From 4e2da08c27ad8ddea2ad1c52b0d11a1d21640b26 Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Sat, 8 Oct 2016 09:47:46 +0200 Subject: [PATCH] Udoo NEXT upstream patches --- .../kernel/udoo-next/03-patch-4.4.22-23.patch | 2907 +++++++++++++++++ .../kernel/udoo-next/03-patch-4.4.23-24.patch | 2457 ++++++++++++++ 2 files changed, 5364 insertions(+) create mode 100644 patch/kernel/udoo-next/03-patch-4.4.22-23.patch create mode 100644 patch/kernel/udoo-next/03-patch-4.4.23-24.patch diff --git a/patch/kernel/udoo-next/03-patch-4.4.22-23.patch b/patch/kernel/udoo-next/03-patch-4.4.22-23.patch new file mode 100644 index 0000000000..5ea7450adf --- /dev/null +++ b/patch/kernel/udoo-next/03-patch-4.4.22-23.patch @@ -0,0 +1,2907 @@ +diff --git a/Makefile b/Makefile +index a6512f4eec9f..95421b688f23 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 22 ++SUBLEVEL = 23 + EXTRAVERSION = + NAME = Blurry Fish Butt + +@@ -128,6 +128,10 @@ _all: + # Cancel implicit rules on top Makefile + $(CURDIR)/Makefile Makefile: ; + ++ifneq ($(words $(subst :, ,$(CURDIR))), 1) ++ $(error main directory cannot contain spaces nor colons) ++endif ++ + ifneq ($(KBUILD_OUTPUT),) + # Invoke a second make in the output directory, passing relevant variables + # check that the output directory actually exists +@@ -495,6 +499,12 @@ ifeq ($(KBUILD_EXTMOD),) + endif + endif + endif ++# install and module_install need also be processed one by one ++ifneq ($(filter install,$(MAKECMDGOALS)),) ++ ifneq ($(filter modules_install,$(MAKECMDGOALS)),) ++ mixed-targets := 1 ++ endif ++endif + + ifeq ($(mixed-targets),1) + # =========================================================================== +@@ -606,11 +616,16 @@ ARCH_CFLAGS := + include arch/$(SRCARCH)/Makefile + + KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,) ++KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,) + + ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE +-KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,) ++KBUILD_CFLAGS += -Os + else ++ifdef CONFIG_PROFILE_ALL_BRANCHES + KBUILD_CFLAGS += -O2 ++else ++KBUILD_CFLAGS += -O2 ++endif + endif + + # Tell gcc to never replace conditional load with a non-conditional one +@@ -1260,7 +1275,7 @@ help: + @echo ' firmware_install- Install all firmware to INSTALL_FW_PATH' + @echo ' (default: $$(INSTALL_MOD_PATH)/lib/firmware)' + @echo ' dir/ - Build all files in dir and below' +- @echo ' dir/file.[oisS] - Build specified target only' ++ @echo ' dir/file.[ois] - Build specified target only' + @echo ' dir/file.lst - Build specified mixed source/assembly target only' + @echo ' (requires a recent binutils and recent build (System.map))' + @echo ' dir/file.ko - Build module including final link' +@@ -1500,11 +1515,11 @@ image_name: + # Clear a bunch of variables before executing the submake + tools/: FORCE + $(Q)mkdir -p $(objtree)/tools +- $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(O) subdir=tools -C $(src)/tools/ ++ $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ + + tools/%: FORCE + $(Q)mkdir -p $(objtree)/tools +- $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(O) subdir=tools -C $(src)/tools/ $* ++ $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ $* + + # Single targets + # --------------------------------------------------------------------------- +diff --git a/arch/arm/crypto/aes-ce-glue.c b/arch/arm/crypto/aes-ce-glue.c +index b445a5d56f43..593da7ffb449 100644 +--- a/arch/arm/crypto/aes-ce-glue.c ++++ b/arch/arm/crypto/aes-ce-glue.c +@@ -279,7 +279,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst, + err = blkcipher_walk_done(desc, &walk, + walk.nbytes % AES_BLOCK_SIZE); + } +- if (nbytes) { ++ if (walk.nbytes % AES_BLOCK_SIZE) { + u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE; + u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE; + u8 __aligned(8) tail[AES_BLOCK_SIZE]; +diff --git a/arch/arm/mach-pxa/idp.c b/arch/arm/mach-pxa/idp.c +index f6d02e4cbcda..5c87dff5d46e 100644 +--- a/arch/arm/mach-pxa/idp.c ++++ b/arch/arm/mach-pxa/idp.c +@@ -83,7 +83,8 @@ static struct resource smc91x_resources[] = { + }; + + static struct smc91x_platdata smc91x_platdata = { +- .flags = SMC91X_USE_32BIT | SMC91X_USE_DMA | SMC91X_NOWAIT, ++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT | ++ SMC91X_USE_DMA | SMC91X_NOWAIT, + }; + + static struct platform_device smc91x_device = { +diff --git a/arch/arm/mach-pxa/xcep.c b/arch/arm/mach-pxa/xcep.c +index 13b1d4586d7d..9001312710f7 100644 +--- a/arch/arm/mach-pxa/xcep.c ++++ b/arch/arm/mach-pxa/xcep.c +@@ -120,7 +120,8 @@ static struct resource smc91x_resources[] = { + }; + + static struct smc91x_platdata xcep_smc91x_info = { +- .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT | SMC91X_USE_DMA, ++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT | ++ SMC91X_NOWAIT | SMC91X_USE_DMA, + }; + + static struct platform_device smc91x_device = { +diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c +index 44575edc44b1..cf0a7c2359f0 100644 +--- a/arch/arm/mach-realview/core.c ++++ b/arch/arm/mach-realview/core.c +@@ -95,7 +95,8 @@ static struct smsc911x_platform_config smsc911x_config = { + }; + + static struct smc91x_platdata smc91x_platdata = { +- .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT, ++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT | ++ SMC91X_NOWAIT, + }; + + static struct platform_device realview_eth_device = { +diff --git a/arch/arm/mach-sa1100/pleb.c b/arch/arm/mach-sa1100/pleb.c +index 1525d7b5f1b7..88149f85bc49 100644 +--- a/arch/arm/mach-sa1100/pleb.c ++++ b/arch/arm/mach-sa1100/pleb.c +@@ -45,7 +45,7 @@ static struct resource smc91x_resources[] = { + }; + + static struct smc91x_platdata smc91x_platdata = { +- .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT, ++ .flags = SMC91X_USE_16BIT | SMC91X_USE_8BIT | SMC91X_NOWAIT, + }; + + static struct platform_device smc91x_device = { +diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c +index 05d9e16c0dfd..6a51dfccfe71 100644 +--- a/arch/arm64/crypto/aes-glue.c ++++ b/arch/arm64/crypto/aes-glue.c +@@ -211,7 +211,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst, + err = blkcipher_walk_done(desc, &walk, + walk.nbytes % AES_BLOCK_SIZE); + } +- if (nbytes) { ++ if (walk.nbytes % AES_BLOCK_SIZE) { + u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE; + u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE; + u8 __aligned(8) tail[AES_BLOCK_SIZE]; +diff --git a/arch/blackfin/mach-bf561/boards/cm_bf561.c b/arch/blackfin/mach-bf561/boards/cm_bf561.c +index c6db52ba3a06..10c57771822d 100644 +--- a/arch/blackfin/mach-bf561/boards/cm_bf561.c ++++ b/arch/blackfin/mach-bf561/boards/cm_bf561.c +@@ -146,7 +146,8 @@ static struct platform_device hitachi_fb_device = { + #include + + static struct smc91x_platdata smc91x_info = { +- .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT, ++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT | ++ SMC91X_NOWAIT, + .leda = RPC_LED_100_10, + .ledb = RPC_LED_TX_RX, + }; +diff --git a/arch/blackfin/mach-bf561/boards/ezkit.c b/arch/blackfin/mach-bf561/boards/ezkit.c +index 2de71e8c104b..93c22468cc14 100644 +--- a/arch/blackfin/mach-bf561/boards/ezkit.c ++++ b/arch/blackfin/mach-bf561/boards/ezkit.c +@@ -134,7 +134,8 @@ static struct platform_device net2272_bfin_device = { + #include + + static struct smc91x_platdata smc91x_info = { +- .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT, ++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT | ++ SMC91X_NOWAIT, + .leda = RPC_LED_100_10, + .ledb = RPC_LED_TX_RX, + }; +diff --git a/arch/mips/Kconfig.debug b/arch/mips/Kconfig.debug +index f0e314ceb8ba..7f975b20b20c 100644 +--- a/arch/mips/Kconfig.debug ++++ b/arch/mips/Kconfig.debug +@@ -113,42 +113,6 @@ config SPINLOCK_TEST + help + Add several files to the debugfs to test spinlock speed. + +-if CPU_MIPSR6 +- +-choice +- prompt "Compact branch policy" +- default MIPS_COMPACT_BRANCHES_OPTIMAL +- +-config MIPS_COMPACT_BRANCHES_NEVER +- bool "Never (force delay slot branches)" +- help +- Pass the -mcompact-branches=never flag to the compiler in order to +- force it to always emit branches with delay slots, and make no use +- of the compact branch instructions introduced by MIPSr6. This is +- useful if you suspect there may be an issue with compact branches in +- either the compiler or the CPU. +- +-config MIPS_COMPACT_BRANCHES_OPTIMAL +- bool "Optimal (use where beneficial)" +- help +- Pass the -mcompact-branches=optimal flag to the compiler in order for +- it to make use of compact branch instructions where it deems them +- beneficial, and use branches with delay slots elsewhere. This is the +- default compiler behaviour, and should be used unless you have a +- reason to choose otherwise. +- +-config MIPS_COMPACT_BRANCHES_ALWAYS +- bool "Always (force compact branches)" +- help +- Pass the -mcompact-branches=always flag to the compiler in order to +- force it to always emit compact branches, making no use of branch +- instructions with delay slots. This can result in more compact code +- which may be beneficial in some scenarios. +- +-endchoice +- +-endif # CPU_MIPSR6 +- + config SCACHE_DEBUGFS + bool "L2 cache debugfs entries" + depends on DEBUG_FS +diff --git a/arch/mips/Makefile b/arch/mips/Makefile +index 3f70ba54ae21..252e347958f3 100644 +--- a/arch/mips/Makefile ++++ b/arch/mips/Makefile +@@ -204,10 +204,6 @@ toolchain-msa := $(call cc-option-yn,$(mips-cflags) -mhard-float -mfp64 -Wa$( + cflags-$(toolchain-msa) += -DTOOLCHAIN_SUPPORTS_MSA + endif + +-cflags-$(CONFIG_MIPS_COMPACT_BRANCHES_NEVER) += -mcompact-branches=never +-cflags-$(CONFIG_MIPS_COMPACT_BRANCHES_OPTIMAL) += -mcompact-branches=optimal +-cflags-$(CONFIG_MIPS_COMPACT_BRANCHES_ALWAYS) += -mcompact-branches=always +- + # + # Firmware support + # +diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h +index e689b894353c..8dedee1def83 100644 +--- a/arch/mips/include/asm/asmmacro.h ++++ b/arch/mips/include/asm/asmmacro.h +@@ -135,6 +135,7 @@ + ldc1 $f28, THREAD_FPR28(\thread) + ldc1 $f30, THREAD_FPR30(\thread) + ctc1 \tmp, fcr31 ++ .set pop + .endm + + .macro fpu_restore_16odd thread +diff --git a/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h b/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h +index 2f82bfa3a773..c9f5769dfc8f 100644 +--- a/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h ++++ b/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h +@@ -11,11 +11,13 @@ + #define CP0_EBASE $15, 1 + + .macro kernel_entry_setup ++#ifdef CONFIG_SMP + mfc0 t0, CP0_EBASE + andi t0, t0, 0x3ff # CPUNum + beqz t0, 1f + # CPUs other than zero goto smp_bootstrap + j smp_bootstrap ++#endif /* CONFIG_SMP */ + + 1: + .endm +diff --git a/arch/mips/kernel/mips-r2-to-r6-emul.c b/arch/mips/kernel/mips-r2-to-r6-emul.c +index 4674a74a08b5..af27334d6809 100644 +--- a/arch/mips/kernel/mips-r2-to-r6-emul.c ++++ b/arch/mips/kernel/mips-r2-to-r6-emul.c +@@ -1164,7 +1164,9 @@ fpu_emul: + regs->regs[31] = r31; + regs->cp0_epc = epc; + if (!used_math()) { /* First time FPU user. */ ++ preempt_disable(); + err = init_fpu(); ++ preempt_enable(); + set_used_math(); + } + lose_fpu(1); /* Save FPU state for the emulator. */ +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 89847bee2b53..44a6f25e902e 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -593,14 +593,14 @@ int mips_set_process_fp_mode(struct task_struct *task, unsigned int value) + return -EOPNOTSUPP; + + /* Avoid inadvertently triggering emulation */ +- if ((value & PR_FP_MODE_FR) && cpu_has_fpu && +- !(current_cpu_data.fpu_id & MIPS_FPIR_F64)) ++ if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu && ++ !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64)) + return -EOPNOTSUPP; +- if ((value & PR_FP_MODE_FRE) && cpu_has_fpu && !cpu_has_fre) ++ if ((value & PR_FP_MODE_FRE) && raw_cpu_has_fpu && !cpu_has_fre) + return -EOPNOTSUPP; + + /* FR = 0 not supported in MIPS R6 */ +- if (!(value & PR_FP_MODE_FR) && cpu_has_fpu && cpu_has_mips_r6) ++ if (!(value & PR_FP_MODE_FR) && raw_cpu_has_fpu && cpu_has_mips_r6) + return -EOPNOTSUPP; + + /* Proceed with the mode switch */ +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index 2b521e07b860..7fef02a9eb85 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -174,6 +174,9 @@ asmlinkage void start_secondary(void) + cpumask_set_cpu(cpu, &cpu_coherent_mask); + notify_cpu_starting(cpu); + ++ cpumask_set_cpu(cpu, &cpu_callin_map); ++ synchronise_count_slave(cpu); ++ + set_cpu_online(cpu, true); + + set_cpu_sibling_map(cpu); +@@ -181,10 +184,6 @@ asmlinkage void start_secondary(void) + + calculate_cpu_foreign_map(); + +- cpumask_set_cpu(cpu, &cpu_callin_map); +- +- synchronise_count_slave(cpu); +- + /* + * irq will be enabled in ->smp_finish(), enabling it too early + * is dangerous. +diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c +index 975e99759bab..5649a9e429e0 100644 +--- a/arch/mips/kernel/vdso.c ++++ b/arch/mips/kernel/vdso.c +@@ -39,16 +39,16 @@ static struct vm_special_mapping vdso_vvar_mapping = { + static void __init init_vdso_image(struct mips_vdso_image *image) + { + unsigned long num_pages, i; ++ unsigned long data_pfn; + + BUG_ON(!PAGE_ALIGNED(image->data)); + BUG_ON(!PAGE_ALIGNED(image->size)); + + num_pages = image->size / PAGE_SIZE; + +- for (i = 0; i < num_pages; i++) { +- image->mapping.pages[i] = +- virt_to_page(image->data + (i * PAGE_SIZE)); +- } ++ data_pfn = __phys_to_pfn(__pa_symbol(image->data)); ++ for (i = 0; i < num_pages; i++) ++ image->mapping.pages[i] = pfn_to_page(data_pfn + i); + } + + static int __init init_vdso(void) +diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c +index 8cc1622b2ee0..dca7bc87dad9 100644 +--- a/crypto/blkcipher.c ++++ b/crypto/blkcipher.c +@@ -234,6 +234,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc, + return blkcipher_walk_done(desc, walk, -EINVAL); + } + ++ bsize = min(walk->walk_blocksize, n); ++ + walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY | + BLKCIPHER_WALK_DIFF); + if (!scatterwalk_aligned(&walk->in, walk->alignmask) || +@@ -246,7 +248,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc, + } + } + +- bsize = min(walk->walk_blocksize, n); + n = scatterwalk_clamp(&walk->in, n); + n = scatterwalk_clamp(&walk->out, n); + +diff --git a/crypto/echainiv.c b/crypto/echainiv.c +index b96a84560b67..343a74e96e2a 100644 +--- a/crypto/echainiv.c ++++ b/crypto/echainiv.c +@@ -1,8 +1,8 @@ + /* + * echainiv: Encrypted Chain IV Generator + * +- * This generator generates an IV based on a sequence number by xoring it +- * with a salt and then encrypting it with the same key as used to encrypt ++ * This generator generates an IV based on a sequence number by multiplying ++ * it with a salt and then encrypting it with the same key as used to encrypt + * the plain text. This algorithm requires that the block size be equal + * to the IV size. It is mainly useful for CBC. + * +@@ -23,81 +23,17 @@ + #include + #include + #include +-#include + #include +-#include +-#include ++#include + #include + +-#define MAX_IV_SIZE 16 +- +-static DEFINE_PER_CPU(u32 [MAX_IV_SIZE / sizeof(u32)], echainiv_iv); +- +-/* We don't care if we get preempted and read/write IVs from the next CPU. */ +-static void echainiv_read_iv(u8 *dst, unsigned size) +-{ +- u32 *a = (u32 *)dst; +- u32 __percpu *b = echainiv_iv; +- +- for (; size >= 4; size -= 4) { +- *a++ = this_cpu_read(*b); +- b++; +- } +-} +- +-static void echainiv_write_iv(const u8 *src, unsigned size) +-{ +- const u32 *a = (const u32 *)src; +- u32 __percpu *b = echainiv_iv; +- +- for (; size >= 4; size -= 4) { +- this_cpu_write(*b, *a); +- a++; +- b++; +- } +-} +- +-static void echainiv_encrypt_complete2(struct aead_request *req, int err) +-{ +- struct aead_request *subreq = aead_request_ctx(req); +- struct crypto_aead *geniv; +- unsigned int ivsize; +- +- if (err == -EINPROGRESS) +- return; +- +- if (err) +- goto out; +- +- geniv = crypto_aead_reqtfm(req); +- ivsize = crypto_aead_ivsize(geniv); +- +- echainiv_write_iv(subreq->iv, ivsize); +- +- if (req->iv != subreq->iv) +- memcpy(req->iv, subreq->iv, ivsize); +- +-out: +- if (req->iv != subreq->iv) +- kzfree(subreq->iv); +-} +- +-static void echainiv_encrypt_complete(struct crypto_async_request *base, +- int err) +-{ +- struct aead_request *req = base->data; +- +- echainiv_encrypt_complete2(req, err); +- aead_request_complete(req, err); +-} +- + static int echainiv_encrypt(struct aead_request *req) + { + struct crypto_aead *geniv = crypto_aead_reqtfm(req); + struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv); + struct aead_request *subreq = aead_request_ctx(req); +- crypto_completion_t compl; +- void *data; ++ __be64 nseqno; ++ u64 seqno; + u8 *info; + unsigned int ivsize = crypto_aead_ivsize(geniv); + int err; +@@ -107,8 +43,6 @@ static int echainiv_encrypt(struct aead_request *req) + + aead_request_set_tfm(subreq, ctx->child); + +- compl = echainiv_encrypt_complete; +- data = req; + info = req->iv; + + if (req->src != req->dst) { +@@ -123,29 +57,30 @@ static int echainiv_encrypt(struct aead_request *req) + return err; + } + +- if (unlikely(!IS_ALIGNED((unsigned long)info, +- crypto_aead_alignmask(geniv) + 1))) { +- info = kmalloc(ivsize, req->base.flags & +- CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL: +- GFP_ATOMIC); +- if (!info) +- return -ENOMEM; +- +- memcpy(info, req->iv, ivsize); +- } +- +- aead_request_set_callback(subreq, req->base.flags, compl, data); ++ aead_request_set_callback(subreq, req->base.flags, ++ req->base.complete, req->base.data); + aead_request_set_crypt(subreq, req->dst, req->dst, + req->cryptlen, info); + aead_request_set_ad(subreq, req->assoclen); + +- crypto_xor(info, ctx->salt, ivsize); ++ memcpy(&nseqno, info + ivsize - 8, 8); ++ seqno = be64_to_cpu(nseqno); ++ memset(info, 0, ivsize); ++ + scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1); +- echainiv_read_iv(info, ivsize); + +- err = crypto_aead_encrypt(subreq); +- echainiv_encrypt_complete2(req, err); +- return err; ++ do { ++ u64 a; ++ ++ memcpy(&a, ctx->salt + ivsize - 8, 8); ++ ++ a |= 1; ++ a *= seqno; ++ ++ memcpy(info + ivsize - 8, &a, 8); ++ } while ((ivsize -= 8)); ++ ++ return crypto_aead_encrypt(subreq); + } + + static int echainiv_decrypt(struct aead_request *req) +@@ -192,8 +127,7 @@ static int echainiv_aead_create(struct crypto_template *tmpl, + alg = crypto_spawn_aead_alg(spawn); + + err = -EINVAL; +- if (inst->alg.ivsize & (sizeof(u32) - 1) || +- inst->alg.ivsize > MAX_IV_SIZE) ++ if (inst->alg.ivsize & (sizeof(u64) - 1) || !inst->alg.ivsize) + goto free_inst; + + inst->alg.encrypt = echainiv_encrypt; +@@ -202,7 +136,6 @@ static int echainiv_aead_create(struct crypto_template *tmpl, + inst->alg.init = aead_init_geniv; + inst->alg.exit = aead_exit_geniv; + +- inst->alg.base.cra_alignmask |= __alignof__(u32) - 1; + inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx); + inst->alg.base.cra_ctxsize += inst->alg.ivsize; + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/pm/nv40.c b/drivers/gpu/drm/nouveau/nvkm/engine/pm/nv40.c +index 4bef72a9d106..3fda594700e0 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/pm/nv40.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/pm/nv40.c +@@ -59,9 +59,11 @@ static void + nv40_perfctr_next(struct nvkm_pm *pm, struct nvkm_perfdom *dom) + { + struct nvkm_device *device = pm->engine.subdev.device; +- if (pm->sequence != pm->sequence) { ++ struct nv40_pm *nv40pm = container_of(pm, struct nv40_pm, base); ++ ++ if (nv40pm->sequence != pm->sequence) { + nvkm_wr32(device, 0x400084, 0x00000020); +- pm->sequence = pm->sequence; ++ nv40pm->sequence = pm->sequence; + } + } + +diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c +index 56e1d633875e..6e6c76080d6a 100644 +--- a/drivers/gpu/drm/qxl/qxl_draw.c ++++ b/drivers/gpu/drm/qxl/qxl_draw.c +@@ -136,6 +136,8 @@ static int qxl_palette_create_1bit(struct qxl_bo *palette_bo, + * correctly globaly, since that would require + * tracking all of our palettes. */ + ret = qxl_bo_kmap(palette_bo, (void **)&pal); ++ if (ret) ++ return ret; + pal->num_ents = 2; + pal->unique = unique++; + if (visual == FB_VISUAL_TRUECOLOR || visual == FB_VISUAL_DIRECTCOLOR) { +diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c +index 76e699f9ed97..eef3aa6007f1 100644 +--- a/drivers/i2c/busses/i2c-eg20t.c ++++ b/drivers/i2c/busses/i2c-eg20t.c +@@ -773,13 +773,6 @@ static int pch_i2c_probe(struct pci_dev *pdev, + /* Set the number of I2C channel instance */ + adap_info->ch_num = id->driver_data; + +- ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED, +- KBUILD_MODNAME, adap_info); +- if (ret) { +- pch_pci_err(pdev, "request_irq FAILED\n"); +- goto err_request_irq; +- } +- + for (i = 0; i < adap_info->ch_num; i++) { + pch_adap = &adap_info->pch_data[i].pch_adapter; + adap_info->pch_i2c_suspended = false; +@@ -796,6 +789,17 @@ static int pch_i2c_probe(struct pci_dev *pdev, + adap_info->pch_data[i].pch_base_address = base_addr + 0x100 * i; + + pch_adap->dev.parent = &pdev->dev; ++ } ++ ++ ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED, ++ KBUILD_MODNAME, adap_info); ++ if (ret) { ++ pch_pci_err(pdev, "request_irq FAILED\n"); ++ goto err_request_irq; ++ } ++ ++ for (i = 0; i < adap_info->ch_num; i++) { ++ pch_adap = &adap_info->pch_data[i].pch_adapter; + + pch_i2c_init(&adap_info->pch_data[i]); + +diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c +index fdcbdab808e9..33b11563cde7 100644 +--- a/drivers/i2c/busses/i2c-qup.c ++++ b/drivers/i2c/busses/i2c-qup.c +@@ -727,7 +727,8 @@ static int qup_i2c_pm_resume_runtime(struct device *device) + #ifdef CONFIG_PM_SLEEP + static int qup_i2c_suspend(struct device *device) + { +- qup_i2c_pm_suspend_runtime(device); ++ if (!pm_runtime_suspended(device)) ++ return qup_i2c_pm_suspend_runtime(device); + return 0; + } + +diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c +index 7ede941e9301..131b434af994 100644 +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -433,16 +433,15 @@ ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals) + scale_db = true; + case IIO_VAL_INT_PLUS_MICRO: + if (vals[1] < 0) +- return sprintf(buf, "-%ld.%06u%s\n", abs(vals[0]), +- -vals[1], +- scale_db ? " dB" : ""); ++ return sprintf(buf, "-%d.%06u%s\n", abs(vals[0]), ++ -vals[1], scale_db ? " dB" : ""); + else + return sprintf(buf, "%d.%06u%s\n", vals[0], vals[1], + scale_db ? " dB" : ""); + case IIO_VAL_INT_PLUS_NANO: + if (vals[1] < 0) +- return sprintf(buf, "-%ld.%09u\n", abs(vals[0]), +- -vals[1]); ++ return sprintf(buf, "-%d.%09u\n", abs(vals[0]), ++ -vals[1]); + else + return sprintf(buf, "%d.%09u\n", vals[0], vals[1]); + case IIO_VAL_FRACTIONAL: +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index 3821c4786662..565bb2c140ed 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -1858,10 +1858,11 @@ static int dmar_hp_remove_drhd(struct acpi_dmar_header *header, void *arg) + /* + * All PCI devices managed by this unit should have been destroyed. + */ +- if (!dmaru->include_all && dmaru->devices && dmaru->devices_cnt) ++ if (!dmaru->include_all && dmaru->devices && dmaru->devices_cnt) { + for_each_active_dev_scope(dmaru->devices, + dmaru->devices_cnt, i, dev) + return -EBUSY; ++ } + + ret = dmar_ir_hotplug(dmaru, false); + if (ret == 0) +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 24d81308a1a6..b7f852d824a3 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -4182,10 +4182,11 @@ int dmar_check_one_atsr(struct acpi_dmar_header *hdr, void *arg) + if (!atsru) + return 0; + +- if (!atsru->include_all && atsru->devices && atsru->devices_cnt) ++ if (!atsru->include_all && atsru->devices && atsru->devices_cnt) { + for_each_active_dev_scope(atsru->devices, atsru->devices_cnt, + i, dev) + return -EBUSY; ++ } + + return 0; + } +diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c +index f0480d687f17..ba780c45f645 100644 +--- a/drivers/media/platform/am437x/am437x-vpfe.c ++++ b/drivers/media/platform/am437x/am437x-vpfe.c +@@ -1706,7 +1706,7 @@ static int vpfe_get_app_input_index(struct vpfe_device *vpfe, + sdinfo = &cfg->sub_devs[i]; + client = v4l2_get_subdevdata(sdinfo->sd); + if (client->addr == curr_client->addr && +- client->adapter->nr == client->adapter->nr) { ++ client->adapter->nr == curr_client->adapter->nr) { + if (vpfe->current_input >= 1) + return -1; + *app_input_index = j + vpfe->current_input; +diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c +index 744ca5cacc9b..f9fa3fad728e 100644 +--- a/drivers/mtd/maps/pmcmsp-flash.c ++++ b/drivers/mtd/maps/pmcmsp-flash.c +@@ -75,15 +75,15 @@ static int __init init_msp_flash(void) + + printk(KERN_NOTICE "Found %d PMC flash devices\n", fcnt); + +- msp_flash = kmalloc(fcnt * sizeof(struct map_info *), GFP_KERNEL); ++ msp_flash = kcalloc(fcnt, sizeof(*msp_flash), GFP_KERNEL); + if (!msp_flash) + return -ENOMEM; + +- msp_parts = kmalloc(fcnt * sizeof(struct mtd_partition *), GFP_KERNEL); ++ msp_parts = kcalloc(fcnt, sizeof(*msp_parts), GFP_KERNEL); + if (!msp_parts) + goto free_msp_flash; + +- msp_maps = kcalloc(fcnt, sizeof(struct mtd_info), GFP_KERNEL); ++ msp_maps = kcalloc(fcnt, sizeof(*msp_maps), GFP_KERNEL); + if (!msp_maps) + goto free_msp_parts; + +diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c +index 142fc3d79463..784c6e1a0391 100644 +--- a/drivers/mtd/maps/sa1100-flash.c ++++ b/drivers/mtd/maps/sa1100-flash.c +@@ -230,8 +230,10 @@ static struct sa_info *sa1100_setup_mtd(struct platform_device *pdev, + + info->mtd = mtd_concat_create(cdev, info->num_subdev, + plat->name); +- if (info->mtd == NULL) ++ if (info->mtd == NULL) { + ret = -ENXIO; ++ goto err; ++ } + } + info->mtd->dev.parent = &pdev->dev; + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index b3d70a7a5262..5dca77e0ffed 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1317,9 +1317,10 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + slave_dev->name); + } + +- /* already enslaved */ +- if (slave_dev->flags & IFF_SLAVE) { +- netdev_dbg(bond_dev, "Error: Device was already enslaved\n"); ++ /* already in-use? */ ++ if (netdev_is_rx_handler_busy(slave_dev)) { ++ netdev_err(bond_dev, ++ "Error: Device is in use and cannot be enslaved\n"); + return -EBUSY; + } + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 41c0fc9f3b14..16f7cadda5c3 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -1268,11 +1268,10 @@ static int __maybe_unused flexcan_suspend(struct device *device) + struct flexcan_priv *priv = netdev_priv(dev); + int err; + +- err = flexcan_chip_disable(priv); +- if (err) +- return err; +- + if (netif_running(dev)) { ++ err = flexcan_chip_disable(priv); ++ if (err) ++ return err; + netif_stop_queue(dev); + netif_device_detach(dev); + } +@@ -1285,13 +1284,17 @@ static int __maybe_unused flexcan_resume(struct device *device) + { + struct net_device *dev = dev_get_drvdata(device); + struct flexcan_priv *priv = netdev_priv(dev); ++ int err; + + priv->can.state = CAN_STATE_ERROR_ACTIVE; + if (netif_running(dev)) { + netif_device_attach(dev); + netif_start_queue(dev); ++ err = flexcan_chip_enable(priv); ++ if (err) ++ return err; + } +- return flexcan_chip_enable(priv); ++ return 0; + } + + static SIMPLE_DEV_PM_OPS(flexcan_pm_ops, flexcan_suspend, flexcan_resume); +diff --git a/drivers/net/dsa/bcm_sf2.h b/drivers/net/dsa/bcm_sf2.h +index 6bba1c98d764..c7994e372284 100644 +--- a/drivers/net/dsa/bcm_sf2.h ++++ b/drivers/net/dsa/bcm_sf2.h +@@ -187,8 +187,8 @@ static inline void name##_writeq(struct bcm_sf2_priv *priv, u64 val, \ + static inline void intrl2_##which##_mask_clear(struct bcm_sf2_priv *priv, \ + u32 mask) \ + { \ +- intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR); \ + priv->irq##which##_mask &= ~(mask); \ ++ intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR); \ + } \ + static inline void intrl2_##which##_mask_set(struct bcm_sf2_priv *priv, \ + u32 mask) \ +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 037fc4cdf5af..cc199063612a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -143,13 +143,14 @@ static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx) + return cmd->cmd_buf + (idx << cmd->log_stride); + } + +-static u8 xor8_buf(void *buf, int len) ++static u8 xor8_buf(void *buf, size_t offset, int len) + { + u8 *ptr = buf; + u8 sum = 0; + int i; ++ int end = len + offset; + +- for (i = 0; i < len; i++) ++ for (i = offset; i < end; i++) + sum ^= ptr[i]; + + return sum; +@@ -157,41 +158,49 @@ static u8 xor8_buf(void *buf, int len) + + static int verify_block_sig(struct mlx5_cmd_prot_block *block) + { +- if (xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 1) != 0xff) ++ size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0); ++ int xor_len = sizeof(*block) - sizeof(block->data) - 1; ++ ++ if (xor8_buf(block, rsvd0_off, xor_len) != 0xff) + return -EINVAL; + +- if (xor8_buf(block, sizeof(*block)) != 0xff) ++ if (xor8_buf(block, 0, sizeof(*block)) != 0xff) + return -EINVAL; + + return 0; + } + +-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token, +- int csum) ++static void calc_block_sig(struct mlx5_cmd_prot_block *block) + { +- block->token = token; +- if (csum) { +- block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) - +- sizeof(block->data) - 2); +- block->sig = ~xor8_buf(block, sizeof(*block) - 1); +- } ++ int ctrl_xor_len = sizeof(*block) - sizeof(block->data) - 2; ++ size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0); ++ ++ block->ctrl_sig = ~xor8_buf(block, rsvd0_off, ctrl_xor_len); ++ block->sig = ~xor8_buf(block, 0, sizeof(*block) - 1); + } + +-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum) ++static void calc_chain_sig(struct mlx5_cmd_msg *msg) + { + struct mlx5_cmd_mailbox *next = msg->next; +- +- while (next) { +- calc_block_sig(next->buf, token, csum); ++ int size = msg->len; ++ int blen = size - min_t(int, sizeof(msg->first.data), size); ++ int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1) ++ / MLX5_CMD_DATA_BLOCK_SIZE; ++ int i = 0; ++ ++ for (i = 0; i < n && next; i++) { ++ calc_block_sig(next->buf); + next = next->next; + } + } + + static void set_signature(struct mlx5_cmd_work_ent *ent, int csum) + { +- ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay)); +- calc_chain_sig(ent->in, ent->token, csum); +- calc_chain_sig(ent->out, ent->token, csum); ++ ent->lay->sig = ~xor8_buf(ent->lay, 0, sizeof(*ent->lay)); ++ if (csum) { ++ calc_chain_sig(ent->in); ++ calc_chain_sig(ent->out); ++ } + } + + static void poll_timeout(struct mlx5_cmd_work_ent *ent) +@@ -222,12 +231,17 @@ static int verify_signature(struct mlx5_cmd_work_ent *ent) + struct mlx5_cmd_mailbox *next = ent->out->next; + int err; + u8 sig; ++ int size = ent->out->len; ++ int blen = size - min_t(int, sizeof(ent->out->first.data), size); ++ int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1) ++ / MLX5_CMD_DATA_BLOCK_SIZE; ++ int i = 0; + +- sig = xor8_buf(ent->lay, sizeof(*ent->lay)); ++ sig = xor8_buf(ent->lay, 0, sizeof(*ent->lay)); + if (sig != 0xff) + return -EINVAL; + +- while (next) { ++ for (i = 0; i < n && next; i++) { + err = verify_block_sig(next->buf); + if (err) + return err; +@@ -641,7 +655,6 @@ static void cmd_work_handler(struct work_struct *work) + spin_unlock_irqrestore(&cmd->alloc_lock, flags); + } + +- ent->token = alloc_token(cmd); + cmd->ent_arr[ent->idx] = ent; + lay = get_inst(cmd, ent->idx); + ent->lay = lay; +@@ -755,7 +768,8 @@ static u8 *get_status_ptr(struct mlx5_outbox_hdr *out) + static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, + struct mlx5_cmd_msg *out, void *uout, int uout_size, + mlx5_cmd_cbk_t callback, +- void *context, int page_queue, u8 *status) ++ void *context, int page_queue, u8 *status, ++ u8 token) + { + struct mlx5_cmd *cmd = &dev->cmd; + struct mlx5_cmd_work_ent *ent; +@@ -772,6 +786,8 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, + if (IS_ERR(ent)) + return PTR_ERR(ent); + ++ ent->token = token; ++ + if (!callback) + init_completion(&ent->done); + +@@ -844,7 +860,8 @@ static const struct file_operations fops = { + .write = dbg_write, + }; + +-static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size) ++static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size, ++ u8 token) + { + struct mlx5_cmd_prot_block *block; + struct mlx5_cmd_mailbox *next; +@@ -870,6 +887,7 @@ static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size) + memcpy(block->data, from, copy); + from += copy; + size -= copy; ++ block->token = token; + next = next->next; + } + +@@ -939,7 +957,8 @@ static void free_cmd_box(struct mlx5_core_dev *dev, + } + + static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev, +- gfp_t flags, int size) ++ gfp_t flags, int size, ++ u8 token) + { + struct mlx5_cmd_mailbox *tmp, *head = NULL; + struct mlx5_cmd_prot_block *block; +@@ -968,6 +987,7 @@ static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev, + tmp->next = head; + block->next = cpu_to_be64(tmp->next ? tmp->next->dma : 0); + block->block_num = cpu_to_be32(n - i - 1); ++ block->token = token; + head = tmp; + } + msg->next = head; +@@ -1351,7 +1371,7 @@ static struct mlx5_cmd_msg *alloc_msg(struct mlx5_core_dev *dev, int in_size, + } + + if (IS_ERR(msg)) +- msg = mlx5_alloc_cmd_msg(dev, gfp, in_size); ++ msg = mlx5_alloc_cmd_msg(dev, gfp, in_size, 0); + + return msg; + } +@@ -1376,6 +1396,7 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out, + int err; + u8 status = 0; + u32 drv_synd; ++ u8 token; + + if (pci_channel_offline(dev->pdev) || + dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) { +@@ -1394,20 +1415,22 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out, + return err; + } + +- err = mlx5_copy_to_msg(inb, in, in_size); ++ token = alloc_token(&dev->cmd); ++ ++ err = mlx5_copy_to_msg(inb, in, in_size, token); + if (err) { + mlx5_core_warn(dev, "err %d\n", err); + goto out_in; + } + +- outb = mlx5_alloc_cmd_msg(dev, gfp, out_size); ++ outb = mlx5_alloc_cmd_msg(dev, gfp, out_size, token); + if (IS_ERR(outb)) { + err = PTR_ERR(outb); + goto out_in; + } + + err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context, +- pages_queue, &status); ++ pages_queue, &status, token); + if (err) + goto out_out; + +@@ -1475,7 +1498,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev) + INIT_LIST_HEAD(&cmd->cache.med.head); + + for (i = 0; i < NUM_LONG_LISTS; i++) { +- msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE); ++ msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE, 0); + if (IS_ERR(msg)) { + err = PTR_ERR(msg); + goto ex_err; +@@ -1485,7 +1508,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev) + } + + for (i = 0; i < NUM_MED_LISTS; i++) { +- msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE); ++ msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE, 0); + if (IS_ERR(msg)) { + err = PTR_ERR(msg); + goto ex_err; +diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c +index 0e2fc1a844ab..8c44cf6ff7a2 100644 +--- a/drivers/net/ethernet/smsc/smc91x.c ++++ b/drivers/net/ethernet/smsc/smc91x.c +@@ -2269,6 +2269,13 @@ static int smc_drv_probe(struct platform_device *pdev) + if (pd) { + memcpy(&lp->cfg, pd, sizeof(lp->cfg)); + lp->io_shift = SMC91X_IO_SHIFT(lp->cfg.flags); ++ ++ if (!SMC_8BIT(lp) && !SMC_16BIT(lp)) { ++ dev_err(&pdev->dev, ++ "at least one of 8-bit or 16-bit access support is required.\n"); ++ ret = -ENXIO; ++ goto out_free_netdev; ++ } + } + + #if IS_BUILTIN(CONFIG_OF) +diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h +index a3c129e1e40a..29df0465daf4 100644 +--- a/drivers/net/ethernet/smsc/smc91x.h ++++ b/drivers/net/ethernet/smsc/smc91x.h +@@ -37,6 +37,27 @@ + #include + + /* ++ * Any 16-bit access is performed with two 8-bit accesses if the hardware ++ * can't do it directly. Most registers are 16-bit so those are mandatory. ++ */ ++#define SMC_outw_b(x, a, r) \ ++ do { \ ++ unsigned int __val16 = (x); \ ++ unsigned int __reg = (r); \ ++ SMC_outb(__val16, a, __reg); \ ++ SMC_outb(__val16 >> 8, a, __reg + (1 << SMC_IO_SHIFT)); \ ++ } while (0) ++ ++#define SMC_inw_b(a, r) \ ++ ({ \ ++ unsigned int __val16; \ ++ unsigned int __reg = r; \ ++ __val16 = SMC_inb(a, __reg); \ ++ __val16 |= SMC_inb(a, __reg + (1 << SMC_IO_SHIFT)) << 8; \ ++ __val16; \ ++ }) ++ ++/* + * Define your architecture specific bus configuration parameters here. + */ + +@@ -55,10 +76,30 @@ + #define SMC_IO_SHIFT (lp->io_shift) + + #define SMC_inb(a, r) readb((a) + (r)) +-#define SMC_inw(a, r) readw((a) + (r)) ++#define SMC_inw(a, r) \ ++ ({ \ ++ unsigned int __smc_r = r; \ ++ SMC_16BIT(lp) ? readw((a) + __smc_r) : \ ++ SMC_8BIT(lp) ? SMC_inw_b(a, __smc_r) : \ ++ ({ BUG(); 0; }); \ ++ }) ++ + #define SMC_inl(a, r) readl((a) + (r)) + #define SMC_outb(v, a, r) writeb(v, (a) + (r)) ++#define SMC_outw(v, a, r) \ ++ do { \ ++ unsigned int __v = v, __smc_r = r; \ ++ if (SMC_16BIT(lp)) \ ++ __SMC_outw(__v, a, __smc_r); \ ++ else if (SMC_8BIT(lp)) \ ++ SMC_outw_b(__v, a, __smc_r); \ ++ else \ ++ BUG(); \ ++ } while (0) ++ + #define SMC_outl(v, a, r) writel(v, (a) + (r)) ++#define SMC_insb(a, r, p, l) readsb((a) + (r), p, l) ++#define SMC_outsb(a, r, p, l) writesb((a) + (r), p, l) + #define SMC_insw(a, r, p, l) readsw((a) + (r), p, l) + #define SMC_outsw(a, r, p, l) writesw((a) + (r), p, l) + #define SMC_insl(a, r, p, l) readsl((a) + (r), p, l) +@@ -66,7 +107,7 @@ + #define SMC_IRQ_FLAGS (-1) /* from resource */ + + /* We actually can't write halfwords properly if not word aligned */ +-static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg) ++static inline void __SMC_outw(u16 val, void __iomem *ioaddr, int reg) + { + if ((machine_is_mainstone() || machine_is_stargate2() || + machine_is_pxa_idp()) && reg & 2) { +@@ -405,24 +446,8 @@ smc_pxa_dma_insw(void __iomem *ioaddr, struct smc_local *lp, int reg, int dma, + + #if ! SMC_CAN_USE_16BIT + +-/* +- * Any 16-bit access is performed with two 8-bit accesses if the hardware +- * can't do it directly. Most registers are 16-bit so those are mandatory. +- */ +-#define SMC_outw(x, ioaddr, reg) \ +- do { \ +- unsigned int __val16 = (x); \ +- SMC_outb( __val16, ioaddr, reg ); \ +- SMC_outb( __val16 >> 8, ioaddr, reg + (1 << SMC_IO_SHIFT));\ +- } while (0) +-#define SMC_inw(ioaddr, reg) \ +- ({ \ +- unsigned int __val16; \ +- __val16 = SMC_inb( ioaddr, reg ); \ +- __val16 |= SMC_inb( ioaddr, reg + (1 << SMC_IO_SHIFT)) << 8; \ +- __val16; \ +- }) +- ++#define SMC_outw(x, ioaddr, reg) SMC_outw_b(x, ioaddr, reg) ++#define SMC_inw(ioaddr, reg) SMC_inw_b(ioaddr, reg) + #define SMC_insw(a, r, p, l) BUG() + #define SMC_outsw(a, r, p, l) BUG() + +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index 47cd306dbb3c..bba0ca786aaa 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -640,8 +640,10 @@ phy_err: + int phy_start_interrupts(struct phy_device *phydev) + { + atomic_set(&phydev->irq_disable, 0); +- if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt", +- phydev) < 0) { ++ if (request_irq(phydev->irq, phy_interrupt, ++ IRQF_SHARED, ++ "phy_interrupt", ++ phydev) < 0) { + pr_warn("%s: Can't get IRQ %d (PHY)\n", + phydev->bus->name, phydev->irq); + phydev->irq = PHY_POLL; +diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c +index 1bdeacf7b257..bc70ce62bc03 100644 +--- a/drivers/net/wireless/ath/ath9k/init.c ++++ b/drivers/net/wireless/ath/ath9k/init.c +@@ -869,8 +869,8 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw) + hw->wiphy->interface_modes |= + BIT(NL80211_IFTYPE_P2P_DEVICE); + +- hw->wiphy->iface_combinations = if_comb; +- hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb); ++ hw->wiphy->iface_combinations = if_comb; ++ hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb); + } + + hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT; +diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c +index 93bdf684babe..ae047ab7a4df 100644 +--- a/drivers/net/wireless/iwlegacy/3945.c ++++ b/drivers/net/wireless/iwlegacy/3945.c +@@ -1019,12 +1019,13 @@ il3945_hw_txq_ctx_free(struct il_priv *il) + int txq_id; + + /* Tx queues */ +- if (il->txq) ++ if (il->txq) { + for (txq_id = 0; txq_id < il->hw_params.max_txq_num; txq_id++) + if (txq_id == IL39_CMD_QUEUE_NUM) + il_cmd_queue_free(il); + else + il_tx_queue_free(il, txq_id); ++ } + + /* free tx queue structure */ + il_free_txq_mem(il); +diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.c b/drivers/net/wireless/iwlwifi/dvm/calib.c +index 20e6aa910700..c148085742a0 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/calib.c ++++ b/drivers/net/wireless/iwlwifi/dvm/calib.c +@@ -901,7 +901,7 @@ static void iwlagn_gain_computation(struct iwl_priv *priv, + /* bound gain by 2 bits value max, 3rd bit is sign */ + data->delta_gain_code[i] = + min(abs(delta_g), +- (long) CHAIN_NOISE_MAX_DELTA_GAIN_CODE); ++ (s32) CHAIN_NOISE_MAX_DELTA_GAIN_CODE); + + if (delta_g < 0) + /* +diff --git a/drivers/power/max17042_battery.c b/drivers/power/max17042_battery.c +index 9c65f134d447..da7a75f82489 100644 +--- a/drivers/power/max17042_battery.c ++++ b/drivers/power/max17042_battery.c +@@ -457,13 +457,16 @@ static inline void max17042_write_model_data(struct max17042_chip *chip, + } + + static inline void max17042_read_model_data(struct max17042_chip *chip, +- u8 addr, u32 *data, int size) ++ u8 addr, u16 *data, int size) + { + struct regmap *map = chip->regmap; + int i; ++ u32 tmp; + +- for (i = 0; i < size; i++) +- regmap_read(map, addr + i, &data[i]); ++ for (i = 0; i < size; i++) { ++ regmap_read(map, addr + i, &tmp); ++ data[i] = (u16)tmp; ++ } + } + + static inline int max17042_model_data_compare(struct max17042_chip *chip, +@@ -486,7 +489,7 @@ static int max17042_init_model(struct max17042_chip *chip) + { + int ret; + int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl); +- u32 *temp_data; ++ u16 *temp_data; + + temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL); + if (!temp_data) +@@ -501,7 +504,7 @@ static int max17042_init_model(struct max17042_chip *chip) + ret = max17042_model_data_compare( + chip, + chip->pdata->config_data->cell_char_tbl, +- (u16 *)temp_data, ++ temp_data, + table_size); + + max10742_lock_model(chip); +@@ -514,7 +517,7 @@ static int max17042_verify_model_lock(struct max17042_chip *chip) + { + int i; + int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl); +- u32 *temp_data; ++ u16 *temp_data; + int ret = 0; + + temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL); +diff --git a/drivers/power/reset/hisi-reboot.c b/drivers/power/reset/hisi-reboot.c +index 9ab7f562a83b..f69387e12c1e 100644 +--- a/drivers/power/reset/hisi-reboot.c ++++ b/drivers/power/reset/hisi-reboot.c +@@ -53,13 +53,16 @@ static int hisi_reboot_probe(struct platform_device *pdev) + + if (of_property_read_u32(np, "reboot-offset", &reboot_offset) < 0) { + pr_err("failed to find reboot-offset property\n"); ++ iounmap(base); + return -EINVAL; + } + + err = register_restart_handler(&hisi_restart_nb); +- if (err) ++ if (err) { + dev_err(&pdev->dev, "cannot register restart handler (err=%d)\n", + err); ++ iounmap(base); ++ } + + return err; + } +diff --git a/drivers/power/tps65217_charger.c b/drivers/power/tps65217_charger.c +index d9f56730c735..040a40b4b173 100644 +--- a/drivers/power/tps65217_charger.c ++++ b/drivers/power/tps65217_charger.c +@@ -205,6 +205,7 @@ static int tps65217_charger_probe(struct platform_device *pdev) + if (!charger) + return -ENOMEM; + ++ platform_set_drvdata(pdev, charger); + charger->tps = tps; + charger->dev = &pdev->dev; + +diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c +index d24ca5f281b4..7831bc6b51dd 100644 +--- a/drivers/pwm/core.c ++++ b/drivers/pwm/core.c +@@ -889,7 +889,7 @@ EXPORT_SYMBOL_GPL(devm_pwm_put); + */ + bool pwm_can_sleep(struct pwm_device *pwm) + { +- return pwm->chip->can_sleep; ++ return true; + } + EXPORT_SYMBOL_GPL(pwm_can_sleep); + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 3f8d357b1bac..278e10cd771f 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -5941,11 +5941,11 @@ static void megasas_detach_one(struct pci_dev *pdev) + if (fusion->ld_drv_map[i]) + free_pages((ulong)fusion->ld_drv_map[i], + fusion->drv_map_pages); +- if (fusion->pd_seq_sync) +- dma_free_coherent(&instance->pdev->dev, +- pd_seq_map_sz, +- fusion->pd_seq_sync[i], +- fusion->pd_seq_phys[i]); ++ if (fusion->pd_seq_sync[i]) ++ dma_free_coherent(&instance->pdev->dev, ++ pd_seq_map_sz, ++ fusion->pd_seq_sync[i], ++ fusion->pd_seq_phys[i]); + } + free_pages((ulong)instance->ctrl_context, + instance->ctrl_context_pages); +diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c +index bb40f3728742..20314ff08be0 100644 +--- a/drivers/staging/iio/adc/ad7192.c ++++ b/drivers/staging/iio/adc/ad7192.c +@@ -236,7 +236,7 @@ static int ad7192_setup(struct ad7192_state *st, + st->mclk = pdata->ext_clk_hz; + else + st->mclk = AD7192_INT_FREQ_MHZ; +- break; ++ break; + default: + ret = -EINVAL; + goto out; +diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h +index c37149b929be..502d3892d8a4 100644 +--- a/fs/autofs4/autofs_i.h ++++ b/fs/autofs4/autofs_i.h +@@ -79,9 +79,13 @@ struct autofs_info { + }; + + #define AUTOFS_INF_EXPIRING (1<<0) /* dentry is in the process of expiring */ +-#define AUTOFS_INF_NO_RCU (1<<1) /* the dentry is being considered ++#define AUTOFS_INF_WANT_EXPIRE (1<<1) /* the dentry is being considered + * for expiry, so RCU_walk is +- * not permitted ++ * not permitted. If it progresses to ++ * actual expiry attempt, the flag is ++ * not cleared when EXPIRING is set - ++ * in that case it gets cleared only ++ * when it comes to clearing EXPIRING. + */ + #define AUTOFS_INF_PENDING (1<<2) /* dentry pending mount */ + +diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c +index 1cebc3c52fa5..7a5a598a2d94 100644 +--- a/fs/autofs4/expire.c ++++ b/fs/autofs4/expire.c +@@ -315,19 +315,17 @@ struct dentry *autofs4_expire_direct(struct super_block *sb, + if (ino->flags & AUTOFS_INF_PENDING) + goto out; + if (!autofs4_direct_busy(mnt, root, timeout, do_now)) { +- ino->flags |= AUTOFS_INF_NO_RCU; ++ ino->flags |= AUTOFS_INF_WANT_EXPIRE; + spin_unlock(&sbi->fs_lock); + synchronize_rcu(); + spin_lock(&sbi->fs_lock); + if (!autofs4_direct_busy(mnt, root, timeout, do_now)) { + ino->flags |= AUTOFS_INF_EXPIRING; +- smp_mb(); +- ino->flags &= ~AUTOFS_INF_NO_RCU; + init_completion(&ino->expire_complete); + spin_unlock(&sbi->fs_lock); + return root; + } +- ino->flags &= ~AUTOFS_INF_NO_RCU; ++ ino->flags &= ~AUTOFS_INF_WANT_EXPIRE; + } + out: + spin_unlock(&sbi->fs_lock); +@@ -417,6 +415,7 @@ static struct dentry *should_expire(struct dentry *dentry, + } + return NULL; + } ++ + /* + * Find an eligible tree to time-out + * A tree is eligible if :- +@@ -432,6 +431,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb, + struct dentry *root = sb->s_root; + struct dentry *dentry; + struct dentry *expired; ++ struct dentry *found; + struct autofs_info *ino; + + if (!root) +@@ -442,48 +442,54 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb, + + dentry = NULL; + while ((dentry = get_next_positive_subdir(dentry, root))) { ++ int flags = how; ++ + spin_lock(&sbi->fs_lock); + ino = autofs4_dentry_ino(dentry); +- if (ino->flags & AUTOFS_INF_NO_RCU) +- expired = NULL; +- else +- expired = should_expire(dentry, mnt, timeout, how); +- if (!expired) { ++ if (ino->flags & AUTOFS_INF_WANT_EXPIRE) { + spin_unlock(&sbi->fs_lock); + continue; + } ++ spin_unlock(&sbi->fs_lock); ++ ++ expired = should_expire(dentry, mnt, timeout, flags); ++ if (!expired) ++ continue; ++ ++ spin_lock(&sbi->fs_lock); + ino = autofs4_dentry_ino(expired); +- ino->flags |= AUTOFS_INF_NO_RCU; ++ ino->flags |= AUTOFS_INF_WANT_EXPIRE; + spin_unlock(&sbi->fs_lock); + synchronize_rcu(); +- spin_lock(&sbi->fs_lock); +- if (should_expire(expired, mnt, timeout, how)) { +- if (expired != dentry) +- dput(dentry); +- goto found; +- } + +- ino->flags &= ~AUTOFS_INF_NO_RCU; ++ /* Make sure a reference is not taken on found if ++ * things have changed. ++ */ ++ flags &= ~AUTOFS_EXP_LEAVES; ++ found = should_expire(expired, mnt, timeout, how); ++ if (!found || found != expired) ++ /* Something has changed, continue */ ++ goto next; ++ + if (expired != dentry) +- dput(expired); ++ dput(dentry); ++ ++ spin_lock(&sbi->fs_lock); ++ goto found; ++next: ++ spin_lock(&sbi->fs_lock); ++ ino->flags &= ~AUTOFS_INF_WANT_EXPIRE; + spin_unlock(&sbi->fs_lock); ++ if (expired != dentry) ++ dput(expired); + } + return NULL; + + found: + DPRINTK("returning %p %pd", expired, expired); + ino->flags |= AUTOFS_INF_EXPIRING; +- smp_mb(); +- ino->flags &= ~AUTOFS_INF_NO_RCU; + init_completion(&ino->expire_complete); + spin_unlock(&sbi->fs_lock); +- spin_lock(&sbi->lookup_lock); +- spin_lock(&expired->d_parent->d_lock); +- spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED); +- list_move(&expired->d_parent->d_subdirs, &expired->d_child); +- spin_unlock(&expired->d_lock); +- spin_unlock(&expired->d_parent->d_lock); +- spin_unlock(&sbi->lookup_lock); + return expired; + } + +@@ -492,15 +498,27 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk) + struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb); + struct autofs_info *ino = autofs4_dentry_ino(dentry); + int status; ++ int state; + + /* Block on any pending expire */ +- if (!(ino->flags & (AUTOFS_INF_EXPIRING | AUTOFS_INF_NO_RCU))) ++ if (!(ino->flags & AUTOFS_INF_WANT_EXPIRE)) + return 0; + if (rcu_walk) + return -ECHILD; + ++retry: + spin_lock(&sbi->fs_lock); +- if (ino->flags & AUTOFS_INF_EXPIRING) { ++ state = ino->flags & (AUTOFS_INF_WANT_EXPIRE | AUTOFS_INF_EXPIRING); ++ if (state == AUTOFS_INF_WANT_EXPIRE) { ++ spin_unlock(&sbi->fs_lock); ++ /* ++ * Possibly being selected for expire, wait until ++ * it's selected or not. ++ */ ++ schedule_timeout_uninterruptible(HZ/10); ++ goto retry; ++ } ++ if (state & AUTOFS_INF_EXPIRING) { + spin_unlock(&sbi->fs_lock); + + DPRINTK("waiting for expire %p name=%pd", dentry, dentry); +@@ -551,7 +569,7 @@ int autofs4_expire_run(struct super_block *sb, + ino = autofs4_dentry_ino(dentry); + /* avoid rapid-fire expire attempts if expiry fails */ + ino->last_used = now; +- ino->flags &= ~AUTOFS_INF_EXPIRING; ++ ino->flags &= ~(AUTOFS_INF_EXPIRING|AUTOFS_INF_WANT_EXPIRE); + complete_all(&ino->expire_complete); + spin_unlock(&sbi->fs_lock); + +@@ -579,7 +597,7 @@ int autofs4_do_expire_multi(struct super_block *sb, struct vfsmount *mnt, + spin_lock(&sbi->fs_lock); + /* avoid rapid-fire expire attempts if expiry fails */ + ino->last_used = now; +- ino->flags &= ~AUTOFS_INF_EXPIRING; ++ ino->flags &= ~(AUTOFS_INF_EXPIRING|AUTOFS_INF_WANT_EXPIRE); + complete_all(&ino->expire_complete); + spin_unlock(&sbi->fs_lock); + dput(dentry); +diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c +index c6d7d3dbd52a..7a54c6a867c8 100644 +--- a/fs/autofs4/root.c ++++ b/fs/autofs4/root.c +@@ -455,7 +455,7 @@ static int autofs4_d_manage(struct dentry *dentry, bool rcu_walk) + * a mount-trap. + */ + struct inode *inode; +- if (ino->flags & (AUTOFS_INF_EXPIRING | AUTOFS_INF_NO_RCU)) ++ if (ino->flags & AUTOFS_INF_WANT_EXPIRE) + return 0; + if (d_mountpoint(dentry)) + return 0; +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 65f30b3b04f9..a7e18dbadf74 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -1619,6 +1619,9 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file, + int namelen; + int ret = 0; + ++ if (!S_ISDIR(file_inode(file)->i_mode)) ++ return -ENOTDIR; ++ + ret = mnt_want_write_file(file); + if (ret) + goto out; +@@ -1676,6 +1679,9 @@ static noinline int btrfs_ioctl_snap_create(struct file *file, + struct btrfs_ioctl_vol_args *vol_args; + int ret; + ++ if (!S_ISDIR(file_inode(file)->i_mode)) ++ return -ENOTDIR; ++ + vol_args = memdup_user(arg, sizeof(*vol_args)); + if (IS_ERR(vol_args)) + return PTR_ERR(vol_args); +@@ -1699,6 +1705,9 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file, + bool readonly = false; + struct btrfs_qgroup_inherit *inherit = NULL; + ++ if (!S_ISDIR(file_inode(file)->i_mode)) ++ return -ENOTDIR; ++ + vol_args = memdup_user(arg, sizeof(*vol_args)); + if (IS_ERR(vol_args)) + return PTR_ERR(vol_args); +@@ -2345,6 +2354,9 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file, + int ret; + int err = 0; + ++ if (!S_ISDIR(dir->i_mode)) ++ return -ENOTDIR; ++ + vol_args = memdup_user(arg, sizeof(*vol_args)); + if (IS_ERR(vol_args)) + return PTR_ERR(vol_args); +diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c +index 5a7b3229b956..f34d6f5a5aca 100644 +--- a/fs/hostfs/hostfs_kern.c ++++ b/fs/hostfs/hostfs_kern.c +@@ -959,10 +959,11 @@ static int hostfs_fill_sb_common(struct super_block *sb, void *d, int silent) + + if (S_ISLNK(root_inode->i_mode)) { + char *name = follow_link(host_root_path); +- if (IS_ERR(name)) ++ if (IS_ERR(name)) { + err = PTR_ERR(name); +- else +- err = read_name(root_inode, name); ++ goto out_put; ++ } ++ err = read_name(root_inode, name); + kfree(name); + if (err) + goto out_put; +diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c +index d2f97ecca6a5..e0e5f7c3c99f 100644 +--- a/fs/notify/fanotify/fanotify.c ++++ b/fs/notify/fanotify/fanotify.c +@@ -67,18 +67,7 @@ static int fanotify_get_response(struct fsnotify_group *group, + + pr_debug("%s: group=%p event=%p\n", __func__, group, event); + +- wait_event(group->fanotify_data.access_waitq, event->response || +- atomic_read(&group->fanotify_data.bypass_perm)); +- +- if (!event->response) { /* bypass_perm set */ +- /* +- * Event was canceled because group is being destroyed. Remove +- * it from group's event list because we are responsible for +- * freeing the permission event. +- */ +- fsnotify_remove_event(group, &event->fae.fse); +- return 0; +- } ++ wait_event(group->fanotify_data.access_waitq, event->response); + + /* userspace responded, convert to something usable */ + switch (event->response) { +diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c +index 8e8e6bcd1d43..a64313868d3a 100644 +--- a/fs/notify/fanotify/fanotify_user.c ++++ b/fs/notify/fanotify/fanotify_user.c +@@ -358,16 +358,20 @@ static int fanotify_release(struct inode *ignored, struct file *file) + + #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS + struct fanotify_perm_event_info *event, *next; ++ struct fsnotify_event *fsn_event; + + /* +- * There may be still new events arriving in the notification queue +- * but since userspace cannot use fanotify fd anymore, no event can +- * enter or leave access_list by now. ++ * Stop new events from arriving in the notification queue. since ++ * userspace cannot use fanotify fd anymore, no event can enter or ++ * leave access_list by now either. + */ +- spin_lock(&group->fanotify_data.access_lock); +- +- atomic_inc(&group->fanotify_data.bypass_perm); ++ fsnotify_group_stop_queueing(group); + ++ /* ++ * Process all permission events on access_list and notification queue ++ * and simulate reply from userspace. ++ */ ++ spin_lock(&group->fanotify_data.access_lock); + list_for_each_entry_safe(event, next, &group->fanotify_data.access_list, + fae.fse.list) { + pr_debug("%s: found group=%p event=%p\n", __func__, group, +@@ -379,12 +383,21 @@ static int fanotify_release(struct inode *ignored, struct file *file) + spin_unlock(&group->fanotify_data.access_lock); + + /* +- * Since bypass_perm is set, newly queued events will not wait for +- * access response. Wake up the already sleeping ones now. +- * synchronize_srcu() in fsnotify_destroy_group() will wait for all +- * processes sleeping in fanotify_handle_event() waiting for access +- * response and thus also for all permission events to be freed. ++ * Destroy all non-permission events. For permission events just ++ * dequeue them and set the response. They will be freed once the ++ * response is consumed and fanotify_get_response() returns. + */ ++ mutex_lock(&group->notification_mutex); ++ while (!fsnotify_notify_queue_is_empty(group)) { ++ fsn_event = fsnotify_remove_first_event(group); ++ if (!(fsn_event->mask & FAN_ALL_PERM_EVENTS)) ++ fsnotify_destroy_event(group, fsn_event); ++ else ++ FANOTIFY_PE(fsn_event)->response = FAN_ALLOW; ++ } ++ mutex_unlock(&group->notification_mutex); ++ ++ /* Response for all permission events it set, wakeup waiters */ + wake_up(&group->fanotify_data.access_waitq); + #endif + +@@ -755,7 +768,6 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) + spin_lock_init(&group->fanotify_data.access_lock); + init_waitqueue_head(&group->fanotify_data.access_waitq); + INIT_LIST_HEAD(&group->fanotify_data.access_list); +- atomic_set(&group->fanotify_data.bypass_perm, 0); + #endif + switch (flags & FAN_ALL_CLASS_BITS) { + case FAN_CLASS_NOTIF: +diff --git a/fs/notify/group.c b/fs/notify/group.c +index d16b62cb2854..18eb30c6bd8f 100644 +--- a/fs/notify/group.c ++++ b/fs/notify/group.c +@@ -40,6 +40,17 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group) + } + + /* ++ * Stop queueing new events for this group. Once this function returns ++ * fsnotify_add_event() will not add any new events to the group's queue. ++ */ ++void fsnotify_group_stop_queueing(struct fsnotify_group *group) ++{ ++ mutex_lock(&group->notification_mutex); ++ group->shutdown = true; ++ mutex_unlock(&group->notification_mutex); ++} ++ ++/* + * Trying to get rid of a group. Remove all marks, flush all events and release + * the group reference. + * Note that another thread calling fsnotify_clear_marks_by_group() may still +@@ -47,6 +58,14 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group) + */ + void fsnotify_destroy_group(struct fsnotify_group *group) + { ++ /* ++ * Stop queueing new events. The code below is careful enough to not ++ * require this but fanotify needs to stop queuing events even before ++ * fsnotify_destroy_group() is called and this makes the other callers ++ * of fsnotify_destroy_group() to see the same behavior. ++ */ ++ fsnotify_group_stop_queueing(group); ++ + /* clear all inode marks for this group */ + fsnotify_clear_marks_by_group(group); + +diff --git a/fs/notify/notification.c b/fs/notify/notification.c +index a95d8e037aeb..e455e83ceeeb 100644 +--- a/fs/notify/notification.c ++++ b/fs/notify/notification.c +@@ -82,7 +82,8 @@ void fsnotify_destroy_event(struct fsnotify_group *group, + * Add an event to the group notification queue. The group can later pull this + * event off the queue to deal with. The function returns 0 if the event was + * added to the queue, 1 if the event was merged with some other queued event, +- * 2 if the queue of events has overflown. ++ * 2 if the event was not queued - either the queue of events has overflown ++ * or the group is shutting down. + */ + int fsnotify_add_event(struct fsnotify_group *group, + struct fsnotify_event *event, +@@ -96,6 +97,11 @@ int fsnotify_add_event(struct fsnotify_group *group, + + mutex_lock(&group->notification_mutex); + ++ if (group->shutdown) { ++ mutex_unlock(&group->notification_mutex); ++ return 2; ++ } ++ + if (group->q_len >= group->max_events) { + ret = 2; + /* Queue overflow event only if it isn't already queued */ +@@ -126,21 +132,6 @@ queue: + } + + /* +- * Remove @event from group's notification queue. It is the responsibility of +- * the caller to destroy the event. +- */ +-void fsnotify_remove_event(struct fsnotify_group *group, +- struct fsnotify_event *event) +-{ +- mutex_lock(&group->notification_mutex); +- if (!list_empty(&event->list)) { +- list_del_init(&event->list); +- group->q_len--; +- } +- mutex_unlock(&group->notification_mutex); +-} +- +-/* + * Remove and return the first event from the notification list. It is the + * responsibility of the caller to destroy the obtained event + */ +diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c +index f90931335c6b..2e11658676eb 100644 +--- a/fs/ocfs2/dlm/dlmconvert.c ++++ b/fs/ocfs2/dlm/dlmconvert.c +@@ -262,7 +262,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + struct dlm_lock *lock, int flags, int type) + { + enum dlm_status status; +- u8 old_owner = res->owner; + + mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type, + lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS); +@@ -329,7 +328,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + + spin_lock(&res->spinlock); + res->state &= ~DLM_LOCK_RES_IN_PROGRESS; +- lock->convert_pending = 0; + /* if it failed, move it back to granted queue. + * if master returns DLM_NORMAL and then down before sending ast, + * it may have already been moved to granted queue, reset to +@@ -338,12 +336,14 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm, + if (status != DLM_NOTQUEUED) + dlm_error(status); + dlm_revert_pending_convert(res, lock); +- } else if ((res->state & DLM_LOCK_RES_RECOVERING) || +- (old_owner != res->owner)) { +- mlog(0, "res %.*s is in recovering or has been recovered.\n", +- res->lockname.len, res->lockname.name); ++ } else if (!lock->convert_pending) { ++ mlog(0, "%s: res %.*s, owner died and lock has been moved back " ++ "to granted list, retry convert.\n", ++ dlm->name, res->lockname.len, res->lockname.name); + status = DLM_RECOVERING; + } ++ ++ lock->convert_pending = 0; + bail: + spin_unlock(&res->spinlock); + +diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c +index 77d30cbd944d..56dd3957cc91 100644 +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -1536,7 +1536,8 @@ static int ocfs2_zero_partial_clusters(struct inode *inode, + u64 start, u64 len) + { + int ret = 0; +- u64 tmpend, end = start + len; ++ u64 tmpend = 0; ++ u64 end = start + len; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + unsigned int csize = osb->s_clustersize; + handle_t *handle; +@@ -1568,18 +1569,31 @@ static int ocfs2_zero_partial_clusters(struct inode *inode, + } + + /* +- * We want to get the byte offset of the end of the 1st cluster. ++ * If start is on a cluster boundary and end is somewhere in another ++ * cluster, we have not COWed the cluster starting at start, unless ++ * end is also within the same cluster. So, in this case, we skip this ++ * first call to ocfs2_zero_range_for_truncate() truncate and move on ++ * to the next one. + */ +- tmpend = (u64)osb->s_clustersize + (start & ~(osb->s_clustersize - 1)); +- if (tmpend > end) +- tmpend = end; ++ if ((start & (csize - 1)) != 0) { ++ /* ++ * We want to get the byte offset of the end of the 1st ++ * cluster. ++ */ ++ tmpend = (u64)osb->s_clustersize + ++ (start & ~(osb->s_clustersize - 1)); ++ if (tmpend > end) ++ tmpend = end; + +- trace_ocfs2_zero_partial_clusters_range1((unsigned long long)start, +- (unsigned long long)tmpend); ++ trace_ocfs2_zero_partial_clusters_range1( ++ (unsigned long long)start, ++ (unsigned long long)tmpend); + +- ret = ocfs2_zero_range_for_truncate(inode, handle, start, tmpend); +- if (ret) +- mlog_errno(ret); ++ ret = ocfs2_zero_range_for_truncate(inode, handle, start, ++ tmpend); ++ if (ret) ++ mlog_errno(ret); ++ } + + if (tmpend < end) { + /* +diff --git a/fs/reiserfs/ibalance.c b/fs/reiserfs/ibalance.c +index b751eea32e20..5db6f45b3fed 100644 +--- a/fs/reiserfs/ibalance.c ++++ b/fs/reiserfs/ibalance.c +@@ -1153,8 +1153,9 @@ int balance_internal(struct tree_balance *tb, + insert_ptr); + } + +- memcpy(new_insert_key_addr, &new_insert_key, KEY_SIZE); + insert_ptr[0] = new_insert_ptr; ++ if (new_insert_ptr) ++ memcpy(new_insert_key_addr, &new_insert_key, KEY_SIZE); + + return order; + } +diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c +index 39090fc56f09..eb1b8c8acfcb 100644 +--- a/fs/xfs/xfs_buf.c ++++ b/fs/xfs/xfs_buf.c +@@ -1535,7 +1535,7 @@ xfs_wait_buftarg( + * ensure here that all reference counts have been dropped before we + * start walking the LRU list. + */ +- drain_workqueue(btp->bt_mount->m_buf_workqueue); ++ flush_workqueue(btp->bt_mount->m_buf_workqueue); + + /* loop until there is nothing left on the lru list. */ + while (list_lru_count(&btp->bt_lru)) { +diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h +index 533c4408529a..850d8822e8ff 100644 +--- a/include/linux/fsnotify_backend.h ++++ b/include/linux/fsnotify_backend.h +@@ -148,6 +148,7 @@ struct fsnotify_group { + #define FS_PRIO_1 1 /* fanotify content based access control */ + #define FS_PRIO_2 2 /* fanotify pre-content access */ + unsigned int priority; ++ bool shutdown; /* group is being shut down, don't queue more events */ + + /* stores all fastpath marks assoc with this group so they can be cleaned on unregister */ + struct mutex mark_mutex; /* protect marks_list */ +@@ -179,7 +180,6 @@ struct fsnotify_group { + spinlock_t access_lock; + struct list_head access_list; + wait_queue_head_t access_waitq; +- atomic_t bypass_perm; + #endif /* CONFIG_FANOTIFY_ACCESS_PERMISSIONS */ + int f_flags; + unsigned int max_marks; +@@ -308,6 +308,8 @@ extern struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *op + extern void fsnotify_get_group(struct fsnotify_group *group); + /* drop reference on a group from fsnotify_alloc_group */ + extern void fsnotify_put_group(struct fsnotify_group *group); ++/* group destruction begins, stop queuing new events */ ++extern void fsnotify_group_stop_queueing(struct fsnotify_group *group); + /* destroy group */ + extern void fsnotify_destroy_group(struct fsnotify_group *group); + /* fasync handler function */ +@@ -320,8 +322,6 @@ extern int fsnotify_add_event(struct fsnotify_group *group, + struct fsnotify_event *event, + int (*merge)(struct list_head *, + struct fsnotify_event *)); +-/* Remove passed event from groups notification queue */ +-extern void fsnotify_remove_event(struct fsnotify_group *group, struct fsnotify_event *event); + /* true if the group notification queue is empty */ + extern bool fsnotify_notify_queue_is_empty(struct fsnotify_group *group); + /* return, but do not dequeue the first event on the notification queue */ +diff --git a/include/linux/kernel.h b/include/linux/kernel.h +index 924853d33a13..e571e592e53a 100644 +--- a/include/linux/kernel.h ++++ b/include/linux/kernel.h +@@ -202,26 +202,26 @@ extern int _cond_resched(void); + + /** + * abs - return absolute value of an argument +- * @x: the value. If it is unsigned type, it is converted to signed type first +- * (s64, long or int depending on its size). ++ * @x: the value. If it is unsigned type, it is converted to signed type first. ++ * char is treated as if it was signed (regardless of whether it really is) ++ * but the macro's return type is preserved as char. + * +- * Return: an absolute value of x. If x is 64-bit, macro's return type is s64, +- * otherwise it is signed long. ++ * Return: an absolute value of x. + */ +-#define abs(x) __builtin_choose_expr(sizeof(x) == sizeof(s64), ({ \ +- s64 __x = (x); \ +- (__x < 0) ? -__x : __x; \ +- }), ({ \ +- long ret; \ +- if (sizeof(x) == sizeof(long)) { \ +- long __x = (x); \ +- ret = (__x < 0) ? -__x : __x; \ +- } else { \ +- int __x = (x); \ +- ret = (__x < 0) ? -__x : __x; \ +- } \ +- ret; \ +- })) ++#define abs(x) __abs_choose_expr(x, long long, \ ++ __abs_choose_expr(x, long, \ ++ __abs_choose_expr(x, int, \ ++ __abs_choose_expr(x, short, \ ++ __abs_choose_expr(x, char, \ ++ __builtin_choose_expr( \ ++ __builtin_types_compatible_p(typeof(x), char), \ ++ (char)({ signed char __x = (x); __x<0?-__x:__x; }), \ ++ ((void)0))))))) ++ ++#define __abs_choose_expr(x, type, other) __builtin_choose_expr( \ ++ __builtin_types_compatible_p(typeof(x), signed type) || \ ++ __builtin_types_compatible_p(typeof(x), unsigned type), \ ++ ({ signed type __x = (x); __x < 0 ? -__x : __x; }), other) + + /** + * reciprocal_scale - "scale" a value into range [0, ep_ro) +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index b97d6823ef3c..4e9c75226f07 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -3036,6 +3036,7 @@ static inline void napi_free_frags(struct napi_struct *napi) + napi->skb = NULL; + } + ++bool netdev_is_rx_handler_busy(struct net_device *dev); + int netdev_rx_handler_register(struct net_device *dev, + rx_handler_func_t *rx_handler, + void *rx_handler_data); +diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h +index 26eabf5ec718..fbfadba81c5a 100644 +--- a/include/linux/pagemap.h ++++ b/include/linux/pagemap.h +@@ -601,56 +601,56 @@ static inline int fault_in_pages_readable(const char __user *uaddr, int size) + */ + static inline int fault_in_multipages_writeable(char __user *uaddr, int size) + { +- int ret = 0; + char __user *end = uaddr + size - 1; + + if (unlikely(size == 0)) +- return ret; ++ return 0; + ++ if (unlikely(uaddr > end)) ++ return -EFAULT; + /* + * Writing zeroes into userspace here is OK, because we know that if + * the zero gets there, we'll be overwriting it. + */ +- while (uaddr <= end) { +- ret = __put_user(0, uaddr); +- if (ret != 0) +- return ret; ++ do { ++ if (unlikely(__put_user(0, uaddr) != 0)) ++ return -EFAULT; + uaddr += PAGE_SIZE; +- } ++ } while (uaddr <= end); + + /* Check whether the range spilled into the next page. */ + if (((unsigned long)uaddr & PAGE_MASK) == + ((unsigned long)end & PAGE_MASK)) +- ret = __put_user(0, end); ++ return __put_user(0, end); + +- return ret; ++ return 0; + } + + static inline int fault_in_multipages_readable(const char __user *uaddr, + int size) + { + volatile char c; +- int ret = 0; + const char __user *end = uaddr + size - 1; + + if (unlikely(size == 0)) +- return ret; ++ return 0; + +- while (uaddr <= end) { +- ret = __get_user(c, uaddr); +- if (ret != 0) +- return ret; ++ if (unlikely(uaddr > end)) ++ return -EFAULT; ++ ++ do { ++ if (unlikely(__get_user(c, uaddr) != 0)) ++ return -EFAULT; + uaddr += PAGE_SIZE; +- } ++ } while (uaddr <= end); + + /* Check whether the range spilled into the next page. */ + if (((unsigned long)uaddr & PAGE_MASK) == + ((unsigned long)end & PAGE_MASK)) { +- ret = __get_user(c, end); +- (void)c; ++ return __get_user(c, end); + } + +- return ret; ++ return 0; + } + + int add_to_page_cache_locked(struct page *page, struct address_space *mapping, +diff --git a/include/linux/smc91x.h b/include/linux/smc91x.h +index 76199b75d584..e302c447e057 100644 +--- a/include/linux/smc91x.h ++++ b/include/linux/smc91x.h +@@ -1,6 +1,16 @@ + #ifndef __SMC91X_H__ + #define __SMC91X_H__ + ++/* ++ * These bits define which access sizes a platform can support, rather ++ * than the maximal access size. So, if your platform can do 16-bit ++ * and 32-bit accesses to the SMC91x device, but not 8-bit, set both ++ * SMC91X_USE_16BIT and SMC91X_USE_32BIT. ++ * ++ * The SMC91x driver requires at least one of SMC91X_USE_8BIT or ++ * SMC91X_USE_16BIT to be supported - just setting SMC91X_USE_32BIT is ++ * an invalid configuration. ++ */ + #define SMC91X_USE_8BIT (1 << 0) + #define SMC91X_USE_16BIT (1 << 1) + #define SMC91X_USE_32BIT (1 << 2) +diff --git a/include/net/af_unix.h b/include/net/af_unix.h +index 9b4c418bebd8..fd60eccb59a6 100644 +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -52,7 +52,7 @@ struct unix_sock { + struct sock sk; + struct unix_address *addr; + struct path path; +- struct mutex readlock; ++ struct mutex iolock, bindlock; + struct sock *peer; + struct list_head link; + atomic_long_t inflight; +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 414d822bc1db..9c3ab544d3a8 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1510,6 +1510,8 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli + { + if (sk->sk_send_head == skb_unlinked) + sk->sk_send_head = NULL; ++ if (tcp_sk(sk)->highest_sack == skb_unlinked) ++ tcp_sk(sk)->highest_sack = NULL; + } + + static inline void tcp_init_send_head(struct sock *sk) +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index e120bd983ad0..b9279a2844d8 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -2079,7 +2079,7 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css) + * which could have been changed by cpuset just after it inherits the + * state from the parent and before it sits on the cgroup's task list. + */ +-void cpuset_fork(struct task_struct *task) ++void cpuset_fork(struct task_struct *task, void *priv) + { + if (task_css_is_root(task, cpuset_cgrp_id)) + return; +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index b7dd5718836e..3124cebaec31 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -299,12 +299,12 @@ static int create_image(int platform_mode) + save_processor_state(); + trace_suspend_resume(TPS("machine_suspend"), PM_EVENT_HIBERNATE, true); + error = swsusp_arch_suspend(); ++ /* Restore control flow magically appears here */ ++ restore_processor_state(); + trace_suspend_resume(TPS("machine_suspend"), PM_EVENT_HIBERNATE, false); + if (error) + printk(KERN_ERR "PM: Error %d creating hibernation image\n", + error); +- /* Restore control flow magically appears here */ +- restore_processor_state(); + if (!in_suspend) + events_check_enabled = false; + +diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c +index 3a970604308f..f155c62f1f2c 100644 +--- a/kernel/power/snapshot.c ++++ b/kernel/power/snapshot.c +@@ -765,9 +765,9 @@ static bool memory_bm_pfn_present(struct memory_bitmap *bm, unsigned long pfn) + */ + static bool rtree_next_node(struct memory_bitmap *bm) + { +- bm->cur.node = list_entry(bm->cur.node->list.next, +- struct rtree_node, list); +- if (&bm->cur.node->list != &bm->cur.zone->leaves) { ++ if (!list_is_last(&bm->cur.node->list, &bm->cur.zone->leaves)) { ++ bm->cur.node = list_entry(bm->cur.node->list.next, ++ struct rtree_node, list); + bm->cur.node_pfn += BM_BITS_PER_BLOCK; + bm->cur.node_bit = 0; + touch_softlockup_watchdog(); +@@ -775,9 +775,9 @@ static bool rtree_next_node(struct memory_bitmap *bm) + } + + /* No more nodes, goto next zone */ +- bm->cur.zone = list_entry(bm->cur.zone->list.next, ++ if (!list_is_last(&bm->cur.zone->list, &bm->zones)) { ++ bm->cur.zone = list_entry(bm->cur.zone->list.next, + struct mem_zone_bm_rtree, list); +- if (&bm->cur.zone->list != &bm->zones) { + bm->cur.node = list_entry(bm->cur.zone->leaves.next, + struct rtree_node, list); + bm->cur.node_pfn = 0; +diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile +index 9b1044e936a6..05ea5167e6bb 100644 +--- a/kernel/trace/Makefile ++++ b/kernel/trace/Makefile +@@ -1,4 +1,8 @@ + ++# We are fully aware of the dangers of __builtin_return_address() ++FRAME_CFLAGS := $(call cc-disable-warning,frame-address) ++KBUILD_CFLAGS += $(FRAME_CFLAGS) ++ + # Do not instrument the tracer itself: + + ifdef CONFIG_FUNCTION_TRACER +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 8305cbb2d5a2..059233abcfcf 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -4727,19 +4727,20 @@ tracing_read_pipe(struct file *filp, char __user *ubuf, + struct trace_iterator *iter = filp->private_data; + ssize_t sret; + +- /* return any leftover data */ +- sret = trace_seq_to_user(&iter->seq, ubuf, cnt); +- if (sret != -EBUSY) +- return sret; +- +- trace_seq_init(&iter->seq); +- + /* + * Avoid more than one consumer on a single file descriptor + * This is just a matter of traces coherency, the ring buffer itself + * is protected. + */ + mutex_lock(&iter->mutex); ++ ++ /* return any leftover data */ ++ sret = trace_seq_to_user(&iter->seq, ubuf, cnt); ++ if (sret != -EBUSY) ++ goto out; ++ ++ trace_seq_init(&iter->seq); ++ + if (iter->trace->read) { + sret = iter->trace->read(iter, filp, ubuf, cnt, ppos); + if (sret) +@@ -5766,9 +5767,6 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, + return -EBUSY; + #endif + +- if (splice_grow_spd(pipe, &spd)) +- return -ENOMEM; +- + if (*ppos & (PAGE_SIZE - 1)) + return -EINVAL; + +@@ -5778,6 +5776,9 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, + len &= PAGE_MASK; + } + ++ if (splice_grow_spd(pipe, &spd)) ++ return -ENOMEM; ++ + again: + trace_access_lock(iter->cpu_file); + entries = ring_buffer_entries_cpu(iter->trace_buffer->buffer, iter->cpu_file); +@@ -5835,19 +5836,21 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, + /* did we read anything? */ + if (!spd.nr_pages) { + if (ret) +- return ret; ++ goto out; + ++ ret = -EAGAIN; + if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK)) +- return -EAGAIN; ++ goto out; + + ret = wait_on_pipe(iter, true); + if (ret) +- return ret; ++ goto out; + + goto again; + } + + ret = splice_to_pipe(pipe, &spd); ++out: + splice_shrink_spd(&spd); + + return ret; +diff --git a/mm/vmscan.c b/mm/vmscan.c +index 0c114e2b01d3..0838e9f02b11 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -2159,23 +2159,6 @@ out: + } + } + +-#ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH +-static void init_tlb_ubc(void) +-{ +- /* +- * This deliberately does not clear the cpumask as it's expensive +- * and unnecessary. If there happens to be data in there then the +- * first SWAP_CLUSTER_MAX pages will send an unnecessary IPI and +- * then will be cleared. +- */ +- current->tlb_ubc.flush_required = false; +-} +-#else +-static inline void init_tlb_ubc(void) +-{ +-} +-#endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */ +- + /* + * This is a basic per-zone page freer. Used by both kswapd and direct reclaim. + */ +@@ -2210,8 +2193,6 @@ static void shrink_lruvec(struct lruvec *lruvec, int swappiness, + scan_adjusted = (global_reclaim(sc) && !current_is_kswapd() && + sc->priority == DEF_PRIORITY); + +- init_tlb_ubc(); +- + blk_start_plug(&plug); + while (nr[LRU_INACTIVE_ANON] || nr[LRU_ACTIVE_FILE] || + nr[LRU_INACTIVE_FILE]) { +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 7173a685309a..9542e84a9455 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1113,7 +1113,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, + } else { + err = br_ip6_multicast_add_group(br, port, + &grec->grec_mca, vid); +- if (!err) ++ if (err) + break; + } + } +diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c +index f6c3b2137eea..59ce1fcc220c 100644 +--- a/net/caif/cfpkt_skbuff.c ++++ b/net/caif/cfpkt_skbuff.c +@@ -286,7 +286,7 @@ int cfpkt_setlen(struct cfpkt *pkt, u16 len) + else + skb_trim(skb, len); + +- return cfpkt_getlen(pkt); ++ return cfpkt_getlen(pkt); + } + + /* Need to expand SKB */ +diff --git a/net/core/dev.c b/net/core/dev.c +index 9efbdb3ff78a..de4ed2b5a221 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3722,6 +3722,22 @@ static inline struct sk_buff *handle_ing(struct sk_buff *skb, + } + + /** ++ * netdev_is_rx_handler_busy - check if receive handler is registered ++ * @dev: device to check ++ * ++ * Check if a receive handler is already registered for a given device. ++ * Return true if there one. ++ * ++ * The caller must hold the rtnl_mutex. ++ */ ++bool netdev_is_rx_handler_busy(struct net_device *dev) ++{ ++ ASSERT_RTNL(); ++ return dev && rtnl_dereference(dev->rx_handler); ++} ++EXPORT_SYMBOL_GPL(netdev_is_rx_handler_busy); ++ ++/** + * netdev_rx_handler_register - register receive handler + * @dev: device to register a handler for + * @rx_handler: receive handler to register +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 744e5936c10d..e5a3ff210fec 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -2453,9 +2453,7 @@ struct fib_route_iter { + static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter, + loff_t pos) + { +- struct fib_table *tb = iter->main_tb; + struct key_vector *l, **tp = &iter->tnode; +- struct trie *t; + t_key key; + + /* use cache location of next-to-find key */ +@@ -2463,8 +2461,6 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter, + pos -= iter->pos; + key = iter->key; + } else { +- t = (struct trie *)tb->tb_data; +- iter->tnode = t->kv; + iter->pos = 0; + key = 0; + } +@@ -2505,12 +2501,12 @@ static void *fib_route_seq_start(struct seq_file *seq, loff_t *pos) + return NULL; + + iter->main_tb = tb; ++ t = (struct trie *)tb->tb_data; ++ iter->tnode = t->kv; + + if (*pos != 0) + return fib_route_get_idx(iter, *pos); + +- t = (struct trie *)tb->tb_data; +- iter->tnode = t->kv; + iter->pos = 0; + iter->key = 0; + +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index 4d8f0b698777..65036891e080 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -540,6 +540,33 @@ static struct rtnl_link_ops vti_link_ops __read_mostly = { + .get_link_net = ip_tunnel_get_link_net, + }; + ++static bool is_vti_tunnel(const struct net_device *dev) ++{ ++ return dev->netdev_ops == &vti_netdev_ops; ++} ++ ++static int vti_device_event(struct notifier_block *unused, ++ unsigned long event, void *ptr) ++{ ++ struct net_device *dev = netdev_notifier_info_to_dev(ptr); ++ struct ip_tunnel *tunnel = netdev_priv(dev); ++ ++ if (!is_vti_tunnel(dev)) ++ return NOTIFY_DONE; ++ ++ switch (event) { ++ case NETDEV_DOWN: ++ if (!net_eq(tunnel->net, dev_net(dev))) ++ xfrm_garbage_collect(tunnel->net); ++ break; ++ } ++ return NOTIFY_DONE; ++} ++ ++static struct notifier_block vti_notifier_block __read_mostly = { ++ .notifier_call = vti_device_event, ++}; ++ + static int __init vti_init(void) + { + const char *msg; +@@ -547,6 +574,8 @@ static int __init vti_init(void) + + pr_info("IPv4 over IPsec tunneling driver\n"); + ++ register_netdevice_notifier(&vti_notifier_block); ++ + msg = "tunnel device"; + err = register_pernet_device(&vti_net_ops); + if (err < 0) +@@ -579,6 +608,7 @@ xfrm_proto_ah_failed: + xfrm_proto_esp_failed: + unregister_pernet_device(&vti_net_ops); + pernet_dev_failed: ++ unregister_netdevice_notifier(&vti_notifier_block); + pr_err("vti init: failed to register %s\n", msg); + return err; + } +@@ -590,6 +620,7 @@ static void __exit vti_fini(void) + xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH); + xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP); + unregister_pernet_device(&vti_net_ops); ++ unregister_netdevice_notifier(&vti_notifier_block); + } + + module_init(vti_init); +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 048418b049d8..b5853cac3269 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -808,8 +808,14 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, + u32 seq = (sk->sk_state == TCP_LISTEN) ? tcp_rsk(req)->snt_isn + 1 : + tcp_sk(sk)->snd_nxt; + ++ /* RFC 7323 2.3 ++ * The window field (SEG.WND) of every outgoing segment, with the ++ * exception of segments, MUST be right-shifted by ++ * Rcv.Wind.Shift bits: ++ */ + tcp_v4_send_ack(sock_net(sk), skb, seq, +- tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd, ++ tcp_rsk(req)->rcv_nxt, ++ req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale, + tcp_time_stamp, + req->ts_recent, + 0, +diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c +index 3e6a472e6b88..92ab5bc91592 100644 +--- a/net/ipv4/tcp_yeah.c ++++ b/net/ipv4/tcp_yeah.c +@@ -75,7 +75,7 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked) + if (!tcp_is_cwnd_limited(sk)) + return; + +- if (tp->snd_cwnd <= tp->snd_ssthresh) ++ if (tcp_in_slow_start(tp)) + tcp_slow_start(tp, acked); + + else if (!yeah->doing_reno_now) { +diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c +index 263a5164a6f5..3e55447b63a4 100644 +--- a/net/ipv6/ping.c ++++ b/net/ipv6/ping.c +@@ -150,8 +150,10 @@ int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + rt = (struct rt6_info *) dst; + + np = inet6_sk(sk); +- if (!np) +- return -EBADF; ++ if (!np) { ++ err = -EBADF; ++ goto dst_err_out; ++ } + + if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) + fl6.flowi6_oif = np->mcast_oif; +@@ -186,6 +188,9 @@ int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + } + release_sock(sk); + ++dst_err_out: ++ dst_release(dst); ++ + if (err) + return err; + +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 1a1cd3938fd0..2d81e2f33ef2 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -932,9 +932,15 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, + /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV + * sk->sk_state == TCP_SYN_RECV -> for Fast Open. + */ ++ /* RFC 7323 2.3 ++ * The window field (SEG.WND) of every outgoing segment, with the ++ * exception of segments, MUST be right-shifted by ++ * Rcv.Wind.Shift bits: ++ */ + tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ? + tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt, +- tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd, ++ tcp_rsk(req)->rcv_nxt, ++ req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale, + tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if, + tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), + 0, 0); +diff --git a/net/irda/iriap.c b/net/irda/iriap.c +index 4a7ae32afa09..1138eaf5c682 100644 +--- a/net/irda/iriap.c ++++ b/net/irda/iriap.c +@@ -185,8 +185,12 @@ struct iriap_cb *iriap_open(__u8 slsap_sel, int mode, void *priv, + + self->magic = IAS_MAGIC; + self->mode = mode; +- if (mode == IAS_CLIENT) +- iriap_register_lsap(self, slsap_sel, mode); ++ if (mode == IAS_CLIENT) { ++ if (iriap_register_lsap(self, slsap_sel, mode)) { ++ kfree(self); ++ return NULL; ++ } ++ } + + self->confirm = callback; + self->priv = priv; +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index 9b713e0ce00d..b26b7a127773 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2111,7 +2111,8 @@ restart: + TIPC_CONN_MSG, SHORT_H_SIZE, + 0, dnode, onode, dport, oport, + TIPC_CONN_SHUTDOWN); +- tipc_node_xmit_skb(net, skb, dnode, tsk->portid); ++ if (skb) ++ tipc_node_xmit_skb(net, skb, dnode, tsk->portid); + } + tsk->connected = 0; + sock->state = SS_DISCONNECTING; +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 6579fd6e7459..824cc1e160bc 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -661,11 +661,11 @@ static int unix_set_peek_off(struct sock *sk, int val) + { + struct unix_sock *u = unix_sk(sk); + +- if (mutex_lock_interruptible(&u->readlock)) ++ if (mutex_lock_interruptible(&u->iolock)) + return -EINTR; + + sk->sk_peek_off = val; +- mutex_unlock(&u->readlock); ++ mutex_unlock(&u->iolock); + + return 0; + } +@@ -778,7 +778,8 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern) + spin_lock_init(&u->lock); + atomic_long_set(&u->inflight, 0); + INIT_LIST_HEAD(&u->link); +- mutex_init(&u->readlock); /* single task reading lock */ ++ mutex_init(&u->iolock); /* single task reading lock */ ++ mutex_init(&u->bindlock); /* single task binding lock */ + init_waitqueue_head(&u->peer_wait); + init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay); + unix_insert_socket(unix_sockets_unbound(sk), sk); +@@ -847,7 +848,7 @@ static int unix_autobind(struct socket *sock) + int err; + unsigned int retries = 0; + +- err = mutex_lock_interruptible(&u->readlock); ++ err = mutex_lock_interruptible(&u->bindlock); + if (err) + return err; + +@@ -894,7 +895,7 @@ retry: + spin_unlock(&unix_table_lock); + err = 0; + +-out: mutex_unlock(&u->readlock); ++out: mutex_unlock(&u->bindlock); + return err; + } + +@@ -953,20 +954,32 @@ fail: + return NULL; + } + +-static int unix_mknod(struct dentry *dentry, struct path *path, umode_t mode, +- struct path *res) ++static int unix_mknod(const char *sun_path, umode_t mode, struct path *res) + { +- int err; ++ struct dentry *dentry; ++ struct path path; ++ int err = 0; ++ /* ++ * Get the parent directory, calculate the hash for last ++ * component. ++ */ ++ dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0); ++ err = PTR_ERR(dentry); ++ if (IS_ERR(dentry)) ++ return err; + +- err = security_path_mknod(path, dentry, mode, 0); ++ /* ++ * All right, let's create it. ++ */ ++ err = security_path_mknod(&path, dentry, mode, 0); + if (!err) { +- err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0); ++ err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0); + if (!err) { +- res->mnt = mntget(path->mnt); ++ res->mnt = mntget(path.mnt); + res->dentry = dget(dentry); + } + } +- ++ done_path_create(&path, dentry); + return err; + } + +@@ -977,12 +990,10 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + struct unix_sock *u = unix_sk(sk); + struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr; + char *sun_path = sunaddr->sun_path; +- int err, name_err; ++ int err; + unsigned int hash; + struct unix_address *addr; + struct hlist_head *list; +- struct path path; +- struct dentry *dentry; + + err = -EINVAL; + if (sunaddr->sun_family != AF_UNIX) +@@ -998,34 +1009,14 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out; + addr_len = err; + +- name_err = 0; +- dentry = NULL; +- if (sun_path[0]) { +- /* Get the parent directory, calculate the hash for last +- * component. +- */ +- dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0); +- +- if (IS_ERR(dentry)) { +- /* delay report until after 'already bound' check */ +- name_err = PTR_ERR(dentry); +- dentry = NULL; +- } +- } +- +- err = mutex_lock_interruptible(&u->readlock); ++ err = mutex_lock_interruptible(&u->bindlock); + if (err) +- goto out_path; ++ goto out; + + err = -EINVAL; + if (u->addr) + goto out_up; + +- if (name_err) { +- err = name_err == -EEXIST ? -EADDRINUSE : name_err; +- goto out_up; +- } +- + err = -ENOMEM; + addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL); + if (!addr) +@@ -1036,11 +1027,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + addr->hash = hash ^ sk->sk_type; + atomic_set(&addr->refcnt, 1); + +- if (dentry) { +- struct path u_path; ++ if (sun_path[0]) { ++ struct path path; + umode_t mode = S_IFSOCK | + (SOCK_INODE(sock)->i_mode & ~current_umask()); +- err = unix_mknod(dentry, &path, mode, &u_path); ++ err = unix_mknod(sun_path, mode, &path); + if (err) { + if (err == -EEXIST) + err = -EADDRINUSE; +@@ -1048,9 +1039,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out_up; + } + addr->hash = UNIX_HASH_SIZE; +- hash = d_real_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1); ++ hash = d_real_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1); + spin_lock(&unix_table_lock); +- u->path = u_path; ++ u->path = path; + list = &unix_socket_table[hash]; + } else { + spin_lock(&unix_table_lock); +@@ -1072,11 +1063,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + out_unlock: + spin_unlock(&unix_table_lock); + out_up: +- mutex_unlock(&u->readlock); +-out_path: +- if (dentry) +- done_path_create(&path, dentry); +- ++ mutex_unlock(&u->bindlock); + out: + return err; + } +@@ -1971,17 +1958,17 @@ static ssize_t unix_stream_sendpage(struct socket *socket, struct page *page, + if (false) { + alloc_skb: + unix_state_unlock(other); +- mutex_unlock(&unix_sk(other)->readlock); ++ mutex_unlock(&unix_sk(other)->iolock); + newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT, + &err, 0); + if (!newskb) + goto err; + } + +- /* we must acquire readlock as we modify already present ++ /* we must acquire iolock as we modify already present + * skbs in the sk_receive_queue and mess with skb->len + */ +- err = mutex_lock_interruptible(&unix_sk(other)->readlock); ++ err = mutex_lock_interruptible(&unix_sk(other)->iolock); + if (err) { + err = flags & MSG_DONTWAIT ? -EAGAIN : -ERESTARTSYS; + goto err; +@@ -2048,7 +2035,7 @@ alloc_skb: + } + + unix_state_unlock(other); +- mutex_unlock(&unix_sk(other)->readlock); ++ mutex_unlock(&unix_sk(other)->iolock); + + other->sk_data_ready(other); + scm_destroy(&scm); +@@ -2057,7 +2044,7 @@ alloc_skb: + err_state_unlock: + unix_state_unlock(other); + err_unlock: +- mutex_unlock(&unix_sk(other)->readlock); ++ mutex_unlock(&unix_sk(other)->iolock); + err: + kfree_skb(newskb); + if (send_sigpipe && !(flags & MSG_NOSIGNAL)) +@@ -2122,7 +2109,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, + if (flags&MSG_OOB) + goto out; + +- err = mutex_lock_interruptible(&u->readlock); ++ err = mutex_lock_interruptible(&u->iolock); + if (unlikely(err)) { + /* recvmsg() in non blocking mode is supposed to return -EAGAIN + * sk_rcvtimeo is not honored by mutex_lock_interruptible() +@@ -2198,7 +2185,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, + out_free: + skb_free_datagram(sk, skb); + out_unlock: +- mutex_unlock(&u->readlock); ++ mutex_unlock(&u->iolock); + out: + return err; + } +@@ -2293,7 +2280,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state) + /* Lock the socket to prevent queue disordering + * while sleeps in memcpy_tomsg + */ +- mutex_lock(&u->readlock); ++ mutex_lock(&u->iolock); + + if (flags & MSG_PEEK) + skip = sk_peek_offset(sk, flags); +@@ -2334,7 +2321,7 @@ again: + break; + } + +- mutex_unlock(&u->readlock); ++ mutex_unlock(&u->iolock); + + timeo = unix_stream_data_wait(sk, timeo, last, + last_len); +@@ -2345,7 +2332,7 @@ again: + goto out; + } + +- mutex_lock(&u->readlock); ++ mutex_lock(&u->iolock); + continue; + unlock: + unix_state_unlock(sk); +@@ -2448,7 +2435,7 @@ unlock: + } + } while (size); + +- mutex_unlock(&u->readlock); ++ mutex_unlock(&u->iolock); + if (state->msg) + scm_recv(sock, state->msg, &scm, flags); + else +@@ -2489,9 +2476,9 @@ static ssize_t skb_unix_socket_splice(struct sock *sk, + int ret; + struct unix_sock *u = unix_sk(sk); + +- mutex_unlock(&u->readlock); ++ mutex_unlock(&u->iolock); + ret = splice_to_pipe(pipe, spd); +- mutex_lock(&u->readlock); ++ mutex_lock(&u->iolock); + + return ret; + } +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 5d89f13a98db..bf65f31bd55e 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -6628,7 +6628,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) + + params.n_counter_offsets_presp = len / sizeof(u16); + if (rdev->wiphy.max_num_csa_counters && +- (params.n_counter_offsets_beacon > ++ (params.n_counter_offsets_presp > + rdev->wiphy.max_num_csa_counters)) + return -EINVAL; + diff --git a/patch/kernel/udoo-next/03-patch-4.4.23-24.patch b/patch/kernel/udoo-next/03-patch-4.4.23-24.patch new file mode 100644 index 0000000000..f3a7dba266 --- /dev/null +++ b/patch/kernel/udoo-next/03-patch-4.4.23-24.patch @@ -0,0 +1,2457 @@ +diff --git a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt +index d00bfd8624a5..e0381c28773d 100644 +--- a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt ++++ b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt +@@ -81,9 +81,9 @@ pm8916: + l14, l15, l16, l17, l18 + + pm8941: +- s1, s2, s3, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13, l14, +- l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3, +- mvs1, mvs2 ++ s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13, ++ l14, l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3, ++ 5vs1, 5vs2 + + The content of each sub-node is defined by the standard binding for regulators - + see regulator.txt - with additional custom properties described below: +diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt +index 4976389e432d..dd15a699ee1c 100644 +--- a/Documentation/pinctrl.txt ++++ b/Documentation/pinctrl.txt +@@ -831,7 +831,7 @@ separate memory range only intended for GPIO driving, and the register + range dealing with pin config and pin multiplexing get placed into a + different memory range and a separate section of the data sheet. + +-A flag "strict" in struct pinctrl_desc is available to check and deny ++A flag "strict" in struct pinmux_ops is available to check and deny + simultaneous access to the same pin from GPIO and pin multiplexing + consumers on hardware of this type. The pinctrl driver should set this flag + accordingly. +diff --git a/Makefile b/Makefile +index 95421b688f23..cdbc185c3539 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 23 ++SUBLEVEL = 24 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S +index 06e983f59980..856913705169 100644 +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -776,7 +776,7 @@ __armv7_mmu_cache_on: + orrne r0, r0, #1 @ MMU enabled + movne r1, #0xfffffffd @ domain 0 = client + bic r6, r6, #1 << 31 @ 32-bit translation system +- bic r6, r6, #3 << 0 @ use only ttbr0 ++ bic r6, r6, #(7 << 0) | (1 << 4) @ use only ttbr0 + mcrne p15, 0, r3, c2, c0, 0 @ load page table pointer + mcrne p15, 0, r1, c3, c0, 0 @ load domain access control + mcrne p15, 0, r6, c2, c0, 2 @ load ttb control +diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi +index d910d3a6c41c..84bdba480d5a 100644 +--- a/arch/arm/boot/dts/sun5i-a13.dtsi ++++ b/arch/arm/boot/dts/sun5i-a13.dtsi +@@ -83,7 +83,7 @@ + trips { + cpu_alert0: cpu_alert0 { + /* milliCelsius */ +- temperature = <850000>; ++ temperature = <85000>; + hysteresis = <2000>; + type = "passive"; + }; +diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c +index 3d224941b541..a3a9ad4dc3c6 100644 +--- a/arch/arm/common/sa1111.c ++++ b/arch/arm/common/sa1111.c +@@ -869,9 +869,9 @@ struct sa1111_save_data { + + #ifdef CONFIG_PM + +-static int sa1111_suspend(struct platform_device *dev, pm_message_t state) ++static int sa1111_suspend_noirq(struct device *dev) + { +- struct sa1111 *sachip = platform_get_drvdata(dev); ++ struct sa1111 *sachip = dev_get_drvdata(dev); + struct sa1111_save_data *save; + unsigned long flags; + unsigned int val; +@@ -934,9 +934,9 @@ static int sa1111_suspend(struct platform_device *dev, pm_message_t state) + * restored by their respective drivers, and must be called + * via LDM after this function. + */ +-static int sa1111_resume(struct platform_device *dev) ++static int sa1111_resume_noirq(struct device *dev) + { +- struct sa1111 *sachip = platform_get_drvdata(dev); ++ struct sa1111 *sachip = dev_get_drvdata(dev); + struct sa1111_save_data *save; + unsigned long flags, id; + void __iomem *base; +@@ -952,7 +952,7 @@ static int sa1111_resume(struct platform_device *dev) + id = sa1111_readl(sachip->base + SA1111_SKID); + if ((id & SKID_ID_MASK) != SKID_SA1111_ID) { + __sa1111_remove(sachip); +- platform_set_drvdata(dev, NULL); ++ dev_set_drvdata(dev, NULL); + kfree(save); + return 0; + } +@@ -1003,8 +1003,8 @@ static int sa1111_resume(struct platform_device *dev) + } + + #else +-#define sa1111_suspend NULL +-#define sa1111_resume NULL ++#define sa1111_suspend_noirq NULL ++#define sa1111_resume_noirq NULL + #endif + + static int sa1111_probe(struct platform_device *pdev) +@@ -1038,6 +1038,11 @@ static int sa1111_remove(struct platform_device *pdev) + return 0; + } + ++static struct dev_pm_ops sa1111_pm_ops = { ++ .suspend_noirq = sa1111_suspend_noirq, ++ .resume_noirq = sa1111_resume_noirq, ++}; ++ + /* + * Not sure if this should be on the system bus or not yet. + * We really want some way to register a system device at +@@ -1050,10 +1055,9 @@ static int sa1111_remove(struct platform_device *pdev) + static struct platform_driver sa1111_device_driver = { + .probe = sa1111_probe, + .remove = sa1111_remove, +- .suspend = sa1111_suspend, +- .resume = sa1111_resume, + .driver = { + .name = "sa1111", ++ .pm = &sa1111_pm_ops, + }, + }; + +diff --git a/arch/arm/include/asm/dma-mapping.h b/arch/arm/include/asm/dma-mapping.h +index ccb3aa64640d..b91a2d17a521 100644 +--- a/arch/arm/include/asm/dma-mapping.h ++++ b/arch/arm/include/asm/dma-mapping.h +@@ -119,7 +119,7 @@ static inline dma_addr_t virt_to_dma(struct device *dev, void *addr) + /* The ARM override for dma_max_pfn() */ + static inline unsigned long dma_max_pfn(struct device *dev) + { +- return PHYS_PFN_OFFSET + dma_to_pfn(dev, *dev->dma_mask); ++ return dma_to_pfn(dev, *dev->dma_mask); + } + #define dma_max_pfn(dev) dma_max_pfn(dev) + +diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c +index 65addcbf5b30..b3b950fc8ea0 100644 +--- a/arch/arm/kernel/devtree.c ++++ b/arch/arm/kernel/devtree.c +@@ -87,6 +87,8 @@ void __init arm_dt_init_cpu_maps(void) + return; + + for_each_child_of_node(cpus, cpu) { ++ const __be32 *cell; ++ int prop_bytes; + u32 hwid; + + if (of_node_cmp(cpu->type, "cpu")) +@@ -98,7 +100,8 @@ void __init arm_dt_init_cpu_maps(void) + * properties is considered invalid to build the + * cpu_logical_map. + */ +- if (of_property_read_u32(cpu, "reg", &hwid)) { ++ cell = of_get_property(cpu, "reg", &prop_bytes); ++ if (!cell || prop_bytes < sizeof(*cell)) { + pr_debug(" * %s missing reg property\n", + cpu->full_name); + of_node_put(cpu); +@@ -106,10 +109,15 @@ void __init arm_dt_init_cpu_maps(void) + } + + /* +- * 8 MSBs must be set to 0 in the DT since the reg property ++ * Bits n:24 must be set to 0 in the DT since the reg property + * defines the MPIDR[23:0]. + */ +- if (hwid & ~MPIDR_HWID_BITMASK) { ++ do { ++ hwid = be32_to_cpu(*cell++); ++ prop_bytes -= sizeof(*cell); ++ } while (!hwid && prop_bytes > 0); ++ ++ if (prop_bytes || (hwid & ~MPIDR_HWID_BITMASK)) { + of_node_put(cpu); + return; + } +diff --git a/arch/arm/mach-sa1100/clock.c b/arch/arm/mach-sa1100/clock.c +index cbf53bb9c814..0db46895c82a 100644 +--- a/arch/arm/mach-sa1100/clock.c ++++ b/arch/arm/mach-sa1100/clock.c +@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(struct clk *clk) + } + + static struct clkops clk_36864_ops = { ++ .enable = clk_cpu_enable, ++ .disable = clk_cpu_disable, + .get_rate = clk_36864_get_rate, + }; + +@@ -140,9 +142,8 @@ static struct clk_lookup sa11xx_clkregs[] = { + CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864), + }; + +-static int __init sa11xx_clk_init(void) ++int __init sa11xx_clk_init(void) + { + clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs)); + return 0; + } +-core_initcall(sa11xx_clk_init); +diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c +index 345e63f4eb71..3e09beddb6e8 100644 +--- a/arch/arm/mach-sa1100/generic.c ++++ b/arch/arm/mach-sa1100/generic.c +@@ -34,6 +34,7 @@ + + #include + #include ++#include + + #include "generic.h" + #include +@@ -95,6 +96,8 @@ static void sa1100_power_off(void) + + void sa11x0_restart(enum reboot_mode mode, const char *cmd) + { ++ clear_reset_status(RESET_STATUS_ALL); ++ + if (mode == REBOOT_SOFT) { + /* Jump into ROM at address 0 */ + soft_restart(0); +@@ -388,6 +391,7 @@ void __init sa1100_init_irq(void) + sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start); + + sa1100_init_gpio(); ++ sa11xx_clk_init(); + } + + /* +diff --git a/arch/arm/mach-sa1100/generic.h b/arch/arm/mach-sa1100/generic.h +index 0d92e119b36b..68199b603ff7 100644 +--- a/arch/arm/mach-sa1100/generic.h ++++ b/arch/arm/mach-sa1100/generic.h +@@ -44,3 +44,5 @@ int sa11x0_pm_init(void); + #else + static inline int sa11x0_pm_init(void) { return 0; } + #endif ++ ++int sa11xx_clk_init(void); +diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +index 62437b57813e..73e3adbc1330 100644 +--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c ++++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +@@ -41,39 +41,26 @@ + + #define REGULATOR_IRQ_MASK BIT(2) /* IRQ2, active low */ + +-static void __iomem *irqc; +- +-static const u8 da9063_mask_regs[] = { +- DA9063_REG_IRQ_MASK_A, +- DA9063_REG_IRQ_MASK_B, +- DA9063_REG_IRQ_MASK_C, +- DA9063_REG_IRQ_MASK_D, +-}; +- +-/* DA9210 System Control and Event Registers */ ++/* start of DA9210 System Control and Event Registers */ + #define DA9210_REG_MASK_A 0x54 +-#define DA9210_REG_MASK_B 0x55 +- +-static const u8 da9210_mask_regs[] = { +- DA9210_REG_MASK_A, +- DA9210_REG_MASK_B, +-}; +- +-static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[], +- unsigned int nregs) +-{ +- unsigned int i; + +- dev_info(&client->dev, "Masking %s interrupt sources\n", client->name); ++static void __iomem *irqc; + +- for (i = 0; i < nregs; i++) { +- int error = i2c_smbus_write_byte_data(client, regs[i], ~0); +- if (error) { +- dev_err(&client->dev, "i2c error %d\n", error); +- return; +- } +- } +-} ++/* first byte sets the memory pointer, following are consecutive reg values */ ++static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff }; ++static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff }; ++ ++static struct i2c_msg da9xxx_msgs[2] = { ++ { ++ .addr = 0x58, ++ .len = ARRAY_SIZE(da9063_irq_clr), ++ .buf = da9063_irq_clr, ++ }, { ++ .addr = 0x68, ++ .len = ARRAY_SIZE(da9210_irq_clr), ++ .buf = da9210_irq_clr, ++ }, ++}; + + static int regulator_quirk_notify(struct notifier_block *nb, + unsigned long action, void *data) +@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct notifier_block *nb, + client = to_i2c_client(dev); + dev_dbg(dev, "Detected %s\n", client->name); + +- if ((client->addr == 0x58 && !strcmp(client->name, "da9063"))) +- da9xxx_mask_irqs(client, da9063_mask_regs, +- ARRAY_SIZE(da9063_mask_regs)); +- else if (client->addr == 0x68 && !strcmp(client->name, "da9210")) +- da9xxx_mask_irqs(client, da9210_mask_regs, +- ARRAY_SIZE(da9210_mask_regs)); ++ if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) || ++ (client->addr == 0x68 && !strcmp(client->name, "da9210"))) { ++ int ret; ++ ++ dev_info(&client->dev, "clearing da9063/da9210 interrupts\n"); ++ ret = i2c_transfer(client->adapter, da9xxx_msgs, ARRAY_SIZE(da9xxx_msgs)); ++ if (ret != ARRAY_SIZE(da9xxx_msgs)) ++ dev_err(&client->dev, "i2c error %d\n", ret); ++ } + + mon = ioread32(irqc + IRQC_MONITOR); + if (mon & REGULATOR_IRQ_MASK) +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index e51f27ac13fd..c8875b64be90 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -422,8 +422,10 @@ int kernel_active_single_step(void) + /* ptrace API */ + void user_enable_single_step(struct task_struct *task) + { +- set_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP); +- set_regs_spsr_ss(task_pt_regs(task)); ++ struct thread_info *ti = task_thread_info(task); ++ ++ if (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP)) ++ set_regs_spsr_ss(task_pt_regs(task)); + } + + void user_disable_single_step(struct task_struct *task) +diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c +index 4f61378c3453..456128174b17 100644 +--- a/arch/avr32/mach-at32ap/pio.c ++++ b/arch/avr32/mach-at32ap/pio.c +@@ -435,7 +435,7 @@ void __init at32_init_pio(struct platform_device *pdev) + struct resource *regs; + struct pio_device *pio; + +- if (pdev->id > MAX_NR_PIO_DEVICES) { ++ if (pdev->id >= MAX_NR_PIO_DEVICES) { + dev_err(&pdev->dev, "only %d PIO devices supported\n", + MAX_NR_PIO_DEVICES); + return; +diff --git a/arch/mips/include/asm/uprobes.h b/arch/mips/include/asm/uprobes.h +index 34c325c674c4..70a4a2f173ff 100644 +--- a/arch/mips/include/asm/uprobes.h ++++ b/arch/mips/include/asm/uprobes.h +@@ -36,7 +36,6 @@ struct arch_uprobe { + unsigned long resume_epc; + u32 insn[2]; + u32 ixol[2]; +- union mips_instruction orig_inst[MAX_UINSN_BYTES / 4]; + }; + + struct arch_uprobe_task { +diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c +index 8452d933a645..4e7b89f2e244 100644 +--- a/arch/mips/kernel/uprobes.c ++++ b/arch/mips/kernel/uprobes.c +@@ -157,7 +157,6 @@ bool is_trap_insn(uprobe_opcode_t *insn) + int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs) + { + struct uprobe_task *utask = current->utask; +- union mips_instruction insn; + + /* + * Now find the EPC where to resume after the breakpoint has been +@@ -168,10 +167,10 @@ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs) + unsigned long epc; + + epc = regs->cp0_epc; +- __compute_return_epc_for_insn(regs, insn); ++ __compute_return_epc_for_insn(regs, ++ (union mips_instruction) aup->insn[0]); + aup->resume_epc = regs->cp0_epc; + } +- + utask->autask.saved_trap_nr = current->thread.trap_nr; + current->thread.trap_nr = UPROBE_TRAP_NR; + regs->cp0_epc = current->utask->xol_vaddr; +@@ -257,7 +256,7 @@ unsigned long arch_uretprobe_hijack_return_addr( + ra = regs->regs[31]; + + /* Replace the return address with the trampoline address */ +- regs->regs[31] = ra; ++ regs->regs[31] = trampoline_vaddr; + + return ra; + } +@@ -280,24 +279,6 @@ int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm, + return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN); + } + +-/** +- * set_orig_insn - Restore the original instruction. +- * @mm: the probed process address space. +- * @auprobe: arch specific probepoint information. +- * @vaddr: the virtual address to insert the opcode. +- * +- * For mm @mm, restore the original opcode (opcode) at @vaddr. +- * Return 0 (success) or a negative errno. +- * +- * This overrides the weak version in kernel/events/uprobes.c. +- */ +-int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm, +- unsigned long vaddr) +-{ +- return uprobe_write_opcode(mm, vaddr, +- *(uprobe_opcode_t *)&auprobe->orig_inst[0].word); +-} +- + void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr, + void *src, unsigned long len) + { +diff --git a/arch/mips/mti-malta/malta-setup.c b/arch/mips/mti-malta/malta-setup.c +index 4740c82fb97a..36b09b2ea972 100644 +--- a/arch/mips/mti-malta/malta-setup.c ++++ b/arch/mips/mti-malta/malta-setup.c +@@ -39,6 +39,9 @@ + #include + #endif + ++#define ROCIT_CONFIG_GEN0 0x1f403000 ++#define ROCIT_CONFIG_GEN0_PCI_IOCU BIT(7) ++ + extern void malta_be_init(void); + extern int malta_be_handler(struct pt_regs *regs, int is_fixup); + +@@ -107,6 +110,8 @@ static void __init fd_activate(void) + static int __init plat_enable_iocoherency(void) + { + int supported = 0; ++ u32 cfg; ++ + if (mips_revision_sconid == MIPS_REVISION_SCON_BONITO) { + if (BONITO_PCICACHECTRL & BONITO_PCICACHECTRL_CPUCOH_PRES) { + BONITO_PCICACHECTRL |= BONITO_PCICACHECTRL_CPUCOH_EN; +@@ -129,7 +134,8 @@ static int __init plat_enable_iocoherency(void) + } else if (mips_cm_numiocu() != 0) { + /* Nothing special needs to be done to enable coherency */ + pr_info("CMP IOCU detected\n"); +- if ((*(unsigned int *)0xbf403000 & 0x81) != 0x81) { ++ cfg = __raw_readl((u32 *)CKSEG1ADDR(ROCIT_CONFIG_GEN0)); ++ if (!(cfg & ROCIT_CONFIG_GEN0_PCI_IOCU)) { + pr_crit("IOCU OPERATION DISABLED BY SWITCH - DEFAULTING TO SW IO COHERENCY\n"); + return 0; + } +diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c +index b7e86e00048f..7b89e7b305e6 100644 +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -694,7 +694,7 @@ unsigned char ibm_architecture_vec[] = { + OV4_MIN_ENT_CAP, /* minimum VP entitled capacity */ + + /* option vector 5: PAPR/OF options */ +- VECTOR_LENGTH(18), /* length */ ++ VECTOR_LENGTH(21), /* length */ + 0, /* don't ignore, don't halt */ + OV5_FEAT(OV5_LPAR) | OV5_FEAT(OV5_SPLPAR) | OV5_FEAT(OV5_LARGE_PAGES) | + OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) | +@@ -725,8 +725,11 @@ unsigned char ibm_architecture_vec[] = { + 0, + 0, + OV5_FEAT(OV5_PFO_HW_RNG) | OV5_FEAT(OV5_PFO_HW_ENCR) | +- OV5_FEAT(OV5_PFO_HW_842), +- OV5_FEAT(OV5_SUB_PROCESSORS), ++ OV5_FEAT(OV5_PFO_HW_842), /* Byte 17 */ ++ 0, /* Byte 18 */ ++ 0, /* Byte 19 */ ++ 0, /* Byte 20 */ ++ OV5_FEAT(OV5_SUB_PROCESSORS), /* Byte 21 */ + + /* option vector 6: IBM PAPR hints */ + VECTOR_LENGTH(3), /* length */ +diff --git a/arch/tile/include/asm/elf.h b/arch/tile/include/asm/elf.h +index c505d77e4d06..e9d54a06736f 100644 +--- a/arch/tile/include/asm/elf.h ++++ b/arch/tile/include/asm/elf.h +@@ -129,6 +129,7 @@ extern int dump_task_regs(struct task_struct *, elf_gregset_t *); + struct linux_binprm; + extern int arch_setup_additional_pages(struct linux_binprm *bprm, + int executable_stack); ++/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */ + #define ARCH_DLINFO \ + do { \ + NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \ +diff --git a/arch/tile/include/uapi/asm/auxvec.h b/arch/tile/include/uapi/asm/auxvec.h +index c93e92709f14..f497123ed980 100644 +--- a/arch/tile/include/uapi/asm/auxvec.h ++++ b/arch/tile/include/uapi/asm/auxvec.h +@@ -18,4 +18,6 @@ + /* The vDSO location. */ + #define AT_SYSINFO_EHDR 33 + ++#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */ ++ + #endif /* _ASM_TILE_AUXVEC_H */ +diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h +index 3142218e546f..6433e28dc9c8 100644 +--- a/arch/x86/include/asm/tlbflush.h ++++ b/arch/x86/include/asm/tlbflush.h +@@ -32,7 +32,7 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate); + /* Initialize cr4 shadow for this CPU. */ + static inline void cr4_init_shadow(void) + { +- this_cpu_write(cpu_tlbstate.cr4, __read_cr4()); ++ this_cpu_write(cpu_tlbstate.cr4, __read_cr4_safe()); + } + + /* Set in this cpu's CR4. */ +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index c2b7522cbf35..2b49b113d65d 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -737,21 +737,20 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c) + identify_cpu_without_cpuid(c); + + /* cyrix could have cpuid enabled via c_identify()*/ +- if (!have_cpuid_p()) +- return; ++ if (have_cpuid_p()) { ++ cpu_detect(c); ++ get_cpu_vendor(c); ++ get_cpu_cap(c); + +- cpu_detect(c); +- get_cpu_vendor(c); +- get_cpu_cap(c); +- +- if (this_cpu->c_early_init) +- this_cpu->c_early_init(c); ++ if (this_cpu->c_early_init) ++ this_cpu->c_early_init(c); + +- c->cpu_index = 0; +- filter_cpuid_features(c, false); ++ c->cpu_index = 0; ++ filter_cpuid_features(c, false); + +- if (this_cpu->c_bsp_init) +- this_cpu->c_bsp_init(c); ++ if (this_cpu->c_bsp_init) ++ this_cpu->c_bsp_init(c); ++ } + + setup_force_cpu_cap(X86_FEATURE_ALWAYS); + fpu__init_system(c); +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 4589b6feeb7b..268df707b5ce 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -408,6 +408,7 @@ struct nested_vmx { + struct list_head vmcs02_pool; + int vmcs02_num; + u64 vmcs01_tsc_offset; ++ bool change_vmcs01_virtual_x2apic_mode; + /* L2 must run next, and mustn't decide to exit to L1. */ + bool nested_run_pending; + /* +@@ -8184,6 +8185,12 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set) + { + u32 sec_exec_control; + ++ /* Postpone execution until vmcs01 is the current VMCS. */ ++ if (is_guest_mode(vcpu)) { ++ to_vmx(vcpu)->nested.change_vmcs01_virtual_x2apic_mode = true; ++ return; ++ } ++ + /* + * There is not point to enable virtualize x2apic without enable + * apicv +@@ -10483,6 +10490,12 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, + /* Update TSC_OFFSET if TSC was changed while L2 ran */ + vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset); + ++ if (vmx->nested.change_vmcs01_virtual_x2apic_mode) { ++ vmx->nested.change_vmcs01_virtual_x2apic_mode = false; ++ vmx_set_virtual_x2apic_mode(vcpu, ++ vcpu->arch.apic_base & X2APIC_ENABLE); ++ } ++ + /* This is needed for same reason as it was needed in prepare_vmcs02 */ + vmx->host_rsp = 0; + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 839b1e17481b..c3e461ec40e4 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -780,7 +780,7 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx) + switch (ret) { + case BLK_MQ_RQ_QUEUE_OK: + queued++; +- continue; ++ break; + case BLK_MQ_RQ_QUEUE_BUSY: + list_add(&rq->queuelist, &rq_list); + __blk_mq_requeue_request(rq); +diff --git a/drivers/acpi/acpica/hwxface.c b/drivers/acpi/acpica/hwxface.c +index 5f97468df8ff..b2e50d8007fe 100644 +--- a/drivers/acpi/acpica/hwxface.c ++++ b/drivers/acpi/acpica/hwxface.c +@@ -504,11 +504,20 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, u8 *sleep_type_b) + * Evaluate the \_Sx namespace object containing the register values + * for this state + */ +- info->relative_pathname = +- ACPI_CAST_PTR(char, acpi_gbl_sleep_state_names[sleep_state]); ++ info->relative_pathname = ACPI_CAST_PTR(char, ++ acpi_gbl_sleep_state_names ++ [sleep_state]); ++ + status = acpi_ns_evaluate(info); + if (ACPI_FAILURE(status)) { +- goto cleanup; ++ if (status == AE_NOT_FOUND) { ++ ++ /* The _Sx states are optional, ignore NOT_FOUND */ ++ ++ goto final_cleanup; ++ } ++ ++ goto warning_cleanup; + } + + /* Must have a return object */ +@@ -517,7 +526,7 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, u8 *sleep_type_b) + ACPI_ERROR((AE_INFO, "No Sleep State object returned from [%s]", + info->relative_pathname)); + status = AE_AML_NO_RETURN_VALUE; +- goto cleanup; ++ goto warning_cleanup; + } + + /* Return object must be of type Package */ +@@ -526,7 +535,7 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, u8 *sleep_type_b) + ACPI_ERROR((AE_INFO, + "Sleep State return object is not a Package")); + status = AE_AML_OPERAND_TYPE; +- goto cleanup1; ++ goto return_value_cleanup; + } + + /* +@@ -570,16 +579,17 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, u8 *sleep_type_b) + break; + } + +-cleanup1: ++return_value_cleanup: + acpi_ut_remove_reference(info->return_object); + +-cleanup: ++warning_cleanup: + if (ACPI_FAILURE(status)) { + ACPI_EXCEPTION((AE_INFO, status, + "While evaluating Sleep State [%s]", + info->relative_pathname)); + } + ++final_cleanup: + ACPI_FREE(info); + return_ACPI_STATUS(status); + } +diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c +index 8a1432e8bb80..01d4be2c354b 100644 +--- a/drivers/char/hw_random/omap-rng.c ++++ b/drivers/char/hw_random/omap-rng.c +@@ -384,7 +384,12 @@ static int omap_rng_probe(struct platform_device *pdev) + } + + pm_runtime_enable(&pdev->dev); +- pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_get_sync(&pdev->dev); ++ if (ret) { ++ dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret); ++ pm_runtime_put_noidle(&pdev->dev); ++ goto err_ioremap; ++ } + + ret = (dev->of_node) ? of_get_omap_rng_device_details(priv, pdev) : + get_omap_rng_device_details(priv); +@@ -435,8 +440,15 @@ static int __maybe_unused omap_rng_suspend(struct device *dev) + static int __maybe_unused omap_rng_resume(struct device *dev) + { + struct omap_rng_dev *priv = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = pm_runtime_get_sync(dev); ++ if (ret) { ++ dev_err(dev, "Failed to runtime_get device: %d\n", ret); ++ pm_runtime_put_noidle(dev); ++ return ret; ++ } + +- pm_runtime_get_sync(dev); + priv->pdata->init(priv); + + return 0; +diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c +index c12130485fc1..678af51fb29e 100644 +--- a/drivers/char/tpm/tpm2-cmd.c ++++ b/drivers/char/tpm/tpm2-cmd.c +@@ -657,7 +657,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id, u32 *value, + + rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), desc); + if (!rc) +- *value = cmd.params.get_tpm_pt_out.value; ++ *value = be32_to_cpu(cmd.params.get_tpm_pt_out.value); + + return rc; + } +diff --git a/drivers/clk/clk-xgene.c b/drivers/clk/clk-xgene.c +index 10224b01b97c..b134a8b15e2c 100644 +--- a/drivers/clk/clk-xgene.c ++++ b/drivers/clk/clk-xgene.c +@@ -351,8 +351,8 @@ static int xgene_clk_set_rate(struct clk_hw *hw, unsigned long rate, + /* Set new divider */ + data = xgene_clk_read(pclk->param.divider_reg + + pclk->param.reg_divider_offset); +- data &= ~((1 << pclk->param.reg_divider_width) - 1) +- << pclk->param.reg_divider_shift; ++ data &= ~(((1 << pclk->param.reg_divider_width) - 1) ++ << pclk->param.reg_divider_shift); + data |= divider; + xgene_clk_write(data, pclk->param.divider_reg + + pclk->param.reg_divider_offset); +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index e44a1bfb0250..9d05d7dbcfa9 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -1183,8 +1183,8 @@ static struct at_xdmac_desc *at_xdmac_memset_create_desc(struct dma_chan *chan, + desc->lld.mbr_cfg = chan_cc; + + dev_dbg(chan2dev(chan), +- "%s: lld: mbr_da=%pad, mbr_ds=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n", +- __func__, &desc->lld.mbr_da, &desc->lld.mbr_ds, desc->lld.mbr_ubc, ++ "%s: lld: mbr_da=%pad, mbr_ds=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n", ++ __func__, &desc->lld.mbr_da, desc->lld.mbr_ds, desc->lld.mbr_ubc, + desc->lld.mbr_cfg); + + return desc; +@@ -2055,7 +2055,7 @@ err_dma_unregister: + err_clk_disable: + clk_disable_unprepare(atxdmac->clk); + err_free_irq: +- free_irq(atxdmac->irq, atxdmac->dma.dev); ++ free_irq(atxdmac->irq, atxdmac); + return ret; + } + +@@ -2071,7 +2071,7 @@ static int at_xdmac_remove(struct platform_device *pdev) + + synchronize_irq(atxdmac->irq); + +- free_irq(atxdmac->irq, atxdmac->dma.dev); ++ free_irq(atxdmac->irq, atxdmac); + + for (i = 0; i < atxdmac->dma.chancnt; i++) { + struct at_xdmac_chan *atchan = &atxdmac->chan[i]; +diff --git a/drivers/gpio/gpio-sa1100.c b/drivers/gpio/gpio-sa1100.c +index 990fa9023e22..3b6bce0518ab 100644 +--- a/drivers/gpio/gpio-sa1100.c ++++ b/drivers/gpio/gpio-sa1100.c +@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(struct irq_domain *d, + { + irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip, + handle_edge_irq); +- irq_set_noprobe(irq); ++ irq_set_probe(irq); + + return 0; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c +index bfcc6408a772..b7f4b826febe 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c +@@ -36,7 +36,10 @@ nv04_fifo_dma_object_dtor(struct nvkm_fifo_chan *base, int cookie) + { + struct nv04_fifo_chan *chan = nv04_fifo_chan(base); + struct nvkm_instmem *imem = chan->fifo->base.engine.subdev.device->imem; ++ ++ mutex_lock(&chan->fifo->base.engine.subdev.mutex); + nvkm_ramht_remove(imem->ramht, cookie); ++ mutex_unlock(&chan->fifo->base.engine.subdev.mutex); + } + + static int +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index caa73de584a5..3aaa07dafc00 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -3015,6 +3015,12 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + if (rdev->pdev->device == 0x6811 && + rdev->pdev->revision == 0x81) + max_mclk = 120000; ++ /* limit sclk/mclk on Jet parts for stability */ ++ if (rdev->pdev->device == 0x6665 && ++ rdev->pdev->revision == 0xc3) { ++ max_sclk = 75000; ++ max_mclk = 80000; ++ } + + if (rps->vce_active) { + rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk; +diff --git a/drivers/hwmon/adt7411.c b/drivers/hwmon/adt7411.c +index 827c03703128..a7f886961830 100644 +--- a/drivers/hwmon/adt7411.c ++++ b/drivers/hwmon/adt7411.c +@@ -30,6 +30,7 @@ + + #define ADT7411_REG_CFG1 0x18 + #define ADT7411_CFG1_START_MONITOR (1 << 0) ++#define ADT7411_CFG1_RESERVED_BIT3 (1 << 3) + + #define ADT7411_REG_CFG2 0x19 + #define ADT7411_CFG2_DISABLE_AVG (1 << 5) +@@ -296,8 +297,10 @@ static int adt7411_probe(struct i2c_client *client, + mutex_init(&data->device_lock); + mutex_init(&data->update_lock); + ++ /* According to the datasheet, we must only write 1 to bit 3 */ + ret = adt7411_modify_bit(client, ADT7411_REG_CFG1, +- ADT7411_CFG1_START_MONITOR, 1); ++ ADT7411_CFG1_RESERVED_BIT3 ++ | ADT7411_CFG1_START_MONITOR, 1); + if (ret < 0) + return ret; + +diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c +index bb6685fb08c6..6aa648cb5381 100644 +--- a/drivers/infiniband/core/multicast.c ++++ b/drivers/infiniband/core/multicast.c +@@ -106,7 +106,6 @@ struct mcast_group { + atomic_t refcount; + enum mcast_group_state state; + struct ib_sa_query *query; +- int query_id; + u16 pkey_index; + u8 leave_state; + int retries; +@@ -339,11 +338,7 @@ static int send_join(struct mcast_group *group, struct mcast_member *member) + member->multicast.comp_mask, + 3000, GFP_KERNEL, join_handler, group, + &group->query); +- if (ret >= 0) { +- group->query_id = ret; +- ret = 0; +- } +- return ret; ++ return (ret > 0) ? 0 : ret; + } + + static int send_leave(struct mcast_group *group, u8 leave_state) +@@ -363,11 +358,7 @@ static int send_leave(struct mcast_group *group, u8 leave_state) + IB_SA_MCMEMBER_REC_JOIN_STATE, + 3000, GFP_KERNEL, leave_handler, + group, &group->query); +- if (ret >= 0) { +- group->query_id = ret; +- ret = 0; +- } +- return ret; ++ return (ret > 0) ? 0 : ret; + } + + static void join_group(struct mcast_group *group, struct mcast_member *member, +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index 05179f47bbde..d862b9b7910e 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -1080,6 +1080,27 @@ void handle_port_mgmt_change_event(struct work_struct *work) + + /* Generate GUID changed event */ + if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) { ++ if (mlx4_is_master(dev->dev)) { ++ union ib_gid gid; ++ int err = 0; ++ ++ if (!eqe->event.port_mgmt_change.params.port_info.gid_prefix) ++ err = __mlx4_ib_query_gid(&dev->ib_dev, port, 0, &gid, 1); ++ else ++ gid.global.subnet_prefix = ++ eqe->event.port_mgmt_change.params.port_info.gid_prefix; ++ if (err) { ++ pr_warn("Could not change QP1 subnet prefix for port %d: query_gid error (%d)\n", ++ port, err); ++ } else { ++ pr_debug("Changing QP1 subnet prefix for port %d. old=0x%llx. new=0x%llx\n", ++ port, ++ (u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix), ++ be64_to_cpu(gid.global.subnet_prefix)); ++ atomic64_set(&dev->sriov.demux[port - 1].subnet_prefix, ++ be64_to_cpu(gid.global.subnet_prefix)); ++ } ++ } + mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE); + /*if master, notify all slaves*/ + if (mlx4_is_master(dev->dev)) +@@ -2154,6 +2175,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev) + if (err) + goto demux_err; + dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id; ++ atomic64_set(&dev->sriov.demux[i].subnet_prefix, ++ be64_to_cpu(gid.global.subnet_prefix)); + err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1, + &dev->sriov.sqps[i]); + if (err) +diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c +index 99451d887266..36ec8aa048aa 100644 +--- a/drivers/infiniband/hw/mlx4/mcg.c ++++ b/drivers/infiniband/hw/mlx4/mcg.c +@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_group *group) + if (!group->members[i]) + leave_state |= (1 << i); + +- return leave_state & (group->rec.scope_join_state & 7); ++ return leave_state & (group->rec.scope_join_state & 0xf); + } + + static int join_group(struct mcast_group *group, int slave, u8 join_mask) +@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(struct work_struct *work) + } else + mcg_warn_group(group, "DRIVER BUG\n"); + } else if (group->state == MCAST_LEAVE_SENT) { +- if (group->rec.scope_join_state & 7) +- group->rec.scope_join_state &= 0xf8; ++ if (group->rec.scope_join_state & 0xf) ++ group->rec.scope_join_state &= 0xf0; + group->state = MCAST_IDLE; + mutex_unlock(&group->lock); + if (release_group(group, 1)) +@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast_group *group, u8 leave_mask, + static int handle_join_req(struct mcast_group *group, u8 join_mask, + struct mcast_req *req) + { +- u8 group_join_state = group->rec.scope_join_state & 7; ++ u8 group_join_state = group->rec.scope_join_state & 0xf; + int ref = 0; + u16 status; + struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data; +@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(struct work_struct *work) + u8 cur_join_state; + + resp_join_state = ((struct ib_sa_mcmember_data *) +- group->response_sa_mad.data)->scope_join_state & 7; +- cur_join_state = group->rec.scope_join_state & 7; ++ group->response_sa_mad.data)->scope_join_state & 0xf; ++ cur_join_state = group->rec.scope_join_state & 0xf; + + if (method == IB_MGMT_METHOD_GET_RESP) { + /* successfull join */ +@@ -710,7 +710,7 @@ process_requests: + req = list_first_entry(&group->pending_list, struct mcast_req, + group_list); + sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data; +- req_join_state = sa_data->scope_join_state & 0x7; ++ req_join_state = sa_data->scope_join_state & 0xf; + + /* For a leave request, we will immediately answer the VF, and + * update our internal counters. The actual leave will be sent +diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h +index 1caa11edac03..78f29e91653a 100644 +--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h ++++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h +@@ -441,7 +441,7 @@ struct mlx4_ib_demux_ctx { + struct workqueue_struct *wq; + struct workqueue_struct *ud_wq; + spinlock_t ud_lock; +- __be64 subnet_prefix; ++ atomic64_t subnet_prefix; + __be64 guid_cache[128]; + struct mlx4_ib_dev *dev; + /* the following lock protects both mcg_table and mcg_mgid0_list */ +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index ea1e2ddaddf5..f350f2d61c15 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -2331,24 +2331,27 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_ud_wr *wr, + sqp->ud_header.grh.flow_label = + ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff); + sqp->ud_header.grh.hop_limit = ah->av.ib.hop_limit; +- if (is_eth) ++ if (is_eth) { + memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16); +- else { +- if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) { +- /* When multi-function is enabled, the ib_core gid +- * indexes don't necessarily match the hw ones, so +- * we must use our own cache */ +- sqp->ud_header.grh.source_gid.global.subnet_prefix = +- to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1]. +- subnet_prefix; +- sqp->ud_header.grh.source_gid.global.interface_id = +- to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1]. +- guid_cache[ah->av.ib.gid_index]; +- } else +- ib_get_cached_gid(ib_dev, +- be32_to_cpu(ah->av.ib.port_pd) >> 24, +- ah->av.ib.gid_index, +- &sqp->ud_header.grh.source_gid, NULL); ++ } else { ++ if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) { ++ /* When multi-function is enabled, the ib_core gid ++ * indexes don't necessarily match the hw ones, so ++ * we must use our own cache ++ */ ++ sqp->ud_header.grh.source_gid.global.subnet_prefix = ++ cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov. ++ demux[sqp->qp.port - 1]. ++ subnet_prefix))); ++ sqp->ud_header.grh.source_gid.global.interface_id = ++ to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1]. ++ guid_cache[ah->av.ib.gid_index]; ++ } else { ++ ib_get_cached_gid(ib_dev, ++ be32_to_cpu(ah->av.ib.port_pd) >> 24, ++ ah->av.ib.gid_index, ++ &sqp->ud_header.grh.source_gid, NULL); ++ } + } + memcpy(sqp->ud_header.grh.destination_gid.raw, + ah->av.ib.dgid, 16); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h +index 3ede10309754..69a151ae8261 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib.h ++++ b/drivers/infiniband/ulp/ipoib/ipoib.h +@@ -472,6 +472,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb, + struct ipoib_ah *address, u32 qpn); + void ipoib_reap_ah(struct work_struct *work); + ++struct ipoib_path *__path_find(struct net_device *dev, void *gid); + void ipoib_mark_paths_invalid(struct net_device *dev); + void ipoib_flush_paths(struct net_device *dev); + struct ipoib_dev_priv *ipoib_intf_alloc(const char *format); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index 3ae9726efb98..8ca75af0e6d1 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -1299,6 +1299,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx) + } + } + ++#define QPN_AND_OPTIONS_OFFSET 4 ++ + static void ipoib_cm_tx_start(struct work_struct *work) + { + struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv, +@@ -1307,6 +1309,7 @@ static void ipoib_cm_tx_start(struct work_struct *work) + struct ipoib_neigh *neigh; + struct ipoib_cm_tx *p; + unsigned long flags; ++ struct ipoib_path *path; + int ret; + + struct ib_sa_path_rec pathrec; +@@ -1319,7 +1322,19 @@ static void ipoib_cm_tx_start(struct work_struct *work) + p = list_entry(priv->cm.start_list.next, typeof(*p), list); + list_del_init(&p->list); + neigh = p->neigh; ++ + qpn = IPOIB_QPN(neigh->daddr); ++ /* ++ * As long as the search is with these 2 locks, ++ * path existence indicates its validity. ++ */ ++ path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET); ++ if (!path) { ++ pr_info("%s ignore not valid path %pI6\n", ++ __func__, ++ neigh->daddr + QPN_AND_OPTIONS_OFFSET); ++ goto free_neigh; ++ } + memcpy(&pathrec, &p->path->pathrec, sizeof pathrec); + + spin_unlock_irqrestore(&priv->lock, flags); +@@ -1331,6 +1346,7 @@ static void ipoib_cm_tx_start(struct work_struct *work) + spin_lock_irqsave(&priv->lock, flags); + + if (ret) { ++free_neigh: + neigh = p->neigh; + if (neigh) { + neigh->cm = NULL; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index fa9c42ff1fb0..85de078fb0ce 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -1028,8 +1028,17 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, + } + + if (level == IPOIB_FLUSH_LIGHT) { ++ int oper_up; + ipoib_mark_paths_invalid(dev); ++ /* Set IPoIB operation as down to prevent races between: ++ * the flush flow which leaves MCG and on the fly joins ++ * which can happen during that time. mcast restart task ++ * should deal with join requests we missed. ++ */ ++ oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags); + ipoib_mcast_dev_flush(dev); ++ if (oper_up) ++ set_bit(IPOIB_FLAG_OPER_UP, &priv->flags); + ipoib_flush_ah(dev); + } + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 942dffca6a9d..5f7681b975d0 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -481,7 +481,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf) + return -EINVAL; + } + +-static struct ipoib_path *__path_find(struct net_device *dev, void *gid) ++struct ipoib_path *__path_find(struct net_device *dev, void *gid) + { + struct ipoib_dev_priv *priv = netdev_priv(dev); + struct rb_node *n = priv->path_tree.rb_node; +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index 2fc499a2207e..44aa57edf207 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -544,7 +544,7 @@ static struct notifier_block gic_cpu_notifier = { + static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask, + unsigned long cluster_id) + { +- int cpu = *base_cpu; ++ int next_cpu, cpu = *base_cpu; + unsigned long mpidr = cpu_logical_map(cpu); + u16 tlist = 0; + +@@ -558,9 +558,10 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask, + + tlist |= 1 << (mpidr & 0xf); + +- cpu = cpumask_next(cpu, mask); +- if (cpu >= nr_cpu_ids) ++ next_cpu = cpumask_next(cpu, mask); ++ if (next_cpu >= nr_cpu_ids) + goto out; ++ cpu = next_cpu; + + mpidr = cpu_logical_map(cpu); + +diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c +index d8956b4a7b09..c8b513ee117c 100644 +--- a/drivers/md/dm-log-writes.c ++++ b/drivers/md/dm-log-writes.c +@@ -259,7 +259,7 @@ static int log_one_block(struct log_writes_c *lc, + sector++; + + atomic_inc(&lc->io_blocks); +- bio = bio_alloc(GFP_KERNEL, block->vec_cnt); ++ bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES)); + if (!bio) { + DMERR("Couldn't alloc log bio"); + goto error; +@@ -280,7 +280,7 @@ static int log_one_block(struct log_writes_c *lc, + if (ret != block->vecs[i].bv_len) { + atomic_inc(&lc->io_blocks); + submit_bio(WRITE, bio); +- bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i); ++ bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES)); + if (!bio) { + DMERR("Couldn't alloc log bio"); + goto error; +diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c b/drivers/media/usb/em28xx/em28xx-i2c.c +index a19b5c8b56ff..1a9e1e556706 100644 +--- a/drivers/media/usb/em28xx/em28xx-i2c.c ++++ b/drivers/media/usb/em28xx/em28xx-i2c.c +@@ -507,9 +507,8 @@ static int em28xx_i2c_xfer(struct i2c_adapter *i2c_adap, + if (dev->disconnected) + return -ENODEV; + +- rc = rt_mutex_trylock(&dev->i2c_bus_lock); +- if (rc < 0) +- return rc; ++ if (!rt_mutex_trylock(&dev->i2c_bus_lock)) ++ return -EAGAIN; + + /* Switch I2C bus if needed */ + if (bus != dev->cur_i2c_bus && +diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c +index f23df4a9d8c5..52b88e9e656b 100644 +--- a/drivers/media/usb/gspca/cpia1.c ++++ b/drivers/media/usb/gspca/cpia1.c +@@ -1624,7 +1624,7 @@ static int sd_start(struct gspca_dev *gspca_dev) + + static void sd_stopN(struct gspca_dev *gspca_dev) + { +- struct sd *sd = (struct sd *) gspca_dev; ++ struct sd *sd __maybe_unused = (struct sd *) gspca_dev; + + command_pause(gspca_dev); + +diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c +index 39c96bb4c985..0712b1bc90b4 100644 +--- a/drivers/media/usb/gspca/konica.c ++++ b/drivers/media/usb/gspca/konica.c +@@ -243,7 +243,7 @@ static int sd_start(struct gspca_dev *gspca_dev) + + static void sd_stopN(struct gspca_dev *gspca_dev) + { +- struct sd *sd = (struct sd *) gspca_dev; ++ struct sd *sd __maybe_unused = (struct sd *) gspca_dev; + + konica_stream_off(gspca_dev); + #if IS_ENABLED(CONFIG_INPUT) +diff --git a/drivers/media/usb/gspca/t613.c b/drivers/media/usb/gspca/t613.c +index e2cc4e5a0ccb..bb52fc1fe598 100644 +--- a/drivers/media/usb/gspca/t613.c ++++ b/drivers/media/usb/gspca/t613.c +@@ -837,7 +837,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev, + u8 *data, /* isoc packet */ + int len) /* iso packet length */ + { +- struct sd *sd = (struct sd *) gspca_dev; ++ struct sd *sd __maybe_unused = (struct sd *) gspca_dev; + int pkt_type; + + if (data[0] == 0x5a) { +diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c +index 28a057fae0a1..72bbb12fb938 100644 +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -798,14 +798,16 @@ static int pxamci_probe(struct platform_device *pdev) + gpio_direction_output(gpio_power, + host->pdata->gpio_power_invert); + } +- if (gpio_is_valid(gpio_ro)) ++ if (gpio_is_valid(gpio_ro)) { + ret = mmc_gpio_request_ro(mmc, gpio_ro); +- if (ret) { +- dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro); +- goto out; +- } else { +- mmc->caps2 |= host->pdata->gpio_card_ro_invert ? +- 0 : MMC_CAP2_RO_ACTIVE_HIGH; ++ if (ret) { ++ dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", ++ gpio_ro); ++ goto out; ++ } else { ++ mmc->caps2 |= host->pdata->gpio_card_ro_invert ? ++ 0 : MMC_CAP2_RO_ACTIVE_HIGH; ++ } + } + + if (gpio_is_valid(gpio_cd)) +diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c +index c72313d66cf6..bc054a5ed7f8 100644 +--- a/drivers/mtd/nand/davinci_nand.c ++++ b/drivers/mtd/nand/davinci_nand.c +@@ -241,6 +241,9 @@ static void nand_davinci_hwctl_4bit(struct mtd_info *mtd, int mode) + unsigned long flags; + u32 val; + ++ /* Reset ECC hardware */ ++ davinci_nand_readl(info, NAND_4BIT_ECC1_OFFSET); ++ + spin_lock_irqsave(&davinci_nand_lock, flags); + + /* Start 4-bit ECC calculation for read/write */ +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index ad535a854e5c..eab132778e67 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -471,9 +472,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb); + /* + * CAN device restart for bus-off recovery + */ +-static void can_restart(unsigned long data) ++static void can_restart(struct net_device *dev) + { +- struct net_device *dev = (struct net_device *)data; + struct can_priv *priv = netdev_priv(dev); + struct net_device_stats *stats = &dev->stats; + struct sk_buff *skb; +@@ -513,6 +513,14 @@ restart: + netdev_err(dev, "Error %d during restart", err); + } + ++static void can_restart_work(struct work_struct *work) ++{ ++ struct delayed_work *dwork = to_delayed_work(work); ++ struct can_priv *priv = container_of(dwork, struct can_priv, restart_work); ++ ++ can_restart(priv->dev); ++} ++ + int can_restart_now(struct net_device *dev) + { + struct can_priv *priv = netdev_priv(dev); +@@ -526,8 +534,8 @@ int can_restart_now(struct net_device *dev) + if (priv->state != CAN_STATE_BUS_OFF) + return -EBUSY; + +- /* Runs as soon as possible in the timer context */ +- mod_timer(&priv->restart_timer, jiffies); ++ cancel_delayed_work_sync(&priv->restart_work); ++ can_restart(dev); + + return 0; + } +@@ -548,8 +556,8 @@ void can_bus_off(struct net_device *dev) + netif_carrier_off(dev); + + if (priv->restart_ms) +- mod_timer(&priv->restart_timer, +- jiffies + (priv->restart_ms * HZ) / 1000); ++ schedule_delayed_work(&priv->restart_work, ++ msecs_to_jiffies(priv->restart_ms)); + } + EXPORT_SYMBOL_GPL(can_bus_off); + +@@ -658,6 +666,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max) + return NULL; + + priv = netdev_priv(dev); ++ priv->dev = dev; + + if (echo_skb_max) { + priv->echo_skb_max = echo_skb_max; +@@ -667,7 +676,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max) + + priv->state = CAN_STATE_STOPPED; + +- init_timer(&priv->restart_timer); ++ INIT_DELAYED_WORK(&priv->restart_work, can_restart_work); + + return dev; + } +@@ -748,8 +757,6 @@ int open_candev(struct net_device *dev) + if (!netif_carrier_ok(dev)) + netif_carrier_on(dev); + +- setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev); +- + return 0; + } + EXPORT_SYMBOL_GPL(open_candev); +@@ -764,7 +771,7 @@ void close_candev(struct net_device *dev) + { + struct can_priv *priv = netdev_priv(dev); + +- del_timer_sync(&priv->restart_timer); ++ cancel_delayed_work_sync(&priv->restart_work); + can_flush_echo_skb(dev); + } + EXPORT_SYMBOL_GPL(close_candev); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c +index 2d74c6e4d7b6..1cf715c72683 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -302,13 +302,15 @@ void i40e_debug_aq(struct i40e_hw *hw, enum i40e_debug_mask mask, void *desc, + void *buffer, u16 buf_len) + { + struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc; +- u16 len = le16_to_cpu(aq_desc->datalen); ++ u16 len; + u8 *buf = (u8 *)buffer; + u16 i = 0; + + if ((!(mask & hw->debug_mask)) || (desc == NULL)) + return; + ++ len = le16_to_cpu(aq_desc->datalen); ++ + i40e_debug(hw, mask, + "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n", + le16_to_cpu(aq_desc->opcode), +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +index 8b4561e8ce1a..ef493271c712 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +@@ -4176,7 +4176,7 @@ static void ath9k_hw_ar9300_set_board_values(struct ath_hw *ah, + if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah)) + ar9003_hw_internal_regulator_apply(ah); + ar9003_hw_apply_tuning_caps(ah); +- ar9003_hw_apply_minccapwr_thresh(ah, chan); ++ ar9003_hw_apply_minccapwr_thresh(ah, is2ghz); + ar9003_hw_txend_to_xpa_off_apply(ah, is2ghz); + ar9003_hw_thermometer_apply(ah); + ar9003_hw_thermo_cal_apply(ah); +diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c +index 410a6645d316..59cef6c69fe8 100644 +--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c +@@ -726,8 +726,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev, + return -ENOMEM; + err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, + glom_skb); +- if (err) ++ if (err) { ++ brcmu_pkt_buf_free_skb(glom_skb); + goto done; ++ } + + skb_queue_walk(pktq, skb) { + memcpy(skb->data, glom_skb->data, skb->len); +diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c +index 796f5f9d5d5a..b7df576bb84d 100644 +--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c ++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c +@@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub) + + pa = dma_map_single(di->dmadev, p->data, di->rxbufsize, + DMA_FROM_DEVICE); +- if (dma_mapping_error(di->dmadev, pa)) ++ if (dma_mapping_error(di->dmadev, pa)) { ++ brcmu_pkt_buf_free_skb(p); + return false; ++ } + + /* save the free packet pointer */ + di->rxp[rxout] = p; +diff --git a/drivers/net/wireless/brcm80211/brcmsmac/stf.c b/drivers/net/wireless/brcm80211/brcmsmac/stf.c +index dd9162722495..0ab865de1491 100644 +--- a/drivers/net/wireless/brcm80211/brcmsmac/stf.c ++++ b/drivers/net/wireless/brcm80211/brcmsmac/stf.c +@@ -87,7 +87,7 @@ void + brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc, u16 *ss_algo_channel, + u16 chanspec) + { +- struct tx_power power; ++ struct tx_power power = { }; + u8 siso_mcs_id, cdd_mcs_id, stbc_mcs_id; + + /* Clear previous settings */ +diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c +index 610c442c7ab2..9584f950fd2f 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/iwlwifi/mvm/fw.c +@@ -935,7 +935,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id) + } + + mvm->fw_dbg_conf = conf_id; +- return ret; ++ ++ return 0; + } + + static int iwl_mvm_config_ltr(struct iwl_mvm *mvm) +diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +index f96ab2f4b90e..ce12717e656a 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c +@@ -3992,8 +3992,8 @@ static int iwl_mvm_mac_get_survey(struct ieee80211_hw *hw, int idx, + if (idx != 0) + return -ENOENT; + +- if (fw_has_capa(&mvm->fw->ucode_capa, +- IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS)) ++ if (!fw_has_capa(&mvm->fw->ucode_capa, ++ IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS)) + return -ENOENT; + + mutex_lock(&mvm->mutex); +@@ -4039,8 +4039,8 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw, + struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); + struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + +- if (fw_has_capa(&mvm->fw->ucode_capa, +- IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS)) ++ if (!fw_has_capa(&mvm->fw->ucode_capa, ++ IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS)) + return; + + /* if beacon filtering isn't on mac80211 does it anyway */ +diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c b/drivers/net/wireless/iwlwifi/mvm/sf.c +index b0f59fdd287c..d7d72adb6343 100644 +--- a/drivers/net/wireless/iwlwifi/mvm/sf.c ++++ b/drivers/net/wireless/iwlwifi/mvm/sf.c +@@ -215,7 +215,7 @@ static int iwl_mvm_sf_config(struct iwl_mvm *mvm, u8 sta_id, + enum iwl_sf_state new_state) + { + struct iwl_sf_cfg_cmd sf_cmd = { +- .state = cpu_to_le32(SF_FULL_ON), ++ .state = cpu_to_le32(new_state), + }; + struct ieee80211_sta *sta; + int ret = 0; +diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c +index a8c8a4a7420b..8dfe6b2bc703 100644 +--- a/drivers/net/wireless/iwlwifi/pcie/tx.c ++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c +@@ -1508,9 +1508,9 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans, + + /* start the TFD with the scratchbuf */ + scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE); +- memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size); ++ memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size); + iwl_pcie_txq_build_tfd(trans, txq, +- iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr), ++ iwl_pcie_get_scratchbuf_dma(txq, idx), + scratch_size, true); + + /* map first command fragment, if any remains */ +diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c +index ccb07a1b153d..23e53780728b 100644 +--- a/drivers/nfc/fdp/fdp.c ++++ b/drivers/nfc/fdp/fdp.c +@@ -352,7 +352,7 @@ static int fdp_nci_patch_otp(struct nci_dev *ndev) + { + struct fdp_nci_info *info = nci_get_drvdata(ndev); + struct device *dev = &info->phy->i2c_dev->dev; +- u8 conn_id; ++ int conn_id; + int r = 0; + + if (info->otp_version >= info->otp_patch_version) +@@ -423,7 +423,7 @@ static int fdp_nci_patch_ram(struct nci_dev *ndev) + { + struct fdp_nci_info *info = nci_get_drvdata(ndev); + struct device *dev = &info->phy->i2c_dev->dev; +- u8 conn_id; ++ int conn_id; + int r = 0; + + if (info->ram_version >= info->ram_patch_version) +diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c +index be3755c973e9..8af1f900ea65 100644 +--- a/drivers/perf/arm_pmu.c ++++ b/drivers/perf/arm_pmu.c +@@ -815,6 +815,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu) + if (i > 0 && spi != using_spi) { + pr_err("PPI/SPI IRQ type mismatch for %s!\n", + dn->name); ++ of_node_put(dn); + kfree(irqs); + return -EINVAL; + } +diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c +index 589872cc8adb..a19c29c79b0a 100644 +--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c ++++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c +@@ -73,6 +73,12 @@ static void uniphier_pctl_pin_dbg_show(struct pinctrl_dev *pctldev, + case UNIPHIER_PIN_PULL_DOWN: + pull_dir = "DOWN"; + break; ++ case UNIPHIER_PIN_PULL_UP_FIXED: ++ pull_dir = "UP(FIXED)"; ++ break; ++ case UNIPHIER_PIN_PULL_DOWN_FIXED: ++ pull_dir = "DOWN(FIXED)"; ++ break; + case UNIPHIER_PIN_PULL_NONE: + pull_dir = "NONE"; + break; +diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c +index 6fa0c7d13290..4bda998afdef 100644 +--- a/drivers/regulator/qcom_smd-regulator.c ++++ b/drivers/regulator/qcom_smd-regulator.c +@@ -166,29 +166,30 @@ static const struct regulator_desc pm8x41_hfsmps = { + static const struct regulator_desc pm8841_ftsmps = { + .linear_ranges = (struct regulator_linear_range[]) { + REGULATOR_LINEAR_RANGE(350000, 0, 184, 5000), +- REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000), ++ REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000), + }, + .n_linear_ranges = 2, +- .n_voltages = 340, ++ .n_voltages = 262, + .ops = &rpm_smps_ldo_ops, + }; + + static const struct regulator_desc pm8941_boost = { + .linear_ranges = (struct regulator_linear_range[]) { +- REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000), ++ REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000), + }, + .n_linear_ranges = 1, +- .n_voltages = 16, ++ .n_voltages = 31, + .ops = &rpm_smps_ldo_ops, + }; + + static const struct regulator_desc pm8941_pldo = { + .linear_ranges = (struct regulator_linear_range[]) { +- REGULATOR_LINEAR_RANGE( 750000, 0, 30, 25000), +- REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000), ++ REGULATOR_LINEAR_RANGE( 750000, 0, 63, 12500), ++ REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000), ++ REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000), + }, +- .n_linear_ranges = 2, +- .n_voltages = 100, ++ .n_linear_ranges = 3, ++ .n_voltages = 164, + .ops = &rpm_smps_ldo_ops, + }; + +diff --git a/drivers/regulator/qcom_spmi-regulator.c b/drivers/regulator/qcom_spmi-regulator.c +index 88a5dc88badc..fee6457e3111 100644 +--- a/drivers/regulator/qcom_spmi-regulator.c ++++ b/drivers/regulator/qcom_spmi-regulator.c +@@ -1050,6 +1050,8 @@ static struct regulator_ops spmi_vs_ops = { + .set_pull_down = spmi_regulator_common_set_pull_down, + .set_soft_start = spmi_regulator_common_set_soft_start, + .set_over_current_protection = spmi_regulator_vs_ocp, ++ .set_mode = spmi_regulator_common_set_mode, ++ .get_mode = spmi_regulator_common_get_mode, + }; + + static struct regulator_ops spmi_boost_ops = { +@@ -1440,6 +1442,7 @@ static const struct spmi_regulator_data pm8941_regulators[] = { + { "s1", 0x1400, "vdd_s1", }, + { "s2", 0x1700, "vdd_s2", }, + { "s3", 0x1a00, "vdd_s3", }, ++ { "s4", 0xa000, }, + { "l1", 0x4000, "vdd_l1_l3", }, + { "l2", 0x4100, "vdd_l2_lvs_1_2_3", }, + { "l3", 0x4200, "vdd_l1_l3", }, +@@ -1467,8 +1470,8 @@ static const struct spmi_regulator_data pm8941_regulators[] = { + { "lvs1", 0x8000, "vdd_l2_lvs_1_2_3", }, + { "lvs2", 0x8100, "vdd_l2_lvs_1_2_3", }, + { "lvs3", 0x8200, "vdd_l2_lvs_1_2_3", }, +- { "mvs1", 0x8300, "vin_5vs", }, +- { "mvs2", 0x8400, "vin_5vs", }, ++ { "5vs1", 0x8300, "vin_5vs", "ocp-5vs1", }, ++ { "5vs2", 0x8400, "vin_5vs", "ocp-5vs2", }, + { } + }; + +diff --git a/drivers/scsi/fnic/fnic_fcs.c b/drivers/scsi/fnic/fnic_fcs.c +index 67669a9e73c1..f3a33312a9a6 100644 +--- a/drivers/scsi/fnic/fnic_fcs.c ++++ b/drivers/scsi/fnic/fnic_fcs.c +@@ -954,8 +954,8 @@ int fnic_alloc_rq_frame(struct vnic_rq *rq) + skb_put(skb, len); + pa = pci_map_single(fnic->pdev, skb->data, len, PCI_DMA_FROMDEVICE); + +- r = pci_dma_mapping_error(fnic->pdev, pa); +- if (r) { ++ if (pci_dma_mapping_error(fnic->pdev, pa)) { ++ r = -ENOMEM; + printk(KERN_ERR "PCI mapping failed with error %d\n", r); + goto free_skb; + } +@@ -1093,8 +1093,8 @@ static int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp) + + pa = pci_map_single(fnic->pdev, eth_hdr, tot_len, PCI_DMA_TODEVICE); + +- ret = pci_dma_mapping_error(fnic->pdev, pa); +- if (ret) { ++ if (pci_dma_mapping_error(fnic->pdev, pa)) { ++ ret = -ENOMEM; + printk(KERN_ERR "DMA map failed with error %d\n", ret); + goto free_skb_on_err; + } +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index a7934ab00b96..d22de4c8c399 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -263,6 +263,9 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p, + + for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) { + brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div); ++ /* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */ ++ if (sh_msiof_spi_div_table[k].div == 1 && brps > 2) ++ continue; + if (brps <= 32) /* max of brdv is 32 */ + break; + } +diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c +index b1e45161eefc..18c2b6daf588 100644 +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -392,11 +392,11 @@ static void fbtft_update_display(struct fbtft_par *par, unsigned start_line, + + if (unlikely(timeit)) { + ts_end = ktime_get(); +- if (ktime_to_ns(par->update_time)) ++ if (!ktime_to_ns(par->update_time)) + par->update_time = ts_start; + +- par->update_time = ts_start; + fps = ktime_us_delta(ts_start, par->update_time); ++ par->update_time = ts_start; + fps = fps ? 1000000 / fps : 0; + + throughput = ktime_us_delta(ts_end, ts_start); +diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c +index 7a11a8263171..deaddb950c20 100644 +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -121,6 +121,7 @@ static void usbtmc_delete(struct kref *kref) + struct usbtmc_device_data *data = to_usbtmc_data(kref); + + usb_put_dev(data->usb_dev); ++ kfree(data); + } + + static int usbtmc_open(struct inode *inode, struct file *filp) +@@ -1104,7 +1105,7 @@ static int usbtmc_probe(struct usb_interface *intf, + + dev_dbg(&intf->dev, "%s called\n", __func__); + +- data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); ++ data = kmalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + +diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c +index c73689b72f95..b38a33584d4a 100644 +--- a/drivers/usb/gadget/udc/fsl_qe_udc.c ++++ b/drivers/usb/gadget/udc/fsl_qe_udc.c +@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadget *gadget) + + tmp = in_be16(&udc->usb_param->frame_n); + if (tmp & 0x8000) +- tmp = tmp & 0x07ff; +- else +- tmp = -EINVAL; +- +- return (int)tmp; ++ return tmp & 0x07ff; ++ return -EINVAL; + } + + static int fsl_qe_start(struct usb_gadget *gadget, +diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c +index 7771be3ac178..4dd531ac5a7f 100644 +--- a/drivers/usb/misc/legousbtower.c ++++ b/drivers/usb/misc/legousbtower.c +@@ -898,24 +898,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device + dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; + dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; + +- /* we can register the device now, as it is ready */ +- usb_set_intfdata (interface, dev); +- +- retval = usb_register_dev (interface, &tower_class); +- +- if (retval) { +- /* something prevented us from registering this driver */ +- dev_err(idev, "Not able to get a minor for this device.\n"); +- usb_set_intfdata (interface, NULL); +- goto error; +- } +- dev->minor = interface->minor; +- +- /* let the user know what node this device is now attached to */ +- dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major " +- "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE), +- USB_MAJOR, dev->minor); +- + /* get the firmware version and log it */ + result = usb_control_msg (udev, + usb_rcvctrlpipe(udev, 0), +@@ -936,6 +918,23 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device + get_version_reply.minor, + le16_to_cpu(get_version_reply.build_no)); + ++ /* we can register the device now, as it is ready */ ++ usb_set_intfdata (interface, dev); ++ ++ retval = usb_register_dev (interface, &tower_class); ++ ++ if (retval) { ++ /* something prevented us from registering this driver */ ++ dev_err(idev, "Not able to get a minor for this device.\n"); ++ usb_set_intfdata (interface, NULL); ++ goto error; ++ } ++ dev->minor = interface->minor; ++ ++ /* let the user know what node this device is now attached to */ ++ dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major " ++ "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE), ++ USB_MAJOR, dev->minor); + + exit: + return retval; +diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c +index 59a63a0b7985..e0a083f6ab68 100644 +--- a/drivers/usb/musb/musb_host.c ++++ b/drivers/usb/musb/musb_host.c +@@ -661,7 +661,7 @@ static int musb_tx_dma_set_mode_mentor(struct dma_controller *dma, + csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAMODE); + csr |= MUSB_TXCSR_DMAENAB; /* against programmer's guide */ + } +- channel->desired_mode = mode; ++ channel->desired_mode = *mode; + musb_writew(epio, MUSB_TXCSR, csr); + + return 0; +@@ -2008,10 +2008,8 @@ void musb_host_rx(struct musb *musb, u8 epnum) + qh->offset, + urb->transfer_buffer_length); + +- done = musb_rx_dma_in_inventra_cppi41(c, hw_ep, qh, +- urb, xfer_len, +- iso_err); +- if (done) ++ if (musb_rx_dma_in_inventra_cppi41(c, hw_ep, qh, urb, ++ xfer_len, iso_err)) + goto finish; + else + dev_err(musb->controller, "error: rx_dma failed\n"); +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index a2b43a6e7fa7..6eccded3bc33 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -117,6 +117,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ + { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ ++ { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ + { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ + { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ + { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ +@@ -784,7 +785,7 @@ static void cp210x_set_termios(struct tty_struct *tty, + } else { + modem_ctl[0] &= ~0x7B; + modem_ctl[0] |= 0x01; +- modem_ctl[1] |= 0x40; ++ modem_ctl[1] = 0x40; + dev_dbg(dev, "%s - flow control = NONE\n", __func__); + } + +diff --git a/fs/aio.c b/fs/aio.c +index 155f84253f33..fe4f49212b99 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type, + static const struct dentry_operations ops = { + .d_dname = simple_dname, + }; +- return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC); ++ struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops, ++ AIO_RING_MAGIC); ++ ++ if (!IS_ERR(root)) ++ root->d_sb->s_iflags |= SB_I_NOEXEC; ++ return root; + } + + /* aio_setup +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 498dcfa2dcdb..d98536c8abfc 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1358,15 +1358,20 @@ static int fill_readdir_cache(struct inode *dir, struct dentry *dn, + + if (!ctl->page || pgoff != page_index(ctl->page)) { + ceph_readdir_cache_release(ctl); +- ctl->page = grab_cache_page(&dir->i_data, pgoff); ++ if (idx == 0) ++ ctl->page = grab_cache_page(&dir->i_data, pgoff); ++ else ++ ctl->page = find_lock_page(&dir->i_data, pgoff); + if (!ctl->page) { + ctl->index = -1; +- return -ENOMEM; ++ return idx == 0 ? -ENOMEM : 0; + } + /* reading/filling the cache are serialized by + * i_mutex, no need to use page lock */ + unlock_page(ctl->page); + ctl->dentries = kmap(ctl->page); ++ if (idx == 0) ++ memset(ctl->dentries, 0, PAGE_CACHE_SIZE); + } + + if (req->r_dir_release_cnt == atomic64_read(&ci->i_release_count) && +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index 646cdac73488..e2e857affbf2 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -912,7 +912,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r + if (hdr_arg.minorversion == 0) { + cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); + if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) +- return rpc_drop_reply; ++ goto out_invalidcred; + } + + cps.minorversion = hdr_arg.minorversion; +@@ -940,6 +940,10 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r + nfs_put_client(cps.clp); + dprintk("%s: done, status = %u\n", __func__, ntohl(status)); + return rpc_success; ++ ++out_invalidcred: ++ pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n"); ++ return rpc_autherr_badcred; + } + + /* +diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c +index 02ec07973bc4..fd8da630fd22 100644 +--- a/fs/nfs/filelayout/filelayout.c ++++ b/fs/nfs/filelayout/filelayout.c +@@ -374,8 +374,7 @@ static int filelayout_commit_done_cb(struct rpc_task *task, + return -EAGAIN; + } + +- if (data->verf.committed == NFS_UNSTABLE) +- pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb); ++ pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb); + + return 0; + } +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c +index 2a2e2d8ddee5..54313322ee5b 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -1414,8 +1414,7 @@ static int ff_layout_commit_done_cb(struct rpc_task *task, + return -EAGAIN; + } + +- if (data->verf.committed == NFS_UNSTABLE +- && ff_layout_need_layoutcommit(data->lseg)) ++ if (ff_layout_need_layoutcommit(data->lseg)) + pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb); + + return 0; +diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c +index d8c439d813ce..ac6c78fe19cf 100644 +--- a/fs/pstore/inode.c ++++ b/fs/pstore/inode.c +@@ -178,7 +178,6 @@ static loff_t pstore_file_llseek(struct file *file, loff_t off, int whence) + } + + static const struct file_operations pstore_file_operations = { +- .owner = THIS_MODULE, + .open = pstore_file_open, + .read = pstore_file_read, + .llseek = pstore_file_llseek, +diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h +index 5261751f6bd4..5f5270941ba0 100644 +--- a/include/linux/can/dev.h ++++ b/include/linux/can/dev.h +@@ -32,6 +32,7 @@ enum can_mode { + * CAN common private data + */ + struct can_priv { ++ struct net_device *dev; + struct can_device_stats can_stats; + + struct can_bittiming bittiming, data_bittiming; +@@ -47,7 +48,7 @@ struct can_priv { + u32 ctrlmode_static; /* static enabled options for driver/hardware */ + + int restart_ms; +- struct timer_list restart_timer; ++ struct delayed_work restart_work; + + int (*do_set_bittiming)(struct net_device *dev); + int (*do_set_data_bittiming)(struct net_device *dev); +diff --git a/include/linux/nvmem-consumer.h b/include/linux/nvmem-consumer.h +index 9bb77d3ed6e0..c2256d746543 100644 +--- a/include/linux/nvmem-consumer.h ++++ b/include/linux/nvmem-consumer.h +@@ -74,7 +74,7 @@ static inline void nvmem_cell_put(struct nvmem_cell *cell) + { + } + +-static inline char *nvmem_cell_read(struct nvmem_cell *cell, size_t *len) ++static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len) + { + return ERR_PTR(-ENOSYS); + } +diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h +index fa7bc29925c9..ef17db6caaed 100644 +--- a/include/linux/sysctl.h ++++ b/include/linux/sysctl.h +@@ -41,6 +41,8 @@ extern int proc_dostring(struct ctl_table *, int, + void __user *, size_t *, loff_t *); + extern int proc_dointvec(struct ctl_table *, int, + void __user *, size_t *, loff_t *); ++extern int proc_douintvec(struct ctl_table *, int, ++ void __user *, size_t *, loff_t *); + extern int proc_dointvec_minmax(struct ctl_table *, int, + void __user *, size_t *, loff_t *); + extern int proc_dointvec_jiffies(struct ctl_table *, int, +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index b9279a2844d8..b271353d5202 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -324,8 +324,7 @@ static struct file_system_type cpuset_fs_type = { + /* + * Return in pmask the portion of a cpusets's cpus_allowed that + * are online. If none are online, walk up the cpuset hierarchy +- * until we find one that does have some online cpus. The top +- * cpuset always has some cpus online. ++ * until we find one that does have some online cpus. + * + * One way or another, we guarantee to return some non-empty subset + * of cpu_online_mask. +@@ -334,8 +333,20 @@ static struct file_system_type cpuset_fs_type = { + */ + static void guarantee_online_cpus(struct cpuset *cs, struct cpumask *pmask) + { +- while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask)) ++ while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask)) { + cs = parent_cs(cs); ++ if (unlikely(!cs)) { ++ /* ++ * The top cpuset doesn't have any online cpu as a ++ * consequence of a race between cpuset_hotplug_work ++ * and cpu hotplug notifier. But we know the top ++ * cpuset's effective_cpus is on its way to to be ++ * identical to cpu_online_mask. ++ */ ++ cpumask_copy(pmask, cpu_online_mask); ++ return; ++ } ++ } + cpumask_and(pmask, cs->effective_cpus, cpu_online_mask); + } + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 12ecd4f0329f..bc6371b0e4fb 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -1539,12 +1539,33 @@ static int __init perf_workqueue_init(void) + + core_initcall(perf_workqueue_init); + +-static inline int pmu_filter_match(struct perf_event *event) ++static inline int __pmu_filter_match(struct perf_event *event) + { + struct pmu *pmu = event->pmu; + return pmu->filter_match ? pmu->filter_match(event) : 1; + } + ++/* ++ * Check whether we should attempt to schedule an event group based on ++ * PMU-specific filtering. An event group can consist of HW and SW events, ++ * potentially with a SW leader, so we must check all the filters, to ++ * determine whether a group is schedulable: ++ */ ++static inline int pmu_filter_match(struct perf_event *event) ++{ ++ struct perf_event *child; ++ ++ if (!__pmu_filter_match(event)) ++ return 0; ++ ++ list_for_each_entry(child, &event->sibling_list, group_entry) { ++ if (!__pmu_filter_match(child)) ++ return 0; ++ } ++ ++ return 1; ++} ++ + static inline int + event_filter_match(struct perf_event *event) + { +diff --git a/kernel/fork.c b/kernel/fork.c +index 8860d1f50d24..7161ebe67cbb 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -901,14 +901,12 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm) + deactivate_mm(tsk, mm); + + /* +- * If we're exiting normally, clear a user-space tid field if +- * requested. We leave this alone when dying by signal, to leave +- * the value intact in a core dump, and to save the unnecessary +- * trouble, say, a killed vfork parent shouldn't touch this mm. +- * Userland only wants this done for a sys_exit. ++ * Signal userspace if we're not exiting with a core dump ++ * because we want to leave the value intact for debugging ++ * purposes. + */ + if (tsk->clear_child_tid) { +- if (!(tsk->flags & PF_SIGNALED) && ++ if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) && + atomic_read(&mm->mm_users) > 1) { + /* + * We don't check the error code - if userspace has +diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c +index 276762f3a460..d5760c42f042 100644 +--- a/kernel/printk/braille.c ++++ b/kernel/printk/braille.c +@@ -9,10 +9,10 @@ + + char *_braille_console_setup(char **str, char **brl_options) + { +- if (!memcmp(*str, "brl,", 4)) { ++ if (!strncmp(*str, "brl,", 4)) { + *brl_options = ""; + *str += 4; +- } else if (!memcmp(str, "brl=", 4)) { ++ } else if (!strncmp(*str, "brl=", 4)) { + *brl_options = *str + 4; + *str = strchr(*brl_options, ','); + if (!*str) +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 2781141a89f9..999e025bf68e 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -2051,6 +2051,21 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp, + return 0; + } + ++static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp, ++ int *valp, ++ int write, void *data) ++{ ++ if (write) { ++ if (*negp) ++ return -EINVAL; ++ *valp = *lvalp; ++ } else { ++ unsigned int val = *valp; ++ *lvalp = (unsigned long)val; ++ } ++ return 0; ++} ++ + static const char proc_wspace_sep[] = { ' ', '\t', '\n' }; + + static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table, +@@ -2178,8 +2193,27 @@ static int do_proc_dointvec(struct ctl_table *table, int write, + int proc_dointvec(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { +- return do_proc_dointvec(table,write,buffer,lenp,ppos, +- NULL,NULL); ++ return do_proc_dointvec(table, write, buffer, lenp, ppos, NULL, NULL); ++} ++ ++/** ++ * proc_douintvec - read a vector of unsigned integers ++ * @table: the sysctl table ++ * @write: %TRUE if this is a write to the sysctl file ++ * @buffer: the user buffer ++ * @lenp: the size of the user buffer ++ * @ppos: file position ++ * ++ * Reads/writes up to table->maxlen/sizeof(unsigned int) unsigned integer ++ * values from/to the user buffer, treated as an ASCII string. ++ * ++ * Returns 0 on success. ++ */ ++int proc_douintvec(struct ctl_table *table, int write, ++ void __user *buffer, size_t *lenp, loff_t *ppos) ++{ ++ return do_proc_dointvec(table, write, buffer, lenp, ppos, ++ do_proc_douintvec_conv, NULL); + } + + /* +@@ -2792,6 +2826,12 @@ int proc_dointvec(struct ctl_table *table, int write, + return -ENOSYS; + } + ++int proc_douintvec(struct ctl_table *table, int write, ++ void __user *buffer, size_t *lenp, loff_t *ppos) ++{ ++ return -ENOSYS; ++} ++ + int proc_dointvec_minmax(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) + { +@@ -2837,6 +2877,7 @@ int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write, + * exception granted :-) + */ + EXPORT_SYMBOL(proc_dointvec); ++EXPORT_SYMBOL(proc_douintvec); + EXPORT_SYMBOL(proc_dointvec_jiffies); + EXPORT_SYMBOL(proc_dointvec_minmax); + EXPORT_SYMBOL(proc_dointvec_userhz_jiffies); +diff --git a/mm/ksm.c b/mm/ksm.c +index b5cd647daa52..2f028e6d0831 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -283,7 +283,8 @@ static inline struct rmap_item *alloc_rmap_item(void) + { + struct rmap_item *rmap_item; + +- rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL); ++ rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL | ++ __GFP_NORETRY | __GFP_NOWARN); + if (rmap_item) + ksm_rmap_items++; + return rmap_item; +diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c +index 17851d3aaf22..6282f021ddfb 100644 +--- a/net/batman-adv/originator.c ++++ b/net/batman-adv/originator.c +@@ -197,18 +197,12 @@ static void batadv_neigh_node_release(struct batadv_neigh_node *neigh_node) + { + struct hlist_node *node_tmp; + struct batadv_neigh_ifinfo *neigh_ifinfo; +- struct batadv_algo_ops *bao; +- +- bao = neigh_node->orig_node->bat_priv->bat_algo_ops; + + hlist_for_each_entry_safe(neigh_ifinfo, node_tmp, + &neigh_node->ifinfo_list, list) { + batadv_neigh_ifinfo_free_ref(neigh_ifinfo); + } + +- if (bao->bat_neigh_free) +- bao->bat_neigh_free(neigh_node); +- + batadv_hardif_free_ref(neigh_node->if_incoming); + + kfree_rcu(neigh_node, rcu); +diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h +index d260efd70499..cbd347c2e4a5 100644 +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -1136,8 +1136,6 @@ struct batadv_forw_packet { + * @bat_neigh_is_equiv_or_better: check if neigh1 is equally good or better + * than neigh2 for their respective outgoing interface from the metric + * prospective +- * @bat_neigh_free: free the resources allocated by the routing algorithm for a +- * neigh_node object + * @bat_orig_print: print the originator table (optional) + * @bat_orig_free: free the resources allocated by the routing algorithm for an + * orig_node object +@@ -1165,7 +1163,6 @@ struct batadv_algo_ops { + struct batadv_hard_iface *if_outgoing1, + struct batadv_neigh_node *neigh2, + struct batadv_hard_iface *if_outgoing2); +- void (*bat_neigh_free)(struct batadv_neigh_node *neigh); + /* orig_node handling API */ + void (*bat_orig_print)(struct batadv_priv *priv, struct seq_file *seq, + struct batadv_hard_iface *hard_iface); +diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c +index 803001a45aa1..1b07578bedf3 100644 +--- a/net/netfilter/ipvs/ip_vs_sync.c ++++ b/net/netfilter/ipvs/ip_vs_sync.c +@@ -1545,7 +1545,8 @@ error: + /* + * Set up receiving multicast socket over UDP + */ +-static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id) ++static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id, ++ int ifindex) + { + /* multicast addr */ + union ipvs_sockaddr mcast_addr; +@@ -1566,6 +1567,7 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id) + set_sock_size(sock->sk, 0, result); + + get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id); ++ sock->sk->sk_bound_dev_if = ifindex; + result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen); + if (result < 0) { + pr_err("Error binding to the multicast addr\n"); +@@ -1868,7 +1870,7 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, + if (state == IP_VS_STATE_MASTER) + sock = make_send_sock(ipvs, id); + else +- sock = make_receive_sock(ipvs, id); ++ sock = make_receive_sock(ipvs, id, dev->ifindex); + if (IS_ERR(sock)) { + result = PTR_ERR(sock); + goto outtinfo; +diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c +index cc9852897395..c5b0cb4f4056 100644 +--- a/net/sunrpc/svc.c ++++ b/net/sunrpc/svc.c +@@ -1188,11 +1188,17 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv) + *statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp); + + /* Encode reply */ +- if (test_bit(RQ_DROPME, &rqstp->rq_flags)) { ++ if (*statp == rpc_drop_reply || ++ test_bit(RQ_DROPME, &rqstp->rq_flags)) { + if (procp->pc_release) + procp->pc_release(rqstp, NULL, rqstp->rq_resp); + goto dropit; + } ++ if (*statp == rpc_autherr_badcred) { ++ if (procp->pc_release) ++ procp->pc_release(rqstp, NULL, rqstp->rq_resp); ++ goto err_bad_auth; ++ } + if (*statp == rpc_success && + (xdr = procp->pc_encode) && + !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) { +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 600af5878e75..36cd715986bc 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -261,6 +261,7 @@ enum { + CXT_FIXUP_HP_530, + CXT_FIXUP_CAP_MIX_AMP_5047, + CXT_FIXUP_MUTE_LED_EAPD, ++ CXT_FIXUP_HP_SPECTRE, + }; + + /* for hda_fixup_thinkpad_acpi() */ +@@ -765,6 +766,14 @@ static const struct hda_fixup cxt_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_mute_led_eapd, + }, ++ [CXT_FIXUP_HP_SPECTRE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ /* enable NID 0x1d for the speaker on top */ ++ { 0x1d, 0x91170111 }, ++ { } ++ } ++ }, + }; + + static const struct snd_pci_quirk cxt5045_fixups[] = { +@@ -814,6 +823,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC), ++ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index eaee626ab185..b1fa50aed888 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5790,6 +5790,13 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {0x14, 0x90170110}, \ + {0x15, 0x0221401f} + ++#define ALC295_STANDARD_PINS \ ++ {0x12, 0xb7a60130}, \ ++ {0x14, 0x90170110}, \ ++ {0x17, 0x21014020}, \ ++ {0x18, 0x21a19030}, \ ++ {0x21, 0x04211020} ++ + #define ALC298_STANDARD_PINS \ + {0x12, 0x90a60130}, \ + {0x21, 0x03211020} +@@ -5830,6 +5837,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x14, 0x90170120}, + {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x14, 0x90170110}, ++ {0x1b, 0x02011020}, ++ {0x21, 0x0221101f}), ++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x14, 0x90170130}, + {0x1b, 0x01014020}, + {0x21, 0x0221103f}), +@@ -5895,6 +5906,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x14, 0x90170120}, + {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, ++ {0x12, 0xb7a60130}, ++ {0x14, 0x90170110}, ++ {0x21, 0x02211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC256_STANDARD_PINS), + SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, + {0x12, 0x90a60130}, +@@ -6005,6 +6020,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC292_STANDARD_PINS, + {0x13, 0x90a60140}), ++ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC295_STANDARD_PINS), + SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC298_STANDARD_PINS, + {0x17, 0x90170110}), +diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c +index caa69c4598a6..b4844f78266f 100644 +--- a/sound/soc/intel/skylake/skl.c ++++ b/sound/soc/intel/skylake/skl.c +@@ -464,8 +464,10 @@ static int skl_probe(struct pci_dev *pci, + + skl->nhlt = skl_nhlt_init(bus->dev); + +- if (skl->nhlt == NULL) ++ if (skl->nhlt == NULL) { ++ err = -ENODEV; + goto out_free; ++ } + + pci_set_drvdata(skl->pci, ebus); + +diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c +index b837265ac3e9..8d0d45d330e7 100644 +--- a/sound/soc/omap/omap-mcpdm.c ++++ b/sound/soc/omap/omap-mcpdm.c +@@ -390,8 +390,8 @@ static int omap_mcpdm_probe(struct snd_soc_dai *dai) + pm_runtime_get_sync(mcpdm->dev); + omap_mcpdm_write(mcpdm, MCPDM_REG_CTRL, 0x00); + +- ret = devm_request_irq(mcpdm->dev, mcpdm->irq, omap_mcpdm_irq_handler, +- 0, "McPDM", (void *)mcpdm); ++ ret = request_irq(mcpdm->irq, omap_mcpdm_irq_handler, 0, "McPDM", ++ (void *)mcpdm); + + pm_runtime_put_sync(mcpdm->dev); + +@@ -416,6 +416,7 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai) + { + struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai); + ++ free_irq(mcpdm->irq, (void *)mcpdm); + pm_runtime_disable(mcpdm->dev); + + return 0; +diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c +index 86e698d07e20..499b8819d4c6 100644 +--- a/tools/vm/slabinfo.c ++++ b/tools/vm/slabinfo.c +@@ -510,10 +510,11 @@ static void slab_stats(struct slabinfo *s) + s->alloc_node_mismatch, (s->alloc_node_mismatch * 100) / total); + } + +- if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail) ++ if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail) { + printf("\nCmpxchg_double Looping\n------------------------\n"); + printf("Locked Cmpxchg Double redos %lu\nUnlocked Cmpxchg Double redos %lu\n", + s->cmpxchg_double_fail, s->cmpxchg_double_cpu_fail); ++ } + } + + static void report(struct slabinfo *s)