ return -EINVAL;
+
+ wq->wq_dev = wq_dev = kzalloc(sizeof(*wq_dev), GFP_KERNEL);
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 8c15b29d5adc..b53b375e14bd 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -145,7 +145,7 @@ config DEBUG_INFO_REDUCED
+
+ config DEBUG_INFO_SPLIT
+ bool "Produce split debuginfo in .dwo files"
+- depends on DEBUG_INFO
++ depends on DEBUG_INFO && !FRV
+ help
+ Generate debug info into separate .dwo files. This significantly
+ reduces the build directory size for builds with DEBUG_INFO,
+diff --git a/mm/internal.h b/mm/internal.h
+index 6979b2bd3227..f63f4393d633 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -453,6 +453,7 @@ struct tlbflush_unmap_batch;
+ #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
+ void try_to_unmap_flush(void);
+ void try_to_unmap_flush_dirty(void);
++void flush_tlb_batched_pending(struct mm_struct *mm);
+ #else
+ static inline void try_to_unmap_flush(void)
+ {
+@@ -460,6 +461,8 @@ static inline void try_to_unmap_flush(void)
+ static inline void try_to_unmap_flush_dirty(void)
+ {
+ }
+-
++static inline void flush_tlb_batched_pending(struct mm_struct *mm)
++{
++}
+ #endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */
+ #endif /* __MM_INTERNAL_H */
+diff --git a/mm/memory.c b/mm/memory.c
+index e6fa13484447..9ac55172aa7b 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1127,6 +1127,7 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
+ init_rss_vec(rss);
+ start_pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
+ pte = start_pte;
++ flush_tlb_batched_pending(mm);
+ arch_enter_lazy_mmu_mode();
+ do {
+ pte_t ptent = *pte;
+diff --git a/mm/mprotect.c b/mm/mprotect.c
+index ef5be8eaab00..c0b4b2a49462 100644
+--- a/mm/mprotect.c
++++ b/mm/mprotect.c
+@@ -72,6 +72,7 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
+ if (!pte)
+ return 0;
+
++ flush_tlb_batched_pending(vma->vm_mm);
+ arch_enter_lazy_mmu_mode();
+ do {
+ oldpte = *pte;
+diff --git a/mm/mremap.c b/mm/mremap.c
+index c25bc6268e46..fe7b7f65f4f4 100644
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -135,6 +135,7 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
+ new_ptl = pte_lockptr(mm, new_pmd);
+ if (new_ptl != old_ptl)
+ spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
++ flush_tlb_batched_pending(vma->vm_mm);
+ arch_enter_lazy_mmu_mode();
+
+ for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE,
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index bd17a6bdf131..f9d648fce8cd 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1527,14 +1527,14 @@ int move_freepages(struct zone *zone,
+ #endif
+
+ for (page = start_page; page <= end_page;) {
+- /* Make sure we are not inadvertently changing nodes */
+- VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
+-
+ if (!pfn_valid_within(page_to_pfn(page))) {
+ page++;
+ continue;
+ }
+
++ /* Make sure we are not inadvertently changing nodes */
++ VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
++
+ if (!PageBuddy(page)) {
+ page++;
+ continue;
+@@ -5847,8 +5847,8 @@ unsigned long free_reserved_area(void *start, void *end, int poison, char *s)
+ }
+
+ if (pages && s)
+- pr_info("Freeing %s memory: %ldK (%p - %p)\n",
+- s, pages << (PAGE_SHIFT - 10), start, end);
++ pr_info("Freeing %s memory: %ldK\n",
++ s, pages << (PAGE_SHIFT - 10));
+
+ return pages;
+ }
+diff --git a/mm/rmap.c b/mm/rmap.c
+index b577fbb98d4b..ede183c32f45 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -648,6 +648,13 @@ static void set_tlb_ubc_flush_pending(struct mm_struct *mm,
+ cpumask_or(&tlb_ubc->cpumask, &tlb_ubc->cpumask, mm_cpumask(mm));
+ tlb_ubc->flush_required = true;
+
++ /*
++ * Ensure compiler does not re-order the setting of tlb_flush_batched
++ * before the PTE is cleared.
++ */
++ barrier();
++ mm->tlb_flush_batched = true;
++
+ /*
+ * If the PTE was dirty then it's best to assume it's writable. The
+ * caller must use try_to_unmap_flush_dirty() or try_to_unmap_flush()
+@@ -675,6 +682,35 @@ static bool should_defer_flush(struct mm_struct *mm, enum ttu_flags flags)
+
+ return should_defer;
+ }
++
++/*
++ * Reclaim unmaps pages under the PTL but do not flush the TLB prior to
++ * releasing the PTL if TLB flushes are batched. It's possible for a parallel
++ * operation such as mprotect or munmap to race between reclaim unmapping
++ * the page and flushing the page. If this race occurs, it potentially allows
++ * access to data via a stale TLB entry. Tracking all mm's that have TLB
++ * batching in flight would be expensive during reclaim so instead track
++ * whether TLB batching occurred in the past and if so then do a flush here
++ * if required. This will cost one additional flush per reclaim cycle paid
++ * by the first operation at risk such as mprotect and mumap.
++ *
++ * This must be called under the PTL so that an access to tlb_flush_batched
++ * that is potentially a "reclaim vs mprotect/munmap/etc" race will synchronise
++ * via the PTL.
++ */
++void flush_tlb_batched_pending(struct mm_struct *mm)
++{
++ if (mm->tlb_flush_batched) {
++ flush_tlb_mm(mm);
++
++ /*
++ * Do not allow the compiler to re-order the clearing of
++ * tlb_flush_batched before the tlb is flushed.
++ */
++ barrier();
++ mm->tlb_flush_batched = false;
++ }
++}
+ #else
+ static void set_tlb_ubc_flush_pending(struct mm_struct *mm,
+ struct page *page, bool writable)
+diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
+index b94b1d293506..151e047ce072 100644
+--- a/net/core/dev_ioctl.c
++++ b/net/core/dev_ioctl.c
+@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
+
+ if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
+ return -EFAULT;
++ ifr.ifr_name[IFNAMSIZ-1] = 0;
+
+ error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
+ if (error)
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 2ec5324a7ff7..5b3d611d8b5f 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1742,7 +1742,8 @@ static int do_setlink(const struct sk_buff *skb,
+ struct sockaddr *sa;
+ int len;
+
+- len = sizeof(sa_family_t) + dev->addr_len;
++ len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len,
++ sizeof(*sa));
+ sa = kmalloc(len, GFP_KERNEL);
+ if (!sa) {
+ err = -ENOMEM;
+diff --git a/net/dccp/feat.c b/net/dccp/feat.c
+index 1704948e6a12..f227f002c73d 100644
+--- a/net/dccp/feat.c
++++ b/net/dccp/feat.c
+@@ -1471,9 +1471,12 @@ int dccp_feat_init(struct sock *sk)
+ * singleton values (which always leads to failure).
+ * These settings can still (later) be overridden via sockopts.
+ */
+- if (ccid_get_builtin_ccids(&tx.val, &tx.len) ||
+- ccid_get_builtin_ccids(&rx.val, &rx.len))
++ if (ccid_get_builtin_ccids(&tx.val, &tx.len))
+ return -ENOBUFS;
++ if (ccid_get_builtin_ccids(&rx.val, &rx.len)) {
++ kfree(tx.val);
++ return -ENOBUFS;
++ }
+
+ if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
+ !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index 6467bf392e1b..e217f17997a4 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -635,6 +635,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
+ goto drop_and_free;
+
+ inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
++ reqsk_put(req);
+ return 0;
+
+ drop_and_free:
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 3470ad1843bb..09a9ab65f4e1 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -376,6 +376,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
+ goto drop_and_free;
+
+ inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
++ reqsk_put(req);
+ return 0;
+
+ drop_and_free:
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 66dcb529fd9c..0cb240c749bf 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1319,13 +1319,14 @@ static struct pernet_operations fib_net_ops = {
+
+ void __init ip_fib_init(void)
+ {
+- rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+- rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
+- rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
++ fib_trie_init();
+
+ register_pernet_subsys(&fib_net_ops);
++
+ register_netdevice_notifier(&fib_netdev_notifier);
+ register_inetaddr_notifier(&fib_inetaddr_notifier);
+
+- fib_trie_init();
++ rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
++ rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
++ rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
+ }
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 2b7283303650..5d58a6703a43 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -922,7 +922,8 @@ static int __ip_append_data(struct sock *sk,
+ csummode = CHECKSUM_PARTIAL;
+
+ cork->length += length;
+- if (((length > mtu) || (skb && skb_is_gso(skb))) &&
++ if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
++ (skb && skb_is_gso(skb))) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+ (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+ (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
+diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
+index 4cbe9f0a4281..731b91409625 100644
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -337,6 +337,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
+ treq = tcp_rsk(req);
+ treq->rcv_isn = ntohl(th->seq) - 1;
+ treq->snt_isn = cookie;
++ treq->txhash = net_tx_rndhash();
+ req->mss = mss;
+ ireq->ir_num = ntohs(th->dest);
+ ireq->ir_rmt_port = th->source;
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 150b4923fb72..0de3245ea42f 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -647,8 +647,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ *prevhdr = NEXTHDR_FRAGMENT;
+ tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
+ if (!tmp_hdr) {
+- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+- IPSTATS_MIB_FRAGFAILS);
+ err = -ENOMEM;
+ goto fail;
+ }
+@@ -767,8 +765,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
+ hroom + troom, GFP_ATOMIC);
+ if (!frag) {
+- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+- IPSTATS_MIB_FRAGFAILS);
+ err = -ENOMEM;
+ goto fail;
+ }
+@@ -1361,7 +1357,7 @@ static int __ip6_append_data(struct sock *sk,
+ */
+
+ cork->length += length;
+- if ((((length + fragheaderlen) > mtu) ||
++ if ((((length + (skb ? skb->len : headersize)) > mtu) ||
+ (skb && skb_is_gso(skb))) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+ (rt->dst.dev->features & NETIF_F_UFO) &&
+diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
+index 8b56c5240429..f9f02581c4ca 100644
+--- a/net/ipv6/output_core.c
++++ b/net/ipv6/output_core.c
+@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
+
+ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ {
+- u16 offset = sizeof(struct ipv6hdr);
++ unsigned int offset = sizeof(struct ipv6hdr);
+ unsigned int packet_len = skb_tail_pointer(skb) -
+ skb_network_header(skb);
+ int found_rhdr = 0;
+@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+
+ while (offset <= packet_len) {
+ struct ipv6_opt_hdr *exthdr;
++ unsigned int len;
+
+ switch (**nexthdr) {
+
+@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+
+ exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
+ offset);
+- offset += ipv6_optlen(exthdr);
++ len = ipv6_optlen(exthdr);
++ if (len + offset >= IPV6_MAXPLEN)
++ return -EINVAL;
++ offset += len;
+ *nexthdr = &exthdr->nexthdr;
+ }
+
+diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
+index eaf7ac496d50..aee87282d352 100644
+--- a/net/ipv6/syncookies.c
++++ b/net/ipv6/syncookies.c
+@@ -210,6 +210,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
+ treq->snt_synack.v64 = 0;
+ treq->rcv_isn = ntohl(th->seq) - 1;
+ treq->snt_isn = cookie;
++ treq->txhash = net_tx_rndhash();
+
+ /*
+ * We need to lookup the dst_entry to get the correct window size.
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index ad58d2a6284e..6a2507f24b0f 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -577,8 +577,8 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
+
+ nla_for_each_nested(a, attr, rem) {
+ int type = nla_type(a);
+- int maxlen = ovs_ct_attr_lens[type].maxlen;
+- int minlen = ovs_ct_attr_lens[type].minlen;
++ int maxlen;
++ int minlen;
+
+ if (type > OVS_CT_ATTR_MAX) {
+ OVS_NLERR(log,
+@@ -586,6 +586,9 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
+ type, OVS_CT_ATTR_MAX);
+ return -EINVAL;
+ }
++
++ maxlen = ovs_ct_attr_lens[type].maxlen;
++ minlen = ovs_ct_attr_lens[type].minlen;
+ if (nla_len(a) < minlen || nla_len(a) > maxlen) {
+ OVS_NLERR(log,
+ "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index f8d6a0ca9c03..061771ca2582 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4225,7 +4225,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ register_prot_hook(sk);
+ }
+ spin_unlock(&po->bind_lock);
+- if (closing && (po->tp_version > TPACKET_V2)) {
++ if (pg_vec && (po->tp_version > TPACKET_V2)) {
+ /* Because we don't support block-based V3 on tx-ring */
+ if (!tx_ring)
+ prb_shutdown_retire_blk_timer(po, rb_queue);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 46a34039ecdc..5cab24f52825 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2233,6 +2233,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
+ SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
++ SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP),
+ SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+ SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index a1e605bbc465..977066ba1769 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -181,6 +181,10 @@ int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir,
+ dev_dbg(be->dev, "ASoC: BE %s event %d dir %d\n",
+ be->dai_link->name, event, dir);
+
++ if ((event == SND_SOC_DAPM_STREAM_STOP) &&
++ (be->dpcm[dir].users >= 1))
++ continue;
++
+ snd_soc_dapm_stream_event(be, dir, event);
+ }
+
diff --git a/patches.kernel.org/patch-4.4.81-82 b/patches.kernel.org/patch-4.4.81-82
new file mode 100644
index 0000000000..b95f0e6c98
--- /dev/null
+++ b/patches.kernel.org/patch-4.4.81-82
@@ -0,0 +1,350 @@
+From: Jiri Slaby <jslaby@suse.cz>
+Subject: Linux 4.4.82
+References: bnc#1012382 CVE-2017-1000112 bsc#1052311 CVE-2017-1000111 bsc#1052365
+Patch-mainline: 4.4.82
+Git-commit: a5cb659bbc1c8644efa0c3138a757a1e432a4880
+Git-commit: 0a28cfd51e17f4f0a056bcf66bfbe492c3b99f38
+Git-commit: 7640131032db9118a78af715ac77ba2debeeb17c
+Git-commit: 7e5a672289c9754d07e1c3b33649786d3d70f5e4
+Git-commit: fc290a114fc6034b0f6a5a46e2fb7d54976cf87a
+Git-commit: 85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa
+Git-commit: c27927e372f0785f3303e8fad94b85945e2c97b7
+Git-commit: 8d63bee643f1fb53e472f0e135cae4eb99d62d19
+Git-commit: 8ba60924710cde564a3905588b6219741d6356d0
+Git-commit: 96d9703050a0036a3360ec98bb41e107c90664fe
+Git-commit: b0a0c2566f28e71e5e32121992ac8060cec75510
+Git-commit: 2dda640040876cd8ae646408b69eea40c24f9ae9
+Git-commit: ed254971edea92c3ac5c67c6a05247a92aa6075e
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+diff --git a/Makefile b/Makefile
+index d049e53a6960..52f2dd8dcebd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 81
++SUBLEVEL = 82
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index 1f1ff7e7b9cf..ba079e279b58 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -1629,12 +1629,16 @@ static int kvm_test_age_hva_handler(struct kvm *kvm, gpa_t gpa, void *data)
+
+ int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end)
+ {
++ if (!kvm->arch.pgd)
++ return 0;
+ trace_kvm_age_hva(start, end);
+ return handle_hva_to_gpa(kvm, start, end, kvm_age_hva_handler, NULL);
+ }
+
+ int kvm_test_age_hva(struct kvm *kvm, unsigned long hva)
+ {
++ if (!kvm->arch.pgd)
++ return 0;
+ trace_kvm_test_age_hva(hva);
+ return handle_hva_to_gpa(kvm, hva, hva, kvm_test_age_hva_handler, NULL);
+ }
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 0e2919dd8df3..1395eeb6005f 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -1250,7 +1250,8 @@ static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp)
+ insn_count = bpf_jit_insn(jit, fp, i);
+ if (insn_count < 0)
+ return -1;
+- jit->addrs[i + 1] = jit->prg; /* Next instruction address */
++ /* Next instruction address */
++ jit->addrs[i + insn_count] = jit->prg;
+ }
+ bpf_jit_epilogue(jit);
+
+diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h
+index 349dd23e2876..0cdeb2b483a0 100644
+--- a/arch/sparc/include/asm/mmu_context_64.h
++++ b/arch/sparc/include/asm/mmu_context_64.h
+@@ -25,9 +25,11 @@ void destroy_context(struct mm_struct *mm);
+ void __tsb_context_switch(unsigned long pgd_pa,
+ struct tsb_config *tsb_base,
+ struct tsb_config *tsb_huge,
+- unsigned long tsb_descr_pa);
++ unsigned long tsb_descr_pa,
++ unsigned long secondary_ctx);
+
+-static inline void tsb_context_switch(struct mm_struct *mm)
++static inline void tsb_context_switch_ctx(struct mm_struct *mm,
++ unsigned long ctx)
+ {
+ __tsb_context_switch(__pa(mm->pgd),
+ &mm->context.tsb_block[0],
+@@ -38,9 +40,12 @@ static inline void tsb_context_switch(struct mm_struct *mm)
+ #else
+ NULL
+ #endif
+- , __pa(&mm->context.tsb_descr[0]));
++ , __pa(&mm->context.tsb_descr[0]),
++ ctx);
+ }
+
++#define tsb_context_switch(X) tsb_context_switch_ctx(X, 0)
++
+ void tsb_grow(struct mm_struct *mm,
+ unsigned long tsb_index,
+ unsigned long mm_rss);
+@@ -110,8 +115,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str
+ * cpu0 to update it's TSB because at that point the cpu_vm_mask
+ * only had cpu1 set in it.
+ */
+- load_secondary_context(mm);
+- tsb_context_switch(mm);
++ tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
+
+ /* Any time a processor runs a context on an address space
+ * for the first time, we must flush that context out of the
+diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
+index 395ec1800530..7d961f6e3907 100644
+--- a/arch/sparc/kernel/tsb.S
++++ b/arch/sparc/kernel/tsb.S
+@@ -375,6 +375,7 @@ tsb_flush:
+ * %o1: TSB base config pointer
+ * %o2: TSB huge config pointer, or NULL if none
+ * %o3: Hypervisor TSB descriptor physical address
++ * %o4: Secondary context to load, if non-zero
+ *
+ * We have to run this whole thing with interrupts
+ * disabled so that the current cpu doesn't change
+@@ -387,6 +388,17 @@ __tsb_context_switch:
+ rdpr %pstate, %g1
+ wrpr %g1, PSTATE_IE, %pstate
+
++ brz,pn %o4, 1f
++ mov SECONDARY_CONTEXT, %o5
++
++661: stxa %o4, [%o5] ASI_DMMU
++ .section .sun4v_1insn_patch, "ax"
++ .word 661b
++ stxa %o4, [%o5] ASI_MMU
++ .previous
++ flush %g6
++
++1:
+ TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
+
+ stx %o0, [%g2 + TRAP_PER_CPU_PGD_PADDR]
+diff --git a/arch/sparc/power/hibernate.c b/arch/sparc/power/hibernate.c
+index 17bd2e167e07..df707a8ad311 100644
+--- a/arch/sparc/power/hibernate.c
++++ b/arch/sparc/power/hibernate.c
+@@ -35,6 +35,5 @@ void restore_processor_state(void)
+ {
+ struct mm_struct *mm = current->active_mm;
+
+- load_secondary_context(mm);
+- tsb_context_switch(mm);
++ tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context));
+ }
+diff --git a/mm/mempool.c b/mm/mempool.c
+index 004d42b1dfaf..7924f4f58a6d 100644
+--- a/mm/mempool.c
++++ b/mm/mempool.c
+@@ -135,8 +135,8 @@ static void *remove_element(mempool_t *pool)
+ void *element = pool->elements[--pool->curr_nr];
+
+ BUG_ON(pool->curr_nr < 0);
+- check_element(pool, element);
+ kasan_unpoison_element(pool, element);
++ check_element(pool, element);
+ return element;
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 4b0853194a03..24d243084aab 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2551,7 +2551,7 @@ static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path)
+ {
+ if (tx_path)
+ return skb->ip_summed != CHECKSUM_PARTIAL &&
+- skb->ip_summed != CHECKSUM_NONE;
++ skb->ip_summed != CHECKSUM_UNNECESSARY;
+
+ return skb->ip_summed == CHECKSUM_NONE;
+ }
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 5d58a6703a43..09c73dd541c5 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -922,11 +922,12 @@ static int __ip_append_data(struct sock *sk,
+ csummode = CHECKSUM_PARTIAL;
+
+ cork->length += length;
+- if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
+- (skb && skb_is_gso(skb))) &&
++ if ((skb && skb_is_gso(skb)) ||
++ (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
++ (skb_queue_len(queue) <= 1) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+ (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+- (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
++ (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
+ err = ip_ufo_append_data(sk, queue, getfrag, from, length,
+ hh_len, fragheaderlen, transhdrlen,
+ maxfraglen, flags);
+@@ -1242,6 +1243,7 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
+ return -EINVAL;
+
+ if ((size + skb->len > mtu) &&
++ (skb_queue_len(&sk->sk_write_queue) == 1) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+ (rt->dst.dev->features & NETIF_F_UFO)) {
+ if (skb->ip_summed != CHECKSUM_PARTIAL)
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 8f13b2eaabf8..f0dabd125c43 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2503,8 +2503,8 @@ static inline void tcp_end_cwnd_reduction(struct sock *sk)
+ struct tcp_sock *tp = tcp_sk(sk);
+
+ /* Reset cwnd to ssthresh in CWR or Recovery (unless it's undone) */
+- if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR ||
+- (tp->undo_marker && tp->snd_ssthresh < TCP_INFINITE_SSTHRESH)) {
++ if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH &&
++ (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR || tp->undo_marker)) {
+ tp->snd_cwnd = tp->snd_ssthresh;
+ tp->snd_cwnd_stamp = tcp_time_stamp;
+ }
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 3fdcdc730f71..850d1b5bfd81 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -3256,6 +3256,9 @@ int tcp_connect(struct sock *sk)
+ struct sk_buff *buff;
+ int err;
+
++ if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
++ return -EHOSTUNREACH; /* Routing failure or similar. */
++
+ tcp_connect_init(sk);
+
+ if (unlikely(tp->repair)) {
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index ebb34d0c5e80..1ec12a4f327e 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -606,7 +606,8 @@ static void tcp_keepalive_timer (unsigned long data)
+ goto death;
+ }
+
+- if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE)
++ if (!sock_flag(sk, SOCK_KEEPOPEN) ||
++ ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)))
+ goto out;
+
+ elapsed = keepalive_time_when(tp);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index e9513e397c4f..301e60829c7e 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -819,7 +819,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4)
+ if (is_udplite) /* UDP-Lite */
+ csum = udplite_csum(skb);
+
+- else if (sk->sk_no_check_tx) { /* UDP csum disabled */
++ else if (sk->sk_no_check_tx && !skb_is_gso(skb)) { /* UDP csum off */
+
+ skb->ip_summed = CHECKSUM_NONE;
+ goto send;
+diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
+index 6396f1c80ae9..6dfc3daf7c21 100644
+--- a/net/ipv4/udp_offload.c
++++ b/net/ipv4/udp_offload.c
+@@ -231,7 +231,7 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
+ if (uh->check == 0)
+ uh->check = CSUM_MANGLED_0;
+
+- skb->ip_summed = CHECKSUM_NONE;
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+ /* Fragment the skb. IP headers of the fragments are updated in
+ * inet_gso_segment()
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 0de3245ea42f..e22339fad10b 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1357,11 +1357,12 @@ emsgsize:
+ */
+
+ cork->length += length;
+- if ((((length + (skb ? skb->len : headersize)) > mtu) ||
+- (skb && skb_is_gso(skb))) &&
++ if ((skb && skb_is_gso(skb)) ||
++ (((length + (skb ? skb->len : headersize)) > mtu) &&
++ (skb_queue_len(queue) <= 1) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+ (rt->dst.dev->features & NETIF_F_UFO) &&
+- (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
++ (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
+ err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
+ hh_len, fragheaderlen, exthdrlen,
+ transhdrlen, mtu, flags, fl6);
+diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
+index 01582966ffa0..2e3c12eeca07 100644
+--- a/net/ipv6/udp_offload.c
++++ b/net/ipv6/udp_offload.c
+@@ -86,7 +86,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
+ if (uh->check == 0)
+ uh->check = CSUM_MANGLED_0;
+
+- skb->ip_summed = CHECKSUM_NONE;
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+ /* Check if there is enough headroom to insert fragment header. */
+ tnl_hlen = skb_tnl_header_len(skb);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 061771ca2582..148ec130d99d 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3622,14 +3622,19 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+
+ if (optlen != sizeof(val))
+ return -EINVAL;
+- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+- return -EBUSY;
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+ if (val > INT_MAX)
+ return -EINVAL;
+- po->tp_reserve = val;
+- return 0;
++ lock_sock(sk);
++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++ ret = -EBUSY;
++ } else {
++ po->tp_reserve = val;
++ ret = 0;
++ }
++ release_sock(sk);
++ return ret;
+ }
+ case PACKET_LOSS:
+ {
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index d05869646515..0915d448ba23 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -42,8 +42,8 @@ static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int
+ return PTR_ERR(target);
+
+ t->u.kernel.target = target;
++ memset(&par, 0, sizeof(par));
+ par.table = table;
+- par.entryinfo = NULL;
+ par.target = target;
+ par.targinfo = t->data;
+ par.hook_mask = hook;
diff --git a/patches.suse/mm-mprotect.c-don-t-touch-single-threaded-PTEs-which-are-on-the-right-node.patch b/patches.suse/mm-mprotect.c-don-t-touch-single-threaded-PTEs-which-are-on-the-right-node.patch
index 1ec8663f9f..96ea441f5f 100644
--- a/patches.suse/mm-mprotect.c-don-t-touch-single-threaded-PTEs-which-are-on-the-right-node.patch
+++ b/patches.suse/mm-mprotect.c-don-t-touch-single-threaded-PTEs-which-are-on-the-right-node.patch
@@ -32,14 +32,12 @@ Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Mel Gorman <mgorman@suse.de>
---
- mm/mprotect.c | 13 +++++++++++++
+ mm/mprotect.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
-diff --git a/mm/mprotect.c b/mm/mprotect.c
-index 29321f418d46..8eeb8f2d3845 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
-@@ -67,11 +67,17 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
+@@ -67,11 +67,17 @@ static unsigned long change_pte_range(st
pte_t *pte, oldpte;
spinlock_t *ptl;
unsigned long pages = 0;
@@ -54,10 +52,10 @@ index 29321f418d46..8eeb8f2d3845 100644
+ atomic_read(&vma->vm_mm->mm_users) == 1)
+ target_node = numa_node_id();
+
+ flush_tlb_batched_pending(vma->vm_mm);
arch_enter_lazy_mmu_mode();
do {
- oldpte = *pte;
-@@ -93,6 +99,13 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
+@@ -94,6 +100,13 @@ static unsigned long change_pte_range(st
/* Avoid TLB flush if possible */
if (pte_protnone(oldpte))
continue;
diff --git a/patches.suse/mm-printk-introduce-new-format-string-for-flags.patch b/patches.suse/mm-printk-introduce-new-format-string-for-flags.patch
index c15e675a4e..9e05b17b90 100644
--- a/patches.suse/mm-printk-introduce-new-format-string-for-flags.patch
+++ b/patches.suse/mm-printk-introduce-new-format-string-for-flags.patch
@@ -340,9 +340,9 @@ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
/*
* The set of flags that only affect watermark checking and reclaim
-@@ -473,4 +474,9 @@ static inline void try_to_unmap_flush_di
+@@ -479,4 +480,9 @@ static inline void flush_tlb_batched_pen
+ {
}
-
#endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */
+
+extern const struct trace_print_flags pageflag_names[];
diff --git a/patches.suse/sched-cputime-Fix-prev-steal-time-accouting-during-CPU-hotplug.patch b/patches.suse/sched-cputime-Fix-prev-steal-time-accouting-during-CPU-hotplug.patch
deleted file mode 100644
index 4e22699198..0000000000
--- a/patches.suse/sched-cputime-Fix-prev-steal-time-accouting-during-CPU-hotplug.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From: Wanpeng Li <wanpeng.li@hotmail.com>
-Date: Mon, 13 Jun 2016 18:32:45 +0800
-Subject: sched/cputime: Fix prev steal time accouting during CPU hotplug
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-Git-commit: 3d89e5478bf550a50c99e93adf659369798263b0
-Patch-mainline: v4.8-rc1
-References: bnc#1022476
-
-Commit:
-
- e9532e69b8d1 ("sched/cputime: Fix steal time accounting vs. CPU hotplug")
-
-... set rq->prev_* to 0 after a CPU hotplug comes back, in order to
-fix the case where (after CPU hotplug) steal time is smaller than
-rq->prev_steal_time.
-
-However, this should never happen. Steal time was only smaller because of the
-KVM-specific bug fixed by the previous patch. Worse, the previous patch
-triggers a bug on CPU hot-unplug/plug operation: because
-rq->prev_steal_time is cleared, all of the CPU's past steal time will be
-accounted again on hot-plug.
-
-Since the root cause has been fixed, we can just revert commit e9532e69b8d1.
-
-Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
-Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Cc: Frederic Weisbecker <fweisbec@gmail.com>
-Cc: Linus Torvalds <torvalds@linux-foundation.org>
-Cc: Mike Galbraith <efault@gmx.de>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Radim Krčmář <rkrcmar@redhat.com>
-Cc: Rik van Riel <riel@redhat.com>
-Cc: Thomas Gleixner <tglx@linutronix.de>
-Fixes: 'commit e9532e69b8d1 ("sched/cputime: Fix steal time accounting vs. CPU hotplug")'
-Link: http://lkml.kernel.org/r/1465813966-3116-3-git-send-email-wanpeng.li@hotmail.com
-Signed-off-by: Ingo Molnar <mingo@kernel.org>
-Signed-off-by: Mike Galbraith <mgalbraith@suse.de>
----
- kernel/sched/core.c | 1 -
- kernel/sched/sched.h | 13 -------------
- 2 files changed, 14 deletions(-)
-
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -5809,7 +5809,6 @@ migration_call(struct notifier_block *nf
-
- case CPU_UP_PREPARE:
- rq->calc_load_update = calc_load_update;
-- account_reset_rq(rq);
- break;
-
- case CPU_ONLINE:
---- a/kernel/sched/sched.h
-+++ b/kernel/sched/sched.h
-@@ -1712,16 +1712,3 @@ static inline u64 irq_time_read(int cpu)
- }
- #endif /* CONFIG_64BIT */
- #endif /* CONFIG_IRQ_TIME_ACCOUNTING */
--
--static inline void account_reset_rq(struct rq *rq)
--{
--#ifdef CONFIG_IRQ_TIME_ACCOUNTING
-- rq->prev_irq_time = 0;
--#endif
--#ifdef CONFIG_PARAVIRT
-- rq->prev_steal_time = 0;
--#endif
--#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING
-- rq->prev_steal_time_rq = 0;
--#endif
--}
diff --git a/patches.suse/workqueue-skip-flush-dependency-checks-for-legacy-workqueues.patch b/patches.suse/workqueue-skip-flush-dependency-checks-for-legacy-workqueues.patch
index 31cb3ab7b6..0356c31ae7 100644
--- a/patches.suse/workqueue-skip-flush-dependency-checks-for-legacy-workqueues.patch
+++ b/patches.suse/workqueue-skip-flush-dependency-checks-for-legacy-workqueues.patch
@@ -3,7 +3,7 @@ Date: Fri, 29 Jan 2016 05:59:46 -0500
Subject: workqueue: skip flush dependency checks for legacy workqueues
Git-commit: 23d11a58a9a60dcb52c8fc6494efce908b24c295
Patch-mainline: v4.5-rc5
-References:
+References: js has no idea
fca839c00a12 ("workqueue: warn if memory reclaim tries to flush
!WQ_MEM_RECLAIM workqueue") implemented flush dependency warning which
@@ -68,16 +68,16 @@ Signed-off-by: Mike Galbraith <mgalbraith@suse.de>
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
-@@ -311,6 +311,7 @@ enum {
-
+@@ -312,6 +312,7 @@ enum {
__WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */
__WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */
+ __WQ_ORDERED_EXPLICIT = 1 << 18, /* internal: alloc_ordered_workqueue() */
+ __WQ_LEGACY = 1 << 18, /* internal: create*_workqueue() */
WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */
WQ_MAX_UNBOUND_PER_CPU = 4, /* 4 * #cpus for unbound wq */
-@@ -411,12 +412,12 @@ __alloc_workqueue_key(const char *fmt, u
- alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | (flags), 1, ##args)
+@@ -413,12 +414,12 @@ __alloc_workqueue_key(const char *fmt, u
+ __WQ_ORDERED_EXPLICIT | (flags), 1, ##args)
#define create_workqueue(name) \
- alloc_workqueue("%s", WQ_MEM_RECLAIM, 1, (name))
@@ -95,7 +95,7 @@ Signed-off-by: Mike Galbraith <mgalbraith@suse.de>
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
-@@ -2364,7 +2364,8 @@ static void check_flush_dependency(struc
+@@ -2403,7 +2403,8 @@ static void check_flush_dependency(struc
WARN_ONCE(current->flags & PF_MEMALLOC,
"workqueue: PF_MEMALLOC task %d(%s) is flushing !WQ_MEM_RECLAIM %s:%pf",
current->pid, current->comm, target_wq->name, target_func);
diff --git a/series.conf b/series.conf
index fc182902de..b46ee782d0 100644
--- a/series.conf
+++ b/series.conf
@@ -106,6 +106,9 @@
patches.kernel.org/patch-4.4.76-77
patches.kernel.org/patch-4.4.77-78
patches.kernel.org/patch-4.4.78-79
+ patches.kernel.org/patch-4.4.79-80
+ patches.kernel.org/patch-4.4.80-81
+ patches.kernel.org/patch-4.4.81-82
########################################################
# Build fixes that apply to the vanilla kernel too.
@@ -134,6 +137,10 @@
patches.kabi/0002-Revert-Add-shutdown-to-struct-class.patch
patches.kabi/revert-mm-list_lru.c-fix-list_lru_count_node-to-be-r.patch
patches.kabi/kabi-protect-struct-iscsi_tpg_attrib.patch
+ patches.kabi/kabi-protect-struct-mm_struct.patch
+ patches.kabi/revert-proc-iomem-only-expose-physical-resource-addr.patch
+ patches.kabi/revert-Make-file-credentials-available-to-the-seqfil.patch
+ patches.kabi/kabi-protect-struct-se_lun.patch
########################################################
#
@@ -529,7 +536,6 @@
patches.suse/sched-rt-sched-dl-Don-t-push-if-task-s-scheduling-class-was-changed.patch
patches.suse/sched-deadline-Fix-a-bug-in-dl_overflow.patch
patches.suse/sched-fair-Fix-the-wrong-throttled-clock-time-for-cfs_rq_clock_task.patch
- patches.suse/sched-cputime-Fix-prev-steal-time-accouting-during-CPU-hotplug.patch
patches.suse/sched-cputime-Add-steal-time-support-to-full-dynticks-CPU-time-accounting.patch
patches.suse/sched-deadline-Fix-wrap-around-in-DL-heap.patch
patches.suse/sched-deadline-Fix-lock-pinning-warning-during-CPU-hotplug.patch
@@ -1125,8 +1131,6 @@
patches.arch/powerpc-bigmem-21-mm-Use-task_size-for-boundary-checking.patch
patches.arch/powerpc-bigmem-22-mmap-Any-hint-128TB-searches-the-full-VA-space.patch
- patches.fixes/Revert-powerpc-numa-Fix-percpu-allocations-to-be-NUM
-
########################################################
# powerpc/little endian
########################################################
@@ -2998,6 +3002,8 @@
# bsc#1051478
patches.fixes/acpi-processor-avoid-reserving-io-regions-too-early
+ patches.fixes/ACPI-scan-Prefer-devices-without-_HID-for-_ADR-match.patch
+
########################################################
# CPUFREQ
########################################################
@@ -3495,14 +3501,7 @@
patches.fixes/net-ipv6-set-route-type-for-anycast-routes.patch
patches.fixes/l2tp-fix-race-in-l2tp_recv_common.patch
patches.fixes/bonding-avoid-defaulting-hard_header_len-to-ETH_HLEN.patch
- patches.fixes/ipv4-Should-use-consistent-conditional-judgement-for.patch
- patches.fixes/ipv6-Should-use-consistent-conditional-judgement-for.patch
- patches.fixes/net-account-for-current-skb-length-when-deciding-abo.patch
patches.fixes/af_key-fix-slab-out-of-bounds-in-pfkey_compile_policy.patch
- patches.fixes/af_key-add-lock-to-key-dump.patch
- patches.fixes/ipv6-avoid-overflow-of-offset-in-ip6_find_1stfragopt.patch
- patches.fixes/udp-consistently-apply-ufo-or-fragmentation.patch
- patches.fixes/net-packet-fix-race-in-packet_set_ring-on-PACKET_RES.patch
########################################################
# Netfilter
@@ -4173,7 +4172,6 @@
patches.fixes/xfs-don-t-warn-on-buffers-not-being-recovered-due-to.patch
patches.fixes/xfs-update-metadata-LSN-in-buffers-during-log-recove.patch
patches.fixes/xfs-log-recovery-tracepoints-to-track-current-lsn-an.patch
- patches.fixes/xfs-don-t-bug-on-mixed-direct-and-mapped-i-o.patch
# bsc#1036215
patches.fixes/0001-xfs-detect-and-handle-invalid-iclog-size-set-by-mkfs.patch
@@ -4257,7 +4255,6 @@
patches.suse/squashfs3-properly-handle-dir_emit-failures.patch
patches.fixes/f2fs-fix-bad-prefetchw-of-NULL-page.patch
patches.fixes/0002-fs-fcntl-f_setown-avoid-undefined-behaviour.patch
- patches.fixes/dentry-name-snapshots.patch
patches.fixes/udf-Fix-races-with-i_size-changes-during-readpage.patch
patches.fixes/0001-fuse-initialize-the-flock-flag-in-fuse_file-on-alloc.patch
@@ -5112,7 +5109,6 @@
patches.drivers/0070-qla2xxx-Add-multiple-queue-pair-functionality.patch
patches.drivers/0071-qla2xxx-Add-Block-Multi-Queue-functionality.patch
patches.drivers/0072-qla2xxx-Fix-Target-mode-handling-with-Multiqueu.patch
- patches.drivers/0073-qla2xxx-Get-mutex-lock-before-checking-optrom_s.patch
patches.drivers/0074-qla2xxx-silence-Wformat-security-warning.patch
patches.drivers/0075-qla2xxx-make-msix_entries-const.patch
patches.drivers/0076-qla2xxx-Fix-apparent-cut-n-paste-error.patch
@@ -5215,8 +5211,6 @@
patches.drivers/mpt3sas-Ensure-the-connector_name-string-is-NUL-term.patch
patches.drivers/mpt3sas-remove-unused-fw_event_work-elements.patch
patches.drivers/mpt3sas-fix-panic-when-aer-correct-error-occurred.patch
- # mpt3sas backport (bsc#1017972, FATE#321666)
- patches.drivers/mpt3sas-Don-t-overreach-ioc-reply_post-during-initia.patch
patches.drivers/mpt3sas-Remove-usage-of-struct-timeval.patch
patches.drivers/mpt3sas-Update-MPI-header-to-2.00.42.patch
patches.drivers/mpt3sas-Handle-active-cable-exception-event.patch
@@ -5323,7 +5317,6 @@
patches.drivers/0003-Using-rport--dd_data-to-check-rport-online-instead-of-rport_lookup..patch
patches.drivers/0004-scsi-fnic-use-kernel-s-pM-format-option-to-print-MAC.patch
patches.drivers/0005-scsi-fnic-Correcting-rport-check-location-in-fnic_qu.patch
- patches.drivers/0006-scsi-fnic-Avoid-sending-reset-to-firmware-when-anoth.patch
patches.drivers/0007-scsi-fnic-Ratelimit-printks-to-avoid-flooding-when-v.patch
patches.drivers/0008-scsi-fnic-minor-cleanup-in-fnic_fcpio_itmf_cmpl_hand.patch
patches.drivers/0009-scsi-fnic-Fix-for-Number-of-Active-IOs-in-fnicstats-.patch
@@ -5344,7 +5337,6 @@
patches.drivers/0008-snic-correctly-check-for-array-overrun-on-overly-long-version-number.patch
patches.drivers/0009-snic-fix-typo.patch
patches.drivers/0010-snic-Fix-use-after-free-in-case-of-a-dma-mapping-err.patch
- patches.drivers/0011-snic-Return-error-code-on-memory-allocation-fai.patch
# hisi_sas backport
patches.drivers/hisi_sas-0001-Add-initial-bare-main-driver.patch
@@ -6660,7 +6652,6 @@
patches.drivers/media-dvb-usb-avoid-link-error-with-dib3000m-b-c
patches.drivers/media-DaVinci-VPFE-Capture-fix-error-handling
patches.drivers/media-am437x-vpfe-fix-an-uninitialized-variable-bug
- patches.fixes/media-saa7164-fix-double-fetch-PCIe-access-condition
########################################################
# Networking
@@ -10845,7 +10836,6 @@
patches.drivers/net-mlx5e-Don-t-sync-netdev-state-when-not-registere.patch
patches.drivers/net-mlx5e-Disable-netdev-after-close.patch
patches.drivers/net-mlx4_core-Use-after-free-causes-a-resource-leak-.patch
- patches.drivers/net-mlx4-Remove-BUG_ON-from-ICM-allocation-routine.patch
patches.drivers/net-mlx4_en-Fix-type-mismatch-for-32-bit-systems.patch
patches.drivers/net-mlx4_core-Fix-raw-qp-flow-steering-rules-under-S.patch
patches.drivers/benet-stricter-vxlan-offloading-check-in-be_features.patch
@@ -10853,7 +10843,6 @@
patches.drivers/amd-xgbe-0032-amd-xgbe-Fix-IRQ-processing-when-running-in-single-I.patch
patches.drivers/be2net-fix-accesses-to-unicast-list.patch
patches.drivers/be2net-fix-unicast-list-filling.patch
- patches.drivers/tg3-Fix-race-condition-in-tg3_get_stats64.patch
patches.drivers/net-mlx5e-Set-inline-mode-requirements-for-matching-.patch
patches.drivers/net-mlx5e-Properly-handle-FW-errors-while-adding-TC-.patch
patches.drivers/net-mlx5e-Un-register-uplink-representor-on-nic_disa.patch
@@ -11192,7 +11181,6 @@
patches.drivers/amd-xgbe-0038-amd-xgbe-Don-t-overwrite-SFP-PHY-mod_absent-settings.patch
patches.drivers/bonding-use-ETH_MAX_MTU-as-max-mtu.patch
patches.drivers/sfc-fix-IPID-endianness-in-TSOv2.patch
- patches.fixes/net-phy-Do-not-perform-software-reset-for-Generic-PH.patch
patches.drivers/net-mlx5e-add-IPV6-dependency.patch
patches.drivers/ibmvnic-30-Fix-overflowing-firmware-hardware-TX-queue.patch
patches.drivers/ibmvnic-31-Allocate-number-of-rx-tx-buffers-agreed-on-b.patch
@@ -11846,7 +11834,6 @@
patches.drivers/target-remove-sess_kref-and-shutdown_session.patch
patches.drivers/target-need_to_release-is-always-false-remove-redund.patch
patches.drivers/iscsi-target-graceful-disconnect-on-invalid-mapping-.patch
- patches.drivers/iscsi-target-Fix-early-sk_data_ready-LOGIN_FLAGS_REA.patch
patches.drivers/target-fix-spelling-mistake-limitiation-limitation.patch
patches.drivers/target-user-Use-sense_reason_t-in-tcmu_queue_cmd_rin.patch
patches.drivers/target-user-Return-an-error-if-cmd-data-size-is-too-.patch
@@ -12183,8 +12170,6 @@
patches.drivers/0001-media-usbvision-revert-commit-588afcc1.patch
patches.suse/0001-usb-quirk-to-stop-runtime-PM-for-Intel-7260.patch
patches.drivers/0001-usb-devio-do-not-warn-when-allocation-fails.patch
- patches.drivers/0001-kaweth-fix-firmware-download.patch
- patches.drivers/0002-kaweth-fix-oops-upon-failed-memory-allocation.patch
patches.drivers/0001-scsi-introduce-a-quirk-for-false-cache-reporting.patch
patches.drivers/0001-cdc-acm-added-sanity-checking-for-probe.patch
patches.drivers/0001-PCI-Fix-BUG-on-device-attach-failure.patch
@@ -15680,7 +15665,6 @@
patches.drivers/tpm-035-Get-rid-of-devname.patch
patches.drivers/tpm-037-Get-rid-of-module-locking.patch
patches.drivers/tpm-038-Split-out-the-devm-stuff-from-tpmm_chip_alloc.patch
- patches.drivers/tpm-039-Replace-device-number-bitmap-with-IDR.patch
patches.drivers/tpm-040-fix-tpm_bios_log_setup-stub-prototype.patch
patches.drivers/tpm-041-cleanup-tpm_tis_remove.patch
patches.drivers/tpm-042-fix-crash-in-tpm_tis-deinitialization.patch
@@ -16776,7 +16760,6 @@
patches.arch/0019-i2c-xlp9xx-add-support-for-Broadcom-Vulcan.patch
patches.arch/0020-PCI-quirk-fixup-for-cavium-invalid-sriov-link-value.patch
patches.arch/0021-PCI-Fix-cavium-quirk-compile-failure-with-PCI_ATS-of.patch
- patches.arch/0022-mm-don-t-dereference-struct-page-fields-of-invalid-p.patch
patches.arch/0023-arm64-barriers-introduce-nops-and-__nops-macros-for-.patch
patches.arch/0024-arm64-mm-enable-CONFIG_HOLES_IN_ZONE-for-NUMA.patch
patches.arch/0025-arm64-Enable-workaround-for-Cavium-erratum-27456-on-.patch