From 39f703ea850d9831e10795b18f3320c0cd97cdca Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Thu, 27 May 2021 20:47:53 +0200 Subject: [PATCH] Add upstream patches --- .../meson64-4.9/patch-4.9.268-269.patch | 5903 +++++++++++++++++ .../meson64-4.9/patch-4.9.269-270.patch | 951 +++ .../odroidxu4-5.4/patch-5.4.121-122.patch | 2145 ++++++ .../archive/sunxi-5.10/patch-5.10.39-40.patch | 3700 +++++++++++ 4 files changed, 12699 insertions(+) create mode 100644 patch/kernel/archive/meson64-4.9/patch-4.9.268-269.patch create mode 100644 patch/kernel/archive/meson64-4.9/patch-4.9.269-270.patch create mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.121-122.patch create mode 100644 patch/kernel/archive/sunxi-5.10/patch-5.10.39-40.patch diff --git a/patch/kernel/archive/meson64-4.9/patch-4.9.268-269.patch b/patch/kernel/archive/meson64-4.9/patch-4.9.268-269.patch new file mode 100644 index 0000000000..2a1242c3ff --- /dev/null +++ b/patch/kernel/archive/meson64-4.9/patch-4.9.268-269.patch @@ -0,0 +1,5903 @@ +diff --git a/Makefile b/Makefile +index 642365d416be1..94436a50dc9fb 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 268 ++SUBLEVEL = 269 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S +index 85d9ea4a0accc..37ad245cf9899 100644 +--- a/arch/arc/kernel/entry.S ++++ b/arch/arc/kernel/entry.S +@@ -169,7 +169,7 @@ tracesys: + + ; Do the Sys Call as we normally would. + ; Validate the Sys Call number +- cmp r8, NR_syscalls ++ cmp r8, NR_syscalls - 1 + mov.hi r0, -ENOSYS + bhi tracesys_exit + +@@ -252,7 +252,7 @@ ENTRY(EV_Trap) + ;============ Normal syscall case + + ; syscall num shd not exceed the total system calls avail +- cmp r8, NR_syscalls ++ cmp r8, NR_syscalls - 1 + mov.hi r0, -ENOSYS + bhi .Lret_from_system_call + +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index a97a785ccc6ba..f0906d67a1070 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -134,7 +134,7 @@ + compatible = "maxim,max77686"; + reg = <0x09>; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + wakeup-source; +diff --git a/arch/arm/boot/dts/exynos5250-snow-common.dtsi b/arch/arm/boot/dts/exynos5250-snow-common.dtsi +index d5d51916bb742..b24a77781e75e 100644 +--- a/arch/arm/boot/dts/exynos5250-snow-common.dtsi ++++ b/arch/arm/boot/dts/exynos5250-snow-common.dtsi +@@ -280,7 +280,7 @@ + max77686: max77686@09 { + compatible = "maxim,max77686"; + interrupt-parent = <&gpx3>; +- interrupts = <2 IRQ_TYPE_NONE>; ++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>; + pinctrl-names = "default"; + pinctrl-0 = <&max77686_irq>; + wakeup-source; +diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c +index 671dbc28e5d46..59e04e2d9d9db 100644 +--- a/arch/arm/kernel/hw_breakpoint.c ++++ b/arch/arm/kernel/hw_breakpoint.c +@@ -891,7 +891,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs) + info->trigger = addr; + pr_debug("breakpoint fired: address = 0x%x\n", addr); + perf_bp_event(bp, regs); +- if (!bp->overflow_handler) ++ if (is_default_overflow_handler(bp)) + enable_single_step(bp, addr); + goto unlock; + } +diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi +index b307d6b6357ec..ad34be46c3618 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi +@@ -914,7 +914,7 @@ + <&mmsys CLK_MM_DSI1_DIGITAL>, + <&mipi_tx1>; + clock-names = "engine", "digital", "hs"; +- phy = <&mipi_tx1>; ++ phys = <&mipi_tx1>; + phy-names = "dphy"; + status = "disabled"; + }; +diff --git a/arch/arm64/kernel/vdso/vdso.lds.S b/arch/arm64/kernel/vdso/vdso.lds.S +index beca249bc2f39..b3e6c4d5b75c8 100644 +--- a/arch/arm64/kernel/vdso/vdso.lds.S ++++ b/arch/arm64/kernel/vdso/vdso.lds.S +@@ -39,6 +39,13 @@ SECTIONS + .gnu.version_d : { *(.gnu.version_d) } + .gnu.version_r : { *(.gnu.version_r) } + ++ /* ++ * Discard .note.gnu.property sections which are unused and have ++ * different alignment requirement from vDSO note sections. ++ */ ++ /DISCARD/ : { ++ *(.note.GNU-stack .note.gnu.property) ++ } + .note : { *(.note.*) } :text :note + + . = ALIGN(16); +@@ -59,7 +66,6 @@ SECTIONS + PROVIDE(end = .); + + /DISCARD/ : { +- *(.note.GNU-stack) + *(.data .data.* .gnu.linkonce.d.* .sdata*) + *(.bss .sbss .dynbss .dynsbss) + } +diff --git a/arch/mips/include/asm/div64.h b/arch/mips/include/asm/div64.h +index dc5ea57364408..ceece76fc971a 100644 +--- a/arch/mips/include/asm/div64.h ++++ b/arch/mips/include/asm/div64.h +@@ -1,5 +1,5 @@ + /* +- * Copyright (C) 2000, 2004 Maciej W. Rozycki ++ * Copyright (C) 2000, 2004, 2021 Maciej W. Rozycki + * Copyright (C) 2003, 07 Ralf Baechle (ralf@linux-mips.org) + * + * This file is subject to the terms and conditions of the GNU General Public +@@ -9,25 +9,18 @@ + #ifndef __ASM_DIV64_H + #define __ASM_DIV64_H + +-#include +- +-#if BITS_PER_LONG == 64 ++#include + +-#include ++#if BITS_PER_LONG == 32 + + /* + * No traps on overflows for any of these... + */ + +-#define __div64_32(n, base) \ +-({ \ ++#define do_div64_32(res, high, low, base) ({ \ + unsigned long __cf, __tmp, __tmp2, __i; \ + unsigned long __quot32, __mod32; \ +- unsigned long __high, __low; \ +- unsigned long long __n; \ + \ +- __high = *__n >> 32; \ +- __low = __n; \ + __asm__( \ + " .set push \n" \ + " .set noat \n" \ +@@ -51,18 +44,48 @@ + " subu %0, %0, %z6 \n" \ + " addiu %2, %2, 1 \n" \ + "3: \n" \ +- " bnez %4, 0b\n\t" \ +- " srl %5, %1, 0x1f\n\t" \ ++ " bnez %4, 0b \n" \ ++ " srl %5, %1, 0x1f \n" \ + " .set pop" \ + : "=&r" (__mod32), "=&r" (__tmp), \ + "=&r" (__quot32), "=&r" (__cf), \ + "=&r" (__i), "=&r" (__tmp2) \ +- : "Jr" (base), "0" (__high), "1" (__low)); \ ++ : "Jr" (base), "0" (high), "1" (low)); \ + \ +- (__n) = __quot32; \ ++ (res) = __quot32; \ + __mod32; \ + }) + +-#endif /* BITS_PER_LONG == 64 */ ++#define __div64_32(n, base) ({ \ ++ unsigned long __upper, __low, __high, __radix; \ ++ unsigned long long __quot; \ ++ unsigned long long __div; \ ++ unsigned long __mod; \ ++ \ ++ __div = (*n); \ ++ __radix = (base); \ ++ \ ++ __high = __div >> 32; \ ++ __low = __div; \ ++ \ ++ if (__high < __radix) { \ ++ __upper = __high; \ ++ __high = 0; \ ++ } else { \ ++ __upper = __high % __radix; \ ++ __high /= __radix; \ ++ } \ ++ \ ++ __mod = do_div64_32(__low, __upper, __low, __radix); \ ++ \ ++ __quot = __high; \ ++ __quot = __quot << 32 | __low; \ ++ (*n) = __quot; \ ++ __mod; \ ++}) ++ ++#endif /* BITS_PER_LONG == 32 */ ++ ++#include + + #endif /* __ASM_DIV64_H */ +diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c +index 2d6886f09ba35..009b840ee5ef0 100644 +--- a/arch/mips/pci/pci-legacy.c ++++ b/arch/mips/pci/pci-legacy.c +@@ -158,8 +158,13 @@ void pci_load_of_ranges(struct pci_controller *hose, struct device_node *node) + res = hose->mem_resource; + break; + } +- if (res != NULL) +- of_pci_range_to_resource(&range, node, res); ++ if (res != NULL) { ++ res->name = node->full_name; ++ res->flags = range.flags; ++ res->start = range.cpu_addr; ++ res->end = range.cpu_addr + range.size - 1; ++ res->parent = res->child = res->sibling = NULL; ++ } + } + } + +diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug +index 63292f64b25a3..f66326339bc81 100644 +--- a/arch/powerpc/Kconfig.debug ++++ b/arch/powerpc/Kconfig.debug +@@ -348,6 +348,7 @@ config PPC_EARLY_DEBUG_CPM_ADDR + config FAIL_IOMMU + bool "Fault-injection capability for IOMMU" + depends on FAULT_INJECTION ++ depends on PCI || IBMVIO + help + Provide fault-injection capability for IOMMU. Each device can + be selectively enabled via the fail_iommu property. +diff --git a/arch/powerpc/include/uapi/asm/errno.h b/arch/powerpc/include/uapi/asm/errno.h +index e8b6b5f7de7c4..5e8f42ff797fb 100644 +--- a/arch/powerpc/include/uapi/asm/errno.h ++++ b/arch/powerpc/include/uapi/asm/errno.h +@@ -1,6 +1,7 @@ + #ifndef _ASM_POWERPC_ERRNO_H + #define _ASM_POWERPC_ERRNO_H + ++#undef EDEADLOCK + #include + + #undef EDEADLOCK +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index a7f229e598926..90d1f2bfb0071 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -366,14 +366,11 @@ static inline unsigned long eeh_token_to_phys(unsigned long token) + pa = pte_pfn(*ptep); + + /* On radix we can do hugepage mappings for io, so handle that */ +- if (hugepage_shift) { +- pa <<= hugepage_shift; +- pa |= token & ((1ul << hugepage_shift) - 1); +- } else { +- pa <<= PAGE_SHIFT; +- pa |= token & (PAGE_SIZE - 1); +- } ++ if (!hugepage_shift) ++ hugepage_shift = PAGE_SHIFT; + ++ pa <<= PAGE_SHIFT; ++ pa |= token & ((1ul << hugepage_shift) - 1); + return pa; + } + +diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c +index 9bfdd2510fd5e..2cf900d165273 100644 +--- a/arch/powerpc/kernel/iommu.c ++++ b/arch/powerpc/kernel/iommu.c +@@ -1021,7 +1021,7 @@ int iommu_take_ownership(struct iommu_table *tbl) + + spin_lock_irqsave(&tbl->large_pool.lock, flags); + for (i = 0; i < tbl->nr_pools; i++) +- spin_lock(&tbl->pools[i].lock); ++ spin_lock_nest_lock(&tbl->pools[i].lock, &tbl->large_pool.lock); + + if (tbl->it_offset == 0) + clear_bit(0, tbl->it_map); +@@ -1050,7 +1050,7 @@ void iommu_release_ownership(struct iommu_table *tbl) + + spin_lock_irqsave(&tbl->large_pool.lock, flags); + for (i = 0; i < tbl->nr_pools; i++) +- spin_lock(&tbl->pools[i].lock); ++ spin_lock_nest_lock(&tbl->pools[i].lock, &tbl->large_pool.lock); + + memset(tbl->it_map, 0, sz); + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index b868f07c4246c..11b4ecec04eeb 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -262,7 +262,7 @@ static struct feature_property { + }; + + #if defined(CONFIG_44x) && defined(CONFIG_PPC_FPU) +-static inline void identical_pvr_fixup(unsigned long node) ++static __init void identical_pvr_fixup(unsigned long node) + { + unsigned int pvr; + const char *model = of_get_flat_dt_prop(node, "model", NULL); +diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c +index 446810e37b0cc..777a90e251cc2 100644 +--- a/arch/powerpc/lib/feature-fixups.c ++++ b/arch/powerpc/lib/feature-fixups.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -282,8 +283,9 @@ void do_uaccess_flush_fixups(enum l1d_flush_type types) + : "unknown"); + } + +-void do_entry_flush_fixups(enum l1d_flush_type types) ++static int __do_entry_flush_fixups(void *data) + { ++ enum l1d_flush_type types = *(enum l1d_flush_type *)data; + unsigned int instrs[3], *dest; + long *start, *end; + int i; +@@ -334,6 +336,19 @@ void do_entry_flush_fixups(enum l1d_flush_type types) + : "ori type" : + (types & L1D_FLUSH_MTTRIG) ? "mttrig type" + : "unknown"); ++ ++ return 0; ++} ++ ++void do_entry_flush_fixups(enum l1d_flush_type types) ++{ ++ /* ++ * The call to the fallback flush can not be safely patched in/out while ++ * other CPUs are executing it. So call __do_entry_flush_fixups() on one ++ * CPU while all other CPUs spin in the stop machine core with interrupts ++ * hard disabled. ++ */ ++ stop_machine(__do_entry_flush_fixups, &types, NULL); + } + + void do_rfi_flush_fixups(enum l1d_flush_type types) +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c +index 7592a6491a9a2..2d3557406424e 100644 +--- a/arch/powerpc/perf/isa207-common.c ++++ b/arch/powerpc/perf/isa207-common.c +@@ -139,8 +139,8 @@ ebb_bhrb: + * EBB events are pinned & exclusive, so this should never actually + * hit, but we leave it as a fallback in case. + */ +- mask |= CNST_EBB_VAL(ebb); +- value |= CNST_EBB_MASK; ++ mask |= CNST_EBB_MASK; ++ value |= CNST_EBB_VAL(ebb); + + *maskp = mask; + *valp = value; +diff --git a/arch/powerpc/platforms/52xx/lite5200_sleep.S b/arch/powerpc/platforms/52xx/lite5200_sleep.S +index 08ab6fefcf7a6..5f44e92234137 100644 +--- a/arch/powerpc/platforms/52xx/lite5200_sleep.S ++++ b/arch/powerpc/platforms/52xx/lite5200_sleep.S +@@ -180,7 +180,7 @@ sram_code: + udelay: /* r11 - tb_ticks_per_usec, r12 - usecs, overwrites r13 */ + mullw r12, r12, r11 + mftb r13 /* start */ +- addi r12, r13, r12 /* end */ ++ add r12, r13, r12 /* end */ + 1: + mftb r13 /* current */ + cmp cr0, r13, r12 +diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c +index 7a2beedb97403..a7d9dd0298507 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c ++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c +@@ -92,9 +92,6 @@ static void rtas_stop_self(void) + + BUG_ON(rtas_stop_self_token == RTAS_UNKNOWN_SERVICE); + +- printk("cpu %u (hwid %u) Ready to die...\n", +- smp_processor_id(), hard_smp_processor_id()); +- + rtas_call_unlocked(&args, rtas_stop_self_token, 0, 1, NULL); + + panic("Alas, I survived.\n"); +diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c +index 547fd13e4f8e8..35d035d68dce0 100644 +--- a/arch/powerpc/platforms/pseries/pci_dlpar.c ++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c +@@ -66,6 +66,7 @@ EXPORT_SYMBOL_GPL(init_phb_dynamic); + int remove_phb_dynamic(struct pci_controller *phb) + { + struct pci_bus *b = phb->bus; ++ struct pci_host_bridge *host_bridge = to_pci_host_bridge(b->bridge); + struct resource *res; + int rc, i; + +@@ -92,7 +93,8 @@ int remove_phb_dynamic(struct pci_controller *phb) + /* Remove the PCI bus and unregister the bridge device from sysfs */ + phb->bus = NULL; + pci_remove_bus(b); +- device_unregister(b->bridge); ++ host_bridge->bus = NULL; ++ device_unregister(&host_bridge->dev); + + /* Now release the IO resource */ + if (res->flags & IORESOURCE_IO) +diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c +index f9dca1aed9a4b..17b3e82415f89 100644 +--- a/arch/s390/kernel/dis.c ++++ b/arch/s390/kernel/dis.c +@@ -2026,7 +2026,7 @@ void show_code(struct pt_regs *regs) + + void print_fn_code(unsigned char *code, unsigned long len) + { +- char buffer[64], *ptr; ++ char buffer[128], *ptr; + int opsize, i; + + while (len) { +diff --git a/arch/um/kernel/dyn.lds.S b/arch/um/kernel/dyn.lds.S +index 4fdbcf958cd5a..558e5258dfff9 100644 +--- a/arch/um/kernel/dyn.lds.S ++++ b/arch/um/kernel/dyn.lds.S +@@ -6,6 +6,12 @@ OUTPUT_ARCH(ELF_ARCH) + ENTRY(_start) + jiffies = jiffies_64; + ++VERSION { ++ { ++ local: *; ++ }; ++} ++ + SECTIONS + { + PROVIDE (__executable_start = START); +diff --git a/arch/um/kernel/uml.lds.S b/arch/um/kernel/uml.lds.S +index 1840f55ed0420..f544b8c13c2e9 100644 +--- a/arch/um/kernel/uml.lds.S ++++ b/arch/um/kernel/uml.lds.S +@@ -6,6 +6,12 @@ OUTPUT_ARCH(ELF_ARCH) + ENTRY(_start) + jiffies = jiffies_64; + ++VERSION { ++ { ++ local: *; ++ }; ++} ++ + SECTIONS + { + /* This must contain the right address - not quite the default ELF one.*/ +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 80636caee07cc..3ce5b5bd1dc45 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -495,6 +495,7 @@ config X86_UV + depends on X86_EXTENDED_PLATFORM + depends on NUMA + depends on EFI ++ depends on KEXEC_CORE + depends on X86_X2APIC + depends on PCI + ---help--- +diff --git a/arch/x86/Makefile b/arch/x86/Makefile +index 9ebbd4892557e..0bc35e3e6c5cd 100644 +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -40,6 +40,7 @@ REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -ffreestanding + REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -fno-stack-protector) + REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), -Wno-address-of-packed-member) + REALMODE_CFLAGS += $(call __cc-option, $(CC), $(REALMODE_CFLAGS), $(cc_stack_align4)) ++REALMODE_CFLAGS += $(CLANG_FLAGS) + export REALMODE_CFLAGS + + # BITS is used as extension for files which are available in a 32 bit +diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c +index b28200dea715c..2bbf3fba80972 100644 +--- a/arch/x86/events/amd/iommu.c ++++ b/arch/x86/events/amd/iommu.c +@@ -80,12 +80,12 @@ static struct attribute_group amd_iommu_format_group = { + * sysfs events attributes + *---------------------------------------------*/ + struct amd_iommu_event_desc { +- struct kobj_attribute attr; ++ struct device_attribute attr; + const char *event; + }; + +-static ssize_t _iommu_event_show(struct kobject *kobj, +- struct kobj_attribute *attr, char *buf) ++static ssize_t _iommu_event_show(struct device *dev, ++ struct device_attribute *attr, char *buf) + { + struct amd_iommu_event_desc *event = + container_of(attr, struct amd_iommu_event_desc, attr); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 98fb3a7240371..b945f362771fa 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6268,6 +6268,7 @@ void kvm_arch_exit(void) + cpuhp_remove_state_nocalls(CPUHP_AP_X86_KVM_CLK_ONLINE); + #ifdef CONFIG_X86_64 + pvclock_gtod_unregister_notifier(&pvclock_gtod_notifier); ++ cancel_work_sync(&pvclock_gtod_work); + #endif + kvm_x86_ops = NULL; + kvm_mmu_module_exit(); +diff --git a/arch/x86/lib/msr-smp.c b/arch/x86/lib/msr-smp.c +index ce68b6a9d7d1e..e28c106a7c0ce 100644 +--- a/arch/x86/lib/msr-smp.c ++++ b/arch/x86/lib/msr-smp.c +@@ -239,7 +239,7 @@ static void __wrmsr_safe_regs_on_cpu(void *info) + rv->err = wrmsr_safe_regs(rv->regs); + } + +-int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs) ++int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8]) + { + int err; + struct msr_regs_info rv; +@@ -252,7 +252,7 @@ int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs) + } + EXPORT_SYMBOL(rdmsr_safe_regs_on_cpu); + +-int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs) ++int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8]) + { + int err; + struct msr_regs_info rv; +diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c +index 435bd0ffc8c02..ea4c7c93a9209 100644 +--- a/drivers/acpi/custom_method.c ++++ b/drivers/acpi/custom_method.c +@@ -37,6 +37,8 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, + sizeof(struct acpi_table_header))) + return -EFAULT; + uncopied_bytes = max_size = table.length; ++ /* make sure the buf is not allocated */ ++ kfree(buf); + buf = kzalloc(max_size, GFP_KERNEL); + if (!buf) + return -ENOMEM; +@@ -50,6 +52,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, + (*ppos + count < count) || + (count > uncopied_bytes)) { + kfree(buf); ++ buf = NULL; + return -EINVAL; + } + +@@ -71,7 +74,6 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, + add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE); + } + +- kfree(buf); + return count; + } + +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index d749fe20fbfc5..89ce7b14a1660 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -704,6 +704,7 @@ int acpi_device_add(struct acpi_device *device, + + result = acpi_device_set_name(device, acpi_device_bus_id); + if (result) { ++ kfree_const(acpi_device_bus_id->bus_id); + kfree(acpi_device_bus_id); + goto err_unlock; + } +diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c +index 0b80502bc1c51..bfa2e5eec2635 100644 +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -518,11 +518,13 @@ int ahci_platform_init_host(struct platform_device *pdev, + int i, irq, n_ports, rc; + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) { ++ if (irq < 0) { + if (irq != -EPROBE_DEFER) + dev_err(dev, "no irq\n"); + return irq; + } ++ if (!irq) ++ return -EINVAL; + + hpriv->irq = irq; + +diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c +index b4d54771c9fe0..623199fab8fe0 100644 +--- a/drivers/ata/pata_arasan_cf.c ++++ b/drivers/ata/pata_arasan_cf.c +@@ -819,12 +819,19 @@ static int arasan_cf_probe(struct platform_device *pdev) + else + quirk = CF_BROKEN_UDMA; /* as it is on spear1340 */ + +- /* if irq is 0, support only PIO */ +- acdev->irq = platform_get_irq(pdev, 0); +- if (acdev->irq) ++ /* ++ * If there's an error getting IRQ (or we do get IRQ0), ++ * support only PIO ++ */ ++ ret = platform_get_irq(pdev, 0); ++ if (ret > 0) { ++ acdev->irq = ret; + irq_handler = arasan_cf_interrupt; +- else ++ } else if (ret == -EPROBE_DEFER) { ++ return ret; ++ } else { + quirk |= CF_BROKEN_MWDMA | CF_BROKEN_UDMA; ++ } + + acdev->pbase = res->start; + acdev->vbase = devm_ioremap_nocache(&pdev->dev, res->start, +diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c +index abda441835122..fb8d1f68f36f7 100644 +--- a/drivers/ata/pata_ixp4xx_cf.c ++++ b/drivers/ata/pata_ixp4xx_cf.c +@@ -169,8 +169,12 @@ static int ixp4xx_pata_probe(struct platform_device *pdev) + return -ENOMEM; + + irq = platform_get_irq(pdev, 0); +- if (irq) ++ if (irq > 0) + irq_set_irq_type(irq, IRQ_TYPE_EDGE_RISING); ++ else if (irq < 0) ++ return irq; ++ else ++ return -EINVAL; + + /* Setup expansion bus chip selects */ + *data->cs0_cfg = data->cs0_bits; +diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c +index 513ef298dd960..ded3a66049d2c 100644 +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -4112,6 +4112,10 @@ static int mv_platform_probe(struct platform_device *pdev) + n_ports = mv_platform_data->n_ports; + irq = platform_get_irq(pdev, 0); + } ++ if (irq < 0) ++ return irq; ++ if (!irq) ++ return -EINVAL; + + host = ata_host_alloc_pinfo(&pdev->dev, ppi, n_ports); + hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL); +diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c +index a6444244c4111..bfb67aa00becc 100644 +--- a/drivers/bus/qcom-ebi2.c ++++ b/drivers/bus/qcom-ebi2.c +@@ -357,8 +357,10 @@ static int qcom_ebi2_probe(struct platform_device *pdev) + + /* Figure out the chipselect */ + ret = of_property_read_u32(child, "reg", &csindex); +- if (ret) ++ if (ret) { ++ of_node_put(child); + return ret; ++ } + + if (csindex > 5) { + dev_err(dev, +diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c +index 774748497aced..e56ac5adb5fcc 100644 +--- a/drivers/char/ttyprintk.c ++++ b/drivers/char/ttyprintk.c +@@ -159,12 +159,23 @@ static int tpk_ioctl(struct tty_struct *tty, + return 0; + } + ++/* ++ * TTY operations hangup function. ++ */ ++static void tpk_hangup(struct tty_struct *tty) ++{ ++ struct ttyprintk_port *tpkp = tty->driver_data; ++ ++ tty_port_hangup(&tpkp->port); ++} ++ + static const struct tty_operations ttyprintk_ops = { + .open = tpk_open, + .close = tpk_close, + .write = tpk_write, + .write_room = tpk_write_room, + .ioctl = tpk_ioctl, ++ .hangup = tpk_hangup, + }; + + static const struct tty_port_operations null_ops = { }; +diff --git a/drivers/clk/samsung/clk-exynos7.c b/drivers/clk/samsung/clk-exynos7.c +index bbfa57b4e0176..17dfd4f130cae 100644 +--- a/drivers/clk/samsung/clk-exynos7.c ++++ b/drivers/clk/samsung/clk-exynos7.c +@@ -541,8 +541,13 @@ static const struct samsung_gate_clock top1_gate_clks[] __initconst = { + GATE(CLK_ACLK_FSYS0_200, "aclk_fsys0_200", "dout_aclk_fsys0_200", + ENABLE_ACLK_TOP13, 28, CLK_SET_RATE_PARENT | + CLK_IS_CRITICAL, 0), ++ /* ++ * This clock is required for the CMU_FSYS1 registers access, keep it ++ * enabled permanently until proper runtime PM support is added. ++ */ + GATE(CLK_ACLK_FSYS1_200, "aclk_fsys1_200", "dout_aclk_fsys1_200", +- ENABLE_ACLK_TOP13, 24, CLK_SET_RATE_PARENT, 0), ++ ENABLE_ACLK_TOP13, 24, CLK_SET_RATE_PARENT | ++ CLK_IS_CRITICAL, 0), + + GATE(CLK_SCLK_PHY_FSYS1_26M, "sclk_phy_fsys1_26m", + "dout_sclk_phy_fsys1_26m", ENABLE_SCLK_TOP1_FSYS11, +diff --git a/drivers/clk/socfpga/clk-gate-a10.c b/drivers/clk/socfpga/clk-gate-a10.c +index c2d5727481671..7913dbedba89b 100644 +--- a/drivers/clk/socfpga/clk-gate-a10.c ++++ b/drivers/clk/socfpga/clk-gate-a10.c +@@ -157,6 +157,7 @@ static void __init __socfpga_gate_init(struct device_node *node, + if (IS_ERR(socfpga_clk->sys_mgr_base_addr)) { + pr_err("%s: failed to find altr,sys-mgr regmap!\n", + __func__); ++ kfree(socfpga_clk); + return; + } + } +diff --git a/drivers/clk/uniphier/clk-uniphier-mux.c b/drivers/clk/uniphier/clk-uniphier-mux.c +index 2c243a894f3b9..3a52ab968ac24 100644 +--- a/drivers/clk/uniphier/clk-uniphier-mux.c ++++ b/drivers/clk/uniphier/clk-uniphier-mux.c +@@ -40,10 +40,10 @@ static int uniphier_clk_mux_set_parent(struct clk_hw *hw, u8 index) + static u8 uniphier_clk_mux_get_parent(struct clk_hw *hw) + { + struct uniphier_clk_mux *mux = to_uniphier_clk_mux(hw); +- int num_parents = clk_hw_get_num_parents(hw); ++ unsigned int num_parents = clk_hw_get_num_parents(hw); + int ret; + unsigned int val; +- u8 i; ++ unsigned int i; + + ret = regmap_read(mux->regmap, mux->reg, &val); + if (ret) +diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +index 0dd8d2dc2ec1b..26931325dfa26 100644 +--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c +@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto out_err_free_reg; + +- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); +- + ret = adf_dev_init(accel_dev); + if (ret) + goto out_err_dev_shutdown; + ++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); ++ + ret = adf_dev_start(accel_dev); + if (ret) + goto out_err_dev_stop; +diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c +index cd9e63468b189..722a06aac9faa 100644 +--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c +@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto out_err_free_reg; + +- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); +- + ret = adf_dev_init(accel_dev); + if (ret) + goto out_err_dev_shutdown; + ++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); ++ + ret = adf_dev_start(accel_dev); + if (ret) + goto out_err_dev_stop; +diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c +index 06d49017a52b7..2c0be14309cfa 100644 +--- a/drivers/crypto/qat/qat_common/adf_isr.c ++++ b/drivers/crypto/qat/qat_common/adf_isr.c +@@ -330,19 +330,32 @@ int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev) + + ret = adf_isr_alloc_msix_entry_table(accel_dev); + if (ret) +- return ret; +- if (adf_enable_msix(accel_dev)) + goto err_out; + +- if (adf_setup_bh(accel_dev)) +- goto err_out; ++ ret = adf_enable_msix(accel_dev); ++ if (ret) ++ goto err_free_msix_table; + +- if (adf_request_irqs(accel_dev)) +- goto err_out; ++ ret = adf_setup_bh(accel_dev); ++ if (ret) ++ goto err_disable_msix; ++ ++ ret = adf_request_irqs(accel_dev); ++ if (ret) ++ goto err_cleanup_bh; + + return 0; ++ ++err_cleanup_bh: ++ adf_cleanup_bh(accel_dev); ++ ++err_disable_msix: ++ adf_disable_msix(&accel_dev->accel_pci_dev); ++ ++err_free_msix_table: ++ adf_isr_free_msix_entry_table(accel_dev); ++ + err_out: +- adf_isr_resource_free(accel_dev); +- return -EFAULT; ++ return ret; + } + EXPORT_SYMBOL_GPL(adf_isr_resource_alloc); +diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c +index 57d2622728a57..4c0067f8c079f 100644 +--- a/drivers/crypto/qat/qat_common/adf_transport.c ++++ b/drivers/crypto/qat/qat_common/adf_transport.c +@@ -197,6 +197,7 @@ static int adf_init_ring(struct adf_etr_ring_data *ring) + dev_err(&GET_DEV(accel_dev), "Ring address not aligned\n"); + dma_free_coherent(&GET_DEV(accel_dev), ring_size_bytes, + ring->base_addr, ring->dma_addr); ++ ring->base_addr = NULL; + return -EFAULT; + } + +diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c +index bf99e11a3403d..4c1217ba83ae8 100644 +--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c ++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c +@@ -304,17 +304,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev) + goto err_out; + + if (adf_setup_pf2vf_bh(accel_dev)) +- goto err_out; ++ goto err_disable_msi; + + if (adf_setup_bh(accel_dev)) +- goto err_out; ++ goto err_cleanup_pf2vf_bh; + + if (adf_request_msi_irq(accel_dev)) +- goto err_out; ++ goto err_cleanup_bh; + + return 0; ++ ++err_cleanup_bh: ++ adf_cleanup_bh(accel_dev); ++ ++err_cleanup_pf2vf_bh: ++ adf_cleanup_pf2vf_bh(accel_dev); ++ ++err_disable_msi: ++ adf_disable_msi(accel_dev); ++ + err_out: +- adf_vf_isr_resource_free(accel_dev); + return -EFAULT; + } + EXPORT_SYMBOL_GPL(adf_vf_isr_resource_alloc); +diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +index 15de9cbed3bf8..cc3f5171a5233 100644 +--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c ++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c +@@ -238,12 +238,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto out_err_free_reg; + +- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); +- + ret = adf_dev_init(accel_dev); + if (ret) + goto out_err_dev_shutdown; + ++ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); ++ + ret = adf_dev_start(accel_dev); + if (ret) + goto out_err_dev_stop; +diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c +index 4c0b6df8b5ddb..1d06d99b8bd92 100644 +--- a/drivers/extcon/extcon-arizona.c ++++ b/drivers/extcon/extcon-arizona.c +@@ -601,7 +601,7 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data) + struct arizona *arizona = info->arizona; + int id_gpio = arizona->pdata.hpdet_id_gpio; + unsigned int report = EXTCON_JACK_HEADPHONE; +- int ret, reading; ++ int ret, reading, state; + bool mic = false; + + mutex_lock(&info->lock); +@@ -614,12 +614,11 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data) + } + + /* If the cable was removed while measuring ignore the result */ +- ret = extcon_get_state(info->edev, EXTCON_MECHANICAL); +- if (ret < 0) { +- dev_err(arizona->dev, "Failed to check cable state: %d\n", +- ret); ++ state = extcon_get_state(info->edev, EXTCON_MECHANICAL); ++ if (state < 0) { ++ dev_err(arizona->dev, "Failed to check cable state: %d\n", state); + goto out; +- } else if (!ret) { ++ } else if (!state) { + dev_dbg(arizona->dev, "Ignoring HPDET for removed cable\n"); + goto done; + } +@@ -672,7 +671,7 @@ done: + ARIZONA_ACCDET_MODE_MASK, ARIZONA_ACCDET_MODE_MIC); + + /* If we have a mic then reenable MICDET */ +- if (mic || info->mic) ++ if (state && (mic || info->mic)) + arizona_start_mic(info); + + if (info->hpdet_active) { +@@ -680,7 +679,9 @@ done: + info->hpdet_active = false; + } + +- info->hpdet_done = true; ++ /* Do not set hp_det done when the cable has been unplugged */ ++ if (state) ++ info->hpdet_done = true; + + out: + mutex_unlock(&info->lock); +diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig +index 854df538ae01e..1fc29fca27c89 100644 +--- a/drivers/firmware/Kconfig ++++ b/drivers/firmware/Kconfig +@@ -194,6 +194,7 @@ config FW_CFG_SYSFS_CMDLINE + config QCOM_SCM + bool + depends on ARM || ARM64 ++ depends on HAVE_ARM_SMCCC + select RESET_CONTROLLER + + config QCOM_SCM_32 +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 80c60a62d39ef..7271e3f32d82e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -652,7 +652,7 @@ static void amdgpu_ttm_tt_unpin_userptr(struct ttm_tt *ttm) + DMA_BIDIRECTIONAL : DMA_TO_DEVICE; + + /* double check that we don't free the table twice */ +- if (!ttm->sg->sgl) ++ if (!ttm->sg || !ttm->sg->sgl) + return; + + /* free the sg table and pages again */ +diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c +index c627ab6d00617..8ac54b9dcd392 100644 +--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c ++++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cmd_encoder.c +@@ -128,9 +128,17 @@ static int pingpong_tearcheck_setup(struct drm_encoder *encoder, + | MDP5_PP_SYNC_CONFIG_VSYNC_IN_EN; + cfg |= MDP5_PP_SYNC_CONFIG_VSYNC_COUNT(vclks_line); + ++ /* ++ * Tearcheck emits a blanking signal every vclks_line * vtotal * 2 ticks on ++ * the vsync_clk equating to roughly half the desired panel refresh rate. ++ * This is only necessary as stability fallback if interrupts from the ++ * panel arrive too late or not at all, but is currently used by default ++ * because these panel interrupts are not wired up yet. ++ */ + mdp5_write(mdp5_kms, REG_MDP5_PP_SYNC_CONFIG_VSYNC(pp_id), cfg); + mdp5_write(mdp5_kms, +- REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), 0xfff0); ++ REG_MDP5_PP_SYNC_CONFIG_HEIGHT(pp_id), (2 * mode->vtotal)); ++ + mdp5_write(mdp5_kms, + REG_MDP5_PP_VSYNC_INIT_VAL(pp_id), mode->vdisplay); + mdp5_write(mdp5_kms, REG_MDP5_PP_RD_PTR_IRQ(pp_id), mode->vdisplay + 1); +diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c +index 5df3ec73021b5..0bfbced3862e6 100644 +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -2259,10 +2259,10 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev) + rdev->pm.default_power_state_index = state_index - 1; + rdev->pm.power_state[state_index - 1].default_clock_mode = + &rdev->pm.power_state[state_index - 1].clock_info[0]; +- rdev->pm.power_state[state_index].flags &= ++ rdev->pm.power_state[state_index - 1].flags &= + ~RADEON_PM_STATE_SINGLE_DISPLAY_ONLY; +- rdev->pm.power_state[state_index].misc = 0; +- rdev->pm.power_state[state_index].misc2 = 0; ++ rdev->pm.power_state[state_index - 1].misc = 0; ++ rdev->pm.power_state[state_index - 1].misc2 = 0; + } + return state_index; + } +diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c +index 96d2a564d9a3c..61000e3b2e793 100644 +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -506,6 +506,7 @@ static int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file + *value = rdev->config.si.backend_enable_mask; + } else { + DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n"); ++ return -EINVAL; + } + break; + case RADEON_INFO_MAX_SCLK: +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index c4a53fc648e95..1f641870d860d 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -816,6 +816,7 @@ + #define USB_DEVICE_ID_ORTEK_WKB2000 0x2000 + + #define USB_VENDOR_ID_PLANTRONICS 0x047f ++#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES 0xc056 + + #define USB_VENDOR_ID_PANASONIC 0x04da + #define USB_DEVICE_ID_PANABOARD_UBT780 0x1044 +diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c +index 584b10d3fc3d8..460711c1124ac 100644 +--- a/drivers/hid/hid-plantronics.c ++++ b/drivers/hid/hid-plantronics.c +@@ -16,6 +16,7 @@ + + #include + #include ++#include + + #define PLT_HID_1_0_PAGE 0xffa00000 + #define PLT_HID_2_0_PAGE 0xffa20000 +@@ -39,6 +40,16 @@ + #define PLT_ALLOW_CONSUMER (field->application == HID_CP_CONSUMERCONTROL && \ + (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER) + ++#define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0) ++ ++#define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */ ++ ++struct plt_drv_data { ++ unsigned long device_type; ++ unsigned long last_volume_key_ts; ++ u32 quirks; ++}; ++ + static int plantronics_input_mapping(struct hid_device *hdev, + struct hid_input *hi, + struct hid_field *field, +@@ -46,7 +57,8 @@ static int plantronics_input_mapping(struct hid_device *hdev, + unsigned long **bit, int *max) + { + unsigned short mapped_key; +- unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev); ++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev); ++ unsigned long plt_type = drv_data->device_type; + + /* special case for PTT products */ + if (field->application == HID_GD_JOYSTICK) +@@ -108,6 +120,30 @@ mapped: + return 1; + } + ++static int plantronics_event(struct hid_device *hdev, struct hid_field *field, ++ struct hid_usage *usage, __s32 value) ++{ ++ struct plt_drv_data *drv_data = hid_get_drvdata(hdev); ++ ++ if (drv_data->quirks & PLT_QUIRK_DOUBLE_VOLUME_KEYS) { ++ unsigned long prev_ts, cur_ts; ++ ++ /* Usages are filtered in plantronics_usages. */ ++ ++ if (!value) /* Handle key presses only. */ ++ return 0; ++ ++ prev_ts = drv_data->last_volume_key_ts; ++ cur_ts = jiffies; ++ if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_DOUBLE_KEY_TIMEOUT) ++ return 1; /* Ignore the repeated key. */ ++ ++ drv_data->last_volume_key_ts = cur_ts; ++ } ++ ++ return 0; ++} ++ + static unsigned long plantronics_device_type(struct hid_device *hdev) + { + unsigned i, col_page; +@@ -136,15 +172,24 @@ exit: + static int plantronics_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { ++ struct plt_drv_data *drv_data; + int ret; + ++ drv_data = devm_kzalloc(&hdev->dev, sizeof(*drv_data), GFP_KERNEL); ++ if (!drv_data) ++ return -ENOMEM; ++ + ret = hid_parse(hdev); + if (ret) { + hid_err(hdev, "parse failed\n"); + goto err; + } + +- hid_set_drvdata(hdev, (void *)plantronics_device_type(hdev)); ++ drv_data->device_type = plantronics_device_type(hdev); ++ drv_data->quirks = id->driver_data; ++ drv_data->last_volume_key_ts = jiffies - msecs_to_jiffies(PLT_DOUBLE_KEY_TIMEOUT); ++ ++ hid_set_drvdata(hdev, drv_data); + + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT | + HID_CONNECT_HIDINPUT_FORCE | HID_CONNECT_HIDDEV_FORCE); +@@ -156,15 +201,26 @@ err: + } + + static const struct hid_device_id plantronics_devices[] = { ++ { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, ++ USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES), ++ .driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS }, + { HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) }, + { } + }; + MODULE_DEVICE_TABLE(hid, plantronics_devices); + ++static const struct hid_usage_id plantronics_usages[] = { ++ { HID_CP_VOLUMEUP, EV_KEY, HID_ANY_ID }, ++ { HID_CP_VOLUMEDOWN, EV_KEY, HID_ANY_ID }, ++ { HID_TERMINATOR, HID_TERMINATOR, HID_TERMINATOR } ++}; ++ + static struct hid_driver plantronics_driver = { + .name = "plantronics", + .id_table = plantronics_devices, ++ .usage_table = plantronics_usages, + .input_mapping = plantronics_input_mapping, ++ .event = plantronics_event, + .probe = plantronics_probe, + }; + module_hid_driver(plantronics_driver); +diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c +index c2a2a9795b0ba..e9d63b966caff 100644 +--- a/drivers/hsi/hsi_core.c ++++ b/drivers/hsi/hsi_core.c +@@ -223,8 +223,6 @@ static void hsi_add_client_from_dt(struct hsi_port *port, + if (err) + goto err; + +- dev_set_name(&cl->device, "%s", name); +- + err = hsi_of_property_parse_mode(client, "hsi-mode", &mode); + if (err) { + err = hsi_of_property_parse_mode(client, "hsi-rx-mode", +@@ -307,6 +305,7 @@ static void hsi_add_client_from_dt(struct hsi_port *port, + cl->device.release = hsi_client_release; + cl->device.of_node = client; + ++ dev_set_name(&cl->device, "%s", name); + if (device_register(&cl->device) < 0) { + pr_err("hsi: failed to register client: %s\n", name); + put_device(&cl->device); +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 7bf5e2fe17516..60c122b355ea5 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -675,6 +675,12 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type) + channel->target_vp = hv_context.vp_index[cur_cpu]; + } + ++#define UNLOAD_DELAY_UNIT_MS 10 /* 10 milliseconds */ ++#define UNLOAD_WAIT_MS (100*1000) /* 100 seconds */ ++#define UNLOAD_WAIT_LOOPS (UNLOAD_WAIT_MS/UNLOAD_DELAY_UNIT_MS) ++#define UNLOAD_MSG_MS (5*1000) /* Every 5 seconds */ ++#define UNLOAD_MSG_LOOPS (UNLOAD_MSG_MS/UNLOAD_DELAY_UNIT_MS) ++ + static void vmbus_wait_for_unload(void) + { + int cpu; +@@ -692,12 +698,17 @@ static void vmbus_wait_for_unload(void) + * vmbus_connection.unload_event. If not, the last thing we can do is + * read message pages for all CPUs directly. + * +- * Wait no more than 10 seconds so that the panic path can't get +- * hung forever in case the response message isn't seen. ++ * Wait up to 100 seconds since an Azure host must writeback any dirty ++ * data in its disk cache before the VMbus UNLOAD request will ++ * complete. This flushing has been empirically observed to take up ++ * to 50 seconds in cases with a lot of dirty data, so allow additional ++ * leeway and for inaccuracies in mdelay(). But eventually time out so ++ * that the panic path can't get hung forever in case the response ++ * message isn't seen. + */ +- for (i = 0; i < 1000; i++) { ++ for (i = 1; i <= UNLOAD_WAIT_LOOPS; i++) { + if (completion_done(&vmbus_connection.unload_event)) +- break; ++ goto completed; + + for_each_online_cpu(cpu) { + page_addr = hv_context.synic_message_page[cpu]; +@@ -717,9 +728,18 @@ static void vmbus_wait_for_unload(void) + vmbus_signal_eom(msg, message_type); + } + +- mdelay(10); ++ /* ++ * Give a notice periodically so someone watching the ++ * serial output won't think it is completely hung. ++ */ ++ if (!(i % UNLOAD_MSG_LOOPS)) ++ pr_notice("Waiting for VMBus UNLOAD to complete\n"); ++ ++ mdelay(UNLOAD_DELAY_UNIT_MS); + } ++ pr_err("Continuing even though VMBus UNLOAD did not complete\n"); + ++completed: + /* + * We're crashing and already got the UNLOAD_RESPONSE, cleanup all + * maybe-pending messages on all CPUs to be able to receive new +diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c +index 98a4cb5d49938..9c236c88bc7b9 100644 +--- a/drivers/hwtracing/intel_th/gth.c ++++ b/drivers/hwtracing/intel_th/gth.c +@@ -485,7 +485,7 @@ static void intel_th_gth_disable(struct intel_th_device *thdev, + output->active = false; + + for_each_set_bit(master, gth->output[output->port].master, +- TH_CONFIGURABLE_MASTERS) { ++ TH_CONFIGURABLE_MASTERS + 1) { + gth_master_set(gth, master, -1); + } + spin_unlock(>h->gth_lock); +@@ -605,7 +605,7 @@ static void intel_th_gth_unassign(struct intel_th_device *thdev, + othdev->output.port = -1; + othdev->output.active = false; + gth->output[port].output = NULL; +- for (master = 0; master <= TH_CONFIGURABLE_MASTERS; master++) ++ for (master = 0; master < TH_CONFIGURABLE_MASTERS + 1; master++) + if (gth->master[master] == port) + gth->master[master] = -1; + spin_unlock(>h->gth_lock); +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index 45d6771fac8ce..23ee1a4236545 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -908,7 +908,10 @@ static int cdns_i2c_probe(struct platform_device *pdev) + if (IS_ERR(id->membase)) + return PTR_ERR(id->membase); + +- id->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; ++ id->irq = ret; + + id->adap.owner = THIS_MODULE; + id->adap.dev.of_node = pdev->dev.of_node; +diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c +index 0218ba6eb26ab..ad33c1e3a30fe 100644 +--- a/drivers/i2c/busses/i2c-emev2.c ++++ b/drivers/i2c/busses/i2c-emev2.c +@@ -398,7 +398,10 @@ static int em_i2c_probe(struct platform_device *pdev) + + em_i2c_reset(&priv->adap); + +- priv->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto err_clk; ++ priv->irq = ret; + ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0, + "em_i2c", priv); + if (ret) +diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c +index 41ca9ff7b5da7..4dd800c0db14a 100644 +--- a/drivers/i2c/busses/i2c-jz4780.c ++++ b/drivers/i2c/busses/i2c-jz4780.c +@@ -760,7 +760,10 @@ static int jz4780_i2c_probe(struct platform_device *pdev) + + jz4780_i2c_writew(i2c, JZ4780_I2C_INTM, 0x0); + +- i2c->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto err; ++ i2c->irq = ret; + ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0, + dev_name(&pdev->dev), i2c); + if (ret) +diff --git a/drivers/i2c/busses/i2c-sh7760.c b/drivers/i2c/busses/i2c-sh7760.c +index c2005c789d2b0..319d1fa617c88 100644 +--- a/drivers/i2c/busses/i2c-sh7760.c ++++ b/drivers/i2c/busses/i2c-sh7760.c +@@ -471,7 +471,10 @@ static int sh7760_i2c_probe(struct platform_device *pdev) + goto out2; + } + +- id->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto out3; ++ id->irq = ret; + + id->adap.nr = pdev->id; + id->adap.algo = &sh7760_i2c_algo; +diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +index 3141c3c161bb4..46e969a3a9b7e 100644 +--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c ++++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +@@ -166,6 +166,7 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg) + ret = lidar_write_control(data, LIDAR_REG_CONTROL_ACQUIRE); + if (ret < 0) { + dev_err(&client->dev, "cannot send start measurement command"); ++ pm_runtime_put_noidle(&client->dev); + return ret; + } + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_pble.c b/drivers/infiniband/hw/i40iw/i40iw_pble.c +index 85993dc44f6e6..3fbf7a3b00de9 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_pble.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_pble.c +@@ -399,12 +399,9 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev, + i40iw_debug(dev, I40IW_DEBUG_PBLE, "next_fpm_addr = %llx chunk_size[%u] = 0x%x\n", + pble_rsrc->next_fpm_addr, chunk->size, chunk->size); + pble_rsrc->unallocated_pble -= (chunk->size >> 3); +- list_add(&chunk->list, &pble_rsrc->pinfo.clist); + sd_reg_val = (sd_entry_type == I40IW_SD_TYPE_PAGED) ? + sd_entry->u.pd_table.pd_page_addr.pa : sd_entry->u.bp.addr.pa; +- if (sd_entry->valid) +- return 0; +- if (dev->is_pf) { ++ if (dev->is_pf && !sd_entry->valid) { + ret_code = i40iw_hmc_sd_one(dev, hmc_info->hmc_fn_id, + sd_reg_val, idx->sd_idx, + sd_entry->entry_type, true); +@@ -415,6 +412,7 @@ static enum i40iw_status_code add_pble_pool(struct i40iw_sc_dev *dev, + } + + sd_entry->valid = true; ++ list_add(&chunk->list, &pble_rsrc->pinfo.clist); + return 0; + error: + kfree(chunk); +diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c +index 867772878c0c8..3350c0190c4ac 100644 +--- a/drivers/input/touchscreen/silead.c ++++ b/drivers/input/touchscreen/silead.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -317,10 +318,8 @@ static int silead_ts_get_id(struct i2c_client *client) + + error = i2c_smbus_read_i2c_block_data(client, SILEAD_REG_ID, + sizeof(chip_id), (u8 *)&chip_id); +- if (error < 0) { +- dev_err(&client->dev, "Chip ID read error %d\n", error); ++ if (error < 0) + return error; +- } + + data->chip_id = le32_to_cpu(chip_id); + dev_info(&client->dev, "Silead chip ID: 0x%8X", data->chip_id); +@@ -333,12 +332,49 @@ static int silead_ts_setup(struct i2c_client *client) + int error; + u32 status; + ++ /* ++ * Some buggy BIOS-es bring up the chip in a stuck state where it ++ * blocks the I2C bus. The following steps are necessary to ++ * unstuck the chip / bus: ++ * 1. Turn off the Silead chip. ++ * 2. Try to do an I2C transfer with the chip, this will fail in ++ * response to which the I2C-bus-driver will call: ++ * i2c_recover_bus() which will unstuck the I2C-bus. Note the ++ * unstuck-ing of the I2C bus only works if we first drop the ++ * chip off the bus by turning it off. ++ * 3. Turn the chip back on. ++ * ++ * On the x86/ACPI systems were this problem is seen, step 1. and ++ * 3. require making ACPI calls and dealing with ACPI Power ++ * Resources. The workaround below runtime-suspends the chip to ++ * turn it off, leaving it up to the ACPI subsystem to deal with ++ * this. ++ */ ++ ++ if (device_property_read_bool(&client->dev, ++ "silead,stuck-controller-bug")) { ++ pm_runtime_set_active(&client->dev); ++ pm_runtime_enable(&client->dev); ++ pm_runtime_allow(&client->dev); ++ ++ pm_runtime_suspend(&client->dev); ++ ++ dev_warn(&client->dev, FW_BUG "Stuck I2C bus: please ignore the next 'controller timed out' error\n"); ++ silead_ts_get_id(client); ++ ++ /* The forbid will also resume the device */ ++ pm_runtime_forbid(&client->dev); ++ pm_runtime_disable(&client->dev); ++ } ++ + silead_ts_set_power(client, SILEAD_POWER_OFF); + silead_ts_set_power(client, SILEAD_POWER_ON); + + error = silead_ts_get_id(client); +- if (error) ++ if (error) { ++ dev_err(&client->dev, "Chip ID read error %d\n", error); + return error; ++ } + + error = silead_ts_init(client); + if (error) +diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c +index d15347de415a6..9de62c3b8bf9f 100644 +--- a/drivers/isdn/capi/kcapi.c ++++ b/drivers/isdn/capi/kcapi.c +@@ -845,7 +845,7 @@ EXPORT_SYMBOL(capi20_put_message); + * Return value: CAPI result code + */ + +-u16 capi20_get_manufacturer(u32 contr, u8 *buf) ++u16 capi20_get_manufacturer(u32 contr, u8 buf[CAPI_MANUFACTURER_LEN]) + { + struct capi_ctr *ctr; + u16 ret; +@@ -915,7 +915,7 @@ EXPORT_SYMBOL(capi20_get_version); + * Return value: CAPI result code + */ + +-u16 capi20_get_serial(u32 contr, u8 *serial) ++u16 capi20_get_serial(u32 contr, u8 serial[CAPI_SERIAL_LEN]) + { + struct capi_ctr *ctr; + u16 ret; +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index 836a2808c0c71..eb2659a123108 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -524,7 +524,7 @@ static int list_devices(struct dm_ioctl *param, size_t param_size) + * Grab our output buffer. + */ + nl = get_result_buffer(param, param_size, &len); +- if (len < needed) { ++ if (len < needed || len < sizeof(nl->dev)) { + param->flags |= DM_BUFFER_FULL_FLAG; + goto out; + } +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index ba7c4c685db39..dcde657e08252 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -1009,6 +1009,7 @@ out_tag_set: + blk_mq_free_tag_set(md->tag_set); + out_kfree_tag_set: + kfree(md->tag_set); ++ md->tag_set = NULL; + + return err; + } +@@ -1018,6 +1019,7 @@ void dm_mq_cleanup_mapped_device(struct mapped_device *md) + if (md->tag_set) { + blk_mq_free_tag_set(md->tag_set); + kfree(md->tag_set); ++ md->tag_set = NULL; + } + } + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 0bfb77f8503d2..98c72dd56a2d4 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -508,6 +508,17 @@ void mddev_init(struct mddev *mddev) + } + EXPORT_SYMBOL_GPL(mddev_init); + ++static struct mddev *mddev_find_locked(dev_t unit) ++{ ++ struct mddev *mddev; ++ ++ list_for_each_entry(mddev, &all_mddevs, all_mddevs) ++ if (mddev->unit == unit) ++ return mddev; ++ ++ return NULL; ++} ++ + static struct mddev *mddev_find(dev_t unit) + { + struct mddev *mddev, *new = NULL; +@@ -519,13 +530,13 @@ static struct mddev *mddev_find(dev_t unit) + spin_lock(&all_mddevs_lock); + + if (unit) { +- list_for_each_entry(mddev, &all_mddevs, all_mddevs) +- if (mddev->unit == unit) { +- mddev_get(mddev); +- spin_unlock(&all_mddevs_lock); +- kfree(new); +- return mddev; +- } ++ mddev = mddev_find_locked(unit); ++ if (mddev) { ++ mddev_get(mddev); ++ spin_unlock(&all_mddevs_lock); ++ kfree(new); ++ return mddev; ++ } + + if (new) { + list_add(&new->all_mddevs, &all_mddevs); +@@ -551,12 +562,7 @@ static struct mddev *mddev_find(dev_t unit) + return NULL; + } + +- is_free = 1; +- list_for_each_entry(mddev, &all_mddevs, all_mddevs) +- if (mddev->unit == dev) { +- is_free = 0; +- break; +- } ++ is_free = !mddev_find_locked(dev); + } + new->unit = dev; + new->md_minor = MINOR(dev); +@@ -7106,8 +7112,7 @@ static int md_open(struct block_device *bdev, fmode_t mode) + /* Wait until bdev->bd_disk is definitely gone */ + if (work_pending(&mddev->del_work)) + flush_workqueue(md_misc_wq); +- /* Then retry the open from the top */ +- return -ERESTARTSYS; ++ return -EBUSY; + } + BUG_ON(mddev != bdev->bd_disk->private_data); + +@@ -8462,11 +8467,11 @@ void md_check_recovery(struct mddev *mddev) + } + + if (mddev_is_clustered(mddev)) { +- struct md_rdev *rdev; ++ struct md_rdev *rdev, *tmp; + /* kick the device if another node issued a + * remove disk. + */ +- rdev_for_each(rdev, mddev) { ++ rdev_for_each_safe(rdev, tmp, mddev) { + if (test_and_clear_bit(ClusterRemove, &rdev->flags) && + rdev->raid_disk < 0) + md_kick_rdev_from_array(rdev); +@@ -8775,12 +8780,12 @@ err_wq: + static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev) + { + struct mdp_superblock_1 *sb = page_address(rdev->sb_page); +- struct md_rdev *rdev2; ++ struct md_rdev *rdev2, *tmp; + int role, ret; + char b[BDEVNAME_SIZE]; + + /* Check for change of roles in the active devices */ +- rdev_for_each(rdev2, mddev) { ++ rdev_for_each_safe(rdev2, tmp, mddev) { + if (test_bit(Faulty, &rdev2->flags)) + continue; + +diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h +index a240990a7f333..5673f8eb5f88f 100644 +--- a/drivers/md/persistent-data/dm-btree-internal.h ++++ b/drivers/md/persistent-data/dm-btree-internal.h +@@ -34,12 +34,12 @@ struct node_header { + __le32 max_entries; + __le32 value_size; + __le32 padding; +-} __packed; ++} __attribute__((packed, aligned(8))); + + struct btree_node { + struct node_header header; + __le64 keys[0]; +-} __packed; ++} __attribute__((packed, aligned(8))); + + + /* +diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c +index 22729fd92a1b9..ca09ad2a639c4 100644 +--- a/drivers/md/persistent-data/dm-space-map-common.c ++++ b/drivers/md/persistent-data/dm-space-map-common.c +@@ -337,6 +337,8 @@ int sm_ll_find_free_block(struct ll_disk *ll, dm_block_t begin, + */ + begin = do_div(index_begin, ll->entries_per_block); + end = do_div(end, ll->entries_per_block); ++ if (end == 0) ++ end = ll->entries_per_block; + + for (i = index_begin; i < index_end; i++, begin = 0) { + struct dm_block *blk; +diff --git a/drivers/md/persistent-data/dm-space-map-common.h b/drivers/md/persistent-data/dm-space-map-common.h +index 8de63ce39bdd5..87e17909ef521 100644 +--- a/drivers/md/persistent-data/dm-space-map-common.h ++++ b/drivers/md/persistent-data/dm-space-map-common.h +@@ -33,7 +33,7 @@ struct disk_index_entry { + __le64 blocknr; + __le32 nr_free; + __le32 none_free_before; +-} __packed; ++} __attribute__ ((packed, aligned(8))); + + + #define MAX_METADATA_BITMAPS 255 +@@ -43,7 +43,7 @@ struct disk_metadata_index { + __le64 blocknr; + + struct disk_index_entry index[MAX_METADATA_BITMAPS]; +-} __packed; ++} __attribute__ ((packed, aligned(8))); + + struct ll_disk; + +@@ -86,7 +86,7 @@ struct disk_sm_root { + __le64 nr_allocated; + __le64 bitmap_root; + __le64 ref_count_root; +-} __packed; ++} __attribute__ ((packed, aligned(8))); + + #define ENTRIES_PER_BYTE 4 + +@@ -94,7 +94,7 @@ struct disk_bitmap_header { + __le32 csum; + __le32 not_used; + __le64 blocknr; +-} __packed; ++} __attribute__ ((packed, aligned(8))); + + enum allocation_event { + SM_NONE, +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index a1cc1c1e53182..fb1284051d054 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -216,6 +216,7 @@ static void dvb_media_device_free(struct dvb_device *dvbdev) + + if (dvbdev->adapter->conn) { + media_device_unregister_entity(dvbdev->adapter->conn); ++ kfree(dvbdev->adapter->conn); + dvbdev->adapter->conn = NULL; + kfree(dvbdev->adapter->conn_pads); + dvbdev->adapter->conn_pads = NULL; +diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c +index b87c9e7ff146f..e81c4cca50c63 100644 +--- a/drivers/media/i2c/adv7511-v4l2.c ++++ b/drivers/media/i2c/adv7511-v4l2.c +@@ -1976,7 +1976,7 @@ static int adv7511_remove(struct i2c_client *client) + + adv7511_set_isr(sd, false); + adv7511_init_setup(sd); +- cancel_delayed_work(&state->edid_handler); ++ cancel_delayed_work_sync(&state->edid_handler); + i2c_unregister_device(state->i2c_edid); + if (state->i2c_cec) + i2c_unregister_device(state->i2c_cec); +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index ce6f93074ae0d..56b8b7bf759e5 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -3541,7 +3541,7 @@ static int adv76xx_remove(struct i2c_client *client) + io_write(sd, 0x6e, 0); + io_write(sd, 0x73, 0); + +- cancel_delayed_work(&state->delayed_work_enable_hotplug); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); + v4l2_async_unregister_subdev(sd); + media_entity_cleanup(&sd->entity); + adv76xx_unregister_clients(to_state(sd)); +diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c +index cf3b42c9417e7..d7af4fbcb84b3 100644 +--- a/drivers/media/i2c/adv7842.c ++++ b/drivers/media/i2c/adv7842.c +@@ -3598,7 +3598,7 @@ static int adv7842_remove(struct i2c_client *client) + struct adv7842_state *state = to_state(sd); + + adv7842_irq_enable(sd, false); +- cancel_delayed_work(&state->delayed_work_enable_hotplug); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); + v4l2_device_unregister_subdev(sd); + media_entity_cleanup(&sd->entity); + adv7842_unregister_clients(sd); +diff --git a/drivers/media/pci/saa7164/saa7164-encoder.c b/drivers/media/pci/saa7164/saa7164-encoder.c +index 32a353d162e79..f2e6fbfa019fd 100644 +--- a/drivers/media/pci/saa7164/saa7164-encoder.c ++++ b/drivers/media/pci/saa7164/saa7164-encoder.c +@@ -1030,7 +1030,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + "(errno = %d), NO PCI configuration\n", + __func__, result); + result = -ENOMEM; +- goto failed; ++ goto fail_pci; + } + + /* Establish encoder defaults here */ +@@ -1084,7 +1084,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + 100000, ENCODER_DEF_BITRATE); + if (hdl->error) { + result = hdl->error; +- goto failed; ++ goto fail_hdl; + } + + port->std = V4L2_STD_NTSC_M; +@@ -1102,7 +1102,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + printk(KERN_INFO "%s: can't allocate mpeg device\n", + dev->name); + result = -ENOMEM; +- goto failed; ++ goto fail_hdl; + } + + port->v4l_device->ctrl_handler = hdl; +@@ -1113,10 +1113,7 @@ int saa7164_encoder_register(struct saa7164_port *port) + if (result < 0) { + printk(KERN_INFO "%s: can't register mpeg device\n", + dev->name); +- /* TODO: We're going to leak here if we don't dealloc +- The buffers above. The unreg function can't deal wit it. +- */ +- goto failed; ++ goto fail_reg; + } + + printk(KERN_INFO "%s: registered device video%d [mpeg]\n", +@@ -1138,9 +1135,14 @@ int saa7164_encoder_register(struct saa7164_port *port) + + saa7164_api_set_encoder(port); + saa7164_api_get_encoder(port); ++ return 0; + +- result = 0; +-failed: ++fail_reg: ++ video_device_release(port->v4l_device); ++ port->v4l_device = NULL; ++fail_hdl: ++ v4l2_ctrl_handler_free(hdl); ++fail_pci: + return result; + } + +diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c +index 8fed2fbe91a98..f78caf72cb3e4 100644 +--- a/drivers/media/platform/vivid/vivid-vid-out.c ++++ b/drivers/media/platform/vivid/vivid-vid-out.c +@@ -1003,7 +1003,7 @@ int vivid_vid_out_s_fbuf(struct file *file, void *fh, + return -EINVAL; + } + dev->fbuf_out_flags &= ~(chroma_flags | alpha_flags); +- dev->fbuf_out_flags = a->flags & (chroma_flags | alpha_flags); ++ dev->fbuf_out_flags |= a->flags & (chroma_flags | alpha_flags); + return 0; + } + +diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c +index 63165d324fffd..7d3e50d94d86a 100644 +--- a/drivers/media/rc/ite-cir.c ++++ b/drivers/media/rc/ite-cir.c +@@ -292,8 +292,14 @@ static irqreturn_t ite_cir_isr(int irq, void *data) + /* read the interrupt flags */ + iflags = dev->params.get_irq_causes(dev); + ++ /* Check for RX overflow */ ++ if (iflags & ITE_IRQ_RX_FIFO_OVERRUN) { ++ dev_warn(&dev->rdev->dev, "receive overflow\n"); ++ ir_raw_event_reset(dev->rdev); ++ } ++ + /* check for the receive interrupt */ +- if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) { ++ if (iflags & ITE_IRQ_RX_FIFO) { + /* read the FIFO bytes */ + rx_bytes = + dev->params.get_rx_bytes(dev, rx_buf, +diff --git a/drivers/media/tuners/m88rs6000t.c b/drivers/media/tuners/m88rs6000t.c +index 9f3e0fd4cad9f..d4443f9c9fa37 100644 +--- a/drivers/media/tuners/m88rs6000t.c ++++ b/drivers/media/tuners/m88rs6000t.c +@@ -534,7 +534,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) + PGA2_cri = PGA2_GC >> 2; + PGA2_crf = PGA2_GC & 0x03; + +- for (i = 0; i <= RF_GC; i++) ++ for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++) + RFG += RFGS[i]; + + if (RF_GC == 0) +@@ -546,12 +546,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) + if (RF_GC == 3) + RFG += 100; + +- for (i = 0; i <= IF_GC; i++) ++ for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++) + IFG += IFGS[i]; + + TIAG = TIA_GC * TIA_GS; + +- for (i = 0; i <= BB_GC; i++) ++ for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++) + BBG += BBGS[i]; + + PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS; +diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c +index b3413404f91a5..690c1e06fbfac 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c ++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c +@@ -82,11 +82,17 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + } + } + +- if ((ret = dvb_usb_adapter_stream_init(adap)) || +- (ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) || +- (ret = dvb_usb_adapter_frontend_init(adap))) { ++ ret = dvb_usb_adapter_stream_init(adap); ++ if (ret) + return ret; +- } ++ ++ ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs); ++ if (ret) ++ goto dvb_init_err; ++ ++ ret = dvb_usb_adapter_frontend_init(adap); ++ if (ret) ++ goto frontend_init_err; + + /* use exclusive FE lock if there is multiple shared FEs */ + if (adap->fe_adap[1].fe) +@@ -106,6 +112,12 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + } + + return 0; ++ ++frontend_init_err: ++ dvb_usb_adapter_dvb_exit(adap); ++dvb_init_err: ++ dvb_usb_adapter_stream_exit(adap); ++ return ret; + } + + static int dvb_usb_adapter_exit(struct dvb_usb_device *d) +diff --git a/drivers/media/usb/dvb-usb/dvb-usb.h b/drivers/media/usb/dvb-usb/dvb-usb.h +index 107255b08b2b1..704d57e3ea1c1 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb.h ++++ b/drivers/media/usb/dvb-usb/dvb-usb.h +@@ -471,7 +471,8 @@ extern int dvb_usb_generic_rw(struct dvb_usb_device *, u8 *, u16, u8 *, u16,int) + extern int dvb_usb_generic_write(struct dvb_usb_device *, u8 *, u16); + + /* commonly used remote control parsing */ +-extern int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *, u8[], u32 *, int *); ++int dvb_usb_nec_rc_key_to_event(struct dvb_usb_device *d, u8 keybuf[5], ++ u32 *event, int *state); + + /* commonly used firmware download types and function */ + struct hexline { +diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c +index b0aea48907b71..7e259be472522 100644 +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -1967,6 +1967,7 @@ ret: + return result; + + out_free: ++ em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE); + kfree(dvb); + dev->dvb = NULL; + goto ret; +diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c +index d239075a6a65f..79f1e8904e30f 100644 +--- a/drivers/media/usb/gspca/gspca.c ++++ b/drivers/media/usb/gspca/gspca.c +@@ -2146,6 +2146,8 @@ out: + #endif + v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler); + v4l2_device_unregister(&gspca_dev->v4l2_dev); ++ if (sd_desc->probe_error) ++ sd_desc->probe_error(gspca_dev); + kfree(gspca_dev->usb_buf); + kfree(gspca_dev); + return ret; +diff --git a/drivers/media/usb/gspca/gspca.h b/drivers/media/usb/gspca/gspca.h +index d39adf90303b9..bec8fccc2c949 100644 +--- a/drivers/media/usb/gspca/gspca.h ++++ b/drivers/media/usb/gspca/gspca.h +@@ -101,6 +101,7 @@ struct sd_desc { + cam_cf_op config; /* called on probe */ + cam_op init; /* called on probe and resume */ + cam_op init_controls; /* called on probe */ ++ cam_v_op probe_error; /* called if probe failed, do cleanup here */ + cam_op start; /* called on stream on after URBs creation */ + cam_pkt_op pkt_scan; + /* optional operations */ +diff --git a/drivers/media/usb/gspca/sq905.c b/drivers/media/usb/gspca/sq905.c +index a7ae0ec9fa919..03322d2b2e829 100644 +--- a/drivers/media/usb/gspca/sq905.c ++++ b/drivers/media/usb/gspca/sq905.c +@@ -172,7 +172,7 @@ static int + sq905_read_data(struct gspca_dev *gspca_dev, u8 *data, int size, int need_lock) + { + int ret; +- int act_len; ++ int act_len = 0; + + gspca_dev->usb_buf[0] = '\0'; + if (need_lock) +diff --git a/drivers/media/usb/gspca/stv06xx/stv06xx.c b/drivers/media/usb/gspca/stv06xx/stv06xx.c +index 7d255529ed4c1..40d4c99debb88 100644 +--- a/drivers/media/usb/gspca/stv06xx/stv06xx.c ++++ b/drivers/media/usb/gspca/stv06xx/stv06xx.c +@@ -541,12 +541,21 @@ static int sd_int_pkt_scan(struct gspca_dev *gspca_dev, + static int stv06xx_config(struct gspca_dev *gspca_dev, + const struct usb_device_id *id); + ++static void stv06xx_probe_error(struct gspca_dev *gspca_dev) ++{ ++ struct sd *sd = (struct sd *)gspca_dev; ++ ++ kfree(sd->sensor_priv); ++ sd->sensor_priv = NULL; ++} ++ + /* sub-driver description */ + static const struct sd_desc sd_desc = { + .name = MODULE_NAME, + .config = stv06xx_config, + .init = stv06xx_init, + .init_controls = stv06xx_init_controls, ++ .probe_error = stv06xx_probe_error, + .start = stv06xx_start, + .stopN = stv06xx_stopN, + .pkt_scan = stv06xx_pkt_scan, +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c +index a9d47c06f80f3..4af2f5b231dd4 100644 +--- a/drivers/memory/omap-gpmc.c ++++ b/drivers/memory/omap-gpmc.c +@@ -1028,8 +1028,8 @@ EXPORT_SYMBOL(gpmc_cs_request); + + void gpmc_cs_free(int cs) + { +- struct gpmc_cs_data *gpmc = &gpmc_cs[cs]; +- struct resource *res = &gpmc->mem; ++ struct gpmc_cs_data *gpmc; ++ struct resource *res; + + spin_lock(&gpmc_mem_lock); + if (cs >= gpmc_cs_num || cs < 0 || !gpmc_cs_reserved(cs)) { +@@ -1038,6 +1038,9 @@ void gpmc_cs_free(int cs) + spin_unlock(&gpmc_mem_lock); + return; + } ++ gpmc = &gpmc_cs[cs]; ++ res = &gpmc->mem; ++ + gpmc_cs_disable_mem(cs); + if (res->flags) + release_resource(res); +diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c +index fc8cb855c6e66..e4249ce2c42f4 100644 +--- a/drivers/misc/kgdbts.c ++++ b/drivers/misc/kgdbts.c +@@ -105,19 +105,19 @@ + #include + #include + +-#define v1printk(a...) do { \ +- if (verbose) \ +- printk(KERN_INFO a); \ +- } while (0) +-#define v2printk(a...) do { \ +- if (verbose > 1) \ +- printk(KERN_INFO a); \ +- touch_nmi_watchdog(); \ +- } while (0) +-#define eprintk(a...) do { \ +- printk(KERN_ERR a); \ +- WARN_ON(1); \ +- } while (0) ++#define v1printk(a...) do { \ ++ if (verbose) \ ++ printk(KERN_INFO a); \ ++} while (0) ++#define v2printk(a...) do { \ ++ if (verbose > 1) \ ++ printk(KERN_INFO a); \ ++ touch_nmi_watchdog(); \ ++} while (0) ++#define eprintk(a...) do { \ ++ printk(KERN_ERR a); \ ++ WARN_ON(1); \ ++} while (0) + #define MAX_CONFIG_LEN 40 + + static struct kgdb_io kgdbts_io_ops; +diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c +index fb8705fc3aca7..205dc5d40ce61 100644 +--- a/drivers/misc/lis3lv02d/lis3lv02d.c ++++ b/drivers/misc/lis3lv02d/lis3lv02d.c +@@ -220,7 +220,7 @@ static int lis3_3dc_rates[16] = {0, 1, 10, 25, 50, 100, 200, 400, 1600, 5000}; + static int lis3_3dlh_rates[4] = {50, 100, 400, 1000}; + + /* ODR is Output Data Rate */ +-static int lis3lv02d_get_odr(struct lis3lv02d *lis3) ++static int lis3lv02d_get_odr_index(struct lis3lv02d *lis3) + { + u8 ctrl; + int shift; +@@ -228,15 +228,23 @@ static int lis3lv02d_get_odr(struct lis3lv02d *lis3) + lis3->read(lis3, CTRL_REG1, &ctrl); + ctrl &= lis3->odr_mask; + shift = ffs(lis3->odr_mask) - 1; +- return lis3->odrs[(ctrl >> shift)]; ++ return (ctrl >> shift); + } + + static int lis3lv02d_get_pwron_wait(struct lis3lv02d *lis3) + { +- int div = lis3lv02d_get_odr(lis3); ++ int odr_idx = lis3lv02d_get_odr_index(lis3); ++ int div = lis3->odrs[odr_idx]; + +- if (WARN_ONCE(div == 0, "device returned spurious data")) ++ if (div == 0) { ++ if (odr_idx == 0) { ++ /* Power-down mode, not sampling no need to sleep */ ++ return 0; ++ } ++ ++ dev_err(&lis3->pdev->dev, "Error unknown odrs-index: %d\n", odr_idx); + return -ENXIO; ++ } + + /* LIS3 power on delay is quite long */ + msleep(lis3->pwron_delay / div); +@@ -819,9 +827,12 @@ static ssize_t lis3lv02d_rate_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct lis3lv02d *lis3 = dev_get_drvdata(dev); ++ int odr_idx; + + lis3lv02d_sysfs_poweron(lis3); +- return sprintf(buf, "%d\n", lis3lv02d_get_odr(lis3)); ++ ++ odr_idx = lis3lv02d_get_odr_index(lis3); ++ return sprintf(buf, "%d\n", lis3->odrs[odr_idx]); + } + + static ssize_t lis3lv02d_rate_set(struct device *dev, +diff --git a/drivers/misc/vmw_vmci/vmci_doorbell.c b/drivers/misc/vmw_vmci/vmci_doorbell.c +index f005206d9033b..4581210349d29 100644 +--- a/drivers/misc/vmw_vmci/vmci_doorbell.c ++++ b/drivers/misc/vmw_vmci/vmci_doorbell.c +@@ -334,7 +334,7 @@ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle) + bool vmci_dbell_register_notification_bitmap(u32 bitmap_ppn) + { + int result; +- struct vmci_notify_bm_set_msg bitmap_set_msg; ++ struct vmci_notify_bm_set_msg bitmap_set_msg = { }; + + bitmap_set_msg.hdr.dst = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID, + VMCI_SET_NOTIFY_BITMAP); +diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c +index 189b325197488..9ac3659a55377 100644 +--- a/drivers/misc/vmw_vmci/vmci_guest.c ++++ b/drivers/misc/vmw_vmci/vmci_guest.c +@@ -172,7 +172,7 @@ static int vmci_check_host_caps(struct pci_dev *pdev) + VMCI_UTIL_NUM_RESOURCES * sizeof(u32); + struct vmci_datagram *check_msg; + +- check_msg = kmalloc(msg_size, GFP_KERNEL); ++ check_msg = kzalloc(msg_size, GFP_KERNEL); + if (!check_msg) { + dev_err(&pdev->dev, "%s: Insufficient memory\n", __func__); + return -ENOMEM; +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index cff5829790c9e..b2c977d617c58 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -1691,7 +1691,7 @@ int mmc_set_signal_voltage(struct mmc_host *host, int signal_voltage, u32 ocr) + + err = mmc_wait_for_cmd(host, &cmd, 0); + if (err) +- return err; ++ goto power_cycle; + + if (!mmc_host_is_spi(host) && (cmd.resp[0] & R1_ERROR)) + return -EIO; +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index 7f654c714fffc..bb17027c283e9 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -136,6 +136,9 @@ static int mmc_decode_csd(struct mmc_card *card) + csd->erase_size = UNSTUFF_BITS(resp, 39, 7) + 1; + csd->erase_size <<= csd->write_blkbits - 9; + } ++ ++ if (UNSTUFF_BITS(resp, 13, 1)) ++ mmc_card_set_readonly(card); + break; + case 1: + /* +@@ -170,6 +173,9 @@ static int mmc_decode_csd(struct mmc_card *card) + csd->write_blkbits = 9; + csd->write_partial = 0; + csd->erase_size = 1; ++ ++ if (UNSTUFF_BITS(resp, 13, 1)) ++ mmc_card_set_readonly(card); + break; + default: + pr_err("%s: unrecognised CSD structure version %d\n", +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index 331183548bc58..b43b8edc18ec8 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -689,16 +689,12 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + case MEMGETINFO: + case MEMREADOOB: + case MEMREADOOB64: +- case MEMLOCK: +- case MEMUNLOCK: + case MEMISLOCKED: + case MEMGETOOBSEL: + case MEMGETBADBLOCK: +- case MEMSETBADBLOCK: + case OTPSELECT: + case OTPGETREGIONCOUNT: + case OTPGETREGIONINFO: +- case OTPLOCK: + case ECCGETLAYOUT: + case ECCGETSTATS: + case MTDFILEMODE: +@@ -709,9 +705,13 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg) + /* "dangerous" commands */ + case MEMERASE: + case MEMERASE64: ++ case MEMLOCK: ++ case MEMUNLOCK: ++ case MEMSETBADBLOCK: + case MEMWRITEOOB: + case MEMWRITEOOB64: + case MEMWRITE: ++ case OTPLOCK: + if (!(file->f_mode & FMODE_WRITE)) + return -EPERM; + break; +diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +index f4a99e91c2500..c43bd945d93a3 100644 +--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +@@ -2020,7 +2020,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this) + this->bch_geometry.auxiliary_size = 128; + ret = gpmi_alloc_dma_buffer(this); + if (ret) +- goto err_out; ++ return ret; + + ret = nand_scan_ident(mtd, GPMI_IS_MX6(this) ? 2 : 1, NULL); + if (ret) +diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h +index 03d79d95ab75f..d7e0d2ce15c11 100644 +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_regs.h +@@ -526,7 +526,7 @@ + #define CN23XX_BAR1_INDEX_OFFSET 3 + + #define CN23XX_PEM_BAR1_INDEX_REG(port, idx) \ +- (CN23XX_PEM_BAR1_INDEX_START + ((port) << CN23XX_PEM_OFFSET) + \ ++ (CN23XX_PEM_BAR1_INDEX_START + (((u64)port) << CN23XX_PEM_OFFSET) + \ + ((idx) << CN23XX_BAR1_INDEX_OFFSET)) + + /*############################ DPI #########################*/ +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +index 747ef08829763..8f3d544bec0c9 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c +@@ -537,7 +537,7 @@ static void nicvf_rcv_queue_config(struct nicvf *nic, struct queue_set *qs, + mbx.rq.msg = NIC_MBOX_MSG_RQ_CFG; + mbx.rq.qs_num = qs->vnic_id; + mbx.rq.rq_num = qidx; +- mbx.rq.cfg = (rq->caching << 26) | (rq->cq_qs << 19) | ++ mbx.rq.cfg = ((u64)rq->caching << 26) | (rq->cq_qs << 19) | + (rq->cq_idx << 16) | (rq->cont_rbdr_qs << 9) | + (rq->cont_qs_rbdr_idx << 8) | + (rq->start_rbdr_qs << 1) | (rq->start_qs_rbdr_idx); +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +index c150521647172..becfb54421cc2 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +@@ -2446,7 +2446,7 @@ do { \ + seq_printf(seq, "%-12s", s); \ + for (i = 0; i < n; ++i) \ + seq_printf(seq, " %16" fmt_spec, v); \ +- seq_putc(seq, '\n'); \ ++ seq_putc(seq, '\n'); \ + } while (0) + #define S(s, v) S3("s", s, v) + #define T3(fmt_spec, s, v) S3(fmt_spec, s, tx[i].v) +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index d10c8a8156bc2..5b072bf80783a 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -964,7 +964,7 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, + skb->protocol = eth_type_trans(skb, netdev); + + if (netdev->features & NETIF_F_HW_VLAN_CTAG_RX && +- RX_DMA_VID(trxd.rxd3)) ++ (trxd.rxd2 & RX_DMA_VTAG)) + __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), + RX_DMA_VID(trxd.rxd3)); + napi_gro_receive(napi, skb); +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h +index 99b1c8e9f16f9..2e7ccd8261c33 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h +@@ -272,6 +272,7 @@ + #define RX_DMA_DONE BIT(31) + #define RX_DMA_PLEN0(_x) (((_x) & 0x3fff) << 16) + #define RX_DMA_GET_PLEN0(_x) (((_x) >> 16) & 0x3fff) ++#define RX_DMA_VTAG BIT(15) + + /* QDMA descriptor rxd3 */ + #define RX_DMA_VID(_x) ((_x) & 0xfff) +diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c +index 9d223ff650711..882f2b7ec6d1f 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c +@@ -1504,6 +1504,7 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q, + { + struct emac_tpd tpd; + u32 prod_idx; ++ int len; + + memset(&tpd, 0, sizeof(tpd)); + +@@ -1523,9 +1524,10 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q, + if (skb_network_offset(skb) != ETH_HLEN) + TPD_TYP_SET(&tpd, 1); + ++ len = skb->len; + emac_tx_fill_tpd(adpt, tx_q, skb, &tpd); + +- netdev_sent_queue(adpt->netdev, skb->len); ++ netdev_sent_queue(adpt->netdev, len); + + /* Make sure the are enough free descriptors to hold one + * maximum-sized SKB. We need one desc for each fragment, +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +index 1924788d28da0..f4ff43a1b5ba0 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +@@ -363,6 +363,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) + plat_dat->bsp_priv = gmac; + plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed; + plat_dat->multicast_filter_bins = 0; ++ plat_dat->tx_fifo_size = 8192; ++ plat_dat->rx_fifo_size = 8192; + + err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); + if (err) +diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c +index 413cf14dbacd3..8b7596fef42a6 100644 +--- a/drivers/net/ethernet/ti/davinci_emac.c ++++ b/drivers/net/ethernet/ti/davinci_emac.c +@@ -183,11 +183,11 @@ static const char emac_version_string[] = "TI DaVinci EMAC Linux v6.1"; + /* EMAC mac_status register */ + #define EMAC_MACSTATUS_TXERRCODE_MASK (0xF00000) + #define EMAC_MACSTATUS_TXERRCODE_SHIFT (20) +-#define EMAC_MACSTATUS_TXERRCH_MASK (0x7) ++#define EMAC_MACSTATUS_TXERRCH_MASK (0x70000) + #define EMAC_MACSTATUS_TXERRCH_SHIFT (16) + #define EMAC_MACSTATUS_RXERRCODE_MASK (0xF000) + #define EMAC_MACSTATUS_RXERRCODE_SHIFT (12) +-#define EMAC_MACSTATUS_RXERRCH_MASK (0x7) ++#define EMAC_MACSTATUS_RXERRCH_MASK (0x700) + #define EMAC_MACSTATUS_RXERRCH_SHIFT (8) + + /* EMAC RX register masks */ +diff --git a/drivers/net/fddi/Kconfig b/drivers/net/fddi/Kconfig +index 3a424c864f4db..ecebeeb9b2a02 100644 +--- a/drivers/net/fddi/Kconfig ++++ b/drivers/net/fddi/Kconfig +@@ -28,17 +28,20 @@ config DEFXX + + config DEFXX_MMIO + bool +- prompt "Use MMIO instead of PIO" if PCI || EISA ++ prompt "Use MMIO instead of IOP" if PCI || EISA + depends on DEFXX +- default n if PCI || EISA ++ default n if EISA + default y + ---help--- + This instructs the driver to use EISA or PCI memory-mapped I/O +- (MMIO) as appropriate instead of programmed I/O ports (PIO). ++ (MMIO) as appropriate instead of programmed I/O ports (IOP). + Enabling this gives an improvement in processing time in parts +- of the driver, but it may cause problems with EISA (DEFEA) +- adapters. TURBOchannel does not have the concept of I/O ports, +- so MMIO is always used for these (DEFTA) adapters. ++ of the driver, but it requires a memory window to be configured ++ for EISA (DEFEA) adapters that may not always be available. ++ Conversely some PCIe host bridges do not support IOP, so MMIO ++ may be required to access PCI (DEFPA) adapters on downstream PCI ++ buses with some systems. TURBOchannel does not have the concept ++ of I/O ports, so MMIO is always used for these (DEFTA) adapters. + + If unsure, say N. + +diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c +index b0de8ecd7fe8e..bdcf4aa34566b 100644 +--- a/drivers/net/fddi/defxx.c ++++ b/drivers/net/fddi/defxx.c +@@ -495,6 +495,25 @@ static const struct net_device_ops dfx_netdev_ops = { + .ndo_set_mac_address = dfx_ctl_set_mac_address, + }; + ++static void dfx_register_res_alloc_err(const char *print_name, bool mmio, ++ bool eisa) ++{ ++ pr_err("%s: Cannot use %s, no address set, aborting\n", ++ print_name, mmio ? "MMIO" : "I/O"); ++ pr_err("%s: Recompile driver with \"CONFIG_DEFXX_MMIO=%c\"\n", ++ print_name, mmio ? 'n' : 'y'); ++ if (eisa && mmio) ++ pr_err("%s: Or run ECU and set adapter's MMIO location\n", ++ print_name); ++} ++ ++static void dfx_register_res_err(const char *print_name, bool mmio, ++ unsigned long start, unsigned long len) ++{ ++ pr_err("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, aborting\n", ++ print_name, mmio ? "MMIO" : "I/O", len, start); ++} ++ + /* + * ================ + * = dfx_register = +@@ -568,15 +587,12 @@ static int dfx_register(struct device *bdev) + dev_set_drvdata(bdev, dev); + + dfx_get_bars(bdev, bar_start, bar_len); +- if (dfx_bus_eisa && dfx_use_mmio && bar_start[0] == 0) { +- pr_err("%s: Cannot use MMIO, no address set, aborting\n", +- print_name); +- pr_err("%s: Run ECU and set adapter's MMIO location\n", +- print_name); +- pr_err("%s: Or recompile driver with \"CONFIG_DEFXX_MMIO=n\"" +- "\n", print_name); ++ if (bar_len[0] == 0 || ++ (dfx_bus_eisa && dfx_use_mmio && bar_start[0] == 0)) { ++ dfx_register_res_alloc_err(print_name, dfx_use_mmio, ++ dfx_bus_eisa); + err = -ENXIO; +- goto err_out; ++ goto err_out_disable; + } + + if (dfx_use_mmio) +@@ -585,18 +601,16 @@ static int dfx_register(struct device *bdev) + else + region = request_region(bar_start[0], bar_len[0], print_name); + if (!region) { +- pr_err("%s: Cannot reserve %s resource 0x%lx @ 0x%lx, " +- "aborting\n", dfx_use_mmio ? "MMIO" : "I/O", print_name, +- (long)bar_len[0], (long)bar_start[0]); ++ dfx_register_res_err(print_name, dfx_use_mmio, ++ bar_start[0], bar_len[0]); + err = -EBUSY; + goto err_out_disable; + } + if (bar_start[1] != 0) { + region = request_region(bar_start[1], bar_len[1], print_name); + if (!region) { +- pr_err("%s: Cannot reserve I/O resource " +- "0x%lx @ 0x%lx, aborting\n", print_name, +- (long)bar_len[1], (long)bar_start[1]); ++ dfx_register_res_err(print_name, 0, ++ bar_start[1], bar_len[1]); + err = -EBUSY; + goto err_out_csr_region; + } +@@ -604,9 +618,8 @@ static int dfx_register(struct device *bdev) + if (bar_start[2] != 0) { + region = request_region(bar_start[2], bar_len[2], print_name); + if (!region) { +- pr_err("%s: Cannot reserve I/O resource " +- "0x%lx @ 0x%lx, aborting\n", print_name, +- (long)bar_len[2], (long)bar_start[2]); ++ dfx_register_res_err(print_name, 0, ++ bar_start[2], bar_len[2]); + err = -EBUSY; + goto err_out_bh_region; + } +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 0434ecf677122..412a36f27de6d 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -307,12 +307,12 @@ static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + int ret; + + if (2 == size) { +- u16 buf; ++ u16 buf = 0; + ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0); + le16_to_cpus(&buf); + *((u16 *)data) = buf; + } else if (4 == size) { +- u32 buf; ++ u32 buf = 0; + ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0); + le32_to_cpus(&buf); + *((u32 *)data) = buf; +diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c +index 666bbacb8cb49..24daa1d0e9c58 100644 +--- a/drivers/net/wan/lapbether.c ++++ b/drivers/net/wan/lapbether.c +@@ -56,6 +56,8 @@ struct lapbethdev { + struct list_head node; + struct net_device *ethdev; /* link to ethernet device */ + struct net_device *axdev; /* lapbeth device (lapb#) */ ++ bool up; ++ spinlock_t up_lock; /* Protects "up" */ + }; + + static LIST_HEAD(lapbeth_devices); +@@ -103,8 +105,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe + rcu_read_lock(); + lapbeth = lapbeth_get_x25_dev(dev); + if (!lapbeth) +- goto drop_unlock; +- if (!netif_running(lapbeth->axdev)) ++ goto drop_unlock_rcu; ++ spin_lock_bh(&lapbeth->up_lock); ++ if (!lapbeth->up) + goto drop_unlock; + + len = skb->data[0] + skb->data[1] * 256; +@@ -119,11 +122,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe + goto drop_unlock; + } + out: ++ spin_unlock_bh(&lapbeth->up_lock); + rcu_read_unlock(); + return 0; + drop_unlock: + kfree_skb(skb); + goto out; ++drop_unlock_rcu: ++ rcu_read_unlock(); + drop: + kfree_skb(skb); + return 0; +@@ -151,13 +157,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb) + static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + +- /* +- * Just to be *really* sure not to send anything if the interface +- * is down, the ethernet device may have gone. +- */ +- if (!netif_running(dev)) ++ spin_lock_bh(&lapbeth->up_lock); ++ if (!lapbeth->up) + goto drop; + + /* There should be a pseudo header of 1 byte added by upper layers. +@@ -188,6 +192,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, + goto drop; + } + out: ++ spin_unlock_bh(&lapbeth->up_lock); + return NETDEV_TX_OK; + drop: + kfree_skb(skb); +@@ -279,6 +284,7 @@ static const struct lapb_register_struct lapbeth_callbacks = { + */ + static int lapbeth_open(struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + + if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) { +@@ -286,13 +292,22 @@ static int lapbeth_open(struct net_device *dev) + return -ENODEV; + } + ++ spin_lock_bh(&lapbeth->up_lock); ++ lapbeth->up = true; ++ spin_unlock_bh(&lapbeth->up_lock); ++ + return 0; + } + + static int lapbeth_close(struct net_device *dev) + { ++ struct lapbethdev *lapbeth = netdev_priv(dev); + int err; + ++ spin_lock_bh(&lapbeth->up_lock); ++ lapbeth->up = false; ++ spin_unlock_bh(&lapbeth->up_lock); ++ + if ((err = lapb_unregister(dev)) != LAPB_OK) + pr_err("lapb_unregister error: %d\n", err); + +@@ -350,6 +365,9 @@ static int lapbeth_new_device(struct net_device *dev) + dev_hold(dev); + lapbeth->ethdev = dev; + ++ lapbeth->up = false; ++ spin_lock_init(&lapbeth->up_lock); ++ + rc = -EIO; + if (register_netdevice(ndev)) + goto fail; +diff --git a/drivers/net/wimax/i2400m/op-rfkill.c b/drivers/net/wimax/i2400m/op-rfkill.c +index dc6fe93ce71f6..e8473047b2d1e 100644 +--- a/drivers/net/wimax/i2400m/op-rfkill.c ++++ b/drivers/net/wimax/i2400m/op-rfkill.c +@@ -101,7 +101,7 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev, + if (cmd == NULL) + goto error_alloc; + cmd->hdr.type = cpu_to_le16(I2400M_MT_CMD_RF_CONTROL); +- cmd->hdr.length = sizeof(cmd->sw_rf); ++ cmd->hdr.length = cpu_to_le16(sizeof(cmd->sw_rf)); + cmd->hdr.version = cpu_to_le16(I2400M_L3L4_VERSION); + cmd->sw_rf.hdr.type = cpu_to_le16(I2400M_TLV_RF_OPERATION); + cmd->sw_rf.hdr.length = cpu_to_le16(sizeof(cmd->sw_rf.status)); +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index 15a0036dcc6ee..09d737f3461b2 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -246,7 +246,7 @@ static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset) + if (unlikely(r)) { + ath_dbg(common, WMI, "REGISTER READ FAILED: (0x%04x, %d)\n", + reg_offset, r); +- return -EIO; ++ return -1; + } + + return be32_to_cpu(val); +diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c +index e7fca78cdd964..9d664398a41b2 100644 +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -285,7 +285,7 @@ static bool ath9k_hw_read_revisions(struct ath_hw *ah) + + srev = REG_READ(ah, AR_SREV); + +- if (srev == -EIO) { ++ if (srev == -1) { + ath_err(ath9k_hw_common(ah), + "Failed to read SREV register"); + return false; +diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_wx.c b/drivers/net/wireless/intel/ipw2x00/libipw_wx.c +index dd29f46d086b2..028b37ba9425d 100644 +--- a/drivers/net/wireless/intel/ipw2x00/libipw_wx.c ++++ b/drivers/net/wireless/intel/ipw2x00/libipw_wx.c +@@ -649,8 +649,10 @@ int libipw_wx_set_encodeext(struct libipw_device *ieee, + } + + if (ext->alg != IW_ENCODE_ALG_NONE) { +- memcpy(sec.keys[idx], ext->key, ext->key_len); +- sec.key_sizes[idx] = ext->key_len; ++ int key_len = clamp_val(ext->key_len, 0, SCM_KEY_LEN); ++ ++ memcpy(sec.keys[idx], ext->key, key_len); ++ sec.key_sizes[idx] = key_len; + sec.flags |= (1 << idx); + if (ext->alg == IW_ENCODE_ALG_WEP) { + sec.encode_alg[idx] = SEC_ALG_WEP; +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c +index ff564198d2cef..24948b28e3e70 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c +@@ -1510,6 +1510,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans, + u32 cmd_pos; + const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD]; + u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD]; ++ unsigned long flags2; + + if (WARN(!trans->wide_cmd_header && + group_id > IWL_ALWAYS_LONG_GROUP, +@@ -1593,10 +1594,10 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans, + goto free_dup_buf; + } + +- spin_lock_bh(&txq->lock); ++ spin_lock_irqsave(&txq->lock, flags2); + + if (iwl_queue_space(txq) < ((cmd->flags & CMD_ASYNC) ? 2 : 1)) { +- spin_unlock_bh(&txq->lock); ++ spin_unlock_irqrestore(&txq->lock, flags2); + + IWL_ERR(trans, "No space in command queue\n"); + iwl_op_mode_cmd_queue_full(trans->op_mode); +@@ -1757,7 +1758,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans, + spin_unlock_irqrestore(&trans_pcie->reg_lock, flags); + + out: +- spin_unlock_bh(&txq->lock); ++ spin_unlock_irqrestore(&txq->lock, flags2); + free_dup_buf: + if (idx < 0) + kfree(dup_buf); +diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c +index b1b400b59d864..66cd38d4f199b 100644 +--- a/drivers/net/wireless/marvell/mwl8k.c ++++ b/drivers/net/wireless/marvell/mwl8k.c +@@ -1459,6 +1459,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index) + txq->skb = kcalloc(MWL8K_TX_DESCS, sizeof(*txq->skb), GFP_KERNEL); + if (txq->skb == NULL) { + pci_free_consistent(priv->pdev, size, txq->txd, txq->txd_dma); ++ txq->txd = NULL; + return -ENOMEM; + } + +diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.c b/drivers/net/wireless/mediatek/mt7601u/eeprom.c +index da6faea092d6b..80d0f64205f8a 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.c ++++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.c +@@ -106,7 +106,7 @@ mt7601u_has_tssi(struct mt7601u_dev *dev, u8 *eeprom) + { + u16 nic_conf1 = get_unaligned_le16(eeprom + MT_EE_NIC_CONF_1); + +- return ~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN); ++ return (u16)~nic_conf1 && (nic_conf1 & MT_EE_NIC_CONF_1_TX_ALC_EN); + } + + static void +diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h +index 3fbfd19818f1a..ca2021bcac14f 100644 +--- a/drivers/net/wireless/wl3501.h ++++ b/drivers/net/wireless/wl3501.h +@@ -378,16 +378,7 @@ struct wl3501_get_confirm { + u8 mib_value[100]; + }; + +-struct wl3501_join_req { +- u16 next_blk; +- u8 sig_id; +- u8 reserved; +- struct iw_mgmt_data_rset operational_rset; +- u16 reserved2; +- u16 timeout; +- u16 probe_delay; +- u8 timestamp[8]; +- u8 local_time[8]; ++struct wl3501_req { + u16 beacon_period; + u16 dtim_period; + u16 cap_info; +@@ -400,6 +391,19 @@ struct wl3501_join_req { + struct iw_mgmt_data_rset bss_basic_rset; + }; + ++struct wl3501_join_req { ++ u16 next_blk; ++ u8 sig_id; ++ u8 reserved; ++ struct iw_mgmt_data_rset operational_rset; ++ u16 reserved2; ++ u16 timeout; ++ u16 probe_delay; ++ u8 timestamp[8]; ++ u8 local_time[8]; ++ struct wl3501_req req; ++}; ++ + struct wl3501_join_confirm { + u16 next_blk; + u8 sig_id; +@@ -442,16 +446,7 @@ struct wl3501_scan_confirm { + u16 status; + char timestamp[8]; + char localtime[8]; +- u16 beacon_period; +- u16 dtim_period; +- u16 cap_info; +- u8 bss_type; +- u8 bssid[ETH_ALEN]; +- struct iw_mgmt_essid_pset ssid; +- struct iw_mgmt_ds_pset ds_pset; +- struct iw_mgmt_cf_pset cf_pset; +- struct iw_mgmt_ibss_pset ibss_pset; +- struct iw_mgmt_data_rset bss_basic_rset; ++ struct wl3501_req req; + u8 rssi; + }; + +@@ -470,8 +465,10 @@ struct wl3501_md_req { + u16 size; + u8 pri; + u8 service_class; +- u8 daddr[ETH_ALEN]; +- u8 saddr[ETH_ALEN]; ++ struct { ++ u8 daddr[ETH_ALEN]; ++ u8 saddr[ETH_ALEN]; ++ } addr; + }; + + struct wl3501_md_ind { +@@ -483,8 +480,10 @@ struct wl3501_md_ind { + u8 reception; + u8 pri; + u8 service_class; +- u8 daddr[ETH_ALEN]; +- u8 saddr[ETH_ALEN]; ++ struct { ++ u8 daddr[ETH_ALEN]; ++ u8 saddr[ETH_ALEN]; ++ } addr; + }; + + struct wl3501_md_confirm { +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 932f3f81e8cf3..959844a108615 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -468,6 +468,7 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len) + struct wl3501_md_req sig = { + .sig_id = WL3501_SIG_MD_REQ, + }; ++ size_t sig_addr_len = sizeof(sig.addr); + u8 *pdata = (char *)data; + int rc = -EIO; + +@@ -483,9 +484,9 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len) + goto out; + } + rc = 0; +- memcpy(&sig.daddr[0], pdata, 12); +- pktlen = len - 12; +- pdata += 12; ++ memcpy(&sig.addr, pdata, sig_addr_len); ++ pktlen = len - sig_addr_len; ++ pdata += sig_addr_len; + sig.data = bf; + if (((*pdata) * 256 + (*(pdata + 1))) > 1500) { + u8 addr4[ETH_ALEN] = { +@@ -588,7 +589,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas) + struct wl3501_join_req sig = { + .sig_id = WL3501_SIG_JOIN_REQ, + .timeout = 10, +- .ds_pset = { ++ .req.ds_pset = { + .el = { + .id = IW_MGMT_INFO_ELEMENT_DS_PARAMETER_SET, + .len = 1, +@@ -597,7 +598,7 @@ static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas) + }, + }; + +- memcpy(&sig.beacon_period, &this->bss_set[stas].beacon_period, 72); ++ memcpy(&sig.req, &this->bss_set[stas].req, sizeof(sig.req)); + return wl3501_esbq_exec(this, &sig, sizeof(sig)); + } + +@@ -665,35 +666,37 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr) + if (sig.status == WL3501_STATUS_SUCCESS) { + pr_debug("success"); + if ((this->net_type == IW_MODE_INFRA && +- (sig.cap_info & WL3501_MGMT_CAPABILITY_ESS)) || ++ (sig.req.cap_info & WL3501_MGMT_CAPABILITY_ESS)) || + (this->net_type == IW_MODE_ADHOC && +- (sig.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) || ++ (sig.req.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) || + this->net_type == IW_MODE_AUTO) { + if (!this->essid.el.len) + matchflag = 1; + else if (this->essid.el.len == 3 && + !memcmp(this->essid.essid, "ANY", 3)) + matchflag = 1; +- else if (this->essid.el.len != sig.ssid.el.len) ++ else if (this->essid.el.len != sig.req.ssid.el.len) + matchflag = 0; +- else if (memcmp(this->essid.essid, sig.ssid.essid, ++ else if (memcmp(this->essid.essid, sig.req.ssid.essid, + this->essid.el.len)) + matchflag = 0; + else + matchflag = 1; + if (matchflag) { + for (i = 0; i < this->bss_cnt; i++) { +- if (ether_addr_equal_unaligned(this->bss_set[i].bssid, sig.bssid)) { ++ if (ether_addr_equal_unaligned(this->bss_set[i].req.bssid, ++ sig.req.bssid)) { + matchflag = 0; + break; + } + } + } + if (matchflag && (i < 20)) { +- memcpy(&this->bss_set[i].beacon_period, +- &sig.beacon_period, 73); ++ memcpy(&this->bss_set[i].req, ++ &sig.req, sizeof(sig.req)); + this->bss_cnt++; + this->rssi = sig.rssi; ++ this->bss_set[i].rssi = sig.rssi; + } + } + } else if (sig.status == WL3501_STATUS_TIMEOUT) { +@@ -885,19 +888,19 @@ static void wl3501_mgmt_join_confirm(struct net_device *dev, u16 addr) + if (this->join_sta_bss < this->bss_cnt) { + const int i = this->join_sta_bss; + memcpy(this->bssid, +- this->bss_set[i].bssid, ETH_ALEN); +- this->chan = this->bss_set[i].ds_pset.chan; ++ this->bss_set[i].req.bssid, ETH_ALEN); ++ this->chan = this->bss_set[i].req.ds_pset.chan; + iw_copy_mgmt_info_element(&this->keep_essid.el, +- &this->bss_set[i].ssid.el); ++ &this->bss_set[i].req.ssid.el); + wl3501_mgmt_auth(this); + } + } else { + const int i = this->join_sta_bss; + +- memcpy(&this->bssid, &this->bss_set[i].bssid, ETH_ALEN); +- this->chan = this->bss_set[i].ds_pset.chan; ++ memcpy(&this->bssid, &this->bss_set[i].req.bssid, ETH_ALEN); ++ this->chan = this->bss_set[i].req.ds_pset.chan; + iw_copy_mgmt_info_element(&this->keep_essid.el, +- &this->bss_set[i].ssid.el); ++ &this->bss_set[i].req.ssid.el); + wl3501_online(dev); + } + } else { +@@ -979,7 +982,8 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev, + } else { + skb->dev = dev; + skb_reserve(skb, 2); /* IP headers on 16 bytes boundaries */ +- skb_copy_to_linear_data(skb, (unsigned char *)&sig.daddr, 12); ++ skb_copy_to_linear_data(skb, (unsigned char *)&sig.addr, ++ sizeof(sig.addr)); + wl3501_receive(this, skb->data, pkt_len); + skb_put(skb, pkt_len); + skb->protocol = eth_type_trans(skb, dev); +@@ -1574,30 +1578,30 @@ static int wl3501_get_scan(struct net_device *dev, struct iw_request_info *info, + for (i = 0; i < this->bss_cnt; ++i) { + iwe.cmd = SIOCGIWAP; + iwe.u.ap_addr.sa_family = ARPHRD_ETHER; +- memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].bssid, ETH_ALEN); ++ memcpy(iwe.u.ap_addr.sa_data, this->bss_set[i].req.bssid, ETH_ALEN); + current_ev = iwe_stream_add_event(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, IW_EV_ADDR_LEN); + iwe.cmd = SIOCGIWESSID; + iwe.u.data.flags = 1; +- iwe.u.data.length = this->bss_set[i].ssid.el.len; ++ iwe.u.data.length = this->bss_set[i].req.ssid.el.len; + current_ev = iwe_stream_add_point(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, +- this->bss_set[i].ssid.essid); ++ this->bss_set[i].req.ssid.essid); + iwe.cmd = SIOCGIWMODE; +- iwe.u.mode = this->bss_set[i].bss_type; ++ iwe.u.mode = this->bss_set[i].req.bss_type; + current_ev = iwe_stream_add_event(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, IW_EV_UINT_LEN); + iwe.cmd = SIOCGIWFREQ; +- iwe.u.freq.m = this->bss_set[i].ds_pset.chan; ++ iwe.u.freq.m = this->bss_set[i].req.ds_pset.chan; + iwe.u.freq.e = 0; + current_ev = iwe_stream_add_event(info, current_ev, + extra + IW_SCAN_MAX_DATA, + &iwe, IW_EV_FREQ_LEN); + iwe.cmd = SIOCGIWENCODE; +- if (this->bss_set[i].cap_info & WL3501_MGMT_CAPABILITY_PRIVACY) ++ if (this->bss_set[i].req.cap_info & WL3501_MGMT_CAPABILITY_PRIVACY) + iwe.u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY; + else + iwe.u.data.flags = IW_ENCODE_DISABLED; +diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c +index d9c55830b2b26..6c495664d2cb7 100644 +--- a/drivers/nfc/pn533/pn533.c ++++ b/drivers/nfc/pn533/pn533.c +@@ -678,6 +678,9 @@ static bool pn533_target_type_a_is_valid(struct pn533_target_type_a *type_a, + if (PN533_TYPE_A_SEL_CASCADE(type_a->sel_res) != 0) + return false; + ++ if (type_a->nfcid_len > NFC_NFCID1_MAXSIZE) ++ return false; ++ + return true; + } + +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index 9054b8f218a78..e9360d5cbcbac 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -1158,16 +1158,8 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size) + int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base, + phys_addr_t size, bool nomap) + { +- if (nomap) { +- /* +- * If the memory is already reserved (by another region), we +- * should not allow it to be marked nomap. +- */ +- if (memblock_is_region_reserved(base, size)) +- return -EBUSY; +- +- return memblock_mark_nomap(base, size); +- } ++ if (nomap) ++ return memblock_remove(base, size); + return memblock_reserve(base, size); + } + +diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c +index 7f2b9ef185e44..f154b05f467ff 100644 +--- a/drivers/pci/hotplug/acpiphp_glue.c ++++ b/drivers/pci/hotplug/acpiphp_glue.c +@@ -538,6 +538,7 @@ static void enable_slot(struct acpiphp_slot *slot) + slot->flags &= (~SLOT_ENABLED); + continue; + } ++ pci_dev_put(dev); + } + } + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index e09653c73ab4b..acd89fa9820c4 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1378,20 +1378,10 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags) + int err; + int i, bars = 0; + +- /* +- * Power state could be unknown at this point, either due to a fresh +- * boot or a device removal call. So get the current power state +- * so that things like MSI message writing will behave as expected +- * (e.g. if the device really is in D0 at enable time). +- */ +- if (dev->pm_cap) { +- u16 pmcsr; +- pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr); +- dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK); +- } +- +- if (atomic_inc_return(&dev->enable_cnt) > 1) ++ if (atomic_inc_return(&dev->enable_cnt) > 1) { ++ pci_update_current_state(dev, dev->current_state); + return 0; /* already enabled */ ++ } + + bridge = pci_upstream_bridge(dev); + if (bridge) +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 19658873b4c11..ddf5ba63b1958 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -1694,6 +1694,7 @@ static struct pci_dev *pci_scan_device(struct pci_bus *bus, int devfn) + pci_set_of_node(dev); + + if (pci_setup_device(dev)) { ++ pci_release_of_node(dev); + pci_bus_put(dev->bus); + kfree(dev); + return NULL; +diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c +index ddb530ee2255c..9d57695e1f21f 100644 +--- a/drivers/phy/phy-twl4030-usb.c ++++ b/drivers/phy/phy-twl4030-usb.c +@@ -798,7 +798,7 @@ static int twl4030_usb_remove(struct platform_device *pdev) + + usb_remove_phy(&twl->phy); + pm_runtime_get_sync(twl->dev); +- cancel_delayed_work(&twl->id_workaround_work); ++ cancel_delayed_work_sync(&twl->id_workaround_work); + device_remove_file(twl->dev, &dev_attr_vbus); + + /* set transceiver mode to power on defaults */ +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 379f9633f78e1..84bfecded84d9 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -6044,6 +6044,7 @@ enum thermal_access_mode { + enum { /* TPACPI_THERMAL_TPEC_* */ + TP_EC_THERMAL_TMP0 = 0x78, /* ACPI EC regs TMP 0..7 */ + TP_EC_THERMAL_TMP8 = 0xC0, /* ACPI EC regs TMP 8..15 */ ++ TP_EC_FUNCREV = 0xEF, /* ACPI EC Functional revision */ + TP_EC_THERMAL_TMP_NA = -128, /* ACPI EC sensor not available */ + + TPACPI_THERMAL_SENSOR_NA = -128000, /* Sensor not available */ +@@ -6242,7 +6243,7 @@ static const struct attribute_group thermal_temp_input8_group = { + + static int __init thermal_init(struct ibm_init_struct *iibm) + { +- u8 t, ta1, ta2; ++ u8 t, ta1, ta2, ver = 0; + int i; + int acpi_tmp7; + int res; +@@ -6257,7 +6258,14 @@ static int __init thermal_init(struct ibm_init_struct *iibm) + * 0x78-0x7F, 0xC0-0xC7. Registers return 0x00 for + * non-implemented, thermal sensors return 0x80 when + * not available ++ * The above rule is unfortunately flawed. This has been seen with ++ * 0xC2 (power supply ID) causing thermal control problems. ++ * The EC version can be determined by offset 0xEF and at least for ++ * version 3 the Lenovo firmware team confirmed that registers 0xC0-0xC7 ++ * are not thermal registers. + */ ++ if (!acpi_ec_read(TP_EC_FUNCREV, &ver)) ++ pr_warn("Thinkpad ACPI EC unable to access EC version\n"); + + ta1 = ta2 = 0; + for (i = 0; i < 8; i++) { +@@ -6267,11 +6275,13 @@ static int __init thermal_init(struct ibm_init_struct *iibm) + ta1 = 0; + break; + } +- if (acpi_ec_read(TP_EC_THERMAL_TMP8 + i, &t)) { +- ta2 |= t; +- } else { +- ta1 = 0; +- break; ++ if (ver < 3) { ++ if (acpi_ec_read(TP_EC_THERMAL_TMP8 + i, &t)) { ++ ta2 |= t; ++ } else { ++ ta1 = 0; ++ break; ++ } + } + } + if (ta1 == 0) { +@@ -6287,9 +6297,12 @@ static int __init thermal_init(struct ibm_init_struct *iibm) + thermal_read_mode = TPACPI_THERMAL_NONE; + } + } else { +- thermal_read_mode = +- (ta2 != 0) ? +- TPACPI_THERMAL_TPEC_16 : TPACPI_THERMAL_TPEC_8; ++ if (ver >= 3) ++ thermal_read_mode = TPACPI_THERMAL_TPEC_8; ++ else ++ thermal_read_mode = ++ (ta2 != 0) ? ++ TPACPI_THERMAL_TPEC_16 : TPACPI_THERMAL_TPEC_8; + } + } else if (acpi_tmp7) { + if (tpacpi_is_ibm() && +diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c +index f627b39f64bf2..b77fd751945d5 100644 +--- a/drivers/power/supply/generic-adc-battery.c ++++ b/drivers/power/supply/generic-adc-battery.c +@@ -384,7 +384,7 @@ static int gab_remove(struct platform_device *pdev) + } + + kfree(adc_bat->psy_desc.properties); +- cancel_delayed_work(&adc_bat->bat_work); ++ cancel_delayed_work_sync(&adc_bat->bat_work); + return 0; + } + +diff --git a/drivers/power/supply/lp8788-charger.c b/drivers/power/supply/lp8788-charger.c +index c3075ea011b64..e800beff1f8f3 100644 +--- a/drivers/power/supply/lp8788-charger.c ++++ b/drivers/power/supply/lp8788-charger.c +@@ -532,7 +532,7 @@ static int lp8788_set_irqs(struct platform_device *pdev, + + ret = request_threaded_irq(virq, NULL, + lp8788_charger_irq_thread, +- 0, name, pchg); ++ IRQF_ONESHOT, name, pchg); + if (ret) + break; + } +diff --git a/drivers/power/supply/pm2301_charger.c b/drivers/power/supply/pm2301_charger.c +index 78561b6884fc7..9ef218d76aa9c 100644 +--- a/drivers/power/supply/pm2301_charger.c ++++ b/drivers/power/supply/pm2301_charger.c +@@ -1098,7 +1098,7 @@ static int pm2xxx_wall_charger_probe(struct i2c_client *i2c_client, + ret = request_threaded_irq(gpio_to_irq(pm2->pdata->gpio_irq_number), + NULL, + pm2xxx_charger_irq[0].isr, +- pm2->pdata->irq_type, ++ pm2->pdata->irq_type | IRQF_ONESHOT, + pm2xxx_charger_irq[0].name, pm2); + + if (ret != 0) { +diff --git a/drivers/power/supply/s3c_adc_battery.c b/drivers/power/supply/s3c_adc_battery.c +index 0ffe5cd3abf62..06b412c43aa72 100644 +--- a/drivers/power/supply/s3c_adc_battery.c ++++ b/drivers/power/supply/s3c_adc_battery.c +@@ -392,7 +392,7 @@ static int s3c_adc_bat_remove(struct platform_device *pdev) + gpio_free(pdata->gpio_charge_finished); + } + +- cancel_delayed_work(&bat_work); ++ cancel_delayed_work_sync(&bat_work); + + if (pdata->exit) + pdata->exit(); +diff --git a/drivers/power/supply/tps65090-charger.c b/drivers/power/supply/tps65090-charger.c +index 1b4b5e09538e1..297bf58f0d4fb 100644 +--- a/drivers/power/supply/tps65090-charger.c ++++ b/drivers/power/supply/tps65090-charger.c +@@ -311,7 +311,7 @@ static int tps65090_charger_probe(struct platform_device *pdev) + + if (irq != -ENXIO) { + ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, +- tps65090_charger_isr, 0, "tps65090-charger", cdata); ++ tps65090_charger_isr, IRQF_ONESHOT, "tps65090-charger", cdata); + if (ret) { + dev_err(cdata->dev, + "Unable to register irq %d err %d\n", irq, +diff --git a/drivers/power/supply/tps65217_charger.c b/drivers/power/supply/tps65217_charger.c +index 9fd019f9b88c4..a6b4eb61b4bb4 100644 +--- a/drivers/power/supply/tps65217_charger.c ++++ b/drivers/power/supply/tps65217_charger.c +@@ -238,7 +238,7 @@ static int tps65217_charger_probe(struct platform_device *pdev) + if (irq != -ENXIO) { + ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, + tps65217_charger_irq, +- 0, "tps65217-charger", ++ IRQF_ONESHOT, "tps65217-charger", + charger); + if (ret) { + dev_err(charger->dev, +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index 2bc3dc6244a5e..dce8852762350 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -564,10 +564,11 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + * even though it shouldn't according to T10. + * The retry without rtpg_ext_hdr_req set + * handles this. ++ * Note: some arrays return a sense key of ILLEGAL_REQUEST ++ * with ASC 00h if they don't support the extended header. + */ + if (!(pg->flags & ALUA_RTPG_EXT_HDR_UNSUPP) && +- sense_hdr.sense_key == ILLEGAL_REQUEST && +- sense_hdr.asc == 0x24 && sense_hdr.ascq == 0) { ++ sense_hdr.sense_key == ILLEGAL_REQUEST) { + pg->flags |= ALUA_RTPG_EXT_HDR_UNSUPP; + goto retry; + } +diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c +index 9aaa74e349ccb..65f0dbfc3a45d 100644 +--- a/drivers/scsi/jazz_esp.c ++++ b/drivers/scsi/jazz_esp.c +@@ -170,7 +170,9 @@ static int esp_jazz_probe(struct platform_device *dev) + if (!esp->command_block) + goto fail_unmap_regs; + +- host->irq = platform_get_irq(dev, 0); ++ host->irq = err = platform_get_irq(dev, 0); ++ if (err < 0) ++ goto fail_unmap_command_block; + err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, "ESP", esp); + if (err < 0) + goto fail_unmap_command_block; +diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c +index ae93f45f9cd8d..a36817fb0673a 100644 +--- a/drivers/scsi/libfc/fc_lport.c ++++ b/drivers/scsi/libfc/fc_lport.c +@@ -1751,7 +1751,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, + + if (mfs < FC_SP_MIN_MAX_PAYLOAD || mfs > FC_SP_MAX_MAX_PAYLOAD) { + FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, " +- "lport->mfs:%hu\n", mfs, lport->mfs); ++ "lport->mfs:%u\n", mfs, lport->mfs); + fc_lport_error(lport, fp); + goto out; + } +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index fefef2884d590..30b5f65b29d15 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -1606,8 +1606,6 @@ lpfc_cmpl_reglogin_reglogin_issue(struct lpfc_vport *vport, + ndlp->nlp_last_elscmd = ELS_CMD_PLOGI; + + lpfc_issue_els_logo(vport, ndlp, 0); +- ndlp->nlp_prev_state = NLP_STE_REG_LOGIN_ISSUE; +- lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE); + return ndlp->nlp_state; + } + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 08c76c361e8dc..0e7915ecb85a5 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -15252,7 +15252,6 @@ lpfc_sli4_seq_abort_rsp_cmpl(struct lpfc_hba *phba, + if (cmd_iocbq) { + ndlp = (struct lpfc_nodelist *)cmd_iocbq->context1; + lpfc_nlp_put(ndlp); +- lpfc_nlp_not_used(ndlp); + lpfc_sli_release_iocbq(phba, cmd_iocbq); + } + +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 33f4181ba9f76..591e2e89ae9f8 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -1909,6 +1909,8 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost) + vha->qla_stats.jiffies_at_last_reset = get_jiffies_64(); + + if (IS_FWI2_CAPABLE(ha)) { ++ int rval; ++ + stats = dma_alloc_coherent(&ha->pdev->dev, + sizeof(*stats), &stats_dma, GFP_KERNEL); + if (!stats) { +@@ -1918,7 +1920,11 @@ qla2x00_reset_host_stats(struct Scsi_Host *shost) + } + + /* reset firmware statistics */ +- qla24xx_get_isp_stats(base_vha, stats, stats_dma, BIT_0); ++ rval = qla24xx_get_isp_stats(base_vha, stats, stats_dma, BIT_0); ++ if (rval != QLA_SUCCESS) ++ ql_log(ql_log_warn, vha, 0x70de, ++ "Resetting ISP statistics failed: rval = %d\n", ++ rval); + + dma_free_coherent(&ha->pdev->dev, sizeof(*stats), + stats, stats_dma); +diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c +index b0f5220ae23a8..fad68cb028d6b 100644 +--- a/drivers/scsi/sni_53c710.c ++++ b/drivers/scsi/sni_53c710.c +@@ -71,6 +71,7 @@ static int snirm710_probe(struct platform_device *dev) + struct NCR_700_Host_Parameters *hostdata; + struct Scsi_Host *host; + struct resource *res; ++ int rc; + + res = platform_get_resource(dev, IORESOURCE_MEM, 0); + if (!res) +@@ -96,7 +97,9 @@ static int snirm710_probe(struct platform_device *dev) + goto out_kfree; + host->this_id = 7; + host->base = base; +- host->irq = platform_get_irq(dev, 0); ++ host->irq = rc = platform_get_irq(dev, 0); ++ if (rc < 0) ++ goto out_put_host; + if(request_irq(host->irq, NCR_700_intr, IRQF_SHARED, "snirm710", host)) { + printk(KERN_ERR "snirm710: request_irq failed!\n"); + goto out_put_host; +diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c +index d50c5ed8f428c..167ae2d29e47b 100644 +--- a/drivers/scsi/sun3x_esp.c ++++ b/drivers/scsi/sun3x_esp.c +@@ -233,7 +233,9 @@ static int esp_sun3x_probe(struct platform_device *dev) + if (!esp->command_block) + goto fail_unmap_regs_dma; + +- host->irq = platform_get_irq(dev, 0); ++ host->irq = err = platform_get_irq(dev, 0); ++ if (err < 0) ++ goto fail_unmap_command_block; + err = request_irq(host->irq, scsi_esp_intr, IRQF_SHARED, + "SUN3X ESP", esp); + if (err < 0) +diff --git a/drivers/spi/spi-dln2.c b/drivers/spi/spi-dln2.c +index b62a99caacc06..a41adea486182 100644 +--- a/drivers/spi/spi-dln2.c ++++ b/drivers/spi/spi-dln2.c +@@ -783,7 +783,7 @@ exit_free_master: + + static int dln2_spi_remove(struct platform_device *pdev) + { +- struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); ++ struct spi_master *master = platform_get_drvdata(pdev); + struct dln2_spi *dln2 = spi_master_get_devdata(master); + + pm_runtime_disable(&pdev->dev); +diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c +index 76a8425be227b..1eccdc4a45817 100644 +--- a/drivers/spi/spi-omap-100k.c ++++ b/drivers/spi/spi-omap-100k.c +@@ -435,7 +435,7 @@ err: + + static int omap1_spi100k_remove(struct platform_device *pdev) + { +- struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); ++ struct spi_master *master = platform_get_drvdata(pdev); + struct omap1_spi100k *spi100k = spi_master_get_devdata(master); + + pm_runtime_disable(&pdev->dev); +@@ -449,7 +449,7 @@ static int omap1_spi100k_remove(struct platform_device *pdev) + #ifdef CONFIG_PM + static int omap1_spi100k_runtime_suspend(struct device *dev) + { +- struct spi_master *master = spi_master_get(dev_get_drvdata(dev)); ++ struct spi_master *master = dev_get_drvdata(dev); + struct omap1_spi100k *spi100k = spi_master_get_devdata(master); + + clk_disable_unprepare(spi100k->ick); +@@ -460,7 +460,7 @@ static int omap1_spi100k_runtime_suspend(struct device *dev) + + static int omap1_spi100k_runtime_resume(struct device *dev) + { +- struct spi_master *master = spi_master_get(dev_get_drvdata(dev)); ++ struct spi_master *master = dev_get_drvdata(dev); + struct omap1_spi100k *spi100k = spi_master_get_devdata(master); + int ret; + +diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c +index 9ef9cbfd8926d..c35c9b766a001 100644 +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -661,8 +661,6 @@ static int set_serial_info(struct gb_tty *gb_tty, + if ((close_delay != gb_tty->port.close_delay) || + (closing_wait != gb_tty->port.closing_wait)) + retval = -EPERM; +- else +- retval = -EOPNOTSUPP; + } else { + gb_tty->port.close_delay = close_delay; + gb_tty->port.closing_wait = closing_wait; +diff --git a/drivers/staging/media/omap4iss/iss.c b/drivers/staging/media/omap4iss/iss.c +index c26c99fd4a24a..1e10fe204d3bd 100644 +--- a/drivers/staging/media/omap4iss/iss.c ++++ b/drivers/staging/media/omap4iss/iss.c +@@ -1244,8 +1244,10 @@ static int iss_probe(struct platform_device *pdev) + if (ret < 0) + goto error; + +- if (!omap4iss_get(iss)) ++ if (!omap4iss_get(iss)) { ++ ret = -EINVAL; + goto error; ++ } + + ret = iss_reset(iss); + if (ret < 0) +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index fa4c47c7d2166..53b77c8ae328a 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -3420,7 +3420,7 @@ static void rtl819x_update_rxcounts(struct r8192_priv *priv, u32 *TotalRxBcnNum, + u32 *TotalRxDataNum) + { + u16 SlotIndex; +- u8 i; ++ u16 i; + + *TotalRxBcnNum = 0; + *TotalRxDataNum = 0; +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index 079db0bd39174..089ba39f76a23 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -629,8 +629,9 @@ static void pscsi_transport_complete(struct se_cmd *cmd, struct scatterlist *sg, + unsigned char *buf; + + buf = transport_kmap_data_sg(cmd); +- if (!buf) ++ if (!buf) { + ; /* XXX: TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE */ ++ } + + if (cdb[0] == MODE_SENSE_10) { + if (!(buf[3] & 0x80)) +diff --git a/drivers/thermal/fair_share.c b/drivers/thermal/fair_share.c +index 68bd1b5691185..da01b128c9a21 100644 +--- a/drivers/thermal/fair_share.c ++++ b/drivers/thermal/fair_share.c +@@ -93,6 +93,8 @@ static int fair_share_throttle(struct thermal_zone_device *tz, int trip) + int total_instance = 0; + int cur_trip_level = get_trip_level(tz); + ++ mutex_lock(&tz->lock); ++ + list_for_each_entry(instance, &tz->thermal_instances, tz_node) { + if (instance->trip != trip) + continue; +@@ -121,6 +123,8 @@ static int fair_share_throttle(struct thermal_zone_device *tz, int trip) + mutex_unlock(&instance->cdev->lock); + thermal_cdev_update(cdev); + } ++ ++ mutex_unlock(&tz->lock); + return 0; + } + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index ea8b591dd46f4..f325019887b23 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -476,8 +476,9 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + unsigned int baud; + u32 usartdiv, mantissa, fraction, oversampling; + tcflag_t cflag = termios->c_cflag; +- u32 cr1, cr2, cr3; ++ u32 cr1, cr2, cr3, isr; + unsigned long flags; ++ int ret; + + if (!stm32_port->hw_flow_control) + cflag &= ~CRTSCTS; +@@ -486,6 +487,15 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + + spin_lock_irqsave(&port->lock, flags); + ++ ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr, ++ isr, ++ (isr & USART_SR_TC), ++ 10, 100000); ++ ++ /* Send the TC error message only when ISR_TC is not set. */ ++ if (ret) ++ dev_err(port->dev, "Transmission is not complete\n"); ++ + /* Stop serial port and reset value */ + writel_relaxed(0, port->membase + ofs->cr1); + +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 7b4aca20cb299..e16a74b68cd0f 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -2791,14 +2791,14 @@ out: + * @p: pointer to result + * + * Obtain the modem status bits from the tty driver if the feature +- * is supported. Return -EINVAL if it is not available. ++ * is supported. Return -ENOTTY if it is not available. + * + * Locking: none (up to the driver) + */ + + static int tty_tiocmget(struct tty_struct *tty, int __user *p) + { +- int retval = -EINVAL; ++ int retval = -ENOTTY; + + if (tty->ops->tiocmget) { + retval = tty->ops->tiocmget(tty); +@@ -2816,7 +2816,7 @@ static int tty_tiocmget(struct tty_struct *tty, int __user *p) + * @p: pointer to desired bits + * + * Set the modem status bits from the tty driver if the feature +- * is supported. Return -EINVAL if it is not available. ++ * is supported. Return -ENOTTY if it is not available. + * + * Locking: none (up to the driver) + */ +@@ -2828,7 +2828,7 @@ static int tty_tiocmset(struct tty_struct *tty, unsigned int cmd, + unsigned int set, clear, val; + + if (tty->ops->tiocmset == NULL) +- return -EINVAL; ++ return -ENOTTY; + + retval = get_user(val, p); + if (retval) +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 97b5b021a2200..a70d2341ada63 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -870,8 +870,6 @@ static int set_serial_info(struct acm *acm, + if ((new_serial.close_delay != old_close_delay) || + (new_serial.closing_wait != old_closing_wait)) + retval = -EPERM; +- else +- retval = -EOPNOTSUPP; + } else { + acm->port.close_delay = close_delay; + acm->port.closing_wait = closing_wait; +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 238dfe0f6e80a..df9fd9b95f22c 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3486,9 +3486,6 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) + * sequence. + */ + status = hub_port_status(hub, port1, &portstatus, &portchange); +- +- /* TRSMRCY = 10 msec */ +- msleep(10); + } + + SuspendCleared: +@@ -3503,6 +3500,9 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) + usb_clear_port_feature(hub->hdev, port1, + USB_PORT_FEAT_C_SUSPEND); + } ++ ++ /* TRSMRCY = 10 msec */ ++ msleep(10); + } + + if (udev->persist_enabled) +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index cd43e11d74f34..3dfd584a1ef3d 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -245,6 +245,7 @@ static const struct usb_device_id usb_quirk_list[] = { + + /* Realtek hub in Dell WD19 (Type-C) */ + { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, ++ { USB_DEVICE(0x0bda, 0x5487), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Generic RTL8153 based ethernet adapters */ + { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM }, +@@ -264,6 +265,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1532, 0x0116), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + ++ /* Lenovo ThinkPad USB-C Dock Gen2 Ethernet (RTL8153 GigE) */ ++ { USB_DEVICE(0x17ef, 0xa387), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* BUILDWIN Photo Frame */ + { USB_DEVICE(0x1908, 0x1315), .driver_info = + USB_QUIRK_HONOR_BNUMINTERFACES }, +diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h +index 0f45a2f165e5d..1bb8b1e22ed35 100644 +--- a/drivers/usb/dwc2/core.h ++++ b/drivers/usb/dwc2/core.h +@@ -164,6 +164,7 @@ struct dwc2_hsotg_req; + * @lock: State lock to protect contents of endpoint. + * @dir_in: Set to true if this endpoint is of the IN direction, which + * means that it is sending data to the Host. ++ * @map_dir: Set to the value of dir_in when the DMA buffer is mapped. + * @index: The index for the endpoint registers. + * @mc: Multi Count - number of transactions per microframe + * @interval - Interval for periodic endpoints, in frames or microframes. +@@ -207,6 +208,7 @@ struct dwc2_hsotg_ep { + unsigned short fifo_index; + + unsigned char dir_in; ++ unsigned char map_dir; + unsigned char index; + unsigned char mc; + u16 interval; +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 6bde5db1490a1..e7ad3ae4ea6bd 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -308,7 +308,7 @@ static void dwc2_hsotg_unmap_dma(struct dwc2_hsotg *hsotg, + if (hs_req->req.length == 0) + return; + +- usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->dir_in); ++ usb_gadget_unmap_request(&hsotg->gadget, req, hs_ep->map_dir); + } + + /** +@@ -745,6 +745,7 @@ static int dwc2_hsotg_map_dma(struct dwc2_hsotg *hsotg, + if (hs_req->req.length == 0) + return 0; + ++ hs_ep->map_dir = hs_ep->dir_in; + ret = usb_gadget_map_request(&hsotg->gadget, req, hs_ep->dir_in); + if (ret) + goto dma_error; +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index e0fb7b3723c53..cca51553e0fb0 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2409,6 +2409,15 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc) + + dwc->connected = true; + ++ /* ++ * Ideally, dwc3_reset_gadget() would trigger the function ++ * drivers to stop any active transfers through ep disable. ++ * However, for functions which defer ep disable, such as mass ++ * storage, we will need to rely on the call to stop active ++ * transfers here, and avoid allowing of request queuing. ++ */ ++ dwc->connected = false; ++ + /* + * WORKAROUND: DWC3 revisions <1.88a have an issue which + * would cause a missing Disconnect Event if there's a +diff --git a/drivers/usb/gadget/config.c b/drivers/usb/gadget/config.c +index 17a6077b89a49..9b9d31eb6037f 100644 +--- a/drivers/usb/gadget/config.c ++++ b/drivers/usb/gadget/config.c +@@ -198,9 +198,13 @@ EXPORT_SYMBOL_GPL(usb_assign_descriptors); + void usb_free_all_descriptors(struct usb_function *f) + { + usb_free_descriptors(f->fs_descriptors); ++ f->fs_descriptors = NULL; + usb_free_descriptors(f->hs_descriptors); ++ f->hs_descriptors = NULL; + usb_free_descriptors(f->ss_descriptors); ++ f->ss_descriptors = NULL; + usb_free_descriptors(f->ssp_descriptors); ++ f->ssp_descriptors = NULL; + } + EXPORT_SYMBOL_GPL(usb_free_all_descriptors); + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 26fcbb92c4ba7..bcb2daf81b05d 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -2543,6 +2543,7 @@ static int __ffs_data_got_strings(struct ffs_data *ffs, + + do { /* lang_count > 0 so we can use do-while */ + unsigned needed = needed_count; ++ u32 str_per_lang = str_count; + + if (unlikely(len < 3)) + goto error_free; +@@ -2578,7 +2579,7 @@ static int __ffs_data_got_strings(struct ffs_data *ffs, + + data += length + 1; + len -= length + 1; +- } while (--str_count); ++ } while (--str_per_lang); + + s->id = 0; /* terminator */ + s->s = NULL; +diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c +index f8a1881609a2c..89da34ef7b3fe 100644 +--- a/drivers/usb/gadget/function/f_uvc.c ++++ b/drivers/usb/gadget/function/f_uvc.c +@@ -625,7 +625,12 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) + + uvc_hs_streaming_ep.wMaxPacketSize = + cpu_to_le16(max_packet_size | ((max_packet_mult - 1) << 11)); +- uvc_hs_streaming_ep.bInterval = opts->streaming_interval; ++ ++ /* A high-bandwidth endpoint must specify a bInterval value of 1 */ ++ if (max_packet_mult > 1) ++ uvc_hs_streaming_ep.bInterval = 1; ++ else ++ uvc_hs_streaming_ep.bInterval = opts->streaming_interval; + + uvc_ss_streaming_ep.wMaxPacketSize = cpu_to_le16(max_packet_size); + uvc_ss_streaming_ep.bInterval = opts->streaming_interval; +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index 9fdb567a09be6..8b16f0200d59b 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -918,6 +918,21 @@ static int dummy_pullup(struct usb_gadget *_gadget, int value) + spin_lock_irqsave(&dum->lock, flags); + dum->pullup = (value != 0); + set_link_state(dum_hcd); ++ if (value == 0) { ++ /* ++ * Emulate synchronize_irq(): wait for callbacks to finish. ++ * This seems to be the best place to emulate the call to ++ * synchronize_irq() that's in usb_gadget_remove_driver(). ++ * Doing it in dummy_udc_stop() would be too late since it ++ * is called after the unbind callback and unbind shouldn't ++ * be invoked until all the other callbacks are finished. ++ */ ++ while (dum->callback_usage > 0) { ++ spin_unlock_irqrestore(&dum->lock, flags); ++ usleep_range(1000, 2000); ++ spin_lock_irqsave(&dum->lock, flags); ++ } ++ } + spin_unlock_irqrestore(&dum->lock, flags); + + usb_hcd_poll_rh_status(dummy_hcd_to_hcd(dum_hcd)); +@@ -998,14 +1013,6 @@ static int dummy_udc_stop(struct usb_gadget *g) + spin_lock_irq(&dum->lock); + dum->ints_enabled = 0; + stop_activity(dum); +- +- /* emulate synchronize_irq(): wait for callbacks to finish */ +- while (dum->callback_usage > 0) { +- spin_unlock_irq(&dum->lock); +- usleep_range(1000, 2000); +- spin_lock_irq(&dum->lock); +- } +- + dum->driver = NULL; + spin_unlock_irq(&dum->lock); + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 76e991557116a..9e102ba9cf66a 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -340,15 +340,16 @@ static void fotg210_start_dma(struct fotg210_ep *ep, + } else { + buffer = req->req.buf + req->req.actual; + length = ioread32(ep->fotg210->reg + +- FOTG210_FIBCR(ep->epnum - 1)); +- length &= FIBCR_BCFX; ++ FOTG210_FIBCR(ep->epnum - 1)) & FIBCR_BCFX; ++ if (length > req->req.length - req->req.actual) ++ length = req->req.length - req->req.actual; + } + } else { + buffer = req->req.buf + req->req.actual; + if (req->req.length - req->req.actual > ep->ep.maxpacket) + length = ep->ep.maxpacket; + else +- length = req->req.length; ++ length = req->req.length - req->req.actual; + } + + d = dma_map_single(NULL, buffer, length, +@@ -385,8 +386,7 @@ static void fotg210_ep0_queue(struct fotg210_ep *ep, + } + if (ep->dir_in) { /* if IN */ + fotg210_start_dma(ep, req); +- if ((req->req.length == req->req.actual) || +- (req->req.actual < ep->ep.maxpacket)) ++ if (req->req.length == req->req.actual) + fotg210_done(ep, req, 0); + } else { /* OUT */ + u32 value = ioread32(ep->fotg210->reg + FOTG210_DMISGR0); +@@ -827,7 +827,7 @@ static void fotg210_ep0in(struct fotg210_udc *fotg210) + if (req->req.length) + fotg210_start_dma(ep, req); + +- if ((req->req.length - req->req.actual) < ep->ep.maxpacket) ++ if (req->req.actual == req->req.length) + fotg210_done(ep, req, 0); + } else { + fotg210_set_cxdone(fotg210); +@@ -856,12 +856,16 @@ static void fotg210_out_fifo_handler(struct fotg210_ep *ep) + { + struct fotg210_request *req = list_entry(ep->queue.next, + struct fotg210_request, queue); ++ int disgr1 = ioread32(ep->fotg210->reg + FOTG210_DISGR1); + + fotg210_start_dma(ep, req); + +- /* finish out transfer */ ++ /* Complete the request when it's full or a short packet arrived. ++ * Like other drivers, short_not_ok isn't handled. ++ */ ++ + if (req->req.length == req->req.actual || +- req->req.actual < ep->ep.maxpacket) ++ (disgr1 & DISGR1_SPK_INT(ep->epnum - 1))) + fotg210_done(ep, req, 0); + } + +@@ -1034,6 +1038,12 @@ static void fotg210_init(struct fotg210_udc *fotg210) + value &= ~DMCR_GLINT_EN; + iowrite32(value, fotg210->reg + FOTG210_DMCR); + ++ /* enable only grp2 irqs we handle */ ++ iowrite32(~(DISGR2_DMA_ERROR | DISGR2_RX0BYTE_INT | DISGR2_TX0BYTE_INT ++ | DISGR2_ISO_SEQ_ABORT_INT | DISGR2_ISO_SEQ_ERR_INT ++ | DISGR2_RESM_INT | DISGR2_SUSP_INT | DISGR2_USBRST_INT), ++ fotg210->reg + FOTG210_DMISGR2); ++ + /* disable all fifo interrupt */ + iowrite32(~(u32)0, fotg210->reg + FOTG210_DMISGR1); + +diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c +index 8a365aad66fe2..18ce19162804b 100644 +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -604,18 +604,22 @@ static void pch_udc_reconnect(struct pch_udc_dev *dev) + static inline void pch_udc_vbus_session(struct pch_udc_dev *dev, + int is_active) + { ++ unsigned long iflags; ++ ++ spin_lock_irqsave(&dev->lock, iflags); + if (is_active) { + pch_udc_reconnect(dev); + dev->vbus_session = 1; + } else { + if (dev->driver && dev->driver->disconnect) { +- spin_lock(&dev->lock); ++ spin_unlock_irqrestore(&dev->lock, iflags); + dev->driver->disconnect(&dev->gadget); +- spin_unlock(&dev->lock); ++ spin_lock_irqsave(&dev->lock, iflags); + } + pch_udc_set_disconnect(dev); + dev->vbus_session = 0; + } ++ spin_unlock_irqrestore(&dev->lock, iflags); + } + + /** +@@ -1172,20 +1176,25 @@ static int pch_udc_pcd_selfpowered(struct usb_gadget *gadget, int value) + static int pch_udc_pcd_pullup(struct usb_gadget *gadget, int is_on) + { + struct pch_udc_dev *dev; ++ unsigned long iflags; + + if (!gadget) + return -EINVAL; ++ + dev = container_of(gadget, struct pch_udc_dev, gadget); ++ ++ spin_lock_irqsave(&dev->lock, iflags); + if (is_on) { + pch_udc_reconnect(dev); + } else { + if (dev->driver && dev->driver->disconnect) { +- spin_lock(&dev->lock); ++ spin_unlock_irqrestore(&dev->lock, iflags); + dev->driver->disconnect(&dev->gadget); +- spin_unlock(&dev->lock); ++ spin_lock_irqsave(&dev->lock, iflags); + } + pch_udc_set_disconnect(dev); + } ++ spin_unlock_irqrestore(&dev->lock, iflags); + + return 0; + } +@@ -1777,7 +1786,7 @@ static struct usb_request *pch_udc_alloc_request(struct usb_ep *usbep, + } + /* prevent from using desc. - set HOST BUSY */ + dma_desc->status |= PCH_UDC_BS_HST_BSY; +- dma_desc->dataptr = cpu_to_le32(DMA_ADDR_INVALID); ++ dma_desc->dataptr = lower_32_bits(DMA_ADDR_INVALID); + req->td_data = dma_desc; + req->td_data_last = dma_desc; + req->chain_len = 1; +@@ -2320,6 +2329,21 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num) + pch_udc_set_dma(dev, DMA_DIR_RX); + } + ++static int pch_udc_gadget_setup(struct pch_udc_dev *dev) ++ __must_hold(&dev->lock) ++{ ++ int rc; ++ ++ /* In some cases we can get an interrupt before driver gets setup */ ++ if (!dev->driver) ++ return -ESHUTDOWN; ++ ++ spin_unlock(&dev->lock); ++ rc = dev->driver->setup(&dev->gadget, &dev->setup_data); ++ spin_lock(&dev->lock); ++ return rc; ++} ++ + /** + * pch_udc_svc_control_in() - Handle Control IN endpoint interrupts + * @dev: Reference to the device structure +@@ -2391,15 +2415,12 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev) + dev->gadget.ep0 = &dev->ep[UDC_EP0IN_IDX].ep; + else /* OUT */ + dev->gadget.ep0 = &ep->ep; +- spin_lock(&dev->lock); + /* If Mass storage Reset */ + if ((dev->setup_data.bRequestType == 0x21) && + (dev->setup_data.bRequest == 0xFF)) + dev->prot_stall = 0; + /* call gadget with setup data received */ +- setup_supported = dev->driver->setup(&dev->gadget, +- &dev->setup_data); +- spin_unlock(&dev->lock); ++ setup_supported = pch_udc_gadget_setup(dev); + + if (dev->setup_data.bRequestType & USB_DIR_IN) { + ep->td_data->status = (ep->td_data->status & +@@ -2647,9 +2668,7 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev) + dev->ep[i].halted = 0; + } + dev->stall = 0; +- spin_unlock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); +- spin_lock(&dev->lock); ++ pch_udc_gadget_setup(dev); + } + + /** +@@ -2684,9 +2703,7 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev) + dev->stall = 0; + + /* call gadget zero with setup data received */ +- spin_unlock(&dev->lock); +- dev->driver->setup(&dev->gadget, &dev->setup_data); +- spin_lock(&dev->lock); ++ pch_udc_gadget_setup(dev); + } + + /** +@@ -2960,7 +2977,7 @@ static int init_dma_pools(struct pch_udc_dev *dev) + dev->dma_addr = dma_map_single(&dev->pdev->dev, ep0out_buf, + UDC_EP0OUT_BUFF_SIZE * 4, + DMA_FROM_DEVICE); +- return 0; ++ return dma_mapping_error(&dev->pdev->dev, dev->dma_addr); + } + + static int pch_udc_start(struct usb_gadget *g, +diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c +index 230e3248f3860..80503c3604ca5 100644 +--- a/drivers/usb/gadget/udc/r8a66597-udc.c ++++ b/drivers/usb/gadget/udc/r8a66597-udc.c +@@ -1855,6 +1855,8 @@ static int r8a66597_probe(struct platform_device *pdev) + return PTR_ERR(reg); + + ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0); ++ if (!ires) ++ return -EINVAL; + irq = ires->start; + irq_trigger = ires->flags & IRQF_TRIGGER_MASK; + +diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c +index 72853020a5426..15249e664b89e 100644 +--- a/drivers/usb/host/fotg210-hcd.c ++++ b/drivers/usb/host/fotg210-hcd.c +@@ -5599,7 +5599,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) + struct usb_hcd *hcd; + struct resource *res; + int irq; +- int retval = -ENODEV; ++ int retval; + struct fotg210_hcd *fotg210; + + if (usb_disabled()) +@@ -5619,7 +5619,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) + hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev, + dev_name(dev)); + if (!hcd) { +- dev_err(dev, "failed to create hcd with err %d\n", retval); ++ dev_err(dev, "failed to create hcd\n"); + retval = -ENOMEM; + goto fail_create_hcd; + } +diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c +index fd2a11473be79..455c59fe32fa7 100644 +--- a/drivers/usb/host/sl811-hcd.c ++++ b/drivers/usb/host/sl811-hcd.c +@@ -1286,11 +1286,10 @@ sl811h_hub_control( + goto error; + put_unaligned_le32(sl811->port1, buf); + +-#ifndef VERBOSE +- if (*(u16*)(buf+2)) /* only if wPortChange is interesting */ +-#endif +- dev_dbg(hcd->self.controller, "GetPortStatus %08x\n", +- sl811->port1); ++ if (__is_defined(VERBOSE) || ++ *(u16*)(buf+2)) /* only if wPortChange is interesting */ ++ dev_dbg(hcd->self.controller, "GetPortStatus %08x\n", ++ sl811->port1); + break; + case SetPortFeature: + if (wIndex != 1 || wLength != 0) +diff --git a/drivers/usb/host/xhci-ext-caps.h b/drivers/usb/host/xhci-ext-caps.h +index e0244fb3903dc..1e9b2ed83da24 100644 +--- a/drivers/usb/host/xhci-ext-caps.h ++++ b/drivers/usb/host/xhci-ext-caps.h +@@ -19,8 +19,9 @@ + * along with this program; if not, write to the Free Software Foundation, + * Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ +-/* Up to 16 ms to halt an HC */ +-#define XHCI_MAX_HALT_USEC (16*1000) ++ ++/* HC should halt within 16 ms, but use 32 ms as some hosts take longer */ ++#define XHCI_MAX_HALT_USEC (32 * 1000) + /* HC not running - set to 1 when run/stop bit is cleared. */ + #define XHCI_STS_HALT (1<<0) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 3cca60b845a86..9b30936904da7 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -2159,6 +2159,15 @@ static void xhci_add_in_port(struct xhci_hcd *xhci, unsigned int num_ports, + + if (major_revision == 0x03) { + rhub = &xhci->usb3_rhub; ++ /* ++ * Some hosts incorrectly use sub-minor version for minor ++ * version (i.e. 0x02 instead of 0x20 for bcdUSB 0x320 and 0x01 ++ * for bcdUSB 0x310). Since there is no USB release with sub ++ * minor version 0x301 to 0x309, we can assume that they are ++ * incorrect and fix it here. ++ */ ++ if (minor_revision > 0x00 && minor_revision < 0x10) ++ minor_revision <<= 4; + } else if (major_revision <= 0x02) { + rhub = &xhci->usb2_rhub; + } else { +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 809f5f2b0dd9f..ec00eff017942 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1309,7 +1309,7 @@ static int xhci_configure_endpoint(struct xhci_hcd *xhci, + * we need to issue an evaluate context command and wait on it. + */ + static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id, +- unsigned int ep_index, struct urb *urb) ++ unsigned int ep_index, struct urb *urb, gfp_t mem_flags) + { + struct xhci_container_ctx *out_ctx; + struct xhci_input_control_ctx *ctrl_ctx; +@@ -1340,7 +1340,7 @@ static int xhci_check_maxpacket(struct xhci_hcd *xhci, unsigned int slot_id, + * changes max packet sizes. + */ + +- command = xhci_alloc_command(xhci, false, true, GFP_KERNEL); ++ command = xhci_alloc_command(xhci, false, true, mem_flags); + if (!command) + return -ENOMEM; + +@@ -1447,7 +1447,7 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags) + */ + if (urb->dev->speed == USB_SPEED_FULL) { + ret = xhci_check_maxpacket(xhci, slot_id, +- ep_index, urb); ++ ep_index, urb, mem_flags); + if (ret < 0) { + xhci_urb_free_priv(urb_priv); + urb->hcpriv = NULL; +diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c +index 2811c4afde01c..e8ea768481049 100644 +--- a/drivers/video/fbdev/core/fbcmap.c ++++ b/drivers/video/fbdev/core/fbcmap.c +@@ -101,17 +101,17 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cmap, int len, int transp, gfp_t flags) + if (!len) + return 0; + +- cmap->red = kmalloc(size, flags); ++ cmap->red = kzalloc(size, flags); + if (!cmap->red) + goto fail; +- cmap->green = kmalloc(size, flags); ++ cmap->green = kzalloc(size, flags); + if (!cmap->green) + goto fail; +- cmap->blue = kmalloc(size, flags); ++ cmap->blue = kzalloc(size, flags); + if (!cmap->blue) + goto fail; + if (transp) { +- cmap->transp = kmalloc(size, flags); ++ cmap->transp = kzalloc(size, flags); + if (!cmap->transp) + goto fail; + } else { +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index ebca009030c3a..cb6e1ce1e25f5 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -557,8 +557,6 @@ static noinline int create_subvol(struct inode *dir, + btrfs_set_root_otransid(root_item, trans->transid); + + btrfs_tree_unlock(leaf); +- free_extent_buffer(leaf); +- leaf = NULL; + + btrfs_set_root_dirid(root_item, new_dirid); + +@@ -567,8 +565,22 @@ static noinline int create_subvol(struct inode *dir, + key.type = BTRFS_ROOT_ITEM_KEY; + ret = btrfs_insert_root(trans, root->fs_info->tree_root, &key, + root_item); +- if (ret) ++ if (ret) { ++ /* ++ * Since we don't abort the transaction in this case, free the ++ * tree block so that we don't leak space and leave the ++ * filesystem in an inconsistent state (an extent item in the ++ * extent tree without backreferences). Also no need to have ++ * the tree block locked since it is not in any tree at this ++ * point, so no other task can find it and use it. ++ */ ++ btrfs_free_tree_block(trans, root, leaf, 0, 1); ++ free_extent_buffer(leaf); + goto fail; ++ } ++ ++ free_extent_buffer(leaf); ++ leaf = NULL; + + key.offset = (u64)-1; + new_root = btrfs_read_fs_root_no_name(root->fs_info, &key); +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index cd5b86d80e7a0..5caf4dbdd8017 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1801,8 +1801,8 @@ int replace_path(struct btrfs_trans_handle *trans, + int ret; + int slot; + +- BUG_ON(src->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID); +- BUG_ON(dest->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID); ++ ASSERT(src->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID); ++ ASSERT(dest->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID); + + last_snapshot = btrfs_root_last_snapshot(&src->root_item); + again: +@@ -1834,7 +1834,7 @@ again: + parent = eb; + while (1) { + level = btrfs_header_level(parent); +- BUG_ON(level < lowest_level); ++ ASSERT(level >= lowest_level); + + ret = btrfs_bin_search(parent, &key, level, &slot); + if (ret && slot > 0) +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index 2a351821d8f32..0eb2ada032c74 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -1577,6 +1577,7 @@ static int try_nonblocking_invalidate(struct inode *inode) + u32 invalidating_gen = ci->i_rdcache_gen; + + spin_unlock(&ci->i_ceph_lock); ++ ceph_fscache_invalidate(inode); + invalidate_mapping_pages(&inode->i_data, 0, -1); + spin_lock(&ci->i_ceph_lock); + +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 049cff197d2a1..5e12ea92f7cdb 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1762,6 +1762,7 @@ static void ceph_invalidate_work(struct work_struct *work) + orig_gen = ci->i_rdcache_gen; + spin_unlock(&ci->i_ceph_lock); + ++ ceph_fscache_invalidate(inode); + if (invalidate_inode_pages2(inode->i_mapping) < 0) { + pr_err("invalidate_pages %p fails\n", inode); + } +diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c +index 466f7d60edc27..fabce23fdbacc 100644 +--- a/fs/dlm/debug_fs.c ++++ b/fs/dlm/debug_fs.c +@@ -545,6 +545,7 @@ static void *table_seq_next(struct seq_file *seq, void *iter_ptr, loff_t *pos) + + if (bucket >= ls->ls_rsbtbl_size) { + kfree(ri); ++ ++*pos; + return NULL; + } + tree = toss ? &ls->ls_rsbtbl[bucket].toss : &ls->ls_rsbtbl[bucket].keep; +diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c +index 151872dcc1f40..7468f2753e992 100644 +--- a/fs/ecryptfs/main.c ++++ b/fs/ecryptfs/main.c +@@ -506,6 +506,12 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags + goto out; + } + ++ if (!dev_name) { ++ rc = -EINVAL; ++ err = "Device name cannot be null"; ++ goto out; ++ } ++ + rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid); + if (rc) { + err = "Error parsing options"; +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 2b699b1f42c00..11ebd274b7c00 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -1286,6 +1286,7 @@ int ext4_init_inode_table(struct super_block *sb, ext4_group_t group, + handle_t *handle; + ext4_fsblk_t blk; + int num, ret = 0, used_blks = 0; ++ unsigned long used_inos = 0; + + /* This should not happen, but just to be sure check this */ + if (sb->s_flags & MS_RDONLY) { +@@ -1316,22 +1317,37 @@ int ext4_init_inode_table(struct super_block *sb, ext4_group_t group, + * used inodes so we need to skip blocks with used inodes in + * inode table. + */ +- if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT))) +- used_blks = DIV_ROUND_UP((EXT4_INODES_PER_GROUP(sb) - +- ext4_itable_unused_count(sb, gdp)), +- sbi->s_inodes_per_block); +- +- if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) || +- ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) - +- ext4_itable_unused_count(sb, gdp)) < +- EXT4_FIRST_INO(sb)))) { +- ext4_error(sb, "Something is wrong with group %u: " +- "used itable blocks: %d; " +- "itable unused count: %u", +- group, used_blks, +- ext4_itable_unused_count(sb, gdp)); +- ret = 1; +- goto err_out; ++ if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT))) { ++ used_inos = EXT4_INODES_PER_GROUP(sb) - ++ ext4_itable_unused_count(sb, gdp); ++ used_blks = DIV_ROUND_UP(used_inos, sbi->s_inodes_per_block); ++ ++ /* Bogus inode unused count? */ ++ if (used_blks < 0 || used_blks > sbi->s_itb_per_group) { ++ ext4_error(sb, "Something is wrong with group %u: " ++ "used itable blocks: %d; " ++ "itable unused count: %u", ++ group, used_blks, ++ ext4_itable_unused_count(sb, gdp)); ++ ret = 1; ++ goto err_out; ++ } ++ ++ used_inos += group * EXT4_INODES_PER_GROUP(sb); ++ /* ++ * Are there some uninitialized inodes in the inode table ++ * before the first normal inode? ++ */ ++ if ((used_blks != sbi->s_itb_per_group) && ++ (used_inos < EXT4_FIRST_INO(sb))) { ++ ext4_error(sb, "Something is wrong with group %u: " ++ "itable unused count: %u; " ++ "itables initialized count: %ld", ++ group, ext4_itable_unused_count(sb, gdp), ++ used_inos); ++ ret = 1; ++ goto err_out; ++ } + } + + blk = ext4_inode_table(sb, gdp) + used_blks; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index f70c5541d718d..ca89590d1df57 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4678,8 +4678,10 @@ static int ext4_commit_super(struct super_block *sb, int sync) + struct buffer_head *sbh = EXT4_SB(sb)->s_sbh; + int error = 0; + +- if (!sbh || block_device_ejected(sb)) +- return error; ++ if (!sbh) ++ return -EINVAL; ++ if (block_device_ejected(sb)) ++ return -ENODEV; + + /* + * If the file system is mounted read-only, don't update the +diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c +index 482888ee89429..481fae63f1630 100644 +--- a/fs/f2fs/inline.c ++++ b/fs/f2fs/inline.c +@@ -196,7 +196,8 @@ out: + + f2fs_put_page(page, 1); + +- f2fs_balance_fs(sbi, dn.node_changed); ++ if (!err) ++ f2fs_balance_fs(sbi, dn.node_changed); + + return err; + } +diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c +index d9aba97007267..b83367300f487 100644 +--- a/fs/fuse/cuse.c ++++ b/fs/fuse/cuse.c +@@ -616,6 +616,8 @@ static int __init cuse_init(void) + cuse_channel_fops.owner = THIS_MODULE; + cuse_channel_fops.open = cuse_channel_open; + cuse_channel_fops.release = cuse_channel_release; ++ /* CUSE is not prepared for FUSE_DEV_IOC_CLONE */ ++ cuse_channel_fops.unlocked_ioctl = NULL; + + cuse_class = class_create(THIS_MODULE, "cuse"); + if (IS_ERR(cuse_class)) +diff --git a/fs/jffs2/compr_rtime.c b/fs/jffs2/compr_rtime.c +index 406d9cc84ba8d..79e771ab624f4 100644 +--- a/fs/jffs2/compr_rtime.c ++++ b/fs/jffs2/compr_rtime.c +@@ -37,6 +37,9 @@ static int jffs2_rtime_compress(unsigned char *data_in, + int outpos = 0; + int pos=0; + ++ if (*dstlen <= 3) ++ return -1; ++ + memset(positions,0,sizeof(positions)); + + while (pos < (*sourcelen) && outpos <= (*dstlen)-2) { +diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c +index 90431dd613b8d..08813789fcf06 100644 +--- a/fs/jffs2/scan.c ++++ b/fs/jffs2/scan.c +@@ -1075,7 +1075,7 @@ static int jffs2_scan_dirent_node(struct jffs2_sb_info *c, struct jffs2_eraseblo + memcpy(&fd->name, rd->name, checkedlen); + fd->name[checkedlen] = 0; + +- crc = crc32(0, fd->name, rd->nsize); ++ crc = crc32(0, fd->name, checkedlen); + if (crc != je32_to_cpu(rd->name_crc)) { + pr_notice("%s(): Name CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n", + __func__, ofs, je32_to_cpu(rd->name_crc), crc); +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 83149cbae0931..ee12253697009 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -93,7 +93,7 @@ static int decode_nfs_fh(struct xdr_stream *xdr, struct nfs_fh *fh) + if (unlikely(!p)) + return -ENOBUFS; + fh->size = be32_to_cpup(p++); +- if (fh->size > sizeof(struct nfs_fh)) { ++ if (fh->size > NFS_MAXFHSIZE) { + printk(KERN_ERR "NFS flexfiles: Too big fh received %d\n", + fh->size); + return -EOVERFLOW; +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index 6c0035761d170..7a94f5a5f8c8c 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1469,10 +1469,10 @@ EXPORT_SYMBOL_GPL(_nfs_display_fhandle); + */ + static int nfs_inode_attrs_need_update(const struct inode *inode, const struct nfs_fattr *fattr) + { +- const struct nfs_inode *nfsi = NFS_I(inode); ++ unsigned long attr_gencount = NFS_I(inode)->attr_gencount; + +- return ((long)fattr->gencount - (long)nfsi->attr_gencount) > 0 || +- ((long)nfsi->attr_gencount - (long)nfs_read_attr_generation_counter() > 0); ++ return (long)(fattr->gencount - attr_gencount) > 0 || ++ (long)(attr_gencount - nfs_read_attr_generation_counter()) > 0; + } + + static int nfs_refresh_inode_locked(struct inode *inode, struct nfs_fattr *fattr) +@@ -1882,7 +1882,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + nfsi->attrtimeo_timestamp = now; + } + /* Set the barrier to be more recent than this fattr */ +- if ((long)fattr->gencount - (long)nfsi->attr_gencount > 0) ++ if ((long)(fattr->gencount - nfsi->attr_gencount) > 0) + nfsi->attr_gencount = fattr->gencount; + } + +diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c +index 5cda392028ce1..7efb9e0e9f25b 100644 +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -56,7 +56,8 @@ static int _nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep, + static int nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep, + loff_t offset, loff_t len) + { +- struct nfs_server *server = NFS_SERVER(file_inode(filep)); ++ struct inode *inode = file_inode(filep); ++ struct nfs_server *server = NFS_SERVER(inode); + struct nfs4_exception exception = { }; + struct nfs_lock_context *lock; + int err; +@@ -65,9 +66,13 @@ static int nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep, + if (IS_ERR(lock)) + return PTR_ERR(lock); + +- exception.inode = file_inode(filep); ++ exception.inode = inode; + exception.state = lock->open_context->state; + ++ err = nfs_sync_inode(inode); ++ if (err) ++ goto out; ++ + do { + err = _nfs42_proc_fallocate(msg, filep, lock, offset, len); + if (err == -ENOTSUPP) { +@@ -76,7 +81,7 @@ static int nfs42_proc_fallocate(struct rpc_message *msg, struct file *filep, + } + err = nfs4_handle_exception(server, err, &exception); + } while (exception.retry); +- ++out: + nfs_put_lock_context(lock); + return err; + } +@@ -114,16 +119,13 @@ int nfs42_proc_deallocate(struct file *filep, loff_t offset, loff_t len) + return -EOPNOTSUPP; + + inode_lock(inode); +- err = nfs_sync_inode(inode); +- if (err) +- goto out_unlock; + + err = nfs42_proc_fallocate(&msg, filep, offset, len); + if (err == 0) + truncate_pagecache_range(inode, offset, (offset + len) -1); + if (err == -EOPNOTSUPP) + NFS_SERVER(inode)->caps &= ~NFS_CAP_DEALLOCATE; +-out_unlock: ++ + inode_unlock(inode); + return err; + } +@@ -292,7 +294,10 @@ static loff_t _nfs42_proc_llseek(struct file *filep, + if (status) + return status; + +- return vfs_setpos(filep, res.sr_offset, inode->i_sb->s_maxbytes); ++ if (whence == SEEK_DATA && res.sr_eof) ++ return -NFS4ERR_NXIO; ++ else ++ return vfs_setpos(filep, res.sr_offset, inode->i_sb->s_maxbytes); + } + + loff_t nfs42_proc_llseek(struct file *filep, loff_t offset, int whence) +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index c3abf92adfb7d..d347d95a1bac1 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1088,7 +1088,7 @@ _pnfs_return_layout(struct inode *ino) + pnfs_get_layout_hdr(lo); + empty = list_empty(&lo->plh_segs); + pnfs_clear_layoutcommit(ino, &tmp_list); +- pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL, 0); ++ pnfs_mark_matching_lsegs_return(lo, &tmp_list, NULL, 0); + + if (NFS_SERVER(ino)->pnfs_curr_ld->return_range) { + struct pnfs_layout_range range = { +diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c +index f1c1430ae7213..0bcb83479fcba 100644 +--- a/fs/squashfs/file.c ++++ b/fs/squashfs/file.c +@@ -224,11 +224,11 @@ failure: + * If the skip factor is limited in this way then the file will use multiple + * slots. + */ +-static inline int calculate_skip(int blocks) ++static inline int calculate_skip(u64 blocks) + { +- int skip = blocks / ((SQUASHFS_META_ENTRIES + 1) ++ u64 skip = blocks / ((SQUASHFS_META_ENTRIES + 1) + * SQUASHFS_META_INDEXES); +- return min(SQUASHFS_CACHED_BLKS - 1, skip + 1); ++ return min((u64) SQUASHFS_CACHED_BLKS - 1, skip + 1); + } + + +diff --git a/include/linux/extcon/extcon-adc-jack.h b/include/linux/extcon/extcon-adc-jack.h +index a0e03b13b449d..2aa32075bca15 100644 +--- a/include/linux/extcon/extcon-adc-jack.h ++++ b/include/linux/extcon/extcon-adc-jack.h +@@ -59,7 +59,7 @@ struct adc_jack_pdata { + const char *name; + const char *consumer_channel; + +- const enum extcon *cable_names; ++ const unsigned int *cable_names; + + /* The last entry's state should be 0 */ + struct adc_jack_cond *adc_conditions; +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 981657075f051..41c372573a289 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -248,6 +248,8 @@ struct hid_item { + #define HID_CP_SELECTION 0x000c0080 + #define HID_CP_MEDIASELECTION 0x000c0087 + #define HID_CP_SELECTDISC 0x000c00ba ++#define HID_CP_VOLUMEUP 0x000c00e9 ++#define HID_CP_VOLUMEDOWN 0x000c00ea + #define HID_CP_PLAYBACKSPEED 0x000c00f1 + #define HID_CP_PROXIMITY 0x000c0109 + #define HID_CP_SPEAKERSYSTEM 0x000c0160 +diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h +index b742b5e47cc20..ae63c962fa22c 100644 +--- a/include/linux/tty_driver.h ++++ b/include/linux/tty_driver.h +@@ -235,7 +235,7 @@ + * + * Called when the device receives a TIOCGICOUNT ioctl. Passed a kernel + * structure to complete. This method is optional and will only be called +- * if provided (otherwise EINVAL will be returned). ++ * if provided (otherwise ENOTTY will be returned). + */ + + #include +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 52b5352e8fe08..33db6c6d3fba8 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -512,6 +512,7 @@ struct hci_chan { + struct sk_buff_head data_q; + unsigned int sent; + __u8 state; ++ bool amp; + }; + + struct hci_conn_params { +diff --git a/include/scsi/libfcoe.h b/include/scsi/libfcoe.h +index 6be92eede5c01..a911f993219d7 100644 +--- a/include/scsi/libfcoe.h ++++ b/include/scsi/libfcoe.h +@@ -261,7 +261,7 @@ int fcoe_ctlr_recv_flogi(struct fcoe_ctlr *, struct fc_lport *, + struct fc_frame *); + + /* libfcoe funcs */ +-u64 fcoe_wwn_from_mac(unsigned char mac[], unsigned int, unsigned int); ++u64 fcoe_wwn_from_mac(unsigned char mac[MAX_ADDR_LEN], unsigned int, unsigned int); + int fcoe_libfc_config(struct fc_lport *, struct fcoe_ctlr *, + const struct libfc_function_template *, int init_fcp); + u32 fcoe_fc_crc(struct fc_frame *fp); +diff --git a/include/uapi/linux/tty_flags.h b/include/uapi/linux/tty_flags.h +index 66e4d8bcb16f9..9f9572b2a596c 100644 +--- a/include/uapi/linux/tty_flags.h ++++ b/include/uapi/linux/tty_flags.h +@@ -38,7 +38,7 @@ + * WARNING: These flags are no longer used and have been superceded by the + * TTY_PORT_ flags in the iflags field (and not userspace-visible) + */ +-#ifndef _KERNEL_ ++#ifndef __KERNEL__ + #define ASYNCB_INITIALIZED 31 /* Serial port was initialized */ + #define ASYNCB_SUSPENDED 30 /* Serial port is suspended */ + #define ASYNCB_NORMAL_ACTIVE 29 /* Normal device is active */ +@@ -80,7 +80,7 @@ + #define ASYNC_SPD_WARP (ASYNC_SPD_HI|ASYNC_SPD_SHI) + #define ASYNC_SPD_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI|ASYNC_SPD_SHI) + +-#ifndef _KERNEL_ ++#ifndef __KERNEL__ + /* These flags are no longer used (and were always masked from userspace) */ + #define ASYNC_INITIALIZED (1U << ASYNCB_INITIALIZED) + #define ASYNC_NORMAL_ACTIVE (1U << ASYNCB_NORMAL_ACTIVE) +diff --git a/kernel/futex.c b/kernel/futex.c +index 468f39476476b..324fb85c89049 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -3860,8 +3860,7 @@ long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, + + if (op & FUTEX_CLOCK_REALTIME) { + flags |= FLAGS_CLOCKRT; +- if (cmd != FUTEX_WAIT && cmd != FUTEX_WAIT_BITSET && \ +- cmd != FUTEX_WAIT_REQUEUE_PI) ++ if (cmd != FUTEX_WAIT_BITSET && cmd != FUTEX_WAIT_REQUEUE_PI) + return -ENOSYS; + } + +diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c +index 037c321c56188..2edaed6803ff7 100644 +--- a/kernel/kexec_file.c ++++ b/kernel/kexec_file.c +@@ -528,8 +528,10 @@ static int kexec_calculate_store_digests(struct kimage *image) + + sha_region_sz = KEXEC_SEGMENT_MAX * sizeof(struct kexec_sha_region); + sha_regions = vzalloc(sha_region_sz); +- if (!sha_regions) ++ if (!sha_regions) { ++ ret = -ENOMEM; + goto out_free_desc; ++ } + + desc->tfm = tfm; + desc->flags = 0; +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index ce49b62b08346..a6851f8b9b245 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -4486,8 +4486,11 @@ int ftrace_regex_release(struct inode *inode, struct file *file) + + parser = &iter->parser; + if (trace_parser_loaded(parser)) { ++ int enable = !(iter->flags & FTRACE_ITER_NOTRACE); ++ + parser->buffer[parser->idx] = 0; +- ftrace_match_records(iter->hash, parser->buffer, parser->idx); ++ ftrace_process_regex(iter->hash, parser->buffer, ++ parser->idx, enable); + } + + trace_parser_put(parser); +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 8c6b682b83b80..55b7b4cf0080d 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1809,10 +1809,13 @@ void trace_stop_cmdline_recording(void); + + static int trace_save_cmdline(struct task_struct *tsk) + { +- unsigned pid, idx; ++ unsigned tpid, idx; + +- if (!tsk->pid || unlikely(tsk->pid > PID_MAX_DEFAULT)) +- return 0; ++ /* treat recording of idle task as a success */ ++ if (!tsk->pid) ++ return 1; ++ ++ tpid = tsk->pid & (PID_MAX_DEFAULT - 1); + + /* + * It's not the end of the world if we don't get +@@ -1823,26 +1826,15 @@ static int trace_save_cmdline(struct task_struct *tsk) + if (!arch_spin_trylock(&trace_cmdline_lock)) + return 0; + +- idx = savedcmd->map_pid_to_cmdline[tsk->pid]; ++ idx = savedcmd->map_pid_to_cmdline[tpid]; + if (idx == NO_CMDLINE_MAP) { + idx = (savedcmd->cmdline_idx + 1) % savedcmd->cmdline_num; + +- /* +- * Check whether the cmdline buffer at idx has a pid +- * mapped. We are going to overwrite that entry so we +- * need to clear the map_pid_to_cmdline. Otherwise we +- * would read the new comm for the old pid. +- */ +- pid = savedcmd->map_cmdline_to_pid[idx]; +- if (pid != NO_CMDLINE_MAP) +- savedcmd->map_pid_to_cmdline[pid] = NO_CMDLINE_MAP; +- +- savedcmd->map_cmdline_to_pid[idx] = tsk->pid; +- savedcmd->map_pid_to_cmdline[tsk->pid] = idx; +- ++ savedcmd->map_pid_to_cmdline[tpid] = idx; + savedcmd->cmdline_idx = idx; + } + ++ savedcmd->map_cmdline_to_pid[idx] = tsk->pid; + set_cmdline(idx, tsk->comm); + + arch_spin_unlock(&trace_cmdline_lock); +@@ -1853,6 +1845,7 @@ static int trace_save_cmdline(struct task_struct *tsk) + static void __trace_find_cmdline(int pid, char comm[]) + { + unsigned map; ++ int tpid; + + if (!pid) { + strcpy(comm, ""); +@@ -1864,16 +1857,16 @@ static void __trace_find_cmdline(int pid, char comm[]) + return; + } + +- if (pid > PID_MAX_DEFAULT) { +- strcpy(comm, "<...>"); +- return; ++ tpid = pid & (PID_MAX_DEFAULT - 1); ++ map = savedcmd->map_pid_to_cmdline[tpid]; ++ if (map != NO_CMDLINE_MAP) { ++ tpid = savedcmd->map_cmdline_to_pid[map]; ++ if (tpid == pid) { ++ strlcpy(comm, get_saved_cmdlines(map), TASK_COMM_LEN); ++ return; ++ } + } +- +- map = savedcmd->map_pid_to_cmdline[pid]; +- if (map != NO_CMDLINE_MAP) +- strcpy(comm, get_saved_cmdlines(map)); +- else +- strcpy(comm, "<...>"); ++ strcpy(comm, "<...>"); + } + + void trace_find_cmdline(int pid, char comm[]) +diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c +index 0f06532a755b7..b67ea5eed2a89 100644 +--- a/kernel/trace/trace_clock.c ++++ b/kernel/trace/trace_clock.c +@@ -93,33 +93,49 @@ u64 notrace trace_clock_global(void) + { + unsigned long flags; + int this_cpu; +- u64 now; ++ u64 now, prev_time; + + local_irq_save(flags); + + this_cpu = raw_smp_processor_id(); +- now = sched_clock_cpu(this_cpu); ++ + /* +- * If in an NMI context then dont risk lockups and return the +- * cpu_clock() time: ++ * The global clock "guarantees" that the events are ordered ++ * between CPUs. But if two events on two different CPUS call ++ * trace_clock_global at roughly the same time, it really does ++ * not matter which one gets the earlier time. Just make sure ++ * that the same CPU will always show a monotonic clock. ++ * ++ * Use a read memory barrier to get the latest written ++ * time that was recorded. + */ +- if (unlikely(in_nmi())) +- goto out; ++ smp_rmb(); ++ prev_time = READ_ONCE(trace_clock_struct.prev_time); ++ now = sched_clock_cpu(this_cpu); + +- arch_spin_lock(&trace_clock_struct.lock); ++ /* Make sure that now is always greater than prev_time */ ++ if ((s64)(now - prev_time) < 0) ++ now = prev_time + 1; + + /* +- * TODO: if this happens often then maybe we should reset +- * my_scd->clock to prev_time+1, to make sure +- * we start ticking with the local clock from now on? ++ * If in an NMI context then dont risk lockups and simply return ++ * the current time. + */ +- if ((s64)(now - trace_clock_struct.prev_time) < 0) +- now = trace_clock_struct.prev_time + 1; ++ if (unlikely(in_nmi())) ++ goto out; + +- trace_clock_struct.prev_time = now; ++ /* Tracing can cause strange recursion, always use a try lock */ ++ if (arch_spin_trylock(&trace_clock_struct.lock)) { ++ /* Reread prev_time in case it was already updated */ ++ prev_time = READ_ONCE(trace_clock_struct.prev_time); ++ if ((s64)(now - prev_time) < 0) ++ now = prev_time + 1; + +- arch_spin_unlock(&trace_clock_struct.lock); ++ trace_clock_struct.prev_time = now; + ++ /* The unlock acts as the wmb for the above rmb */ ++ arch_spin_unlock(&trace_clock_struct.lock); ++ } + out: + local_irq_restore(flags); + +diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c +index f6c2c1e7779c9..6104daf98ad9f 100644 +--- a/lib/kobject_uevent.c ++++ b/lib/kobject_uevent.c +@@ -128,12 +128,13 @@ static int kobj_usermode_filter(struct kobject *kobj) + + static int init_uevent_argv(struct kobj_uevent_env *env, const char *subsystem) + { ++ int buffer_size = sizeof(env->buf) - env->buflen; + int len; + +- len = strlcpy(&env->buf[env->buflen], subsystem, +- sizeof(env->buf) - env->buflen); +- if (len >= (sizeof(env->buf) - env->buflen)) { +- WARN(1, KERN_ERR "init_uevent_argv: buffer size too small\n"); ++ len = strlcpy(&env->buf[env->buflen], subsystem, buffer_size); ++ if (len >= buffer_size) { ++ pr_warn("init_uevent_argv: buffer size of %d too small, needed %d\n", ++ buffer_size, len); + return -ENOMEM; + } + +diff --git a/lib/stackdepot.c b/lib/stackdepot.c +index 759ff419fe61f..c519aa07d2e98 100644 +--- a/lib/stackdepot.c ++++ b/lib/stackdepot.c +@@ -78,7 +78,7 @@ static void *stack_slabs[STACK_ALLOC_MAX_SLABS]; + static int depot_index; + static int next_slab_inited; + static size_t depot_offset; +-static DEFINE_SPINLOCK(depot_lock); ++static DEFINE_RAW_SPINLOCK(depot_lock); + + static bool init_stack_slab(void **prealloc) + { +@@ -253,7 +253,7 @@ depot_stack_handle_t depot_save_stack(struct stack_trace *trace, + prealloc = page_address(page); + } + +- spin_lock_irqsave(&depot_lock, flags); ++ raw_spin_lock_irqsave(&depot_lock, flags); + + found = find_stack(*bucket, trace->entries, trace->nr_entries, hash); + if (!found) { +@@ -277,7 +277,7 @@ depot_stack_handle_t depot_save_stack(struct stack_trace *trace, + WARN_ON(!init_stack_slab(&prealloc)); + } + +- spin_unlock_irqrestore(&depot_lock, flags); ++ raw_spin_unlock_irqrestore(&depot_lock, flags); + exit: + if (prealloc) { + /* Nobody used this memory, ok to free it. */ +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index e2b5e38e7a4b7..9049e8613237f 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -586,13 +586,20 @@ void hugetlb_fix_reserve_counts(struct inode *inode) + { + struct hugepage_subpool *spool = subpool_inode(inode); + long rsv_adjust; ++ bool reserved = false; + + rsv_adjust = hugepage_subpool_get_pages(spool, 1); +- if (rsv_adjust) { ++ if (rsv_adjust > 0) { + struct hstate *h = hstate_inode(inode); + +- hugetlb_acct_memory(h, 1); ++ if (!hugetlb_acct_memory(h, 1)) ++ reserved = true; ++ } else if (!rsv_adjust) { ++ reserved = true; + } ++ ++ if (!reserved) ++ pr_warn("hugetlb: Huge Page Reserved count may go negative.\n"); + } + + /* +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 753b0e2fef368..0f1bdbae45e21 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -596,17 +596,17 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma, + mmu_notifier_test_young(vma->vm_mm, address)) + referenced++; + } +- if (likely(writable)) { +- if (likely(referenced)) { +- result = SCAN_SUCCEED; +- trace_mm_collapse_huge_page_isolate(page, none_or_zero, +- referenced, writable, result); +- return 1; +- } +- } else { ++ ++ if (unlikely(!writable)) { + result = SCAN_PAGE_RO; ++ } else if (unlikely(!referenced)) { ++ result = SCAN_LACK_REFERENCED_PAGE; ++ } else { ++ result = SCAN_SUCCEED; ++ trace_mm_collapse_huge_page_isolate(page, none_or_zero, ++ referenced, writable, result); ++ return 1; + } +- + out: + release_pte_pages(pte, _pte); + trace_mm_collapse_huge_page_isolate(page, none_or_zero, +diff --git a/mm/ksm.c b/mm/ksm.c +index d6c81a5076a78..27ff68050d856 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -629,6 +629,7 @@ static void remove_rmap_item_from_tree(struct rmap_item *rmap_item) + ksm_pages_shared--; + + put_anon_vma(rmap_item->anon_vma); ++ rmap_item->head = NULL; + rmap_item->address &= PAGE_MASK; + + } else if (rmap_item->address & UNSTABLE_FLAG) { +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index d01bf6a111cee..44eeb27e341af 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4399,6 +4399,7 @@ static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) + return; + + hchan->handle = le16_to_cpu(ev->handle); ++ hchan->amp = true; + + BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan); + +@@ -4431,7 +4432,7 @@ static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, + hci_dev_lock(hdev); + + hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle)); +- if (!hchan) ++ if (!hchan || !hchan->amp) + goto unlock; + + amp_destroy_logical_link(hchan, ev->reason); +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 4a89e121d6627..bfbfe17589784 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -275,12 +275,16 @@ int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req, + { + int ret; + +- if (!test_bit(HCI_UP, &hdev->flags)) +- return -ENETDOWN; +- + /* Serialize all requests */ + hci_req_sync_lock(hdev); +- ret = __hci_req_sync(hdev, req, opt, timeout, hci_status); ++ /* check the state after obtaing the lock to protect the HCI_UP ++ * against any races from hci_dev_do_close when the controller ++ * gets removed. ++ */ ++ if (test_bit(HCI_UP, &hdev->flags)) ++ ret = __hci_req_sync(hdev, req, opt, timeout, hci_status); ++ else ++ ret = -ENETDOWN; + hci_req_sync_unlock(hdev); + + return ret; +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index b96818cda12da..204b6ebd2a24e 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -445,6 +445,8 @@ struct l2cap_chan *l2cap_chan_create(void) + if (!chan) + return NULL; + ++ skb_queue_head_init(&chan->tx_q); ++ skb_queue_head_init(&chan->srej_q); + mutex_init(&chan->lock); + + /* Set default lock nesting level */ +@@ -510,7 +512,9 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan) + chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; + chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; + chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; ++ + chan->conf_state = 0; ++ set_bit(CONF_NOT_COMPLETE, &chan->conf_state); + + set_bit(FLAG_FORCE_ACTIVE, &chan->flags); + } +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index d7206581145d5..336cffd932939 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -310,7 +310,8 @@ void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb, + + node_dst = find_node_by_AddrA(&port->hsr->node_db, eth_hdr(skb)->h_dest); + if (!node_dst) { +- WARN_ONCE(1, "%s: Unknown node\n", __func__); ++ if (net_ratelimit()) ++ netdev_err(skb->dev, "%s: Unknown node\n", __func__); + return; + } + if (port->type != node_dst->AddrB_port) +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index e0a2a3d6772d3..a25dd5c72cff5 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -350,7 +350,6 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net, + if (!(nt->parms.o_flags & TUNNEL_SEQ)) + dev->features |= NETIF_F_LLTX; + +- dev_hold(dev); + ip6gre_tunnel_link(ign, nt); + return nt; + +@@ -1085,8 +1084,6 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev) + strcpy(tunnel->parms.name, dev->name); + + tunnel->hlen = sizeof(struct ipv6hdr) + 4; +- +- dev_hold(dev); + } + + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index d9e60aa2ea1b2..4e18ce5b939ac 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -273,7 +273,6 @@ static int ip6_tnl_create2(struct net_device *dev) + + strcpy(t->parms.name, dev->name); + +- dev_hold(dev); + ip6_tnl_link(ip6n, t); + return 0; + +@@ -1845,6 +1844,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev) + if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT)) + dev->mtu -= 8; + ++ dev_hold(dev); + return 0; + + destroy_dst: +@@ -1888,7 +1888,6 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev) + struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id); + + t->parms.proto = IPPROTO_IPV6; +- dev_hold(dev); + + rcu_assign_pointer(ip6n->tnls_wc[0], t); + return 0; +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index b9f5155a77ef4..f58d69216b616 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -196,7 +196,6 @@ static int vti6_tnl_create2(struct net_device *dev) + + strcpy(t->parms.name, dev->name); + +- dev_hold(dev); + vti6_tnl_link(ip6n, t); + + return 0; +@@ -914,6 +913,7 @@ static inline int vti6_dev_init_gen(struct net_device *dev) + dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); + if (!dev->tstats) + return -ENOMEM; ++ dev_hold(dev); + return 0; + } + +@@ -945,7 +945,6 @@ static int __net_init vti6_fb_tnl_dev_init(struct net_device *dev) + struct vti6_net *ip6n = net_generic(net, vti6_net_id); + + t->parms.proto = IPPROTO_IPV6; +- dev_hold(dev); + + rcu_assign_pointer(ip6n->tnls_wc[0], t); + return 0; +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 157358a15d599..07e545fd2a3d8 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -209,8 +209,6 @@ static int ipip6_tunnel_create(struct net_device *dev) + + ipip6_tunnel_clone_6rd(dev, sitn); + +- dev_hold(dev); +- + ipip6_tunnel_link(sitn, t); + return 0; + +@@ -1400,7 +1398,7 @@ static int ipip6_tunnel_init(struct net_device *dev) + dev->tstats = NULL; + return err; + } +- ++ dev_hold(dev); + return 0; + } + +@@ -1416,7 +1414,6 @@ static void __net_init ipip6_fb_tunnel_init(struct net_device *dev) + iph->ihl = 5; + iph->ttl = 64; + +- dev_hold(dev); + rcu_assign_pointer(sitn->tunnels_wc[0], tunnel); + } + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index f31fd21d59ba9..5f8c6f9563b0b 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1036,8 +1036,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + if (local->hw.wiphy->max_scan_ie_len) + local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len; + +- WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes, +- local->hw.n_cipher_schemes)); ++ if (WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes, ++ local->hw.n_cipher_schemes))) { ++ result = -EINVAL; ++ goto fail_workqueue; ++ } + + result = ieee80211_init_cipher_suites(local); + if (result < 0) +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 58b80270e58c2..3217c98f2b5a2 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -1101,6 +1101,11 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata) + + sdata->vif.csa_active = false; + ifmgd->csa_waiting_bcn = false; ++ /* ++ * If the CSA IE is still present on the beacon after the switch, ++ * we need to consider it as a new CSA (possibly to self). ++ */ ++ ifmgd->beacon_crc_valid = false; + + ret = drv_post_channel_switch(sdata); + if (ret) { +diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c +index 0dbd17137dee6..039fc7c539e2e 100644 +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -551,8 +551,11 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net) + if (net->user_ns != &init_user_ns) + table[0].procname = NULL; + +- if (!net_eq(&init_net, net)) ++ if (!net_eq(&init_net, net)) { ++ table[0].mode = 0444; + table[2].mode = 0444; ++ table[5].mode = 0444; ++ } + + net->ct.sysctl_header = register_net_sysctl(net, "net/netfilter", table); + if (!net->ct.sysctl_header) +diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c +index f864ce19e13db..582f97d035ef1 100644 +--- a/net/nfc/digital_dep.c ++++ b/net/nfc/digital_dep.c +@@ -1289,6 +1289,8 @@ static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg, + } + + rc = nfc_tm_data_received(ddev->nfc_dev, resp); ++ if (rc) ++ resp = NULL; + + exit: + kfree_skb(ddev->chaining_skb); +diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c +index c2bc0f0f04786..22e340a9049c8 100644 +--- a/net/nfc/llcp_sock.c ++++ b/net/nfc/llcp_sock.c +@@ -120,12 +120,14 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) + GFP_KERNEL); + if (!llcp_sock->service_name) { + nfc_llcp_local_put(llcp_sock->local); ++ llcp_sock->local = NULL; + ret = -ENOMEM; + goto put_dev; + } + llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock); + if (llcp_sock->ssap == LLCP_SAP_MAX) { + nfc_llcp_local_put(llcp_sock->local); ++ llcp_sock->local = NULL; + kfree(llcp_sock->service_name); + llcp_sock->service_name = NULL; + ret = -EADDRINUSE; +@@ -721,6 +723,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, + llcp_sock->ssap = nfc_llcp_get_local_ssap(local); + if (llcp_sock->ssap == LLCP_SAP_MAX) { + nfc_llcp_local_put(llcp_sock->local); ++ llcp_sock->local = NULL; + ret = -ENOMEM; + goto put_dev; + } +@@ -759,6 +762,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, + sock_unlink: + nfc_llcp_put_ssap(local, llcp_sock->ssap); + nfc_llcp_local_put(llcp_sock->local); ++ llcp_sock->local = NULL; + + nfc_llcp_sock_unlink(&local->connecting_sockets, sk); + kfree(llcp_sock->service_name); +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index 7135aff3946d7..5fa7b2569a3ab 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -710,16 +710,16 @@ static void ovs_fragment(struct net *net, struct vport *vport, + } + + if (ethertype == htons(ETH_P_IP)) { +- struct dst_entry ovs_dst; ++ struct rtable ovs_rt = { 0 }; + unsigned long orig_dst; + + prepare_frag(vport, skb); +- dst_init(&ovs_dst, &ovs_dst_ops, NULL, 1, ++ dst_init(&ovs_rt.dst, &ovs_dst_ops, NULL, 1, + DST_OBSOLETE_NONE, DST_NOCOUNT); +- ovs_dst.dev = vport->dev; ++ ovs_rt.dst.dev = vport->dev; + + orig_dst = skb->_skb_refdst; +- skb_dst_set_noref(skb, &ovs_dst); ++ skb_dst_set_noref(skb, &ovs_rt.dst); + IPCB(skb)->frag_max_size = mru; + + ip_do_fragment(net, skb->sk, skb, ovs_vport_output); +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index acb0c2631c792..0c5aff3bb5391 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -3129,7 +3129,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, + * primary. + */ + if (af->is_any(&addr)) +- memcpy(&addr.v4, sctp_source(asconf), sizeof(addr)); ++ memcpy(&addr, sctp_source(asconf), sizeof(addr)); + + peer = sctp_assoc_lookup_paddr(asoc, &addr); + if (!peer) +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 146b568962e01..9045f6bcb34c4 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -1851,7 +1851,8 @@ static sctp_disposition_t sctp_sf_do_dupcook_b(struct net *net, + sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc)); + sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, + SCTP_STATE(SCTP_STATE_ESTABLISHED)); +- SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB); ++ if (asoc->state < SCTP_STATE_ESTABLISHED) ++ SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB); + sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL()); + + repl = sctp_make_cookie_ack(new_asoc, chunk); +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 029ec12c77bd7..09a99c92c27dc 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -367,6 +367,18 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt, + return af; + } + ++static void sctp_auto_asconf_init(struct sctp_sock *sp) ++{ ++ struct net *net = sock_net(&sp->inet.sk); ++ ++ if (net->sctp.default_auto_asconf) { ++ spin_lock(&net->sctp.addr_wq_lock); ++ list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist); ++ spin_unlock(&net->sctp.addr_wq_lock); ++ sp->do_auto_asconf = 1; ++ } ++} ++ + /* Bind a local address either to an endpoint or to an association. */ + static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len) + { +@@ -429,8 +441,10 @@ static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len) + } + + /* Refresh ephemeral port. */ +- if (!bp->port) ++ if (!bp->port) { + bp->port = inet_sk(sk)->inet_num; ++ sctp_auto_asconf_init(sp); ++ } + + /* Add the address to the bind address list. + * Use GFP_ATOMIC since BHs will be disabled. +@@ -1582,9 +1596,11 @@ static void sctp_close(struct sock *sk, long timeout) + + /* Supposedly, no process has access to the socket, but + * the net layers still may. ++ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock ++ * held and that should be grabbed before socket lock. + */ +- local_bh_disable(); +- bh_lock_sock(sk); ++ spin_lock_bh(&net->sctp.addr_wq_lock); ++ bh_lock_sock_nested(sk); + + /* Hold the sock, since sk_common_release() will put sock_put() + * and we have just a little more cleanup. +@@ -1593,7 +1609,7 @@ static void sctp_close(struct sock *sk, long timeout) + sk_common_release(sk); + + bh_unlock_sock(sk); +- local_bh_enable(); ++ spin_unlock_bh(&net->sctp.addr_wq_lock); + + sock_put(sk); + +@@ -4260,16 +4276,6 @@ static int sctp_init_sock(struct sock *sk) + sk_sockets_allocated_inc(sk); + sock_prot_inuse_add(net, sk->sk_prot, 1); + +- if (net->sctp.default_auto_asconf) { +- spin_lock(&sock_net(sk)->sctp.addr_wq_lock); +- list_add_tail(&sp->auto_asconf_list, +- &net->sctp.auto_asconf_splist); +- sp->do_auto_asconf = 1; +- spin_unlock(&sock_net(sk)->sctp.addr_wq_lock); +- } else { +- sp->do_auto_asconf = 0; +- } +- + local_bh_enable(); + + return 0; +@@ -4294,9 +4300,7 @@ static void sctp_destroy_sock(struct sock *sk) + + if (sp->do_auto_asconf) { + sp->do_auto_asconf = 0; +- spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock); + list_del(&sp->auto_asconf_list); +- spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock); + } + sctp_endpoint_free(sp->ep); + local_bh_disable(); +@@ -7814,6 +7818,8 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, + sctp_bind_addr_dup(&newsp->ep->base.bind_addr, + &oldsp->ep->base.bind_addr, GFP_KERNEL); + ++ sctp_auto_asconf_init(newsp); ++ + /* Move any messages in the old socket's receive queue that are for the + * peeled off association to the new socket's receive queue. + */ +diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c +index 403be9bfd8d16..69151de9657c6 100644 +--- a/net/tipc/netlink_compat.c ++++ b/net/tipc/netlink_compat.c +@@ -662,7 +662,7 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg, + if (err) + return err; + +- link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]); ++ link_info.dest = htonl(nla_get_flag(link[TIPC_NLA_LINK_DEST])); + link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP])); + nla_strlcpy(link_info.str, link[TIPC_NLA_LINK_NAME], + TIPC_MAX_LINK_NAME); +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 102bf9194662c..c09efcdf72d27 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -593,8 +593,7 @@ vmci_transport_queue_pair_alloc(struct vmci_qp **qpair, + peer, flags, VMCI_NO_PRIVILEGE_FLAGS); + out: + if (err < 0) { +- pr_err("Could not attach to queue pair with %d\n", +- err); ++ pr_err_once("Could not attach to queue pair with %d\n", err); + err = vmci_transport_error_to_vsock_error(err); + } + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index c60be11b5e08b..71a8e6980e2fc 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -956,6 +956,8 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev, + + if (rdev->bss_entries >= bss_entries_limit && + !cfg80211_bss_expire_oldest(rdev)) { ++ if (!list_empty(&new->hidden_list)) ++ list_del(&new->hidden_list); + kfree(new); + goto drop; + } +diff --git a/samples/bpf/tracex1_kern.c b/samples/bpf/tracex1_kern.c +index 107da148820fc..9c74b45c5720f 100644 +--- a/samples/bpf/tracex1_kern.c ++++ b/samples/bpf/tracex1_kern.c +@@ -20,7 +20,7 @@ + SEC("kprobe/__netif_receive_skb_core") + int bpf_prog1(struct pt_regs *ctx) + { +- /* attaches to kprobe netif_receive_skb, ++ /* attaches to kprobe __netif_receive_skb_core, + * looks for packets on loobpack device and prints them + */ + char devname[IFNAMSIZ]; +@@ -29,7 +29,7 @@ int bpf_prog1(struct pt_regs *ctx) + int len; + + /* non-portable! works for the given kernel only */ +- skb = (struct sk_buff *) PT_REGS_PARM1(ctx); ++ bpf_probe_read_kernel(&skb, sizeof(skb), (void *)PT_REGS_PARM1(ctx)); + dev = _(skb->dev); + len = _(skb->len); + +diff --git a/samples/kfifo/bytestream-example.c b/samples/kfifo/bytestream-example.c +index 2fca916d9edfd..a7f5ee8b6edcf 100644 +--- a/samples/kfifo/bytestream-example.c ++++ b/samples/kfifo/bytestream-example.c +@@ -124,8 +124,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -140,8 +142,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct file_operations fifo_fops = { +diff --git a/samples/kfifo/inttype-example.c b/samples/kfifo/inttype-example.c +index 8dc3c2e7105a0..a326a37e91631 100644 +--- a/samples/kfifo/inttype-example.c ++++ b/samples/kfifo/inttype-example.c +@@ -117,8 +117,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -133,8 +135,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct file_operations fifo_fops = { +diff --git a/samples/kfifo/record-example.c b/samples/kfifo/record-example.c +index 2d7529eeb2940..deb87a2e4e6bc 100644 +--- a/samples/kfifo/record-example.c ++++ b/samples/kfifo/record-example.c +@@ -131,8 +131,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, + ret = kfifo_from_user(&test, buf, count, &copied); + + mutex_unlock(&write_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static ssize_t fifo_read(struct file *file, char __user *buf, +@@ -147,8 +149,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, + ret = kfifo_to_user(&test, buf, count, &copied); + + mutex_unlock(&read_lock); ++ if (ret) ++ return ret; + +- return ret ? ret : copied; ++ return copied; + } + + static const struct file_operations fifo_fops = { +diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c +index f7049e288e93d..c58a46904861f 100644 +--- a/scripts/kconfig/nconf.c ++++ b/scripts/kconfig/nconf.c +@@ -502,8 +502,8 @@ static int get_mext_match(const char *match_str, match_f flag) + else if (flag == FIND_NEXT_MATCH_UP) + --match_start; + ++ match_start = (match_start + items_num) % items_num; + index = match_start; +- index = (index + items_num) % items_num; + while (true) { + char *str = k_menu_items[index].str; + if (strcasestr(str, match_str) != 0) +diff --git a/sound/core/init.c b/sound/core/init.c +index 02e96c580cb74..59377e579adb1 100644 +--- a/sound/core/init.c ++++ b/sound/core/init.c +@@ -406,10 +406,8 @@ int snd_card_disconnect(struct snd_card *card) + return 0; + } + card->shutdown = 1; +- spin_unlock(&card->files_lock); + + /* replace file->f_op with special dummy operations */ +- spin_lock(&card->files_lock); + list_for_each_entry(mfile, &card->files_list, list) { + /* it's critical part, use endless loop */ + /* we have no room to fail */ +diff --git a/sound/isa/sb/emu8000.c b/sound/isa/sb/emu8000.c +index 94c411299e5a0..470058e89fef8 100644 +--- a/sound/isa/sb/emu8000.c ++++ b/sound/isa/sb/emu8000.c +@@ -1042,8 +1042,10 @@ snd_emu8000_create_mixer(struct snd_card *card, struct snd_emu8000 *emu) + + memset(emu->controls, 0, sizeof(emu->controls)); + for (i = 0; i < EMU8000_NUM_CONTROLS; i++) { +- if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0) ++ if ((err = snd_ctl_add(card, emu->controls[i] = snd_ctl_new1(mixer_defs[i], emu))) < 0) { ++ emu->controls[i] = NULL; + goto __error; ++ } + } + return 0; + +diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c +index 48da2276683d2..2cc068be7d3be 100644 +--- a/sound/isa/sb/sb16_csp.c ++++ b/sound/isa/sb/sb16_csp.c +@@ -1059,10 +1059,14 @@ static int snd_sb_qsound_build(struct snd_sb_csp * p) + + spin_lock_init(&p->q_lock); + +- if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0) ++ if ((err = snd_ctl_add(card, p->qsound_switch = snd_ctl_new1(&snd_sb_qsound_switch, p))) < 0) { ++ p->qsound_switch = NULL; + goto __error; +- if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0) ++ } ++ if ((err = snd_ctl_add(card, p->qsound_space = snd_ctl_new1(&snd_sb_qsound_space, p))) < 0) { ++ p->qsound_space = NULL; + goto __error; ++ } + + return 0; + +diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c +index 6089ed6efc8dd..8d99ac931ff6b 100644 +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -1165,11 +1165,17 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch, + *index = ch; + return "Headphone"; + case AUTO_PIN_LINE_OUT: +- /* This deals with the case where we have two DACs and +- * one LO, one HP and one Speaker */ +- if (!ch && cfg->speaker_outs && cfg->hp_outs) { +- bool hp_lo_shared = !path_has_mixer(codec, spec->hp_paths[0], ctl_type); +- bool spk_lo_shared = !path_has_mixer(codec, spec->speaker_paths[0], ctl_type); ++ /* This deals with the case where one HP or one Speaker or ++ * one HP + one Speaker need to share the DAC with LO ++ */ ++ if (!ch) { ++ bool hp_lo_shared = false, spk_lo_shared = false; ++ ++ if (cfg->speaker_outs) ++ spk_lo_shared = !path_has_mixer(codec, ++ spec->speaker_paths[0], ctl_type); ++ if (cfg->hp_outs) ++ hp_lo_shared = !path_has_mixer(codec, spec->hp_paths[0], ctl_type); + if (hp_lo_shared && spk_lo_shared) + return spec->vmaster_mute.hook ? "PCM" : "Master"; + if (hp_lo_shared) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 7b94170aa5ecb..58f03b0bb4c46 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2219,13 +2219,13 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + ALC882_FIXUP_ACER_ASPIRE_8930G), + SND_PCI_QUIRK(0x1025, 0x0146, "Acer Aspire 6935G", + ALC882_FIXUP_ACER_ASPIRE_8930G), ++ SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G", ++ ALC882_FIXUP_ACER_ASPIRE_4930G), ++ SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210), + SND_PCI_QUIRK(0x1025, 0x015e, "Acer Aspire 6930G", + ALC882_FIXUP_ACER_ASPIRE_4930G), + SND_PCI_QUIRK(0x1025, 0x0166, "Acer Aspire 6530G", + ALC882_FIXUP_ACER_ASPIRE_4930G), +- SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G", +- ALC882_FIXUP_ACER_ASPIRE_4930G), +- SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210), + SND_PCI_QUIRK(0x1025, 0x021e, "Acer Aspire 5739G", + ALC882_FIXUP_ACER_ASPIRE_4930G), + SND_PCI_QUIRK(0x1025, 0x0259, "Acer Aspire 5935", ALC889_FIXUP_DAC_ROUTE), +@@ -2237,11 +2237,11 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601), + SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS), + SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3), ++ SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP), ++ SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP), + SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT), + SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP), + SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP), +- SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP), +- SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP), + + /* All Apple entries are in codec SSIDs */ + SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF), +@@ -5821,12 +5821,12 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101), +- SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2), + SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), + SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), + SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX), ++ SND_PCI_QUIRK(0x104d, 0x90b5, "Sony VAIO Pro 11", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x104d, 0x90b6, "Sony VAIO Pro 13", ALC286_FIXUP_SONY_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), + SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT), + SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), +@@ -5841,9 +5841,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE), ++ SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST), + SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK), +- SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2208, "Thinkpad T431s", ALC269_FIXUP_LENOVO_DOCK), +@@ -5875,6 +5875,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), ++ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), + SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x501e, "Thinkpad L440", ALC292_FIXUP_TPT440_DOCK), +@@ -5893,7 +5894,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), +- SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), + SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD), + SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */ + +@@ -6569,8 +6569,7 @@ static const struct snd_pci_quirk alc861_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", ALC861_FIXUP_ASUS_A6RP), + SND_PCI_QUIRK_VENDOR(0x1043, "ASUS laptop", ALC861_FIXUP_AMP_VREF_0F), + SND_PCI_QUIRK(0x1462, 0x7254, "HP DX2200", ALC861_FIXUP_NO_JACK_DETECT), +- SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", ALC861_FIXUP_AMP_VREF_0F), +- SND_PCI_QUIRK(0x1584, 0x0000, "Uniwill ECS M31EI", ALC861_FIXUP_AMP_VREF_0F), ++ SND_PCI_QUIRK_VENDOR(0x1584, "Haier/Uniwill", ALC861_FIXUP_AMP_VREF_0F), + SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", ALC861_FIXUP_FSC_AMILO_PI1505), + {} + }; +diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c +index b044dea3c8157..9843954698f45 100644 +--- a/sound/pci/rme9652/hdsp.c ++++ b/sound/pci/rme9652/hdsp.c +@@ -5314,7 +5314,8 @@ static int snd_hdsp_free(struct hdsp *hdsp) + if (hdsp->port) + pci_release_regions(hdsp->pci); + +- pci_disable_device(hdsp->pci); ++ if (pci_is_enabled(hdsp->pci)) ++ pci_disable_device(hdsp->pci); + return 0; + } + +diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c +index 9899ef4c7efa7..a88a81fc638a6 100644 +--- a/sound/pci/rme9652/hdspm.c ++++ b/sound/pci/rme9652/hdspm.c +@@ -6912,7 +6912,8 @@ static int snd_hdspm_free(struct hdspm * hdspm) + if (hdspm->port) + pci_release_regions(hdspm->pci); + +- pci_disable_device(hdspm->pci); ++ if (pci_is_enabled(hdspm->pci)) ++ pci_disable_device(hdspm->pci); + return 0; + } + +diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c +index a76b1f1476609..67bd75fbdc7e6 100644 +--- a/sound/pci/rme9652/rme9652.c ++++ b/sound/pci/rme9652/rme9652.c +@@ -1761,7 +1761,8 @@ static int snd_rme9652_free(struct snd_rme9652 *rme9652) + if (rme9652->port) + pci_release_regions(rme9652->pci); + +- pci_disable_device(rme9652->pci); ++ if (pci_is_enabled(rme9652->pci)) ++ pci_disable_device(rme9652->pci); + return 0; + } + +diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c +index 7899a2cdeb42f..a41dd9d1eb829 100644 +--- a/sound/soc/codecs/rt286.c ++++ b/sound/soc/codecs/rt286.c +@@ -174,6 +174,9 @@ static bool rt286_readable_register(struct device *dev, unsigned int reg) + case RT286_PROC_COEF: + case RT286_SET_AMP_GAIN_ADC_IN1: + case RT286_SET_AMP_GAIN_ADC_IN2: ++ case RT286_SET_GPIO_MASK: ++ case RT286_SET_GPIO_DIRECTION: ++ case RT286_SET_GPIO_DATA: + case RT286_SET_POWER(RT286_DAC_OUT1): + case RT286_SET_POWER(RT286_DAC_OUT2): + case RT286_SET_POWER(RT286_ADC_IN1): +@@ -1119,12 +1122,11 @@ static const struct dmi_system_id force_combo_jack_table[] = { + { } + }; + +-static const struct dmi_system_id dmi_dell_dino[] = { ++static const struct dmi_system_id dmi_dell[] = { + { +- .ident = "Dell Dino", ++ .ident = "Dell", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), +- DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343") + } + }, + { } +@@ -1135,7 +1137,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + { + struct rt286_platform_data *pdata = dev_get_platdata(&i2c->dev); + struct rt286_priv *rt286; +- int i, ret, val; ++ int i, ret, vendor_id; + + rt286 = devm_kzalloc(&i2c->dev, sizeof(*rt286), + GFP_KERNEL); +@@ -1151,14 +1153,15 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + } + + ret = regmap_read(rt286->regmap, +- RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val); ++ RT286_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &vendor_id); + if (ret != 0) { + dev_err(&i2c->dev, "I2C error %d\n", ret); + return ret; + } +- if (val != RT286_VENDOR_ID && val != RT288_VENDOR_ID) { ++ if (vendor_id != RT286_VENDOR_ID && vendor_id != RT288_VENDOR_ID) { + dev_err(&i2c->dev, +- "Device with ID register %#x is not rt286\n", val); ++ "Device with ID register %#x is not rt286\n", ++ vendor_id); + return -ENODEV; + } + +@@ -1182,8 +1185,8 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + if (pdata) + rt286->pdata = *pdata; + +- if (dmi_check_system(force_combo_jack_table) || +- dmi_check_system(dmi_dell_dino)) ++ if ((vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) || ++ dmi_check_system(force_combo_jack_table)) + rt286->pdata.cbj_en = true; + + regmap_write(rt286->regmap, RT286_SET_AUDIO_POWER, AC_PWRST_D3); +@@ -1222,7 +1225,7 @@ static int rt286_i2c_probe(struct i2c_client *i2c, + regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL3, 0xf777, 0x4737); + regmap_update_bits(rt286->regmap, RT286_DEPOP_CTRL4, 0x00ff, 0x003f); + +- if (dmi_check_system(dmi_dell_dino)) { ++ if (vendor_id == RT288_VENDOR_ID && dmi_check_system(dmi_dell)) { + regmap_update_bits(rt286->regmap, + RT286_SET_GPIO_MASK, 0x40, 0x40); + regmap_update_bits(rt286->regmap, +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 023a36a4922b2..6c5be4e3cb9df 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -183,9 +183,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int + ctrlif, interface); + return -EINVAL; + } +- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L); +- +- return 0; ++ return usb_driver_claim_interface(&usb_audio_driver, iface, ++ USB_AUDIO_IFACE_UNUSED); + } + + if ((altsd->bInterfaceClass != USB_CLASS_AUDIO && +@@ -205,7 +204,8 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int + + if (! snd_usb_parse_audio_interface(chip, interface)) { + usb_set_interface(dev, interface, 0); /* reset the current interface */ +- usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L); ++ return usb_driver_claim_interface(&usb_audio_driver, iface, ++ USB_AUDIO_IFACE_UNUSED); + } + + return 0; +@@ -665,7 +665,7 @@ static void usb_audio_disconnect(struct usb_interface *intf) + struct snd_card *card; + struct list_head *p; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return; + + card = chip->card; +@@ -765,7 +765,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message) + struct usb_mixer_interface *mixer; + struct list_head *p; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return 0; + + if (!chip->num_suspended_intf++) { +@@ -795,7 +795,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume) + struct list_head *p; + int err = 0; + +- if (chip == (void *)-1L) ++ if (chip == USB_AUDIO_IFACE_UNUSED) + return 0; + + atomic_inc(&chip->active); /* avoid autopm */ +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index a917b7e02d312..d3d3e05fe5b8d 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2479,6 +2479,16 @@ YAMAHA_DEVICE(0x7010, "UB99"), + } + }, + ++{ ++ USB_DEVICE_VENDOR_SPEC(0x0944, 0x0204), ++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { ++ .vendor_name = "KORG, Inc.", ++ /* .product_name = "ToneLab EX", */ ++ .ifnum = 3, ++ .type = QUIRK_MIDI_STANDARD_INTERFACE, ++ } ++}, ++ + /* AKAI devices */ + { + USB_DEVICE(0x09e8, 0x0062), +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 6b9e6b57d58df..02b4d0638e008 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -66,8 +66,12 @@ static int create_composite_quirk(struct snd_usb_audio *chip, + if (!iface) + continue; + if (quirk->ifnum != probed_ifnum && +- !usb_interface_claimed(iface)) +- usb_driver_claim_interface(driver, iface, (void *)-1L); ++ !usb_interface_claimed(iface)) { ++ err = usb_driver_claim_interface(driver, iface, ++ USB_AUDIO_IFACE_UNUSED); ++ if (err < 0) ++ return err; ++ } + } + + return 0; +@@ -399,8 +403,12 @@ static int create_autodetect_quirks(struct snd_usb_audio *chip, + continue; + + err = create_autodetect_quirk(chip, iface, driver); +- if (err >= 0) +- usb_driver_claim_interface(driver, iface, (void *)-1L); ++ if (err >= 0) { ++ err = usb_driver_claim_interface(driver, iface, ++ USB_AUDIO_IFACE_UNUSED); ++ if (err < 0) ++ return err; ++ } + } + + return 0; +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index f4ee83c8e0b2b..62456a806bb4d 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -63,6 +63,8 @@ struct snd_usb_audio { + struct usb_host_interface *ctrl_intf; /* the audio control interface */ + }; + ++#define USB_AUDIO_IFACE_UNUSED ((void *)-1L) ++ + #define usb_audio_err(chip, fmt, args...) \ + dev_err(&(chip)->dev->dev, fmt, ##args) + #define usb_audio_warn(chip, fmt, args...) \ +diff --git a/tools/perf/util/symbol_fprintf.c b/tools/perf/util/symbol_fprintf.c +index a680bdaa65dc3..060957aeb79a7 100644 +--- a/tools/perf/util/symbol_fprintf.c ++++ b/tools/perf/util/symbol_fprintf.c +@@ -64,7 +64,7 @@ size_t dso__fprintf_symbols_by_name(struct dso *dso, + + for (nd = rb_first(&dso->symbol_names[type]); nd; nd = rb_next(nd)) { + pos = rb_entry(nd, struct symbol_name_rb_node, rb_node); +- fprintf(fp, "%s\n", pos->sym.name); ++ ret += fprintf(fp, "%s\n", pos->sym.name); + } + + return ret; +diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk +index 50a93f5f13d64..d8fa6c72b7ca7 100644 +--- a/tools/testing/selftests/lib.mk ++++ b/tools/testing/selftests/lib.mk +@@ -1,6 +1,10 @@ + # This mimics the top-level Makefile. We do it explicitly here so that this + # Makefile can operate with or without the kbuild infrastructure. ++ifneq ($(LLVM),) ++CC := clang ++else + CC := $(CROSS_COMPILE)gcc ++endif + + define RUN_TESTS + @for TEST in $(TEST_PROGS); do \ diff --git a/patch/kernel/archive/meson64-4.9/patch-4.9.269-270.patch b/patch/kernel/archive/meson64-4.9/patch-4.9.269-270.patch new file mode 100644 index 0000000000..0940ad4b16 --- /dev/null +++ b/patch/kernel/archive/meson64-4.9/patch-4.9.269-270.patch @@ -0,0 +1,951 @@ +diff --git a/Makefile b/Makefile +index 94436a50dc9fb..e8313ffb8af98 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 269 ++SUBLEVEL = 270 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/openrisc/kernel/setup.c b/arch/openrisc/kernel/setup.c +index b4ed8b36e078d..e5f5b69a7b7bd 100644 +--- a/arch/openrisc/kernel/setup.c ++++ b/arch/openrisc/kernel/setup.c +@@ -278,6 +278,8 @@ void calibrate_delay(void) + pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n", + loops_per_jiffy / (500000 / HZ), + (loops_per_jiffy / (5000 / HZ)) % 100, loops_per_jiffy); ++ ++ of_node_put(cpu); + } + + void __init setup_arch(char **cmdline_p) +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c +index 1852d19d0d7b0..86110a2abf0f0 100644 +--- a/drivers/cdrom/gdrom.c ++++ b/drivers/cdrom/gdrom.c +@@ -773,6 +773,13 @@ static int probe_gdrom_setupqueue(void) + static int probe_gdrom(struct platform_device *devptr) + { + int err; ++ ++ /* ++ * Ensure our "one" device is initialized properly in case of previous ++ * usages of it ++ */ ++ memset(&gd, 0, sizeof(gd)); ++ + /* Start the device */ + if (gdrom_execute_diagnostic() != 1) { + pr_warning("ATA Probe for GDROM failed\n"); +@@ -850,6 +857,8 @@ static int remove_gdrom(struct platform_device *devptr) + if (gdrom_major) + unregister_blkdev(gdrom_major, GDROM_DEV_NAME); + unregister_cdrom(gd.cd_info); ++ kfree(gd.cd_info); ++ kfree(gd.toc); + + return 0; + } +@@ -865,7 +874,7 @@ static struct platform_driver gdrom_driver = { + static int __init init_gdrom(void) + { + int rc; +- gd.toc = NULL; ++ + rc = platform_driver_register(&gdrom_driver); + if (rc) + return rc; +@@ -881,8 +890,6 @@ static void __exit exit_gdrom(void) + { + platform_device_unregister(pd); + platform_driver_unregister(&gdrom_driver); +- kfree(gd.toc); +- kfree(gd.cd_info); + } + + module_init(init_gdrom); +diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c +index be60bd5bab783..ee6d499edc1ba 100644 +--- a/drivers/hwmon/lm80.c ++++ b/drivers/hwmon/lm80.c +@@ -630,7 +630,6 @@ static int lm80_probe(struct i2c_client *client, + struct device *dev = &client->dev; + struct device *hwmon_dev; + struct lm80_data *data; +- int rv; + + data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL); + if (!data) +@@ -643,14 +642,8 @@ static int lm80_probe(struct i2c_client *client, + lm80_init_client(client); + + /* A few vars need to be filled upon startup */ +- rv = lm80_read_value(client, LM80_REG_FAN_MIN(1)); +- if (rv < 0) +- return rv; +- data->fan[f_min][0] = rv; +- rv = lm80_read_value(client, LM80_REG_FAN_MIN(2)); +- if (rv < 0) +- return rv; +- data->fan[f_min][1] = rv; ++ data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1)); ++ data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2)); + + hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, + data, lm80_groups); +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 186da467060cc..5fa1442fd4f11 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -258,6 +258,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + if (err) { + vfree(qp->sq.queue->buf); + kfree(qp->sq.queue); ++ qp->sq.queue = NULL; + return err; + } + +@@ -315,6 +316,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + if (err) { + vfree(qp->rq.queue->buf); + kfree(qp->rq.queue); ++ qp->rq.queue = NULL; + return err; + } + } +@@ -374,6 +376,11 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd, + err2: + rxe_queue_cleanup(qp->sq.queue); + err1: ++ qp->pd = NULL; ++ qp->rcq = NULL; ++ qp->scq = NULL; ++ qp->srq = NULL; ++ + if (srq) + rxe_drop_ref(srq); + rxe_drop_ref(scq); +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index 44ceed7ac3c5b..7cebcd458943e 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -320,7 +320,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + usleep_range(3000, 6000); + ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); + if (ret) +- return ret; ++ goto out; + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index c04d9f22d1607..6acdbec05f702 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1264,6 +1264,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + if (!s->store->chunk_size) { + ti->error = "Chunk size not set"; ++ r = -EINVAL; + goto bad_read_metadata; + } + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +index 63ebc491057b6..99fc0121da93d 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +@@ -1039,7 +1039,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) { + skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE); + if (!skb) +- break; ++ goto error; + qlcnic_create_loopback_buff(skb->data, adapter->mac_addr); + skb_put(skb, QLCNIC_ILB_PKT_SIZE); + adapter->ahw->diag_cnt = 0; +@@ -1063,6 +1063,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + cnt++; + } + if (cnt != i) { ++error: + dev_err(&adapter->pdev->dev, + "LB Test: failed, TX[%d], RX[%d]\n", i, cnt); + if (mode != QLCNIC_ILB_MODE) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +index fc1fa0f9f3387..fe4128405bbb7 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +@@ -39,7 +39,7 @@ struct sunxi_priv_data { + static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + { + struct sunxi_priv_data *gmac = priv; +- int ret; ++ int ret = 0; + + if (gmac->regulator) { + ret = regulator_enable(gmac->regulator); +@@ -60,11 +60,11 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + } else { + clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE); + ret = clk_prepare(gmac->tx_clk); +- if (ret) +- return ret; ++ if (ret && gmac->regulator) ++ regulator_disable(gmac->regulator); + } + +- return 0; ++ return ret; + } + + static void sun7i_gmac_exit(struct platform_device *pdev, void *priv) +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 5bf47279f9c1b..306d5d08141ee 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -8166,10 +8166,10 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + "VPD_SCAN: Reading in property [%s] len[%d]\n", + namebuf, prop_len); + for (i = 0; i < prop_len; i++) { +- err = niu_pci_eeprom_read(np, off + i); +- if (err >= 0) +- *prop_buf = err; +- ++prop_buf; ++ err = niu_pci_eeprom_read(np, off + i); ++ if (err < 0) ++ return err; ++ *prop_buf++ = err; + } + } + +@@ -8180,14 +8180,14 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + } + + /* ESPC_PIO_EN_ENABLE must be set */ +-static void niu_pci_vpd_fetch(struct niu *np, u32 start) ++static int niu_pci_vpd_fetch(struct niu *np, u32 start) + { + u32 offset; + int err; + + err = niu_pci_eeprom_read16_swp(np, start + 1); + if (err < 0) +- return; ++ return err; + + offset = err + 3; + +@@ -8196,12 +8196,14 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) + u32 end; + + err = niu_pci_eeprom_read(np, here); ++ if (err < 0) ++ return err; + if (err != 0x90) +- return; ++ return -EINVAL; + + err = niu_pci_eeprom_read16_swp(np, here + 1); + if (err < 0) +- return; ++ return err; + + here = start + offset + 3; + end = start + offset + err; +@@ -8209,9 +8211,12 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) + offset += err; + + err = niu_pci_vpd_scan_props(np, here, end); +- if (err < 0 || err == 1) +- return; ++ if (err < 0) ++ return err; ++ if (err == 1) ++ return -EINVAL; + } ++ return 0; + } + + /* ESPC_PIO_EN_ENABLE must be set */ +@@ -9304,8 +9309,11 @@ static int niu_get_invariants(struct niu *np) + offset = niu_pci_vpd_offset(np); + netif_printk(np, probe, KERN_DEBUG, np->dev, + "%s() VPD offset [%08x]\n", __func__, offset); +- if (offset) +- niu_pci_vpd_fetch(np, offset); ++ if (offset) { ++ err = niu_pci_vpd_fetch(np, offset); ++ if (err < 0) ++ return err; ++ } + nw64(ESPC_PIO_EN, 0); + + if (np->flags & NIU_FLAGS_VPD_VALID) { +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 7de18ed10db8e..e1992de500b0d 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -454,9 +454,14 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw) + } + } + +-static void _rtl_init_deferred_work(struct ieee80211_hw *hw) ++static int _rtl_init_deferred_work(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); ++ struct workqueue_struct *wq; ++ ++ wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); ++ if (!wq) ++ return -ENOMEM; + + /* <1> timer */ + setup_timer(&rtlpriv->works.watchdog_timer, +@@ -465,11 +470,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) + rtl_easy_concurrent_retrytimer_callback, (unsigned long)hw); + /* <2> work queue */ + rtlpriv->works.hw = hw; +- rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); +- if (unlikely(!rtlpriv->works.rtl_wq)) { +- pr_err("Failed to allocate work queue\n"); +- return; +- } ++ rtlpriv->works.rtl_wq = wq; + + INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq, + (void *)rtl_watchdog_wq_callback); +@@ -481,7 +482,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) + (void *)rtl_swlps_rfon_wq_callback); + INIT_DELAYED_WORK(&rtlpriv->works.fwevt_wq, + (void *)rtl_fwevt_wq_callback); +- ++ return 0; + } + + void rtl_deinit_deferred_work(struct ieee80211_hw *hw) +@@ -573,9 +574,7 @@ int rtl_init_core(struct ieee80211_hw *hw) + rtlmac->link_state = MAC80211_NOLINK; + + /* <6> init deferred work */ +- _rtl_init_deferred_work(hw); +- +- return 0; ++ return _rtl_init_deferred_work(hw); + } + EXPORT_SYMBOL_GPL(rtl_init_core); + +diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c +index b29fc258eeba4..ab57a1eb519fc 100644 +--- a/drivers/rapidio/rio_cm.c ++++ b/drivers/rapidio/rio_cm.c +@@ -2136,6 +2136,14 @@ static int riocm_add_mport(struct device *dev, + return -ENODEV; + } + ++ cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); ++ if (!cm->rx_wq) { ++ rio_release_inb_mbox(mport, cmbox); ++ rio_release_outb_mbox(mport, cmbox); ++ kfree(cm); ++ return -ENOMEM; ++ } ++ + /* + * Allocate and register inbound messaging buffers to be ready + * to receive channel and system management requests +@@ -2146,15 +2154,6 @@ static int riocm_add_mport(struct device *dev, + cm->rx_slots = RIOCM_RX_RING_SIZE; + mutex_init(&cm->rx_lock); + riocm_rx_fill(cm, RIOCM_RX_RING_SIZE); +- cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); +- if (!cm->rx_wq) { +- riocm_error("failed to allocate IBMBOX_%d on %s", +- cmbox, mport->name); +- rio_release_outb_mbox(mport, cmbox); +- kfree(cm); +- return -ENOMEM; +- } +- + INIT_WORK(&cm->rx_work, rio_ibmsg_handler); + + cm->tx_slot = 0; +diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c +index 104e13ae34288..9ec18463b4523 100644 +--- a/drivers/scsi/qla2xxx/qla_nx.c ++++ b/drivers/scsi/qla2xxx/qla_nx.c +@@ -1102,7 +1102,8 @@ qla82xx_write_flash_dword(struct qla_hw_data *ha, uint32_t flashaddr, + return ret; + } + +- if (qla82xx_flash_set_write_enable(ha)) ++ ret = qla82xx_flash_set_write_enable(ha); ++ if (ret < 0) + goto done_write; + + qla82xx_wr_32(ha, QLA82XX_ROMUSB_ROM_WDATA, data); +diff --git a/drivers/staging/iio/light/tsl2583.c b/drivers/staging/iio/light/tsl2583.c +index 08f1583ee34e9..fb3ec56d45b61 100644 +--- a/drivers/staging/iio/light/tsl2583.c ++++ b/drivers/staging/iio/light/tsl2583.c +@@ -382,6 +382,15 @@ static int taos_als_calibrate(struct iio_dev *indio_dev) + dev_err(&chip->client->dev, "taos_als_calibrate failed to get lux\n"); + return lux_val; + } ++ ++ /* Avoid division by zero of lux_value later on */ ++ if (lux_val == 0) { ++ dev_err(&chip->client->dev, ++ "%s: lux_val of 0 will produce out of range trim_value\n", ++ __func__); ++ return -ENODATA; ++ } ++ + gain_trim_val = (unsigned int)(((chip->taos_settings.als_cal_target) + * chip->taos_settings.als_gain_trim) / lux_val); + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 2fa7527b1230e..8c74d9ebfc502 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -838,7 +838,7 @@ static inline int resize_screen(struct vc_data *vc, int width, int height, + /* Resizes the resolution of the display adapater */ + int err = 0; + +- if (vc->vc_mode != KD_GRAPHICS && vc->vc_sw->con_resize) ++ if (vc->vc_sw->con_resize) + err = vc->vc_sw->con_resize(vc, width, height, user); + + return err; +diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c +index 275ec49b30b9f..9206fd2489353 100644 +--- a/drivers/tty/vt/vt_ioctl.c ++++ b/drivers/tty/vt/vt_ioctl.c +@@ -898,17 +898,17 @@ int vt_ioctl(struct tty_struct *tty, + if (vcp) { + int ret; + int save_scan_lines = vcp->vc_scan_lines; +- int save_font_height = vcp->vc_font.height; ++ int save_cell_height = vcp->vc_cell_height; + + if (v.v_vlin) + vcp->vc_scan_lines = v.v_vlin; + if (v.v_clin) +- vcp->vc_font.height = v.v_clin; ++ vcp->vc_cell_height = v.v_clin; + vcp->vc_resize_user = 1; + ret = vc_resize(vcp, v.v_cols, v.v_rows); + if (ret) { + vcp->vc_scan_lines = save_scan_lines; +- vcp->vc_font.height = save_font_height; ++ vcp->vc_cell_height = save_cell_height; + console_unlock(); + return ret; + } +diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c +index 44df6f6fd0636..510bc3f51dccf 100644 +--- a/drivers/video/console/fbcon.c ++++ b/drivers/video/console/fbcon.c +@@ -1986,7 +1986,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, + return -EINVAL; + + DPRINTK("resize now %ix%i\n", var.xres, var.yres); +- if (con_is_visible(vc)) { ++ if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) { + var.activate = FB_ACTIVATE_NOW | + FB_ACTIVATE_FORCE; + fb_set_var(info, &var); +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index b38ee2354cbfa..cb9b879631293 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -434,7 +434,7 @@ static void vgacon_init(struct vc_data *c, int init) + vc_resize(c, vga_video_num_columns, vga_video_num_lines); + + c->vc_scan_lines = vga_scan_lines; +- c->vc_font.height = vga_video_font_height; ++ c->vc_font.height = c->vc_cell_height = vga_video_font_height; + c->vc_complement_mask = 0x7700; + if (vga_512_chars) + c->vc_hi_font_mask = 0x0800; +@@ -572,32 +572,32 @@ static void vgacon_cursor(struct vc_data *c, int mode) + switch (c->vc_cursor_type & 0x0f) { + case CUR_UNDERLINE: + vgacon_set_cursor_size(c->vc_x, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 2 : 3), +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_TWO_THIRDS: + vgacon_set_cursor_size(c->vc_x, +- c->vc_font.height / 3, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height / 3, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_LOWER_THIRD: + vgacon_set_cursor_size(c->vc_x, +- (c->vc_font.height * 2) / 3, +- c->vc_font.height - +- (c->vc_font.height < ++ (c->vc_cell_height * 2) / 3, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_LOWER_HALF: + vgacon_set_cursor_size(c->vc_x, +- c->vc_font.height / 2, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height / 2, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_NONE: +@@ -608,7 +608,7 @@ static void vgacon_cursor(struct vc_data *c, int mode) + break; + default: + vgacon_set_cursor_size(c->vc_x, 1, +- c->vc_font.height); ++ c->vc_cell_height); + break; + } + break; +@@ -619,13 +619,13 @@ static int vgacon_doresize(struct vc_data *c, + unsigned int width, unsigned int height) + { + unsigned long flags; +- unsigned int scanlines = height * c->vc_font.height; ++ unsigned int scanlines = height * c->vc_cell_height; + u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan; + + raw_spin_lock_irqsave(&vga_lock, flags); + + vgacon_xres = width * VGA_FONTWIDTH; +- vgacon_yres = height * c->vc_font.height; ++ vgacon_yres = height * c->vc_cell_height; + if (vga_video_type >= VIDEO_TYPE_VGAC) { + outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg); + max_scan = inb_p(vga_video_port_val); +@@ -680,9 +680,9 @@ static int vgacon_doresize(struct vc_data *c, + static int vgacon_switch(struct vc_data *c) + { + int x = c->vc_cols * VGA_FONTWIDTH; +- int y = c->vc_rows * c->vc_font.height; ++ int y = c->vc_rows * c->vc_cell_height; + int rows = screen_info.orig_video_lines * vga_default_font_height/ +- c->vc_font.height; ++ c->vc_cell_height; + /* + * We need to save screen size here as it's the only way + * we can spot the screen has been resized and we need to +@@ -1120,7 +1120,7 @@ static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight) + cursor_size_lastto = 0; + c->vc_sw->con_cursor(c, CM_DRAW); + } +- c->vc_font.height = fontheight; ++ c->vc_font.height = c->vc_cell_height = fontheight; + vc_resize(c, 0, rows); /* Adjust console size */ + } + } +@@ -1174,12 +1174,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width, + if ((width << 1) * height > vga_vram_size) + return -EINVAL; + ++ if (user) { ++ /* ++ * Ho ho! Someone (svgatextmode, eh?) may have reprogrammed ++ * the video mode! Set the new defaults then and go away. ++ */ ++ screen_info.orig_video_cols = width; ++ screen_info.orig_video_lines = height; ++ vga_default_font_height = c->vc_cell_height; ++ return 0; ++ } + if (width % 2 || width > screen_info.orig_video_cols || + height > (screen_info.orig_video_lines * vga_default_font_height)/ +- c->vc_font.height) +- /* let svgatextmode tinker with video timings and +- return success */ +- return (user) ? 0 : -EINVAL; ++ c->vc_cell_height) ++ return -EINVAL; + + if (con_is_visible(c) && !vga_is_gfx) /* who knows */ + vgacon_doresize(c, width, height); +diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c +index 59e1cae579481..03c0b1b8747b9 100644 +--- a/drivers/video/fbdev/hgafb.c ++++ b/drivers/video/fbdev/hgafb.c +@@ -286,7 +286,7 @@ static int hga_card_detect(void) + + hga_vram = ioremap(0xb0000, hga_vram_len); + if (!hga_vram) +- goto error; ++ return -ENOMEM; + + if (request_region(0x3b0, 12, "hgafb")) + release_io_ports = 1; +@@ -346,13 +346,18 @@ static int hga_card_detect(void) + hga_type_name = "Hercules"; + break; + } +- return 1; ++ return 0; + error: + if (release_io_ports) + release_region(0x3b0, 12); + if (release_io_port) + release_region(0x3bf, 1); +- return 0; ++ ++ iounmap(hga_vram); ++ ++ pr_err("hgafb: HGA card not detected.\n"); ++ ++ return -EINVAL; + } + + /** +@@ -550,13 +555,11 @@ static struct fb_ops hgafb_ops = { + static int hgafb_probe(struct platform_device *pdev) + { + struct fb_info *info; ++ int ret; + +- if (! hga_card_detect()) { +- printk(KERN_INFO "hgafb: HGA card not detected.\n"); +- if (hga_vram) +- iounmap(hga_vram); +- return -EINVAL; +- } ++ ret = hga_card_detect(); ++ if (ret) ++ return ret; + + printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n", + hga_type_name, hga_vram_len/1024); +diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c +index 4ef9dc94e8138..4363c64d74e8c 100644 +--- a/drivers/video/fbdev/imsttfb.c ++++ b/drivers/video/fbdev/imsttfb.c +@@ -1516,11 +1516,6 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + info->fix.smem_start = addr; + info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ? + 0x400000 : 0x800000); +- if (!info->screen_base) { +- release_mem_region(addr, size); +- framebuffer_release(info); +- return -ENOMEM; +- } + info->fix.mmio_start = addr + 0x800000; + par->dc_regs = ioremap(addr + 0x800000, 0x1000); + par->cmap_regs_phys = addr + 0x840000; +diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c +index 36ec99cff507b..2912905331020 100644 +--- a/drivers/xen/xen-pciback/xenbus.c ++++ b/drivers/xen/xen-pciback/xenbus.c +@@ -357,7 +357,8 @@ out: + return err; + } + +-static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) ++static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev, ++ enum xenbus_state state) + { + int err = 0; + int num_devs; +@@ -371,9 +372,7 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) + dev_dbg(&pdev->xdev->dev, "Reconfiguring device ...\n"); + + mutex_lock(&pdev->dev_lock); +- /* Make sure we only reconfigure once */ +- if (xenbus_read_driver_state(pdev->xdev->nodename) != +- XenbusStateReconfiguring) ++ if (xenbus_read_driver_state(pdev->xdev->nodename) != state) + goto out; + + err = xenbus_scanf(XBT_NIL, pdev->xdev->nodename, "num_devs", "%d", +@@ -500,6 +499,10 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) + } + } + ++ if (state != XenbusStateReconfiguring) ++ /* Make sure we only reconfigure once. */ ++ goto out; ++ + err = xenbus_switch_state(pdev->xdev, XenbusStateReconfigured); + if (err) { + xenbus_dev_fatal(pdev->xdev, err, +@@ -525,7 +528,7 @@ static void xen_pcibk_frontend_changed(struct xenbus_device *xdev, + break; + + case XenbusStateReconfiguring: +- xen_pcibk_reconfigure(pdev); ++ xen_pcibk_reconfigure(pdev, XenbusStateReconfiguring); + break; + + case XenbusStateConnected: +@@ -664,6 +667,15 @@ static void xen_pcibk_be_watch(struct xenbus_watch *watch, + xen_pcibk_setup_backend(pdev); + break; + ++ case XenbusStateInitialised: ++ /* ++ * We typically move to Initialised when the first device was ++ * added. Hence subsequent devices getting added may need ++ * reconfiguring. ++ */ ++ xen_pcibk_reconfigure(pdev, XenbusStateInitialised); ++ break; ++ + default: + break; + } +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 67edd6e03f803..fffba1b1da2e4 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -629,6 +629,8 @@ smb2_clone_range(const unsigned int xid, + cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk)); + + /* Request server copy to target from src identified by key */ ++ kfree(retbuf); ++ retbuf = NULL; + rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, + trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE, + true /* is_fsctl */, (char *)pcchunk, +diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c +index ff6cf23be8a21..cb77e7ee2c9f0 100644 +--- a/fs/ecryptfs/crypto.c ++++ b/fs/ecryptfs/crypto.c +@@ -339,10 +339,8 @@ static int crypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat, + struct extent_crypt_result ecr; + int rc = 0; + +- if (!crypt_stat || !crypt_stat->tfm +- || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) +- return -EINVAL; +- ++ BUG_ON(!crypt_stat || !crypt_stat->tfm ++ || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)); + if (unlikely(ecryptfs_verbosity > 0)) { + ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n", + crypt_stat->key_size); +diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h +index 6fd3c908a340d..a30112ba06e44 100644 +--- a/include/linux/console_struct.h ++++ b/include/linux/console_struct.h +@@ -61,6 +61,7 @@ struct vc_data { + unsigned int vc_rows; + unsigned int vc_size_row; /* Bytes per row */ + unsigned int vc_scan_lines; /* # of scan lines */ ++ unsigned int vc_cell_height; /* CRTC character cell height */ + unsigned long vc_origin; /* [!] Start of real screen */ + unsigned long vc_scr_end; /* [!] End of real screen */ + unsigned long vc_visible_origin; /* [!] Top of visible window */ +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index ea3370e205fb9..4f10223bc7b0f 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -159,6 +159,21 @@ void __ptrace_unlink(struct task_struct *child) + spin_unlock(&child->sighand->siglock); + } + ++static bool looks_like_a_spurious_pid(struct task_struct *task) ++{ ++ if (task->exit_code != ((PTRACE_EVENT_EXEC << 8) | SIGTRAP)) ++ return false; ++ ++ if (task_pid_vnr(task) == task->ptrace_message) ++ return false; ++ /* ++ * The tracee changed its pid but the PTRACE_EVENT_EXEC event ++ * was not wait()'ed, most probably debugger targets the old ++ * leader which was destroyed in de_thread(). ++ */ ++ return true; ++} ++ + /* Ensure that nothing can wake it up, even SIGKILL */ + static bool ptrace_freeze_traced(struct task_struct *task) + { +@@ -169,7 +184,8 @@ static bool ptrace_freeze_traced(struct task_struct *task) + return ret; + + spin_lock_irq(&task->sighand->siglock); +- if (task_is_traced(task) && !__fatal_signal_pending(task)) { ++ if (task_is_traced(task) && !looks_like_a_spurious_pid(task) && ++ !__fatal_signal_pending(task)) { + task->state = __TASK_TRACED; + ret = true; + } +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index 6670b7ffc2005..cedfce6f397ed 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2636,6 +2636,15 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) + if (skb->len < sizeof(*key)) + return SMP_INVALID_PARAMS; + ++ /* Check if remote and local public keys are the same and debug key is ++ * not in use. ++ */ ++ if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && ++ !crypto_memneq(key, smp->local_pk, 64)) { ++ bt_dev_err(hdev, "Remote and local public keys are identical"); ++ return SMP_UNSPECIFIED; ++ } ++ + memcpy(smp->remote_pk, key, 64); + + if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index 8557e54d26598..f7b8dcb578157 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -36,7 +36,7 @@ config SND_OXFW + * Mackie(Loud) Onyx-i series (former models) + * Mackie(Loud) Onyx Satellite + * Mackie(Loud) Tapco Link.Firewire +- * Mackie(Loud) d.2 pro/d.4 pro ++ * Mackie(Loud) d.4 pro + * Mackie(Loud) U.420/U.420d + * TASCAM FireOne + * Stanton Controllers & Systems 1 Deck/Mixer +@@ -82,7 +82,7 @@ config SND_BEBOB + * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 + * BridgeCo RDAudio1/Audio5 + * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) +- * Mackie d.2 (FireWire Option) ++ * Mackie d.2 (FireWire Option) and d.2 Pro + * Stanton FinalScratch 2 (ScratchAmp) + * Tascam IF-FW/DM + * Behringer XENIX UFX 1204/1604 +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index a205b93fd9ac8..9d620a7c283f4 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -414,7 +414,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { + SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), + /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ + SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), +- /* Mackie, d.2 (Firewire Option) */ ++ // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). + SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), + /* Stanton, ScratchAmp */ + SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index a7ab34d5e7b08..44ecf2f5f65fd 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -405,7 +405,6 @@ static const struct ieee1394_device_id oxfw_id_table[] = { + * Onyx-i series (former models): 0x081216 + * Mackie Onyx Satellite: 0x00200f + * Tapco LINK.firewire 4x6: 0x000460 +- * d.2 pro: Unknown + * d.4 pro: Unknown + * U.420: Unknown + * U.420d: Unknown +diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c +index e75bfc511e3e8..ad42d2364199f 100644 +--- a/sound/isa/sb/sb8.c ++++ b/sound/isa/sb/sb8.c +@@ -111,10 +111,6 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) + + /* block the 0x388 port to avoid PnP conflicts */ + acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); +- if (!acard->fm_res) { +- err = -EBUSY; +- goto _err; +- } + + if (port[dev] != SNDRV_AUTO_PORT) { + if ((err = snd_sbdsp_create(card, port[dev], irq[dev], +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index ea3a9bd05e687..0107bbfeb17d1 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -687,6 +687,10 @@ static int line6_init_cap_control(struct usb_line6 *line6) + line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); + if (!line6->buffer_message) + return -ENOMEM; ++ ++ ret = line6_init_midi(line6); ++ if (ret < 0) ++ return ret; + } else { + ret = line6_hwdep_init(line6); + if (ret < 0) +diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c +index 17aa616e61f53..aaa192aee883e 100644 +--- a/sound/usb/line6/pod.c ++++ b/sound/usb/line6/pod.c +@@ -421,11 +421,6 @@ static int pod_init(struct usb_line6 *line6, + if (err < 0) + return err; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(line6); +- if (err < 0) +- return err; +- + /* initialize PCM subsystem: */ + err = line6_init_pcm(line6, &pod_pcm_properties); + if (err < 0) +diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c +index 0c4512d0382ea..a911cff0cec86 100644 +--- a/sound/usb/line6/variax.c ++++ b/sound/usb/line6/variax.c +@@ -217,7 +217,6 @@ static int variax_init(struct usb_line6 *line6, + const struct usb_device_id *id) + { + struct usb_line6_variax *variax = (struct usb_line6_variax *) line6; +- int err; + + line6->process_message = line6_variax_process_message; + line6->disconnect = line6_variax_disconnect; +@@ -233,11 +232,6 @@ static int variax_init(struct usb_line6 *line6, + if (variax->buffer_activate == NULL) + return -ENOMEM; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(&variax->line6); +- if (err < 0) +- return err; +- + /* initiate startup procedure: */ + variax_startup1(variax); + return 0; +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index ea264727fdf7b..f0b41fee71304 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1867,8 +1867,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi, + ms_ep = find_usb_ms_endpoint_descriptor(hostep); + if (!ms_ep) + continue; ++ if (ms_ep->bLength <= sizeof(*ms_ep)) ++ continue; + if (ms_ep->bNumEmbMIDIJack > 0x10) + continue; ++ if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack) ++ continue; + if (usb_endpoint_dir_out(ep)) { + if (endpoints[epidx].out_ep) { + if (++epidx >= MIDI_MAX_ENDPOINTS) { diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.121-122.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.121-122.patch new file mode 100644 index 0000000000..bb00c38032 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.121-122.patch @@ -0,0 +1,2145 @@ +diff --git a/Makefile b/Makefile +index 18b4cebe55642..9b64ebcf45312 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 121 ++SUBLEVEL = 122 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/openrisc/kernel/setup.c b/arch/openrisc/kernel/setup.c +index d668f5be3a995..ae104eb4becc7 100644 +--- a/arch/openrisc/kernel/setup.c ++++ b/arch/openrisc/kernel/setup.c +@@ -274,6 +274,8 @@ void calibrate_delay(void) + pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n", + loops_per_jiffy / (500000 / HZ), + (loops_per_jiffy / (5000 / HZ)) % 100, loops_per_jiffy); ++ ++ of_node_put(cpu); + } + + void __init setup_arch(char **cmdline_p) +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c +index 6626c84f66d16..1c3b77e17e4b0 100644 +--- a/drivers/cdrom/gdrom.c ++++ b/drivers/cdrom/gdrom.c +@@ -740,6 +740,13 @@ static const struct blk_mq_ops gdrom_mq_ops = { + static int probe_gdrom(struct platform_device *devptr) + { + int err; ++ ++ /* ++ * Ensure our "one" device is initialized properly in case of previous ++ * usages of it ++ */ ++ memset(&gd, 0, sizeof(gd)); ++ + /* Start the device */ + if (gdrom_execute_diagnostic() != 1) { + pr_warning("ATA Probe for GDROM failed\n"); +@@ -828,6 +835,8 @@ static int remove_gdrom(struct platform_device *devptr) + if (gdrom_major) + unregister_blkdev(gdrom_major, GDROM_DEV_NAME); + unregister_cdrom(gd.cd_info); ++ kfree(gd.cd_info); ++ kfree(gd.toc); + + return 0; + } +@@ -843,7 +852,7 @@ static struct platform_driver gdrom_driver = { + static int __init init_gdrom(void) + { + int rc; +- gd.toc = NULL; ++ + rc = platform_driver_register(&gdrom_driver); + if (rc) + return rc; +@@ -859,8 +868,6 @@ static void __exit exit_gdrom(void) + { + platform_device_unregister(pd); + platform_driver_unregister(&gdrom_driver); +- kfree(gd.toc); +- kfree(gd.cd_info); + } + + module_init(init_gdrom); +diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c +index a80c331c3a6e5..e2995ec144010 100644 +--- a/drivers/firmware/arm_scpi.c ++++ b/drivers/firmware/arm_scpi.c +@@ -552,8 +552,10 @@ static unsigned long scpi_clk_get_val(u16 clk_id) + + ret = scpi_send_message(CMD_GET_CLOCK_VALUE, &le_clk_id, + sizeof(le_clk_id), &rate, sizeof(rate)); ++ if (ret) ++ return 0; + +- return ret ? ret : le32_to_cpu(rate); ++ return le32_to_cpu(rate); + } + + static int scpi_clk_set_val(u16 clk_id, unsigned long rate) +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index d17edc850427a..1d8739a4fbcad 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -190,9 +190,10 @@ static const struct soc15_reg_golden golden_settings_gc_10_1_2[] = + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG, 0xffffffff, 0x20000000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG2, 0xffffffff, 0x00000420), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0xffffffff, 0x00000200), +- SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x04800000), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x04900000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DFSM_TILES_IN_FLIGHT, 0x0000ffff, 0x0000003f), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_LAST_OF_BURST_CONFIG, 0xffffffff, 0x03860204), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmGB_ADDR_CONFIG, 0x0c1800ff, 0x00000044), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGCR_GENERAL_CNTL, 0x1ff0ffff, 0x00000500), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGE_PRIV_CONTROL, 0x00007fff, 0x000001fe), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGL1_PIPE_STEER, 0xffffffff, 0xe4e4e4e4), +@@ -210,12 +211,13 @@ static const struct soc15_reg_golden golden_settings_gc_10_1_2[] = + SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_ENHANCE_2, 0x00000820, 0x00000820), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_LINE_STIPPLE_STATE, 0x0000ff0f, 0x00000000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmRMI_SPARE, 0xffffffff, 0xffff3101), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSPI_CONFIG_CNTL_1, 0x001f0000, 0x00070104), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_ALU_CLK_CTRL, 0xffffffff, 0xffffffff), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_ARB_CONFIG, 0x00000133, 0x00000130), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_LDS_CLK_CTRL, 0xffffffff, 0xffffffff), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmTA_CNTL_AUX, 0xfff7ffff, 0x01030000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmTCP_CNTL, 0xffdf80ff, 0x479c0010), +- SOC15_REG_GOLDEN_VALUE(GC, 0, mmUTCL1_CTRL, 0xffffffff, 0x00800000) ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmUTCL1_CTRL, 0xffffffff, 0x00c00000) + }; + + static const struct soc15_reg_golden golden_settings_gc_10_1_nv14[] = +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 90dcc7afc9c43..06cdc22b5501d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -4661,7 +4661,7 @@ static void gfx_v9_0_update_3d_clock_gating(struct amdgpu_device *adev, + amdgpu_gfx_rlc_enter_safe_mode(adev); + + /* Enable 3D CGCG/CGLS */ +- if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGCG)) { ++ if (enable) { + /* write cmd to clear cgcg/cgls ov */ + def = data = RREG32_SOC15(GC, 0, mmRLC_CGTT_MGCG_OVERRIDE); + /* unset CGCG override */ +@@ -4673,8 +4673,12 @@ static void gfx_v9_0_update_3d_clock_gating(struct amdgpu_device *adev, + /* enable 3Dcgcg FSM(0x0000363f) */ + def = RREG32_SOC15(GC, 0, mmRLC_CGCG_CGLS_CTRL_3D); + +- data = (0x36 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT) | +- RLC_CGCG_CGLS_CTRL_3D__CGCG_EN_MASK; ++ if (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGCG) ++ data = (0x36 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT) | ++ RLC_CGCG_CGLS_CTRL_3D__CGCG_EN_MASK; ++ else ++ data = 0x0 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT; ++ + if (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGLS) + data |= (0x000F << RLC_CGCG_CGLS_CTRL_3D__CGLS_REP_COMPANSAT_DELAY__SHIFT) | + RLC_CGCG_CGLS_CTRL_3D__CGLS_EN_MASK; +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +index 465351184bc3e..60180eca84a60 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +@@ -100,6 +100,10 @@ static const struct soc15_reg_golden golden_settings_sdma_nv14[] = { + + static const struct soc15_reg_golden golden_settings_sdma_nv12[] = { + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA0_RLC3_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA0_GB_ADDR_CONFIG, 0x001877ff, 0x00000044), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA0_GB_ADDR_CONFIG_READ, 0x001877ff, 0x00000044), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA1_GB_ADDR_CONFIG, 0x001877ff, 0x00000044), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA1_GB_ADDR_CONFIG_READ, 0x001877ff, 0x00000044), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA1_RLC3_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), + }; + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 41631271d64ca..6ff1d308623a7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1132,7 +1132,6 @@ static int soc15_common_early_init(void *handle) + adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG | + AMD_CG_SUPPORT_GFX_MGLS | + AMD_CG_SUPPORT_GFX_CP_LS | +- AMD_CG_SUPPORT_GFX_3D_CGCG | + AMD_CG_SUPPORT_GFX_3D_CGLS | + AMD_CG_SUPPORT_GFX_CGCG | + AMD_CG_SUPPORT_GFX_CGLS | +@@ -1152,7 +1151,6 @@ static int soc15_common_early_init(void *handle) + AMD_CG_SUPPORT_GFX_MGLS | + AMD_CG_SUPPORT_GFX_RLC_LS | + AMD_CG_SUPPORT_GFX_CP_LS | +- AMD_CG_SUPPORT_GFX_3D_CGCG | + AMD_CG_SUPPORT_GFX_3D_CGLS | + AMD_CG_SUPPORT_GFX_CGCG | + AMD_CG_SUPPORT_GFX_CGLS | +diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c +index 80520cef76173..e34cdc42575d8 100644 +--- a/drivers/hwmon/lm80.c ++++ b/drivers/hwmon/lm80.c +@@ -597,7 +597,6 @@ static int lm80_probe(struct i2c_client *client, + struct device *dev = &client->dev; + struct device *hwmon_dev; + struct lm80_data *data; +- int rv; + + data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL); + if (!data) +@@ -610,14 +609,8 @@ static int lm80_probe(struct i2c_client *client, + lm80_init_client(client); + + /* A few vars need to be filled upon startup */ +- rv = lm80_read_value(client, LM80_REG_FAN_MIN(1)); +- if (rv < 0) +- return rv; +- data->fan[f_min][0] = rv; +- rv = lm80_read_value(client, LM80_REG_FAN_MIN(2)); +- if (rv < 0) +- return rv; +- data->fan[f_min][1] = rv; ++ data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1)); ++ data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2)); + + hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, + data, lm80_groups); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index ecac62a7b59e8..92428990f0ccc 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -530,6 +530,7 @@ static void cma_release_dev(struct rdma_id_private *id_priv) + list_del(&id_priv->list); + cma_deref_dev(id_priv->cma_dev); + id_priv->cma_dev = NULL; ++ id_priv->id.device = NULL; + if (id_priv->id.route.addr.dev_addr.sgid_attr) { + rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr); + id_priv->id.route.addr.dev_addr.sgid_attr = NULL; +@@ -1871,6 +1872,7 @@ void rdma_destroy_id(struct rdma_cm_id *id) + iw_destroy_cm_id(id_priv->cm_id.iw); + } + cma_leave_mc_groups(id_priv); ++ rdma_restrack_del(&id_priv->res); + cma_release_dev(id_priv); + } + +@@ -3580,7 +3582,7 @@ int rdma_listen(struct rdma_cm_id *id, int backlog) + } + + id_priv->backlog = backlog; +- if (id->device) { ++ if (id_priv->cma_dev) { + if (rdma_cap_ib_cm(id->device, 1)) { + ret = cma_ib_listen(id_priv); + if (ret) +diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c +index 2a3f2f01028d3..fd351bdec3f64 100644 +--- a/drivers/infiniband/core/uverbs_std_types_device.c ++++ b/drivers/infiniband/core/uverbs_std_types_device.c +@@ -110,8 +110,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_INFO_HANDLES)( + return ret; + + uapi_object = uapi_get_object(attrs->ufile->device->uapi, object_id); +- if (!uapi_object) +- return -EINVAL; ++ if (IS_ERR(uapi_object)) ++ return PTR_ERR(uapi_object); + + handles = gather_objects_handle(attrs->ufile, uapi_object, attrs, + out_len, &total); +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index e2656b68ec222..a173737cb0222 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -6879,6 +6879,7 @@ static void *mlx5_ib_add_slave_port(struct mlx5_core_dev *mdev) + + if (bound) { + rdma_roce_rescan_device(&dev->ib_dev); ++ mpi->ibdev->ib_active = true; + break; + } + } +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index f85273883794b..d427a343c09f6 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -260,6 +260,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + if (err) { + vfree(qp->sq.queue->buf); + kfree(qp->sq.queue); ++ qp->sq.queue = NULL; + return err; + } + +@@ -313,6 +314,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + if (err) { + vfree(qp->rq.queue->buf); + kfree(qp->rq.queue); ++ qp->rq.queue = NULL; + return err; + } + } +@@ -373,6 +375,11 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd, + err2: + rxe_queue_cleanup(qp->sq.queue); + err1: ++ qp->pd = NULL; ++ qp->rcq = NULL; ++ qp->scq = NULL; ++ qp->srq = NULL; ++ + if (srq) + rxe_drop_ref(srq); + rxe_drop_ref(scq); +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 2c3704f0f10fa..b9ca54e372b47 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -314,7 +314,6 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + struct siw_ucontext *uctx = + rdma_udata_to_drv_context(udata, struct siw_ucontext, + base_ucontext); +- struct siw_cq *scq = NULL, *rcq = NULL; + unsigned long flags; + int num_sqe, num_rqe, rv = 0; + +@@ -353,10 +352,8 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + rv = -EINVAL; + goto err_out; + } +- scq = to_siw_cq(attrs->send_cq); +- rcq = to_siw_cq(attrs->recv_cq); + +- if (!scq || (!rcq && !attrs->srq)) { ++ if (!attrs->send_cq || (!attrs->recv_cq && !attrs->srq)) { + siw_dbg(base_dev, "send CQ or receive CQ invalid\n"); + rv = -EINVAL; + goto err_out; +@@ -400,7 +397,7 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + else { + /* Zero sized SQ is not supported */ + rv = -EINVAL; +- goto err_out; ++ goto err_out_xa; + } + if (num_rqe) + num_rqe = roundup_pow_of_two(num_rqe); +@@ -423,8 +420,8 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + } + } + qp->pd = pd; +- qp->scq = scq; +- qp->rcq = rcq; ++ qp->scq = to_siw_cq(attrs->send_cq); ++ qp->rcq = to_siw_cq(attrs->recv_cq); + + if (attrs->srq) { + /* +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index d0b931a136b96..82e781abde293 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -307,7 +307,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + usleep_range(3000, 6000); + ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); + if (ret) +- return ret; ++ goto out; + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index 0164c9ca984ba..add7d4ce41802 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1408,6 +1408,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + if (!s->store->chunk_size) { + ti->error = "Chunk size not set"; ++ r = -EINVAL; + goto bad_read_metadata; + } + +diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c +index af3c8d405509e..ae9a5f3e1beca 100644 +--- a/drivers/media/platform/rcar_drif.c ++++ b/drivers/media/platform/rcar_drif.c +@@ -911,7 +911,6 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, + { + struct rcar_drif_sdr *sdr = video_drvdata(file); + +- memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); + f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; + f->fmt.sdr.buffersize = sdr->fmt->buffersize; + +diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c +index 2bdf560ee681b..0f9ea75b0b189 100644 +--- a/drivers/misc/ics932s401.c ++++ b/drivers/misc/ics932s401.c +@@ -134,7 +134,7 @@ static struct ics932s401_data *ics932s401_update_device(struct device *dev) + for (i = 0; i < NUM_MIRRORED_REGS; i++) { + temp = i2c_smbus_read_word_data(client, regs_to_copy[i]); + if (temp < 0) +- data->regs[regs_to_copy[i]] = 0; ++ temp = 0; + data->regs[regs_to_copy[i]] = temp >> 8; + } + +diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c +index fd76aa672e020..4437ea4ec8596 100644 +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -318,8 +318,13 @@ static void sdhci_gli_voltage_switch(struct sdhci_host *host) + * + * Wait 5ms after set 1.8V signal enable in Host Control 2 register + * to ensure 1.8V signal enable bit is set by GL9750/GL9755. ++ * ++ * ...however, the controller in the NUC10i3FNK4 (a 9755) requires ++ * slightly longer than 5ms before the control register reports that ++ * 1.8V is ready, and far longer still before the card will actually ++ * work reliably. + */ +- usleep_range(5000, 5500); ++ usleep_range(100000, 110000); + } + + static void sdhci_gl9750_reset(struct sdhci_host *host, u8 mask) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +index a4cd6f2cfb862..4fb3dcb038196 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +@@ -1049,7 +1049,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) { + skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE); + if (!skb) +- break; ++ goto error; + qlcnic_create_loopback_buff(skb->data, adapter->mac_addr); + skb_put(skb, QLCNIC_ILB_PKT_SIZE); + adapter->ahw->diag_cnt = 0; +@@ -1073,6 +1073,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + cnt++; + } + if (cnt != i) { ++error: + dev_err(&adapter->pdev->dev, + "LB Test: failed, TX[%d], RX[%d]\n", i, cnt); + if (mode != QLCNIC_ILB_MODE) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +index 65a3e3b5facef..f87cab39fa0e8 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +@@ -30,7 +30,7 @@ struct sunxi_priv_data { + static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + { + struct sunxi_priv_data *gmac = priv; +- int ret; ++ int ret = 0; + + if (gmac->regulator) { + ret = regulator_enable(gmac->regulator); +@@ -51,11 +51,11 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + } else { + clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE); + ret = clk_prepare(gmac->tx_clk); +- if (ret) +- return ret; ++ if (ret && gmac->regulator) ++ regulator_disable(gmac->regulator); + } + +- return 0; ++ return ret; + } + + static void sun7i_gmac_exit(struct platform_device *pdev, void *priv) +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 2911740af7061..595f560937a71 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -8144,10 +8144,10 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + "VPD_SCAN: Reading in property [%s] len[%d]\n", + namebuf, prop_len); + for (i = 0; i < prop_len; i++) { +- err = niu_pci_eeprom_read(np, off + i); +- if (err >= 0) +- *prop_buf = err; +- ++prop_buf; ++ err = niu_pci_eeprom_read(np, off + i); ++ if (err < 0) ++ return err; ++ *prop_buf++ = err; + } + } + +@@ -8158,14 +8158,14 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + } + + /* ESPC_PIO_EN_ENABLE must be set */ +-static void niu_pci_vpd_fetch(struct niu *np, u32 start) ++static int niu_pci_vpd_fetch(struct niu *np, u32 start) + { + u32 offset; + int err; + + err = niu_pci_eeprom_read16_swp(np, start + 1); + if (err < 0) +- return; ++ return err; + + offset = err + 3; + +@@ -8174,12 +8174,14 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) + u32 end; + + err = niu_pci_eeprom_read(np, here); ++ if (err < 0) ++ return err; + if (err != 0x90) +- return; ++ return -EINVAL; + + err = niu_pci_eeprom_read16_swp(np, here + 1); + if (err < 0) +- return; ++ return err; + + here = start + offset + 3; + end = start + offset + err; +@@ -8187,9 +8189,12 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) + offset += err; + + err = niu_pci_vpd_scan_props(np, here, end); +- if (err < 0 || err == 1) +- return; ++ if (err < 0) ++ return err; ++ if (err == 1) ++ return -EINVAL; + } ++ return 0; + } + + /* ESPC_PIO_EN_ENABLE must be set */ +@@ -9280,8 +9285,11 @@ static int niu_get_invariants(struct niu *np) + offset = niu_pci_vpd_offset(np); + netif_printk(np, probe, KERN_DEBUG, np->dev, + "%s() VPD offset [%08x]\n", __func__, offset); +- if (offset) +- niu_pci_vpd_fetch(np, offset); ++ if (offset) { ++ err = niu_pci_vpd_fetch(np, offset); ++ if (err < 0) ++ return err; ++ } + nw64(ESPC_PIO_EN, 0); + + if (np->flags & NIU_FLAGS_VPD_VALID) { +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index ac746c322554b..c9ad6761032ae 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -436,9 +436,14 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw) + } + } + +-static void _rtl_init_deferred_work(struct ieee80211_hw *hw) ++static int _rtl_init_deferred_work(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); ++ struct workqueue_struct *wq; ++ ++ wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); ++ if (!wq) ++ return -ENOMEM; + + /* <1> timer */ + timer_setup(&rtlpriv->works.watchdog_timer, +@@ -447,11 +452,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) + rtl_easy_concurrent_retrytimer_callback, 0); + /* <2> work queue */ + rtlpriv->works.hw = hw; +- rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); +- if (unlikely(!rtlpriv->works.rtl_wq)) { +- pr_err("Failed to allocate work queue\n"); +- return; +- } ++ rtlpriv->works.rtl_wq = wq; + + INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq, + (void *)rtl_watchdog_wq_callback); +@@ -465,6 +466,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) + (void *)rtl_fwevt_wq_callback); + INIT_DELAYED_WORK(&rtlpriv->works.c2hcmd_wq, + (void *)rtl_c2hcmd_wq_callback); ++ return 0; + } + + void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq) +@@ -564,9 +566,7 @@ int rtl_init_core(struct ieee80211_hw *hw) + rtlmac->link_state = MAC80211_NOLINK; + + /* <6> init deferred work */ +- _rtl_init_deferred_work(hw); +- +- return 0; ++ return _rtl_init_deferred_work(hw); + } + EXPORT_SYMBOL_GPL(rtl_init_core); + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 6041511b8b76d..710ab45eb679d 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2904,7 +2904,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) + ctrl->hmmaxd = le16_to_cpu(id->hmmaxd); + } + +- ret = nvme_mpath_init(ctrl, id); ++ ret = nvme_mpath_init_identify(ctrl, id); + kfree(id); + + if (ret < 0) +@@ -4145,6 +4145,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + min(default_ps_max_latency_us, (unsigned long)S32_MAX)); + + nvme_fault_inject_init(&ctrl->fault_inject, dev_name(ctrl->device)); ++ nvme_mpath_init_ctrl(ctrl); + + return 0; + out_free_name: +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 855edc4e12440..590b040e90a34 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -718,9 +718,18 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head) + put_disk(head->disk); + } + +-int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) ++void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl) + { +- int error; ++ mutex_init(&ctrl->ana_lock); ++ timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); ++ INIT_WORK(&ctrl->ana_work, nvme_ana_work); ++} ++ ++int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) ++{ ++ size_t max_transfer_size = ctrl->max_hw_sectors << SECTOR_SHIFT; ++ size_t ana_log_size; ++ int error = 0; + + /* check if multipath is enabled and we have the capability */ + if (!multipath || !ctrl->subsys || !(ctrl->subsys->cmic & (1 << 3))) +@@ -731,37 +740,31 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + ctrl->nanagrpid = le32_to_cpu(id->nanagrpid); + ctrl->anagrpmax = le32_to_cpu(id->anagrpmax); + +- mutex_init(&ctrl->ana_lock); +- timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); +- ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + +- ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc); +- ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); +- +- if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) { ++ ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + ++ ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc) + ++ ctrl->max_namespaces * sizeof(__le32); ++ if (ana_log_size > max_transfer_size) { + dev_err(ctrl->device, +- "ANA log page size (%zd) larger than MDTS (%d).\n", +- ctrl->ana_log_size, +- ctrl->max_hw_sectors << SECTOR_SHIFT); ++ "ANA log page size (%zd) larger than MDTS (%zd).\n", ++ ana_log_size, max_transfer_size); + dev_err(ctrl->device, "disabling ANA support.\n"); +- return 0; ++ goto out_uninit; + } +- +- INIT_WORK(&ctrl->ana_work, nvme_ana_work); +- kfree(ctrl->ana_log_buf); +- ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL); +- if (!ctrl->ana_log_buf) { +- error = -ENOMEM; +- goto out; ++ if (ana_log_size > ctrl->ana_log_size) { ++ nvme_mpath_stop(ctrl); ++ kfree(ctrl->ana_log_buf); ++ ctrl->ana_log_buf = kmalloc(ana_log_size, GFP_KERNEL); ++ if (!ctrl->ana_log_buf) ++ return -ENOMEM; + } +- ++ ctrl->ana_log_size = ana_log_size; + error = nvme_read_ana_log(ctrl); + if (error) +- goto out_free_ana_log_buf; ++ goto out_uninit; + return 0; +-out_free_ana_log_buf: +- kfree(ctrl->ana_log_buf); +- ctrl->ana_log_buf = NULL; +-out: ++ ++out_uninit: ++ nvme_mpath_uninit(ctrl); + return error; + } + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 62e5401865fee..2df90d4355b9a 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -549,7 +549,8 @@ void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl); + int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head); + void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id); + void nvme_mpath_remove_disk(struct nvme_ns_head *head); +-int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id); ++int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id); ++void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl); + void nvme_mpath_uninit(struct nvme_ctrl *ctrl); + void nvme_mpath_stop(struct nvme_ctrl *ctrl); + bool nvme_mpath_clear_current_path(struct nvme_ns *ns); +@@ -636,7 +637,10 @@ static inline void nvme_trace_bio_complete(struct request *req, + blk_status_t status) + { + } +-static inline int nvme_mpath_init(struct nvme_ctrl *ctrl, ++static inline void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl) ++{ ++} ++static inline int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, + struct nvme_id_ctrl *id) + { + if (ctrl->subsys->cmic & (1 << 3)) +diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c +index 05453f5d14486..6ca17a0babae2 100644 +--- a/drivers/nvme/target/io-cmd-file.c ++++ b/drivers/nvme/target/io-cmd-file.c +@@ -38,9 +38,11 @@ int nvmet_file_ns_enable(struct nvmet_ns *ns) + + ns->file = filp_open(ns->device_path, flags, 0); + if (IS_ERR(ns->file)) { +- pr_err("failed to open file %s: (%ld)\n", +- ns->device_path, PTR_ERR(ns->file)); +- return PTR_ERR(ns->file); ++ ret = PTR_ERR(ns->file); ++ pr_err("failed to open file %s: (%d)\n", ++ ns->device_path, ret); ++ ns->file = NULL; ++ return ret; + } + + ret = vfs_getattr(&ns->file->f_path, +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index 5739a9669b291..92bda873d44a4 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -294,6 +294,9 @@ mlxbf_tmfifo_get_next_desc(struct mlxbf_tmfifo_vring *vring) + if (vring->next_avail == virtio16_to_cpu(vdev, vr->avail->idx)) + return NULL; + ++ /* Make sure 'avail->idx' is visible already. */ ++ virtio_rmb(false); ++ + idx = vring->next_avail % vr->num; + head = virtio16_to_cpu(vdev, vr->avail->ring[idx]); + if (WARN_ON(head >= vr->num)) +@@ -322,7 +325,7 @@ static void mlxbf_tmfifo_release_desc(struct mlxbf_tmfifo_vring *vring, + * done or not. Add a memory barrier here to make sure the update above + * completes before updating the idx. + */ +- mb(); ++ virtio_mb(false); + vr->used->idx = cpu_to_virtio16(vdev, vr_idx + 1); + } + +@@ -730,6 +733,12 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring, + desc = NULL; + fifo->vring[is_rx] = NULL; + ++ /* ++ * Make sure the load/store are in order before ++ * returning back to virtio. ++ */ ++ virtio_mb(false); ++ + /* Notify upper layer that packet is done. */ + spin_lock_irqsave(&fifo->spin_lock[is_rx], flags); + vring_interrupt(0, vring->vq); +diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c +index 27a298b7c541b..c97bd4a452422 100644 +--- a/drivers/platform/x86/dell-smbios-wmi.c ++++ b/drivers/platform/x86/dell-smbios-wmi.c +@@ -271,7 +271,8 @@ int init_dell_smbios_wmi(void) + + void exit_dell_smbios_wmi(void) + { +- wmi_driver_unregister(&dell_smbios_wmi_driver); ++ if (wmi_supported) ++ wmi_driver_unregister(&dell_smbios_wmi_driver); + } + + MODULE_DEVICE_TABLE(wmi, dell_smbios_wmi_id_table); +diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c +index 50ec53d67a4c0..db4c265287ae6 100644 +--- a/drivers/rapidio/rio_cm.c ++++ b/drivers/rapidio/rio_cm.c +@@ -2127,6 +2127,14 @@ static int riocm_add_mport(struct device *dev, + return -ENODEV; + } + ++ cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); ++ if (!cm->rx_wq) { ++ rio_release_inb_mbox(mport, cmbox); ++ rio_release_outb_mbox(mport, cmbox); ++ kfree(cm); ++ return -ENOMEM; ++ } ++ + /* + * Allocate and register inbound messaging buffers to be ready + * to receive channel and system management requests +@@ -2137,15 +2145,6 @@ static int riocm_add_mport(struct device *dev, + cm->rx_slots = RIOCM_RX_RING_SIZE; + mutex_init(&cm->rx_lock); + riocm_rx_fill(cm, RIOCM_RX_RING_SIZE); +- cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); +- if (!cm->rx_wq) { +- riocm_error("failed to allocate IBMBOX_%d on %s", +- cmbox, mport->name); +- rio_release_outb_mbox(mport, cmbox); +- kfree(cm); +- return -ENOMEM; +- } +- + INIT_WORK(&cm->rx_work, rio_ibmsg_handler); + + cm->tx_slot = 0; +diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c +index c855d013ba8aa..de567a025133c 100644 +--- a/drivers/scsi/qla2xxx/qla_nx.c ++++ b/drivers/scsi/qla2xxx/qla_nx.c +@@ -1113,7 +1113,8 @@ qla82xx_write_flash_dword(struct qla_hw_data *ha, uint32_t flashaddr, + return ret; + } + +- if (qla82xx_flash_set_write_enable(ha)) ++ ret = qla82xx_flash_set_write_enable(ha); ++ if (ret < 0) + goto done_write; + + qla82xx_wr_32(ha, QLA82XX_ROMUSB_ROM_WDATA, data); +diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c +index 6bbb1679bb91c..9903ce9f066cf 100644 +--- a/drivers/scsi/ufs/ufs-hisi.c ++++ b/drivers/scsi/ufs/ufs-hisi.c +@@ -481,21 +481,24 @@ static int ufs_hisi_init_common(struct ufs_hba *hba) + host->hba = hba; + ufshcd_set_variant(hba, host); + +- host->rst = devm_reset_control_get(dev, "rst"); ++ host->rst = devm_reset_control_get(dev, "rst"); + if (IS_ERR(host->rst)) { + dev_err(dev, "%s: failed to get reset control\n", __func__); +- return PTR_ERR(host->rst); ++ err = PTR_ERR(host->rst); ++ goto error; + } + + ufs_hisi_set_pm_lvl(hba); + + err = ufs_hisi_get_resource(host); +- if (err) { +- ufshcd_set_variant(hba, NULL); +- return err; +- } ++ if (err) ++ goto error; + + return 0; ++ ++error: ++ ufshcd_set_variant(hba, NULL); ++ return err; + } + + static int ufs_hi3660_init(struct ufs_hba *hba) +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 25112c2fe2db6..0429ba5d7d23c 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -2615,7 +2615,7 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, + * ufshcd_exec_dev_cmd - API for sending device management requests + * @hba: UFS hba + * @cmd_type: specifies the type (NOP, Query...) +- * @timeout: time in seconds ++ * @timeout: timeout in milliseconds + * + * NOTE: Since there is only one available tag for device management commands, + * it is expected you hold the hba->dev_cmd.lock mutex. +@@ -2645,6 +2645,9 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba, + } + tag = req->tag; + WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag)); ++ /* Set the timeout such that the SCSI error handler is not activated. */ ++ req->timeout = msecs_to_jiffies(2 * timeout); ++ blk_mq_start_request(req); + + init_completion(&wait); + lrbp = &hba->lrb[tag]; +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index e006f40ffdc04..5e6f661943eb1 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -818,9 +818,6 @@ static int mvebu_uart_probe(struct platform_device *pdev) + return -EINVAL; + } + +- if (!match) +- return -ENODEV; +- + /* Assume that all UART ports have a DT alias or none has */ + id = of_alias_get_id(pdev->dev.of_node, "serial"); + if (!pdev->dev.of_node || id < 0) +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 564e1fa2e4c94..6f013d7f5bd0f 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1166,7 +1166,7 @@ static inline int resize_screen(struct vc_data *vc, int width, int height, + /* Resizes the resolution of the display adapater */ + int err = 0; + +- if (vc->vc_mode != KD_GRAPHICS && vc->vc_sw->con_resize) ++ if (vc->vc_sw->con_resize) + err = vc->vc_sw->con_resize(vc, width, height, user); + + return err; +diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c +index 4f51be17427c0..b5d2ad900ec09 100644 +--- a/drivers/tty/vt/vt_ioctl.c ++++ b/drivers/tty/vt/vt_ioctl.c +@@ -895,17 +895,17 @@ int vt_ioctl(struct tty_struct *tty, + if (vcp) { + int ret; + int save_scan_lines = vcp->vc_scan_lines; +- int save_font_height = vcp->vc_font.height; ++ int save_cell_height = vcp->vc_cell_height; + + if (v.v_vlin) + vcp->vc_scan_lines = v.v_vlin; + if (v.v_clin) +- vcp->vc_font.height = v.v_clin; ++ vcp->vc_cell_height = v.v_clin; + vcp->vc_resize_user = 1; + ret = vc_resize(vcp, v.v_cols, v.v_rows); + if (ret) { + vcp->vc_scan_lines = save_scan_lines; +- vcp->vc_font.height = save_font_height; ++ vcp->vc_cell_height = save_cell_height; + console_unlock(); + return ret; + } +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +index 3c5169eb23f5c..bdf3932ee3f20 100644 +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -296,8 +296,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->recv_buf, + RECV_BUFFER_SIZE, &pdata->recv_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->recv_buf); + goto fail_close; ++ } + + /* put Global Physical Address Label in name */ + snprintf(pdata->recv_name, sizeof(pdata->recv_name), +@@ -316,8 +318,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->send_buf, + SEND_BUFFER_SIZE, &pdata->send_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->send_buf); + goto fail_close; ++ } + + snprintf(pdata->send_name, sizeof(pdata->send_name), + "send:%u", pdata->send_gpadl); +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index 55507df335bdd..a992d922b3a71 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -384,7 +384,7 @@ static void vgacon_init(struct vc_data *c, int init) + vc_resize(c, vga_video_num_columns, vga_video_num_lines); + + c->vc_scan_lines = vga_scan_lines; +- c->vc_font.height = vga_video_font_height; ++ c->vc_font.height = c->vc_cell_height = vga_video_font_height; + c->vc_complement_mask = 0x7700; + if (vga_512_chars) + c->vc_hi_font_mask = 0x0800; +@@ -517,32 +517,32 @@ static void vgacon_cursor(struct vc_data *c, int mode) + switch (c->vc_cursor_type & 0x0f) { + case CUR_UNDERLINE: + vgacon_set_cursor_size(c->vc_x, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 2 : 3), +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_TWO_THIRDS: + vgacon_set_cursor_size(c->vc_x, +- c->vc_font.height / 3, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height / 3, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_LOWER_THIRD: + vgacon_set_cursor_size(c->vc_x, +- (c->vc_font.height * 2) / 3, +- c->vc_font.height - +- (c->vc_font.height < ++ (c->vc_cell_height * 2) / 3, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_LOWER_HALF: + vgacon_set_cursor_size(c->vc_x, +- c->vc_font.height / 2, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height / 2, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_NONE: +@@ -553,7 +553,7 @@ static void vgacon_cursor(struct vc_data *c, int mode) + break; + default: + vgacon_set_cursor_size(c->vc_x, 1, +- c->vc_font.height); ++ c->vc_cell_height); + break; + } + break; +@@ -564,13 +564,13 @@ static int vgacon_doresize(struct vc_data *c, + unsigned int width, unsigned int height) + { + unsigned long flags; +- unsigned int scanlines = height * c->vc_font.height; ++ unsigned int scanlines = height * c->vc_cell_height; + u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan; + + raw_spin_lock_irqsave(&vga_lock, flags); + + vgacon_xres = width * VGA_FONTWIDTH; +- vgacon_yres = height * c->vc_font.height; ++ vgacon_yres = height * c->vc_cell_height; + if (vga_video_type >= VIDEO_TYPE_VGAC) { + outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg); + max_scan = inb_p(vga_video_port_val); +@@ -625,9 +625,9 @@ static int vgacon_doresize(struct vc_data *c, + static int vgacon_switch(struct vc_data *c) + { + int x = c->vc_cols * VGA_FONTWIDTH; +- int y = c->vc_rows * c->vc_font.height; ++ int y = c->vc_rows * c->vc_cell_height; + int rows = screen_info.orig_video_lines * vga_default_font_height/ +- c->vc_font.height; ++ c->vc_cell_height; + /* + * We need to save screen size here as it's the only way + * we can spot the screen has been resized and we need to +@@ -1058,7 +1058,7 @@ static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight) + cursor_size_lastto = 0; + c->vc_sw->con_cursor(c, CM_DRAW); + } +- c->vc_font.height = fontheight; ++ c->vc_font.height = c->vc_cell_height = fontheight; + vc_resize(c, 0, rows); /* Adjust console size */ + } + } +@@ -1106,12 +1106,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width, + if ((width << 1) * height > vga_vram_size) + return -EINVAL; + ++ if (user) { ++ /* ++ * Ho ho! Someone (svgatextmode, eh?) may have reprogrammed ++ * the video mode! Set the new defaults then and go away. ++ */ ++ screen_info.orig_video_cols = width; ++ screen_info.orig_video_lines = height; ++ vga_default_font_height = c->vc_cell_height; ++ return 0; ++ } + if (width % 2 || width > screen_info.orig_video_cols || + height > (screen_info.orig_video_lines * vga_default_font_height)/ +- c->vc_font.height) +- /* let svgatextmode tinker with video timings and +- return success */ +- return (user) ? 0 : -EINVAL; ++ c->vc_cell_height) ++ return -EINVAL; + + if (con_is_visible(c) && !vga_is_gfx) /* who knows */ + vgacon_doresize(c, width, height); +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 0a9202176ffc9..75b7705140673 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2058,7 +2058,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, + return -EINVAL; + + DPRINTK("resize now %ix%i\n", var.xres, var.yres); +- if (con_is_visible(vc)) { ++ if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) { + var.activate = FB_ACTIVATE_NOW | + FB_ACTIVATE_FORCE; + fb_set_var(info, &var); +diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c +index 59e1cae579481..03c0b1b8747b9 100644 +--- a/drivers/video/fbdev/hgafb.c ++++ b/drivers/video/fbdev/hgafb.c +@@ -286,7 +286,7 @@ static int hga_card_detect(void) + + hga_vram = ioremap(0xb0000, hga_vram_len); + if (!hga_vram) +- goto error; ++ return -ENOMEM; + + if (request_region(0x3b0, 12, "hgafb")) + release_io_ports = 1; +@@ -346,13 +346,18 @@ static int hga_card_detect(void) + hga_type_name = "Hercules"; + break; + } +- return 1; ++ return 0; + error: + if (release_io_ports) + release_region(0x3b0, 12); + if (release_io_port) + release_region(0x3bf, 1); +- return 0; ++ ++ iounmap(hga_vram); ++ ++ pr_err("hgafb: HGA card not detected.\n"); ++ ++ return -EINVAL; + } + + /** +@@ -550,13 +555,11 @@ static struct fb_ops hgafb_ops = { + static int hgafb_probe(struct platform_device *pdev) + { + struct fb_info *info; ++ int ret; + +- if (! hga_card_detect()) { +- printk(KERN_INFO "hgafb: HGA card not detected.\n"); +- if (hga_vram) +- iounmap(hga_vram); +- return -EINVAL; +- } ++ ret = hga_card_detect(); ++ if (ret) ++ return ret; + + printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n", + hga_type_name, hga_vram_len/1024); +diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c +index 58b01c7d90560..5f610d4929ddb 100644 +--- a/drivers/video/fbdev/imsttfb.c ++++ b/drivers/video/fbdev/imsttfb.c +@@ -1512,11 +1512,6 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + info->fix.smem_start = addr; + info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ? + 0x400000 : 0x800000); +- if (!info->screen_base) { +- release_mem_region(addr, size); +- framebuffer_release(info); +- return -ENOMEM; +- } + info->fix.mmio_start = addr + 0x800000; + par->dc_regs = ioremap(addr + 0x800000, 0x1000); + par->cmap_regs_phys = addr + 0x840000; +diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c +index 7fb65836230ac..a255b08aff4d9 100644 +--- a/drivers/xen/xen-pciback/xenbus.c ++++ b/drivers/xen/xen-pciback/xenbus.c +@@ -358,7 +358,8 @@ out: + return err; + } + +-static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) ++static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev, ++ enum xenbus_state state) + { + int err = 0; + int num_devs; +@@ -372,9 +373,7 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) + dev_dbg(&pdev->xdev->dev, "Reconfiguring device ...\n"); + + mutex_lock(&pdev->dev_lock); +- /* Make sure we only reconfigure once */ +- if (xenbus_read_driver_state(pdev->xdev->nodename) != +- XenbusStateReconfiguring) ++ if (xenbus_read_driver_state(pdev->xdev->nodename) != state) + goto out; + + err = xenbus_scanf(XBT_NIL, pdev->xdev->nodename, "num_devs", "%d", +@@ -499,6 +498,10 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) + } + } + ++ if (state != XenbusStateReconfiguring) ++ /* Make sure we only reconfigure once. */ ++ goto out; ++ + err = xenbus_switch_state(pdev->xdev, XenbusStateReconfigured); + if (err) { + xenbus_dev_fatal(pdev->xdev, err, +@@ -524,7 +527,7 @@ static void xen_pcibk_frontend_changed(struct xenbus_device *xdev, + break; + + case XenbusStateReconfiguring: +- xen_pcibk_reconfigure(pdev); ++ xen_pcibk_reconfigure(pdev, XenbusStateReconfiguring); + break; + + case XenbusStateConnected: +@@ -663,6 +666,15 @@ static void xen_pcibk_be_watch(struct xenbus_watch *watch, + xen_pcibk_setup_backend(pdev); + break; + ++ case XenbusStateInitialised: ++ /* ++ * We typically move to Initialised when the first device was ++ * added. Hence subsequent devices getting added may need ++ * reconfiguring. ++ */ ++ xen_pcibk_reconfigure(pdev, XenbusStateInitialised); ++ break; ++ + default: + break; + } +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index b36a4d144bec0..8ea9559c1919a 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -3571,6 +3571,7 @@ void btrfs_run_delayed_iputs(struct btrfs_fs_info *fs_info) + inode = list_first_entry(&fs_info->delayed_iputs, + struct btrfs_inode, delayed_iput); + run_delayed_iput_locked(fs_info, inode); ++ cond_resched_lock(&fs_info->delayed_iput_lock); + } + spin_unlock(&fs_info->delayed_iput_lock); + } +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 997a106f28d37..bf6b4f71dc58f 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1673,6 +1673,8 @@ smb2_copychunk_range(const unsigned int xid, + cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk)); + + /* Request server copy to target from src identified by key */ ++ kfree(retbuf); ++ retbuf = NULL; + rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, + trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE, + true /* is_fsctl */, (char *)pcchunk, +diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c +index a064b408d8416..f91db24bbf3bc 100644 +--- a/fs/ecryptfs/crypto.c ++++ b/fs/ecryptfs/crypto.c +@@ -311,10 +311,8 @@ static int crypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat, + struct extent_crypt_result ecr; + int rc = 0; + +- if (!crypt_stat || !crypt_stat->tfm +- || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) +- return -EINVAL; +- ++ BUG_ON(!crypt_stat || !crypt_stat->tfm ++ || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)); + if (unlikely(ecryptfs_verbosity > 0)) { + ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n", + crypt_stat->key_size); +diff --git a/fs/ext4/verity.c b/fs/ext4/verity.c +index d0d8a9795dd62..6a30e54c11282 100644 +--- a/fs/ext4/verity.c ++++ b/fs/ext4/verity.c +@@ -198,55 +198,76 @@ static int ext4_end_enable_verity(struct file *filp, const void *desc, + struct inode *inode = file_inode(filp); + const int credits = 2; /* superblock and inode for ext4_orphan_del() */ + handle_t *handle; ++ struct ext4_iloc iloc; + int err = 0; +- int err2; + +- if (desc != NULL) { +- /* Succeeded; write the verity descriptor. */ +- err = ext4_write_verity_descriptor(inode, desc, desc_size, +- merkle_tree_size); +- +- /* Write all pages before clearing VERITY_IN_PROGRESS. */ +- if (!err) +- err = filemap_write_and_wait(inode->i_mapping); +- } ++ /* ++ * If an error already occurred (which fs/verity/ signals by passing ++ * desc == NULL), then only clean-up is needed. ++ */ ++ if (desc == NULL) ++ goto cleanup; + +- /* If we failed, truncate anything we wrote past i_size. */ +- if (desc == NULL || err) +- ext4_truncate(inode); ++ /* Append the verity descriptor. */ ++ err = ext4_write_verity_descriptor(inode, desc, desc_size, ++ merkle_tree_size); ++ if (err) ++ goto cleanup; + + /* +- * We must always clean up by clearing EXT4_STATE_VERITY_IN_PROGRESS and +- * deleting the inode from the orphan list, even if something failed. +- * If everything succeeded, we'll also set the verity bit in the same +- * transaction. ++ * Write all pages (both data and verity metadata). Note that this must ++ * happen before clearing EXT4_STATE_VERITY_IN_PROGRESS; otherwise pages ++ * beyond i_size won't be written properly. For crash consistency, this ++ * also must happen before the verity inode flag gets persisted. + */ ++ err = filemap_write_and_wait(inode->i_mapping); ++ if (err) ++ goto cleanup; + +- ext4_clear_inode_state(inode, EXT4_STATE_VERITY_IN_PROGRESS); ++ /* ++ * Finally, set the verity inode flag and remove the inode from the ++ * orphan list (in a single transaction). ++ */ + + handle = ext4_journal_start(inode, EXT4_HT_INODE, credits); + if (IS_ERR(handle)) { +- ext4_orphan_del(NULL, inode); +- return PTR_ERR(handle); ++ err = PTR_ERR(handle); ++ goto cleanup; + } + +- err2 = ext4_orphan_del(handle, inode); +- if (err2) +- goto out_stop; ++ err = ext4_orphan_del(handle, inode); ++ if (err) ++ goto stop_and_cleanup; + +- if (desc != NULL && !err) { +- struct ext4_iloc iloc; ++ err = ext4_reserve_inode_write(handle, inode, &iloc); ++ if (err) ++ goto stop_and_cleanup; + +- err = ext4_reserve_inode_write(handle, inode, &iloc); +- if (err) +- goto out_stop; +- ext4_set_inode_flag(inode, EXT4_INODE_VERITY); +- ext4_set_inode_flags(inode); +- err = ext4_mark_iloc_dirty(handle, inode, &iloc); +- } +-out_stop: ++ ext4_set_inode_flag(inode, EXT4_INODE_VERITY); ++ ext4_set_inode_flags(inode); ++ err = ext4_mark_iloc_dirty(handle, inode, &iloc); ++ if (err) ++ goto stop_and_cleanup; ++ ++ ext4_journal_stop(handle); ++ ++ ext4_clear_inode_state(inode, EXT4_STATE_VERITY_IN_PROGRESS); ++ return 0; ++ ++stop_and_cleanup: + ext4_journal_stop(handle); +- return err ?: err2; ++cleanup: ++ /* ++ * Verity failed to be enabled, so clean up by truncating any verity ++ * metadata that was written beyond i_size (both from cache and from ++ * disk), removing the inode from the orphan list (if it wasn't done ++ * already), and clearing EXT4_STATE_VERITY_IN_PROGRESS. ++ */ ++ truncate_inode_pages(inode->i_mapping, inode->i_size); ++ ext4_truncate(inode); ++ ext4_orphan_del(NULL, inode); ++ ext4_clear_inode_state(inode, EXT4_STATE_VERITY_IN_PROGRESS); ++ return err; + } + + static int ext4_get_verity_descriptor_location(struct inode *inode, +diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h +index 24d4c16e3ae03..717f51e1b1dfa 100644 +--- a/include/linux/console_struct.h ++++ b/include/linux/console_struct.h +@@ -62,6 +62,7 @@ struct vc_data { + unsigned int vc_rows; + unsigned int vc_size_row; /* Bytes per row */ + unsigned int vc_scan_lines; /* # of scan lines */ ++ unsigned int vc_cell_height; /* CRTC character cell height */ + unsigned long vc_origin; /* [!] Start of real screen */ + unsigned long vc_scr_end; /* [!] End of real screen */ + unsigned long vc_visible_origin; /* [!] Top of visible window */ +diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c +index 771d4ca96dda7..4fe40910f471b 100644 +--- a/kernel/locking/mutex-debug.c ++++ b/kernel/locking/mutex-debug.c +@@ -57,7 +57,7 @@ void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, + task->blocked_on = waiter; + } + +-void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, ++void debug_mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, + struct task_struct *task) + { + DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list)); +@@ -65,7 +65,7 @@ void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter); + task->blocked_on = NULL; + +- list_del_init(&waiter->list); ++ INIT_LIST_HEAD(&waiter->list); + waiter->task = NULL; + } + +diff --git a/kernel/locking/mutex-debug.h b/kernel/locking/mutex-debug.h +index 1edd3f45a4ecb..53e631e1d76da 100644 +--- a/kernel/locking/mutex-debug.h ++++ b/kernel/locking/mutex-debug.h +@@ -22,7 +22,7 @@ extern void debug_mutex_free_waiter(struct mutex_waiter *waiter); + extern void debug_mutex_add_waiter(struct mutex *lock, + struct mutex_waiter *waiter, + struct task_struct *task); +-extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, ++extern void debug_mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, + struct task_struct *task); + extern void debug_mutex_unlock(struct mutex *lock); + extern void debug_mutex_init(struct mutex *lock, const char *name, +diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c +index 07a9f9f46e035..c0c7784f074b2 100644 +--- a/kernel/locking/mutex.c ++++ b/kernel/locking/mutex.c +@@ -204,7 +204,7 @@ static inline bool __mutex_waiter_is_first(struct mutex *lock, struct mutex_wait + * Add @waiter to a given location in the lock wait_list and set the + * FLAG_WAITERS flag if it's the first waiter. + */ +-static void __sched ++static void + __mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, + struct list_head *list) + { +@@ -215,6 +215,16 @@ __mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, + __mutex_set_flag(lock, MUTEX_FLAG_WAITERS); + } + ++static void ++__mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter) ++{ ++ list_del(&waiter->list); ++ if (likely(list_empty(&lock->wait_list))) ++ __mutex_clear_flag(lock, MUTEX_FLAGS); ++ ++ debug_mutex_remove_waiter(lock, waiter, current); ++} ++ + /* + * Give up ownership to a specific task, when @task = NULL, this is equivalent + * to a regular unlock. Sets PICKUP on a handoff, clears HANDOF, preserves +@@ -1071,9 +1081,7 @@ acquired: + __ww_mutex_check_waiters(lock, ww_ctx); + } + +- mutex_remove_waiter(lock, &waiter, current); +- if (likely(list_empty(&lock->wait_list))) +- __mutex_clear_flag(lock, MUTEX_FLAGS); ++ __mutex_remove_waiter(lock, &waiter); + + debug_mutex_free_waiter(&waiter); + +@@ -1090,7 +1098,7 @@ skip_wait: + + err: + __set_current_state(TASK_RUNNING); +- mutex_remove_waiter(lock, &waiter, current); ++ __mutex_remove_waiter(lock, &waiter); + err_early_kill: + spin_unlock(&lock->wait_lock); + debug_mutex_free_waiter(&waiter); +diff --git a/kernel/locking/mutex.h b/kernel/locking/mutex.h +index 1c2287d3fa719..f0c710b1d1927 100644 +--- a/kernel/locking/mutex.h ++++ b/kernel/locking/mutex.h +@@ -10,12 +10,10 @@ + * !CONFIG_DEBUG_MUTEXES case. Most of them are NOPs: + */ + +-#define mutex_remove_waiter(lock, waiter, task) \ +- __list_del((waiter)->list.prev, (waiter)->list.next) +- + #define debug_mutex_wake_waiter(lock, waiter) do { } while (0) + #define debug_mutex_free_waiter(waiter) do { } while (0) + #define debug_mutex_add_waiter(lock, waiter, ti) do { } while (0) ++#define debug_mutex_remove_waiter(lock, waiter, ti) do { } while (0) + #define debug_mutex_unlock(lock) do { } while (0) + #define debug_mutex_init(lock, name, key) do { } while (0) + +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index 79de1294f8ebd..eb4d04cb3aaf5 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -169,6 +169,21 @@ void __ptrace_unlink(struct task_struct *child) + spin_unlock(&child->sighand->siglock); + } + ++static bool looks_like_a_spurious_pid(struct task_struct *task) ++{ ++ if (task->exit_code != ((PTRACE_EVENT_EXEC << 8) | SIGTRAP)) ++ return false; ++ ++ if (task_pid_vnr(task) == task->ptrace_message) ++ return false; ++ /* ++ * The tracee changed its pid but the PTRACE_EVENT_EXEC event ++ * was not wait()'ed, most probably debugger targets the old ++ * leader which was destroyed in de_thread(). ++ */ ++ return true; ++} ++ + /* Ensure that nothing can wake it up, even SIGKILL */ + static bool ptrace_freeze_traced(struct task_struct *task) + { +@@ -179,7 +194,8 @@ static bool ptrace_freeze_traced(struct task_struct *task) + return ret; + + spin_lock_irq(&task->sighand->siglock); +- if (task_is_traced(task) && !__fatal_signal_pending(task)) { ++ if (task_is_traced(task) && !looks_like_a_spurious_pid(task) && ++ !__fatal_signal_pending(task)) { + task->state = __TASK_TRACED; + ret = true; + } +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index e693fee08623c..82e76ff01267a 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -426,6 +426,20 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, + break; + } + ++ /* Only BR/EDR modes are supported here */ ++ switch (chan->mode) { ++ case L2CAP_MODE_BASIC: ++ case L2CAP_MODE_ERTM: ++ case L2CAP_MODE_STREAMING: ++ break; ++ default: ++ err = -EINVAL; ++ break; ++ } ++ ++ if (err < 0) ++ break; ++ + memset(&opts, 0, sizeof(opts)); + opts.imtu = chan->imtu; + opts.omtu = chan->omtu; +@@ -685,10 +699,8 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, + break; + } + +- chan->mode = opts.mode; +- switch (chan->mode) { +- case L2CAP_MODE_LE_FLOWCTL: +- break; ++ /* Only BR/EDR modes are supported here */ ++ switch (opts.mode) { + case L2CAP_MODE_BASIC: + clear_bit(CONF_STATE2_DEVICE, &chan->conf_state); + break; +@@ -702,6 +714,10 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, + break; + } + ++ if (err < 0) ++ break; ++ ++ chan->mode = opts.mode; + chan->imtu = opts.imtu; + chan->omtu = opts.omtu; + chan->fcs = opts.fcs; +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index 26e8cfad22b8e..4d5ba9778885d 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2685,6 +2685,15 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) + if (skb->len < sizeof(*key)) + return SMP_INVALID_PARAMS; + ++ /* Check if remote and local public keys are the same and debug key is ++ * not in use. ++ */ ++ if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && ++ !crypto_memneq(key, smp->local_pk, 64)) { ++ bt_dev_err(hdev, "Remote and local public keys are identical"); ++ return SMP_UNSPECIFIED; ++ } ++ + memcpy(smp->remote_pk, key, 64); + + if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index b0a904cdb932d..e6b4ca469b2aa 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -38,7 +38,7 @@ config SND_OXFW + * Mackie(Loud) Onyx 1640i (former model) + * Mackie(Loud) Onyx Satellite + * Mackie(Loud) Tapco Link.Firewire +- * Mackie(Loud) d.2 pro/d.4 pro ++ * Mackie(Loud) d.4 pro + * Mackie(Loud) U.420/U.420d + * TASCAM FireOne + * Stanton Controllers & Systems 1 Deck/Mixer +@@ -84,7 +84,7 @@ config SND_BEBOB + * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 + * BridgeCo RDAudio1/Audio5 + * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) +- * Mackie d.2 (FireWire Option) ++ * Mackie d.2 (FireWire Option) and d.2 Pro + * Stanton FinalScratch 2 (ScratchAmp) + * Tascam IF-FW/DM + * Behringer XENIX UFX 1204/1604 +diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c +index e50e28f77e74e..07e58dcad4afc 100644 +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -617,18 +617,24 @@ static int parse_ir_ctx_header(struct amdtp_stream *s, unsigned int cycle, + unsigned int *syt, unsigned int index) + { + const __be32 *cip_header; ++ unsigned int cip_header_size; + int err; + + *payload_length = be32_to_cpu(ctx_header[0]) >> ISO_DATA_LENGTH_SHIFT; +- if (*payload_length > s->ctx_data.tx.ctx_header_size + +- s->ctx_data.tx.max_ctx_payload_length) { ++ ++ if (!(s->flags & CIP_NO_HEADER)) ++ cip_header_size = 8; ++ else ++ cip_header_size = 0; ++ ++ if (*payload_length > cip_header_size + s->ctx_data.tx.max_ctx_payload_length) { + dev_err(&s->unit->device, + "Detect jumbo payload: %04x %04x\n", +- *payload_length, s->ctx_data.tx.max_ctx_payload_length); ++ *payload_length, cip_header_size + s->ctx_data.tx.max_ctx_payload_length); + return -EIO; + } + +- if (!(s->flags & CIP_NO_HEADER)) { ++ if (cip_header_size > 0) { + cip_header = ctx_header + 2; + err = check_cip_header(s, cip_header, *payload_length, + data_blocks, data_block_counter, syt); +@@ -932,23 +938,22 @@ static int amdtp_stream_start(struct amdtp_stream *s, int channel, int speed) + s->ctx_data.rx.last_syt_offset = TICKS_PER_CYCLE; + } + +- /* initialize packet buffer */ ++ // initialize packet buffer. ++ max_ctx_payload_size = amdtp_stream_get_max_payload(s); + if (s->direction == AMDTP_IN_STREAM) { + dir = DMA_FROM_DEVICE; + type = FW_ISO_CONTEXT_RECEIVE; +- if (!(s->flags & CIP_NO_HEADER)) ++ if (!(s->flags & CIP_NO_HEADER)) { ++ max_ctx_payload_size -= 8; + ctx_header_size = IR_CTX_HEADER_SIZE_CIP; +- else ++ } else { + ctx_header_size = IR_CTX_HEADER_SIZE_NO_CIP; +- +- max_ctx_payload_size = amdtp_stream_get_max_payload(s) - +- ctx_header_size; ++ } + } else { + dir = DMA_TO_DEVICE; + type = FW_ISO_CONTEXT_TRANSMIT; + ctx_header_size = 0; // No effect for IT context. + +- max_ctx_payload_size = amdtp_stream_get_max_payload(s); + if (!(s->flags & CIP_NO_HEADER)) + max_ctx_payload_size -= IT_PKT_HEADER_SIZE_CIP; + } +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index 976d8cb9a34f0..441c58283b47e 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -387,7 +387,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { + SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), + /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ + SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), +- /* Mackie, d.2 (Firewire Option) */ ++ // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). + SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), + /* Stanton, ScratchAmp */ + SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), +diff --git a/sound/firewire/dice/dice-alesis.c b/sound/firewire/dice/dice-alesis.c +index f5b325263b674..39a4ef8c85430 100644 +--- a/sound/firewire/dice/dice-alesis.c ++++ b/sound/firewire/dice/dice-alesis.c +@@ -16,7 +16,7 @@ alesis_io14_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = { + static const unsigned int + alesis_io26_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = { + {10, 10, 4}, /* Tx0 = Analog + S/PDIF. */ +- {16, 8, 0}, /* Tx1 = ADAT1 + ADAT2. */ ++ {16, 4, 0}, /* Tx1 = ADAT1 + ADAT2 (available at low rate). */ + }; + + int snd_dice_detect_alesis_formats(struct snd_dice *dice) +diff --git a/sound/firewire/dice/dice-tcelectronic.c b/sound/firewire/dice/dice-tcelectronic.c +index a8875d24ba2aa..43a3bcb15b3d1 100644 +--- a/sound/firewire/dice/dice-tcelectronic.c ++++ b/sound/firewire/dice/dice-tcelectronic.c +@@ -38,8 +38,8 @@ static const struct dice_tc_spec konnekt_24d = { + }; + + static const struct dice_tc_spec konnekt_live = { +- .tx_pcm_chs = {{16, 16, 16}, {0, 0, 0} }, +- .rx_pcm_chs = {{16, 16, 16}, {0, 0, 0} }, ++ .tx_pcm_chs = {{16, 16, 6}, {0, 0, 0} }, ++ .rx_pcm_chs = {{16, 16, 6}, {0, 0, 0} }, + .has_midi = true, + }; + +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index fb6df3fc018ed..6184a7c8f2b34 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -350,7 +350,6 @@ static const struct ieee1394_device_id oxfw_id_table[] = { + * Onyx-i series (former models): 0x081216 + * Mackie Onyx Satellite: 0x00200f + * Tapco LINK.firewire 4x6: 0x000460 +- * d.2 pro: Unknown + * d.4 pro: Unknown + * U.420: Unknown + * U.420d: Unknown +diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c +index d67eae3988bd7..6f1fc87896765 100644 +--- a/sound/isa/sb/sb8.c ++++ b/sound/isa/sb/sb8.c +@@ -96,10 +96,6 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) + + /* block the 0x388 port to avoid PnP conflicts */ + acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); +- if (!acard->fm_res) { +- err = -EBUSY; +- goto _err; +- } + + if (port[dev] != SNDRV_AUTO_PORT) { + if ((err = snd_sbdsp_create(card, port[dev], irq[dev], +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b7297a22438af..d02c49e1686b6 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -385,7 +385,6 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0282: + case 0x10ec0283: + case 0x10ec0286: +- case 0x10ec0287: + case 0x10ec0288: + case 0x10ec0285: + case 0x10ec0298: +@@ -396,6 +395,10 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0275: + alc_update_coef_idx(codec, 0xe, 0, 1<<0); + break; ++ case 0x10ec0287: ++ alc_update_coef_idx(codec, 0x10, 1<<9, 0); ++ alc_write_coef_idx(codec, 0x8, 0x4ab7); ++ break; + case 0x10ec0293: + alc_update_coef_idx(codec, 0xa, 1<<13, 0); + break; +@@ -5605,6 +5608,18 @@ static void alc_fixup_tpt470_dacs(struct hda_codec *codec, + spec->gen.preferred_dacs = preferred_pairs; + } + ++static void alc295_fixup_asus_dacs(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ static const hda_nid_t preferred_pairs[] = { ++ 0x17, 0x02, 0x21, 0x03, 0 ++ }; ++ struct alc_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) ++ spec->gen.preferred_dacs = preferred_pairs; ++} ++ + static void alc_shutup_dell_xps13(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -6120,6 +6135,35 @@ static void alc294_fixup_gx502_hp(struct hda_codec *codec, + } + } + ++static void alc294_gu502_toggle_output(struct hda_codec *codec, ++ struct hda_jack_callback *cb) ++{ ++ /* Windows sets 0x10 to 0x8420 for Node 0x20 which is ++ * responsible from changes between speakers and headphones ++ */ ++ if (snd_hda_jack_detect_state(codec, 0x21) == HDA_JACK_PRESENT) ++ alc_write_coef_idx(codec, 0x10, 0x8420); ++ else ++ alc_write_coef_idx(codec, 0x10, 0x0a20); ++} ++ ++static void alc294_fixup_gu502_hp(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (!is_jack_detectable(codec, 0x21)) ++ return; ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ snd_hda_jack_detect_enable_callback(codec, 0x21, ++ alc294_gu502_toggle_output); ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ alc294_gu502_toggle_output(codec, NULL); ++ break; ++ } ++} ++ + static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -6316,6 +6360,9 @@ enum { + ALC294_FIXUP_ASUS_GX502_HP, + ALC294_FIXUP_ASUS_GX502_PINS, + ALC294_FIXUP_ASUS_GX502_VERBS, ++ ALC294_FIXUP_ASUS_GU502_HP, ++ ALC294_FIXUP_ASUS_GU502_PINS, ++ ALC294_FIXUP_ASUS_GU502_VERBS, + ALC285_FIXUP_HP_GPIO_LED, + ALC285_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_MUTE_LED, +@@ -6342,6 +6389,9 @@ enum { + ALC274_FIXUP_HP_HEADSET_MIC, + ALC256_FIXUP_ASUS_HPE, + ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK, ++ ALC295_FIXUP_ASUS_DACS, ++ ALC295_FIXUP_HP_OMEN, ++ ALC285_FIXUP_HP_SPECTRE_X360, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7540,6 +7590,35 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc294_fixup_gx502_hp, + }, ++ [ALC294_FIXUP_ASUS_GU502_PINS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a11050 }, /* rear HP mic */ ++ { 0x1a, 0x01a11830 }, /* rear external mic */ ++ { 0x21, 0x012110f0 }, /* rear HP out */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GU502_VERBS ++ }, ++ [ALC294_FIXUP_ASUS_GU502_VERBS] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* set 0x15 to HP-OUT ctrl */ ++ { 0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, 0xc0 }, ++ /* unmute the 0x15 amp */ ++ { 0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0xb000 }, ++ /* set 0x1b to HP-OUT */ ++ { 0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GU502_HP ++ }, ++ [ALC294_FIXUP_ASUS_GU502_HP] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc294_fixup_gu502_hp, ++ }, + [ALC294_FIXUP_ASUS_COEF_1B] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -7778,6 +7857,39 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269_FIXUP_THINKPAD_ACPI + }, ++ [ALC295_FIXUP_ASUS_DACS] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc295_fixup_asus_dacs, ++ }, ++ [ALC295_FIXUP_HP_OMEN] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x12, 0xb7a60130 }, ++ { 0x13, 0x40000000 }, ++ { 0x14, 0x411111f0 }, ++ { 0x16, 0x411111f0 }, ++ { 0x17, 0x90170110 }, ++ { 0x18, 0x411111f0 }, ++ { 0x19, 0x02a11030 }, ++ { 0x1a, 0x411111f0 }, ++ { 0x1b, 0x04a19030 }, ++ { 0x1d, 0x40600001 }, ++ { 0x1e, 0x411111f0 }, ++ { 0x21, 0x03211020 }, ++ {} ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HP_LINE1_MIC1_LED, ++ }, ++ [ALC285_FIXUP_HP_SPECTRE_X360] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x14, 0x90170110 }, /* enable top speaker */ ++ {} ++ }, ++ .chained = true, ++ .chain_id = ALC285_FIXUP_SPEAKER2_TO_DAC1, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7928,7 +8040,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), ++ SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN), + SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), ++ SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), + SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED), +@@ -7954,6 +8068,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), ++ SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS), + SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS), + SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), +@@ -7971,6 +8086,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), ++ SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), +@@ -8027,12 +8143,19 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x50b8, "Clevo NK50SZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50d5, "Clevo NP50D5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50f0, "Clevo NH50A[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f2, "Clevo NH50E[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50f3, "Clevo NH58DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f5, "Clevo NH55EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f6, "Clevo NH55DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f3, "Clevo NH77DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f4, "Clevo NH77EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f6, "Clevo NH77DPQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8228, "Clevo NR40BU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8520, "Clevo NH50D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +@@ -8050,9 +8173,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x8a51, "Clevo NH70RCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8d50, "Clevo NH55RCQ-M", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x951d, "Clevo N950T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x9600, "Clevo N960K[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x961d, "Clevo N960S[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL53RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL5XNU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc022, "Clevo NH77[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS), + SND_PCI_QUIRK(0x17aa, 0x1048, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), +@@ -8315,6 +8446,8 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, + {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, + {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"}, ++ {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, ++ {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, + {} + }; + #define ALC225_STANDARD_PINS \ +diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c +index 6ff94d8ad86e5..2a73fc4fd019f 100644 +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -354,6 +354,7 @@ struct ichdev { + unsigned int ali_slot; /* ALI DMA slot */ + struct ac97_pcm *pcm; + int pcm_open_flag; ++ unsigned int prepared:1; + unsigned int suspended: 1; + }; + +@@ -714,6 +715,9 @@ static inline void snd_intel8x0_update(struct intel8x0 *chip, struct ichdev *ich + int status, civ, i, step; + int ack = 0; + ++ if (!ichdev->prepared || ichdev->suspended) ++ return; ++ + spin_lock_irqsave(&chip->reg_lock, flags); + status = igetbyte(chip, port + ichdev->roff_sr); + civ = igetbyte(chip, port + ICH_REG_OFF_CIV); +@@ -907,6 +911,7 @@ static int snd_intel8x0_hw_params(struct snd_pcm_substream *substream, + if (ichdev->pcm_open_flag) { + snd_ac97_pcm_close(ichdev->pcm); + ichdev->pcm_open_flag = 0; ++ ichdev->prepared = 0; + } + err = snd_ac97_pcm_open(ichdev->pcm, params_rate(hw_params), + params_channels(hw_params), +@@ -928,6 +933,7 @@ static int snd_intel8x0_hw_free(struct snd_pcm_substream *substream) + if (ichdev->pcm_open_flag) { + snd_ac97_pcm_close(ichdev->pcm); + ichdev->pcm_open_flag = 0; ++ ichdev->prepared = 0; + } + return snd_pcm_lib_free_pages(substream); + } +@@ -1002,6 +1008,7 @@ static int snd_intel8x0_pcm_prepare(struct snd_pcm_substream *substream) + ichdev->pos_shift = (runtime->sample_bits > 16) ? 2 : 1; + } + snd_intel8x0_setup_periods(chip, ichdev); ++ ichdev->prepared = 1; + return 0; + } + +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index 0caf53f5764cb..1e38cdda2af69 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -690,6 +690,10 @@ static int line6_init_cap_control(struct usb_line6 *line6) + line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); + if (!line6->buffer_message) + return -ENOMEM; ++ ++ ret = line6_init_midi(line6); ++ if (ret < 0) ++ return ret; + } else { + ret = line6_hwdep_init(line6); + if (ret < 0) +diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c +index ee4c9d220fdf7..b667bb8ad938a 100644 +--- a/sound/usb/line6/pod.c ++++ b/sound/usb/line6/pod.c +@@ -376,11 +376,6 @@ static int pod_init(struct usb_line6 *line6, + if (err < 0) + return err; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(line6); +- if (err < 0) +- return err; +- + /* initialize PCM subsystem: */ + err = line6_init_pcm(line6, &pod_pcm_properties); + if (err < 0) +diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c +index ed158f04de80f..c2245aa93b08f 100644 +--- a/sound/usb/line6/variax.c ++++ b/sound/usb/line6/variax.c +@@ -159,7 +159,6 @@ static int variax_init(struct usb_line6 *line6, + const struct usb_device_id *id) + { + struct usb_line6_variax *variax = line6_to_variax(line6); +- int err; + + line6->process_message = line6_variax_process_message; + line6->disconnect = line6_variax_disconnect; +@@ -172,11 +171,6 @@ static int variax_init(struct usb_line6 *line6, + if (variax->buffer_activate == NULL) + return -ENOMEM; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(&variax->line6); +- if (err < 0) +- return err; +- + /* initiate startup procedure: */ + schedule_delayed_work(&line6->startup_work, + msecs_to_jiffies(VARIAX_STARTUP_DELAY1)); +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index c205a26ef5092..33e9a7f6246f7 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1889,8 +1889,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi, + ms_ep = find_usb_ms_endpoint_descriptor(hostep); + if (!ms_ep) + continue; ++ if (ms_ep->bLength <= sizeof(*ms_ep)) ++ continue; + if (ms_ep->bNumEmbMIDIJack > 0x10) + continue; ++ if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack) ++ continue; + if (usb_endpoint_dir_out(ep)) { + if (endpoints[epidx].out_ep) { + if (++epidx >= MIDI_MAX_ENDPOINTS) { diff --git a/patch/kernel/archive/sunxi-5.10/patch-5.10.39-40.patch b/patch/kernel/archive/sunxi-5.10/patch-5.10.39-40.patch new file mode 100644 index 0000000000..05aa3e0a2c --- /dev/null +++ b/patch/kernel/archive/sunxi-5.10/patch-5.10.39-40.patch @@ -0,0 +1,3700 @@ +diff --git a/Documentation/powerpc/syscall64-abi.rst b/Documentation/powerpc/syscall64-abi.rst +index cf9b2857c72aa..d8242049bdcb5 100644 +--- a/Documentation/powerpc/syscall64-abi.rst ++++ b/Documentation/powerpc/syscall64-abi.rst +@@ -96,6 +96,16 @@ auxiliary vector. + + scv 0 syscalls will always behave as PPC_FEATURE2_HTM_NOSC. + ++ptrace ++------ ++When ptracing system calls (PTRACE_SYSCALL), the pt_regs.trap value contains ++the system call type that can be used to distinguish between sc and scv 0 ++system calls, and the different register conventions can be accounted for. ++ ++If the value of (pt_regs.trap & 0xfff0) is 0xc00 then the system call was ++performed with the sc instruction, if it is 0x3000 then the system call was ++performed with the scv 0 instruction. ++ + vsyscall + ======== + +diff --git a/Makefile b/Makefile +index 38b703568da45..42c915ccc5b80 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 39 ++SUBLEVEL = 40 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/openrisc/kernel/setup.c b/arch/openrisc/kernel/setup.c +index 2416a9f915330..c6f9e7b9f7cb2 100644 +--- a/arch/openrisc/kernel/setup.c ++++ b/arch/openrisc/kernel/setup.c +@@ -278,6 +278,8 @@ void calibrate_delay(void) + pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n", + loops_per_jiffy / (500000 / HZ), + (loops_per_jiffy / (5000 / HZ)) % 100, loops_per_jiffy); ++ ++ of_node_put(cpu); + } + + void __init setup_arch(char **cmdline_p) +diff --git a/arch/openrisc/mm/init.c b/arch/openrisc/mm/init.c +index 8348feaaf46e5..5e88c351e6a45 100644 +--- a/arch/openrisc/mm/init.c ++++ b/arch/openrisc/mm/init.c +@@ -76,7 +76,6 @@ static void __init map_ram(void) + /* These mark extents of read-only kernel pages... + * ...from vmlinux.lds.S + */ +- struct memblock_region *region; + + v = PAGE_OFFSET; + +@@ -122,7 +121,7 @@ static void __init map_ram(void) + } + + printk(KERN_INFO "%s: Memory: 0x%x-0x%x\n", __func__, +- region->base, region->base + region->size); ++ start, end); + } + } + +diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h +index c1fbccb043903..3e8e19f5746c7 100644 +--- a/arch/powerpc/include/asm/hvcall.h ++++ b/arch/powerpc/include/asm/hvcall.h +@@ -437,6 +437,9 @@ + */ + long plpar_hcall_norets(unsigned long opcode, ...); + ++/* Variant which does not do hcall tracing */ ++long plpar_hcall_norets_notrace(unsigned long opcode, ...); ++ + /** + * plpar_hcall: - Make a pseries hypervisor call + * @opcode: The hypervisor call to make. +diff --git a/arch/powerpc/include/asm/paravirt.h b/arch/powerpc/include/asm/paravirt.h +index 9362c94fe3aa0..588bfb9a0579c 100644 +--- a/arch/powerpc/include/asm/paravirt.h ++++ b/arch/powerpc/include/asm/paravirt.h +@@ -24,19 +24,35 @@ static inline u32 yield_count_of(int cpu) + return be32_to_cpu(yield_count); + } + ++/* ++ * Spinlock code confers and prods, so don't trace the hcalls because the ++ * tracing code takes spinlocks which can cause recursion deadlocks. ++ * ++ * These calls are made while the lock is not held: the lock slowpath yields if ++ * it can not acquire the lock, and unlock slow path might prod if a waiter has ++ * yielded). So this may not be a problem for simple spin locks because the ++ * tracing does not technically recurse on the lock, but we avoid it anyway. ++ * ++ * However the queued spin lock contended path is more strictly ordered: the ++ * H_CONFER hcall is made after the task has queued itself on the lock, so then ++ * recursing on that lock will cause the task to then queue up again behind the ++ * first instance (or worse: queued spinlocks use tricks that assume a context ++ * never waits on more than one spinlock, so such recursion may cause random ++ * corruption in the lock code). ++ */ + static inline void yield_to_preempted(int cpu, u32 yield_count) + { +- plpar_hcall_norets(H_CONFER, get_hard_smp_processor_id(cpu), yield_count); ++ plpar_hcall_norets_notrace(H_CONFER, get_hard_smp_processor_id(cpu), yield_count); + } + + static inline void prod_cpu(int cpu) + { +- plpar_hcall_norets(H_PROD, get_hard_smp_processor_id(cpu)); ++ plpar_hcall_norets_notrace(H_PROD, get_hard_smp_processor_id(cpu)); + } + + static inline void yield_to_any(void) + { +- plpar_hcall_norets(H_CONFER, -1, 0); ++ plpar_hcall_norets_notrace(H_CONFER, -1, 0); + } + #else + static inline bool is_shared_processor(void) +diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h +index d6f262df4f346..a7e7688f57eca 100644 +--- a/arch/powerpc/include/asm/ptrace.h ++++ b/arch/powerpc/include/asm/ptrace.h +@@ -19,6 +19,7 @@ + #ifndef _ASM_POWERPC_PTRACE_H + #define _ASM_POWERPC_PTRACE_H + ++#include + #include + #include + +@@ -144,25 +145,6 @@ extern unsigned long profile_pc(struct pt_regs *regs); + long do_syscall_trace_enter(struct pt_regs *regs); + void do_syscall_trace_leave(struct pt_regs *regs); + +-#define kernel_stack_pointer(regs) ((regs)->gpr[1]) +-static inline int is_syscall_success(struct pt_regs *regs) +-{ +- return !(regs->ccr & 0x10000000); +-} +- +-static inline long regs_return_value(struct pt_regs *regs) +-{ +- if (is_syscall_success(regs)) +- return regs->gpr[3]; +- else +- return -regs->gpr[3]; +-} +- +-static inline void regs_set_return_value(struct pt_regs *regs, unsigned long rc) +-{ +- regs->gpr[3] = rc; +-} +- + #ifdef __powerpc64__ + #define user_mode(regs) ((((regs)->msr) >> MSR_PR_LG) & 0x1) + #else +@@ -245,6 +227,31 @@ static inline void set_trap_norestart(struct pt_regs *regs) + regs->trap |= 0x10; + } + ++#define kernel_stack_pointer(regs) ((regs)->gpr[1]) ++static inline int is_syscall_success(struct pt_regs *regs) ++{ ++ if (trap_is_scv(regs)) ++ return !IS_ERR_VALUE((unsigned long)regs->gpr[3]); ++ else ++ return !(regs->ccr & 0x10000000); ++} ++ ++static inline long regs_return_value(struct pt_regs *regs) ++{ ++ if (trap_is_scv(regs)) ++ return regs->gpr[3]; ++ ++ if (is_syscall_success(regs)) ++ return regs->gpr[3]; ++ else ++ return -regs->gpr[3]; ++} ++ ++static inline void regs_set_return_value(struct pt_regs *regs, unsigned long rc) ++{ ++ regs->gpr[3] = rc; ++} ++ + #define arch_has_single_step() (1) + #define arch_has_block_step() (true) + #define ARCH_HAS_USER_SINGLE_STEP_REPORT +diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h +index fd1b518eed17c..ba0f88f3a30da 100644 +--- a/arch/powerpc/include/asm/syscall.h ++++ b/arch/powerpc/include/asm/syscall.h +@@ -41,11 +41,17 @@ static inline void syscall_rollback(struct task_struct *task, + static inline long syscall_get_error(struct task_struct *task, + struct pt_regs *regs) + { +- /* +- * If the system call failed, +- * regs->gpr[3] contains a positive ERRORCODE. +- */ +- return (regs->ccr & 0x10000000UL) ? -regs->gpr[3] : 0; ++ if (trap_is_scv(regs)) { ++ unsigned long error = regs->gpr[3]; ++ ++ return IS_ERR_VALUE(error) ? error : 0; ++ } else { ++ /* ++ * If the system call failed, ++ * regs->gpr[3] contains a positive ERRORCODE. ++ */ ++ return (regs->ccr & 0x10000000UL) ? -regs->gpr[3] : 0; ++ } + } + + static inline long syscall_get_return_value(struct task_struct *task, +@@ -58,18 +64,22 @@ static inline void syscall_set_return_value(struct task_struct *task, + struct pt_regs *regs, + int error, long val) + { +- /* +- * In the general case it's not obvious that we must deal with CCR +- * here, as the syscall exit path will also do that for us. However +- * there are some places, eg. the signal code, which check ccr to +- * decide if the value in r3 is actually an error. +- */ +- if (error) { +- regs->ccr |= 0x10000000L; +- regs->gpr[3] = error; ++ if (trap_is_scv(regs)) { ++ regs->gpr[3] = (long) error ?: val; + } else { +- regs->ccr &= ~0x10000000L; +- regs->gpr[3] = val; ++ /* ++ * In the general case it's not obvious that we must deal with ++ * CCR here, as the syscall exit path will also do that for us. ++ * However there are some places, eg. the signal code, which ++ * check ccr to decide if the value in r3 is actually an error. ++ */ ++ if (error) { ++ regs->ccr |= 0x10000000L; ++ regs->gpr[3] = error; ++ } else { ++ regs->ccr &= ~0x10000000L; ++ regs->gpr[3] = val; ++ } + } + } + +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index 3b871ecb3a921..3f8426bccd168 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -368,11 +368,11 @@ void __init early_setup(unsigned long dt_ptr) + apply_feature_fixups(); + setup_feature_keys(); + +- early_ioremap_setup(); +- + /* Initialize the hash table or TLB handling */ + early_init_mmu(); + ++ early_ioremap_setup(); ++ + /* + * After firmware and early platform setup code has set things up, + * we note the SPR values for configurable control/performance +diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S +index 2136e42833af3..8a2b8d64265bc 100644 +--- a/arch/powerpc/platforms/pseries/hvCall.S ++++ b/arch/powerpc/platforms/pseries/hvCall.S +@@ -102,6 +102,16 @@ END_FTR_SECTION(0, 1); \ + #define HCALL_BRANCH(LABEL) + #endif + ++_GLOBAL_TOC(plpar_hcall_norets_notrace) ++ HMT_MEDIUM ++ ++ mfcr r0 ++ stw r0,8(r1) ++ HVSC /* invoke the hypervisor */ ++ lwz r0,8(r1) ++ mtcrf 0xff,r0 ++ blr /* return r3 = status */ ++ + _GLOBAL_TOC(plpar_hcall_norets) + HMT_MEDIUM + +diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c +index 764170fdb0f74..1c3ac0f663369 100644 +--- a/arch/powerpc/platforms/pseries/lpar.c ++++ b/arch/powerpc/platforms/pseries/lpar.c +@@ -1827,8 +1827,7 @@ void hcall_tracepoint_unregfunc(void) + + /* + * Since the tracing code might execute hcalls we need to guard against +- * recursion. One example of this are spinlocks calling H_YIELD on +- * shared processor partitions. ++ * recursion. + */ + static DEFINE_PER_CPU(unsigned int, hcall_trace_depth); + +diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S +index 017de6cc87dc6..72f655c238cf1 100644 +--- a/arch/x86/boot/compressed/head_64.S ++++ b/arch/x86/boot/compressed/head_64.S +@@ -172,11 +172,21 @@ SYM_FUNC_START(startup_32) + */ + call get_sev_encryption_bit + xorl %edx, %edx ++#ifdef CONFIG_AMD_MEM_ENCRYPT + testl %eax, %eax + jz 1f + subl $32, %eax /* Encryption bit is always above bit 31 */ + bts %eax, %edx /* Set encryption mask for page tables */ ++ /* ++ * Mark SEV as active in sev_status so that startup32_check_sev_cbit() ++ * will do a check. The sev_status memory will be fully initialized ++ * with the contents of MSR_AMD_SEV_STATUS later in ++ * set_sev_encryption_mask(). For now it is sufficient to know that SEV ++ * is active. ++ */ ++ movl $1, rva(sev_status)(%ebp) + 1: ++#endif + + /* Initialize Page tables to 0 */ + leal rva(pgtable)(%ebx), %edi +@@ -261,6 +271,9 @@ SYM_FUNC_START(startup_32) + movl %esi, %edx + 1: + #endif ++ /* Check if the C-bit position is correct when SEV is active */ ++ call startup32_check_sev_cbit ++ + pushl $__KERNEL_CS + pushl %eax + +@@ -786,6 +799,78 @@ SYM_DATA_START_LOCAL(loaded_image_proto) + SYM_DATA_END(loaded_image_proto) + #endif + ++/* ++ * Check for the correct C-bit position when the startup_32 boot-path is used. ++ * ++ * The check makes use of the fact that all memory is encrypted when paging is ++ * disabled. The function creates 64 bits of random data using the RDRAND ++ * instruction. RDRAND is mandatory for SEV guests, so always available. If the ++ * hypervisor violates that the kernel will crash right here. ++ * ++ * The 64 bits of random data are stored to a memory location and at the same ++ * time kept in the %eax and %ebx registers. Since encryption is always active ++ * when paging is off the random data will be stored encrypted in main memory. ++ * ++ * Then paging is enabled. When the C-bit position is correct all memory is ++ * still mapped encrypted and comparing the register values with memory will ++ * succeed. An incorrect C-bit position will map all memory unencrypted, so that ++ * the compare will use the encrypted random data and fail. ++ */ ++ __HEAD ++ .code32 ++SYM_FUNC_START(startup32_check_sev_cbit) ++#ifdef CONFIG_AMD_MEM_ENCRYPT ++ pushl %eax ++ pushl %ebx ++ pushl %ecx ++ pushl %edx ++ ++ /* Check for non-zero sev_status */ ++ movl rva(sev_status)(%ebp), %eax ++ testl %eax, %eax ++ jz 4f ++ ++ /* ++ * Get two 32-bit random values - Don't bail out if RDRAND fails ++ * because it is better to prevent forward progress if no random value ++ * can be gathered. ++ */ ++1: rdrand %eax ++ jnc 1b ++2: rdrand %ebx ++ jnc 2b ++ ++ /* Store to memory and keep it in the registers */ ++ movl %eax, rva(sev_check_data)(%ebp) ++ movl %ebx, rva(sev_check_data+4)(%ebp) ++ ++ /* Enable paging to see if encryption is active */ ++ movl %cr0, %edx /* Backup %cr0 in %edx */ ++ movl $(X86_CR0_PG | X86_CR0_PE), %ecx /* Enable Paging and Protected mode */ ++ movl %ecx, %cr0 ++ ++ cmpl %eax, rva(sev_check_data)(%ebp) ++ jne 3f ++ cmpl %ebx, rva(sev_check_data+4)(%ebp) ++ jne 3f ++ ++ movl %edx, %cr0 /* Restore previous %cr0 */ ++ ++ jmp 4f ++ ++3: /* Check failed - hlt the machine */ ++ hlt ++ jmp 3b ++ ++4: ++ popl %edx ++ popl %ecx ++ popl %ebx ++ popl %eax ++#endif ++ ret ++SYM_FUNC_END(startup32_check_sev_cbit) ++ + /* + * Stack and heap for uncompression + */ +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 0b9975200ae35..ee659b5faf714 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -5563,7 +5563,7 @@ __init int intel_pmu_init(void) + * Check all LBT MSR here. + * Disable LBR access if any LBR MSRs can not be accessed. + */ +- if (x86_pmu.lbr_nr && !check_msr(x86_pmu.lbr_tos, 0x3UL)) ++ if (x86_pmu.lbr_tos && !check_msr(x86_pmu.lbr_tos, 0x3UL)) + x86_pmu.lbr_nr = 0; + for (i = 0; i < x86_pmu.lbr_nr; i++) { + if (!(check_msr(x86_pmu.lbr_from + i, 0xffffUL) && +diff --git a/arch/x86/kernel/sev-es-shared.c b/arch/x86/kernel/sev-es-shared.c +index 387b716698187..ecb20b17b7df6 100644 +--- a/arch/x86/kernel/sev-es-shared.c ++++ b/arch/x86/kernel/sev-es-shared.c +@@ -63,6 +63,7 @@ static bool sev_es_negotiate_protocol(void) + + static __always_inline void vc_ghcb_invalidate(struct ghcb *ghcb) + { ++ ghcb->save.sw_exit_code = 0; + memset(ghcb->save.valid_bitmap, 0, sizeof(ghcb->save.valid_bitmap)); + } + +diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c +index 04a780abb512d..e0cdab7cb632b 100644 +--- a/arch/x86/kernel/sev-es.c ++++ b/arch/x86/kernel/sev-es.c +@@ -191,8 +191,18 @@ static __always_inline struct ghcb *sev_es_get_ghcb(struct ghcb_state *state) + if (unlikely(data->ghcb_active)) { + /* GHCB is already in use - save its contents */ + +- if (unlikely(data->backup_ghcb_active)) +- return NULL; ++ if (unlikely(data->backup_ghcb_active)) { ++ /* ++ * Backup-GHCB is also already in use. There is no way ++ * to continue here so just kill the machine. To make ++ * panic() work, mark GHCBs inactive so that messages ++ * can be printed out. ++ */ ++ data->ghcb_active = false; ++ data->backup_ghcb_active = false; ++ ++ panic("Unable to handle #VC exception! GHCB and Backup GHCB are already in use"); ++ } + + /* Mark backup_ghcb active before writing to it */ + data->backup_ghcb_active = true; +@@ -209,24 +219,6 @@ static __always_inline struct ghcb *sev_es_get_ghcb(struct ghcb_state *state) + return ghcb; + } + +-static __always_inline void sev_es_put_ghcb(struct ghcb_state *state) +-{ +- struct sev_es_runtime_data *data; +- struct ghcb *ghcb; +- +- data = this_cpu_read(runtime_data); +- ghcb = &data->ghcb_page; +- +- if (state->ghcb) { +- /* Restore GHCB from Backup */ +- *ghcb = *state->ghcb; +- data->backup_ghcb_active = false; +- state->ghcb = NULL; +- } else { +- data->ghcb_active = false; +- } +-} +- + /* Needed in vc_early_forward_exception */ + void do_early_exception(struct pt_regs *regs, int trapnr); + +@@ -296,31 +288,44 @@ static enum es_result vc_write_mem(struct es_em_ctxt *ctxt, + u16 d2; + u8 d1; + +- /* If instruction ran in kernel mode and the I/O buffer is in kernel space */ +- if (!user_mode(ctxt->regs) && !access_ok(target, size)) { +- memcpy(dst, buf, size); +- return ES_OK; +- } +- ++ /* ++ * This function uses __put_user() independent of whether kernel or user ++ * memory is accessed. This works fine because __put_user() does no ++ * sanity checks of the pointer being accessed. All that it does is ++ * to report when the access failed. ++ * ++ * Also, this function runs in atomic context, so __put_user() is not ++ * allowed to sleep. The page-fault handler detects that it is running ++ * in atomic context and will not try to take mmap_sem and handle the ++ * fault, so additional pagefault_enable()/disable() calls are not ++ * needed. ++ * ++ * The access can't be done via copy_to_user() here because ++ * vc_write_mem() must not use string instructions to access unsafe ++ * memory. The reason is that MOVS is emulated by the #VC handler by ++ * splitting the move up into a read and a write and taking a nested #VC ++ * exception on whatever of them is the MMIO access. Using string ++ * instructions here would cause infinite nesting. ++ */ + switch (size) { + case 1: + memcpy(&d1, buf, 1); +- if (put_user(d1, target)) ++ if (__put_user(d1, target)) + goto fault; + break; + case 2: + memcpy(&d2, buf, 2); +- if (put_user(d2, target)) ++ if (__put_user(d2, target)) + goto fault; + break; + case 4: + memcpy(&d4, buf, 4); +- if (put_user(d4, target)) ++ if (__put_user(d4, target)) + goto fault; + break; + case 8: + memcpy(&d8, buf, 8); +- if (put_user(d8, target)) ++ if (__put_user(d8, target)) + goto fault; + break; + default: +@@ -351,30 +356,43 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt, + u16 d2; + u8 d1; + +- /* If instruction ran in kernel mode and the I/O buffer is in kernel space */ +- if (!user_mode(ctxt->regs) && !access_ok(s, size)) { +- memcpy(buf, src, size); +- return ES_OK; +- } +- ++ /* ++ * This function uses __get_user() independent of whether kernel or user ++ * memory is accessed. This works fine because __get_user() does no ++ * sanity checks of the pointer being accessed. All that it does is ++ * to report when the access failed. ++ * ++ * Also, this function runs in atomic context, so __get_user() is not ++ * allowed to sleep. The page-fault handler detects that it is running ++ * in atomic context and will not try to take mmap_sem and handle the ++ * fault, so additional pagefault_enable()/disable() calls are not ++ * needed. ++ * ++ * The access can't be done via copy_from_user() here because ++ * vc_read_mem() must not use string instructions to access unsafe ++ * memory. The reason is that MOVS is emulated by the #VC handler by ++ * splitting the move up into a read and a write and taking a nested #VC ++ * exception on whatever of them is the MMIO access. Using string ++ * instructions here would cause infinite nesting. ++ */ + switch (size) { + case 1: +- if (get_user(d1, s)) ++ if (__get_user(d1, s)) + goto fault; + memcpy(buf, &d1, 1); + break; + case 2: +- if (get_user(d2, s)) ++ if (__get_user(d2, s)) + goto fault; + memcpy(buf, &d2, 2); + break; + case 4: +- if (get_user(d4, s)) ++ if (__get_user(d4, s)) + goto fault; + memcpy(buf, &d4, 4); + break; + case 8: +- if (get_user(d8, s)) ++ if (__get_user(d8, s)) + goto fault; + memcpy(buf, &d8, 8); + break; +@@ -434,6 +452,29 @@ static enum es_result vc_slow_virt_to_phys(struct ghcb *ghcb, struct es_em_ctxt + /* Include code shared with pre-decompression boot stage */ + #include "sev-es-shared.c" + ++static __always_inline void sev_es_put_ghcb(struct ghcb_state *state) ++{ ++ struct sev_es_runtime_data *data; ++ struct ghcb *ghcb; ++ ++ data = this_cpu_read(runtime_data); ++ ghcb = &data->ghcb_page; ++ ++ if (state->ghcb) { ++ /* Restore GHCB from Backup */ ++ *ghcb = *state->ghcb; ++ data->backup_ghcb_active = false; ++ state->ghcb = NULL; ++ } else { ++ /* ++ * Invalidate the GHCB so a VMGEXIT instruction issued ++ * from userspace won't appear to be valid. ++ */ ++ vc_ghcb_invalidate(ghcb); ++ data->ghcb_active = false; ++ } ++} ++ + void noinstr __sev_es_nmi_complete(void) + { + struct ghcb_state state; +@@ -1228,6 +1269,10 @@ static __always_inline void vc_forward_exception(struct es_em_ctxt *ctxt) + case X86_TRAP_UD: + exc_invalid_op(ctxt->regs); + break; ++ case X86_TRAP_PF: ++ write_cr2(ctxt->fi.cr2); ++ exc_page_fault(ctxt->regs, error_code); ++ break; + case X86_TRAP_AC: + exc_alignment_check(ctxt->regs, error_code); + break; +@@ -1257,7 +1302,6 @@ static __always_inline bool on_vc_fallback_stack(struct pt_regs *regs) + */ + DEFINE_IDTENTRY_VC_SAFE_STACK(exc_vmm_communication) + { +- struct sev_es_runtime_data *data = this_cpu_read(runtime_data); + irqentry_state_t irq_state; + struct ghcb_state state; + struct es_em_ctxt ctxt; +@@ -1283,16 +1327,6 @@ DEFINE_IDTENTRY_VC_SAFE_STACK(exc_vmm_communication) + */ + + ghcb = sev_es_get_ghcb(&state); +- if (!ghcb) { +- /* +- * Mark GHCBs inactive so that panic() is able to print the +- * message. +- */ +- data->ghcb_active = false; +- data->backup_ghcb_active = false; +- +- panic("Unable to handle #VC exception! GHCB and Backup GHCB are already in use"); +- } + + vc_ghcb_invalidate(ghcb); + result = vc_init_em_ctxt(&ctxt, regs, error_code); +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 9a5a50cdaab59..8064df6382227 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -1262,16 +1262,16 @@ asmlinkage __visible void __init xen_start_kernel(void) + /* Get mfn list */ + xen_build_dynamic_phys_to_machine(); + ++ /* Work out if we support NX */ ++ get_cpu_cap(&boot_cpu_data); ++ x86_configure_nx(); ++ + /* + * Set up kernel GDT and segment registers, mainly so that + * -fstack-protector code can be executed. + */ + xen_setup_gdt(0); + +- /* Work out if we support NX */ +- get_cpu_cap(&boot_cpu_data); +- x86_configure_nx(); +- + /* Determine virtual and physical address sizes */ + get_cpu_address_sizes(&boot_cpu_data); + +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c +index 9874fc1c815b5..1831099306aa9 100644 +--- a/drivers/cdrom/gdrom.c ++++ b/drivers/cdrom/gdrom.c +@@ -743,6 +743,13 @@ static const struct blk_mq_ops gdrom_mq_ops = { + static int probe_gdrom(struct platform_device *devptr) + { + int err; ++ ++ /* ++ * Ensure our "one" device is initialized properly in case of previous ++ * usages of it ++ */ ++ memset(&gd, 0, sizeof(gd)); ++ + /* Start the device */ + if (gdrom_execute_diagnostic() != 1) { + pr_warn("ATA Probe for GDROM failed\n"); +@@ -831,6 +838,8 @@ static int remove_gdrom(struct platform_device *devptr) + if (gdrom_major) + unregister_blkdev(gdrom_major, GDROM_DEV_NAME); + unregister_cdrom(gd.cd_info); ++ kfree(gd.cd_info); ++ kfree(gd.toc); + + return 0; + } +@@ -846,7 +855,7 @@ static struct platform_driver gdrom_driver = { + static int __init init_gdrom(void) + { + int rc; +- gd.toc = NULL; ++ + rc = platform_driver_register(&gdrom_driver); + if (rc) + return rc; +@@ -862,8 +871,6 @@ static void __exit exit_gdrom(void) + { + platform_device_unregister(pd); + platform_driver_unregister(&gdrom_driver); +- kfree(gd.toc); +- kfree(gd.cd_info); + } + + module_init(init_gdrom); +diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c +index d0dee37ad5228..4ceba5ef78958 100644 +--- a/drivers/firmware/arm_scpi.c ++++ b/drivers/firmware/arm_scpi.c +@@ -552,8 +552,10 @@ static unsigned long scpi_clk_get_val(u16 clk_id) + + ret = scpi_send_message(CMD_GET_CLOCK_VALUE, &le_clk_id, + sizeof(le_clk_id), &rate, sizeof(rate)); ++ if (ret) ++ return 0; + +- return ret ? ret : le32_to_cpu(rate); ++ return le32_to_cpu(rate); + } + + static int scpi_clk_set_val(u16 clk_id, unsigned long rate) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index ab7755a3885a6..532250c2b19ee 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -267,7 +267,7 @@ static int amdgpu_ttm_map_buffer(struct ttm_buffer_object *bo, + *addr += offset & ~PAGE_MASK; + + num_dw = ALIGN(adev->mman.buffer_funcs->copy_num_dw, 8); +- num_bytes = num_pages * 8; ++ num_bytes = num_pages * 8 * AMDGPU_GPU_PAGES_IN_CPU_PAGE; + + r = amdgpu_job_alloc_with_ib(adev, num_dw * 4 + num_bytes, + AMDGPU_IB_POOL_DELAYED, &job); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +index 4ebb43e090999..fc8da5fed779b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -1334,9 +1334,10 @@ static const struct soc15_reg_golden golden_settings_gc_10_1_2[] = + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG, 0xffffffff, 0x20000000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG2, 0xffffffff, 0x00000420), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0xffffffff, 0x00000200), +- SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x04800000), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x04900000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DFSM_TILES_IN_FLIGHT, 0x0000ffff, 0x0000003f), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_LAST_OF_BURST_CONFIG, 0xffffffff, 0x03860204), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmGB_ADDR_CONFIG, 0x0c1800ff, 0x00000044), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGCR_GENERAL_CNTL, 0x1ff0ffff, 0x00000500), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGE_PRIV_CONTROL, 0x00007fff, 0x000001fe), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmGL1_PIPE_STEER, 0xffffffff, 0xe4e4e4e4), +@@ -1354,12 +1355,13 @@ static const struct soc15_reg_golden golden_settings_gc_10_1_2[] = + SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_ENHANCE_2, 0x00000820, 0x00000820), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_LINE_STIPPLE_STATE, 0x0000ff0f, 0x00000000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmRMI_SPARE, 0xffffffff, 0xffff3101), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSPI_CONFIG_CNTL_1, 0x001f0000, 0x00070104), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_ALU_CLK_CTRL, 0xffffffff, 0xffffffff), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_ARB_CONFIG, 0x00000133, 0x00000130), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_LDS_CLK_CTRL, 0xffffffff, 0xffffffff), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmTA_CNTL_AUX, 0xfff7ffff, 0x01030000), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmTCP_CNTL, 0xffdf80ff, 0x479c0010), +- SOC15_REG_GOLDEN_VALUE(GC, 0, mmUTCL1_CTRL, 0xffffffff, 0x00800000) ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmUTCL1_CTRL, 0xffffffff, 0x00c00000) + }; + + static void gfx_v10_rlcg_wreg(struct amdgpu_device *adev, u32 offset, u32 v) +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 957c12b727676..fb15e8b5af32f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -4859,7 +4859,7 @@ static void gfx_v9_0_update_3d_clock_gating(struct amdgpu_device *adev, + amdgpu_gfx_rlc_enter_safe_mode(adev); + + /* Enable 3D CGCG/CGLS */ +- if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGCG)) { ++ if (enable) { + /* write cmd to clear cgcg/cgls ov */ + def = data = RREG32_SOC15(GC, 0, mmRLC_CGTT_MGCG_OVERRIDE); + /* unset CGCG override */ +@@ -4871,8 +4871,12 @@ static void gfx_v9_0_update_3d_clock_gating(struct amdgpu_device *adev, + /* enable 3Dcgcg FSM(0x0000363f) */ + def = RREG32_SOC15(GC, 0, mmRLC_CGCG_CGLS_CTRL_3D); + +- data = (0x36 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT) | +- RLC_CGCG_CGLS_CTRL_3D__CGCG_EN_MASK; ++ if (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGCG) ++ data = (0x36 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT) | ++ RLC_CGCG_CGLS_CTRL_3D__CGCG_EN_MASK; ++ else ++ data = 0x0 << RLC_CGCG_CGLS_CTRL_3D__CGCG_GFX_IDLE_THRESHOLD__SHIFT; ++ + if (adev->cg_flags & AMD_CG_SUPPORT_GFX_3D_CGLS) + data |= (0x000F << RLC_CGCG_CGLS_CTRL_3D__CGLS_REP_COMPANSAT_DELAY__SHIFT) | + RLC_CGCG_CGLS_CTRL_3D__CGLS_EN_MASK; +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +index 9c72b95b74639..be23d637c3d77 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +@@ -124,6 +124,10 @@ static const struct soc15_reg_golden golden_settings_sdma_nv14[] = { + + static const struct soc15_reg_golden golden_settings_sdma_nv12[] = { + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA0_RLC3_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA0_GB_ADDR_CONFIG, 0x001877ff, 0x00000044), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA0_GB_ADDR_CONFIG_READ, 0x001877ff, 0x00000044), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA1_GB_ADDR_CONFIG, 0x001877ff, 0x00000044), ++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA1_GB_ADDR_CONFIG_READ, 0x001877ff, 0x00000044), + SOC15_REG_GOLDEN_VALUE(GC, 0, mmSDMA1_RLC3_RB_WPTR_POLL_CNTL, 0xfffffff7, 0x00403000), + }; + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 7efc618887e21..37226cbbbd11a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1183,7 +1183,6 @@ static int soc15_common_early_init(void *handle) + adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG | + AMD_CG_SUPPORT_GFX_MGLS | + AMD_CG_SUPPORT_GFX_CP_LS | +- AMD_CG_SUPPORT_GFX_3D_CGCG | + AMD_CG_SUPPORT_GFX_3D_CGLS | + AMD_CG_SUPPORT_GFX_CGCG | + AMD_CG_SUPPORT_GFX_CGLS | +@@ -1203,7 +1202,6 @@ static int soc15_common_early_init(void *handle) + AMD_CG_SUPPORT_GFX_MGLS | + AMD_CG_SUPPORT_GFX_RLC_LS | + AMD_CG_SUPPORT_GFX_CP_LS | +- AMD_CG_SUPPORT_GFX_3D_CGCG | + AMD_CG_SUPPORT_GFX_3D_CGLS | + AMD_CG_SUPPORT_GFX_CGCG | + AMD_CG_SUPPORT_GFX_CGLS | +diff --git a/drivers/gpu/drm/i915/gt/gen7_renderclear.c b/drivers/gpu/drm/i915/gt/gen7_renderclear.c +index 4adbc2bba97fb..c724fba8a87b9 100644 +--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c ++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c +@@ -397,7 +397,10 @@ static void emit_batch(struct i915_vma * const vma, + gen7_emit_pipeline_invalidate(&cmds); + batch_add(&cmds, MI_LOAD_REGISTER_IMM(2)); + batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_0_GEN7)); +- batch_add(&cmds, 0xffff0000); ++ batch_add(&cmds, 0xffff0000 | ++ ((IS_IVB_GT1(i915) || IS_VALLEYVIEW(i915)) ? ++ HIZ_RAW_STALL_OPT_DISABLE : ++ 0)); + batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_1)); + batch_add(&cmds, 0xffff0000 | PIXEL_SUBSPAN_COLLECT_OPT_DISABLE); + gen7_emit_pipeline_invalidate(&cmds); +diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c +index ac4adb44b224d..97ab491d2922c 100644 +--- a/drivers/hwmon/lm80.c ++++ b/drivers/hwmon/lm80.c +@@ -596,7 +596,6 @@ static int lm80_probe(struct i2c_client *client) + struct device *dev = &client->dev; + struct device *hwmon_dev; + struct lm80_data *data; +- int rv; + + data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL); + if (!data) +@@ -609,14 +608,8 @@ static int lm80_probe(struct i2c_client *client) + lm80_init_client(client); + + /* A few vars need to be filled upon startup */ +- rv = lm80_read_value(client, LM80_REG_FAN_MIN(1)); +- if (rv < 0) +- return rv; +- data->fan[f_min][0] = rv; +- rv = lm80_read_value(client, LM80_REG_FAN_MIN(2)); +- if (rv < 0) +- return rv; +- data->fan[f_min][1] = rv; ++ data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1)); ++ data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2)); + + hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, + data, lm80_groups); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 6af066a2c8c06..d1e94147fb165 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -482,6 +482,7 @@ static void cma_release_dev(struct rdma_id_private *id_priv) + list_del(&id_priv->list); + cma_dev_put(id_priv->cma_dev); + id_priv->cma_dev = NULL; ++ id_priv->id.device = NULL; + if (id_priv->id.route.addr.dev_addr.sgid_attr) { + rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr); + id_priv->id.route.addr.dev_addr.sgid_attr = NULL; +@@ -1864,6 +1865,7 @@ static void _destroy_id(struct rdma_id_private *id_priv, + iw_destroy_cm_id(id_priv->cm_id.iw); + } + cma_leave_mc_groups(id_priv); ++ rdma_restrack_del(&id_priv->res); + cma_release_dev(id_priv); + } + +@@ -1877,7 +1879,6 @@ static void _destroy_id(struct rdma_id_private *id_priv, + kfree(id_priv->id.route.path_rec); + + put_net(id_priv->id.route.addr.dev_addr.net); +- rdma_restrack_del(&id_priv->res); + kfree(id_priv); + } + +@@ -3740,7 +3741,7 @@ int rdma_listen(struct rdma_cm_id *id, int backlog) + } + + id_priv->backlog = backlog; +- if (id->device) { ++ if (id_priv->cma_dev) { + if (rdma_cap_ib_cm(id->device, 1)) { + ret = cma_ib_listen(id_priv); + if (ret) +diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c +index 9ec6971056fa8..049684880ae03 100644 +--- a/drivers/infiniband/core/uverbs_std_types_device.c ++++ b/drivers/infiniband/core/uverbs_std_types_device.c +@@ -117,8 +117,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_INFO_HANDLES)( + return ret; + + uapi_object = uapi_get_object(attrs->ufile->device->uapi, object_id); +- if (!uapi_object) +- return -EINVAL; ++ if (IS_ERR(uapi_object)) ++ return PTR_ERR(uapi_object); + + handles = gather_objects_handle(attrs->ufile, uapi_object, attrs, + out_len, &total); +@@ -331,6 +331,9 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_GID_TABLE)( + if (ret) + return ret; + ++ if (!user_entry_size) ++ return -EINVAL; ++ + max_entries = uverbs_attr_ptr_get_array_size( + attrs, UVERBS_ATTR_QUERY_GID_TABLE_RESP_ENTRIES, + user_entry_size); +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index efb9ec99b68bd..06a8732576193 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -559,9 +559,8 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs, + case UVERBS_OBJECT_QP: + { + struct mlx5_ib_qp *qp = to_mqp(uobj->object); +- enum ib_qp_type qp_type = qp->ibqp.qp_type; + +- if (qp_type == IB_QPT_RAW_PACKET || ++ if (qp->type == IB_QPT_RAW_PACKET || + (qp->flags & IB_QP_CREATE_SOURCE_QPN)) { + struct mlx5_ib_raw_packet_qp *raw_packet_qp = + &qp->raw_packet_qp; +@@ -578,10 +577,9 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs, + sq->tisn) == obj_id); + } + +- if (qp_type == MLX5_IB_QPT_DCT) ++ if (qp->type == MLX5_IB_QPT_DCT) + return get_enc_obj_id(MLX5_CMD_OP_CREATE_DCT, + qp->dct.mdct.mqp.qpn) == obj_id; +- + return get_enc_obj_id(MLX5_CMD_OP_CREATE_QP, + qp->ibqp.qp_num) == obj_id; + } +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index beec0d7c0d6e8..b19506707e45c 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -4762,6 +4762,7 @@ static void *mlx5_ib_add_slave_port(struct mlx5_core_dev *mdev) + + if (bound) { + rdma_roce_rescan_device(&dev->ib_dev); ++ mpi->ibdev->ib_active = true; + break; + } + } +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 656a5b4be847e..1e716fe7014cc 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -231,6 +231,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + if (err) { + vfree(qp->sq.queue->buf); + kfree(qp->sq.queue); ++ qp->sq.queue = NULL; + return err; + } + +@@ -284,6 +285,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + if (err) { + vfree(qp->rq.queue->buf); + kfree(qp->rq.queue); ++ qp->rq.queue = NULL; + return err; + } + } +@@ -344,6 +346,11 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd, + err2: + rxe_queue_cleanup(qp->sq.queue); + err1: ++ qp->pd = NULL; ++ qp->rcq = NULL; ++ qp->scq = NULL; ++ qp->srq = NULL; ++ + if (srq) + rxe_drop_ref(srq); + rxe_drop_ref(scq); +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index fb25e8011f5a4..34e847a91eb80 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -300,7 +300,6 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + struct siw_ucontext *uctx = + rdma_udata_to_drv_context(udata, struct siw_ucontext, + base_ucontext); +- struct siw_cq *scq = NULL, *rcq = NULL; + unsigned long flags; + int num_sqe, num_rqe, rv = 0; + size_t length; +@@ -340,10 +339,8 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + rv = -EINVAL; + goto err_out; + } +- scq = to_siw_cq(attrs->send_cq); +- rcq = to_siw_cq(attrs->recv_cq); + +- if (!scq || (!rcq && !attrs->srq)) { ++ if (!attrs->send_cq || (!attrs->recv_cq && !attrs->srq)) { + siw_dbg(base_dev, "send CQ or receive CQ invalid\n"); + rv = -EINVAL; + goto err_out; +@@ -375,7 +372,7 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + else { + /* Zero sized SQ is not supported */ + rv = -EINVAL; +- goto err_out; ++ goto err_out_xa; + } + if (num_rqe) + num_rqe = roundup_pow_of_two(num_rqe); +@@ -398,8 +395,8 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd, + } + } + qp->pd = pd; +- qp->scq = scq; +- qp->rcq = rcq; ++ qp->scq = to_siw_cq(attrs->send_cq); ++ qp->rcq = to_siw_cq(attrs->recv_cq); + + if (attrs->srq) { + /* +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index fc433e63b1dc0..b1590cb4a1887 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -307,7 +307,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + usleep_range(3000, 6000); + ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); + if (ret) +- return ret; ++ goto out; + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index 11890db71f3fe..962f7df0691ef 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1408,6 +1408,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + if (!s->store->chunk_size) { + ti->error = "Chunk size not set"; ++ r = -EINVAL; + goto bad_read_metadata; + } + +diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c +index f318cd4b8086f..083dba95beaa0 100644 +--- a/drivers/media/platform/rcar_drif.c ++++ b/drivers/media/platform/rcar_drif.c +@@ -915,7 +915,6 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, + { + struct rcar_drif_sdr *sdr = video_drvdata(file); + +- memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); + f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; + f->fmt.sdr.buffersize = sdr->fmt->buffersize; + +diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c +index 926408b41270c..7a6f01ace78ac 100644 +--- a/drivers/misc/eeprom/at24.c ++++ b/drivers/misc/eeprom/at24.c +@@ -763,7 +763,8 @@ static int at24_probe(struct i2c_client *client) + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); +- regulator_disable(at24->vcc_reg); ++ if (!pm_runtime_status_suspended(dev)) ++ regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + +@@ -774,7 +775,8 @@ static int at24_probe(struct i2c_client *client) + err = at24_read(at24, 0, &test_byte, 1); + if (err) { + pm_runtime_disable(dev); +- regulator_disable(at24->vcc_reg); ++ if (!pm_runtime_status_suspended(dev)) ++ regulator_disable(at24->vcc_reg); + return -ENODEV; + } + +diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c +index 2bdf560ee681b..0f9ea75b0b189 100644 +--- a/drivers/misc/ics932s401.c ++++ b/drivers/misc/ics932s401.c +@@ -134,7 +134,7 @@ static struct ics932s401_data *ics932s401_update_device(struct device *dev) + for (i = 0; i < NUM_MIRRORED_REGS; i++) { + temp = i2c_smbus_read_word_data(client, regs_to_copy[i]); + if (temp < 0) +- data->regs[regs_to_copy[i]] = 0; ++ temp = 0; + data->regs[regs_to_copy[i]] = temp >> 8; + } + +diff --git a/drivers/mmc/host/sdhci-pci-gli.c b/drivers/mmc/host/sdhci-pci-gli.c +index 9887485a41348..23b89b4cad088 100644 +--- a/drivers/mmc/host/sdhci-pci-gli.c ++++ b/drivers/mmc/host/sdhci-pci-gli.c +@@ -555,8 +555,13 @@ static void sdhci_gli_voltage_switch(struct sdhci_host *host) + * + * Wait 5ms after set 1.8V signal enable in Host Control 2 register + * to ensure 1.8V signal enable bit is set by GL9750/GL9755. ++ * ++ * ...however, the controller in the NUC10i3FNK4 (a 9755) requires ++ * slightly longer than 5ms before the control register reports that ++ * 1.8V is ready, and far longer still before the card will actually ++ * work reliably. + */ +- usleep_range(5000, 5500); ++ usleep_range(100000, 110000); + } + + static void sdhci_gl9750_reset(struct sdhci_host *host, u8 mask) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +index d8a3ecaed3fc6..d8f0863b39342 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +@@ -1048,7 +1048,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) { + skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE); + if (!skb) +- break; ++ goto error; + qlcnic_create_loopback_buff(skb->data, adapter->mac_addr); + skb_put(skb, QLCNIC_ILB_PKT_SIZE); + adapter->ahw->diag_cnt = 0; +@@ -1072,6 +1072,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + cnt++; + } + if (cnt != i) { ++error: + dev_err(&adapter->pdev->dev, + "LB Test: failed, TX[%d], RX[%d]\n", i, cnt); + if (mode != QLCNIC_ILB_MODE) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +index 0e1ca2cba3c7c..e18dee7fe6876 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c +@@ -30,7 +30,7 @@ struct sunxi_priv_data { + static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + { + struct sunxi_priv_data *gmac = priv; +- int ret; ++ int ret = 0; + + if (gmac->regulator) { + ret = regulator_enable(gmac->regulator); +@@ -51,11 +51,11 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) + } else { + clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE); + ret = clk_prepare(gmac->tx_clk); +- if (ret) +- return ret; ++ if (ret && gmac->regulator) ++ regulator_disable(gmac->regulator); + } + +- return 0; ++ return ret; + } + + static void sun7i_gmac_exit(struct platform_device *pdev, void *priv) +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 707ccdd03b19e..74e748662ec01 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -8144,10 +8144,10 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + "VPD_SCAN: Reading in property [%s] len[%d]\n", + namebuf, prop_len); + for (i = 0; i < prop_len; i++) { +- err = niu_pci_eeprom_read(np, off + i); +- if (err >= 0) +- *prop_buf = err; +- ++prop_buf; ++ err = niu_pci_eeprom_read(np, off + i); ++ if (err < 0) ++ return err; ++ *prop_buf++ = err; + } + } + +@@ -8158,14 +8158,14 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + } + + /* ESPC_PIO_EN_ENABLE must be set */ +-static void niu_pci_vpd_fetch(struct niu *np, u32 start) ++static int niu_pci_vpd_fetch(struct niu *np, u32 start) + { + u32 offset; + int err; + + err = niu_pci_eeprom_read16_swp(np, start + 1); + if (err < 0) +- return; ++ return err; + + offset = err + 3; + +@@ -8174,12 +8174,14 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) + u32 end; + + err = niu_pci_eeprom_read(np, here); ++ if (err < 0) ++ return err; + if (err != 0x90) +- return; ++ return -EINVAL; + + err = niu_pci_eeprom_read16_swp(np, here + 1); + if (err < 0) +- return; ++ return err; + + here = start + offset + 3; + end = start + offset + err; +@@ -8187,9 +8189,12 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) + offset += err; + + err = niu_pci_vpd_scan_props(np, here, end); +- if (err < 0 || err == 1) +- return; ++ if (err < 0) ++ return err; ++ if (err == 1) ++ return -EINVAL; + } ++ return 0; + } + + /* ESPC_PIO_EN_ENABLE must be set */ +@@ -9280,8 +9285,11 @@ static int niu_get_invariants(struct niu *np) + offset = niu_pci_vpd_offset(np); + netif_printk(np, probe, KERN_DEBUG, np->dev, + "%s() VPD offset [%08x]\n", __func__, offset); +- if (offset) +- niu_pci_vpd_fetch(np, offset); ++ if (offset) { ++ err = niu_pci_vpd_fetch(np, offset); ++ if (err < 0) ++ return err; ++ } + nw64(ESPC_PIO_EN, 0); + + if (np->flags & NIU_FLAGS_VPD_VALID) { +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 6e8bd99e8911d..1866f6c2acab1 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -440,9 +440,14 @@ static void rtl_watchdog_wq_callback(struct work_struct *work); + static void rtl_fwevt_wq_callback(struct work_struct *work); + static void rtl_c2hcmd_wq_callback(struct work_struct *work); + +-static void _rtl_init_deferred_work(struct ieee80211_hw *hw) ++static int _rtl_init_deferred_work(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); ++ struct workqueue_struct *wq; ++ ++ wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); ++ if (!wq) ++ return -ENOMEM; + + /* <1> timer */ + timer_setup(&rtlpriv->works.watchdog_timer, +@@ -451,11 +456,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) + rtl_easy_concurrent_retrytimer_callback, 0); + /* <2> work queue */ + rtlpriv->works.hw = hw; +- rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); +- if (unlikely(!rtlpriv->works.rtl_wq)) { +- pr_err("Failed to allocate work queue\n"); +- return; +- } ++ rtlpriv->works.rtl_wq = wq; + + INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq, + rtl_watchdog_wq_callback); +@@ -466,6 +467,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) + rtl_swlps_rfon_wq_callback); + INIT_DELAYED_WORK(&rtlpriv->works.fwevt_wq, rtl_fwevt_wq_callback); + INIT_DELAYED_WORK(&rtlpriv->works.c2hcmd_wq, rtl_c2hcmd_wq_callback); ++ return 0; + } + + void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq) +@@ -565,9 +567,7 @@ int rtl_init_core(struct ieee80211_hw *hw) + rtlmac->link_state = MAC80211_NOLINK; + + /* <6> init deferred work */ +- _rtl_init_deferred_work(hw); +- +- return 0; ++ return _rtl_init_deferred_work(hw); + } + EXPORT_SYMBOL_GPL(rtl_init_core); + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 740de61d12a0e..f520a71a361fc 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3131,7 +3131,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl) + ctrl->hmmaxd = le16_to_cpu(id->hmmaxd); + } + +- ret = nvme_mpath_init(ctrl, id); ++ ret = nvme_mpath_init_identify(ctrl, id); + kfree(id); + + if (ret < 0) +@@ -4517,6 +4517,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + min(default_ps_max_latency_us, (unsigned long)S32_MAX)); + + nvme_fault_inject_init(&ctrl->fault_inject, dev_name(ctrl->device)); ++ nvme_mpath_init_ctrl(ctrl); + + return 0; + out_free_name: +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 41257daf7464d..a0bcec33b0208 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -2460,6 +2460,18 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved) + static void + __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues) + { ++ int q; ++ ++ /* ++ * if aborting io, the queues are no longer good, mark them ++ * all as not live. ++ */ ++ if (ctrl->ctrl.queue_count > 1) { ++ for (q = 1; q < ctrl->ctrl.queue_count; q++) ++ clear_bit(NVME_FC_Q_LIVE, &ctrl->queues[q].flags); ++ } ++ clear_bit(NVME_FC_Q_LIVE, &ctrl->queues[0].flags); ++ + /* + * If io queues are present, stop them and terminate all outstanding + * ios on them. As FC allocates FC exchange for each io, the +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index f750cf98ae264..2747efc03825c 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -708,9 +708,18 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head) + put_disk(head->disk); + } + +-int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) ++void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl) + { +- int error; ++ mutex_init(&ctrl->ana_lock); ++ timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); ++ INIT_WORK(&ctrl->ana_work, nvme_ana_work); ++} ++ ++int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) ++{ ++ size_t max_transfer_size = ctrl->max_hw_sectors << SECTOR_SHIFT; ++ size_t ana_log_size; ++ int error = 0; + + /* check if multipath is enabled and we have the capability */ + if (!multipath || !ctrl->subsys || +@@ -722,37 +731,31 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + ctrl->nanagrpid = le32_to_cpu(id->nanagrpid); + ctrl->anagrpmax = le32_to_cpu(id->anagrpmax); + +- mutex_init(&ctrl->ana_lock); +- timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); +- ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + +- ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc); +- ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); +- +- if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) { ++ ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + ++ ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc) + ++ ctrl->max_namespaces * sizeof(__le32); ++ if (ana_log_size > max_transfer_size) { + dev_err(ctrl->device, +- "ANA log page size (%zd) larger than MDTS (%d).\n", +- ctrl->ana_log_size, +- ctrl->max_hw_sectors << SECTOR_SHIFT); ++ "ANA log page size (%zd) larger than MDTS (%zd).\n", ++ ana_log_size, max_transfer_size); + dev_err(ctrl->device, "disabling ANA support.\n"); +- return 0; ++ goto out_uninit; + } +- +- INIT_WORK(&ctrl->ana_work, nvme_ana_work); +- kfree(ctrl->ana_log_buf); +- ctrl->ana_log_buf = kmalloc(ctrl->ana_log_size, GFP_KERNEL); +- if (!ctrl->ana_log_buf) { +- error = -ENOMEM; +- goto out; ++ if (ana_log_size > ctrl->ana_log_size) { ++ nvme_mpath_stop(ctrl); ++ kfree(ctrl->ana_log_buf); ++ ctrl->ana_log_buf = kmalloc(ana_log_size, GFP_KERNEL); ++ if (!ctrl->ana_log_buf) ++ return -ENOMEM; + } +- ++ ctrl->ana_log_size = ana_log_size; + error = nvme_read_ana_log(ctrl); + if (error) +- goto out_free_ana_log_buf; ++ goto out_uninit; + return 0; +-out_free_ana_log_buf: +- kfree(ctrl->ana_log_buf); +- ctrl->ana_log_buf = NULL; +-out: ++ ++out_uninit: ++ nvme_mpath_uninit(ctrl); + return error; + } + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index f843540cc238e..3cb3c82061d7e 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -654,7 +654,8 @@ void nvme_kick_requeue_lists(struct nvme_ctrl *ctrl); + int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl,struct nvme_ns_head *head); + void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id); + void nvme_mpath_remove_disk(struct nvme_ns_head *head); +-int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id); ++int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id); ++void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl); + void nvme_mpath_uninit(struct nvme_ctrl *ctrl); + void nvme_mpath_stop(struct nvme_ctrl *ctrl); + bool nvme_mpath_clear_current_path(struct nvme_ns *ns); +@@ -730,7 +731,10 @@ static inline void nvme_trace_bio_complete(struct request *req, + blk_status_t status) + { + } +-static inline int nvme_mpath_init(struct nvme_ctrl *ctrl, ++static inline void nvme_mpath_init_ctrl(struct nvme_ctrl *ctrl) ++{ ++} ++static inline int nvme_mpath_init_identify(struct nvme_ctrl *ctrl, + struct nvme_id_ctrl *id) + { + if (ctrl->subsys->cmic & (1 << 3)) +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 4cf81f3841aee..82b2611d39a2f 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -940,7 +940,6 @@ static int nvme_tcp_try_send_data(struct nvme_tcp_request *req) + if (ret <= 0) + return ret; + +- nvme_tcp_advance_req(req, ret); + if (queue->data_digest) + nvme_tcp_ddgst_update(queue->snd_hash, page, + offset, ret); +@@ -957,6 +956,7 @@ static int nvme_tcp_try_send_data(struct nvme_tcp_request *req) + } + return 1; + } ++ nvme_tcp_advance_req(req, ret); + } + return -EAGAIN; + } +@@ -1140,7 +1140,8 @@ static void nvme_tcp_io_work(struct work_struct *w) + pending = true; + else if (unlikely(result < 0)) + break; +- } ++ } else ++ pending = !llist_empty(&queue->req_list); + + result = nvme_tcp_try_recv(queue); + if (result > 0) +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 1e79d33c1df7e..46e4f7ea34c8b 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -757,8 +757,6 @@ void nvmet_cq_setup(struct nvmet_ctrl *ctrl, struct nvmet_cq *cq, + { + cq->qid = qid; + cq->size = size; +- +- ctrl->cqs[qid] = cq; + } + + void nvmet_sq_setup(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq, +@@ -1355,20 +1353,14 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn, + if (!ctrl->changed_ns_list) + goto out_free_ctrl; + +- ctrl->cqs = kcalloc(subsys->max_qid + 1, +- sizeof(struct nvmet_cq *), +- GFP_KERNEL); +- if (!ctrl->cqs) +- goto out_free_changed_ns_list; +- + ctrl->sqs = kcalloc(subsys->max_qid + 1, + sizeof(struct nvmet_sq *), + GFP_KERNEL); + if (!ctrl->sqs) +- goto out_free_cqs; ++ goto out_free_changed_ns_list; + + if (subsys->cntlid_min > subsys->cntlid_max) +- goto out_free_cqs; ++ goto out_free_sqs; + + ret = ida_simple_get(&cntlid_ida, + subsys->cntlid_min, subsys->cntlid_max, +@@ -1406,8 +1398,6 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn, + + out_free_sqs: + kfree(ctrl->sqs); +-out_free_cqs: +- kfree(ctrl->cqs); + out_free_changed_ns_list: + kfree(ctrl->changed_ns_list); + out_free_ctrl: +@@ -1437,7 +1427,6 @@ static void nvmet_ctrl_free(struct kref *ref) + + nvmet_async_events_free(ctrl); + kfree(ctrl->sqs); +- kfree(ctrl->cqs); + kfree(ctrl->changed_ns_list); + kfree(ctrl); + +diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c +index 0abbefd9925e3..b575997244482 100644 +--- a/drivers/nvme/target/io-cmd-file.c ++++ b/drivers/nvme/target/io-cmd-file.c +@@ -49,9 +49,11 @@ int nvmet_file_ns_enable(struct nvmet_ns *ns) + + ns->file = filp_open(ns->device_path, flags, 0); + if (IS_ERR(ns->file)) { +- pr_err("failed to open file %s: (%ld)\n", +- ns->device_path, PTR_ERR(ns->file)); +- return PTR_ERR(ns->file); ++ ret = PTR_ERR(ns->file); ++ pr_err("failed to open file %s: (%d)\n", ++ ns->device_path, ret); ++ ns->file = NULL; ++ return ret; + } + + ret = nvmet_file_ns_revalidate(ns); +diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c +index f6d81239be215..b869b686e9623 100644 +--- a/drivers/nvme/target/loop.c ++++ b/drivers/nvme/target/loop.c +@@ -578,8 +578,10 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, + + ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops, + 0 /* no quirks, we're perfect! */); +- if (ret) ++ if (ret) { ++ kfree(ctrl); + goto out; ++ } + + if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) + WARN_ON_ONCE(1); +diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h +index bc91336080e01..ea96487b5424e 100644 +--- a/drivers/nvme/target/nvmet.h ++++ b/drivers/nvme/target/nvmet.h +@@ -164,7 +164,6 @@ static inline struct nvmet_port *ana_groups_to_port( + + struct nvmet_ctrl { + struct nvmet_subsys *subsys; +- struct nvmet_cq **cqs; + struct nvmet_sq **sqs; + + bool cmd_seen; +diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c +index bbc4e71a16ff8..38800e86ed8ad 100644 +--- a/drivers/platform/mellanox/mlxbf-tmfifo.c ++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c +@@ -294,6 +294,9 @@ mlxbf_tmfifo_get_next_desc(struct mlxbf_tmfifo_vring *vring) + if (vring->next_avail == virtio16_to_cpu(vdev, vr->avail->idx)) + return NULL; + ++ /* Make sure 'avail->idx' is visible already. */ ++ virtio_rmb(false); ++ + idx = vring->next_avail % vr->num; + head = virtio16_to_cpu(vdev, vr->avail->ring[idx]); + if (WARN_ON(head >= vr->num)) +@@ -322,7 +325,7 @@ static void mlxbf_tmfifo_release_desc(struct mlxbf_tmfifo_vring *vring, + * done or not. Add a memory barrier here to make sure the update above + * completes before updating the idx. + */ +- mb(); ++ virtio_mb(false); + vr->used->idx = cpu_to_virtio16(vdev, vr_idx + 1); + } + +@@ -733,6 +736,12 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring, + desc = NULL; + fifo->vring[is_rx] = NULL; + ++ /* ++ * Make sure the load/store are in order before ++ * returning back to virtio. ++ */ ++ virtio_mb(false); ++ + /* Notify upper layer that packet is done. */ + spin_lock_irqsave(&fifo->spin_lock[is_rx], flags); + vring_interrupt(0, vring->vq); +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index 0d91d136bc3b7..a1858689d6e10 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -821,7 +821,7 @@ config INTEL_HID_EVENT + + config INTEL_INT0002_VGPIO + tristate "Intel ACPI INT0002 Virtual GPIO driver" +- depends on GPIOLIB && ACPI ++ depends on GPIOLIB && ACPI && PM_SLEEP + select GPIOLIB_IRQCHIP + help + Some peripherals on Bay Trail and Cherry Trail platforms signal a +diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c +index 27a298b7c541b..c97bd4a452422 100644 +--- a/drivers/platform/x86/dell-smbios-wmi.c ++++ b/drivers/platform/x86/dell-smbios-wmi.c +@@ -271,7 +271,8 @@ int init_dell_smbios_wmi(void) + + void exit_dell_smbios_wmi(void) + { +- wmi_driver_unregister(&dell_smbios_wmi_driver); ++ if (wmi_supported) ++ wmi_driver_unregister(&dell_smbios_wmi_driver); + } + + MODULE_DEVICE_TABLE(wmi, dell_smbios_wmi_id_table); +diff --git a/drivers/platform/x86/intel_int0002_vgpio.c b/drivers/platform/x86/intel_int0002_vgpio.c +index 289c6655d425d..569342aa8926e 100644 +--- a/drivers/platform/x86/intel_int0002_vgpio.c ++++ b/drivers/platform/x86/intel_int0002_vgpio.c +@@ -51,6 +51,12 @@ + #define GPE0A_STS_PORT 0x420 + #define GPE0A_EN_PORT 0x428 + ++struct int0002_data { ++ struct gpio_chip chip; ++ int parent_irq; ++ int wake_enable_count; ++}; ++ + /* + * As this is not a real GPIO at all, but just a hack to model an event in + * ACPI the get / set functions are dummy functions. +@@ -98,14 +104,16 @@ static void int0002_irq_mask(struct irq_data *data) + static int int0002_irq_set_wake(struct irq_data *data, unsigned int on) + { + struct gpio_chip *chip = irq_data_get_irq_chip_data(data); +- struct platform_device *pdev = to_platform_device(chip->parent); +- int irq = platform_get_irq(pdev, 0); ++ struct int0002_data *int0002 = container_of(chip, struct int0002_data, chip); + +- /* Propagate to parent irq */ ++ /* ++ * Applying of the wakeup flag to our parent IRQ is delayed till system ++ * suspend, because we only want to do this when using s2idle. ++ */ + if (on) +- enable_irq_wake(irq); ++ int0002->wake_enable_count++; + else +- disable_irq_wake(irq); ++ int0002->wake_enable_count--; + + return 0; + } +@@ -135,7 +143,7 @@ static bool int0002_check_wake(void *data) + return (gpe_sts_reg & GPE0A_PME_B0_STS_BIT); + } + +-static struct irq_chip int0002_byt_irqchip = { ++static struct irq_chip int0002_irqchip = { + .name = DRV_NAME, + .irq_ack = int0002_irq_ack, + .irq_mask = int0002_irq_mask, +@@ -143,21 +151,9 @@ static struct irq_chip int0002_byt_irqchip = { + .irq_set_wake = int0002_irq_set_wake, + }; + +-static struct irq_chip int0002_cht_irqchip = { +- .name = DRV_NAME, +- .irq_ack = int0002_irq_ack, +- .irq_mask = int0002_irq_mask, +- .irq_unmask = int0002_irq_unmask, +- /* +- * No set_wake, on CHT the IRQ is typically shared with the ACPI SCI +- * and we don't want to mess with the ACPI SCI irq settings. +- */ +- .flags = IRQCHIP_SKIP_SET_WAKE, +-}; +- + static const struct x86_cpu_id int0002_cpu_ids[] = { +- X86_MATCH_INTEL_FAM6_MODEL(ATOM_SILVERMONT, &int0002_byt_irqchip), +- X86_MATCH_INTEL_FAM6_MODEL(ATOM_AIRMONT, &int0002_cht_irqchip), ++ X86_MATCH_INTEL_FAM6_MODEL(ATOM_SILVERMONT, NULL), ++ X86_MATCH_INTEL_FAM6_MODEL(ATOM_AIRMONT, NULL), + {} + }; + +@@ -172,8 +168,9 @@ static int int0002_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + const struct x86_cpu_id *cpu_id; +- struct gpio_chip *chip; ++ struct int0002_data *int0002; + struct gpio_irq_chip *girq; ++ struct gpio_chip *chip; + int irq, ret; + + /* Menlow has a different INT0002 device? */ +@@ -185,10 +182,13 @@ static int int0002_probe(struct platform_device *pdev) + if (irq < 0) + return irq; + +- chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL); +- if (!chip) ++ int0002 = devm_kzalloc(dev, sizeof(*int0002), GFP_KERNEL); ++ if (!int0002) + return -ENOMEM; + ++ int0002->parent_irq = irq; ++ ++ chip = &int0002->chip; + chip->label = DRV_NAME; + chip->parent = dev; + chip->owner = THIS_MODULE; +@@ -214,7 +214,7 @@ static int int0002_probe(struct platform_device *pdev) + } + + girq = &chip->irq; +- girq->chip = (struct irq_chip *)cpu_id->driver_data; ++ girq->chip = &int0002_irqchip; + /* This let us handle the parent IRQ in the driver */ + girq->parent_handler = NULL; + girq->num_parents = 0; +@@ -230,6 +230,7 @@ static int int0002_probe(struct platform_device *pdev) + + acpi_register_wakeup_handler(irq, int0002_check_wake, NULL); + device_init_wakeup(dev, true); ++ dev_set_drvdata(dev, int0002); + return 0; + } + +@@ -240,6 +241,36 @@ static int int0002_remove(struct platform_device *pdev) + return 0; + } + ++static int int0002_suspend(struct device *dev) ++{ ++ struct int0002_data *int0002 = dev_get_drvdata(dev); ++ ++ /* ++ * The INT0002 parent IRQ is often shared with the ACPI GPE IRQ, don't ++ * muck with it when firmware based suspend is used, otherwise we may ++ * cause spurious wakeups from firmware managed suspend. ++ */ ++ if (!pm_suspend_via_firmware() && int0002->wake_enable_count) ++ enable_irq_wake(int0002->parent_irq); ++ ++ return 0; ++} ++ ++static int int0002_resume(struct device *dev) ++{ ++ struct int0002_data *int0002 = dev_get_drvdata(dev); ++ ++ if (!pm_suspend_via_firmware() && int0002->wake_enable_count) ++ disable_irq_wake(int0002->parent_irq); ++ ++ return 0; ++} ++ ++static const struct dev_pm_ops int0002_pm_ops = { ++ .suspend = int0002_suspend, ++ .resume = int0002_resume, ++}; ++ + static const struct acpi_device_id int0002_acpi_ids[] = { + { "INT0002", 0 }, + { }, +@@ -250,6 +281,7 @@ static struct platform_driver int0002_driver = { + .driver = { + .name = DRV_NAME, + .acpi_match_table = int0002_acpi_ids, ++ .pm = &int0002_pm_ops, + }, + .probe = int0002_probe, + .remove = int0002_remove, +diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c +index 50ec53d67a4c0..db4c265287ae6 100644 +--- a/drivers/rapidio/rio_cm.c ++++ b/drivers/rapidio/rio_cm.c +@@ -2127,6 +2127,14 @@ static int riocm_add_mport(struct device *dev, + return -ENODEV; + } + ++ cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); ++ if (!cm->rx_wq) { ++ rio_release_inb_mbox(mport, cmbox); ++ rio_release_outb_mbox(mport, cmbox); ++ kfree(cm); ++ return -ENOMEM; ++ } ++ + /* + * Allocate and register inbound messaging buffers to be ready + * to receive channel and system management requests +@@ -2137,15 +2145,6 @@ static int riocm_add_mport(struct device *dev, + cm->rx_slots = RIOCM_RX_RING_SIZE; + mutex_init(&cm->rx_lock); + riocm_rx_fill(cm, RIOCM_RX_RING_SIZE); +- cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); +- if (!cm->rx_wq) { +- riocm_error("failed to allocate IBMBOX_%d on %s", +- cmbox, mport->name); +- rio_release_outb_mbox(mport, cmbox); +- kfree(cm); +- return -ENOMEM; +- } +- + INIT_WORK(&cm->rx_work, rio_ibmsg_handler); + + cm->tx_slot = 0; +diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c +index f8b99cb729590..62684ca3a665e 100644 +--- a/drivers/rtc/rtc-pcf85063.c ++++ b/drivers/rtc/rtc-pcf85063.c +@@ -486,6 +486,7 @@ static struct clk *pcf85063_clkout_register_clk(struct pcf85063 *pcf85063) + { + struct clk *clk; + struct clk_init_data init; ++ struct device_node *node = pcf85063->rtc->dev.parent->of_node; + + init.name = "pcf85063-clkout"; + init.ops = &pcf85063_clkout_ops; +@@ -495,15 +496,13 @@ static struct clk *pcf85063_clkout_register_clk(struct pcf85063 *pcf85063) + pcf85063->clkout_hw.init = &init; + + /* optional override of the clockname */ +- of_property_read_string(pcf85063->rtc->dev.of_node, +- "clock-output-names", &init.name); ++ of_property_read_string(node, "clock-output-names", &init.name); + + /* register the clock */ + clk = devm_clk_register(&pcf85063->rtc->dev, &pcf85063->clkout_hw); + + if (!IS_ERR(clk)) +- of_clk_add_provider(pcf85063->rtc->dev.of_node, +- of_clk_src_simple_get, clk); ++ of_clk_add_provider(node, of_clk_src_simple_get, clk); + + return clk; + } +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 46d185cb9ea80..a464d0a4f4653 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -536,7 +536,9 @@ static void qedf_update_link_speed(struct qedf_ctx *qedf, + if (linkmode_intersects(link->supported_caps, sup_caps)) + lport->link_supported_speeds |= FC_PORTSPEED_20GBIT; + +- fc_host_supported_speeds(lport->host) = lport->link_supported_speeds; ++ if (lport->host && lport->host->shost_data) ++ fc_host_supported_speeds(lport->host) = ++ lport->link_supported_speeds; + } + + static void qedf_bw_update(void *dev) +diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c +index b3ba0de5d4fb8..0563c9530dcad 100644 +--- a/drivers/scsi/qla2xxx/qla_nx.c ++++ b/drivers/scsi/qla2xxx/qla_nx.c +@@ -1066,7 +1066,8 @@ qla82xx_write_flash_dword(struct qla_hw_data *ha, uint32_t flashaddr, + return ret; + } + +- if (qla82xx_flash_set_write_enable(ha)) ++ ret = qla82xx_flash_set_write_enable(ha); ++ if (ret < 0) + goto done_write; + + qla82xx_wr_32(ha, QLA82XX_ROMUSB_ROM_WDATA, data); +diff --git a/drivers/scsi/ufs/ufs-hisi.c b/drivers/scsi/ufs/ufs-hisi.c +index 074a6a055a4c0..55b7161d76977 100644 +--- a/drivers/scsi/ufs/ufs-hisi.c ++++ b/drivers/scsi/ufs/ufs-hisi.c +@@ -478,21 +478,24 @@ static int ufs_hisi_init_common(struct ufs_hba *hba) + host->hba = hba; + ufshcd_set_variant(hba, host); + +- host->rst = devm_reset_control_get(dev, "rst"); ++ host->rst = devm_reset_control_get(dev, "rst"); + if (IS_ERR(host->rst)) { + dev_err(dev, "%s: failed to get reset control\n", __func__); +- return PTR_ERR(host->rst); ++ err = PTR_ERR(host->rst); ++ goto error; + } + + ufs_hisi_set_pm_lvl(hba); + + err = ufs_hisi_get_resource(host); +- if (err) { +- ufshcd_set_variant(hba, NULL); +- return err; +- } ++ if (err) ++ goto error; + + return 0; ++ ++error: ++ ufshcd_set_variant(hba, NULL); ++ return err; + } + + static int ufs_hi3660_init(struct ufs_hba *hba) +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 08d4d40c510ea..854c96e630077 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -2768,7 +2768,7 @@ static int ufshcd_wait_for_dev_cmd(struct ufs_hba *hba, + * ufshcd_exec_dev_cmd - API for sending device management requests + * @hba: UFS hba + * @cmd_type: specifies the type (NOP, Query...) +- * @timeout: time in seconds ++ * @timeout: timeout in milliseconds + * + * NOTE: Since there is only one available tag for device management commands, + * it is expected you hold the hba->dev_cmd.lock mutex. +@@ -2798,6 +2798,9 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba, + } + tag = req->tag; + WARN_ON_ONCE(!ufshcd_valid_tag(hba, tag)); ++ /* Set the timeout such that the SCSI error handler is not activated. */ ++ req->timeout = msecs_to_jiffies(2 * timeout); ++ blk_mq_start_request(req); + + init_completion(&wait); + lrbp = &hba->lrb[tag]; +diff --git a/drivers/tee/amdtee/amdtee_private.h b/drivers/tee/amdtee/amdtee_private.h +index 337c8d82f74eb..6d0f7062bb870 100644 +--- a/drivers/tee/amdtee/amdtee_private.h ++++ b/drivers/tee/amdtee/amdtee_private.h +@@ -21,6 +21,7 @@ + #define TEEC_SUCCESS 0x00000000 + #define TEEC_ERROR_GENERIC 0xFFFF0000 + #define TEEC_ERROR_BAD_PARAMETERS 0xFFFF0006 ++#define TEEC_ERROR_OUT_OF_MEMORY 0xFFFF000C + #define TEEC_ERROR_COMMUNICATION 0xFFFF000E + + #define TEEC_ORIGIN_COMMS 0x00000002 +@@ -93,6 +94,18 @@ struct amdtee_shm_data { + u32 buf_id; + }; + ++/** ++ * struct amdtee_ta_data - Keeps track of all TAs loaded in AMD Secure ++ * Processor ++ * @ta_handle: Handle to TA loaded in TEE ++ * @refcount: Reference count for the loaded TA ++ */ ++struct amdtee_ta_data { ++ struct list_head list_node; ++ u32 ta_handle; ++ u32 refcount; ++}; ++ + #define LOWER_TWO_BYTE_MASK 0x0000FFFF + + /** +diff --git a/drivers/tee/amdtee/call.c b/drivers/tee/amdtee/call.c +index 096dd4d92d39c..07f36ac834c88 100644 +--- a/drivers/tee/amdtee/call.c ++++ b/drivers/tee/amdtee/call.c +@@ -121,15 +121,69 @@ static int amd_params_to_tee_params(struct tee_param *tee, u32 count, + return ret; + } + ++static DEFINE_MUTEX(ta_refcount_mutex); ++static struct list_head ta_list = LIST_HEAD_INIT(ta_list); ++ ++static u32 get_ta_refcount(u32 ta_handle) ++{ ++ struct amdtee_ta_data *ta_data; ++ u32 count = 0; ++ ++ /* Caller must hold a mutex */ ++ list_for_each_entry(ta_data, &ta_list, list_node) ++ if (ta_data->ta_handle == ta_handle) ++ return ++ta_data->refcount; ++ ++ ta_data = kzalloc(sizeof(*ta_data), GFP_KERNEL); ++ if (ta_data) { ++ ta_data->ta_handle = ta_handle; ++ ta_data->refcount = 1; ++ count = ta_data->refcount; ++ list_add(&ta_data->list_node, &ta_list); ++ } ++ ++ return count; ++} ++ ++static u32 put_ta_refcount(u32 ta_handle) ++{ ++ struct amdtee_ta_data *ta_data; ++ u32 count = 0; ++ ++ /* Caller must hold a mutex */ ++ list_for_each_entry(ta_data, &ta_list, list_node) ++ if (ta_data->ta_handle == ta_handle) { ++ count = --ta_data->refcount; ++ if (count == 0) { ++ list_del(&ta_data->list_node); ++ kfree(ta_data); ++ break; ++ } ++ } ++ ++ return count; ++} ++ + int handle_unload_ta(u32 ta_handle) + { + struct tee_cmd_unload_ta cmd = {0}; +- u32 status; ++ u32 status, count; + int ret; + + if (!ta_handle) + return -EINVAL; + ++ mutex_lock(&ta_refcount_mutex); ++ ++ count = put_ta_refcount(ta_handle); ++ ++ if (count) { ++ pr_debug("unload ta: not unloading %u count %u\n", ++ ta_handle, count); ++ ret = -EBUSY; ++ goto unlock; ++ } ++ + cmd.ta_handle = ta_handle; + + ret = psp_tee_process_cmd(TEE_CMD_ID_UNLOAD_TA, (void *)&cmd, +@@ -137,8 +191,12 @@ int handle_unload_ta(u32 ta_handle) + if (!ret && status != 0) { + pr_err("unload ta: status = 0x%x\n", status); + ret = -EBUSY; ++ } else { ++ pr_debug("unloaded ta handle %u\n", ta_handle); + } + ++unlock: ++ mutex_unlock(&ta_refcount_mutex); + return ret; + } + +@@ -340,7 +398,8 @@ int handle_open_session(struct tee_ioctl_open_session_arg *arg, u32 *info, + + int handle_load_ta(void *data, u32 size, struct tee_ioctl_open_session_arg *arg) + { +- struct tee_cmd_load_ta cmd = {0}; ++ struct tee_cmd_unload_ta unload_cmd = {}; ++ struct tee_cmd_load_ta load_cmd = {}; + phys_addr_t blob; + int ret; + +@@ -353,21 +412,36 @@ int handle_load_ta(void *data, u32 size, struct tee_ioctl_open_session_arg *arg) + return -EINVAL; + } + +- cmd.hi_addr = upper_32_bits(blob); +- cmd.low_addr = lower_32_bits(blob); +- cmd.size = size; ++ load_cmd.hi_addr = upper_32_bits(blob); ++ load_cmd.low_addr = lower_32_bits(blob); ++ load_cmd.size = size; + +- ret = psp_tee_process_cmd(TEE_CMD_ID_LOAD_TA, (void *)&cmd, +- sizeof(cmd), &arg->ret); ++ mutex_lock(&ta_refcount_mutex); ++ ++ ret = psp_tee_process_cmd(TEE_CMD_ID_LOAD_TA, (void *)&load_cmd, ++ sizeof(load_cmd), &arg->ret); + if (ret) { + arg->ret_origin = TEEC_ORIGIN_COMMS; + arg->ret = TEEC_ERROR_COMMUNICATION; +- } else { +- set_session_id(cmd.ta_handle, 0, &arg->session); ++ } else if (arg->ret == TEEC_SUCCESS) { ++ ret = get_ta_refcount(load_cmd.ta_handle); ++ if (!ret) { ++ arg->ret_origin = TEEC_ORIGIN_COMMS; ++ arg->ret = TEEC_ERROR_OUT_OF_MEMORY; ++ ++ /* Unload the TA on error */ ++ unload_cmd.ta_handle = load_cmd.ta_handle; ++ psp_tee_process_cmd(TEE_CMD_ID_UNLOAD_TA, ++ (void *)&unload_cmd, ++ sizeof(unload_cmd), &ret); ++ } else { ++ set_session_id(load_cmd.ta_handle, 0, &arg->session); ++ } + } ++ mutex_unlock(&ta_refcount_mutex); + + pr_debug("load TA: TA handle = 0x%x, RO = 0x%x, ret = 0x%x\n", +- cmd.ta_handle, arg->ret_origin, arg->ret); ++ load_cmd.ta_handle, arg->ret_origin, arg->ret); + + return 0; + } +diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c +index 8a6a8f30bb427..da6b88e80dc07 100644 +--- a/drivers/tee/amdtee/core.c ++++ b/drivers/tee/amdtee/core.c +@@ -59,10 +59,9 @@ static void release_session(struct amdtee_session *sess) + continue; + + handle_close_session(sess->ta_handle, sess->session_info[i]); ++ handle_unload_ta(sess->ta_handle); + } + +- /* Unload Trusted Application once all sessions are closed */ +- handle_unload_ta(sess->ta_handle); + kfree(sess); + } + +@@ -224,8 +223,6 @@ static void destroy_session(struct kref *ref) + struct amdtee_session *sess = container_of(ref, struct amdtee_session, + refcount); + +- /* Unload the TA from TEE */ +- handle_unload_ta(sess->ta_handle); + mutex_lock(&session_list_mutex); + list_del(&sess->list_node); + mutex_unlock(&session_list_mutex); +@@ -238,7 +235,7 @@ int amdtee_open_session(struct tee_context *ctx, + { + struct amdtee_context_data *ctxdata = ctx->data; + struct amdtee_session *sess = NULL; +- u32 session_info; ++ u32 session_info, ta_handle; + size_t ta_size; + int rc, i; + void *ta; +@@ -259,11 +256,14 @@ int amdtee_open_session(struct tee_context *ctx, + if (arg->ret != TEEC_SUCCESS) + goto out; + ++ ta_handle = get_ta_handle(arg->session); ++ + mutex_lock(&session_list_mutex); + sess = alloc_session(ctxdata, arg->session); + mutex_unlock(&session_list_mutex); + + if (!sess) { ++ handle_unload_ta(ta_handle); + rc = -ENOMEM; + goto out; + } +@@ -277,6 +277,7 @@ int amdtee_open_session(struct tee_context *ctx, + + if (i >= TEE_NUM_SESSIONS) { + pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS); ++ handle_unload_ta(ta_handle); + kref_put(&sess->refcount, destroy_session); + rc = -ENOMEM; + goto out; +@@ -289,12 +290,13 @@ int amdtee_open_session(struct tee_context *ctx, + spin_lock(&sess->lock); + clear_bit(i, sess->sess_mask); + spin_unlock(&sess->lock); ++ handle_unload_ta(ta_handle); + kref_put(&sess->refcount, destroy_session); + goto out; + } + + sess->session_info[i] = session_info; +- set_session_id(sess->ta_handle, i, &arg->session); ++ set_session_id(ta_handle, i, &arg->session); + out: + free_pages((u64)ta, get_order(ta_size)); + return rc; +@@ -329,6 +331,7 @@ int amdtee_close_session(struct tee_context *ctx, u32 session) + + /* Close the session */ + handle_close_session(ta_handle, session_info); ++ handle_unload_ta(ta_handle); + + kref_put(&sess->refcount, destroy_session); + +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index e0c00a1b07639..51b0ecabf2ec9 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -818,9 +818,6 @@ static int mvebu_uart_probe(struct platform_device *pdev) + return -EINVAL; + } + +- if (!match) +- return -ENODEV; +- + /* Assume that all UART ports have a DT alias or none has */ + id = of_alias_get_id(pdev->dev.of_node, "serial"); + if (!pdev->dev.of_node || id < 0) +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 8f88ee2a2c8d0..06757b1d4aecd 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1172,7 +1172,7 @@ static inline int resize_screen(struct vc_data *vc, int width, int height, + /* Resizes the resolution of the display adapater */ + int err = 0; + +- if (vc->vc_mode != KD_GRAPHICS && vc->vc_sw->con_resize) ++ if (vc->vc_sw->con_resize) + err = vc->vc_sw->con_resize(vc, width, height, user); + + return err; +diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c +index 5f61b25a9aaa8..09b8d02acd996 100644 +--- a/drivers/tty/vt/vt_ioctl.c ++++ b/drivers/tty/vt/vt_ioctl.c +@@ -771,21 +771,58 @@ static int vt_resizex(struct vc_data *vc, struct vt_consize __user *cs) + if (copy_from_user(&v, cs, sizeof(struct vt_consize))) + return -EFAULT; + +- if (v.v_vlin) +- pr_info_once("\"struct vt_consize\"->v_vlin is ignored. Please report if you need this.\n"); +- if (v.v_clin) +- pr_info_once("\"struct vt_consize\"->v_clin is ignored. Please report if you need this.\n"); ++ /* FIXME: Should check the copies properly */ ++ if (!v.v_vlin) ++ v.v_vlin = vc->vc_scan_lines; ++ ++ if (v.v_clin) { ++ int rows = v.v_vlin / v.v_clin; ++ if (v.v_rows != rows) { ++ if (v.v_rows) /* Parameters don't add up */ ++ return -EINVAL; ++ v.v_rows = rows; ++ } ++ } ++ ++ if (v.v_vcol && v.v_ccol) { ++ int cols = v.v_vcol / v.v_ccol; ++ if (v.v_cols != cols) { ++ if (v.v_cols) ++ return -EINVAL; ++ v.v_cols = cols; ++ } ++ } ++ ++ if (v.v_clin > 32) ++ return -EINVAL; + +- console_lock(); + for (i = 0; i < MAX_NR_CONSOLES; i++) { +- vc = vc_cons[i].d; ++ struct vc_data *vcp; + +- if (vc) { +- vc->vc_resize_user = 1; +- vc_resize(vc, v.v_cols, v.v_rows); ++ if (!vc_cons[i].d) ++ continue; ++ console_lock(); ++ vcp = vc_cons[i].d; ++ if (vcp) { ++ int ret; ++ int save_scan_lines = vcp->vc_scan_lines; ++ int save_cell_height = vcp->vc_cell_height; ++ ++ if (v.v_vlin) ++ vcp->vc_scan_lines = v.v_vlin; ++ if (v.v_clin) ++ vcp->vc_cell_height = v.v_clin; ++ vcp->vc_resize_user = 1; ++ ret = vc_resize(vcp, v.v_cols, v.v_rows); ++ if (ret) { ++ vcp->vc_scan_lines = save_scan_lines; ++ vcp->vc_cell_height = save_cell_height; ++ console_unlock(); ++ return ret; ++ } + } ++ console_unlock(); + } +- console_unlock(); + + return 0; + } +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +index 4dae2320b103e..c31febe90d4ea 100644 +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -296,8 +296,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->recv_buf, + RECV_BUFFER_SIZE, &pdata->recv_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->recv_buf); + goto fail_close; ++ } + + /* put Global Physical Address Label in name */ + snprintf(pdata->recv_name, sizeof(pdata->recv_name), +@@ -316,8 +318,10 @@ hv_uio_probe(struct hv_device *dev, + + ret = vmbus_establish_gpadl(channel, pdata->send_buf, + SEND_BUFFER_SIZE, &pdata->send_gpadl); +- if (ret) ++ if (ret) { ++ vfree(pdata->send_buf); + goto fail_close; ++ } + + snprintf(pdata->send_name, sizeof(pdata->send_name), + "send:%u", pdata->send_gpadl); +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index 17876f0179b57..5dc88a914b349 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -384,7 +384,7 @@ static void vgacon_init(struct vc_data *c, int init) + vc_resize(c, vga_video_num_columns, vga_video_num_lines); + + c->vc_scan_lines = vga_scan_lines; +- c->vc_font.height = vga_video_font_height; ++ c->vc_font.height = c->vc_cell_height = vga_video_font_height; + c->vc_complement_mask = 0x7700; + if (vga_512_chars) + c->vc_hi_font_mask = 0x0800; +@@ -519,32 +519,32 @@ static void vgacon_cursor(struct vc_data *c, int mode) + switch (CUR_SIZE(c->vc_cursor_type)) { + case CUR_UNDERLINE: + vgacon_set_cursor_size(c->state.x, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 2 : 3), +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_TWO_THIRDS: + vgacon_set_cursor_size(c->state.x, +- c->vc_font.height / 3, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height / 3, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_LOWER_THIRD: + vgacon_set_cursor_size(c->state.x, +- (c->vc_font.height * 2) / 3, +- c->vc_font.height - +- (c->vc_font.height < ++ (c->vc_cell_height * 2) / 3, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_LOWER_HALF: + vgacon_set_cursor_size(c->state.x, +- c->vc_font.height / 2, +- c->vc_font.height - +- (c->vc_font.height < ++ c->vc_cell_height / 2, ++ c->vc_cell_height - ++ (c->vc_cell_height < + 10 ? 1 : 2)); + break; + case CUR_NONE: +@@ -555,7 +555,7 @@ static void vgacon_cursor(struct vc_data *c, int mode) + break; + default: + vgacon_set_cursor_size(c->state.x, 1, +- c->vc_font.height); ++ c->vc_cell_height); + break; + } + break; +@@ -566,13 +566,13 @@ static int vgacon_doresize(struct vc_data *c, + unsigned int width, unsigned int height) + { + unsigned long flags; +- unsigned int scanlines = height * c->vc_font.height; ++ unsigned int scanlines = height * c->vc_cell_height; + u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan; + + raw_spin_lock_irqsave(&vga_lock, flags); + + vgacon_xres = width * VGA_FONTWIDTH; +- vgacon_yres = height * c->vc_font.height; ++ vgacon_yres = height * c->vc_cell_height; + if (vga_video_type >= VIDEO_TYPE_VGAC) { + outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg); + max_scan = inb_p(vga_video_port_val); +@@ -627,9 +627,9 @@ static int vgacon_doresize(struct vc_data *c, + static int vgacon_switch(struct vc_data *c) + { + int x = c->vc_cols * VGA_FONTWIDTH; +- int y = c->vc_rows * c->vc_font.height; ++ int y = c->vc_rows * c->vc_cell_height; + int rows = screen_info.orig_video_lines * vga_default_font_height/ +- c->vc_font.height; ++ c->vc_cell_height; + /* + * We need to save screen size here as it's the only way + * we can spot the screen has been resized and we need to +@@ -1060,7 +1060,7 @@ static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight) + cursor_size_lastto = 0; + c->vc_sw->con_cursor(c, CM_DRAW); + } +- c->vc_font.height = fontheight; ++ c->vc_font.height = c->vc_cell_height = fontheight; + vc_resize(c, 0, rows); /* Adjust console size */ + } + } +@@ -1108,12 +1108,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width, + if ((width << 1) * height > vga_vram_size) + return -EINVAL; + ++ if (user) { ++ /* ++ * Ho ho! Someone (svgatextmode, eh?) may have reprogrammed ++ * the video mode! Set the new defaults then and go away. ++ */ ++ screen_info.orig_video_cols = width; ++ screen_info.orig_video_lines = height; ++ vga_default_font_height = c->vc_cell_height; ++ return 0; ++ } + if (width % 2 || width > screen_info.orig_video_cols || + height > (screen_info.orig_video_lines * vga_default_font_height)/ +- c->vc_font.height) +- /* let svgatextmode tinker with video timings and +- return success */ +- return (user) ? 0 : -EINVAL; ++ c->vc_cell_height) ++ return -EINVAL; + + if (con_is_visible(c) && !vga_is_gfx) /* who knows */ + vgacon_doresize(c, width, height); +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 26581194fdf81..42c72d051158f 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2031,7 +2031,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, + return -EINVAL; + + DPRINTK("resize now %ix%i\n", var.xres, var.yres); +- if (con_is_visible(vc)) { ++ if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) { + var.activate = FB_ACTIVATE_NOW | + FB_ACTIVATE_FORCE; + fb_set_var(info, &var); +diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c +index a45fcff1461fb..0fe32737ba084 100644 +--- a/drivers/video/fbdev/hgafb.c ++++ b/drivers/video/fbdev/hgafb.c +@@ -286,7 +286,7 @@ static int hga_card_detect(void) + + hga_vram = ioremap(0xb0000, hga_vram_len); + if (!hga_vram) +- goto error; ++ return -ENOMEM; + + if (request_region(0x3b0, 12, "hgafb")) + release_io_ports = 1; +@@ -346,13 +346,18 @@ static int hga_card_detect(void) + hga_type_name = "Hercules"; + break; + } +- return 1; ++ return 0; + error: + if (release_io_ports) + release_region(0x3b0, 12); + if (release_io_port) + release_region(0x3bf, 1); +- return 0; ++ ++ iounmap(hga_vram); ++ ++ pr_err("hgafb: HGA card not detected.\n"); ++ ++ return -EINVAL; + } + + /** +@@ -550,13 +555,11 @@ static const struct fb_ops hgafb_ops = { + static int hgafb_probe(struct platform_device *pdev) + { + struct fb_info *info; ++ int ret; + +- if (! hga_card_detect()) { +- printk(KERN_INFO "hgafb: HGA card not detected.\n"); +- if (hga_vram) +- iounmap(hga_vram); +- return -EINVAL; +- } ++ ret = hga_card_detect(); ++ if (ret) ++ return ret; + + printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n", + hga_type_name, hga_vram_len/1024); +diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c +index 3ac053b884958..e04411701ec85 100644 +--- a/drivers/video/fbdev/imsttfb.c ++++ b/drivers/video/fbdev/imsttfb.c +@@ -1512,11 +1512,6 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + info->fix.smem_start = addr; + info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ? + 0x400000 : 0x800000); +- if (!info->screen_base) { +- release_mem_region(addr, size); +- framebuffer_release(info); +- return -ENOMEM; +- } + info->fix.mmio_start = addr + 0x800000; + par->dc_regs = ioremap(addr + 0x800000, 0x1000); + par->cmap_regs_phys = addr + 0x840000; +diff --git a/drivers/xen/xen-pciback/vpci.c b/drivers/xen/xen-pciback/vpci.c +index 5447b5ab7c766..1221cfd914cb0 100644 +--- a/drivers/xen/xen-pciback/vpci.c ++++ b/drivers/xen/xen-pciback/vpci.c +@@ -70,7 +70,7 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev, + struct pci_dev *dev, int devid, + publish_pci_dev_cb publish_cb) + { +- int err = 0, slot, func = -1; ++ int err = 0, slot, func = PCI_FUNC(dev->devfn); + struct pci_dev_entry *t, *dev_entry; + struct vpci_dev_data *vpci_dev = pdev->pci_dev_data; + +@@ -95,22 +95,25 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev, + + /* + * Keep multi-function devices together on the virtual PCI bus, except +- * virtual functions. ++ * that we want to keep virtual functions at func 0 on their own. They ++ * aren't multi-function devices and hence their presence at func 0 ++ * may cause guests to not scan the other functions. + */ +- if (!dev->is_virtfn) { ++ if (!dev->is_virtfn || func) { + for (slot = 0; slot < PCI_SLOT_MAX; slot++) { + if (list_empty(&vpci_dev->dev_list[slot])) + continue; + + t = list_entry(list_first(&vpci_dev->dev_list[slot]), + struct pci_dev_entry, list); ++ if (t->dev->is_virtfn && !PCI_FUNC(t->dev->devfn)) ++ continue; + + if (match_slot(dev, t->dev)) { + dev_info(&dev->dev, "vpci: assign to virtual slot %d func %d\n", +- slot, PCI_FUNC(dev->devfn)); ++ slot, func); + list_add_tail(&dev_entry->list, + &vpci_dev->dev_list[slot]); +- func = PCI_FUNC(dev->devfn); + goto unlock; + } + } +@@ -123,7 +126,6 @@ static int __xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev, + slot); + list_add_tail(&dev_entry->list, + &vpci_dev->dev_list[slot]); +- func = dev->is_virtfn ? 0 : PCI_FUNC(dev->devfn); + goto unlock; + } + } +diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c +index e7c692cfb2cf8..cad56ea61376d 100644 +--- a/drivers/xen/xen-pciback/xenbus.c ++++ b/drivers/xen/xen-pciback/xenbus.c +@@ -359,7 +359,8 @@ out: + return err; + } + +-static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) ++static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev, ++ enum xenbus_state state) + { + int err = 0; + int num_devs; +@@ -373,9 +374,7 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) + dev_dbg(&pdev->xdev->dev, "Reconfiguring device ...\n"); + + mutex_lock(&pdev->dev_lock); +- /* Make sure we only reconfigure once */ +- if (xenbus_read_driver_state(pdev->xdev->nodename) != +- XenbusStateReconfiguring) ++ if (xenbus_read_driver_state(pdev->xdev->nodename) != state) + goto out; + + err = xenbus_scanf(XBT_NIL, pdev->xdev->nodename, "num_devs", "%d", +@@ -500,6 +499,10 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) + } + } + ++ if (state != XenbusStateReconfiguring) ++ /* Make sure we only reconfigure once. */ ++ goto out; ++ + err = xenbus_switch_state(pdev->xdev, XenbusStateReconfigured); + if (err) { + xenbus_dev_fatal(pdev->xdev, err, +@@ -525,7 +528,7 @@ static void xen_pcibk_frontend_changed(struct xenbus_device *xdev, + break; + + case XenbusStateReconfiguring: +- xen_pcibk_reconfigure(pdev); ++ xen_pcibk_reconfigure(pdev, XenbusStateReconfiguring); + break; + + case XenbusStateConnected: +@@ -664,6 +667,15 @@ static void xen_pcibk_be_watch(struct xenbus_watch *watch, + xen_pcibk_setup_backend(pdev); + break; + ++ case XenbusStateInitialised: ++ /* ++ * We typically move to Initialised when the first device was ++ * added. Hence subsequent devices getting added may need ++ * reconfiguring. ++ */ ++ xen_pcibk_reconfigure(pdev, XenbusStateInitialised); ++ break; ++ + default: + break; + } +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 4162ef602a024..94c24b2a211bf 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2967,6 +2967,7 @@ void btrfs_run_delayed_iputs(struct btrfs_fs_info *fs_info) + inode = list_first_entry(&fs_info->delayed_iputs, + struct btrfs_inode, delayed_iput); + run_delayed_iput_locked(fs_info, inode); ++ cond_resched_lock(&fs_info->delayed_iput_lock); + } + spin_unlock(&fs_info->delayed_iput_lock); + } +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 6e45a25adeff8..a9d1555301446 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1764,6 +1764,8 @@ smb2_copychunk_range(const unsigned int xid, + cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk)); + + /* Request server copy to target from src identified by key */ ++ kfree(retbuf); ++ retbuf = NULL; + rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, + trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE, + true /* is_fsctl */, (char *)pcchunk, +diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c +index 0681540c48d98..adf0707263a1b 100644 +--- a/fs/ecryptfs/crypto.c ++++ b/fs/ecryptfs/crypto.c +@@ -296,10 +296,8 @@ static int crypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat, + struct extent_crypt_result ecr; + int rc = 0; + +- if (!crypt_stat || !crypt_stat->tfm +- || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) +- return -EINVAL; +- ++ BUG_ON(!crypt_stat || !crypt_stat->tfm ++ || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)); + if (unlikely(ecryptfs_verbosity > 0)) { + ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n", + crypt_stat->key_size); +diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h +index 153734816b49c..d5b9c8d40c18e 100644 +--- a/include/linux/console_struct.h ++++ b/include/linux/console_struct.h +@@ -101,6 +101,7 @@ struct vc_data { + unsigned int vc_rows; + unsigned int vc_size_row; /* Bytes per row */ + unsigned int vc_scan_lines; /* # of scan lines */ ++ unsigned int vc_cell_height; /* CRTC character cell height */ + unsigned long vc_origin; /* [!] Start of real screen */ + unsigned long vc_scr_end; /* [!] End of real screen */ + unsigned long vc_visible_origin; /* [!] Top of visible window */ +diff --git a/ipc/mqueue.c b/ipc/mqueue.c +index beff0cfcd1e87..05d2176cc4712 100644 +--- a/ipc/mqueue.c ++++ b/ipc/mqueue.c +@@ -1003,12 +1003,14 @@ static inline void __pipelined_op(struct wake_q_head *wake_q, + struct mqueue_inode_info *info, + struct ext_wait_queue *this) + { ++ struct task_struct *task; ++ + list_del(&this->list); +- get_task_struct(this->task); ++ task = get_task_struct(this->task); + + /* see MQ_BARRIER for purpose/pairing */ + smp_store_release(&this->state, STATE_READY); +- wake_q_add_safe(wake_q, this->task); ++ wake_q_add_safe(wake_q, task); + } + + /* pipelined_send() - send a message directly to the task waiting in +diff --git a/ipc/msg.c b/ipc/msg.c +index acd1bc7af55a2..6e6c8e0c9380e 100644 +--- a/ipc/msg.c ++++ b/ipc/msg.c +@@ -251,11 +251,13 @@ static void expunge_all(struct msg_queue *msq, int res, + struct msg_receiver *msr, *t; + + list_for_each_entry_safe(msr, t, &msq->q_receivers, r_list) { +- get_task_struct(msr->r_tsk); ++ struct task_struct *r_tsk; ++ ++ r_tsk = get_task_struct(msr->r_tsk); + + /* see MSG_BARRIER for purpose/pairing */ + smp_store_release(&msr->r_msg, ERR_PTR(res)); +- wake_q_add_safe(wake_q, msr->r_tsk); ++ wake_q_add_safe(wake_q, r_tsk); + } + } + +diff --git a/ipc/sem.c b/ipc/sem.c +index f6c30a85dadf9..7d9c06b0ad6e2 100644 +--- a/ipc/sem.c ++++ b/ipc/sem.c +@@ -784,12 +784,14 @@ would_block: + static inline void wake_up_sem_queue_prepare(struct sem_queue *q, int error, + struct wake_q_head *wake_q) + { +- get_task_struct(q->sleeper); ++ struct task_struct *sleeper; ++ ++ sleeper = get_task_struct(q->sleeper); + + /* see SEM_BARRIER_2 for purpuse/pairing */ + smp_store_release(&q->status, error); + +- wake_q_add_safe(wake_q, q->sleeper); ++ wake_q_add_safe(wake_q, sleeper); + } + + static void unlink_queue(struct sem_array *sma, struct sem_queue *q) +diff --git a/kernel/kcsan/debugfs.c b/kernel/kcsan/debugfs.c +index 209ad8dcfcecf..62a52be8f6ba9 100644 +--- a/kernel/kcsan/debugfs.c ++++ b/kernel/kcsan/debugfs.c +@@ -261,9 +261,10 @@ static const struct file_operations debugfs_ops = + .release = single_release + }; + +-static void __init kcsan_debugfs_init(void) ++static int __init kcsan_debugfs_init(void) + { + debugfs_create_file("kcsan", 0644, NULL, NULL, &debugfs_ops); ++ return 0; + } + + late_initcall(kcsan_debugfs_init); +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 38d7c03e694cd..858b96b438cee 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -5664,7 +5664,7 @@ void lock_contended(struct lockdep_map *lock, unsigned long ip) + { + unsigned long flags; + +- trace_lock_acquired(lock, ip); ++ trace_lock_contended(lock, ip); + + if (unlikely(!lock_stat || !lockdep_enabled())) + return; +@@ -5682,7 +5682,7 @@ void lock_acquired(struct lockdep_map *lock, unsigned long ip) + { + unsigned long flags; + +- trace_lock_contended(lock, ip); ++ trace_lock_acquired(lock, ip); + + if (unlikely(!lock_stat || !lockdep_enabled())) + return; +diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c +index a7276aaf2abc0..db9301591e3fc 100644 +--- a/kernel/locking/mutex-debug.c ++++ b/kernel/locking/mutex-debug.c +@@ -57,7 +57,7 @@ void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, + task->blocked_on = waiter; + } + +-void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, ++void debug_mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, + struct task_struct *task) + { + DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list)); +@@ -65,7 +65,7 @@ void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter); + task->blocked_on = NULL; + +- list_del_init(&waiter->list); ++ INIT_LIST_HEAD(&waiter->list); + waiter->task = NULL; + } + +diff --git a/kernel/locking/mutex-debug.h b/kernel/locking/mutex-debug.h +index 1edd3f45a4ecb..53e631e1d76da 100644 +--- a/kernel/locking/mutex-debug.h ++++ b/kernel/locking/mutex-debug.h +@@ -22,7 +22,7 @@ extern void debug_mutex_free_waiter(struct mutex_waiter *waiter); + extern void debug_mutex_add_waiter(struct mutex *lock, + struct mutex_waiter *waiter, + struct task_struct *task); +-extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, ++extern void debug_mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter, + struct task_struct *task); + extern void debug_mutex_unlock(struct mutex *lock); + extern void debug_mutex_init(struct mutex *lock, const char *name, +diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c +index 2c25b830203cd..15ac7c4bb1117 100644 +--- a/kernel/locking/mutex.c ++++ b/kernel/locking/mutex.c +@@ -204,7 +204,7 @@ static inline bool __mutex_waiter_is_first(struct mutex *lock, struct mutex_wait + * Add @waiter to a given location in the lock wait_list and set the + * FLAG_WAITERS flag if it's the first waiter. + */ +-static void __sched ++static void + __mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, + struct list_head *list) + { +@@ -215,6 +215,16 @@ __mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter, + __mutex_set_flag(lock, MUTEX_FLAG_WAITERS); + } + ++static void ++__mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter) ++{ ++ list_del(&waiter->list); ++ if (likely(list_empty(&lock->wait_list))) ++ __mutex_clear_flag(lock, MUTEX_FLAGS); ++ ++ debug_mutex_remove_waiter(lock, waiter, current); ++} ++ + /* + * Give up ownership to a specific task, when @task = NULL, this is equivalent + * to a regular unlock. Sets PICKUP on a handoff, clears HANDOF, preserves +@@ -1071,9 +1081,7 @@ acquired: + __ww_mutex_check_waiters(lock, ww_ctx); + } + +- mutex_remove_waiter(lock, &waiter, current); +- if (likely(list_empty(&lock->wait_list))) +- __mutex_clear_flag(lock, MUTEX_FLAGS); ++ __mutex_remove_waiter(lock, &waiter); + + debug_mutex_free_waiter(&waiter); + +@@ -1090,7 +1098,7 @@ skip_wait: + + err: + __set_current_state(TASK_RUNNING); +- mutex_remove_waiter(lock, &waiter, current); ++ __mutex_remove_waiter(lock, &waiter); + err_early_kill: + spin_unlock(&lock->wait_lock); + debug_mutex_free_waiter(&waiter); +diff --git a/kernel/locking/mutex.h b/kernel/locking/mutex.h +index 1c2287d3fa719..f0c710b1d1927 100644 +--- a/kernel/locking/mutex.h ++++ b/kernel/locking/mutex.h +@@ -10,12 +10,10 @@ + * !CONFIG_DEBUG_MUTEXES case. Most of them are NOPs: + */ + +-#define mutex_remove_waiter(lock, waiter, task) \ +- __list_del((waiter)->list.prev, (waiter)->list.next) +- + #define debug_mutex_wake_waiter(lock, waiter) do { } while (0) + #define debug_mutex_free_waiter(waiter) do { } while (0) + #define debug_mutex_add_waiter(lock, waiter, ti) do { } while (0) ++#define debug_mutex_remove_waiter(lock, waiter, ti) do { } while (0) + #define debug_mutex_unlock(lock) do { } while (0) + #define debug_mutex_init(lock, name, key) do { } while (0) + +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index 79de1294f8ebd..eb4d04cb3aaf5 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -169,6 +169,21 @@ void __ptrace_unlink(struct task_struct *child) + spin_unlock(&child->sighand->siglock); + } + ++static bool looks_like_a_spurious_pid(struct task_struct *task) ++{ ++ if (task->exit_code != ((PTRACE_EVENT_EXEC << 8) | SIGTRAP)) ++ return false; ++ ++ if (task_pid_vnr(task) == task->ptrace_message) ++ return false; ++ /* ++ * The tracee changed its pid but the PTRACE_EVENT_EXEC event ++ * was not wait()'ed, most probably debugger targets the old ++ * leader which was destroyed in de_thread(). ++ */ ++ return true; ++} ++ + /* Ensure that nothing can wake it up, even SIGKILL */ + static bool ptrace_freeze_traced(struct task_struct *task) + { +@@ -179,7 +194,8 @@ static bool ptrace_freeze_traced(struct task_struct *task) + return ret; + + spin_lock_irq(&task->sighand->siglock); +- if (task_is_traced(task) && !__fatal_signal_pending(task)) { ++ if (task_is_traced(task) && !looks_like_a_spurious_pid(task) && ++ !__fatal_signal_pending(task)) { + task->state = __TASK_TRACED; + ret = true; + } +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index bf4bef13d9354..2b7879afc333b 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2733,6 +2733,15 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) + if (skb->len < sizeof(*key)) + return SMP_INVALID_PARAMS; + ++ /* Check if remote and local public keys are the same and debug key is ++ * not in use. ++ */ ++ if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && ++ !crypto_memneq(key, smp->local_pk, 64)) { ++ bt_dev_err(hdev, "Remote and local public keys are identical"); ++ return SMP_UNSPECIFIED; ++ } ++ + memcpy(smp->remote_pk, key, 64); + + if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index 25778765cbfe9..9897bd26a4388 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -38,7 +38,7 @@ config SND_OXFW + * Mackie(Loud) Onyx 1640i (former model) + * Mackie(Loud) Onyx Satellite + * Mackie(Loud) Tapco Link.Firewire +- * Mackie(Loud) d.2 pro/d.4 pro ++ * Mackie(Loud) d.4 pro + * Mackie(Loud) U.420/U.420d + * TASCAM FireOne + * Stanton Controllers & Systems 1 Deck/Mixer +@@ -84,7 +84,7 @@ config SND_BEBOB + * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 + * BridgeCo RDAudio1/Audio5 + * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) +- * Mackie d.2 (FireWire Option) ++ * Mackie d.2 (FireWire Option) and d.2 Pro + * Stanton FinalScratch 2 (ScratchAmp) + * Tascam IF-FW/DM + * Behringer XENIX UFX 1204/1604 +diff --git a/sound/firewire/amdtp-stream-trace.h b/sound/firewire/amdtp-stream-trace.h +index 26e7cb555d3c5..aa53c13b89d34 100644 +--- a/sound/firewire/amdtp-stream-trace.h ++++ b/sound/firewire/amdtp-stream-trace.h +@@ -14,8 +14,8 @@ + #include + + TRACE_EVENT(amdtp_packet, +- TP_PROTO(const struct amdtp_stream *s, u32 cycles, const __be32 *cip_header, unsigned int payload_length, unsigned int data_blocks, unsigned int data_block_counter, unsigned int index), +- TP_ARGS(s, cycles, cip_header, payload_length, data_blocks, data_block_counter, index), ++ TP_PROTO(const struct amdtp_stream *s, u32 cycles, const __be32 *cip_header, unsigned int payload_length, unsigned int data_blocks, unsigned int data_block_counter, unsigned int packet_index, unsigned int index), ++ TP_ARGS(s, cycles, cip_header, payload_length, data_blocks, data_block_counter, packet_index, index), + TP_STRUCT__entry( + __field(unsigned int, second) + __field(unsigned int, cycle) +@@ -48,7 +48,7 @@ TRACE_EVENT(amdtp_packet, + __entry->payload_quadlets = payload_length / sizeof(__be32); + __entry->data_blocks = data_blocks; + __entry->data_block_counter = data_block_counter, +- __entry->packet_index = s->packet_index; ++ __entry->packet_index = packet_index; + __entry->irq = !!in_interrupt(); + __entry->index = index; + ), +diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c +index 4e2f2bb7879fb..e0faa6601966c 100644 +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -526,7 +526,7 @@ static void build_it_pkt_header(struct amdtp_stream *s, unsigned int cycle, + } + + trace_amdtp_packet(s, cycle, cip_header, payload_length, data_blocks, +- data_block_counter, index); ++ data_block_counter, s->packet_index, index); + } + + static int check_cip_header(struct amdtp_stream *s, const __be32 *buf, +@@ -630,21 +630,27 @@ static int parse_ir_ctx_header(struct amdtp_stream *s, unsigned int cycle, + unsigned int *payload_length, + unsigned int *data_blocks, + unsigned int *data_block_counter, +- unsigned int *syt, unsigned int index) ++ unsigned int *syt, unsigned int packet_index, unsigned int index) + { + const __be32 *cip_header; ++ unsigned int cip_header_size; + int err; + + *payload_length = be32_to_cpu(ctx_header[0]) >> ISO_DATA_LENGTH_SHIFT; +- if (*payload_length > s->ctx_data.tx.ctx_header_size + +- s->ctx_data.tx.max_ctx_payload_length) { ++ ++ if (!(s->flags & CIP_NO_HEADER)) ++ cip_header_size = 8; ++ else ++ cip_header_size = 0; ++ ++ if (*payload_length > cip_header_size + s->ctx_data.tx.max_ctx_payload_length) { + dev_err(&s->unit->device, + "Detect jumbo payload: %04x %04x\n", +- *payload_length, s->ctx_data.tx.max_ctx_payload_length); ++ *payload_length, cip_header_size + s->ctx_data.tx.max_ctx_payload_length); + return -EIO; + } + +- if (!(s->flags & CIP_NO_HEADER)) { ++ if (cip_header_size > 0) { + cip_header = ctx_header + 2; + err = check_cip_header(s, cip_header, *payload_length, + data_blocks, data_block_counter, syt); +@@ -662,7 +668,7 @@ static int parse_ir_ctx_header(struct amdtp_stream *s, unsigned int cycle, + } + + trace_amdtp_packet(s, cycle, cip_header, *payload_length, *data_blocks, +- *data_block_counter, index); ++ *data_block_counter, packet_index, index); + + return err; + } +@@ -701,12 +707,13 @@ static int generate_device_pkt_descs(struct amdtp_stream *s, + unsigned int packets) + { + unsigned int dbc = s->data_block_counter; ++ unsigned int packet_index = s->packet_index; ++ unsigned int queue_size = s->queue_size; + int i; + int err; + + for (i = 0; i < packets; ++i) { + struct pkt_desc *desc = descs + i; +- unsigned int index = (s->packet_index + i) % s->queue_size; + unsigned int cycle; + unsigned int payload_length; + unsigned int data_blocks; +@@ -715,7 +722,7 @@ static int generate_device_pkt_descs(struct amdtp_stream *s, + cycle = compute_cycle_count(ctx_header[1]); + + err = parse_ir_ctx_header(s, cycle, ctx_header, &payload_length, +- &data_blocks, &dbc, &syt, i); ++ &data_blocks, &dbc, &syt, packet_index, i); + if (err < 0) + return err; + +@@ -723,13 +730,15 @@ static int generate_device_pkt_descs(struct amdtp_stream *s, + desc->syt = syt; + desc->data_blocks = data_blocks; + desc->data_block_counter = dbc; +- desc->ctx_payload = s->buffer.packets[index].buffer; ++ desc->ctx_payload = s->buffer.packets[packet_index].buffer; + + if (!(s->flags & CIP_DBC_IS_END_EVENT)) + dbc = (dbc + desc->data_blocks) & 0xff; + + ctx_header += + s->ctx_data.tx.ctx_header_size / sizeof(*ctx_header); ++ ++ packet_index = (packet_index + 1) % queue_size; + } + + s->data_block_counter = dbc; +@@ -1065,23 +1074,22 @@ static int amdtp_stream_start(struct amdtp_stream *s, int channel, int speed, + s->data_block_counter = 0; + } + +- /* initialize packet buffer */ ++ // initialize packet buffer. ++ max_ctx_payload_size = amdtp_stream_get_max_payload(s); + if (s->direction == AMDTP_IN_STREAM) { + dir = DMA_FROM_DEVICE; + type = FW_ISO_CONTEXT_RECEIVE; +- if (!(s->flags & CIP_NO_HEADER)) ++ if (!(s->flags & CIP_NO_HEADER)) { ++ max_ctx_payload_size -= 8; + ctx_header_size = IR_CTX_HEADER_SIZE_CIP; +- else ++ } else { + ctx_header_size = IR_CTX_HEADER_SIZE_NO_CIP; +- +- max_ctx_payload_size = amdtp_stream_get_max_payload(s) - +- ctx_header_size; ++ } + } else { + dir = DMA_TO_DEVICE; + type = FW_ISO_CONTEXT_TRANSMIT; + ctx_header_size = 0; // No effect for IT context. + +- max_ctx_payload_size = amdtp_stream_get_max_payload(s); + if (!(s->flags & CIP_NO_HEADER)) + max_ctx_payload_size -= IT_PKT_HEADER_SIZE_CIP; + } +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index 2c8e3392a4903..daeecfa8b9aac 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -387,7 +387,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { + SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), + /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ + SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), +- /* Mackie, d.2 (Firewire Option) */ ++ // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). + SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), + /* Stanton, ScratchAmp */ + SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), +diff --git a/sound/firewire/dice/dice-alesis.c b/sound/firewire/dice/dice-alesis.c +index 0916864511d50..27c13b9cc9efd 100644 +--- a/sound/firewire/dice/dice-alesis.c ++++ b/sound/firewire/dice/dice-alesis.c +@@ -16,7 +16,7 @@ alesis_io14_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = { + static const unsigned int + alesis_io26_tx_pcm_chs[MAX_STREAMS][SND_DICE_RATE_MODE_COUNT] = { + {10, 10, 4}, /* Tx0 = Analog + S/PDIF. */ +- {16, 8, 0}, /* Tx1 = ADAT1 + ADAT2. */ ++ {16, 4, 0}, /* Tx1 = ADAT1 + ADAT2 (available at low rate). */ + }; + + int snd_dice_detect_alesis_formats(struct snd_dice *dice) +diff --git a/sound/firewire/dice/dice-tcelectronic.c b/sound/firewire/dice/dice-tcelectronic.c +index a8875d24ba2aa..43a3bcb15b3d1 100644 +--- a/sound/firewire/dice/dice-tcelectronic.c ++++ b/sound/firewire/dice/dice-tcelectronic.c +@@ -38,8 +38,8 @@ static const struct dice_tc_spec konnekt_24d = { + }; + + static const struct dice_tc_spec konnekt_live = { +- .tx_pcm_chs = {{16, 16, 16}, {0, 0, 0} }, +- .rx_pcm_chs = {{16, 16, 16}, {0, 0, 0} }, ++ .tx_pcm_chs = {{16, 16, 6}, {0, 0, 0} }, ++ .rx_pcm_chs = {{16, 16, 6}, {0, 0, 0} }, + .has_midi = true, + }; + +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index 1f1e3236efb8e..9eea25c46dc7e 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -355,7 +355,6 @@ static const struct ieee1394_device_id oxfw_id_table[] = { + * Onyx-i series (former models): 0x081216 + * Mackie Onyx Satellite: 0x00200f + * Tapco LINK.firewire 4x6: 0x000460 +- * d.2 pro: Unknown + * d.4 pro: Unknown + * U.420: Unknown + * U.420d: Unknown +diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c +index 438109f167d61..ae93191ffdc9f 100644 +--- a/sound/isa/sb/sb8.c ++++ b/sound/isa/sb/sb8.c +@@ -96,10 +96,6 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) + + /* block the 0x388 port to avoid PnP conflicts */ + acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); +- if (!acard->fm_res) { +- err = -EBUSY; +- goto _err; +- } + + if (port[dev] != SNDRV_AUTO_PORT) { + if ((err = snd_sbdsp_create(card, port[dev], irq[dev], +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 1fe70f2fe4fe8..43a63db4ab6ad 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -395,7 +395,6 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0282: + case 0x10ec0283: + case 0x10ec0286: +- case 0x10ec0287: + case 0x10ec0288: + case 0x10ec0285: + case 0x10ec0298: +@@ -406,6 +405,10 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0275: + alc_update_coef_idx(codec, 0xe, 0, 1<<0); + break; ++ case 0x10ec0287: ++ alc_update_coef_idx(codec, 0x10, 1<<9, 0); ++ alc_write_coef_idx(codec, 0x8, 0x4ab7); ++ break; + case 0x10ec0293: + alc_update_coef_idx(codec, 0xa, 1<<13, 0); + break; +@@ -5717,6 +5720,18 @@ static void alc_fixup_tpt470_dacs(struct hda_codec *codec, + spec->gen.preferred_dacs = preferred_pairs; + } + ++static void alc295_fixup_asus_dacs(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ static const hda_nid_t preferred_pairs[] = { ++ 0x17, 0x02, 0x21, 0x03, 0 ++ }; ++ struct alc_spec *spec = codec->spec; ++ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) ++ spec->gen.preferred_dacs = preferred_pairs; ++} ++ + static void alc_shutup_dell_xps13(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -6232,6 +6247,35 @@ static void alc294_fixup_gx502_hp(struct hda_codec *codec, + } + } + ++static void alc294_gu502_toggle_output(struct hda_codec *codec, ++ struct hda_jack_callback *cb) ++{ ++ /* Windows sets 0x10 to 0x8420 for Node 0x20 which is ++ * responsible from changes between speakers and headphones ++ */ ++ if (snd_hda_jack_detect_state(codec, 0x21) == HDA_JACK_PRESENT) ++ alc_write_coef_idx(codec, 0x10, 0x8420); ++ else ++ alc_write_coef_idx(codec, 0x10, 0x0a20); ++} ++ ++static void alc294_fixup_gu502_hp(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (!is_jack_detectable(codec, 0x21)) ++ return; ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ snd_hda_jack_detect_enable_callback(codec, 0x21, ++ alc294_gu502_toggle_output); ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ alc294_gu502_toggle_output(codec, NULL); ++ break; ++ } ++} ++ + static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -6449,6 +6493,9 @@ enum { + ALC294_FIXUP_ASUS_GX502_HP, + ALC294_FIXUP_ASUS_GX502_PINS, + ALC294_FIXUP_ASUS_GX502_VERBS, ++ ALC294_FIXUP_ASUS_GU502_HP, ++ ALC294_FIXUP_ASUS_GU502_PINS, ++ ALC294_FIXUP_ASUS_GU502_VERBS, + ALC285_FIXUP_HP_GPIO_LED, + ALC285_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_GPIO_LED, +@@ -6485,6 +6532,9 @@ enum { + ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST, + ALC256_FIXUP_ACER_HEADSET_MIC, + ALC285_FIXUP_IDEAPAD_S740_COEF, ++ ALC295_FIXUP_ASUS_DACS, ++ ALC295_FIXUP_HP_OMEN, ++ ALC285_FIXUP_HP_SPECTRE_X360, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7687,6 +7737,35 @@ static const struct hda_fixup alc269_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc294_fixup_gx502_hp, + }, ++ [ALC294_FIXUP_ASUS_GU502_PINS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a11050 }, /* rear HP mic */ ++ { 0x1a, 0x01a11830 }, /* rear external mic */ ++ { 0x21, 0x012110f0 }, /* rear HP out */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GU502_VERBS ++ }, ++ [ALC294_FIXUP_ASUS_GU502_VERBS] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* set 0x15 to HP-OUT ctrl */ ++ { 0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, 0xc0 }, ++ /* unmute the 0x15 amp */ ++ { 0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0xb000 }, ++ /* set 0x1b to HP-OUT */ ++ { 0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GU502_HP ++ }, ++ [ALC294_FIXUP_ASUS_GU502_HP] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc294_fixup_gu502_hp, ++ }, + [ALC294_FIXUP_ASUS_COEF_1B] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -7983,6 +8062,39 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269_FIXUP_THINKPAD_ACPI, + }, ++ [ALC295_FIXUP_ASUS_DACS] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc295_fixup_asus_dacs, ++ }, ++ [ALC295_FIXUP_HP_OMEN] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x12, 0xb7a60130 }, ++ { 0x13, 0x40000000 }, ++ { 0x14, 0x411111f0 }, ++ { 0x16, 0x411111f0 }, ++ { 0x17, 0x90170110 }, ++ { 0x18, 0x411111f0 }, ++ { 0x19, 0x02a11030 }, ++ { 0x1a, 0x411111f0 }, ++ { 0x1b, 0x04a19030 }, ++ { 0x1d, 0x40600001 }, ++ { 0x1e, 0x411111f0 }, ++ { 0x21, 0x03211020 }, ++ {} ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HP_LINE1_MIC1_LED, ++ }, ++ [ALC285_FIXUP_HP_SPECTRE_X360] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x14, 0x90170110 }, /* enable top speaker */ ++ {} ++ }, ++ .chained = true, ++ .chain_id = ALC285_FIXUP_SPEAKER2_TO_DAC1, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -8141,7 +8253,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8497, "HP Envy x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), ++ SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN), + SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), ++ SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360), + SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x103c, 0x86c7, "HP Envy AiO 32", ALC274_FIXUP_HP_ENVY_GPIO), + SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED), +@@ -8181,6 +8295,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), ++ SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS), + SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS), + SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), +@@ -8198,6 +8313,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), ++ SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), +@@ -8254,12 +8370,19 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x50b8, "Clevo NK50SZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50d5, "Clevo NP50D5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50f0, "Clevo NH50A[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f2, "Clevo NH50E[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x50f3, "Clevo NH58DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f5, "Clevo NH55EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x50f6, "Clevo NH55DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f3, "Clevo NH77DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f4, "Clevo NH77EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x70f6, "Clevo NH77DPQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8228, "Clevo NR40BU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8520, "Clevo NH50D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), +@@ -8277,9 +8400,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x8a51, "Clevo NH70RCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x8d50, "Clevo NH55RCQ-M", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x951d, "Clevo N950T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0x9600, "Clevo N960K[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x961d, "Clevo N960S[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL53RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL5XNU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1558, 0xc022, "Clevo NH77[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS), + SND_PCI_QUIRK(0x17aa, 0x1048, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), +@@ -8544,6 +8675,8 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, + {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"}, + {.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"}, ++ {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, ++ {.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"}, + {} + }; + #define ALC225_STANDARD_PINS \ +diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c +index 3349e455a871a..6fb6f36d0d377 100644 +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -354,6 +354,7 @@ struct ichdev { + unsigned int ali_slot; /* ALI DMA slot */ + struct ac97_pcm *pcm; + int pcm_open_flag; ++ unsigned int prepared:1; + unsigned int suspended: 1; + }; + +@@ -714,6 +715,9 @@ static inline void snd_intel8x0_update(struct intel8x0 *chip, struct ichdev *ich + int status, civ, i, step; + int ack = 0; + ++ if (!ichdev->prepared || ichdev->suspended) ++ return; ++ + spin_lock_irqsave(&chip->reg_lock, flags); + status = igetbyte(chip, port + ichdev->roff_sr); + civ = igetbyte(chip, port + ICH_REG_OFF_CIV); +@@ -904,6 +908,7 @@ static int snd_intel8x0_hw_params(struct snd_pcm_substream *substream, + if (ichdev->pcm_open_flag) { + snd_ac97_pcm_close(ichdev->pcm); + ichdev->pcm_open_flag = 0; ++ ichdev->prepared = 0; + } + err = snd_ac97_pcm_open(ichdev->pcm, params_rate(hw_params), + params_channels(hw_params), +@@ -925,6 +930,7 @@ static int snd_intel8x0_hw_free(struct snd_pcm_substream *substream) + if (ichdev->pcm_open_flag) { + snd_ac97_pcm_close(ichdev->pcm); + ichdev->pcm_open_flag = 0; ++ ichdev->prepared = 0; + } + return 0; + } +@@ -999,6 +1005,7 @@ static int snd_intel8x0_pcm_prepare(struct snd_pcm_substream *substream) + ichdev->pos_shift = (runtime->sample_bits > 16) ? 2 : 1; + } + snd_intel8x0_setup_periods(chip, ichdev); ++ ichdev->prepared = 1; + return 0; + } + +diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c +index a030dd65eb280..9602929b7de90 100644 +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -699,6 +699,10 @@ static int line6_init_cap_control(struct usb_line6 *line6) + line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); + if (!line6->buffer_message) + return -ENOMEM; ++ ++ ret = line6_init_midi(line6); ++ if (ret < 0) ++ return ret; + } else { + ret = line6_hwdep_init(line6); + if (ret < 0) +diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c +index cd44cb5f1310c..16e644330c4d6 100644 +--- a/sound/usb/line6/pod.c ++++ b/sound/usb/line6/pod.c +@@ -376,11 +376,6 @@ static int pod_init(struct usb_line6 *line6, + if (err < 0) + return err; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(line6); +- if (err < 0) +- return err; +- + /* initialize PCM subsystem: */ + err = line6_init_pcm(line6, &pod_pcm_properties); + if (err < 0) +diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c +index ed158f04de80f..c2245aa93b08f 100644 +--- a/sound/usb/line6/variax.c ++++ b/sound/usb/line6/variax.c +@@ -159,7 +159,6 @@ static int variax_init(struct usb_line6 *line6, + const struct usb_device_id *id) + { + struct usb_line6_variax *variax = line6_to_variax(line6); +- int err; + + line6->process_message = line6_variax_process_message; + line6->disconnect = line6_variax_disconnect; +@@ -172,11 +171,6 @@ static int variax_init(struct usb_line6 *line6, + if (variax->buffer_activate == NULL) + return -ENOMEM; + +- /* initialize MIDI subsystem: */ +- err = line6_init_midi(&variax->line6); +- if (err < 0) +- return err; +- + /* initiate startup procedure: */ + schedule_delayed_work(&line6->startup_work, + msecs_to_jiffies(VARIAX_STARTUP_DELAY1)); +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index cd46ca7cd28de..fa91290ad89db 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1889,8 +1889,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi, + ms_ep = find_usb_ms_endpoint_descriptor(hostep); + if (!ms_ep) + continue; ++ if (ms_ep->bLength <= sizeof(*ms_ep)) ++ continue; + if (ms_ep->bNumEmbMIDIJack > 0x10) + continue; ++ if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack) ++ continue; + if (usb_endpoint_dir_out(ep)) { + if (endpoints[epidx].out_ep) { + if (++epidx >= MIDI_MAX_ENDPOINTS) { +diff --git a/tools/testing/selftests/exec/Makefile b/tools/testing/selftests/exec/Makefile +index cf69b2fcce59e..dd61118df66ed 100644 +--- a/tools/testing/selftests/exec/Makefile ++++ b/tools/testing/selftests/exec/Makefile +@@ -28,8 +28,8 @@ $(OUTPUT)/execveat.denatured: $(OUTPUT)/execveat + cp $< $@ + chmod -x $@ + $(OUTPUT)/load_address_4096: load_address.c +- $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000 -pie $< -o $@ ++ $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000 -pie -static $< -o $@ + $(OUTPUT)/load_address_2097152: load_address.c +- $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x200000 -pie $< -o $@ ++ $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x200000 -pie -static $< -o $@ + $(OUTPUT)/load_address_16777216: load_address.c +- $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000000 -pie $< -o $@ ++ $(CC) $(CFLAGS) $(LDFLAGS) -Wl,-z,max-page-size=0x1000000 -pie -static $< -o $@ +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 1b6c7d33c4ff2..dc21dc49b426f 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -1753,16 +1753,25 @@ TEST_F(TRACE_poke, getpid_runs_normally) + # define SYSCALL_RET_SET(_regs, _val) \ + do { \ + typeof(_val) _result = (_val); \ +- /* \ +- * A syscall error is signaled by CR0 SO bit \ +- * and the code is stored as a positive value. \ +- */ \ +- if (_result < 0) { \ +- SYSCALL_RET(_regs) = -_result; \ +- (_regs).ccr |= 0x10000000; \ +- } else { \ ++ if ((_regs.trap & 0xfff0) == 0x3000) { \ ++ /* \ ++ * scv 0 system call uses -ve result \ ++ * for error, so no need to adjust. \ ++ */ \ + SYSCALL_RET(_regs) = _result; \ +- (_regs).ccr &= ~0x10000000; \ ++ } else { \ ++ /* \ ++ * A syscall error is signaled by the \ ++ * CR0 SO bit and the code is stored as \ ++ * a positive value. \ ++ */ \ ++ if (_result < 0) { \ ++ SYSCALL_RET(_regs) = -_result; \ ++ (_regs).ccr |= 0x10000000; \ ++ } else { \ ++ SYSCALL_RET(_regs) = _result; \ ++ (_regs).ccr &= ~0x10000000; \ ++ } \ + } \ + } while (0) + # define SYSCALL_RET_SET_ON_PTRACE_EXIT