commit: b00da6f810d31f1fb924713c20c3f3b103f03228 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Tue Oct 27 13:36:07 2015 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Tue Oct 27 13:36:07 2015 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b00da6f8
Linux patch 4.2.5 0000_README | 4 + 1004_linux-4.2.5.patch | 1945 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1949 insertions(+) diff --git a/0000_README b/0000_README index daafdd3..d40ecf2 100644 --- a/0000_README +++ b/0000_README @@ -59,6 +59,10 @@ Patch: 1003_linux-4.2.4.patch From: http://www.kernel.org Desc: Linux 4.2.4 +Patch: 1004_linux-4.2.5.patch +From: http://www.kernel.org +Desc: Linux 4.2.5 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1004_linux-4.2.5.patch b/1004_linux-4.2.5.patch new file mode 100644 index 0000000..b866faf --- /dev/null +++ b/1004_linux-4.2.5.patch @@ -0,0 +1,1945 @@ +diff --git a/Makefile b/Makefile +index a952801a6cd5..96076dcad18e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 2 +-SUBLEVEL = 4 ++SUBLEVEL = 5 + EXTRAVERSION = + NAME = Hurr durr I'ma sheep + +diff --git a/arch/arm/mach-ux500/Makefile b/arch/arm/mach-ux500/Makefile +index 4418a5078833..c8643ac5db71 100644 +--- a/arch/arm/mach-ux500/Makefile ++++ b/arch/arm/mach-ux500/Makefile +@@ -7,7 +7,7 @@ obj-$(CONFIG_CACHE_L2X0) += cache-l2x0.o + obj-$(CONFIG_UX500_SOC_DB8500) += cpu-db8500.o + obj-$(CONFIG_MACH_MOP500) += board-mop500-regulators.o \ + board-mop500-audio.o +-obj-$(CONFIG_SMP) += platsmp.o headsmp.o ++obj-$(CONFIG_SMP) += platsmp.o + obj-$(CONFIG_HOTPLUG_CPU) += hotplug.o + obj-$(CONFIG_PM_GENERIC_DOMAINS) += pm_domains.o + +diff --git a/arch/arm/mach-ux500/cpu-db8500.c b/arch/arm/mach-ux500/cpu-db8500.c +index 16913800bbf9..ba708ce08616 100644 +--- a/arch/arm/mach-ux500/cpu-db8500.c ++++ b/arch/arm/mach-ux500/cpu-db8500.c +@@ -154,7 +154,6 @@ static const char * stericsson_dt_platform_compat[] = { + }; + + DT_MACHINE_START(U8500_DT, "ST-Ericsson Ux5x0 platform (Device Tree Support)") +- .smp = smp_ops(ux500_smp_ops), + .map_io = u8500_map_io, + .init_irq = ux500_init_irq, + /* we re-use nomadik timer here */ +diff --git a/arch/arm/mach-ux500/headsmp.S b/arch/arm/mach-ux500/headsmp.S +deleted file mode 100644 +index 9cdea049485d..000000000000 +--- a/arch/arm/mach-ux500/headsmp.S ++++ /dev/null +@@ -1,37 +0,0 @@ +-/* +- * Copyright (c) 2009 ST-Ericsson +- * This file is based ARM Realview platform +- * Copyright (c) 2003 ARM Limited +- * All Rights Reserved +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License version 2 as +- * published by the Free Software Foundation. +- */ +-#include <linux/linkage.h> +-#include <linux/init.h> +- +-/* +- * U8500 specific entry point for secondary CPUs. +- */ +-ENTRY(u8500_secondary_startup) +- mrc p15, 0, r0, c0, c0, 5 +- and r0, r0, #15 +- adr r4, 1f +- ldmia r4, {r5, r6} +- sub r4, r4, r5 +- add r6, r6, r4 +-pen: ldr r7, [r6] +- cmp r7, r0 +- bne pen +- +- /* +- * we've been released from the holding pen: secondary_stack +- * should now contain the SVC stack for this core +- */ +- b secondary_startup +-ENDPROC(u8500_secondary_startup) +- +- .align 2 +-1: .long . +- .long pen_release +diff --git a/arch/arm/mach-ux500/platsmp.c b/arch/arm/mach-ux500/platsmp.c +index 62b1de922bd8..70766b963758 100644 +--- a/arch/arm/mach-ux500/platsmp.c ++++ b/arch/arm/mach-ux500/platsmp.c +@@ -28,135 +28,81 @@ + #include "db8500-regs.h" + #include "id.h" + +-static void __iomem *scu_base; +-static void __iomem *backupram; +- +-/* This is called from headsmp.S to wakeup the secondary core */ +-extern void u8500_secondary_startup(void); +- +-/* +- * Write pen_release in a way that is guaranteed to be visible to all +- * observers, irrespective of whether they're taking part in coherency +- * or not. This is necessary for the hotplug code to work reliably. +- */ +-static void write_pen_release(int val) +-{ +- pen_release = val; +- smp_wmb(); +- sync_cache_w(&pen_release); +-} +- +-static DEFINE_SPINLOCK(boot_lock); +- +-static void ux500_secondary_init(unsigned int cpu) +-{ +- /* +- * let the primary processor know we're out of the +- * pen, then head off into the C entry point +- */ +- write_pen_release(-1); +- +- /* +- * Synchronise with the boot thread. +- */ +- spin_lock(&boot_lock); +- spin_unlock(&boot_lock); +-} ++/* Magic triggers in backup RAM */ ++#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4 ++#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0 + +-static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle) ++static void wakeup_secondary(void) + { +- unsigned long timeout; +- +- /* +- * set synchronisation state between this boot processor +- * and the secondary one +- */ +- spin_lock(&boot_lock); +- +- /* +- * The secondary processor is waiting to be released from +- * the holding pen - release it, then wait for it to flag +- * that it has been released by resetting pen_release. +- */ +- write_pen_release(cpu_logical_map(cpu)); +- +- arch_send_wakeup_ipi_mask(cpumask_of(cpu)); ++ struct device_node *np; ++ static void __iomem *backupram; + +- timeout = jiffies + (1 * HZ); +- while (time_before(jiffies, timeout)) { +- if (pen_release == -1) +- break; ++ np = of_find_compatible_node(NULL, NULL, "ste,dbx500-backupram"); ++ if (!np) { ++ pr_err("No backupram base address\n"); ++ return; ++ } ++ backupram = of_iomap(np, 0); ++ of_node_put(np); ++ if (!backupram) { ++ pr_err("No backupram remap\n"); ++ return; + } + + /* +- * now the secondary core is starting up let it run its +- * calibrations, then wait for it to finish +- */ +- spin_unlock(&boot_lock); +- +- return pen_release != -1 ? -ENOSYS : 0; +-} +- +-static void __init wakeup_secondary(void) +-{ +- /* + * write the address of secondary startup into the backup ram register + * at offset 0x1FF4, then write the magic number 0xA1FEED01 to the + * backup ram register at offset 0x1FF0, which is what boot rom code +- * is waiting for. This would wake up the secondary core from WFE ++ * is waiting for. This will wake up the secondary core from WFE. + */ +-#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4 +- __raw_writel(virt_to_phys(u8500_secondary_startup), +- backupram + UX500_CPU1_JUMPADDR_OFFSET); +- +-#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0 +- __raw_writel(0xA1FEED01, +- backupram + UX500_CPU1_WAKEMAGIC_OFFSET); ++ writel(virt_to_phys(secondary_startup), ++ backupram + UX500_CPU1_JUMPADDR_OFFSET); ++ writel(0xA1FEED01, ++ backupram + UX500_CPU1_WAKEMAGIC_OFFSET); + + /* make sure write buffer is drained */ + mb(); ++ iounmap(backupram); + } + +-/* +- * Initialise the CPU possible map early - this describes the CPUs +- * which may be present or become present in the system. +- */ +-static void __init ux500_smp_init_cpus(void) ++static void __init ux500_smp_prepare_cpus(unsigned int max_cpus) + { +- unsigned int i, ncores; + struct device_node *np; ++ static void __iomem *scu_base; ++ unsigned int ncores; ++ int i; + + np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-scu"); ++ if (!np) { ++ pr_err("No SCU base address\n"); ++ return; ++ } + scu_base = of_iomap(np, 0); + of_node_put(np); +- if (!scu_base) ++ if (!scu_base) { ++ pr_err("No SCU remap\n"); + return; +- backupram = ioremap(U8500_BACKUPRAM0_BASE, SZ_8K); +- ncores = scu_get_core_count(scu_base); +- +- /* sanity check */ +- if (ncores > nr_cpu_ids) { +- pr_warn("SMP: %u cores greater than maximum (%u), clipping\n", +- ncores, nr_cpu_ids); +- ncores = nr_cpu_ids; + } + ++ scu_enable(scu_base); ++ ncores = scu_get_core_count(scu_base); + for (i = 0; i < ncores; i++) + set_cpu_possible(i, true); ++ iounmap(scu_base); + } + +-static void __init ux500_smp_prepare_cpus(unsigned int max_cpus) ++static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle) + { +- scu_enable(scu_base); + wakeup_secondary(); ++ arch_send_wakeup_ipi_mask(cpumask_of(cpu)); ++ return 0; + } + + struct smp_operations ux500_smp_ops __initdata = { +- .smp_init_cpus = ux500_smp_init_cpus, + .smp_prepare_cpus = ux500_smp_prepare_cpus, +- .smp_secondary_init = ux500_secondary_init, + .smp_boot_secondary = ux500_boot_secondary, + #ifdef CONFIG_HOTPLUG_CPU + .cpu_die = ux500_cpu_die, + #endif + }; ++CPU_METHOD_OF_DECLARE(ux500_smp, "ste,dbx500-smp", &ux500_smp_ops); +diff --git a/arch/arm/mach-ux500/setup.h b/arch/arm/mach-ux500/setup.h +index 1fb6ad2789f1..65876eac0761 100644 +--- a/arch/arm/mach-ux500/setup.h ++++ b/arch/arm/mach-ux500/setup.h +@@ -26,7 +26,6 @@ extern struct device *ux500_soc_device_init(const char *soc_id); + + extern void ux500_timer_init(void); + +-extern struct smp_operations ux500_smp_ops; + extern void ux500_cpu_die(unsigned int cpu); + + #endif /* __ASM_ARCH_SETUP_H */ +diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile +index 81151663ef38..3258174e6152 100644 +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -31,7 +31,7 @@ endif + CHECKFLAGS += -D__aarch64__ + + ifeq ($(CONFIG_ARM64_ERRATUM_843419), y) +-CFLAGS_MODULE += -mcmodel=large ++KBUILD_CFLAGS_MODULE += -mcmodel=large + endif + + # Default value +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 56283f8a675c..cf7319422768 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -80,7 +80,7 @@ extern void __pgd_error(const char *file, int line, unsigned long val); + #define PAGE_S2 __pgprot(PROT_DEFAULT | PTE_S2_MEMATTR(MT_S2_NORMAL) | PTE_S2_RDONLY) + #define PAGE_S2_DEVICE __pgprot(PROT_DEFAULT | PTE_S2_MEMATTR(MT_S2_DEVICE_nGnRE) | PTE_S2_RDONLY | PTE_UXN) + +-#define PAGE_NONE __pgprot(((_PAGE_DEFAULT) & ~PTE_TYPE_MASK) | PTE_PROT_NONE | PTE_PXN | PTE_UXN) ++#define PAGE_NONE __pgprot(((_PAGE_DEFAULT) & ~PTE_VALID) | PTE_PROT_NONE | PTE_PXN | PTE_UXN) + #define PAGE_SHARED __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_WRITE) + #define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_WRITE) + #define PAGE_COPY __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN) +@@ -460,7 +460,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long addr) + static inline pte_t pte_modify(pte_t pte, pgprot_t newprot) + { + const pteval_t mask = PTE_USER | PTE_PXN | PTE_UXN | PTE_RDONLY | +- PTE_PROT_NONE | PTE_WRITE | PTE_TYPE_MASK; ++ PTE_PROT_NONE | PTE_VALID | PTE_WRITE; + pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask); + return pte; + } +diff --git a/arch/sparc/crypto/aes_glue.c b/arch/sparc/crypto/aes_glue.c +index 2e48eb8813ff..c90930de76ba 100644 +--- a/arch/sparc/crypto/aes_glue.c ++++ b/arch/sparc/crypto/aes_glue.c +@@ -433,6 +433,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, ++ .ivsize = AES_BLOCK_SIZE, + .setkey = aes_set_key, + .encrypt = cbc_encrypt, + .decrypt = cbc_decrypt, +@@ -452,6 +453,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, ++ .ivsize = AES_BLOCK_SIZE, + .setkey = aes_set_key, + .encrypt = ctr_crypt, + .decrypt = ctr_crypt, +diff --git a/arch/sparc/crypto/camellia_glue.c b/arch/sparc/crypto/camellia_glue.c +index 6bf2479a12fb..561a84d93cf6 100644 +--- a/arch/sparc/crypto/camellia_glue.c ++++ b/arch/sparc/crypto/camellia_glue.c +@@ -274,6 +274,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = CAMELLIA_MIN_KEY_SIZE, + .max_keysize = CAMELLIA_MAX_KEY_SIZE, ++ .ivsize = CAMELLIA_BLOCK_SIZE, + .setkey = camellia_set_key, + .encrypt = cbc_encrypt, + .decrypt = cbc_decrypt, +diff --git a/arch/sparc/crypto/des_glue.c b/arch/sparc/crypto/des_glue.c +index dd6a34fa6e19..61af794aa2d3 100644 +--- a/arch/sparc/crypto/des_glue.c ++++ b/arch/sparc/crypto/des_glue.c +@@ -429,6 +429,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = DES_KEY_SIZE, + .max_keysize = DES_KEY_SIZE, ++ .ivsize = DES_BLOCK_SIZE, + .setkey = des_set_key, + .encrypt = cbc_encrypt, + .decrypt = cbc_decrypt, +@@ -485,6 +486,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = DES3_EDE_KEY_SIZE, + .max_keysize = DES3_EDE_KEY_SIZE, ++ .ivsize = DES3_EDE_BLOCK_SIZE, + .setkey = des3_ede_set_key, + .encrypt = cbc3_encrypt, + .decrypt = cbc3_decrypt, +diff --git a/arch/x86/crypto/camellia_aesni_avx_glue.c b/arch/x86/crypto/camellia_aesni_avx_glue.c +index 80a0e4389c9a..bacaa13acac5 100644 +--- a/arch/x86/crypto/camellia_aesni_avx_glue.c ++++ b/arch/x86/crypto/camellia_aesni_avx_glue.c +@@ -554,6 +554,11 @@ static int __init camellia_aesni_init(void) + { + const char *feature_name; + ++ if (!cpu_has_avx || !cpu_has_aes || !cpu_has_osxsave) { ++ pr_info("AVX or AES-NI instructions are not detected.\n"); ++ return -ENODEV; ++ } ++ + if (!cpu_has_xfeatures(XSTATE_SSE | XSTATE_YMM, &feature_name)) { + pr_info("CPU feature '%s' is not supported.\n", feature_name); + return -ENODEV; +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index e7a4fde5d631..2392541a96e6 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -2418,7 +2418,7 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase) + u64 val, cr0, cr4; + u32 base3; + u16 selector; +- int i; ++ int i, r; + + for (i = 0; i < 16; i++) + *reg_write(ctxt, i) = GET_SMSTATE(u64, smbase, 0x7ff8 - i * 8); +@@ -2460,13 +2460,17 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase) + dt.address = GET_SMSTATE(u64, smbase, 0x7e68); + ctxt->ops->set_gdt(ctxt, &dt); + ++ r = rsm_enter_protected_mode(ctxt, cr0, cr4); ++ if (r != X86EMUL_CONTINUE) ++ return r; ++ + for (i = 0; i < 6; i++) { +- int r = rsm_load_seg_64(ctxt, smbase, i); ++ r = rsm_load_seg_64(ctxt, smbase, i); + if (r != X86EMUL_CONTINUE) + return r; + } + +- return rsm_enter_protected_mode(ctxt, cr0, cr4); ++ return X86EMUL_CONTINUE; + } + + static int em_rsm(struct x86_emulate_ctxt *ctxt) +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 32c6e6ac5964..373328b71599 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6706,6 +6706,12 @@ static inline int vcpu_block(struct kvm *kvm, struct kvm_vcpu *vcpu) + return 1; + } + ++static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu) ++{ ++ return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && ++ !vcpu->arch.apf.halted); ++} ++ + static int vcpu_run(struct kvm_vcpu *vcpu) + { + int r; +@@ -6714,8 +6720,7 @@ static int vcpu_run(struct kvm_vcpu *vcpu) + vcpu->srcu_idx = srcu_read_lock(&kvm->srcu); + + for (;;) { +- if (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && +- !vcpu->arch.apf.halted) ++ if (kvm_vcpu_running(vcpu)) + r = vcpu_enter_guest(vcpu); + else + r = vcpu_block(kvm, vcpu); +@@ -8011,19 +8016,36 @@ void kvm_arch_flush_shadow_memslot(struct kvm *kvm, + kvm_mmu_invalidate_zap_all_pages(kvm); + } + ++static inline bool kvm_vcpu_has_events(struct kvm_vcpu *vcpu) ++{ ++ if (!list_empty_careful(&vcpu->async_pf.done)) ++ return true; ++ ++ if (kvm_apic_has_events(vcpu)) ++ return true; ++ ++ if (vcpu->arch.pv.pv_unhalted) ++ return true; ++ ++ if (atomic_read(&vcpu->arch.nmi_queued)) ++ return true; ++ ++ if (test_bit(KVM_REQ_SMI, &vcpu->requests)) ++ return true; ++ ++ if (kvm_arch_interrupt_allowed(vcpu) && ++ kvm_cpu_has_interrupt(vcpu)) ++ return true; ++ ++ return false; ++} ++ + int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) + { + if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events) + kvm_x86_ops->check_nested_events(vcpu, false); + +- return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && +- !vcpu->arch.apf.halted) +- || !list_empty_careful(&vcpu->async_pf.done) +- || kvm_apic_has_events(vcpu) +- || vcpu->arch.pv.pv_unhalted +- || atomic_read(&vcpu->arch.nmi_queued) || +- (kvm_arch_interrupt_allowed(vcpu) && +- kvm_cpu_has_interrupt(vcpu)); ++ return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu); + } + + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) +diff --git a/crypto/ahash.c b/crypto/ahash.c +index 8acb886032ae..9c1dc8d6106a 100644 +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -544,7 +544,8 @@ static int ahash_prepare_alg(struct ahash_alg *alg) + struct crypto_alg *base = &alg->halg.base; + + if (alg->halg.digestsize > PAGE_SIZE / 8 || +- alg->halg.statesize > PAGE_SIZE / 8) ++ alg->halg.statesize > PAGE_SIZE / 8 || ++ alg->halg.statesize == 0) + return -EINVAL; + + base->cra_type = &crypto_ahash_type; +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index bc67a93aa4f4..324bf35ec4dd 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -5201,7 +5201,6 @@ static int rbd_dev_probe_parent(struct rbd_device *rbd_dev) + out_err: + if (parent) { + rbd_dev_unparent(rbd_dev); +- kfree(rbd_dev->header_name); + rbd_dev_destroy(parent); + } else { + rbd_put_client(rbdc); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index b16b9256883e..4c4035fdeb6f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -76,8 +76,6 @@ static void amdgpu_flip_work_func(struct work_struct *__work) + /* We borrow the event spin lock for protecting flip_status */ + spin_lock_irqsave(&crtc->dev->event_lock, flags); + +- /* set the proper interrupt */ +- amdgpu_irq_get(adev, &adev->pageflip_irq, work->crtc_id); + /* do the flip (mmio) */ + adev->mode_info.funcs->page_flip(adev, work->crtc_id, work->base); + /* set the flip status */ +diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c +index 82e8d0730517..a1a35a5df8e7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c +@@ -6185,6 +6185,11 @@ static int ci_dpm_late_init(void *handle) + if (!amdgpu_dpm) + return 0; + ++ /* init the sysfs and debugfs files late */ ++ ret = amdgpu_pm_sysfs_init(adev); ++ if (ret) ++ return ret; ++ + ret = ci_set_temperature_range(adev); + if (ret) + return ret; +@@ -6232,9 +6237,6 @@ static int ci_dpm_sw_init(void *handle) + adev->pm.dpm.current_ps = adev->pm.dpm.requested_ps = adev->pm.dpm.boot_ps; + if (amdgpu_dpm == 1) + amdgpu_pm_print_power_states(adev); +- ret = amdgpu_pm_sysfs_init(adev); +- if (ret) +- goto dpm_failed; + mutex_unlock(&adev->pm.mutex); + DRM_INFO("amdgpu: dpm initialized\n"); + +diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c +index 341c56681841..519fa515c4d8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik.c +@@ -1565,6 +1565,9 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev) + int ret, i; + u16 tmp16; + ++ if (pci_is_root_bus(adev->pdev->bus)) ++ return; ++ + if (amdgpu_pcie_gen2 == 0) + return; + +diff --git a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c +index ace870afc7d4..fd29c18fc14e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c +@@ -596,6 +596,12 @@ static int cz_dpm_late_init(void *handle) + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + + if (amdgpu_dpm) { ++ int ret; ++ /* init the sysfs and debugfs files late */ ++ ret = amdgpu_pm_sysfs_init(adev); ++ if (ret) ++ return ret; ++ + /* powerdown unused blocks for now */ + cz_dpm_powergate_uvd(adev, true); + cz_dpm_powergate_vce(adev, true); +@@ -632,10 +638,6 @@ static int cz_dpm_sw_init(void *handle) + if (amdgpu_dpm == 1) + amdgpu_pm_print_power_states(adev); + +- ret = amdgpu_pm_sysfs_init(adev); +- if (ret) +- goto dpm_init_failed; +- + mutex_unlock(&adev->pm.mutex); + DRM_INFO("amdgpu: dpm initialized\n"); + +diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +index e774a437dd65..ef36467c7e34 100644 +--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c +@@ -233,6 +233,24 @@ static u32 dce_v10_0_vblank_get_counter(struct amdgpu_device *adev, int crtc) + return RREG32(mmCRTC_STATUS_FRAME_COUNT + crtc_offsets[crtc]); + } + ++static void dce_v10_0_pageflip_interrupt_init(struct amdgpu_device *adev) ++{ ++ unsigned i; ++ ++ /* Enable pflip interrupts */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) ++ amdgpu_irq_get(adev, &adev->pageflip_irq, i); ++} ++ ++static void dce_v10_0_pageflip_interrupt_fini(struct amdgpu_device *adev) ++{ ++ unsigned i; ++ ++ /* Disable pflip interrupts */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) ++ amdgpu_irq_put(adev, &adev->pageflip_irq, i); ++} ++ + /** + * dce_v10_0_page_flip - pageflip callback. + * +@@ -2641,9 +2659,10 @@ static void dce_v10_0_crtc_dpms(struct drm_crtc *crtc, int mode) + dce_v10_0_vga_enable(crtc, true); + amdgpu_atombios_crtc_blank(crtc, ATOM_DISABLE); + dce_v10_0_vga_enable(crtc, false); +- /* Make sure VBLANK interrupt is still enabled */ ++ /* Make sure VBLANK and PFLIP interrupts are still enabled */ + type = amdgpu_crtc_idx_to_irq_type(adev, amdgpu_crtc->crtc_id); + amdgpu_irq_update(adev, &adev->crtc_irq, type); ++ amdgpu_irq_update(adev, &adev->pageflip_irq, type); + drm_vblank_post_modeset(dev, amdgpu_crtc->crtc_id); + dce_v10_0_crtc_load_lut(crtc); + break; +@@ -3002,6 +3021,8 @@ static int dce_v10_0_hw_init(void *handle) + dce_v10_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); + } + ++ dce_v10_0_pageflip_interrupt_init(adev); ++ + return 0; + } + +@@ -3016,6 +3037,8 @@ static int dce_v10_0_hw_fini(void *handle) + dce_v10_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); + } + ++ dce_v10_0_pageflip_interrupt_fini(adev); ++ + return 0; + } + +@@ -3027,6 +3050,8 @@ static int dce_v10_0_suspend(void *handle) + + dce_v10_0_hpd_fini(adev); + ++ dce_v10_0_pageflip_interrupt_fini(adev); ++ + return 0; + } + +@@ -3052,6 +3077,8 @@ static int dce_v10_0_resume(void *handle) + /* initialize hpd */ + dce_v10_0_hpd_init(adev); + ++ dce_v10_0_pageflip_interrupt_init(adev); ++ + return 0; + } + +@@ -3346,7 +3373,6 @@ static int dce_v10_0_pageflip_irq(struct amdgpu_device *adev, + spin_unlock_irqrestore(&adev->ddev->event_lock, flags); + + drm_vblank_put(adev->ddev, amdgpu_crtc->crtc_id); +- amdgpu_irq_put(adev, &adev->pageflip_irq, crtc_id); + queue_work(amdgpu_crtc->pflip_queue, &works->unpin_work); + + return 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +index c4a21a7afd68..329bca0f1331 100644 +--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c +@@ -233,6 +233,24 @@ static u32 dce_v11_0_vblank_get_counter(struct amdgpu_device *adev, int crtc) + return RREG32(mmCRTC_STATUS_FRAME_COUNT + crtc_offsets[crtc]); + } + ++static void dce_v11_0_pageflip_interrupt_init(struct amdgpu_device *adev) ++{ ++ unsigned i; ++ ++ /* Enable pflip interrupts */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) ++ amdgpu_irq_get(adev, &adev->pageflip_irq, i); ++} ++ ++static void dce_v11_0_pageflip_interrupt_fini(struct amdgpu_device *adev) ++{ ++ unsigned i; ++ ++ /* Disable pflip interrupts */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) ++ amdgpu_irq_put(adev, &adev->pageflip_irq, i); ++} ++ + /** + * dce_v11_0_page_flip - pageflip callback. + * +@@ -2640,9 +2658,10 @@ static void dce_v11_0_crtc_dpms(struct drm_crtc *crtc, int mode) + dce_v11_0_vga_enable(crtc, true); + amdgpu_atombios_crtc_blank(crtc, ATOM_DISABLE); + dce_v11_0_vga_enable(crtc, false); +- /* Make sure VBLANK interrupt is still enabled */ ++ /* Make sure VBLANK and PFLIP interrupts are still enabled */ + type = amdgpu_crtc_idx_to_irq_type(adev, amdgpu_crtc->crtc_id); + amdgpu_irq_update(adev, &adev->crtc_irq, type); ++ amdgpu_irq_update(adev, &adev->pageflip_irq, type); + drm_vblank_post_modeset(dev, amdgpu_crtc->crtc_id); + dce_v11_0_crtc_load_lut(crtc); + break; +@@ -2888,7 +2907,7 @@ static int dce_v11_0_early_init(void *handle) + + switch (adev->asic_type) { + case CHIP_CARRIZO: +- adev->mode_info.num_crtc = 4; ++ adev->mode_info.num_crtc = 3; + adev->mode_info.num_hpd = 6; + adev->mode_info.num_dig = 9; + break; +@@ -3000,6 +3019,8 @@ static int dce_v11_0_hw_init(void *handle) + dce_v11_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); + } + ++ dce_v11_0_pageflip_interrupt_init(adev); ++ + return 0; + } + +@@ -3014,6 +3035,8 @@ static int dce_v11_0_hw_fini(void *handle) + dce_v11_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); + } + ++ dce_v11_0_pageflip_interrupt_fini(adev); ++ + return 0; + } + +@@ -3025,6 +3048,8 @@ static int dce_v11_0_suspend(void *handle) + + dce_v11_0_hpd_fini(adev); + ++ dce_v11_0_pageflip_interrupt_fini(adev); ++ + return 0; + } + +@@ -3051,6 +3076,8 @@ static int dce_v11_0_resume(void *handle) + /* initialize hpd */ + dce_v11_0_hpd_init(adev); + ++ dce_v11_0_pageflip_interrupt_init(adev); ++ + return 0; + } + +@@ -3345,7 +3372,6 @@ static int dce_v11_0_pageflip_irq(struct amdgpu_device *adev, + spin_unlock_irqrestore(&adev->ddev->event_lock, flags); + + drm_vblank_put(adev->ddev, amdgpu_crtc->crtc_id); +- amdgpu_irq_put(adev, &adev->pageflip_irq, crtc_id); + queue_work(amdgpu_crtc->pflip_queue, &works->unpin_work); + + return 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +index cc050a329c49..937879ed86bc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c +@@ -204,6 +204,24 @@ static u32 dce_v8_0_vblank_get_counter(struct amdgpu_device *adev, int crtc) + return RREG32(mmCRTC_STATUS_FRAME_COUNT + crtc_offsets[crtc]); + } + ++static void dce_v8_0_pageflip_interrupt_init(struct amdgpu_device *adev) ++{ ++ unsigned i; ++ ++ /* Enable pflip interrupts */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) ++ amdgpu_irq_get(adev, &adev->pageflip_irq, i); ++} ++ ++static void dce_v8_0_pageflip_interrupt_fini(struct amdgpu_device *adev) ++{ ++ unsigned i; ++ ++ /* Disable pflip interrupts */ ++ for (i = 0; i < adev->mode_info.num_crtc; i++) ++ amdgpu_irq_put(adev, &adev->pageflip_irq, i); ++} ++ + /** + * dce_v8_0_page_flip - pageflip callback. + * +@@ -2575,9 +2593,10 @@ static void dce_v8_0_crtc_dpms(struct drm_crtc *crtc, int mode) + dce_v8_0_vga_enable(crtc, true); + amdgpu_atombios_crtc_blank(crtc, ATOM_DISABLE); + dce_v8_0_vga_enable(crtc, false); +- /* Make sure VBLANK interrupt is still enabled */ ++ /* Make sure VBLANK and PFLIP interrupts are still enabled */ + type = amdgpu_crtc_idx_to_irq_type(adev, amdgpu_crtc->crtc_id); + amdgpu_irq_update(adev, &adev->crtc_irq, type); ++ amdgpu_irq_update(adev, &adev->pageflip_irq, type); + drm_vblank_post_modeset(dev, amdgpu_crtc->crtc_id); + dce_v8_0_crtc_load_lut(crtc); + break; +@@ -2933,6 +2952,8 @@ static int dce_v8_0_hw_init(void *handle) + dce_v8_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); + } + ++ dce_v8_0_pageflip_interrupt_init(adev); ++ + return 0; + } + +@@ -2947,6 +2968,8 @@ static int dce_v8_0_hw_fini(void *handle) + dce_v8_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false); + } + ++ dce_v8_0_pageflip_interrupt_fini(adev); ++ + return 0; + } + +@@ -2958,6 +2981,8 @@ static int dce_v8_0_suspend(void *handle) + + dce_v8_0_hpd_fini(adev); + ++ dce_v8_0_pageflip_interrupt_fini(adev); ++ + return 0; + } + +@@ -2981,6 +3006,8 @@ static int dce_v8_0_resume(void *handle) + /* initialize hpd */ + dce_v8_0_hpd_init(adev); + ++ dce_v8_0_pageflip_interrupt_init(adev); ++ + return 0; + } + +@@ -3376,7 +3403,6 @@ static int dce_v8_0_pageflip_irq(struct amdgpu_device *adev, + spin_unlock_irqrestore(&adev->ddev->event_lock, flags); + + drm_vblank_put(adev->ddev, amdgpu_crtc->crtc_id); +- amdgpu_irq_put(adev, &adev->pageflip_irq, crtc_id); + queue_work(amdgpu_crtc->pflip_queue, &works->unpin_work); + + return 0; +diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c +index 94ec04a9c4d5..9745ed3a9aef 100644 +--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c +@@ -2995,6 +2995,12 @@ static int kv_dpm_late_init(void *handle) + { + /* powerdown unused blocks for now */ + struct amdgpu_device *adev = (struct amdgpu_device *)handle; ++ int ret; ++ ++ /* init the sysfs and debugfs files late */ ++ ret = amdgpu_pm_sysfs_init(adev); ++ if (ret) ++ return ret; + + kv_dpm_powergate_acp(adev, true); + kv_dpm_powergate_samu(adev, true); +@@ -3038,9 +3044,6 @@ static int kv_dpm_sw_init(void *handle) + adev->pm.dpm.current_ps = adev->pm.dpm.requested_ps = adev->pm.dpm.boot_ps; + if (amdgpu_dpm == 1) + amdgpu_pm_print_power_states(adev); +- ret = amdgpu_pm_sysfs_init(adev); +- if (ret) +- goto dpm_failed; + mutex_unlock(&adev->pm.mutex); + DRM_INFO("amdgpu: dpm initialized\n"); + +diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c +index 4f58a1e18de6..9ffa56cebdbc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vi.c ++++ b/drivers/gpu/drm/amd/amdgpu/vi.c +@@ -968,6 +968,9 @@ static void vi_pcie_gen3_enable(struct amdgpu_device *adev) + u32 mask; + int ret; + ++ if (pci_is_root_bus(adev->pdev->bus)) ++ return; ++ + if (amdgpu_pcie_gen2 == 0) + return; + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 969e7898a7ed..27a2426c3daa 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -2789,12 +2789,13 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs + if (msgs[num - 1].flags & I2C_M_RD) + reading = true; + +- if (!reading) { ++ if (!reading || (num - 1 > DP_REMOTE_I2C_READ_MAX_TRANSACTIONS)) { + DRM_DEBUG_KMS("Unsupported I2C transaction for MST device\n"); + ret = -EIO; + goto out; + } + ++ memset(&msg, 0, sizeof(msg)); + msg.req_type = DP_REMOTE_I2C_READ; + msg.u.i2c_read.num_transactions = num - 1; + msg.u.i2c_read.port_number = port->port_num; +diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c +index 0f6cd33b531f..684bd4a13843 100644 +--- a/drivers/gpu/drm/drm_sysfs.c ++++ b/drivers/gpu/drm/drm_sysfs.c +@@ -235,18 +235,12 @@ static ssize_t dpms_show(struct device *device, + char *buf) + { + struct drm_connector *connector = to_drm_connector(device); +- struct drm_device *dev = connector->dev; +- uint64_t dpms_status; +- int ret; ++ int dpms; + +- ret = drm_object_property_get_value(&connector->base, +- dev->mode_config.dpms_property, +- &dpms_status); +- if (ret) +- return 0; ++ dpms = READ_ONCE(connector->dpms); + + return snprintf(buf, PAGE_SIZE, "%s\n", +- drm_get_dpms_name((int)dpms_status)); ++ drm_get_dpms_name(dpms)); + } + + static ssize_t enabled_show(struct device *device, +diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +index 6751553abe4a..567791b27d6d 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +@@ -178,8 +178,30 @@ nouveau_fbcon_sync(struct fb_info *info) + return 0; + } + ++static int ++nouveau_fbcon_open(struct fb_info *info, int user) ++{ ++ struct nouveau_fbdev *fbcon = info->par; ++ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); ++ int ret = pm_runtime_get_sync(drm->dev->dev); ++ if (ret < 0 && ret != -EACCES) ++ return ret; ++ return 0; ++} ++ ++static int ++nouveau_fbcon_release(struct fb_info *info, int user) ++{ ++ struct nouveau_fbdev *fbcon = info->par; ++ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); ++ pm_runtime_put(drm->dev->dev); ++ return 0; ++} ++ + static struct fb_ops nouveau_fbcon_ops = { + .owner = THIS_MODULE, ++ .fb_open = nouveau_fbcon_open, ++ .fb_release = nouveau_fbcon_release, + .fb_check_var = drm_fb_helper_check_var, + .fb_set_par = drm_fb_helper_set_par, + .fb_fillrect = nouveau_fbcon_fillrect, +@@ -195,6 +217,8 @@ static struct fb_ops nouveau_fbcon_ops = { + + static struct fb_ops nouveau_fbcon_sw_ops = { + .owner = THIS_MODULE, ++ .fb_open = nouveau_fbcon_open, ++ .fb_release = nouveau_fbcon_release, + .fb_check_var = drm_fb_helper_check_var, + .fb_set_par = drm_fb_helper_set_par, + .fb_fillrect = cfb_fillrect, +diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c +index 6b6e57e8c2d6..847a902e7385 100644 +--- a/drivers/gpu/drm/qxl/qxl_fb.c ++++ b/drivers/gpu/drm/qxl/qxl_fb.c +@@ -144,14 +144,17 @@ static void qxl_dirty_update(struct qxl_fbdev *qfbdev, + + spin_lock_irqsave(&qfbdev->dirty.lock, flags); + +- if (qfbdev->dirty.y1 < y) +- y = qfbdev->dirty.y1; +- if (qfbdev->dirty.y2 > y2) +- y2 = qfbdev->dirty.y2; +- if (qfbdev->dirty.x1 < x) +- x = qfbdev->dirty.x1; +- if (qfbdev->dirty.x2 > x2) +- x2 = qfbdev->dirty.x2; ++ if ((qfbdev->dirty.y2 - qfbdev->dirty.y1) && ++ (qfbdev->dirty.x2 - qfbdev->dirty.x1)) { ++ if (qfbdev->dirty.y1 < y) ++ y = qfbdev->dirty.y1; ++ if (qfbdev->dirty.y2 > y2) ++ y2 = qfbdev->dirty.y2; ++ if (qfbdev->dirty.x1 < x) ++ x = qfbdev->dirty.x1; ++ if (qfbdev->dirty.x2 > x2) ++ x2 = qfbdev->dirty.x2; ++ } + + qfbdev->dirty.x1 = x; + qfbdev->dirty.x2 = x2; +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index d2e9e9efc159..6743174acdbc 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -1633,18 +1633,8 @@ int radeon_modeset_init(struct radeon_device *rdev) + radeon_fbdev_init(rdev); + drm_kms_helper_poll_init(rdev->ddev); + +- if (rdev->pm.dpm_enabled) { +- /* do dpm late init */ +- ret = radeon_pm_late_init(rdev); +- if (ret) { +- rdev->pm.dpm_enabled = false; +- DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n"); +- } +- /* set the dpm state for PX since there won't be +- * a modeset to call this. +- */ +- radeon_pm_compute_clocks(rdev); +- } ++ /* do pm late init */ ++ ret = radeon_pm_late_init(rdev); + + return 0; + } +diff --git a/drivers/gpu/drm/radeon/radeon_dp_mst.c b/drivers/gpu/drm/radeon/radeon_dp_mst.c +index 257b10be5cda..42986130cc63 100644 +--- a/drivers/gpu/drm/radeon/radeon_dp_mst.c ++++ b/drivers/gpu/drm/radeon/radeon_dp_mst.c +@@ -283,6 +283,7 @@ static struct drm_connector *radeon_dp_add_mst_connector(struct drm_dp_mst_topol + radeon_connector->mst_encoder = radeon_dp_create_fake_mst_encoder(master); + + drm_object_attach_property(&connector->base, dev->mode_config.path_property, 0); ++ drm_object_attach_property(&connector->base, dev->mode_config.tile_property, 0); + drm_mode_connector_set_path_property(connector, pathprop); + drm_reinit_primary_mode_group(dev); + +diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c +index c1ba83a8dd8c..948c33105801 100644 +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -1331,14 +1331,6 @@ static int radeon_pm_init_old(struct radeon_device *rdev) + INIT_DELAYED_WORK(&rdev->pm.dynpm_idle_work, radeon_dynpm_idle_work_handler); + + if (rdev->pm.num_power_states > 1) { +- /* where's the best place to put these? */ +- ret = device_create_file(rdev->dev, &dev_attr_power_profile); +- if (ret) +- DRM_ERROR("failed to create device file for power profile\n"); +- ret = device_create_file(rdev->dev, &dev_attr_power_method); +- if (ret) +- DRM_ERROR("failed to create device file for power method\n"); +- + if (radeon_debugfs_pm_init(rdev)) { + DRM_ERROR("Failed to register debugfs file for PM!\n"); + } +@@ -1396,20 +1388,6 @@ static int radeon_pm_init_dpm(struct radeon_device *rdev) + goto dpm_failed; + rdev->pm.dpm_enabled = true; + +- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state); +- if (ret) +- DRM_ERROR("failed to create device file for dpm state\n"); +- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level); +- if (ret) +- DRM_ERROR("failed to create device file for dpm state\n"); +- /* XXX: these are noops for dpm but are here for backwards compat */ +- ret = device_create_file(rdev->dev, &dev_attr_power_profile); +- if (ret) +- DRM_ERROR("failed to create device file for power profile\n"); +- ret = device_create_file(rdev->dev, &dev_attr_power_method); +- if (ret) +- DRM_ERROR("failed to create device file for power method\n"); +- + if (radeon_debugfs_pm_init(rdev)) { + DRM_ERROR("Failed to register debugfs file for dpm!\n"); + } +@@ -1550,9 +1528,44 @@ int radeon_pm_late_init(struct radeon_device *rdev) + int ret = 0; + + if (rdev->pm.pm_method == PM_METHOD_DPM) { +- mutex_lock(&rdev->pm.mutex); +- ret = radeon_dpm_late_enable(rdev); +- mutex_unlock(&rdev->pm.mutex); ++ if (rdev->pm.dpm_enabled) { ++ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state); ++ if (ret) ++ DRM_ERROR("failed to create device file for dpm state\n"); ++ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level); ++ if (ret) ++ DRM_ERROR("failed to create device file for dpm state\n"); ++ /* XXX: these are noops for dpm but are here for backwards compat */ ++ ret = device_create_file(rdev->dev, &dev_attr_power_profile); ++ if (ret) ++ DRM_ERROR("failed to create device file for power profile\n"); ++ ret = device_create_file(rdev->dev, &dev_attr_power_method); ++ if (ret) ++ DRM_ERROR("failed to create device file for power method\n"); ++ ++ mutex_lock(&rdev->pm.mutex); ++ ret = radeon_dpm_late_enable(rdev); ++ mutex_unlock(&rdev->pm.mutex); ++ if (ret) { ++ rdev->pm.dpm_enabled = false; ++ DRM_ERROR("radeon_pm_late_init failed, disabling dpm\n"); ++ } else { ++ /* set the dpm state for PX since there won't be ++ * a modeset to call this. ++ */ ++ radeon_pm_compute_clocks(rdev); ++ } ++ } ++ } else { ++ if (rdev->pm.num_power_states > 1) { ++ /* where's the best place to put these? */ ++ ret = device_create_file(rdev->dev, &dev_attr_power_profile); ++ if (ret) ++ DRM_ERROR("failed to create device file for power profile\n"); ++ ret = device_create_file(rdev->dev, &dev_attr_power_method); ++ if (ret) ++ DRM_ERROR("failed to create device file for power method\n"); ++ } + } + return ret; + } +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 3dd2de31a2f8..472b88285c75 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -24,6 +24,7 @@ + #include <linux/kernel.h> + #include <linux/module.h> + #include <linux/delay.h> ++#include <linux/dmi.h> + #include <linux/i2c.h> + #include <linux/clk.h> + #include <linux/clk-provider.h> +@@ -51,6 +52,22 @@ static u32 i2c_dw_get_clk_rate_khz(struct dw_i2c_dev *dev) + } + + #ifdef CONFIG_ACPI ++/* ++ * The HCNT/LCNT information coming from ACPI should be the most accurate ++ * for given platform. However, some systems get it wrong. On such systems ++ * we get better results by calculating those based on the input clock. ++ */ ++static const struct dmi_system_id dw_i2c_no_acpi_params[] = { ++ { ++ .ident = "Dell Inspiron 7348", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7348"), ++ }, ++ }, ++ { } ++}; ++ + static void dw_i2c_acpi_params(struct platform_device *pdev, char method[], + u16 *hcnt, u16 *lcnt, u32 *sda_hold) + { +@@ -58,6 +75,9 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[], + acpi_handle handle = ACPI_HANDLE(&pdev->dev); + union acpi_object *obj; + ++ if (dmi_check_system(dw_i2c_no_acpi_params)) ++ return; ++ + if (ACPI_FAILURE(acpi_evaluate_object(handle, method, NULL, &buf))) + return; + +@@ -253,12 +273,6 @@ static int dw_i2c_probe(struct platform_device *pdev) + adap->dev.parent = &pdev->dev; + adap->dev.of_node = pdev->dev.of_node; + +- r = i2c_add_numbered_adapter(adap); +- if (r) { +- dev_err(&pdev->dev, "failure adding adapter\n"); +- return r; +- } +- + if (dev->pm_runtime_disabled) { + pm_runtime_forbid(&pdev->dev); + } else { +@@ -268,6 +282,13 @@ static int dw_i2c_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + } + ++ r = i2c_add_numbered_adapter(adap); ++ if (r) { ++ dev_err(&pdev->dev, "failure adding adapter\n"); ++ pm_runtime_disable(&pdev->dev); ++ return r; ++ } ++ + return 0; + } + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index d8361dada584..d8b5a8fee1e6 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -690,15 +690,16 @@ static int rcar_i2c_probe(struct platform_device *pdev) + return ret; + } + ++ pm_runtime_enable(dev); ++ platform_set_drvdata(pdev, priv); ++ + ret = i2c_add_numbered_adapter(adap); + if (ret < 0) { + dev_err(dev, "reg adap failed: %d\n", ret); ++ pm_runtime_disable(dev); + return ret; + } + +- pm_runtime_enable(dev); +- platform_set_drvdata(pdev, priv); +- + dev_info(dev, "probed\n"); + + return 0; +diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c +index 50bfd8cef5f2..5df819610d52 100644 +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -1243,17 +1243,19 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) + i2c->adap.nr = i2c->pdata->bus_num; + i2c->adap.dev.of_node = pdev->dev.of_node; + ++ platform_set_drvdata(pdev, i2c); ++ ++ pm_runtime_enable(&pdev->dev); ++ + ret = i2c_add_numbered_adapter(&i2c->adap); + if (ret < 0) { + dev_err(&pdev->dev, "failed to add bus to i2c core\n"); ++ pm_runtime_disable(&pdev->dev); + s3c24xx_i2c_deregister_cpufreq(i2c); + clk_unprepare(i2c->clk); + return ret; + } + +- platform_set_drvdata(pdev, i2c); +- +- pm_runtime_enable(&pdev->dev); + pm_runtime_enable(&i2c->adap.dev); + + dev_info(&pdev->dev, "%s: S3C I2C adapter\n", dev_name(&i2c->adap.dev)); +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 75aef240c2d1..493c38e08bd2 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -3255,7 +3255,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) + metadata_low_callback, + pool); + if (r) +- goto out_free_pt; ++ goto out_flags_changed; + + pt->callbacks.congested_fn = pool_is_congested; + dm_table_add_target_callbacks(ti->table, &pt->callbacks); +diff --git a/drivers/mfd/max77843.c b/drivers/mfd/max77843.c +index a354ac677ec7..1074a0d68680 100644 +--- a/drivers/mfd/max77843.c ++++ b/drivers/mfd/max77843.c +@@ -79,7 +79,7 @@ static int max77843_chg_init(struct max77843 *max77843) + if (!max77843->i2c_chg) { + dev_err(&max77843->i2c->dev, + "Cannot allocate I2C device for Charger\n"); +- return PTR_ERR(max77843->i2c_chg); ++ return -ENODEV; + } + i2c_set_clientdata(max77843->i2c_chg, max77843); + +diff --git a/drivers/net/ethernet/ibm/emac/core.h b/drivers/net/ethernet/ibm/emac/core.h +index 28df37420da9..ac02c675c59c 100644 +--- a/drivers/net/ethernet/ibm/emac/core.h ++++ b/drivers/net/ethernet/ibm/emac/core.h +@@ -460,8 +460,8 @@ struct emac_ethtool_regs_subhdr { + u32 index; + }; + +-#define EMAC_ETHTOOL_REGS_VER 0 +-#define EMAC4_ETHTOOL_REGS_VER 1 +-#define EMAC4SYNC_ETHTOOL_REGS_VER 2 ++#define EMAC_ETHTOOL_REGS_VER 3 ++#define EMAC4_ETHTOOL_REGS_VER 4 ++#define EMAC4SYNC_ETHTOOL_REGS_VER 5 + + #endif /* __IBM_NEWEMAC_CORE_H */ +diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c +index 3837ae344f63..2ed75060da50 100644 +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_device *dev) + if (po->pppoe_dev == dev && + sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { + pppox_unbind_sock(sk); +- sk->sk_state = PPPOX_ZOMBIE; + sk->sk_state_change(sk); + po->pppoe_dev = NULL; + dev_put(dev); +diff --git a/drivers/pinctrl/freescale/pinctrl-imx25.c b/drivers/pinctrl/freescale/pinctrl-imx25.c +index faf635654312..293ed4381cc0 100644 +--- a/drivers/pinctrl/freescale/pinctrl-imx25.c ++++ b/drivers/pinctrl/freescale/pinctrl-imx25.c +@@ -26,7 +26,8 @@ + #include "pinctrl-imx.h" + + enum imx25_pads { +- MX25_PAD_RESERVE0 = 1, ++ MX25_PAD_RESERVE0 = 0, ++ MX25_PAD_RESERVE1 = 1, + MX25_PAD_A10 = 2, + MX25_PAD_A13 = 3, + MX25_PAD_A14 = 4, +@@ -169,6 +170,7 @@ enum imx25_pads { + /* Pad names for the pinmux subsystem */ + static const struct pinctrl_pin_desc imx25_pinctrl_pads[] = { + IMX_PINCTRL_PIN(MX25_PAD_RESERVE0), ++ IMX_PINCTRL_PIN(MX25_PAD_RESERVE1), + IMX_PINCTRL_PIN(MX25_PAD_A10), + IMX_PINCTRL_PIN(MX25_PAD_A13), + IMX_PINCTRL_PIN(MX25_PAD_A14), +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index 802fabb30e15..34cbe3505dac 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -1809,7 +1809,6 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root, + int found = 0; + struct extent_buffer *eb; + struct btrfs_inode_extref *extref; +- struct extent_buffer *leaf; + u32 item_size; + u32 cur_offset; + unsigned long ptr; +@@ -1837,9 +1836,8 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root, + btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK); + btrfs_release_path(path); + +- leaf = path->nodes[0]; +- item_size = btrfs_item_size_nr(leaf, slot); +- ptr = btrfs_item_ptr_offset(leaf, slot); ++ item_size = btrfs_item_size_nr(eb, slot); ++ ptr = btrfs_item_ptr_offset(eb, slot); + cur_offset = 0; + + while (cur_offset < item_size) { +@@ -1853,7 +1851,7 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root, + if (ret) + break; + +- cur_offset += btrfs_inode_extref_name_len(leaf, extref); ++ cur_offset += btrfs_inode_extref_name_len(eb, extref); + cur_offset += sizeof(*extref); + } + btrfs_tree_read_unlock_blocking(eb); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 0770c91586ca..f490b6155091 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -4647,6 +4647,11 @@ locked: + bctl->flags |= BTRFS_BALANCE_TYPE_MASK; + } + ++ if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) { ++ ret = -EINVAL; ++ goto out_bargs; ++ } ++ + do_balance: + /* + * Ownership of bctl and mutually_exclusive_operation_running +diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h +index 95842a909e7f..2ac5f8cd701a 100644 +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -376,6 +376,14 @@ struct map_lookup { + #define BTRFS_BALANCE_ARGS_VRANGE (1ULL << 4) + #define BTRFS_BALANCE_ARGS_LIMIT (1ULL << 5) + ++#define BTRFS_BALANCE_ARGS_MASK \ ++ (BTRFS_BALANCE_ARGS_PROFILES | \ ++ BTRFS_BALANCE_ARGS_USAGE | \ ++ BTRFS_BALANCE_ARGS_DEVID | \ ++ BTRFS_BALANCE_ARGS_DRANGE | \ ++ BTRFS_BALANCE_ARGS_VRANGE | \ ++ BTRFS_BALANCE_ARGS_LIMIT) ++ + /* + * Profile changing flags. When SOFT is set we won't relocate chunk if + * it already has the target profile (even though it may be +diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c +index cdefaa331a07..c29d9421bd5e 100644 +--- a/fs/nfsd/blocklayout.c ++++ b/fs/nfsd/blocklayout.c +@@ -56,14 +56,6 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp, + u32 device_generation = 0; + int error; + +- /* +- * We do not attempt to support I/O smaller than the fs block size, +- * or not aligned to it. +- */ +- if (args->lg_minlength < block_size) { +- dprintk("pnfsd: I/O too small\n"); +- goto out_layoutunavailable; +- } + if (seg->offset & (block_size - 1)) { + dprintk("pnfsd: I/O misaligned\n"); + goto out_layoutunavailable; +diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h +index 86d0b25ed054..a89f505c856b 100644 +--- a/include/drm/drm_dp_mst_helper.h ++++ b/include/drm/drm_dp_mst_helper.h +@@ -253,6 +253,7 @@ struct drm_dp_remote_dpcd_write { + u8 *bytes; + }; + ++#define DP_REMOTE_I2C_READ_MAX_TRANSACTIONS 4 + struct drm_dp_remote_i2c_read { + u8 num_transactions; + u8 port_number; +@@ -262,7 +263,7 @@ struct drm_dp_remote_i2c_read { + u8 *bytes; + u8 no_stop_bit; + u8 i2c_transaction_delay; +- } transactions[4]; ++ } transactions[DP_REMOTE_I2C_READ_MAX_TRANSACTIONS]; + u8 read_i2c_device_id; + u8 num_bytes_read; + }; +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 9b88536487e6..275158803824 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2601,6 +2601,9 @@ static inline void skb_postpull_rcsum(struct sk_buff *skb, + { + if (skb->ip_summed == CHECKSUM_COMPLETE) + skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); ++ else if (skb->ip_summed == CHECKSUM_PARTIAL && ++ skb_checksum_start_offset(skb) < 0) ++ skb->ip_summed = CHECKSUM_NONE; + } + + unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len); +diff --git a/include/net/af_unix.h b/include/net/af_unix.h +index 4a167b30a12f..cb1b9bbda332 100644 +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -63,7 +63,11 @@ struct unix_sock { + #define UNIX_GC_MAYBE_CYCLE 1 + struct socket_wq peer_wq; + }; +-#define unix_sk(__sk) ((struct unix_sock *)__sk) ++ ++static inline struct unix_sock *unix_sk(struct sock *sk) ++{ ++ return (struct unix_sock *)sk; ++} + + #define peer_wait peer_wq.wait + +diff --git a/include/net/sock.h b/include/net/sock.h +index f21f0708ec59..4ca4c3fe446f 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -826,6 +826,14 @@ static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *s + if (sk_rcvqueues_full(sk, limit)) + return -ENOBUFS; + ++ /* ++ * If the skb was allocated from pfmemalloc reserves, only ++ * allow SOCK_MEMALLOC sockets to use it as this socket is ++ * helping free memory ++ */ ++ if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC)) ++ return -ENOMEM; ++ + __sk_add_backlog(sk, skb); + sk->sk_backlog.len += skb->truesize; + return 0; +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index a20d4110e871..3688f1e07ebd 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -1244,7 +1244,7 @@ void __init timekeeping_init(void) + set_normalized_timespec64(&tmp, -boot.tv_sec, -boot.tv_nsec); + tk_set_wall_to_mono(tk, tmp); + +- timekeeping_update(tk, TK_MIRROR); ++ timekeeping_update(tk, TK_MIRROR | TK_CLOCK_WAS_SET); + + write_seqcount_end(&tk_core.seq); + raw_spin_unlock_irqrestore(&timekeeper_lock, flags); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index a413acb59a07..1de0f5fabb98 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1458,13 +1458,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq, + timer_stats_timer_set_start_info(&dwork->timer); + + dwork->wq = wq; ++ /* timer isn't guaranteed to run in this cpu, record earlier */ ++ if (cpu == WORK_CPU_UNBOUND) ++ cpu = raw_smp_processor_id(); + dwork->cpu = cpu; + timer->expires = jiffies + delay; + +- if (unlikely(cpu != WORK_CPU_UNBOUND)) +- add_timer_on(timer, cpu); +- else +- add_timer(timer); ++ add_timer_on(timer, cpu); + } + + /** +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 237d4686482d..03a6f7506cf3 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -3687,6 +3687,7 @@ static int __mem_cgroup_usage_register_event(struct mem_cgroup *memcg, + ret = page_counter_memparse(args, "-1", &threshold); + if (ret) + return ret; ++ threshold <<= PAGE_SHIFT; + + mutex_lock(&memcg->thresholds_lock); + +diff --git a/net/core/ethtool.c b/net/core/ethtool.c +index b495ab1797fa..29edf74846fc 100644 +--- a/net/core/ethtool.c ++++ b/net/core/ethtool.c +@@ -1284,7 +1284,7 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr) + + gstrings.len = ret; + +- data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER); ++ data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER); + if (!data) + return -ENOMEM; + +diff --git a/net/core/filter.c b/net/core/filter.c +index be3098fb65e4..8dcdd86b68dd 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -1412,6 +1412,7 @@ static u64 bpf_clone_redirect(u64 r1, u64 ifindex, u64 flags, u64 r4, u64 r5) + return dev_forward_skb(dev, skb2); + + skb2->dev = dev; ++ skb_sender_cpu_clear(skb2); + return dev_queue_xmit(skb2); + } + +@@ -1701,9 +1702,13 @@ int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf, + goto out; + + /* We're copying the filter that has been originally attached, +- * so no conversion/decode needed anymore. ++ * so no conversion/decode needed anymore. eBPF programs that ++ * have no original program cannot be dumped through this. + */ ++ ret = -EACCES; + fprog = filter->prog->orig_prog; ++ if (!fprog) ++ goto out; + + ret = fprog->len; + if (!len) +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 7b84330e5d30..7bfa18746681 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2958,11 +2958,12 @@ EXPORT_SYMBOL_GPL(skb_append_pagefrags); + */ + unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len) + { ++ unsigned char *data = skb->data; ++ + BUG_ON(len > skb->len); +- skb->len -= len; +- BUG_ON(skb->len < skb->data_len); +- skb_postpull_rcsum(skb, skb->data, len); +- return skb->data += len; ++ __skb_pull(skb, len); ++ skb_postpull_rcsum(skb, data, len); ++ return skb->data; + } + EXPORT_SYMBOL_GPL(skb_pull_rcsum); + +diff --git a/net/dsa/slave.c b/net/dsa/slave.c +index 35c47ddd04f0..25dbb91e1bc0 100644 +--- a/net/dsa/slave.c ++++ b/net/dsa/slave.c +@@ -348,12 +348,17 @@ static int dsa_slave_stp_update(struct net_device *dev, u8 state) + static int dsa_slave_port_attr_set(struct net_device *dev, + struct switchdev_attr *attr) + { +- int ret = 0; ++ struct dsa_slave_priv *p = netdev_priv(dev); ++ struct dsa_switch *ds = p->parent; ++ int ret; + + switch (attr->id) { + case SWITCHDEV_ATTR_PORT_STP_STATE: +- if (attr->trans == SWITCHDEV_TRANS_COMMIT) +- ret = dsa_slave_stp_update(dev, attr->u.stp_state); ++ if (attr->trans == SWITCHDEV_TRANS_PREPARE) ++ ret = ds->drv->port_stp_update ? 0 : -EOPNOTSUPP; ++ else ++ ret = ds->drv->port_stp_update(ds, p->port, ++ attr->u.stp_state); + break; + default: + ret = -EOPNOTSUPP; +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 134957159c27..61b45a17fc73 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -577,21 +577,22 @@ EXPORT_SYMBOL(inet_rtx_syn_ack); + static bool reqsk_queue_unlink(struct request_sock_queue *queue, + struct request_sock *req) + { +- struct listen_sock *lopt = queue->listen_opt; + struct request_sock **prev; ++ struct listen_sock *lopt; + bool found = false; + + spin_lock(&queue->syn_wait_lock); +- +- for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL; +- prev = &(*prev)->dl_next) { +- if (*prev == req) { +- *prev = req->dl_next; +- found = true; +- break; ++ lopt = queue->listen_opt; ++ if (lopt) { ++ for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL; ++ prev = &(*prev)->dl_next) { ++ if (*prev == req) { ++ *prev = req->dl_next; ++ found = true; ++ break; ++ } + } + } +- + spin_unlock(&queue->syn_wait_lock); + if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer)) + reqsk_put(req); +@@ -685,20 +686,20 @@ void reqsk_queue_hash_req(struct request_sock_queue *queue, + req->num_timeout = 0; + req->sk = NULL; + ++ setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); ++ mod_timer_pinned(&req->rsk_timer, jiffies + timeout); ++ req->rsk_hash = hash; ++ + /* before letting lookups find us, make sure all req fields + * are committed to memory and refcnt initialized. + */ + smp_wmb(); + atomic_set(&req->rsk_refcnt, 2); +- setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); +- req->rsk_hash = hash; + + spin_lock(&queue->syn_wait_lock); + req->dl_next = lopt->syn_table[hash]; + lopt->syn_table[hash] = req; + spin_unlock(&queue->syn_wait_lock); +- +- mod_timer_pinned(&req->rsk_timer, jiffies + timeout); + } + EXPORT_SYMBOL(reqsk_queue_hash_req); + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 00b64d402a57..dd6ebba5846c 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -139,6 +139,9 @@ static void rt6_uncached_list_flush_dev(struct net *net, struct net_device *dev) + struct net_device *loopback_dev = net->loopback_dev; + int cpu; + ++ if (dev == loopback_dev) ++ return; ++ + for_each_possible_cpu(cpu) { + struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu); + struct rt6_info *rt; +@@ -148,14 +151,12 @@ static void rt6_uncached_list_flush_dev(struct net *net, struct net_device *dev) + struct inet6_dev *rt_idev = rt->rt6i_idev; + struct net_device *rt_dev = rt->dst.dev; + +- if (rt_idev && (rt_idev->dev == dev || !dev) && +- rt_idev->dev != loopback_dev) { ++ if (rt_idev->dev == dev) { + rt->rt6i_idev = in6_dev_get(loopback_dev); + in6_dev_put(rt_idev); + } + +- if (rt_dev && (rt_dev == dev || !dev) && +- rt_dev != loopback_dev) { ++ if (rt_dev == dev) { + rt->dst.dev = loopback_dev; + dev_hold(rt->dst.dev); + dev_put(rt_dev); +@@ -2577,7 +2578,8 @@ void rt6_ifdown(struct net *net, struct net_device *dev) + + fib6_clean_all(net, fib6_ifdown, &adn); + icmp6_clean_all(fib6_ifdown, &adn); +- rt6_uncached_list_flush_dev(net, dev); ++ if (dev) ++ rt6_uncached_list_flush_dev(net, dev); + } + + struct rt6_mtu_change_arg { +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index f6b090df3930..afca2eb4dfa7 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1319,7 +1319,7 @@ static void l2tp_tunnel_del_work(struct work_struct *work) + tunnel = container_of(work, struct l2tp_tunnel, del_work); + sk = l2tp_tunnel_sock_lookup(tunnel); + if (!sk) +- return; ++ goto out; + + sock = sk->sk_socket; + +@@ -1341,6 +1341,8 @@ static void l2tp_tunnel_del_work(struct work_struct *work) + } + + l2tp_tunnel_sock_put(sk); ++out: ++ l2tp_tunnel_dec_refcount(tunnel); + } + + /* Create a socket for the tunnel, if one isn't set up by +@@ -1636,8 +1638,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); + */ + int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) + { ++ l2tp_tunnel_inc_refcount(tunnel); + l2tp_tunnel_closeall(tunnel); +- return (false == queue_work(l2tp_wq, &tunnel->del_work)); ++ if (false == queue_work(l2tp_wq, &tunnel->del_work)) { ++ l2tp_tunnel_dec_refcount(tunnel); ++ return 1; ++ } ++ return 0; + } + EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 0857f7243797..a133d16eb053 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -2750,6 +2750,7 @@ static int netlink_dump(struct sock *sk) + struct sk_buff *skb = NULL; + struct nlmsghdr *nlh; + int len, err = -ENOBUFS; ++ int alloc_min_size; + int alloc_size; + + mutex_lock(nlk->cb_mutex); +@@ -2758,9 +2759,6 @@ static int netlink_dump(struct sock *sk) + goto errout_skb; + } + +- cb = &nlk->cb; +- alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); +- + if (!netlink_rx_is_mmaped(sk) && + atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) + goto errout_skb; +@@ -2770,23 +2768,35 @@ static int netlink_dump(struct sock *sk) + * to reduce number of system calls on dump operations, if user + * ever provided a big enough buffer. + */ +- if (alloc_size < nlk->max_recvmsg_len) { +- skb = netlink_alloc_skb(sk, +- nlk->max_recvmsg_len, +- nlk->portid, ++ cb = &nlk->cb; ++ alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); ++ ++ if (alloc_min_size < nlk->max_recvmsg_len) { ++ alloc_size = nlk->max_recvmsg_len; ++ skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, + GFP_KERNEL | + __GFP_NOWARN | + __GFP_NORETRY); +- /* available room should be exact amount to avoid MSG_TRUNC */ +- if (skb) +- skb_reserve(skb, skb_tailroom(skb) - +- nlk->max_recvmsg_len); + } +- if (!skb) ++ if (!skb) { ++ alloc_size = alloc_min_size; + skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, + GFP_KERNEL); ++ } + if (!skb) + goto errout_skb; ++ ++ /* Trim skb to allocated size. User is expected to provide buffer as ++ * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at ++ * netlink_recvmsg())). dump will pack as many smaller messages as ++ * could fit within the allocated skb. skb is typically allocated ++ * with larger space than required (could be as much as near 2x the ++ * requested size with align to next power of 2 approach). Allowing ++ * dump to use the excess space makes it difficult for a user to have a ++ * reasonable static buffer based on the expected largest dump of a ++ * single netdev. The outcome is MSG_TRUNC error. ++ */ ++ skb_reserve(skb, skb_tailroom(skb) - alloc_size); + netlink_skb_set_owner_r(skb, sk); + + len = cb->dump(skb, cb); +diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c +index b5c3bba87fc8..af08e6fc9860 100644 +--- a/net/openvswitch/flow_table.c ++++ b/net/openvswitch/flow_table.c +@@ -92,7 +92,8 @@ struct sw_flow *ovs_flow_alloc(void) + + /* Initialize the default stat node. */ + stats = kmem_cache_alloc_node(flow_stats_cache, +- GFP_KERNEL | __GFP_ZERO, 0); ++ GFP_KERNEL | __GFP_ZERO, ++ node_online(0) ? 0 : NUMA_NO_NODE); + if (!stats) + goto err; + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 268545050ddb..b1768198ad59 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -168,6 +168,7 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a, + + skb2->skb_iif = skb->dev->ifindex; + skb2->dev = dev; ++ skb_sender_cpu_clear(skb2); + err = dev_queue_xmit(skb2); + + out: +diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +index 2e1348bde325..96d886a866e9 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +@@ -146,7 +146,8 @@ int rdma_read_chunk_lcl(struct svcxprt_rdma *xprt, + ctxt->read_hdr = head; + pages_needed = + min_t(int, pages_needed, rdma_read_max_sge(xprt, pages_needed)); +- read = min_t(int, pages_needed << PAGE_SHIFT, rs_length); ++ read = min_t(int, (pages_needed << PAGE_SHIFT) - *page_offset, ++ rs_length); + + for (pno = 0; pno < pages_needed; pno++) { + int len = min_t(int, rs_length, PAGE_SIZE - pg_off); +@@ -245,7 +246,8 @@ int rdma_read_chunk_frmr(struct svcxprt_rdma *xprt, + ctxt->direction = DMA_FROM_DEVICE; + ctxt->frmr = frmr; + pages_needed = min_t(int, pages_needed, xprt->sc_frmr_pg_list_len); +- read = min_t(int, pages_needed << PAGE_SHIFT, rs_length); ++ read = min_t(int, (pages_needed << PAGE_SHIFT) - *page_offset, ++ rs_length); + + frmr->kva = page_address(rqstp->rq_arg.pages[pg_no]); + frmr->direction = DMA_FROM_DEVICE; +diff --git a/net/tipc/msg.h b/net/tipc/msg.h +index 19c45fb66238..49f9a9648aa9 100644 +--- a/net/tipc/msg.h ++++ b/net/tipc/msg.h +@@ -357,7 +357,7 @@ static inline u32 msg_importance(struct tipc_msg *m) + if (likely((usr <= TIPC_CRITICAL_IMPORTANCE) && !msg_errcode(m))) + return usr; + if ((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER)) +- return msg_bits(m, 5, 13, 0x7); ++ return msg_bits(m, 9, 0, 0x7); + return TIPC_SYSTEM_IMPORTANCE; + } + +@@ -366,7 +366,7 @@ static inline void msg_set_importance(struct tipc_msg *m, u32 i) + int usr = msg_user(m); + + if (likely((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER))) +- msg_set_bits(m, 5, 13, 0x7, i); ++ msg_set_bits(m, 9, 0, 0x7, i); + else if (i < TIPC_SYSTEM_IMPORTANCE) + msg_set_user(m, i); + else +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 03ee4d359f6a..94f658235fb4 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2064,6 +2064,11 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state) + goto out; + } + ++ if (flags & MSG_PEEK) ++ skip = sk_peek_offset(sk, flags); ++ else ++ skip = 0; ++ + do { + int chunk; + struct sk_buff *skb, *last; +@@ -2112,7 +2117,6 @@ unlock: + break; + } + +- skip = sk_peek_offset(sk, flags); + while (skip >= unix_skb_len(skb)) { + skip -= unix_skb_len(skb); + last = skb; +@@ -2181,6 +2185,17 @@ unlock: + + sk_peek_offset_fwd(sk, chunk); + ++ if (UNIXCB(skb).fp) ++ break; ++ ++ skip = 0; ++ last = skb; ++ last_len = skb->len; ++ unix_state_lock(sk); ++ skb = skb_peek_next(skb, &sk->sk_receive_queue); ++ if (skb) ++ goto again; ++ unix_state_unlock(sk); + break; + } + } while (size);
