From 6b09068695bbd4bbbff19dc0cc2c312d49452cbc Mon Sep 17 00:00:00 2001 From: Julian Sikorski Date: Thu, 16 Jan 2020 22:20:39 +0100 Subject: [PATCH] Drop patches already included in hardkernel git repo (#1743) --- .../odroidxu4-legacy/patch-4.14.157-158.patch | 7483 ---------------- .../odroidxu4-legacy/patch-4.14.158-159.patch | 7973 ----------------- .../odroidxu4-legacy/patch-4.14.159-160.patch | 1086 --- .../odroidxu4-legacy/patch-4.14.160-161.patch | 4240 --------- .../odroidxu4-legacy/patch-4.14.161-162.patch | 3364 ------- .../odroidxu4-legacy/patch-4.14.162-163.patch | 2380 ----- .../odroidxu4-legacy/patch-4.14.163-164.patch | 2533 ------ .../odroidxu4-legacy/patch-4.14.164-165.patch | 1239 --- 8 files changed, 30298 deletions(-) delete mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.157-158.patch delete mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.158-159.patch delete mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.159-160.patch delete mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.160-161.patch delete mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.161-162.patch delete mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.162-163.patch delete mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.163-164.patch delete mode 100644 patch/kernel/odroidxu4-legacy/patch-4.14.164-165.patch diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.157-158.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.157-158.patch deleted file mode 100644 index 1719a84c7b..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.157-158.patch +++ /dev/null @@ -1,7483 +0,0 @@ -diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt -index c8656dd029a9..958fff945304 100644 ---- a/Documentation/hid/uhid.txt -+++ b/Documentation/hid/uhid.txt -@@ -160,7 +160,7 @@ them but you should handle them according to your needs. - UHID_OUTPUT: - This is sent if the HID device driver wants to send raw data to the I/O - device on the interrupt channel. You should read the payload and forward it to -- the device. The payload is of type "struct uhid_data_req". -+ the device. The payload is of type "struct uhid_output_req". - This may be received even though you haven't received UHID_OPEN, yet. - - UHID_GET_REPORT: -diff --git a/Makefile b/Makefile -index dad90f53faeb..d97288c0754f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 157 -+SUBLEVEL = 158 - EXTRAVERSION = - NAME = Petit Gorille - -diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug -index 954ba8b81052..fd4b679945d3 100644 ---- a/arch/arm/Kconfig.debug -+++ b/arch/arm/Kconfig.debug -@@ -1376,21 +1376,21 @@ config DEBUG_OMAP2PLUS_UART - depends on ARCH_OMAP2PLUS - - config DEBUG_IMX_UART_PORT -- int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \ -- DEBUG_IMX25_UART || \ -- DEBUG_IMX21_IMX27_UART || \ -- DEBUG_IMX31_UART || \ -- DEBUG_IMX35_UART || \ -- DEBUG_IMX50_UART || \ -- DEBUG_IMX51_UART || \ -- DEBUG_IMX53_UART || \ -- DEBUG_IMX6Q_UART || \ -- DEBUG_IMX6SL_UART || \ -- DEBUG_IMX6SX_UART || \ -- DEBUG_IMX6UL_UART || \ -- DEBUG_IMX7D_UART -+ int "i.MX Debug UART Port Selection" -+ depends on DEBUG_IMX1_UART || \ -+ DEBUG_IMX25_UART || \ -+ DEBUG_IMX21_IMX27_UART || \ -+ DEBUG_IMX31_UART || \ -+ DEBUG_IMX35_UART || \ -+ DEBUG_IMX50_UART || \ -+ DEBUG_IMX51_UART || \ -+ DEBUG_IMX53_UART || \ -+ DEBUG_IMX6Q_UART || \ -+ DEBUG_IMX6SL_UART || \ -+ DEBUG_IMX6SX_UART || \ -+ DEBUG_IMX6UL_UART || \ -+ DEBUG_IMX7D_UART - default 1 -- depends on ARCH_MXC - help - Choose UART port on which kernel low-level debug messages - should be output. -diff --git a/arch/arm/boot/dts/gemini-sq201.dts b/arch/arm/boot/dts/gemini-sq201.dts -index 63c02ca9513c..e9e2f6ff0c58 100644 ---- a/arch/arm/boot/dts/gemini-sq201.dts -+++ b/arch/arm/boot/dts/gemini-sq201.dts -@@ -20,7 +20,7 @@ - }; - - chosen { -- bootargs = "console=ttyS0,115200n8"; -+ bootargs = "console=ttyS0,115200n8 root=/dev/mtdblock2 rw rootfstype=squashfs,jffs2 rootwait"; - stdout-path = &uart0; - }; - -@@ -71,37 +71,10 @@ - /* 16MB of flash */ - reg = <0x30000000 0x01000000>; - -- partition@0 { -- label = "RedBoot"; -- reg = <0x00000000 0x00120000>; -- read-only; -- }; -- partition@120000 { -- label = "Kernel"; -- reg = <0x00120000 0x00200000>; -- }; -- partition@320000 { -- label = "Ramdisk"; -- reg = <0x00320000 0x00600000>; -- }; -- partition@920000 { -- label = "Application"; -- reg = <0x00920000 0x00600000>; -- }; -- partition@f20000 { -- label = "VCTL"; -- reg = <0x00f20000 0x00020000>; -- read-only; -- }; -- partition@f40000 { -- label = "CurConf"; -- reg = <0x00f40000 0x000a0000>; -- read-only; -- }; -- partition@fe0000 { -- label = "FIS directory"; -- reg = <0x00fe0000 0x00020000>; -- read-only; -+ partitions { -+ compatible = "redboot-fis"; -+ /* Eraseblock at 0xfe0000 */ -+ fis-index-block = <0x1fc>; - }; - }; - -diff --git a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi -index df8dafe2564d..2297ed90ee89 100644 ---- a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi -+++ b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi -@@ -17,12 +17,8 @@ - - memory@70000000 { - device_type = "memory"; -- reg = <0x70000000 0x20000000>; -- }; -- -- memory@b0000000 { -- device_type = "memory"; -- reg = <0xb0000000 0x20000000>; -+ reg = <0x70000000 0x20000000>, -+ <0xb0000000 0x20000000>; - }; - - regulators { -diff --git a/arch/arm/mach-ks8695/board-acs5k.c b/arch/arm/mach-ks8695/board-acs5k.c -index e4d709c8ed32..76d3083f1f63 100644 ---- a/arch/arm/mach-ks8695/board-acs5k.c -+++ b/arch/arm/mach-ks8695/board-acs5k.c -@@ -92,7 +92,7 @@ static struct i2c_board_info acs5k_i2c_devs[] __initdata = { - }, - }; - --static void acs5k_i2c_init(void) -+static void __init acs5k_i2c_init(void) - { - /* The gpio interface */ - platform_device_register(&acs5k_i2c_device); -diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile -index e8ccf51c6f29..ec0235899de2 100644 ---- a/arch/arm/mach-omap1/Makefile -+++ b/arch/arm/mach-omap1/Makefile -@@ -25,7 +25,7 @@ obj-y += $(i2c-omap-m) $(i2c-omap-y) - - led-y := leds.o - --usb-fs-$(CONFIG_USB) := usb.o -+usb-fs-$(CONFIG_USB_SUPPORT) := usb.o - obj-y += $(usb-fs-m) $(usb-fs-y) - - # Specific board support -diff --git a/arch/arm/mach-omap1/include/mach/usb.h b/arch/arm/mach-omap1/include/mach/usb.h -index 77867778d4ec..5429d86c7190 100644 ---- a/arch/arm/mach-omap1/include/mach/usb.h -+++ b/arch/arm/mach-omap1/include/mach/usb.h -@@ -11,7 +11,7 @@ - - #include - --#if IS_ENABLED(CONFIG_USB) -+#if IS_ENABLED(CONFIG_USB_SUPPORT) - void omap1_usb_init(struct omap_usb_config *pdata); - #else - static inline void omap1_usb_init(struct omap_usb_config *pdata) -diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index 92cc7b51f100..9c00fd2acc2a 100644 ---- a/arch/arm64/kernel/head.S -+++ b/arch/arm64/kernel/head.S -@@ -594,6 +594,7 @@ secondary_startup: - /* - * Common entry point for secondary CPUs. - */ -+ bl __cpu_secondary_check52bitva - bl __cpu_setup // initialise processor - bl __enable_mmu - ldr x8, =__secondary_switched -@@ -668,6 +669,31 @@ ENTRY(__enable_mmu) - ret - ENDPROC(__enable_mmu) - -+ENTRY(__cpu_secondary_check52bitva) -+#ifdef CONFIG_ARM64_52BIT_VA -+ ldr_l x0, vabits_user -+ cmp x0, #52 -+ b.ne 2f -+ -+ mrs_s x0, SYS_ID_AA64MMFR2_EL1 -+ and x0, x0, #(0xf << ID_AA64MMFR2_LVA_SHIFT) -+ cbnz x0, 2f -+ -+ adr_l x0, va52mismatch -+ mov w1, #1 -+ strb w1, [x0] -+ dmb sy -+ dc ivac, x0 // Invalidate potentially stale cache line -+ -+ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x0, x1 -+1: wfe -+ wfi -+ b 1b -+ -+#endif -+2: ret -+ENDPROC(__cpu_secondary_check52bitva) -+ - __no_granule_support: - /* Indicate that this CPU can't boot and is stuck in the kernel */ - update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x1, x2 -diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c -index a683cd499515..909bf3926fd2 100644 ---- a/arch/arm64/kernel/smp.c -+++ b/arch/arm64/kernel/smp.c -@@ -106,6 +106,7 @@ static int boot_secondary(unsigned int cpu, struct task_struct *idle) - } - - static DECLARE_COMPLETION(cpu_running); -+bool va52mismatch __ro_after_init; - - int __cpu_up(unsigned int cpu, struct task_struct *idle) - { -@@ -135,10 +136,15 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) - - if (!cpu_online(cpu)) { - pr_crit("CPU%u: failed to come online\n", cpu); -+ -+ if (IS_ENABLED(CONFIG_ARM64_52BIT_VA) && va52mismatch) -+ pr_crit("CPU%u: does not support 52-bit VAs\n", cpu); -+ - ret = -EIO; - } - } else { - pr_err("CPU%u: failed to boot: %d\n", cpu, ret); -+ return ret; - } - - secondary_data.task = NULL; -diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile -index d269dd4b8279..fe5e48184c3c 100644 ---- a/arch/microblaze/Makefile -+++ b/arch/microblaze/Makefile -@@ -83,19 +83,21 @@ archclean: - - linux.bin linux.bin.gz linux.bin.ub: vmlinux - $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@ -+ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')' - - simpleImage.%: vmlinux - $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@ -+ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')' - - define archhelp - echo '* linux.bin - Create raw binary' - echo ' linux.bin.gz - Create compressed raw binary' - echo ' linux.bin.ub - Create U-Boot wrapped raw binary' -- echo ' simpleImage.
- ELF image with $(arch)/boot/dts/
.dts linked in' -- echo ' - stripped elf with fdt blob' -- echo ' simpleImage.
.unstrip - full ELF image with fdt blob' -- echo ' *_defconfig - Select default config from arch/microblaze/configs' -- echo '' -+ echo ' simpleImage.
- Create the following images with
.dtb linked in' -+ echo ' simpleImage.
: raw image' -+ echo ' simpleImage.
.ub : raw image with U-Boot header' -+ echo ' simpleImage.
.unstrip: ELF (identical to vmlinux)' -+ echo ' simpleImage.
.strip : stripped ELF' - echo ' Targets with
embed a device tree blob inside the image' - echo ' These targets support board with firmware that does not' - echo ' support passing a device tree directly. Replace
with the' -diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile -index 7c2f52d4a0e4..49dbd1063d71 100644 ---- a/arch/microblaze/boot/Makefile -+++ b/arch/microblaze/boot/Makefile -@@ -9,15 +9,12 @@ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary - - $(obj)/linux.bin: vmlinux FORCE - $(call if_changed,objcopy) -- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' - - $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE - $(call if_changed,uimage) -- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' - - $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE - $(call if_changed,gzip) -- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' - - quiet_cmd_cp = CP $< $@$2 - cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false) -@@ -35,6 +32,5 @@ $(obj)/simpleImage.%: vmlinux FORCE - $(call if_changed,objcopy) - $(call if_changed,uimage) - $(call if_changed,strip,.strip) -- @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')' - - clean-files += simpleImage.*.unstrip linux.bin.ub dts/*.dtb -diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S -index b16e95a4e875..1107d34e45bf 100644 ---- a/arch/openrisc/kernel/entry.S -+++ b/arch/openrisc/kernel/entry.S -@@ -184,7 +184,7 @@ handler: ;\ - * occured. in fact they never do. if you need them use - * values saved on stack (for SPR_EPC, SPR_ESR) or content - * of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE() -- * in 'arch/or32/kernel/head.S' -+ * in 'arch/openrisc/kernel/head.S' - */ - - /* =====================================================[ exceptions] === */ -diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S -index 90979acdf165..4d878d13b860 100644 ---- a/arch/openrisc/kernel/head.S -+++ b/arch/openrisc/kernel/head.S -@@ -1551,7 +1551,7 @@ _string_nl: - - /* - * .data section should be page aligned -- * (look into arch/or32/kernel/vmlinux.lds) -+ * (look into arch/openrisc/kernel/vmlinux.lds.S) - */ - .section .data,"aw" - .align 8192 -diff --git a/arch/powerpc/boot/dts/bamboo.dts b/arch/powerpc/boot/dts/bamboo.dts -index aa68911f6560..084b82ba7493 100644 ---- a/arch/powerpc/boot/dts/bamboo.dts -+++ b/arch/powerpc/boot/dts/bamboo.dts -@@ -268,8 +268,10 @@ - /* Outbound ranges, one memory and one IO, - * later cannot be changed. Chip supports a second - * IO range but we don't use it for now -+ * The chip also supports a larger memory range but -+ * it's not naturally aligned, so our code will break - */ -- ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x40000000 -+ ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x20000000 - 0x02000000 0x00000000 0x00000000 0x00000000 0xe0000000 0x00000000 0x00100000 - 0x01000000 0x00000000 0x00000000 0x00000000 0xe8000000 0x00000000 0x00010000>; - -diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h -index 7e3ccf21830e..e4451b30d7e3 100644 ---- a/arch/powerpc/include/asm/cputable.h -+++ b/arch/powerpc/include/asm/cputable.h -@@ -45,6 +45,7 @@ extern int machine_check_e500(struct pt_regs *regs); - extern int machine_check_e200(struct pt_regs *regs); - extern int machine_check_47x(struct pt_regs *regs); - int machine_check_8xx(struct pt_regs *regs); -+int machine_check_83xx(struct pt_regs *regs); - - extern void cpu_down_flush_e500v2(void); - extern void cpu_down_flush_e500mc(void); -diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h -index b779f3ccd412..05f3c2b3aa0e 100644 ---- a/arch/powerpc/include/asm/reg.h -+++ b/arch/powerpc/include/asm/reg.h -@@ -733,6 +733,8 @@ - #define SRR1_PROGTRAP 0x00020000 /* Trap */ - #define SRR1_PROGADDR 0x00010000 /* SRR0 contains subsequent addr */ - -+#define SRR1_MCE_MCP 0x00080000 /* Machine check signal caused interrupt */ -+ - #define SPRN_HSRR0 0x13A /* Save/Restore Register 0 */ - #define SPRN_HSRR1 0x13B /* Save/Restore Register 1 */ - #define HSRR1_DENORM 0x00100000 /* Denorm exception */ -diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c -index 760872916013..da4b0e379238 100644 ---- a/arch/powerpc/kernel/cputable.c -+++ b/arch/powerpc/kernel/cputable.c -@@ -1185,6 +1185,7 @@ static struct cpu_spec __initdata cpu_specs[] = { - .machine_check = machine_check_generic, - .platform = "ppc603", - }, -+#ifdef CONFIG_PPC_83xx - { /* e300c1 (a 603e core, plus some) on 83xx */ - .pvr_mask = 0x7fff0000, - .pvr_value = 0x00830000, -@@ -1195,7 +1196,7 @@ static struct cpu_spec __initdata cpu_specs[] = { - .icache_bsize = 32, - .dcache_bsize = 32, - .cpu_setup = __setup_cpu_603, -- .machine_check = machine_check_generic, -+ .machine_check = machine_check_83xx, - .platform = "ppc603", - }, - { /* e300c2 (an e300c1 core, plus some, minus FPU) on 83xx */ -@@ -1209,7 +1210,7 @@ static struct cpu_spec __initdata cpu_specs[] = { - .icache_bsize = 32, - .dcache_bsize = 32, - .cpu_setup = __setup_cpu_603, -- .machine_check = machine_check_generic, -+ .machine_check = machine_check_83xx, - .platform = "ppc603", - }, - { /* e300c3 (e300c1, plus one IU, half cache size) on 83xx */ -@@ -1223,7 +1224,7 @@ static struct cpu_spec __initdata cpu_specs[] = { - .icache_bsize = 32, - .dcache_bsize = 32, - .cpu_setup = __setup_cpu_603, -- .machine_check = machine_check_generic, -+ .machine_check = machine_check_83xx, - .num_pmcs = 4, - .oprofile_cpu_type = "ppc/e300", - .oprofile_type = PPC_OPROFILE_FSL_EMB, -@@ -1240,12 +1241,13 @@ static struct cpu_spec __initdata cpu_specs[] = { - .icache_bsize = 32, - .dcache_bsize = 32, - .cpu_setup = __setup_cpu_603, -- .machine_check = machine_check_generic, -+ .machine_check = machine_check_83xx, - .num_pmcs = 4, - .oprofile_cpu_type = "ppc/e300", - .oprofile_type = PPC_OPROFILE_FSL_EMB, - .platform = "ppc603", - }, -+#endif - { /* default match, we assume split I/D cache & TB (non-601)... */ - .pvr_mask = 0x00000000, - .pvr_value = 0x00000000, -diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c -index f83056297441..d96b28415090 100644 ---- a/arch/powerpc/kernel/prom.c -+++ b/arch/powerpc/kernel/prom.c -@@ -128,7 +128,7 @@ static void __init move_device_tree(void) - p = __va(memblock_alloc(size, PAGE_SIZE)); - memcpy(p, initial_boot_params, size); - initial_boot_params = p; -- DBG("Moved device tree to 0x%p\n", p); -+ DBG("Moved device tree to 0x%px\n", p); - } - - DBG("<- move_device_tree\n"); -@@ -662,7 +662,7 @@ void __init early_init_devtree(void *params) - { - phys_addr_t limit; - -- DBG(" -> early_init_devtree(%p)\n", params); -+ DBG(" -> early_init_devtree(%px)\n", params); - - /* Too early to BUG_ON(), do it by hand */ - if (!early_init_dt_verify(params)) -@@ -722,7 +722,7 @@ void __init early_init_devtree(void *params) - memblock_allow_resize(); - memblock_dump_all(); - -- DBG("Phys. mem: %llx\n", memblock_phys_mem_size()); -+ DBG("Phys. mem: %llx\n", (unsigned long long)memblock_phys_mem_size()); - - /* We may need to relocate the flat tree, do it now. - * FIXME .. and the initrd too? */ -diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c -index 52863deed65d..5fc8a010fdf0 100644 ---- a/arch/powerpc/mm/fault.c -+++ b/arch/powerpc/mm/fault.c -@@ -581,21 +581,22 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig) - switch (regs->trap) { - case 0x300: - case 0x380: -- printk(KERN_ALERT "Unable to handle kernel paging request for " -- "data at address 0x%08lx\n", regs->dar); -+ pr_alert("BUG: %s at 0x%08lx\n", -+ regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" : -+ "Unable to handle kernel data access", regs->dar); - break; - case 0x400: - case 0x480: -- printk(KERN_ALERT "Unable to handle kernel paging request for " -- "instruction fetch\n"); -+ pr_alert("BUG: Unable to handle kernel instruction fetch%s", -+ regs->nip < PAGE_SIZE ? " (NULL pointer?)\n" : "\n"); - break; - case 0x600: -- printk(KERN_ALERT "Unable to handle kernel paging request for " -- "unaligned access at address 0x%08lx\n", regs->dar); -+ pr_alert("BUG: Unable to handle kernel unaligned access at 0x%08lx\n", -+ regs->dar); - break; - default: -- printk(KERN_ALERT "Unable to handle kernel paging request for " -- "unknown fault\n"); -+ pr_alert("BUG: Unable to handle unknown paging fault at 0x%08lx\n", -+ regs->dar); - break; - } - printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n", -diff --git a/arch/powerpc/mm/ppc_mmu_32.c b/arch/powerpc/mm/ppc_mmu_32.c -index 2a049fb8523d..96c52271e9c2 100644 ---- a/arch/powerpc/mm/ppc_mmu_32.c -+++ b/arch/powerpc/mm/ppc_mmu_32.c -@@ -52,7 +52,7 @@ struct batrange { /* stores address ranges mapped by BATs */ - phys_addr_t v_block_mapped(unsigned long va) - { - int b; -- for (b = 0; b < 4; ++b) -+ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b) - if (va >= bat_addrs[b].start && va < bat_addrs[b].limit) - return bat_addrs[b].phys + (va - bat_addrs[b].start); - return 0; -@@ -64,7 +64,7 @@ phys_addr_t v_block_mapped(unsigned long va) - unsigned long p_block_mapped(phys_addr_t pa) - { - int b; -- for (b = 0; b < 4; ++b) -+ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b) - if (pa >= bat_addrs[b].phys - && pa < (bat_addrs[b].limit-bat_addrs[b].start) - +bat_addrs[b].phys) -diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c -index cf9c35aa0cf4..7ecea7143e58 100644 ---- a/arch/powerpc/perf/isa207-common.c -+++ b/arch/powerpc/perf/isa207-common.c -@@ -150,6 +150,14 @@ static bool is_thresh_cmp_valid(u64 event) - return true; - } - -+static unsigned int dc_ic_rld_quad_l1_sel(u64 event) -+{ -+ unsigned int cache; -+ -+ cache = (event >> EVENT_CACHE_SEL_SHIFT) & MMCR1_DC_IC_QUAL_MASK; -+ return cache; -+} -+ - static inline u64 isa207_find_source(u64 idx, u32 sub_idx) - { - u64 ret = PERF_MEM_NA; -@@ -290,10 +298,10 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) - * have a cache selector of zero. The bank selector (bit 3) is - * irrelevant, as long as the rest of the value is 0. - */ -- if (cache & 0x7) -+ if (!cpu_has_feature(CPU_FTR_ARCH_300) && (cache & 0x7)) - return -1; - -- } else if (event & EVENT_IS_L1) { -+ } else if (cpu_has_feature(CPU_FTR_ARCH_300) || (event & EVENT_IS_L1)) { - mask |= CNST_L1_QUAL_MASK; - value |= CNST_L1_QUAL_VAL(cache); - } -@@ -396,11 +404,14 @@ int isa207_compute_mmcr(u64 event[], int n_ev, - /* In continuous sampling mode, update SDAR on TLB miss */ - mmcra_sdar_mode(event[i], &mmcra); - -- if (event[i] & EVENT_IS_L1) { -- cache = event[i] >> EVENT_CACHE_SEL_SHIFT; -- mmcr1 |= (cache & 1) << MMCR1_IC_QUAL_SHIFT; -- cache >>= 1; -- mmcr1 |= (cache & 1) << MMCR1_DC_QUAL_SHIFT; -+ if (cpu_has_feature(CPU_FTR_ARCH_300)) { -+ cache = dc_ic_rld_quad_l1_sel(event[i]); -+ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT; -+ } else { -+ if (event[i] & EVENT_IS_L1) { -+ cache = dc_ic_rld_quad_l1_sel(event[i]); -+ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT; -+ } - } - - if (is_event_marked(event[i])) { -diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h -index 6c737d675792..493e5cc5fa8a 100644 ---- a/arch/powerpc/perf/isa207-common.h -+++ b/arch/powerpc/perf/isa207-common.h -@@ -232,8 +232,8 @@ - #define MMCR1_COMBINE_SHIFT(pmc) (35 - ((pmc) - 1)) - #define MMCR1_PMCSEL_SHIFT(pmc) (24 - (((pmc) - 1)) * 8) - #define MMCR1_FAB_SHIFT 36 --#define MMCR1_DC_QUAL_SHIFT 47 --#define MMCR1_IC_QUAL_SHIFT 46 -+#define MMCR1_DC_IC_QUAL_MASK 0x3 -+#define MMCR1_DC_IC_QUAL_SHIFT 46 - - /* MMCR1 Combine bits macro for power9 */ - #define p9_MMCR1_COMBINE_SHIFT(pmc) (38 - ((pmc - 1) * 2)) -diff --git a/arch/powerpc/platforms/83xx/misc.c b/arch/powerpc/platforms/83xx/misc.c -index d75c9816a5c9..2b6589fe812d 100644 ---- a/arch/powerpc/platforms/83xx/misc.c -+++ b/arch/powerpc/platforms/83xx/misc.c -@@ -14,6 +14,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -150,3 +151,19 @@ void __init mpc83xx_setup_arch(void) - - mpc83xx_setup_pci(); - } -+ -+int machine_check_83xx(struct pt_regs *regs) -+{ -+ u32 mask = 1 << (31 - IPIC_MCP_WDT); -+ -+ if (!(regs->msr & SRR1_MCE_MCP) || !(ipic_get_mcp_status() & mask)) -+ return machine_check_generic(regs); -+ ipic_clear_mcp_status(mask); -+ -+ if (debugger_fault_handler(regs)) -+ return 1; -+ -+ die("Watchdog NMI Reset", regs, 0); -+ -+ return 1; -+} -diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c -index 8864065eba22..fa2965c96155 100644 ---- a/arch/powerpc/platforms/powernv/eeh-powernv.c -+++ b/arch/powerpc/platforms/powernv/eeh-powernv.c -@@ -548,8 +548,8 @@ static void pnv_eeh_get_phb_diag(struct eeh_pe *pe) - static int pnv_eeh_get_phb_state(struct eeh_pe *pe) - { - struct pnv_phb *phb = pe->phb->private_data; -- u8 fstate; -- __be16 pcierr; -+ u8 fstate = 0; -+ __be16 pcierr = 0; - s64 rc; - int result = 0; - -@@ -587,8 +587,8 @@ static int pnv_eeh_get_phb_state(struct eeh_pe *pe) - static int pnv_eeh_get_pe_state(struct eeh_pe *pe) - { - struct pnv_phb *phb = pe->phb->private_data; -- u8 fstate; -- __be16 pcierr; -+ u8 fstate = 0; -+ __be16 pcierr = 0; - s64 rc; - int result; - -diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c -index ddef22e00ddd..d3d5796f7df6 100644 ---- a/arch/powerpc/platforms/powernv/pci-ioda.c -+++ b/arch/powerpc/platforms/powernv/pci-ioda.c -@@ -598,8 +598,8 @@ static int pnv_ioda_unfreeze_pe(struct pnv_phb *phb, int pe_no, int opt) - static int pnv_ioda_get_pe_state(struct pnv_phb *phb, int pe_no) - { - struct pnv_ioda_pe *slave, *pe; -- u8 fstate, state; -- __be16 pcierr; -+ u8 fstate = 0, state; -+ __be16 pcierr = 0; - s64 rc; - - /* Sanity check on PE number */ -diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c -index 5422f4a6317c..e2d031a3ec15 100644 ---- a/arch/powerpc/platforms/powernv/pci.c -+++ b/arch/powerpc/platforms/powernv/pci.c -@@ -600,8 +600,8 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no) - static void pnv_pci_config_check_eeh(struct pci_dn *pdn) - { - struct pnv_phb *phb = pdn->phb->private_data; -- u8 fstate; -- __be16 pcierr; -+ u8 fstate = 0; -+ __be16 pcierr = 0; - unsigned int pe_no; - s64 rc; - -diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c -index f4e6565dd7a9..fb2876a84fbe 100644 ---- a/arch/powerpc/platforms/pseries/dlpar.c -+++ b/arch/powerpc/platforms/pseries/dlpar.c -@@ -63,6 +63,10 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa) - - name = (char *)ccwa + be32_to_cpu(ccwa->name_offset); - prop->name = kstrdup(name, GFP_KERNEL); -+ if (!prop->name) { -+ dlpar_free_cc_property(prop); -+ return NULL; -+ } - - prop->length = be32_to_cpu(ccwa->prop_length); - value = (char *)ccwa + be32_to_cpu(ccwa->prop_offset); -diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c -index 99a3cf51c5ba..fdfce7a46d73 100644 ---- a/arch/powerpc/platforms/pseries/hotplug-memory.c -+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c -@@ -295,6 +295,7 @@ static u32 lookup_lmb_associativity_index(struct of_drconf_cell *lmb) - - aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc); - -+ of_node_put(dr_node); - dlpar_free_cc_nodes(lmb_node); - return aa_index; - } -diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c -index 5a739588aa50..51a53fd51722 100644 ---- a/arch/powerpc/xmon/xmon.c -+++ b/arch/powerpc/xmon/xmon.c -@@ -3293,7 +3293,7 @@ void dump_segments(void) - - printf("sr0-15 ="); - for (i = 0; i < 16; ++i) -- printf(" %x", mfsrin(i)); -+ printf(" %x", mfsrin(i << 28)); - printf("\n"); - } - #endif -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index ff62a4fe2159..91c24e87fe10 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -361,19 +361,30 @@ static void kvm_s390_cpu_feat_init(void) - - int kvm_arch_init(void *opaque) - { -+ int rc; -+ - kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long)); - if (!kvm_s390_dbf) - return -ENOMEM; - - if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) { -- debug_unregister(kvm_s390_dbf); -- return -ENOMEM; -+ rc = -ENOMEM; -+ goto out_debug_unreg; - } - - kvm_s390_cpu_feat_init(); - - /* Register floating interrupt controller interface. */ -- return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC); -+ rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC); -+ if (rc) { -+ pr_err("Failed to register FLIC rc=%d\n", rc); -+ goto out_debug_unreg; -+ } -+ return 0; -+ -+out_debug_unreg: -+ debug_unregister(kvm_s390_dbf); -+ return rc; - } - - void kvm_arch_exit(void) -diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c -index 05c8abd864f1..9bce54eac0b0 100644 ---- a/arch/s390/mm/gup.c -+++ b/arch/s390/mm/gup.c -@@ -39,7 +39,8 @@ static inline int gup_pte_range(pmd_t *pmdp, pmd_t pmd, unsigned long addr, - VM_BUG_ON(!pfn_valid(pte_pfn(pte))); - page = pte_page(pte); - head = compound_head(page); -- if (!page_cache_get_speculative(head)) -+ if (unlikely(WARN_ON_ONCE(page_ref_count(head) < 0) -+ || !page_cache_get_speculative(head))) - return 0; - if (unlikely(pte_val(pte) != pte_val(*ptep))) { - put_page(head); -@@ -77,7 +78,8 @@ static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr, - refs++; - } while (addr += PAGE_SIZE, addr != end); - -- if (!page_cache_add_speculative(head, refs)) { -+ if (unlikely(WARN_ON_ONCE(page_ref_count(head) < 0) -+ || !page_cache_add_speculative(head, refs))) { - *nr -= refs; - return 0; - } -@@ -151,7 +153,8 @@ static int gup_huge_pud(pud_t *pudp, pud_t pud, unsigned long addr, - refs++; - } while (addr += PAGE_SIZE, addr != end); - -- if (!page_cache_add_speculative(head, refs)) { -+ if (unlikely(WARN_ON_ONCE(page_ref_count(head) < 0) -+ || !page_cache_add_speculative(head, refs))) { - *nr -= refs; - return 0; - } -diff --git a/arch/um/Kconfig.debug b/arch/um/Kconfig.debug -index 967d3109689f..39d44bfb241d 100644 ---- a/arch/um/Kconfig.debug -+++ b/arch/um/Kconfig.debug -@@ -19,6 +19,7 @@ config GPROF - config GCOV - bool "Enable gcov support" - depends on DEBUG_INFO -+ depends on !KCOV - help - This option allows developers to retrieve coverage data from a UML - session. -diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c -index f6ea94f8954a..f892cb0b485e 100644 ---- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c -+++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c -@@ -313,6 +313,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg) - int ret = 0; - - rdtgrp = rdtgroup_kn_lock_live(of->kn); -+ if (!rdtgrp) { -+ ret = -ENOENT; -+ goto out; -+ } - - md.priv = of->kn->priv; - resid = md.u.rid; -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index f67fc0f359ff..c579cda1721e 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -2818,9 +2818,6 @@ static void setup_msrs(struct vcpu_vmx *vmx) - index = __find_msr_index(vmx, MSR_CSTAR); - if (index >= 0) - move_msr_up(vmx, index, save_nmsrs++); -- index = __find_msr_index(vmx, MSR_TSC_AUX); -- if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP)) -- move_msr_up(vmx, index, save_nmsrs++); - /* - * MSR_STAR is only needed on long mode guests, and only - * if efer.sce is enabled. -@@ -2833,6 +2830,9 @@ static void setup_msrs(struct vcpu_vmx *vmx) - index = __find_msr_index(vmx, MSR_EFER); - if (index >= 0 && update_transition_efer(vmx, index)) - move_msr_up(vmx, index, save_nmsrs++); -+ index = __find_msr_index(vmx, MSR_TSC_AUX); -+ if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP)) -+ move_msr_up(vmx, index, save_nmsrs++); - - vmx->save_nmsrs = save_nmsrs; - -@@ -10000,10 +10000,6 @@ static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs) - vmx_vcpu_load(vcpu, cpu); - vcpu->cpu = cpu; - put_cpu(); -- -- vm_entry_controls_reset_shadow(vmx); -- vm_exit_controls_reset_shadow(vmx); -- vmx_segment_cache_clear(vmx); - } - - /* -@@ -11432,6 +11428,7 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry) - vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL); - - vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02); -+ vmx_segment_cache_clear(vmx); - - if (prepare_vmcs02(vcpu, vmcs12, from_vmentry, &exit_qual)) { - leave_guest_mode(vcpu); -@@ -12175,6 +12172,9 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, - } - - vmx_switch_vmcs(vcpu, &vmx->vmcs01); -+ vm_entry_controls_reset_shadow(vmx); -+ vm_exit_controls_reset_shadow(vmx); -+ vmx_segment_cache_clear(vmx); - - /* Update any VMCS fields that might have changed while L2 ran */ - vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr); -diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S -index 3a6feed76dfc..a93d8a7cef26 100644 ---- a/arch/x86/xen/xen-asm_64.S -+++ b/arch/x86/xen/xen-asm_64.S -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - - #include - -@@ -24,6 +25,7 @@ ENTRY(xen_\name) - pop %r11 - jmp \name - END(xen_\name) -+_ASM_NOKPROBE(xen_\name) - .endm - - xen_pv_trap divide_error -diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c -index 2b8fb8f1391e..5e457a7dd1c9 100644 ---- a/crypto/crypto_user.c -+++ b/crypto/crypto_user.c -@@ -296,30 +296,33 @@ drop_alg: - - static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb) - { -- struct crypto_alg *alg; -+ const size_t start_pos = cb->args[0]; -+ size_t pos = 0; - struct crypto_dump_info info; -- int err; -- -- if (cb->args[0]) -- goto out; -- -- cb->args[0] = 1; -+ struct crypto_alg *alg; -+ int res; - - info.in_skb = cb->skb; - info.out_skb = skb; - info.nlmsg_seq = cb->nlh->nlmsg_seq; - info.nlmsg_flags = NLM_F_MULTI; - -+ down_read(&crypto_alg_sem); - list_for_each_entry(alg, &crypto_alg_list, cra_list) { -- err = crypto_report_alg(alg, &info); -- if (err) -- goto out_err; -+ if (pos >= start_pos) { -+ res = crypto_report_alg(alg, &info); -+ if (res == -EMSGSIZE) -+ break; -+ if (res) -+ goto out; -+ } -+ pos++; - } -- -+ cb->args[0] = pos; -+ res = skb->len; - out: -- return skb->len; --out_err: -- return err; -+ up_read(&crypto_alg_sem); -+ return res; - } - - static int crypto_dump_report_done(struct netlink_callback *cb) -@@ -503,7 +506,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, - if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) && - (nlh->nlmsg_flags & NLM_F_DUMP))) { - struct crypto_alg *alg; -- u16 dump_alloc = 0; -+ unsigned long dump_alloc = 0; - - if (link->dump == NULL) - return -EINVAL; -@@ -511,16 +514,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, - down_read(&crypto_alg_sem); - list_for_each_entry(alg, &crypto_alg_list, cra_list) - dump_alloc += CRYPTO_REPORT_MAXSIZE; -+ up_read(&crypto_alg_sem); - - { - struct netlink_dump_control c = { - .dump = link->dump, - .done = link->done, -- .min_dump_alloc = dump_alloc, -+ .min_dump_alloc = min(dump_alloc, 65535UL), - }; - err = netlink_dump_start(crypto_nlsk, skb, nlh, &c); - } -- up_read(&crypto_alg_sem); - - return err; - } -diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c -index 1ab8d7223b25..84b1d30f699c 100644 ---- a/drivers/acpi/acpi_lpss.c -+++ b/drivers/acpi/acpi_lpss.c -@@ -518,12 +518,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev, - * have _PS0 and _PS3 without _PSC (and no power resources), so - * acpi_bus_init_power() will assume that the BIOS has put them into D0. - */ -- ret = acpi_device_fix_up_power(adev); -- if (ret) { -- /* Skip the device, but continue the namespace scan. */ -- ret = 0; -- goto err_out; -- } -+ acpi_device_fix_up_power(adev); - - adev->driver_data = pdata; - pdev = acpi_create_platform_device(adev, dev_desc->properties); -diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c -index 5889f6407fea..cd6fae6ad4c2 100644 ---- a/drivers/acpi/apei/ghes.c -+++ b/drivers/acpi/apei/ghes.c -@@ -33,7 +33,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -171,40 +170,40 @@ static int ghes_estatus_pool_init(void) - return 0; - } - --static void ghes_estatus_pool_free_chunk_page(struct gen_pool *pool, -+static void ghes_estatus_pool_free_chunk(struct gen_pool *pool, - struct gen_pool_chunk *chunk, - void *data) - { -- free_page(chunk->start_addr); -+ vfree((void *)chunk->start_addr); - } - - static void ghes_estatus_pool_exit(void) - { - gen_pool_for_each_chunk(ghes_estatus_pool, -- ghes_estatus_pool_free_chunk_page, NULL); -+ ghes_estatus_pool_free_chunk, NULL); - gen_pool_destroy(ghes_estatus_pool); - } - - static int ghes_estatus_pool_expand(unsigned long len) - { -- unsigned long i, pages, size, addr; -- int ret; -+ unsigned long size, addr; - - ghes_estatus_pool_size_request += PAGE_ALIGN(len); - size = gen_pool_size(ghes_estatus_pool); - if (size >= ghes_estatus_pool_size_request) - return 0; -- pages = (ghes_estatus_pool_size_request - size) / PAGE_SIZE; -- for (i = 0; i < pages; i++) { -- addr = __get_free_page(GFP_KERNEL); -- if (!addr) -- return -ENOMEM; -- ret = gen_pool_add(ghes_estatus_pool, addr, PAGE_SIZE, -1); -- if (ret) -- return ret; -- } - -- return 0; -+ addr = (unsigned long)vmalloc(PAGE_ALIGN(len)); -+ if (!addr) -+ return -ENOMEM; -+ -+ /* -+ * New allocation must be visible in all pgd before it can be found by -+ * an NMI allocating from the pool. -+ */ -+ vmalloc_sync_all(); -+ -+ return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1); - } - - static int map_gen_v2(struct ghes *ghes) -@@ -936,7 +935,6 @@ static int ghes_notify_nmi(unsigned int cmd, struct pt_regs *regs) - - sev = ghes_severity(ghes->estatus->error_severity); - if (sev >= GHES_SEV_PANIC) { -- oops_begin(); - ghes_print_queued_estatus(); - __ghes_panic(ghes); - } -diff --git a/drivers/base/platform.c b/drivers/base/platform.c -index 9045c5f3734e..f1105de0d9fe 100644 ---- a/drivers/base/platform.c -+++ b/drivers/base/platform.c -@@ -27,6 +27,7 @@ - #include - #include - #include -+#include - - #include "base.h" - #include "power/power.h" -@@ -526,6 +527,8 @@ struct platform_device *platform_device_register_full( - if (!pdev->dev.dma_mask) - goto err; - -+ kmemleak_ignore(pdev->dev.dma_mask); -+ - *pdev->dev.dma_mask = pdevinfo->dma_mask; - pdev->dev.coherent_dma_mask = pdevinfo->dma_mask; - } -diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c -index 8cb3791898ae..7ea13b5497fd 100644 ---- a/drivers/block/drbd/drbd_main.c -+++ b/drivers/block/drbd/drbd_main.c -@@ -795,7 +795,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm - - if (nc->tentative && connection->agreed_pro_version < 92) { - rcu_read_unlock(); -- mutex_unlock(&sock->mutex); - drbd_err(connection, "--dry-run is not supported by peer"); - return -EOPNOTSUPP; - } -diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c -index ad13ec66c8e4..31d7fe4480af 100644 ---- a/drivers/block/drbd/drbd_nl.c -+++ b/drivers/block/drbd/drbd_nl.c -@@ -1515,6 +1515,30 @@ static void sanitize_disk_conf(struct drbd_device *device, struct disk_conf *dis - } - } - -+static int disk_opts_check_al_size(struct drbd_device *device, struct disk_conf *dc) -+{ -+ int err = -EBUSY; -+ -+ if (device->act_log && -+ device->act_log->nr_elements == dc->al_extents) -+ return 0; -+ -+ drbd_suspend_io(device); -+ /* If IO completion is currently blocked, we would likely wait -+ * "forever" for the activity log to become unused. So we don't. */ -+ if (atomic_read(&device->ap_bio_cnt)) -+ goto out; -+ -+ wait_event(device->al_wait, lc_try_lock(device->act_log)); -+ drbd_al_shrink(device); -+ err = drbd_check_al_size(device, dc); -+ lc_unlock(device->act_log); -+ wake_up(&device->al_wait); -+out: -+ drbd_resume_io(device); -+ return err; -+} -+ - int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info) - { - struct drbd_config_context adm_ctx; -@@ -1577,15 +1601,12 @@ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info) - } - } - -- drbd_suspend_io(device); -- wait_event(device->al_wait, lc_try_lock(device->act_log)); -- drbd_al_shrink(device); -- err = drbd_check_al_size(device, new_disk_conf); -- lc_unlock(device->act_log); -- wake_up(&device->al_wait); -- drbd_resume_io(device); -- -+ err = disk_opts_check_al_size(device, new_disk_conf); - if (err) { -+ /* Could be just "busy". Ignore? -+ * Introduce dedicated error code? */ -+ drbd_msg_put_info(adm_ctx.reply_skb, -+ "Try again without changing current al-extents setting"); - retcode = ERR_NOMEM; - goto fail_unlock; - } -@@ -1935,9 +1956,9 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info) - } - } - -- if (device->state.conn < C_CONNECTED && -- device->state.role == R_PRIMARY && device->ed_uuid && -- (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) { -+ if (device->state.pdsk != D_UP_TO_DATE && device->ed_uuid && -+ (device->state.role == R_PRIMARY || device->state.peer == R_PRIMARY) && -+ (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) { - drbd_err(device, "Can only attach to data with current UUID=%016llX\n", - (unsigned long long)device->ed_uuid); - retcode = ERR_DATA_NOT_CURRENT; -diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c -index 8fbdfaacc222..a7c180426c60 100644 ---- a/drivers/block/drbd/drbd_receiver.c -+++ b/drivers/block/drbd/drbd_receiver.c -@@ -3977,6 +3977,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info - struct o_qlim *o = (connection->agreed_features & DRBD_FF_WSAME) ? p->qlim : NULL; - enum determine_dev_size dd = DS_UNCHANGED; - sector_t p_size, p_usize, p_csize, my_usize; -+ sector_t new_size, cur_size; - int ldsc = 0; /* local disk size changed */ - enum dds_flags ddsf; - -@@ -3984,6 +3985,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info - if (!peer_device) - return config_unknown_volume(connection, pi); - device = peer_device->device; -+ cur_size = drbd_get_capacity(device->this_bdev); - - p_size = be64_to_cpu(p->d_size); - p_usize = be64_to_cpu(p->u_size); -@@ -3994,7 +3996,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info - device->p_size = p_size; - - if (get_ldev(device)) { -- sector_t new_size, cur_size; - rcu_read_lock(); - my_usize = rcu_dereference(device->ldev->disk_conf)->disk_size; - rcu_read_unlock(); -@@ -4012,7 +4013,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info - /* Never shrink a device with usable data during connect. - But allow online shrinking if we are connected. */ - new_size = drbd_new_dev_size(device, device->ldev, p_usize, 0); -- cur_size = drbd_get_capacity(device->this_bdev); - if (new_size < cur_size && - device->state.disk >= D_OUTDATED && - device->state.conn < C_CONNECTED) { -@@ -4077,9 +4077,36 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info - * - * However, if he sends a zero current size, - * take his (user-capped or) backing disk size anyways. -+ * -+ * Unless of course he does not have a disk himself. -+ * In which case we ignore this completely. - */ -+ sector_t new_size = p_csize ?: p_usize ?: p_size; - drbd_reconsider_queue_parameters(device, NULL, o); -- drbd_set_my_capacity(device, p_csize ?: p_usize ?: p_size); -+ if (new_size == 0) { -+ /* Ignore, peer does not know nothing. */ -+ } else if (new_size == cur_size) { -+ /* nothing to do */ -+ } else if (cur_size != 0 && p_size == 0) { -+ drbd_warn(device, "Ignored diskless peer device size (peer:%llu != me:%llu sectors)!\n", -+ (unsigned long long)new_size, (unsigned long long)cur_size); -+ } else if (new_size < cur_size && device->state.role == R_PRIMARY) { -+ drbd_err(device, "The peer's device size is too small! (%llu < %llu sectors); demote me first!\n", -+ (unsigned long long)new_size, (unsigned long long)cur_size); -+ conn_request_state(peer_device->connection, NS(conn, C_DISCONNECTING), CS_HARD); -+ return -EIO; -+ } else { -+ /* I believe the peer, if -+ * - I don't have a current size myself -+ * - we agree on the size anyways -+ * - I do have a current size, am Secondary, -+ * and he has the only disk -+ * - I do have a current size, am Primary, -+ * and he has the only disk, -+ * which is larger than my current size -+ */ -+ drbd_set_my_capacity(device, new_size); -+ } - } - - if (get_ldev(device)) { -@@ -4365,6 +4392,25 @@ static int receive_state(struct drbd_connection *connection, struct packet_info - if (peer_state.conn == C_AHEAD) - ns.conn = C_BEHIND; - -+ /* TODO: -+ * if (primary and diskless and peer uuid != effective uuid) -+ * abort attach on peer; -+ * -+ * If this node does not have good data, was already connected, but -+ * the peer did a late attach only now, trying to "negotiate" with me, -+ * AND I am currently Primary, possibly frozen, with some specific -+ * "effective" uuid, this should never be reached, really, because -+ * we first send the uuids, then the current state. -+ * -+ * In this scenario, we already dropped the connection hard -+ * when we received the unsuitable uuids (receive_uuids(). -+ * -+ * Should we want to change this, that is: not drop the connection in -+ * receive_uuids() already, then we would need to add a branch here -+ * that aborts the attach of "unsuitable uuids" on the peer in case -+ * this node is currently Diskless Primary. -+ */ -+ - if (device->p_uuid && peer_state.disk >= D_NEGOTIATING && - get_ldev_if_state(device, D_NEGOTIATING)) { - int cr; /* consider resync */ -diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h -index ea58301d0895..b2a390ba73a0 100644 ---- a/drivers/block/drbd/drbd_state.h -+++ b/drivers/block/drbd/drbd_state.h -@@ -131,7 +131,7 @@ extern enum drbd_state_rv _drbd_set_state(struct drbd_device *, union drbd_state - enum chg_state_flags, - struct completion *done); - extern void print_st_err(struct drbd_device *, union drbd_state, -- union drbd_state, int); -+ union drbd_state, enum drbd_state_rv); - - enum drbd_state_rv - _conn_request_state(struct drbd_connection *connection, union drbd_state mask, union drbd_state val, -diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c -index 6d41b2023f09..61971ddbd231 100644 ---- a/drivers/bluetooth/hci_bcm.c -+++ b/drivers/bluetooth/hci_bcm.c -@@ -50,6 +50,12 @@ - #define BCM_LM_DIAG_PKT 0x07 - #define BCM_LM_DIAG_SIZE 63 - -+#define BCM_TYPE49_PKT 0x31 -+#define BCM_TYPE49_SIZE 0 -+ -+#define BCM_TYPE52_PKT 0x34 -+#define BCM_TYPE52_SIZE 0 -+ - #define BCM_AUTOSUSPEND_DELAY 5000 /* default autosleep delay */ - - /* platform device driver resources */ -@@ -483,12 +489,28 @@ finalize: - .lsize = 0, \ - .maxlen = BCM_NULL_SIZE - -+#define BCM_RECV_TYPE49 \ -+ .type = BCM_TYPE49_PKT, \ -+ .hlen = BCM_TYPE49_SIZE, \ -+ .loff = 0, \ -+ .lsize = 0, \ -+ .maxlen = BCM_TYPE49_SIZE -+ -+#define BCM_RECV_TYPE52 \ -+ .type = BCM_TYPE52_PKT, \ -+ .hlen = BCM_TYPE52_SIZE, \ -+ .loff = 0, \ -+ .lsize = 0, \ -+ .maxlen = BCM_TYPE52_SIZE -+ - static const struct h4_recv_pkt bcm_recv_pkts[] = { - { H4_RECV_ACL, .recv = hci_recv_frame }, - { H4_RECV_SCO, .recv = hci_recv_frame }, - { H4_RECV_EVENT, .recv = hci_recv_frame }, - { BCM_RECV_LM_DIAG, .recv = hci_recv_diag }, - { BCM_RECV_NULL, .recv = hci_recv_diag }, -+ { BCM_RECV_TYPE49, .recv = hci_recv_diag }, -+ { BCM_RECV_TYPE52, .recv = hci_recv_diag }, - }; - - static int bcm_recv(struct hci_uart *hu, const void *data, int count) -diff --git a/drivers/char/hw_random/stm32-rng.c b/drivers/char/hw_random/stm32-rng.c -index 83c695938a2d..f53d47e3355d 100644 ---- a/drivers/char/hw_random/stm32-rng.c -+++ b/drivers/char/hw_random/stm32-rng.c -@@ -166,6 +166,13 @@ static int stm32_rng_probe(struct platform_device *ofdev) - return devm_hwrng_register(dev, &priv->rng); - } - -+static int stm32_rng_remove(struct platform_device *ofdev) -+{ -+ pm_runtime_disable(&ofdev->dev); -+ -+ return 0; -+} -+ - #ifdef CONFIG_PM - static int stm32_rng_runtime_suspend(struct device *dev) - { -@@ -202,6 +209,7 @@ static struct platform_driver stm32_rng_driver = { - .of_match_table = stm32_rng_match, - }, - .probe = stm32_rng_probe, -+ .remove = stm32_rng_remove, - }; - - module_platform_driver(stm32_rng_driver); -diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c -index 113152425a95..ea23002be4de 100644 ---- a/drivers/clk/at91/clk-generated.c -+++ b/drivers/clk/at91/clk-generated.c -@@ -284,7 +284,7 @@ static void clk_generated_startup(struct clk_generated *gck) - static struct clk_hw * __init - at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, - const char *name, const char **parent_names, -- u8 num_parents, u8 id, -+ u8 num_parents, u8 id, bool pll_audio, - const struct clk_range *range) - { - struct clk_generated *gck; -@@ -308,6 +308,7 @@ at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, - gck->regmap = regmap; - gck->lock = lock; - gck->range = *range; -+ gck->audio_pll_allowed = pll_audio; - - clk_generated_startup(gck); - hw = &gck->hw; -@@ -333,7 +334,6 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np) - struct device_node *gcknp; - struct clk_range range = CLK_RANGE(0, 0); - struct regmap *regmap; -- struct clk_generated *gck; - - num_parents = of_clk_get_parent_count(np); - if (num_parents == 0 || num_parents > GENERATED_SOURCE_MAX) -@@ -350,6 +350,8 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np) - return; - - for_each_child_of_node(np, gcknp) { -+ bool pll_audio = false; -+ - if (of_property_read_u32(gcknp, "reg", &id)) - continue; - -@@ -362,24 +364,14 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np) - of_at91_get_clk_range(gcknp, "atmel,clk-output-range", - &range); - -+ if (of_device_is_compatible(np, "atmel,sama5d2-clk-generated") && -+ (id == GCK_ID_I2S0 || id == GCK_ID_I2S1 || -+ id == GCK_ID_CLASSD)) -+ pll_audio = true; -+ - hw = at91_clk_register_generated(regmap, &pmc_pcr_lock, name, - parent_names, num_parents, -- id, &range); -- -- gck = to_clk_generated(hw); -- -- if (of_device_is_compatible(np, -- "atmel,sama5d2-clk-generated")) { -- if (gck->id == GCK_ID_SSC0 || gck->id == GCK_ID_SSC1 || -- gck->id == GCK_ID_I2S0 || gck->id == GCK_ID_I2S1 || -- gck->id == GCK_ID_CLASSD) -- gck->audio_pll_allowed = true; -- else -- gck->audio_pll_allowed = false; -- } else { -- gck->audio_pll_allowed = false; -- } -- -+ id, pll_audio, &range); - if (IS_ERR(hw)) - continue; - -diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c -index 2f97a843d6d6..90988e7a5b47 100644 ---- a/drivers/clk/at91/clk-main.c -+++ b/drivers/clk/at91/clk-main.c -@@ -162,7 +162,7 @@ at91_clk_register_main_osc(struct regmap *regmap, - if (bypass) - regmap_update_bits(regmap, - AT91_CKGR_MOR, MOR_KEY_MASK | -- AT91_PMC_MOSCEN, -+ AT91_PMC_OSCBYPASS, - AT91_PMC_OSCBYPASS | AT91_PMC_KEY); - - hw = &osc->hw; -@@ -354,7 +354,10 @@ static int clk_main_probe_frequency(struct regmap *regmap) - regmap_read(regmap, AT91_CKGR_MCFR, &mcfr); - if (mcfr & AT91_PMC_MAINRDY) - return 0; -- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT); -+ if (system_state < SYSTEM_RUNNING) -+ udelay(MAINF_LOOP_MIN_WAIT); -+ else -+ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT); - } while (time_before(prep_time, timeout)); - - return -ETIMEDOUT; -diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c -index ab6ecefc49ad..43ba2a8b03fa 100644 ---- a/drivers/clk/at91/sckc.c -+++ b/drivers/clk/at91/sckc.c -@@ -74,7 +74,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw) - - writel(tmp | AT91_SCKC_OSC32EN, sckcr); - -- usleep_range(osc->startup_usec, osc->startup_usec + 1); -+ if (system_state < SYSTEM_RUNNING) -+ udelay(osc->startup_usec); -+ else -+ usleep_range(osc->startup_usec, osc->startup_usec + 1); - - return 0; - } -@@ -197,7 +200,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw) - - writel(readl(sckcr) | AT91_SCKC_RCEN, sckcr); - -- usleep_range(osc->startup_usec, osc->startup_usec + 1); -+ if (system_state < SYSTEM_RUNNING) -+ udelay(osc->startup_usec); -+ else -+ usleep_range(osc->startup_usec, osc->startup_usec + 1); - - return 0; - } -@@ -310,7 +316,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index) - - writel(tmp, sckcr); - -- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1); -+ if (system_state < SYSTEM_RUNNING) -+ udelay(SLOWCK_SW_TIME_USEC); -+ else -+ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1); - - return 0; - } -@@ -443,7 +452,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw) - return 0; - } - -- usleep_range(osc->startup_usec, osc->startup_usec + 1); -+ if (system_state < SYSTEM_RUNNING) -+ udelay(osc->startup_usec); -+ else -+ usleep_range(osc->startup_usec, osc->startup_usec + 1); - osc->prepared = true; - - return 0; -diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c -index 92168348ffa6..f2d27addf485 100644 ---- a/drivers/clk/meson/gxbb.c -+++ b/drivers/clk/meson/gxbb.c -@@ -687,6 +687,7 @@ static struct clk_divider gxbb_sar_adc_clk_div = { - .ops = &clk_divider_ops, - .parent_names = (const char *[]){ "sar_adc_clk_sel" }, - .num_parents = 1, -+ .flags = CLK_SET_RATE_PARENT, - }, - }; - -diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c -index a882f7038bce..47a14f93f869 100644 ---- a/drivers/clk/samsung/clk-exynos5420.c -+++ b/drivers/clk/samsung/clk-exynos5420.c -@@ -170,12 +170,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = { - GATE_BUS_CPU, - GATE_SCLK_CPU, - CLKOUT_CMU_CPU, -+ CPLL_CON0, -+ DPLL_CON0, - EPLL_CON0, - EPLL_CON1, - EPLL_CON2, - RPLL_CON0, - RPLL_CON1, - RPLL_CON2, -+ IPLL_CON0, -+ SPLL_CON0, -+ VPLL_CON0, -+ MPLL_CON0, - SRC_TOP0, - SRC_TOP1, - SRC_TOP2, -diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c -index 8936ef87652c..c14bf782b2b3 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c -+++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c -@@ -1231,7 +1231,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev) - - /* Enforce d1 = 0, d2 = 0 for Audio PLL */ - val = readl(reg + SUN9I_A80_PLL_AUDIO_REG); -- val &= (BIT(16) & BIT(18)); -+ val &= ~(BIT(16) | BIT(18)); - writel(val, reg + SUN9I_A80_PLL_AUDIO_REG); - - /* Enforce P = 1 for both CPU cluster PLLs */ -diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c -index 148815470431..beb672a215b6 100644 ---- a/drivers/clk/ti/clk-dra7-atl.c -+++ b/drivers/clk/ti/clk-dra7-atl.c -@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node) - struct clk_init_data init = { NULL }; - const char **parent_names = NULL; - struct clk *clk; -- int ret; - - clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL); - if (!clk_hw) { -@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node) - clk = ti_clk_register(NULL, &clk_hw->hw, node->name); - - if (!IS_ERR(clk)) { -- ret = ti_clk_add_alias(NULL, clk, node->name); -- if (ret) { -- clk_unregister(clk); -- goto cleanup; -- } - of_clk_add_provider(node, of_clk_src_simple_get, clk); - kfree(parent_names); - return; -diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c -index cdfe1c82f3f0..3928f3999015 100644 ---- a/drivers/clocksource/timer-fttmr010.c -+++ b/drivers/clocksource/timer-fttmr010.c -@@ -21,7 +21,7 @@ - #include - - /* -- * Register definitions for the timers -+ * Register definitions common for all the timer variants. - */ - #define TIMER1_COUNT (0x00) - #define TIMER1_LOAD (0x04) -@@ -36,9 +36,10 @@ - #define TIMER3_MATCH1 (0x28) - #define TIMER3_MATCH2 (0x2c) - #define TIMER_CR (0x30) --#define TIMER_INTR_STATE (0x34) --#define TIMER_INTR_MASK (0x38) - -+/* -+ * Control register (TMC30) bit fields for fttmr010/gemini/moxart timers. -+ */ - #define TIMER_1_CR_ENABLE BIT(0) - #define TIMER_1_CR_CLOCK BIT(1) - #define TIMER_1_CR_INT BIT(2) -@@ -53,8 +54,9 @@ - #define TIMER_3_CR_UPDOWN BIT(11) - - /* -- * The Aspeed AST2400 moves bits around in the control register -- * and lacks bits for setting the timer to count upwards. -+ * Control register (TMC30) bit fields for aspeed ast2400/ast2500 timers. -+ * The aspeed timers move bits around in the control register and lacks -+ * bits for setting the timer to count upwards. - */ - #define TIMER_1_CR_ASPEED_ENABLE BIT(0) - #define TIMER_1_CR_ASPEED_CLOCK BIT(1) -@@ -66,6 +68,18 @@ - #define TIMER_3_CR_ASPEED_CLOCK BIT(9) - #define TIMER_3_CR_ASPEED_INT BIT(10) - -+/* -+ * Interrupt status/mask register definitions for fttmr010/gemini/moxart -+ * timers. -+ * The registers don't exist and they are not needed on aspeed timers -+ * because: -+ * - aspeed timer overflow interrupt is controlled by bits in Control -+ * Register (TMC30). -+ * - aspeed timers always generate interrupt when either one of the -+ * Match registers equals to Status register. -+ */ -+#define TIMER_INTR_STATE (0x34) -+#define TIMER_INTR_MASK (0x38) - #define TIMER_1_INT_MATCH1 BIT(0) - #define TIMER_1_INT_MATCH2 BIT(1) - #define TIMER_1_INT_OVERFLOW BIT(2) -@@ -80,7 +94,7 @@ - struct fttmr010 { - void __iomem *base; - unsigned int tick_rate; -- bool count_down; -+ bool is_aspeed; - u32 t1_enable_val; - struct clock_event_device clkevt; - #ifdef CONFIG_ARM -@@ -130,7 +144,7 @@ static int fttmr010_timer_set_next_event(unsigned long cycles, - cr &= ~fttmr010->t1_enable_val; - writel(cr, fttmr010->base + TIMER_CR); - -- if (fttmr010->count_down) { -+ if (fttmr010->is_aspeed) { - /* - * ASPEED Timer Controller will load TIMER1_LOAD register - * into TIMER1_COUNT register when the timer is re-enabled. -@@ -175,16 +189,17 @@ static int fttmr010_timer_set_oneshot(struct clock_event_device *evt) - - /* Setup counter start from 0 or ~0 */ - writel(0, fttmr010->base + TIMER1_COUNT); -- if (fttmr010->count_down) -+ if (fttmr010->is_aspeed) { - writel(~0, fttmr010->base + TIMER1_LOAD); -- else -+ } else { - writel(0, fttmr010->base + TIMER1_LOAD); - -- /* Enable interrupt */ -- cr = readl(fttmr010->base + TIMER_INTR_MASK); -- cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2); -- cr |= TIMER_1_INT_MATCH1; -- writel(cr, fttmr010->base + TIMER_INTR_MASK); -+ /* Enable interrupt */ -+ cr = readl(fttmr010->base + TIMER_INTR_MASK); -+ cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2); -+ cr |= TIMER_1_INT_MATCH1; -+ writel(cr, fttmr010->base + TIMER_INTR_MASK); -+ } - - return 0; - } -@@ -201,9 +216,8 @@ static int fttmr010_timer_set_periodic(struct clock_event_device *evt) - writel(cr, fttmr010->base + TIMER_CR); - - /* Setup timer to fire at 1/HZ intervals. */ -- if (fttmr010->count_down) { -+ if (fttmr010->is_aspeed) { - writel(period, fttmr010->base + TIMER1_LOAD); -- writel(0, fttmr010->base + TIMER1_MATCH1); - } else { - cr = 0xffffffff - (period - 1); - writel(cr, fttmr010->base + TIMER1_COUNT); -@@ -281,23 +295,21 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) - } - - /* -- * The Aspeed AST2400 moves bits around in the control register, -- * otherwise it works the same. -+ * The Aspeed timers move bits around in the control register. - */ - if (is_aspeed) { - fttmr010->t1_enable_val = TIMER_1_CR_ASPEED_ENABLE | - TIMER_1_CR_ASPEED_INT; -- /* Downward not available */ -- fttmr010->count_down = true; -+ fttmr010->is_aspeed = true; - } else { - fttmr010->t1_enable_val = TIMER_1_CR_ENABLE | TIMER_1_CR_INT; -- } - -- /* -- * Reset the interrupt mask and status -- */ -- writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK); -- writel(0, fttmr010->base + TIMER_INTR_STATE); -+ /* -+ * Reset the interrupt mask and status -+ */ -+ writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK); -+ writel(0, fttmr010->base + TIMER_INTR_STATE); -+ } - - /* - * Enable timer 1 count up, timer 2 count up, except on Aspeed, -@@ -306,9 +318,8 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) - if (is_aspeed) - val = TIMER_2_CR_ASPEED_ENABLE; - else { -- val = TIMER_2_CR_ENABLE; -- if (!fttmr010->count_down) -- val |= TIMER_1_CR_UPDOWN | TIMER_2_CR_UPDOWN; -+ val = TIMER_2_CR_ENABLE | TIMER_1_CR_UPDOWN | -+ TIMER_2_CR_UPDOWN; - } - writel(val, fttmr010->base + TIMER_CR); - -@@ -321,7 +332,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) - writel(0, fttmr010->base + TIMER2_MATCH1); - writel(0, fttmr010->base + TIMER2_MATCH2); - -- if (fttmr010->count_down) { -+ if (fttmr010->is_aspeed) { - writel(~0, fttmr010->base + TIMER2_LOAD); - clocksource_mmio_init(fttmr010->base + TIMER2_COUNT, - "FTTMR010-TIMER2", -@@ -371,7 +382,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed) - - #ifdef CONFIG_ARM - /* Also use this timer for delays */ -- if (fttmr010->count_down) -+ if (fttmr010->is_aspeed) - fttmr010->delay_timer.read_current_timer = - fttmr010_read_current_timer_down; - else -diff --git a/drivers/crypto/mxc-scc.c b/drivers/crypto/mxc-scc.c -index e01c46387df8..519086730791 100644 ---- a/drivers/crypto/mxc-scc.c -+++ b/drivers/crypto/mxc-scc.c -@@ -178,12 +178,12 @@ static int mxc_scc_get_data(struct mxc_scc_ctx *ctx, - else - from = scc->black_memory; - -- dev_dbg(scc->dev, "pcopy: from 0x%p %d bytes\n", from, -+ dev_dbg(scc->dev, "pcopy: from 0x%p %zu bytes\n", from, - ctx->dst_nents * 8); - len = sg_pcopy_from_buffer(ablkreq->dst, ctx->dst_nents, - from, ctx->size, ctx->offset); - if (!len) { -- dev_err(scc->dev, "pcopy err from 0x%p (len=%d)\n", from, len); -+ dev_err(scc->dev, "pcopy err from 0x%p (len=%zu)\n", from, len); - return -EINVAL; - } - -@@ -274,7 +274,7 @@ static int mxc_scc_put_data(struct mxc_scc_ctx *ctx, - len = sg_pcopy_to_buffer(req->src, ctx->src_nents, - to, len, ctx->offset); - if (!len) { -- dev_err(scc->dev, "pcopy err to 0x%p (len=%d)\n", to, len); -+ dev_err(scc->dev, "pcopy err to 0x%p (len=%zu)\n", to, len); - return -EINVAL; - } - -@@ -335,9 +335,9 @@ static void mxc_scc_ablkcipher_next(struct mxc_scc_ctx *ctx, - return; - } - -- dev_dbg(scc->dev, "Start encryption (0x%p/0x%p)\n", -- (void *)readl(scc->base + SCC_SCM_RED_START), -- (void *)readl(scc->base + SCC_SCM_BLACK_START)); -+ dev_dbg(scc->dev, "Start encryption (0x%x/0x%x)\n", -+ readl(scc->base + SCC_SCM_RED_START), -+ readl(scc->base + SCC_SCM_BLACK_START)); - - /* clear interrupt control registers */ - writel(SCC_SCM_INTR_CTRL_CLR_INTR, -diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c -index 4835dd4a9e50..4909f820e953 100644 ---- a/drivers/crypto/stm32/stm32-hash.c -+++ b/drivers/crypto/stm32/stm32-hash.c -@@ -361,7 +361,7 @@ static int stm32_hash_xmit_cpu(struct stm32_hash_dev *hdev, - return -ETIMEDOUT; - - if ((hdev->flags & HASH_FLAGS_HMAC) && -- (hdev->flags & ~HASH_FLAGS_HMAC_KEY)) { -+ (!(hdev->flags & HASH_FLAGS_HMAC_KEY))) { - hdev->flags |= HASH_FLAGS_HMAC_KEY; - stm32_hash_write_key(hdev); - if (stm32_hash_wait_busy(hdev)) -diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c -index 1d1612e28854..6fd4af647f59 100644 ---- a/drivers/gpu/ipu-v3/ipu-pre.c -+++ b/drivers/gpu/ipu-v3/ipu-pre.c -@@ -102,6 +102,7 @@ struct ipu_pre { - void *buffer_virt; - bool in_use; - unsigned int safe_window_end; -+ unsigned int last_bufaddr; - }; - - static DEFINE_MUTEX(ipu_pre_list_mutex); -@@ -177,6 +178,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width, - - writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF); - writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF); -+ pre->last_bufaddr = bufaddr; - - val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) | - IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) | -@@ -218,7 +220,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr) - unsigned short current_yblock; - u32 val; - -+ if (bufaddr == pre->last_bufaddr) -+ return; -+ - writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF); -+ pre->last_bufaddr = bufaddr; - - do { - if (time_after(jiffies, timeout)) { -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 0b0fa257299d..0c547bf841f4 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -195,6 +195,18 @@ static unsigned hid_lookup_collection(struct hid_parser *parser, unsigned type) - return 0; /* we know nothing about this usage type */ - } - -+/* -+ * Concatenate usage which defines 16 bits or less with the -+ * currently defined usage page to form a 32 bit usage -+ */ -+ -+static void complete_usage(struct hid_parser *parser, unsigned int index) -+{ -+ parser->local.usage[index] &= 0xFFFF; -+ parser->local.usage[index] |= -+ (parser->global.usage_page & 0xFFFF) << 16; -+} -+ - /* - * Add a usage to the temporary parser table. - */ -@@ -206,6 +218,14 @@ static int hid_add_usage(struct hid_parser *parser, unsigned usage, u8 size) - return -1; - } - parser->local.usage[parser->local.usage_index] = usage; -+ -+ /* -+ * If Usage item only includes usage id, concatenate it with -+ * currently defined usage page -+ */ -+ if (size <= 2) -+ complete_usage(parser, parser->local.usage_index); -+ - parser->local.usage_size[parser->local.usage_index] = size; - parser->local.collection_index[parser->local.usage_index] = - parser->collection_stack_ptr ? -@@ -522,13 +542,32 @@ static int hid_parser_local(struct hid_parser *parser, struct hid_item *item) - * usage value." - */ - --static void hid_concatenate_usage_page(struct hid_parser *parser) -+static void hid_concatenate_last_usage_page(struct hid_parser *parser) - { - int i; -+ unsigned int usage_page; -+ unsigned int current_page; - -- for (i = 0; i < parser->local.usage_index; i++) -- if (parser->local.usage_size[i] <= 2) -- parser->local.usage[i] += parser->global.usage_page << 16; -+ if (!parser->local.usage_index) -+ return; -+ -+ usage_page = parser->global.usage_page; -+ -+ /* -+ * Concatenate usage page again only if last declared Usage Page -+ * has not been already used in previous usages concatenation -+ */ -+ for (i = parser->local.usage_index - 1; i >= 0; i--) { -+ if (parser->local.usage_size[i] > 2) -+ /* Ignore extended usages */ -+ continue; -+ -+ current_page = parser->local.usage[i] >> 16; -+ if (current_page == usage_page) -+ break; -+ -+ complete_usage(parser, i); -+ } - } - - /* -@@ -540,7 +579,7 @@ static int hid_parser_main(struct hid_parser *parser, struct hid_item *item) - __u32 data; - int ret; - -- hid_concatenate_usage_page(parser); -+ hid_concatenate_last_usage_page(parser); - - data = item_udata(item); - -@@ -751,7 +790,7 @@ static int hid_scan_main(struct hid_parser *parser, struct hid_item *item) - __u32 data; - int i; - -- hid_concatenate_usage_page(parser); -+ hid_concatenate_last_usage_page(parser); - - data = item_udata(item); - -diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c -index cd23903ddcf1..e918d78e541c 100644 ---- a/drivers/hid/intel-ish-hid/ishtp-hid.c -+++ b/drivers/hid/intel-ish-hid/ishtp-hid.c -@@ -222,7 +222,7 @@ int ishtp_hid_probe(unsigned int cur_hid_dev, - err_hid_device: - kfree(hid_data); - err_hid_data: -- kfree(hid); -+ hid_destroy_device(hid); - return rv; - } - -diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c -index 891873b38a1e..5f3f197678b7 100644 ---- a/drivers/infiniband/hw/qib/qib_sdma.c -+++ b/drivers/infiniband/hw/qib/qib_sdma.c -@@ -600,8 +600,10 @@ retry: - dw = (len + 3) >> 2; - addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr, - dw << 2, DMA_TO_DEVICE); -- if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) -+ if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) { -+ ret = -ENOMEM; - goto unmap; -+ } - sdmadesc[0] = 0; - make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset); - /* SDmaUseLargeBuf has to be set in every descriptor */ -diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c -index aa533f08e017..5c7aa6ff1538 100644 ---- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c -+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c -@@ -550,7 +550,7 @@ struct ib_ah *pvrdma_create_ah(struct ib_pd *pd, struct rdma_ah_attr *ah_attr, - if (!atomic_add_unless(&dev->num_ahs, 1, dev->dsr->caps.max_ah)) - return ERR_PTR(-ENOMEM); - -- ah = kzalloc(sizeof(*ah), GFP_KERNEL); -+ ah = kzalloc(sizeof(*ah), GFP_ATOMIC); - if (!ah) { - atomic_dec(&dev->num_ahs); - return ERR_PTR(-ENOMEM); -diff --git a/drivers/infiniband/sw/rxe/rxe_hw_counters.c b/drivers/infiniband/sw/rxe/rxe_hw_counters.c -index 6aeb7a165e46..ea4542a9d69e 100644 ---- a/drivers/infiniband/sw/rxe/rxe_hw_counters.c -+++ b/drivers/infiniband/sw/rxe/rxe_hw_counters.c -@@ -59,7 +59,7 @@ int rxe_ib_get_hw_stats(struct ib_device *ibdev, - return -EINVAL; - - for (cnt = 0; cnt < ARRAY_SIZE(rxe_counter_name); cnt++) -- stats->value[cnt] = dev->stats_counters[cnt]; -+ stats->value[cnt] = atomic64_read(&dev->stats_counters[cnt]); - - return ARRAY_SIZE(rxe_counter_name); - } -diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h -index b2b76a316eba..d1cc89f6f2e3 100644 ---- a/drivers/infiniband/sw/rxe/rxe_verbs.h -+++ b/drivers/infiniband/sw/rxe/rxe_verbs.h -@@ -410,16 +410,16 @@ struct rxe_dev { - spinlock_t mmap_offset_lock; /* guard mmap_offset */ - int mmap_offset; - -- u64 stats_counters[RXE_NUM_OF_COUNTERS]; -+ atomic64_t stats_counters[RXE_NUM_OF_COUNTERS]; - - struct rxe_port port; - struct list_head list; - struct crypto_shash *tfm; - }; - --static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters cnt) -+static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters index) - { -- rxe->stats_counters[cnt]++; -+ atomic64_inc(&rxe->stats_counters[index]); - } - - static inline struct rxe_dev *to_rdev(struct ib_device *dev) -diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c -index 3f5b5893792c..9f7287f45d06 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.c -+++ b/drivers/infiniband/ulp/srp/ib_srp.c -@@ -2210,6 +2210,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd) - - if (srp_post_send(ch, iu, len)) { - shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n"); -+ scmnd->result = DID_ERROR << 16; - goto err_unmap; - } - -diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c -index aa9f29b875de..d84e3b70215a 100644 ---- a/drivers/input/serio/gscps2.c -+++ b/drivers/input/serio/gscps2.c -@@ -382,9 +382,9 @@ static int __init gscps2_probe(struct parisc_device *dev) - goto fail; - #endif - -- printk(KERN_INFO "serio: %s port at 0x%p irq %d @ %s\n", -+ pr_info("serio: %s port at 0x%08lx irq %d @ %s\n", - ps2port->port->name, -- ps2port->addr, -+ hpa, - ps2port->padev->irq, - ps2port->port->phys); - -diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c -index 8eef6849d066..5585823ced19 100644 ---- a/drivers/input/serio/hp_sdc.c -+++ b/drivers/input/serio/hp_sdc.c -@@ -887,8 +887,8 @@ static int __init hp_sdc_init(void) - "HP SDC NMI", &hp_sdc)) - goto err2; - -- printk(KERN_INFO PREFIX "HP SDC at 0x%p, IRQ %d (NMI IRQ %d)\n", -- (void *)hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi); -+ pr_info(PREFIX "HP SDC at 0x%08lx, IRQ %d (NMI IRQ %d)\n", -+ hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi); - - hp_sdc_status_in8(); - hp_sdc_data_in8(); -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index 07b6cf58fd99..d09c24825734 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -139,10 +139,14 @@ static struct lock_class_key reserved_rbtree_key; - static inline int match_hid_uid(struct device *dev, - struct acpihid_map_entry *entry) - { -+ struct acpi_device *adev = ACPI_COMPANION(dev); - const char *hid, *uid; - -- hid = acpi_device_hid(ACPI_COMPANION(dev)); -- uid = acpi_device_uid(ACPI_COMPANION(dev)); -+ if (!adev) -+ return -ENODEV; -+ -+ hid = acpi_device_hid(adev); -+ uid = acpi_device_uid(adev); - - if (!hid || !(*hid)) - return -ENODEV; -diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c -index 93f3d4d61fa7..546ba140f83d 100644 ---- a/drivers/mailbox/mailbox-test.c -+++ b/drivers/mailbox/mailbox-test.c -@@ -363,22 +363,24 @@ static int mbox_test_probe(struct platform_device *pdev) - - /* It's okay for MMIO to be NULL */ - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -- size = resource_size(res); - tdev->tx_mmio = devm_ioremap_resource(&pdev->dev, res); -- if (PTR_ERR(tdev->tx_mmio) == -EBUSY) -+ if (PTR_ERR(tdev->tx_mmio) == -EBUSY) { - /* if reserved area in SRAM, try just ioremap */ -+ size = resource_size(res); - tdev->tx_mmio = devm_ioremap(&pdev->dev, res->start, size); -- else if (IS_ERR(tdev->tx_mmio)) -+ } else if (IS_ERR(tdev->tx_mmio)) { - tdev->tx_mmio = NULL; -+ } - - /* If specified, second reg entry is Rx MMIO */ - res = platform_get_resource(pdev, IORESOURCE_MEM, 1); -- size = resource_size(res); - tdev->rx_mmio = devm_ioremap_resource(&pdev->dev, res); -- if (PTR_ERR(tdev->rx_mmio) == -EBUSY) -+ if (PTR_ERR(tdev->rx_mmio) == -EBUSY) { -+ size = resource_size(res); - tdev->rx_mmio = devm_ioremap(&pdev->dev, res->start, size); -- else if (IS_ERR(tdev->rx_mmio)) -+ } else if (IS_ERR(tdev->rx_mmio)) { - tdev->rx_mmio = tdev->tx_mmio; -+ } - - tdev->tx_channel = mbox_test_request_channel(pdev, "tx"); - tdev->rx_channel = mbox_test_request_channel(pdev, "rx"); -diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c -index 0c1ef63c3461..b1b68e01b889 100644 ---- a/drivers/md/dm-flakey.c -+++ b/drivers/md/dm-flakey.c -@@ -282,20 +282,31 @@ static void flakey_map_bio(struct dm_target *ti, struct bio *bio) - - static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc) - { -- unsigned bio_bytes = bio_cur_bytes(bio); -- char *data = bio_data(bio); -+ unsigned int corrupt_bio_byte = fc->corrupt_bio_byte - 1; -+ -+ struct bvec_iter iter; -+ struct bio_vec bvec; -+ -+ if (!bio_has_data(bio)) -+ return; - - /* -- * Overwrite the Nth byte of the data returned. -+ * Overwrite the Nth byte of the bio's data, on whichever page -+ * it falls. - */ -- if (data && bio_bytes >= fc->corrupt_bio_byte) { -- data[fc->corrupt_bio_byte - 1] = fc->corrupt_bio_value; -- -- DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " -- "(rw=%c bi_opf=%u bi_sector=%llu cur_bytes=%u)\n", -- bio, fc->corrupt_bio_value, fc->corrupt_bio_byte, -- (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf, -- (unsigned long long)bio->bi_iter.bi_sector, bio_bytes); -+ bio_for_each_segment(bvec, bio, iter) { -+ if (bio_iter_len(bio, iter) > corrupt_bio_byte) { -+ char *segment = (page_address(bio_iter_page(bio, iter)) -+ + bio_iter_offset(bio, iter)); -+ segment[corrupt_bio_byte] = fc->corrupt_bio_value; -+ DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " -+ "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n", -+ bio, fc->corrupt_bio_value, fc->corrupt_bio_byte, -+ (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf, -+ (unsigned long long)bio->bi_iter.bi_sector, bio->bi_iter.bi_size); -+ break; -+ } -+ corrupt_bio_byte -= bio_iter_len(bio, iter); - } - } - -diff --git a/drivers/media/platform/atmel/atmel-isc.c b/drivers/media/platform/atmel/atmel-isc.c -index d7103c5f92c3..0dea3cf2cb52 100644 ---- a/drivers/media/platform/atmel/atmel-isc.c -+++ b/drivers/media/platform/atmel/atmel-isc.c -@@ -1555,6 +1555,8 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier) - struct vb2_queue *q = &isc->vb2_vidq; - int ret; - -+ INIT_WORK(&isc->awb_work, isc_awb_work); -+ - ret = v4l2_device_register_subdev_nodes(&isc->v4l2_dev); - if (ret < 0) { - v4l2_err(&isc->v4l2_dev, "Failed to register subdev nodes\n"); -@@ -1614,8 +1616,6 @@ static int isc_async_complete(struct v4l2_async_notifier *notifier) - return ret; - } - -- INIT_WORK(&isc->awb_work, isc_awb_work); -- - /* Register video device */ - strlcpy(vdev->name, ATMEL_ISC_NAME, sizeof(vdev->name)); - vdev->release = video_device_release_empty; -@@ -1722,8 +1722,11 @@ static int isc_parse_dt(struct device *dev, struct isc_device *isc) - break; - } - -- subdev_entity->asd = devm_kzalloc(dev, -- sizeof(*subdev_entity->asd), GFP_KERNEL); -+ /* asd will be freed by the subsystem once it's added to the -+ * notifier list -+ */ -+ subdev_entity->asd = kzalloc(sizeof(*subdev_entity->asd), -+ GFP_KERNEL); - if (subdev_entity->asd == NULL) { - of_node_put(rem); - ret = -ENOMEM; -@@ -1859,6 +1862,7 @@ static int atmel_isc_probe(struct platform_device *pdev) - &subdev_entity->notifier); - if (ret) { - dev_err(dev, "fail to register async notifier\n"); -+ kfree(subdev_entity->asd); - goto cleanup_subdev; - } - -diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c -index 4281f3f76ab1..f157ccbd8286 100644 ---- a/drivers/media/platform/stm32/stm32-dcmi.c -+++ b/drivers/media/platform/stm32/stm32-dcmi.c -@@ -161,6 +161,9 @@ struct stm32_dcmi { - u32 misr; - int errors_count; - int buffers_count; -+ -+ /* Ensure DMA operations atomicity */ -+ struct mutex dma_lock; - }; - - static inline struct stm32_dcmi *notifier_to_dcmi(struct v4l2_async_notifier *n) -@@ -291,6 +294,13 @@ static int dcmi_start_dma(struct stm32_dcmi *dcmi, - return ret; - } - -+ /* -+ * Avoid call of dmaengine_terminate_all() between -+ * dmaengine_prep_slave_single() and dmaengine_submit() -+ * by locking the whole DMA submission sequence -+ */ -+ mutex_lock(&dcmi->dma_lock); -+ - /* Prepare a DMA transaction */ - desc = dmaengine_prep_slave_single(dcmi->dma_chan, buf->paddr, - buf->size, -@@ -298,6 +308,7 @@ static int dcmi_start_dma(struct stm32_dcmi *dcmi, - if (!desc) { - dev_err(dcmi->dev, "%s: DMA dmaengine_prep_slave_single failed for buffer size %zu\n", - __func__, buf->size); -+ mutex_unlock(&dcmi->dma_lock); - return -EINVAL; - } - -@@ -309,9 +320,12 @@ static int dcmi_start_dma(struct stm32_dcmi *dcmi, - dcmi->dma_cookie = dmaengine_submit(desc); - if (dma_submit_error(dcmi->dma_cookie)) { - dev_err(dcmi->dev, "%s: DMA submission failed\n", __func__); -+ mutex_unlock(&dcmi->dma_lock); - return -ENXIO; - } - -+ mutex_unlock(&dcmi->dma_lock); -+ - dma_async_issue_pending(dcmi->dma_chan); - - return 0; -@@ -690,7 +704,9 @@ static void dcmi_stop_streaming(struct vb2_queue *vq) - spin_unlock_irq(&dcmi->irqlock); - - /* Stop all pending DMA operations */ -+ mutex_lock(&dcmi->dma_lock); - dmaengine_terminate_all(dcmi->dma_chan); -+ mutex_unlock(&dcmi->dma_lock); - - clk_disable(dcmi->mclk); - -@@ -1662,6 +1678,7 @@ static int dcmi_probe(struct platform_device *pdev) - - spin_lock_init(&dcmi->irqlock); - mutex_init(&dcmi->lock); -+ mutex_init(&dcmi->dma_lock); - init_completion(&dcmi->complete); - INIT_LIST_HEAD(&dcmi->buffers); - -diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c -index 1ee072e939e4..34d6ae43fc45 100644 ---- a/drivers/media/v4l2-core/v4l2-ctrls.c -+++ b/drivers/media/v4l2-core/v4l2-ctrls.c -@@ -1014,6 +1014,7 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type, - case V4L2_CID_FLASH_STROBE_STOP: - case V4L2_CID_AUTO_FOCUS_START: - case V4L2_CID_AUTO_FOCUS_STOP: -+ case V4L2_CID_DO_WHITE_BALANCE: - *type = V4L2_CTRL_TYPE_BUTTON; - *flags |= V4L2_CTRL_FLAG_WRITE_ONLY | - V4L2_CTRL_FLAG_EXECUTE_ON_WRITE; -diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c -index 37b13bc5c16f..8f6ab516041b 100644 ---- a/drivers/misc/mei/bus.c -+++ b/drivers/misc/mei/bus.c -@@ -850,15 +850,16 @@ static const struct device_type mei_cl_device_type = { - - /** - * mei_cl_bus_set_name - set device name for me client device -+ * - -+ * Example: 0000:00:16.0-55213584-9a29-4916-badf-0fb7ed682aeb - * - * @cldev: me client device - */ - static inline void mei_cl_bus_set_name(struct mei_cl_device *cldev) - { -- dev_set_name(&cldev->dev, "mei:%s:%pUl:%02X", -- cldev->name, -- mei_me_cl_uuid(cldev->me_cl), -- mei_me_cl_ver(cldev->me_cl)); -+ dev_set_name(&cldev->dev, "%s-%pUl", -+ dev_name(cldev->bus->dev), -+ mei_me_cl_uuid(cldev->me_cl)); - } - - /** -diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c -index 08a55c2e96e1..53ce1bb83d2c 100644 ---- a/drivers/mmc/host/meson-gx-mmc.c -+++ b/drivers/mmc/host/meson-gx-mmc.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -74,9 +75,11 @@ - #define CFG_CLK_ALWAYS_ON BIT(18) - #define CFG_CHK_DS BIT(20) - #define CFG_AUTO_CLK BIT(23) -+#define CFG_ERR_ABORT BIT(27) - - #define SD_EMMC_STATUS 0x48 - #define STATUS_BUSY BIT(31) -+#define STATUS_DESC_BUSY BIT(30) - #define STATUS_DATI GENMASK(23, 16) - - #define SD_EMMC_IRQ_EN 0x4c -@@ -905,6 +908,7 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd) - - cmd_cfg |= FIELD_PREP(CMD_CFG_CMD_INDEX_MASK, cmd->opcode); - cmd_cfg |= CMD_CFG_OWNER; /* owned by CPU */ -+ cmd_cfg |= CMD_CFG_ERROR; /* stop in case of error */ - - meson_mmc_set_response_bits(cmd, &cmd_cfg); - -@@ -999,6 +1003,17 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id) - u32 irq_en, status, raw_status; - irqreturn_t ret = IRQ_NONE; - -+ irq_en = readl(host->regs + SD_EMMC_IRQ_EN); -+ raw_status = readl(host->regs + SD_EMMC_STATUS); -+ status = raw_status & irq_en; -+ -+ if (!status) { -+ dev_dbg(host->dev, -+ "Unexpected IRQ! irq_en 0x%08x - status 0x%08x\n", -+ irq_en, raw_status); -+ return IRQ_NONE; -+ } -+ - if (WARN_ON(!host) || WARN_ON(!host->cmd)) - return IRQ_NONE; - -@@ -1006,22 +1021,18 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id) - - cmd = host->cmd; - data = cmd->data; -- irq_en = readl(host->regs + SD_EMMC_IRQ_EN); -- raw_status = readl(host->regs + SD_EMMC_STATUS); -- status = raw_status & irq_en; -- - cmd->error = 0; - if (status & IRQ_CRC_ERR) { - dev_dbg(host->dev, "CRC Error - status 0x%08x\n", status); - cmd->error = -EILSEQ; -- ret = IRQ_HANDLED; -+ ret = IRQ_WAKE_THREAD; - goto out; - } - - if (status & IRQ_TIMEOUTS) { - dev_dbg(host->dev, "Timeout - status 0x%08x\n", status); - cmd->error = -ETIMEDOUT; -- ret = IRQ_HANDLED; -+ ret = IRQ_WAKE_THREAD; - goto out; - } - -@@ -1046,17 +1057,49 @@ out: - /* ack all enabled interrupts */ - writel(irq_en, host->regs + SD_EMMC_STATUS); - -+ if (cmd->error) { -+ /* Stop desc in case of errors */ -+ u32 start = readl(host->regs + SD_EMMC_START); -+ -+ start &= ~START_DESC_BUSY; -+ writel(start, host->regs + SD_EMMC_START); -+ } -+ - if (ret == IRQ_HANDLED) - meson_mmc_request_done(host->mmc, cmd->mrq); -- else if (ret == IRQ_NONE) -- dev_warn(host->dev, -- "Unexpected IRQ! status=0x%08x, irq_en=0x%08x\n", -- raw_status, irq_en); - - spin_unlock(&host->lock); - return ret; - } - -+static int meson_mmc_wait_desc_stop(struct meson_host *host) -+{ -+ int loop; -+ u32 status; -+ -+ /* -+ * It may sometimes take a while for it to actually halt. Here, we -+ * are giving it 5ms to comply -+ * -+ * If we don't confirm the descriptor is stopped, it might raise new -+ * IRQs after we have called mmc_request_done() which is bad. -+ */ -+ for (loop = 50; loop; loop--) { -+ status = readl(host->regs + SD_EMMC_STATUS); -+ if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) -+ udelay(100); -+ else -+ break; -+ } -+ -+ if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) { -+ dev_err(host->dev, "Timed out waiting for host to stop\n"); -+ return -ETIMEDOUT; -+ } -+ -+ return 0; -+} -+ - static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id) - { - struct meson_host *host = dev_id; -@@ -1067,6 +1110,13 @@ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id) - if (WARN_ON(!cmd)) - return IRQ_NONE; - -+ if (cmd->error) { -+ meson_mmc_wait_desc_stop(host); -+ meson_mmc_request_done(host->mmc, cmd->mrq); -+ -+ return IRQ_HANDLED; -+ } -+ - data = cmd->data; - if (meson_mmc_bounce_buf_read(data)) { - xfer_bytes = data->blksz * data->blocks; -@@ -1107,6 +1157,9 @@ static void meson_mmc_cfg_init(struct meson_host *host) - cfg |= FIELD_PREP(CFG_RC_CC_MASK, ilog2(SD_EMMC_CFG_CMD_GAP)); - cfg |= FIELD_PREP(CFG_BLK_LEN_MASK, ilog2(SD_EMMC_CFG_BLK_SIZE)); - -+ /* abort chain on R/W errors */ -+ cfg |= CFG_ERR_ABORT; -+ - writel(cfg, host->regs + SD_EMMC_CFG); - } - -diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h -index 37accfd0400e..24480b75a88d 100644 ---- a/drivers/mtd/mtdcore.h -+++ b/drivers/mtd/mtdcore.h -@@ -7,7 +7,7 @@ - extern struct mutex mtd_table_mutex; - - struct mtd_info *__mtd_next_device(int i); --int add_mtd_device(struct mtd_info *mtd); -+int __must_check add_mtd_device(struct mtd_info *mtd); - int del_mtd_device(struct mtd_info *mtd); - int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int); - int del_mtd_partitions(struct mtd_info *); -diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c -index a308e707392d..45626b0eed64 100644 ---- a/drivers/mtd/mtdpart.c -+++ b/drivers/mtd/mtdpart.c -@@ -684,10 +684,21 @@ int mtd_add_partition(struct mtd_info *parent, const char *name, - list_add(&new->list, &mtd_partitions); - mutex_unlock(&mtd_partitions_mutex); - -- add_mtd_device(&new->mtd); -+ ret = add_mtd_device(&new->mtd); -+ if (ret) -+ goto err_remove_part; - - mtd_add_partition_attrs(new); - -+ return 0; -+ -+err_remove_part: -+ mutex_lock(&mtd_partitions_mutex); -+ list_del(&new->list); -+ mutex_unlock(&mtd_partitions_mutex); -+ -+ free_partition(new); -+ - return ret; - } - EXPORT_SYMBOL_GPL(mtd_add_partition); -@@ -778,22 +789,31 @@ int add_mtd_partitions(struct mtd_info *master, - { - struct mtd_part *slave; - uint64_t cur_offset = 0; -- int i; -+ int i, ret; - - printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name); - - for (i = 0; i < nbparts; i++) { - slave = allocate_partition(master, parts + i, i, cur_offset); - if (IS_ERR(slave)) { -- del_mtd_partitions(master); -- return PTR_ERR(slave); -+ ret = PTR_ERR(slave); -+ goto err_del_partitions; - } - - mutex_lock(&mtd_partitions_mutex); - list_add(&slave->list, &mtd_partitions); - mutex_unlock(&mtd_partitions_mutex); - -- add_mtd_device(&slave->mtd); -+ ret = add_mtd_device(&slave->mtd); -+ if (ret) { -+ mutex_lock(&mtd_partitions_mutex); -+ list_del(&slave->list); -+ mutex_unlock(&mtd_partitions_mutex); -+ -+ free_partition(slave); -+ goto err_del_partitions; -+ } -+ - mtd_add_partition_attrs(slave); - if (parts[i].types) - mtd_parse_part(slave, parts[i].types); -@@ -802,6 +822,11 @@ int add_mtd_partitions(struct mtd_info *master, - } - - return 0; -+ -+err_del_partitions: -+ del_mtd_partitions(master); -+ -+ return ret; - } - - static DEFINE_SPINLOCK(part_parser_lock); -diff --git a/drivers/mtd/nand/atmel/nand-controller.c b/drivers/mtd/nand/atmel/nand-controller.c -index 0b93f152d993..d5a493e8ee08 100644 ---- a/drivers/mtd/nand/atmel/nand-controller.c -+++ b/drivers/mtd/nand/atmel/nand-controller.c -@@ -1888,7 +1888,7 @@ static int atmel_nand_controller_add_nands(struct atmel_nand_controller *nc) - - ret = of_property_read_u32(np, "#size-cells", &val); - if (ret) { -- dev_err(dev, "missing #address-cells property\n"); -+ dev_err(dev, "missing #size-cells property\n"); - return ret; - } - -diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c -index 4124bf91bee6..8cd153974e8d 100644 ---- a/drivers/mtd/nand/atmel/pmecc.c -+++ b/drivers/mtd/nand/atmel/pmecc.c -@@ -875,23 +875,32 @@ static struct atmel_pmecc *atmel_pmecc_get_by_node(struct device *userdev, - { - struct platform_device *pdev; - struct atmel_pmecc *pmecc, **ptr; -+ int ret; - - pdev = of_find_device_by_node(np); -- if (!pdev || !platform_get_drvdata(pdev)) -+ if (!pdev) - return ERR_PTR(-EPROBE_DEFER); -+ pmecc = platform_get_drvdata(pdev); -+ if (!pmecc) { -+ ret = -EPROBE_DEFER; -+ goto err_put_device; -+ } - - ptr = devres_alloc(devm_atmel_pmecc_put, sizeof(*ptr), GFP_KERNEL); -- if (!ptr) -- return ERR_PTR(-ENOMEM); -- -- get_device(&pdev->dev); -- pmecc = platform_get_drvdata(pdev); -+ if (!ptr) { -+ ret = -ENOMEM; -+ goto err_put_device; -+ } - - *ptr = pmecc; - - devres_add(userdev, ptr); - - return pmecc; -+ -+err_put_device: -+ put_device(&pdev->dev); -+ return ERR_PTR(ret); - } - - static const int atmel_pmecc_strengths[] = { 2, 4, 8, 12, 24, 32 }; -diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c -index 958974821582..8e5231482397 100644 ---- a/drivers/mtd/nand/sunxi_nand.c -+++ b/drivers/mtd/nand/sunxi_nand.c -@@ -1435,7 +1435,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct mtd_info *mtd, - sunxi_nfc_randomizer_enable(mtd); - - writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG, -- nfc->regs + NFC_REG_RCMD_SET); -+ nfc->regs + NFC_REG_WCMD_SET); - - dma_async_issue_pending(nfc->dmac); - -diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c -index 6c013341ef09..d550148177a0 100644 ---- a/drivers/mtd/spi-nor/spi-nor.c -+++ b/drivers/mtd/spi-nor/spi-nor.c -@@ -2382,7 +2382,7 @@ static int spi_nor_init_params(struct spi_nor *nor, - memset(params, 0, sizeof(*params)); - - /* Set SPI NOR sizes. */ -- params->size = info->sector_size * info->n_sectors; -+ params->size = (u64)info->sector_size * info->n_sectors; - params->page_size = info->page_size; - - /* (Fast) Read settings. */ -diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c -index 6445c693d935..0104d9537329 100644 ---- a/drivers/mtd/ubi/build.c -+++ b/drivers/mtd/ubi/build.c -@@ -1092,10 +1092,10 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway) - ubi_wl_close(ubi); - ubi_free_internal_volumes(ubi); - vfree(ubi->vtbl); -- put_mtd_device(ubi->mtd); - vfree(ubi->peb_buf); - vfree(ubi->fm_buf); - ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index); -+ put_mtd_device(ubi->mtd); - put_device(&ubi->dev); - return 0; - } -diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c -index d4b2e8744498..c2cf6bd3c162 100644 ---- a/drivers/mtd/ubi/kapi.c -+++ b/drivers/mtd/ubi/kapi.c -@@ -227,9 +227,9 @@ out_unlock: - out_free: - kfree(desc); - out_put_ubi: -- ubi_put_device(ubi); - ubi_err(ubi, "cannot open device %d, volume %d, error %d", - ubi_num, vol_id, err); -+ ubi_put_device(ubi); - return ERR_PTR(err); - } - EXPORT_SYMBOL_GPL(ubi_open_volume); -diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c -index 9b61bfbea6cd..24c6015f6c92 100644 ---- a/drivers/net/can/c_can/c_can.c -+++ b/drivers/net/can/c_can/c_can.c -@@ -52,6 +52,7 @@ - #define CONTROL_EX_PDR BIT(8) - - /* control register */ -+#define CONTROL_SWR BIT(15) - #define CONTROL_TEST BIT(7) - #define CONTROL_CCE BIT(6) - #define CONTROL_DISABLE_AR BIT(5) -@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev) - IF_MCONT_RCV_EOB); - } - -+static int c_can_software_reset(struct net_device *dev) -+{ -+ struct c_can_priv *priv = netdev_priv(dev); -+ int retry = 0; -+ -+ if (priv->type != BOSCH_D_CAN) -+ return 0; -+ -+ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT); -+ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) { -+ msleep(20); -+ if (retry++ > 100) { -+ netdev_err(dev, "CCTRL: software reset failed\n"); -+ return -EIO; -+ } -+ } -+ -+ return 0; -+} -+ - /* - * Configure C_CAN chip: - * - enable/disable auto-retransmission -@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev) - static int c_can_chip_config(struct net_device *dev) - { - struct c_can_priv *priv = netdev_priv(dev); -+ int err; -+ -+ err = c_can_software_reset(dev); -+ if (err) -+ return err; - - /* enable automatic retransmission */ - priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR); -diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c -index 1a7c183e6678..54ffd1e91a69 100644 ---- a/drivers/net/can/rx-offload.c -+++ b/drivers/net/can/rx-offload.c -@@ -116,37 +116,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b) - return cb_b->timestamp - cb_a->timestamp; - } - --static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n) -+/** -+ * can_rx_offload_offload_one() - Read one CAN frame from HW -+ * @offload: pointer to rx_offload context -+ * @n: number of mailbox to read -+ * -+ * The task of this function is to read a CAN frame from mailbox @n -+ * from the device and return the mailbox's content as a struct -+ * sk_buff. -+ * -+ * If the struct can_rx_offload::skb_queue exceeds the maximal queue -+ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be -+ * allocated, the mailbox contents is discarded by reading it into an -+ * overflow buffer. This way the mailbox is marked as free by the -+ * driver. -+ * -+ * Return: A pointer to skb containing the CAN frame on success. -+ * -+ * NULL if the mailbox @n is empty. -+ * -+ * ERR_PTR() in case of an error -+ */ -+static struct sk_buff * -+can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n) - { -- struct sk_buff *skb = NULL; -+ struct sk_buff *skb = NULL, *skb_error = NULL; - struct can_rx_offload_cb *cb; - struct can_frame *cf; - int ret; - -- /* If queue is full or skb not available, read to discard mailbox */ -- if (likely(skb_queue_len(&offload->skb_queue) <= -- offload->skb_queue_len_max)) -+ if (likely(skb_queue_len(&offload->skb_queue) < -+ offload->skb_queue_len_max)) { - skb = alloc_can_skb(offload->dev, &cf); -+ if (unlikely(!skb)) -+ skb_error = ERR_PTR(-ENOMEM); /* skb alloc failed */ -+ } else { -+ skb_error = ERR_PTR(-ENOBUFS); /* skb_queue is full */ -+ } - -- if (!skb) { -+ /* If queue is full or skb not available, drop by reading into -+ * overflow buffer. -+ */ -+ if (unlikely(skb_error)) { - struct can_frame cf_overflow; - u32 timestamp; - - ret = offload->mailbox_read(offload, &cf_overflow, - ×tamp, n); -- if (ret) -- offload->dev->stats.rx_dropped++; - -- return NULL; -+ /* Mailbox was empty. */ -+ if (unlikely(!ret)) -+ return NULL; -+ -+ /* Mailbox has been read and we're dropping it or -+ * there was a problem reading the mailbox. -+ * -+ * Increment error counters in any case. -+ */ -+ offload->dev->stats.rx_dropped++; -+ offload->dev->stats.rx_fifo_errors++; -+ -+ /* There was a problem reading the mailbox, propagate -+ * error value. -+ */ -+ if (unlikely(ret < 0)) -+ return ERR_PTR(ret); -+ -+ return skb_error; - } - - cb = can_rx_offload_get_cb(skb); - ret = offload->mailbox_read(offload, cf, &cb->timestamp, n); -- if (!ret) { -+ -+ /* Mailbox was empty. */ -+ if (unlikely(!ret)) { - kfree_skb(skb); - return NULL; - } - -+ /* There was a problem reading the mailbox, propagate error value. */ -+ if (unlikely(ret < 0)) { -+ kfree_skb(skb); -+ -+ offload->dev->stats.rx_dropped++; -+ offload->dev->stats.rx_fifo_errors++; -+ -+ return ERR_PTR(ret); -+ } -+ -+ /* Mailbox was read. */ - return skb; - } - -@@ -166,8 +224,8 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen - continue; - - skb = can_rx_offload_offload_one(offload, i); -- if (!skb) -- break; -+ if (IS_ERR_OR_NULL(skb)) -+ continue; - - __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare); - } -@@ -197,7 +255,13 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload) - struct sk_buff *skb; - int received = 0; - -- while ((skb = can_rx_offload_offload_one(offload, 0))) { -+ while (1) { -+ skb = can_rx_offload_offload_one(offload, 0); -+ if (IS_ERR(skb)) -+ continue; -+ if (!skb) -+ break; -+ - skb_queue_tail(&offload->skb_queue, skb); - received++; - } -@@ -261,8 +325,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload, - struct sk_buff *skb) - { - if (skb_queue_len(&offload->skb_queue) > -- offload->skb_queue_len_max) -- return -ENOMEM; -+ offload->skb_queue_len_max) { -+ kfree_skb(skb); -+ return -ENOBUFS; -+ } - - skb_queue_tail(&offload->skb_queue, skb); - can_rx_offload_schedule(offload); -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c -index e626c2afbbb1..0e1fc6c4360e 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c -@@ -441,8 +441,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, - } - if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) { - /* no error (back to active state) */ -- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE; -- return 0; -+ new_state = CAN_STATE_ERROR_ACTIVE; -+ break; - } - break; - -@@ -465,9 +465,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, - } - - if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) { -- /* no error (back to active state) */ -- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE; -- return 0; -+ /* no error (back to warning state) */ -+ new_state = CAN_STATE_ERROR_WARNING; -+ break; - } - break; - -@@ -506,6 +506,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, - mc->pdev->dev.can.can_stats.error_warning++; - break; - -+ case CAN_STATE_ERROR_ACTIVE: -+ cf->can_id |= CAN_ERR_CRTL; -+ cf->data[1] = CAN_ERR_CRTL_ACTIVE; -+ break; -+ - default: - /* CAN_STATE_MAX (trick to handle other errors) */ - cf->can_id |= CAN_ERR_CRTL; -diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c -index af666951a959..94ad2fdd6ef0 100644 ---- a/drivers/net/dsa/bcm_sf2.c -+++ b/drivers/net/dsa/bcm_sf2.c -@@ -432,11 +432,10 @@ static int bcm_sf2_sw_mdio_write(struct mii_bus *bus, int addr, int regnum, - * send them to our master MDIO bus controller - */ - if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr)) -- bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val); -+ return bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val); - else -- mdiobus_write_nested(priv->master_mii_bus, addr, regnum, val); -- -- return 0; -+ return mdiobus_write_nested(priv->master_mii_bus, addr, -+ regnum, val); - } - - static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id) -diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c -index 4f7e195af0bc..0d08039981b5 100644 ---- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c -+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c -@@ -472,7 +472,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id, - { - struct atl1e_adapter *adapter = netdev_priv(netdev); - -- atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val); -+ if (atl1e_write_phy_reg(&adapter->hw, -+ reg_num & MDIO_REG_ADDR_MASK, val)) -+ netdev_err(netdev, "write phy register failed\n"); - } - - static int atl1e_mii_ioctl(struct net_device *netdev, -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -index a22336fef66b..fc8e185718a1 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -@@ -1339,14 +1339,22 @@ static int bnxt_flash_nvram(struct net_device *dev, - rc = hwrm_send_message(bp, &req, sizeof(req), FLASH_NVRAM_TIMEOUT); - dma_free_coherent(&bp->pdev->dev, data_len, kmem, dma_handle); - -+ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) { -+ netdev_info(dev, -+ "PF does not have admin privileges to flash the device\n"); -+ rc = -EACCES; -+ } else if (rc) { -+ rc = -EIO; -+ } - return rc; - } - - static int bnxt_firmware_reset(struct net_device *dev, - u16 dir_type) - { -- struct bnxt *bp = netdev_priv(dev); - struct hwrm_fw_reset_input req = {0}; -+ struct bnxt *bp = netdev_priv(dev); -+ int rc; - - bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FW_RESET, -1, -1); - -@@ -1380,7 +1388,15 @@ static int bnxt_firmware_reset(struct net_device *dev, - return -EINVAL; - } - -- return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); -+ rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); -+ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) { -+ netdev_info(dev, -+ "PF does not have admin privileges to reset the device\n"); -+ rc = -EACCES; -+ } else if (rc) { -+ rc = -EIO; -+ } -+ return rc; - } - - static int bnxt_flash_firmware(struct net_device *dev, -@@ -1587,9 +1603,9 @@ static int bnxt_flash_package_from_file(struct net_device *dev, - struct hwrm_nvm_install_update_output *resp = bp->hwrm_cmd_resp_addr; - struct hwrm_nvm_install_update_input install = {0}; - const struct firmware *fw; -+ int rc, hwrm_err = 0; - u32 item_len; - u16 index; -- int rc; - - bnxt_hwrm_fw_set_time(bp); - -@@ -1632,15 +1648,16 @@ static int bnxt_flash_package_from_file(struct net_device *dev, - memcpy(kmem, fw->data, fw->size); - modify.host_src_addr = cpu_to_le64(dma_handle); - -- rc = hwrm_send_message(bp, &modify, sizeof(modify), -- FLASH_PACKAGE_TIMEOUT); -+ hwrm_err = hwrm_send_message(bp, &modify, -+ sizeof(modify), -+ FLASH_PACKAGE_TIMEOUT); - dma_free_coherent(&bp->pdev->dev, fw->size, kmem, - dma_handle); - } - } - release_firmware(fw); -- if (rc) -- return rc; -+ if (rc || hwrm_err) -+ goto err_exit; - - if ((install_type & 0xffff) == 0) - install_type >>= 16; -@@ -1648,12 +1665,10 @@ static int bnxt_flash_package_from_file(struct net_device *dev, - install.install_type = cpu_to_le32(install_type); - - mutex_lock(&bp->hwrm_cmd_lock); -- rc = _hwrm_send_message(bp, &install, sizeof(install), -- INSTALL_PACKAGE_TIMEOUT); -- if (rc) { -- rc = -EOPNOTSUPP; -+ hwrm_err = _hwrm_send_message(bp, &install, sizeof(install), -+ INSTALL_PACKAGE_TIMEOUT); -+ if (hwrm_err) - goto flash_pkg_exit; -- } - - if (resp->error_code) { - u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err; -@@ -1661,12 +1676,11 @@ static int bnxt_flash_package_from_file(struct net_device *dev, - if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) { - install.flags |= cpu_to_le16( - NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG); -- rc = _hwrm_send_message(bp, &install, sizeof(install), -- INSTALL_PACKAGE_TIMEOUT); -- if (rc) { -- rc = -EOPNOTSUPP; -+ hwrm_err = _hwrm_send_message(bp, &install, -+ sizeof(install), -+ INSTALL_PACKAGE_TIMEOUT); -+ if (hwrm_err) - goto flash_pkg_exit; -- } - } - } - -@@ -1677,6 +1691,14 @@ static int bnxt_flash_package_from_file(struct net_device *dev, - } - flash_pkg_exit: - mutex_unlock(&bp->hwrm_cmd_lock); -+err_exit: -+ if (hwrm_err == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) { -+ netdev_info(dev, -+ "PF does not have admin privileges to flash the device\n"); -+ rc = -EACCES; -+ } else if (hwrm_err) { -+ rc = -EOPNOTSUPP; -+ } - return rc; - } - -@@ -2236,17 +2258,37 @@ static int bnxt_hwrm_mac_loopback(struct bnxt *bp, bool enable) - return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); - } - -+static int bnxt_query_force_speeds(struct bnxt *bp, u16 *force_speeds) -+{ -+ struct hwrm_port_phy_qcaps_output *resp = bp->hwrm_cmd_resp_addr; -+ struct hwrm_port_phy_qcaps_input req = {0}; -+ int rc; -+ -+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_PORT_PHY_QCAPS, -1, -1); -+ mutex_lock(&bp->hwrm_cmd_lock); -+ rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); -+ if (!rc) -+ *force_speeds = le16_to_cpu(resp->supported_speeds_force_mode); -+ -+ mutex_unlock(&bp->hwrm_cmd_lock); -+ return rc; -+} -+ - static int bnxt_disable_an_for_lpbk(struct bnxt *bp, - struct hwrm_port_phy_cfg_input *req) - { - struct bnxt_link_info *link_info = &bp->link_info; -- u16 fw_advertising = link_info->advertising; -+ u16 fw_advertising; - u16 fw_speed; - int rc; - - if (!link_info->autoneg) - return 0; - -+ rc = bnxt_query_force_speeds(bp, &fw_advertising); -+ if (rc) -+ return rc; -+ - fw_speed = PORT_PHY_CFG_REQ_FORCE_LINK_SPEED_1GB; - if (netif_carrier_ok(bp->dev)) - fw_speed = bp->link_info.link_speed; -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index b6af286fa5c7..3e3044fe3206 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -2611,8 +2611,10 @@ static void bcmgenet_irq_task(struct work_struct *work) - } - - if (status & UMAC_IRQ_PHY_DET_R && -- priv->dev->phydev->autoneg != AUTONEG_ENABLE) -+ priv->dev->phydev->autoneg != AUTONEG_ENABLE) { - phy_init_hw(priv->dev->phydev); -+ genphy_config_aneg(priv->dev->phydev); -+ } - - /* Link UP/DOWN event */ - if (status & UMAC_IRQ_LINK_EVENT) -@@ -3688,6 +3690,7 @@ static int bcmgenet_resume(struct device *d) - - phy_init_hw(priv->phydev); - /* Speed settings must be restored */ -+ genphy_config_aneg(dev->phydev); - bcmgenet_mii_config(priv->dev, false); - - /* disable ethernet MAC while updating its registers */ -diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h -index c93f3a2dc6c1..4c0bcfd1d250 100644 ---- a/drivers/net/ethernet/cadence/macb.h -+++ b/drivers/net/ethernet/cadence/macb.h -@@ -457,7 +457,11 @@ - - /* Bitfields in TISUBN */ - #define GEM_SUBNSINCR_OFFSET 0 --#define GEM_SUBNSINCR_SIZE 16 -+#define GEM_SUBNSINCRL_OFFSET 24 -+#define GEM_SUBNSINCRL_SIZE 8 -+#define GEM_SUBNSINCRH_OFFSET 0 -+#define GEM_SUBNSINCRH_SIZE 16 -+#define GEM_SUBNSINCR_SIZE 24 - - /* Bitfields in TI */ - #define GEM_NSINCR_OFFSET 0 -diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c -index 2287749de087..5aff1b460151 100644 ---- a/drivers/net/ethernet/cadence/macb_main.c -+++ b/drivers/net/ethernet/cadence/macb_main.c -@@ -852,7 +852,9 @@ static void macb_tx_interrupt(struct macb_queue *queue) - - /* First, update TX stats if needed */ - if (skb) { -- if (gem_ptp_do_txstamp(queue, skb, desc) == 0) { -+ if (unlikely(skb_shinfo(skb)->tx_flags & -+ SKBTX_HW_TSTAMP) && -+ gem_ptp_do_txstamp(queue, skb, desc) == 0) { - /* skb now belongs to timestamp buffer - * and will be removed later - */ -@@ -2822,7 +2824,7 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk, - if (!err) - err = -ENODEV; - -- dev_err(&pdev->dev, "failed to get macb_clk (%u)\n", err); -+ dev_err(&pdev->dev, "failed to get macb_clk (%d)\n", err); - return err; - } - -@@ -2831,7 +2833,7 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk, - if (!err) - err = -ENODEV; - -- dev_err(&pdev->dev, "failed to get hclk (%u)\n", err); -+ dev_err(&pdev->dev, "failed to get hclk (%d)\n", err); - return err; - } - -@@ -2845,25 +2847,25 @@ static int macb_clk_init(struct platform_device *pdev, struct clk **pclk, - - err = clk_prepare_enable(*pclk); - if (err) { -- dev_err(&pdev->dev, "failed to enable pclk (%u)\n", err); -+ dev_err(&pdev->dev, "failed to enable pclk (%d)\n", err); - return err; - } - - err = clk_prepare_enable(*hclk); - if (err) { -- dev_err(&pdev->dev, "failed to enable hclk (%u)\n", err); -+ dev_err(&pdev->dev, "failed to enable hclk (%d)\n", err); - goto err_disable_pclk; - } - - err = clk_prepare_enable(*tx_clk); - if (err) { -- dev_err(&pdev->dev, "failed to enable tx_clk (%u)\n", err); -+ dev_err(&pdev->dev, "failed to enable tx_clk (%d)\n", err); - goto err_disable_hclk; - } - - err = clk_prepare_enable(*rx_clk); - if (err) { -- dev_err(&pdev->dev, "failed to enable rx_clk (%u)\n", err); -+ dev_err(&pdev->dev, "failed to enable rx_clk (%d)\n", err); - goto err_disable_txclk; - } - -@@ -3298,7 +3300,7 @@ static int at91ether_clk_init(struct platform_device *pdev, struct clk **pclk, - - err = clk_prepare_enable(*pclk); - if (err) { -- dev_err(&pdev->dev, "failed to enable pclk (%u)\n", err); -+ dev_err(&pdev->dev, "failed to enable pclk (%d)\n", err); - return err; - } - -diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c -index 678835136bf8..f1f07e9d53f8 100755 ---- a/drivers/net/ethernet/cadence/macb_ptp.c -+++ b/drivers/net/ethernet/cadence/macb_ptp.c -@@ -115,7 +115,10 @@ static int gem_tsu_incr_set(struct macb *bp, struct tsu_incr *incr_spec) - * to take effect. - */ - spin_lock_irqsave(&bp->tsu_clk_lock, flags); -- gem_writel(bp, TISUBN, GEM_BF(SUBNSINCR, incr_spec->sub_ns)); -+ /* RegBit[15:0] = Subns[23:8]; RegBit[31:24] = Subns[7:0] */ -+ gem_writel(bp, TISUBN, GEM_BF(SUBNSINCRL, incr_spec->sub_ns) | -+ GEM_BF(SUBNSINCRH, (incr_spec->sub_ns >> -+ GEM_SUBNSINCRL_SIZE))); - gem_writel(bp, TI, GEM_BF(NSINCR, incr_spec->ns)); - spin_unlock_irqrestore(&bp->tsu_clk_lock, flags); - -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 0ae6532b02e0..62bc19bedb06 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -3565,6 +3565,11 @@ fec_drv_remove(struct platform_device *pdev) - struct net_device *ndev = platform_get_drvdata(pdev); - struct fec_enet_private *fep = netdev_priv(ndev); - struct device_node *np = pdev->dev.of_node; -+ int ret; -+ -+ ret = pm_runtime_get_sync(&pdev->dev); -+ if (ret < 0) -+ return ret; - - cancel_work_sync(&fep->tx_timeout_work); - fec_ptp_stop(pdev); -@@ -3572,13 +3577,17 @@ fec_drv_remove(struct platform_device *pdev) - fec_enet_mii_remove(fep); - if (fep->reg_phy) - regulator_disable(fep->reg_phy); -- pm_runtime_put(&pdev->dev); -- pm_runtime_disable(&pdev->dev); -+ - if (of_phy_is_fixed_link(np)) - of_phy_deregister_fixed_link(np); - of_node_put(fep->phy_node); - free_netdev(ndev); - -+ clk_disable_unprepare(fep->clk_ahb); -+ clk_disable_unprepare(fep->clk_ipg); -+ pm_runtime_put_noidle(&pdev->dev); -+ pm_runtime_disable(&pdev->dev); -+ - return 0; - } - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c -index 8b511e6e0ce9..396ea0db7102 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c -@@ -251,6 +251,8 @@ int hclge_cmd_send(struct hclge_hw *hw, struct hclge_desc *desc, int num) - if ((enum hclge_cmd_return_status)desc_ret == - HCLGE_CMD_EXEC_SUCCESS) - retval = 0; -+ else if (desc_ret == HCLGE_CMD_NOT_SUPPORTED) -+ retval = -EOPNOTSUPP; - else - retval = -EIO; - hw->cmq.last_status = (enum hclge_cmd_status)desc_ret; -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h -index 758cf3948131..3823ae6303ad 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h -@@ -52,7 +52,7 @@ struct hclge_cmq_ring { - enum hclge_cmd_return_status { - HCLGE_CMD_EXEC_SUCCESS = 0, - HCLGE_CMD_NO_AUTH = 1, -- HCLGE_CMD_NOT_EXEC = 2, -+ HCLGE_CMD_NOT_SUPPORTED = 2, - HCLGE_CMD_QUEUE_FULL = 3, - }; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 97874c2568fc..1ac0e173da12 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -838,11 +838,9 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv) - - priv->numa_node = dev_to_node(&dev->pdev->dev); - -- priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root); -- if (!priv->dbg_root) { -- dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n"); -- return -ENOMEM; -- } -+ if (mlx5_debugfs_root) -+ priv->dbg_root = -+ debugfs_create_dir(pci_name(pdev), mlx5_debugfs_root); - - err = mlx5_pci_enable_device(dev); - if (err) { -diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c -index 09352ee43b55..2d92a9fe4606 100644 ---- a/drivers/net/ethernet/sfc/ef10.c -+++ b/drivers/net/ethernet/sfc/ef10.c -@@ -5852,22 +5852,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = { - { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" }, - { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" }, - }; -+#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types) - - static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, - struct efx_mcdi_mtd_partition *part, -- unsigned int type) -+ unsigned int type, -+ unsigned long *found) - { - MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN); - MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX); - const struct efx_ef10_nvram_type_info *info; - size_t size, erase_size, outlen; -+ int type_idx = 0; - bool protected; - int rc; - -- for (info = efx_ef10_nvram_types; ; info++) { -- if (info == -- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types)) -+ for (type_idx = 0; ; type_idx++) { -+ if (type_idx == EF10_NVRAM_PARTITION_COUNT) - return -ENODEV; -+ info = efx_ef10_nvram_types + type_idx; - if ((type & ~info->type_mask) == info->type) - break; - } -@@ -5880,6 +5883,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, - if (protected) - return -ENODEV; /* hide it */ - -+ /* If we've already exposed a partition of this type, hide this -+ * duplicate. All operations on MTDs are keyed by the type anyway, -+ * so we can't act on the duplicate. -+ */ -+ if (__test_and_set_bit(type_idx, found)) -+ return -EEXIST; -+ - part->nvram_type = type; - - MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type); -@@ -5908,6 +5918,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, - static int efx_ef10_mtd_probe(struct efx_nic *efx) - { - MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX); -+ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 }; - struct efx_mcdi_mtd_partition *parts; - size_t outlen, n_parts_total, i, n_parts; - unsigned int type; -@@ -5936,11 +5947,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx) - for (i = 0; i < n_parts_total; i++) { - type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID, - i); -- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type); -- if (rc == 0) -- n_parts++; -- else if (rc != -ENODEV) -+ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type, -+ found); -+ if (rc == -EEXIST || rc == -ENODEV) -+ continue; -+ if (rc) - goto fail; -+ n_parts++; - } - - rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts)); -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c -index d07520fb969e..62ccbd47c1db 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c -@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) - gmac->clk_enabled = 1; - } else { - clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE); -- clk_prepare(gmac->tx_clk); -+ ret = clk_prepare(gmac->tx_clk); -+ if (ret) -+ return ret; - } - - return 0; -diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c -index e7b76f6b4f67..7d1281d81248 100644 ---- a/drivers/net/ethernet/ti/cpts.c -+++ b/drivers/net/ethernet/ti/cpts.c -@@ -567,7 +567,9 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs, - return ERR_PTR(PTR_ERR(cpts->refclk)); - } - -- clk_prepare(cpts->refclk); -+ ret = clk_prepare(cpts->refclk); -+ if (ret) -+ return ERR_PTR(ret); - - cpts->cc.read = cpts_systim_read; - cpts->cc.mask = CLOCKSOURCE_MASK(32); -diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c -index 963a02c988e9..8d5f88a538fc 100644 ---- a/drivers/net/macvlan.c -+++ b/drivers/net/macvlan.c -@@ -363,10 +363,11 @@ static void macvlan_broadcast_enqueue(struct macvlan_port *port, - } - spin_unlock(&port->bc_queue.lock); - -+ schedule_work(&port->bc_work); -+ - if (err) - goto free_nskb; - -- schedule_work(&port->bc_work); - return; - - free_nskb: -diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c -index 2901b7db9d2e..d6dc00b4ba55 100644 ---- a/drivers/net/slip/slip.c -+++ b/drivers/net/slip/slip.c -@@ -859,6 +859,7 @@ err_free_chan: - sl->tty = NULL; - tty->disc_data = NULL; - clear_bit(SLF_INUSE, &sl->flags); -+ sl_free_netdev(sl->dev); - free_netdev(sl->dev); - - err_exit: -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 6d26bbd190dd..153a81ece9fe 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -3217,6 +3217,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, - struct vxlan_net *vn = net_generic(net, vxlan_net_id); - struct vxlan_dev *vxlan = netdev_priv(dev); - struct vxlan_fdb *f = NULL; -+ bool unregister = false; - int err; - - err = vxlan_dev_configure(net, dev, conf, false, extack); -@@ -3242,12 +3243,11 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, - err = register_netdevice(dev); - if (err) - goto errout; -+ unregister = true; - - err = rtnl_configure_link(dev, NULL); -- if (err) { -- unregister_netdevice(dev); -+ if (err) - goto errout; -- } - - /* notify default fdb entry */ - if (f) -@@ -3255,9 +3255,16 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, - - list_add(&vxlan->next, &vn->vxlan_list); - return 0; -+ - errout: -+ /* unregister_netdevice() destroys the default FDB entry with deletion -+ * notification. But the addition notification was not sent yet, so -+ * destroy the entry by hand here. -+ */ - if (f) - vxlan_fdb_destroy(vxlan, f, false); -+ if (unregister) -+ unregister_netdevice(dev); - return err; - } - -diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c -index 18b648648adb..289dff262948 100644 ---- a/drivers/net/wan/fsl_ucc_hdlc.c -+++ b/drivers/net/wan/fsl_ucc_hdlc.c -@@ -1114,7 +1114,6 @@ static int ucc_hdlc_probe(struct platform_device *pdev) - if (register_hdlc_device(dev)) { - ret = -ENOBUFS; - pr_err("ucc_hdlc: unable to register hdlc device\n"); -- free_netdev(dev); - goto free_dev; - } - -diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c -index 414b5b596efc..37deb9bae364 100644 ---- a/drivers/net/wireless/ath/ath6kl/cfg80211.c -+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c -@@ -939,7 +939,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar, - else - ssid_list[i].flag = ANY_SSID_FLAG; - -- if (n_match_ssid == 0) -+ if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0) - ssid_list[i].flag |= MATCH_SSID_FLAG; - } - -@@ -1093,7 +1093,7 @@ void ath6kl_cfg80211_scan_complete_event(struct ath6kl_vif *vif, bool aborted) - if (vif->scan_req->n_ssids && vif->scan_req->ssids[0].ssid_len) { - for (i = 0; i < vif->scan_req->n_ssids; i++) { - ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx, -- i + 1, DISABLE_SSID_FLAG, -+ i, DISABLE_SSID_FLAG, - 0, NULL); - } - } -diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c -index 2acd94da9efe..051a2fea9572 100644 ---- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c -+++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c -@@ -1229,6 +1229,23 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv) - return 0; - } - -+static int iwl_nvm_check_version(struct iwl_nvm_data *data, -+ struct iwl_trans *trans) -+{ -+ if (data->nvm_version >= trans->cfg->nvm_ver || -+ data->calib_version >= trans->cfg->nvm_calib_ver) { -+ IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n", -+ data->nvm_version, data->calib_version); -+ return 0; -+ } -+ -+ IWL_ERR(trans, -+ "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n", -+ data->nvm_version, trans->cfg->nvm_ver, -+ data->calib_version, trans->cfg->nvm_calib_ver); -+ return -EINVAL; -+} -+ - static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, - const struct iwl_cfg *cfg, - const struct iwl_fw *fw, -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c -index 3199d345b427..92727f7e42db 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c -@@ -928,22 +928,3 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg, - return NULL; - } - IWL_EXPORT_SYMBOL(iwl_parse_eeprom_data); -- --/* helper functions */ --int iwl_nvm_check_version(struct iwl_nvm_data *data, -- struct iwl_trans *trans) --{ -- if (data->nvm_version >= trans->cfg->nvm_ver || -- data->calib_version >= trans->cfg->nvm_calib_ver) { -- IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n", -- data->nvm_version, data->calib_version); -- return 0; -- } -- -- IWL_ERR(trans, -- "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n", -- data->nvm_version, trans->cfg->nvm_ver, -- data->calib_version, trans->cfg->nvm_calib_ver); -- return -EINVAL; --} --IWL_EXPORT_SYMBOL(iwl_nvm_check_version); -diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h -index b33888991b94..5545210151cd 100644 ---- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h -+++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h -@@ -7,6 +7,7 @@ - * - * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved. - * Copyright(c) 2015 Intel Mobile Communications GmbH -+ * Copyright (C) 2018 Intel Corporation - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of version 2 of the GNU General Public License as -@@ -33,6 +34,7 @@ - * - * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. - * Copyright(c) 2015 Intel Mobile Communications GmbH -+ * Copyright (C) 2018 Intel Corporation - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without -@@ -121,9 +123,6 @@ struct iwl_nvm_data * - iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg, - const u8 *eeprom, size_t eeprom_size); - --int iwl_nvm_check_version(struct iwl_nvm_data *data, -- struct iwl_trans *trans); -- - int iwl_init_sband_channels(struct iwl_nvm_data *data, - struct ieee80211_supported_band *sband, - int n_channels, enum nl80211_band band); -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -index 534c0ea7b232..78228f870f8f 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c -@@ -501,7 +501,9 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm) - if (mvm->nvm_file_name) - iwl_mvm_load_nvm_to_nic(mvm); - -- WARN_ON(iwl_nvm_check_version(mvm->nvm_data, mvm->trans)); -+ WARN_ONCE(mvm->nvm_data->nvm_version < mvm->trans->cfg->nvm_ver, -+ "Too old NVM version (0x%0x, required = 0x%0x)", -+ mvm->nvm_data->nvm_version, mvm->trans->cfg->nvm_ver); - - /* - * abort after reading the nvm in case RF Kill is on, we will complete -diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c -index 6f4239be609d..49ca84ef1a99 100644 ---- a/drivers/net/wireless/marvell/mwifiex/debugfs.c -+++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c -@@ -296,15 +296,13 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, - "total samples = %d\n", - atomic_read(&phist_data->num_samples)); - -- p += sprintf(p, "rx rates (in Mbps): 0=1M 1=2M"); -- p += sprintf(p, "2=5.5M 3=11M 4=6M 5=9M 6=12M\n"); -- p += sprintf(p, "7=18M 8=24M 9=36M 10=48M 11=54M"); -- p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n"); -+ p += sprintf(p, -+ "rx rates (in Mbps): 0=1M 1=2M 2=5.5M 3=11M 4=6M 5=9M 6=12M\n" -+ "7=18M 8=24M 9=36M 10=48M 11=54M 12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n"); - - if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) { -- p += sprintf(p, "44-53=MCS0-9(VHT:BW20)"); -- p += sprintf(p, "54-63=MCS0-9(VHT:BW40)"); -- p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n"); -+ p += sprintf(p, -+ "44-53=MCS0-9(VHT:BW20) 54-63=MCS0-9(VHT:BW40) 64-73=MCS0-9(VHT:BW80)\n\n"); - } else { - p += sprintf(p, "\n"); - } -@@ -333,7 +331,7 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf, - for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) { - value = atomic_read(&phist_data->noise_flr[i]); - if (value) -- p += sprintf(p, "noise_flr[-%02ddBm] = %d\n", -+ p += sprintf(p, "noise_flr[%02ddBm] = %d\n", - (int)(i-128), value); - } - for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) { -diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c -index 67c334221077..c013c94fbf15 100644 ---- a/drivers/net/wireless/marvell/mwifiex/scan.c -+++ b/drivers/net/wireless/marvell/mwifiex/scan.c -@@ -1901,15 +1901,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info, - ETH_ALEN)) - mwifiex_update_curr_bss_params(priv, - bss); -- cfg80211_put_bss(priv->wdev.wiphy, bss); -- } - -- if ((chan->flags & IEEE80211_CHAN_RADAR) || -- (chan->flags & IEEE80211_CHAN_NO_IR)) { -- mwifiex_dbg(adapter, INFO, -- "radar or passive channel %d\n", -- channel); -- mwifiex_save_hidden_ssid_channels(priv, bss); -+ if ((chan->flags & IEEE80211_CHAN_RADAR) || -+ (chan->flags & IEEE80211_CHAN_NO_IR)) { -+ mwifiex_dbg(adapter, INFO, -+ "radar or passive channel %d\n", -+ channel); -+ mwifiex_save_hidden_ssid_channels(priv, -+ bss); -+ } -+ -+ cfg80211_put_bss(priv->wdev.wiphy, bss); - } - } - } else { -diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c -index 9a1d15b3ce45..518caaaf8a98 100644 ---- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c -+++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c -@@ -444,12 +444,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev) - skb_queue_tail(&priv->rx_queue, skb); - usb_anchor_urb(entry, &priv->anchored); - ret = usb_submit_urb(entry, GFP_KERNEL); -- usb_put_urb(entry); - if (ret) { - skb_unlink(skb, &priv->rx_queue); - usb_unanchor_urb(entry); -+ usb_put_urb(entry); - goto err; - } -+ usb_put_urb(entry); - } - return ret; - -diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c -index 536e9a5cd2b1..d66ef88e13cf 100644 ---- a/drivers/pci/msi.c -+++ b/drivers/pci/msi.c -@@ -1156,7 +1156,8 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs, - const struct irq_affinity *affd) - { - static const struct irq_affinity msi_default_affd; -- int vecs = -ENOSPC; -+ int msix_vecs = -ENOSPC; -+ int msi_vecs = -ENOSPC; - - if (flags & PCI_IRQ_AFFINITY) { - if (!affd) -@@ -1167,16 +1168,17 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs, - } - - if (flags & PCI_IRQ_MSIX) { -- vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs, -- affd); -- if (vecs > 0) -- return vecs; -+ msix_vecs = __pci_enable_msix_range(dev, NULL, min_vecs, -+ max_vecs, affd); -+ if (msix_vecs > 0) -+ return msix_vecs; - } - - if (flags & PCI_IRQ_MSI) { -- vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, affd); -- if (vecs > 0) -- return vecs; -+ msi_vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, -+ affd); -+ if (msi_vecs > 0) -+ return msi_vecs; - } - - /* use legacy irq if allowed */ -@@ -1187,7 +1189,9 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs, - } - } - -- return vecs; -+ if (msix_vecs == -ENOSPC) -+ return -ENOSPC; -+ return msi_vecs; - } - EXPORT_SYMBOL(pci_alloc_irq_vectors_affinity); - -diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c -index f9e98a7d4f0c..1b0c5958c56a 100644 ---- a/drivers/pinctrl/pinctrl-xway.c -+++ b/drivers/pinctrl/pinctrl-xway.c -@@ -1748,14 +1748,6 @@ static int pinmux_xway_probe(struct platform_device *pdev) - } - xway_pctrl_desc.pins = xway_info.pads; - -- /* register the gpio chip */ -- xway_chip.parent = &pdev->dev; -- ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL); -- if (ret) { -- dev_err(&pdev->dev, "Failed to register gpio chip\n"); -- return ret; -- } -- - /* setup the data needed by pinctrl */ - xway_pctrl_desc.name = dev_name(&pdev->dev); - xway_pctrl_desc.npins = xway_chip.ngpio; -@@ -1777,10 +1769,33 @@ static int pinmux_xway_probe(struct platform_device *pdev) - return ret; - } - -- /* finish with registering the gpio range in pinctrl */ -- xway_gpio_range.npins = xway_chip.ngpio; -- xway_gpio_range.base = xway_chip.base; -- pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range); -+ /* register the gpio chip */ -+ xway_chip.parent = &pdev->dev; -+ xway_chip.owner = THIS_MODULE; -+ xway_chip.of_node = pdev->dev.of_node; -+ ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL); -+ if (ret) { -+ dev_err(&pdev->dev, "Failed to register gpio chip\n"); -+ return ret; -+ } -+ -+ /* -+ * For DeviceTree-supported systems, the gpio core checks the -+ * pinctrl's device node for the "gpio-ranges" property. -+ * If it is present, it takes care of adding the pin ranges -+ * for the driver. In this case the driver can skip ahead. -+ * -+ * In order to remain compatible with older, existing DeviceTree -+ * files which don't set the "gpio-ranges" property or systems that -+ * utilize ACPI the driver has to call gpiochip_add_pin_range(). -+ */ -+ if (!of_property_read_bool(pdev->dev.of_node, "gpio-ranges")) { -+ /* finish with registering the gpio range in pinctrl */ -+ xway_gpio_range.npins = xway_chip.ngpio; -+ xway_gpio_range.base = xway_chip.base; -+ pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range); -+ } -+ - dev_info(&pdev->dev, "Init done\n"); - return 0; - } -diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c -index 8070765311db..e1c34e19222e 100644 ---- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c -+++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c -@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { - }, - - { PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) { -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, -+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, - PF12MD_000, PF12MD_001, 0, PF12MD_011, - PF12MD_100, PF12MD_101, 0, 0, - 0, 0, 0, 0, 0, 0, 0, 0 } -@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { - 0, 0, 0, 0, 0, 0, 0, 0, - PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011, - PF1MD_100, PF1MD_101, 0, 0, -- 0, 0, 0, 0, 0, 0, 0, 0 -- } -+ 0, 0, 0, 0, 0, 0, 0, 0, -+ PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011, -+ PF0MD_100, PF0MD_101, 0, 0, -+ 0, 0, 0, 0, 0, 0, 0, 0 } - }, - - { PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) { -diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c -index 6502e676d368..33232041ee86 100644 ---- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c -+++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c -@@ -2213,22 +2213,22 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { - /* IP10_22 [1] */ - FN_CAN_CLK_A, FN_RX4_D, - /* IP10_21_19 [3] */ -- FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B, -- FN_LCD_M_DISP_B, 0, 0, 0, -+ FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B, -+ FN_LCD_M_DISP_B, 0, 0, - /* IP10_18_16 [3] */ -- FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B, -- FN_LCD_VEPWC_B, 0, 0, 0, -+ FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B, -+ FN_LCD_VEPWC_B, 0, 0, - /* IP10_15 [1] */ - FN_AUDIO_CLKB_A, FN_LCD_CLK_B, - /* IP10_14_12 [3] */ - FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B, - FN_LCD_FLM_B, 0, 0, 0, - /* IP10_11_9 [3] */ -- FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B, -- FN_LCD_CL2_B, 0, 0, 0, -+ FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B, -+ FN_LCD_CL2_B, 0, 0, - /* IP10_8_6 [3] */ -- FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B, -- FN_LCD_CL1_B, 0, 0, 0, -+ FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B, -+ FN_LCD_CL1_B, 0, 0, - /* IP10_5_3 [3] */ - FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B, - FN_LCD_DON_B, 0, 0, 0, -diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c -index 50299ad96659..072bd11074c6 100644 ---- a/drivers/pinctrl/stm32/pinctrl-stm32.c -+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c -@@ -403,7 +403,7 @@ static int stm32_pctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, - unsigned int num_configs; - bool has_config = 0; - unsigned reserve = 0; -- int num_pins, num_funcs, maps_per_pin, i, err; -+ int num_pins, num_funcs, maps_per_pin, i, err = 0; - - pctl = pinctrl_dev_get_drvdata(pctldev); - -@@ -430,41 +430,45 @@ static int stm32_pctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, - if (has_config && num_pins >= 1) - maps_per_pin++; - -- if (!num_pins || !maps_per_pin) -- return -EINVAL; -+ if (!num_pins || !maps_per_pin) { -+ err = -EINVAL; -+ goto exit; -+ } - - reserve = num_pins * maps_per_pin; - - err = pinctrl_utils_reserve_map(pctldev, map, - reserved_maps, num_maps, reserve); - if (err) -- return err; -+ goto exit; - - for (i = 0; i < num_pins; i++) { - err = of_property_read_u32_index(node, "pinmux", - i, &pinfunc); - if (err) -- return err; -+ goto exit; - - pin = STM32_GET_PIN_NO(pinfunc); - func = STM32_GET_PIN_FUNC(pinfunc); - - if (!stm32_pctrl_is_function_valid(pctl, pin, func)) { - dev_err(pctl->dev, "invalid function.\n"); -- return -EINVAL; -+ err = -EINVAL; -+ goto exit; - } - - grp = stm32_pctrl_find_group_by_pin(pctl, pin); - if (!grp) { - dev_err(pctl->dev, "unable to match pin %d to group\n", - pin); -- return -EINVAL; -+ err = -EINVAL; -+ goto exit; - } - - err = stm32_pctrl_dt_node_to_map_func(pctl, pin, func, grp, map, - reserved_maps, num_maps); - if (err) -- return err; -+ goto exit; - - if (has_config) { - err = pinctrl_utils_add_map_configs(pctldev, map, -@@ -472,11 +476,13 @@ static int stm32_pctrl_dt_subnode_to_map(struct pinctrl_dev *pctldev, - configs, num_configs, - PIN_MAP_TYPE_CONFIGS_GROUP); - if (err) -- return err; -+ goto exit; - } - } - -- return 0; -+exit: -+ kfree(configs); -+ return err; - } - - static int stm32_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev, -diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c -index b4224389febe..d0ffdd5d9199 100644 ---- a/drivers/platform/x86/hp-wmi.c -+++ b/drivers/platform/x86/hp-wmi.c -@@ -78,7 +78,7 @@ struct bios_args { - u32 command; - u32 commandtype; - u32 datasize; -- u32 data; -+ u8 data[128]; - }; - - enum hp_wmi_commandtype { -@@ -229,7 +229,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command, - .command = command, - .commandtype = query, - .datasize = insize, -- .data = 0, -+ .data = { 0 }, - }; - struct acpi_buffer input = { sizeof(struct bios_args), &args }; - struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; -@@ -241,7 +241,7 @@ static int hp_wmi_perform_query(int query, enum hp_wmi_command command, - - if (WARN_ON(insize > sizeof(args.data))) - return -EINVAL; -- memcpy(&args.data, buffer, insize); -+ memcpy(&args.data[0], buffer, insize); - - wmi_evaluate_method(HPWMI_BIOS_GUID, 0, mid, &input, &output); - -@@ -393,7 +393,7 @@ static int hp_wmi_rfkill2_refresh(void) - int err, i; - - err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state, -- 0, sizeof(state)); -+ sizeof(state), sizeof(state)); - if (err) - return err; - -@@ -790,7 +790,7 @@ static int __init hp_wmi_rfkill2_setup(struct platform_device *device) - int err, i; - - err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state, -- 0, sizeof(state)); -+ sizeof(state), sizeof(state)); - if (err) - return err < 0 ? err : -EINVAL; - -diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c -index 974fd684bab2..4b6fddc18394 100644 ---- a/drivers/power/avs/smartreflex.c -+++ b/drivers/power/avs/smartreflex.c -@@ -994,8 +994,7 @@ static int omap_sr_remove(struct platform_device *pdev) - - if (sr_info->autocomp_active) - sr_stop_vddautocomp(sr_info); -- if (sr_info->dbg_dir) -- debugfs_remove_recursive(sr_info->dbg_dir); -+ debugfs_remove_recursive(sr_info->dbg_dir); - - pm_runtime_disable(&pdev->dev); - list_del(&sr_info->node); -diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c -index c45e5719ba17..b1b74cfb1571 100644 ---- a/drivers/pwm/core.c -+++ b/drivers/pwm/core.c -@@ -874,6 +874,7 @@ void pwm_put(struct pwm_device *pwm) - if (pwm->chip->ops->free) - pwm->chip->ops->free(pwm->chip, pwm); - -+ pwm_set_chip_data(pwm, NULL); - pwm->label = NULL; - - module_put(pwm->chip->ops->owner); -diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c -index d961a8207b1c..31b01035d0ab 100644 ---- a/drivers/pwm/pwm-bcm-iproc.c -+++ b/drivers/pwm/pwm-bcm-iproc.c -@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm, - static const struct pwm_ops iproc_pwm_ops = { - .apply = iproc_pwmc_apply, - .get_state = iproc_pwmc_get_state, -+ .owner = THIS_MODULE, - }; - - static int iproc_pwmc_probe(struct platform_device *pdev) -diff --git a/drivers/pwm/pwm-berlin.c b/drivers/pwm/pwm-berlin.c -index 771859aca4be..7bb819e3c0c1 100644 ---- a/drivers/pwm/pwm-berlin.c -+++ b/drivers/pwm/pwm-berlin.c -@@ -78,7 +78,6 @@ static void berlin_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) - { - struct berlin_pwm_channel *channel = pwm_get_chip_data(pwm); - -- pwm_set_chip_data(pwm, NULL); - kfree(channel); - } - -diff --git a/drivers/pwm/pwm-clps711x.c b/drivers/pwm/pwm-clps711x.c -index 26ec24e457b1..7e16b7def0dc 100644 ---- a/drivers/pwm/pwm-clps711x.c -+++ b/drivers/pwm/pwm-clps711x.c -@@ -48,7 +48,7 @@ static void clps711x_pwm_update_val(struct clps711x_chip *priv, u32 n, u32 v) - static unsigned int clps711x_get_duty(struct pwm_device *pwm, unsigned int v) - { - /* Duty cycle 0..15 max */ -- return DIV_ROUND_CLOSEST(v * 0xf, pwm_get_period(pwm)); -+ return DIV_ROUND_CLOSEST(v * 0xf, pwm->args.period); - } - - static int clps711x_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm) -@@ -71,7 +71,7 @@ static int clps711x_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, - struct clps711x_chip *priv = to_clps711x_chip(chip); - unsigned int duty; - -- if (period_ns != pwm_get_period(pwm)) -+ if (period_ns != pwm->args.period) - return -EINVAL; - - duty = clps711x_get_duty(pwm, duty_ns); -diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c -index a7eaf962a95b..567f5e2771c4 100644 ---- a/drivers/pwm/pwm-pca9685.c -+++ b/drivers/pwm/pwm-pca9685.c -@@ -176,7 +176,6 @@ static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset) - pm_runtime_put(pca->chip.dev); - mutex_lock(&pca->lock); - pwm = &pca->chip.pwms[offset]; -- pwm_set_chip_data(pwm, NULL); - mutex_unlock(&pca->lock); - } - -diff --git a/drivers/pwm/pwm-samsung.c b/drivers/pwm/pwm-samsung.c -index 062f2cfc45ec..3762432dd6a7 100644 ---- a/drivers/pwm/pwm-samsung.c -+++ b/drivers/pwm/pwm-samsung.c -@@ -238,7 +238,6 @@ static int pwm_samsung_request(struct pwm_chip *chip, struct pwm_device *pwm) - static void pwm_samsung_free(struct pwm_chip *chip, struct pwm_device *pwm) - { - devm_kfree(chip->dev, pwm_get_chip_data(pwm)); -- pwm_set_chip_data(pwm, NULL); - } - - static int pwm_samsung_enable(struct pwm_chip *chip, struct pwm_device *pwm) -diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c -index bb5ab7d78895..c2cc392a27d4 100644 ---- a/drivers/regulator/palmas-regulator.c -+++ b/drivers/regulator/palmas-regulator.c -@@ -443,13 +443,16 @@ static int palmas_ldo_write(struct palmas *palmas, unsigned int reg, - static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode) - { - int id = rdev_get_id(dev); -+ int ret; - struct palmas_pmic *pmic = rdev_get_drvdata(dev); - struct palmas_pmic_driver_data *ddata = pmic->palmas->pmic_ddata; - struct palmas_regs_info *rinfo = &ddata->palmas_regs_info[id]; - unsigned int reg; - bool rail_enable = true; - -- palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®); -+ ret = palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®); -+ if (ret) -+ return ret; - - reg &= ~PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK; - -diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c -index 81672a58fcc2..194fa0cbbc04 100644 ---- a/drivers/regulator/tps65910-regulator.c -+++ b/drivers/regulator/tps65910-regulator.c -@@ -1102,8 +1102,10 @@ static int tps65910_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, pmic); - - /* Give control of all register to control port */ -- tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL, -+ err = tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL, - DEVCTRL_SR_CTL_I2C_SEL_MASK); -+ if (err < 0) -+ return err; - - switch (tps65910_chip_id(tps65910)) { - case TPS65910: -diff --git a/drivers/reset/core.c b/drivers/reset/core.c -index 72b96b5c75a8..7e0a14211c88 100644 ---- a/drivers/reset/core.c -+++ b/drivers/reset/core.c -@@ -513,6 +513,7 @@ static void reset_control_array_put(struct reset_control_array *resets) - for (i = 0; i < resets->num_rstcs; i++) - __reset_control_put_internal(resets->rstc[i]); - mutex_unlock(&reset_list_mutex); -+ kfree(resets); - } - - /** -diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c -index 28a9c7d706cb..03c7b1603dbc 100644 ---- a/drivers/scsi/csiostor/csio_init.c -+++ b/drivers/scsi/csiostor/csio_init.c -@@ -649,7 +649,7 @@ csio_shost_init(struct csio_hw *hw, struct device *dev, - if (csio_lnode_init(ln, hw, pln)) - goto err_shost_put; - -- if (scsi_add_host(shost, dev)) -+ if (scsi_add_host_with_dma(shost, dev, &hw->pdev->dev)) - goto err_lnode_exit; - - return ln; -diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c -index 7f2d00354a85..f77d72f01da9 100644 ---- a/drivers/scsi/libsas/sas_expander.c -+++ b/drivers/scsi/libsas/sas_expander.c -@@ -614,7 +614,14 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id, - } - - res = smp_execute_task(dev, pc_req, PC_REQ_SIZE, pc_resp,PC_RESP_SIZE); -- -+ if (res) { -+ pr_err("ex %016llx phy%02d PHY control failed: %d\n", -+ SAS_ADDR(dev->sas_addr), phy_id, res); -+ } else if (pc_resp[2] != SMP_RESP_FUNC_ACC) { -+ pr_err("ex %016llx phy%02d PHY control failed: function result 0x%x\n", -+ SAS_ADDR(dev->sas_addr), phy_id, pc_resp[2]); -+ res = pc_resp[2]; -+ } - kfree(pc_resp); - kfree(pc_req); - return res; -@@ -817,6 +824,26 @@ static struct domain_device *sas_ex_discover_end_dev( - - #ifdef CONFIG_SCSI_SAS_ATA - if ((phy->attached_tproto & SAS_PROTOCOL_STP) || phy->attached_sata_dev) { -+ if (child->linkrate > parent->min_linkrate) { -+ struct sas_phy_linkrates rates = { -+ .maximum_linkrate = parent->min_linkrate, -+ .minimum_linkrate = parent->min_linkrate, -+ }; -+ int ret; -+ -+ pr_notice("ex %016llx phy%02d SATA device linkrate > min pathway connection rate, attempting to lower device linkrate\n", -+ SAS_ADDR(child->sas_addr), phy_id); -+ ret = sas_smp_phy_control(parent, phy_id, -+ PHY_FUNC_LINK_RESET, &rates); -+ if (ret) { -+ pr_err("ex %016llx phy%02d SATA device could not set linkrate (%d)\n", -+ SAS_ADDR(child->sas_addr), phy_id, ret); -+ goto out_free; -+ } -+ pr_notice("ex %016llx phy%02d SATA device set linkrate successfully\n", -+ SAS_ADDR(child->sas_addr), phy_id); -+ child->linkrate = child->min_linkrate; -+ } - res = sas_get_ata_info(child, phy); - if (res) - goto out_free; -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index bc61cc8bc6f0..03e95a3216c8 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -1239,6 +1239,12 @@ lpfc_sli_read_hs(struct lpfc_hba *phba) - static inline struct lpfc_sli_ring * - lpfc_phba_elsring(struct lpfc_hba *phba) - { -+ /* Return NULL if sli_rev has become invalid due to bad fw */ -+ if (phba->sli_rev != LPFC_SLI_REV4 && -+ phba->sli_rev != LPFC_SLI_REV3 && -+ phba->sli_rev != LPFC_SLI_REV2) -+ return NULL; -+ - if (phba->sli_rev == LPFC_SLI_REV4) { - if (phba->sli4_hba.els_wq) - return phba->sli4_hba.els_wq->pring; -diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c -index 3da242201cb4..82ce5d193018 100644 ---- a/drivers/scsi/lpfc/lpfc_attr.c -+++ b/drivers/scsi/lpfc/lpfc_attr.c -@@ -1178,7 +1178,7 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode) - return -EACCES; - - if ((phba->sli_rev < LPFC_SLI_REV4) || -- (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != -+ (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < - LPFC_SLI_INTF_IF_TYPE_2)) - return -EPERM; - -@@ -4056,7 +4056,7 @@ lpfc_link_speed_store(struct device *dev, struct device_attribute *attr, - uint32_t prev_val, if_type; - - if_type = bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf); -- if (if_type == LPFC_SLI_INTF_IF_TYPE_2 && -+ if (if_type >= LPFC_SLI_INTF_IF_TYPE_2 && - phba->hba_flag & HBA_FORCED_LINK_SPEED) - return -EPERM; - -diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c -index d89816222b23..6dde21dc82a3 100644 ---- a/drivers/scsi/lpfc/lpfc_bsg.c -+++ b/drivers/scsi/lpfc/lpfc_bsg.c -@@ -2221,7 +2221,7 @@ lpfc_bsg_diag_loopback_mode(struct bsg_job *job) - - if (phba->sli_rev < LPFC_SLI_REV4) - rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job); -- else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) == -+ else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >= - LPFC_SLI_INTF_IF_TYPE_2) - rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job); - else -@@ -2261,7 +2261,7 @@ lpfc_sli4_bsg_diag_mode_end(struct bsg_job *job) - - if (phba->sli_rev < LPFC_SLI_REV4) - return -ENODEV; -- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != -+ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < - LPFC_SLI_INTF_IF_TYPE_2) - return -ENODEV; - -@@ -2353,7 +2353,7 @@ lpfc_sli4_bsg_link_diag_test(struct bsg_job *job) - rc = -ENODEV; - goto job_error; - } -- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != -+ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < - LPFC_SLI_INTF_IF_TYPE_2) { - rc = -ENODEV; - goto job_error; -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index e5db20e8979d..c851fd14ff3e 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1337,6 +1337,8 @@ lpfc_els_abort_flogi(struct lpfc_hba *phba) - Fabric_DID); - - pring = lpfc_phba_elsring(phba); -+ if (unlikely(!pring)) -+ return -EIO; - - /* - * Check the txcmplq for an iocb that matches the nport the driver is -@@ -5548,7 +5550,7 @@ lpfc_els_rcv_rdp(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - struct ls_rjt stat; - - if (phba->sli_rev < LPFC_SLI_REV4 || -- bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) != -+ bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) < - LPFC_SLI_INTF_IF_TYPE_2) { - rjt_err = LSRJT_UNABLE_TPC; - rjt_expl = LSEXP_REQ_UNSUPPORTED; -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index d850077c5e22..3f88f3d79622 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -4769,7 +4769,7 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) - if (phba->sli_rev == LPFC_SLI_REV4 && - (!(vport->load_flag & FC_UNLOADING)) && - (bf_get(lpfc_sli_intf_if_type, -- &phba->sli4_hba.sli_intf) == -+ &phba->sli4_hba.sli_intf) >= - LPFC_SLI_INTF_IF_TYPE_2) && - (kref_read(&ndlp->kref) > 0)) { - mbox->context1 = lpfc_nlp_get(ndlp); -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index 15bcd00dd7a2..c69c2a2b2ead 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -1773,7 +1773,12 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_hba *phba, int mbx_action, - lpfc_offline(phba); - /* release interrupt for possible resource change */ - lpfc_sli4_disable_intr(phba); -- lpfc_sli_brdrestart(phba); -+ rc = lpfc_sli_brdrestart(phba); -+ if (rc) { -+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -+ "6309 Failed to restart board\n"); -+ return rc; -+ } - /* request and enable interrupt */ - intr_mode = lpfc_sli4_enable_intr(phba, phba->intr_mode); - if (intr_mode == LPFC_INTR_ERROR) { -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 07cb671bb855..2eba0c39ac1c 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -2714,6 +2714,7 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba, - int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction; - int prot_group_type = 0; - int fcpdl; -+ struct lpfc_vport *vport = phba->pport; - - /* - * Start the lpfc command prep by bumping the bpl beyond fcp_cmnd -@@ -2819,6 +2820,14 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba, - */ - iocb_cmd->un.fcpi.fcpi_parm = fcpdl; - -+ /* -+ * For First burst, we may need to adjust the initial transfer -+ * length for DIF -+ */ -+ if (iocb_cmd->un.fcpi.fcpi_XRdy && -+ (fcpdl < vport->cfg_first_burst_size)) -+ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl; -+ - return 0; - err: - if (lpfc_cmd->seg_cnt) -@@ -3371,6 +3380,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, - int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction; - int prot_group_type = 0; - int fcpdl; -+ struct lpfc_vport *vport = phba->pport; - - /* - * Start the lpfc command prep by bumping the sgl beyond fcp_cmnd -@@ -3486,6 +3496,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba, - */ - iocb_cmd->un.fcpi.fcpi_parm = fcpdl; - -+ /* -+ * For First burst, we may need to adjust the initial transfer -+ * length for DIF -+ */ -+ if (iocb_cmd->un.fcpi.fcpi_XRdy && -+ (fcpdl < vport->cfg_first_burst_size)) -+ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl; -+ - /* - * If the OAS driver feature is enabled and the lun is enabled for - * OAS, set the oas iocb related flags. -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index ebf7d3cda367..62bea4ffdc25 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -4421,6 +4421,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba) - hba_aer_enabled = phba->hba_flag & HBA_AER_ENABLED; - - rc = lpfc_sli4_brdreset(phba); -+ if (rc) -+ return rc; - - spin_lock_irq(&phba->hbalock); - phba->pport->stopped = 0; -diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -index 2fcdaadd10fa..e08ac431bc49 100644 ---- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c -+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -@@ -903,38 +903,14 @@ static ssize_t tcm_qla2xxx_tpg_enable_show(struct config_item *item, - atomic_read(&tpg->lport_tpg_enabled)); - } - --static void tcm_qla2xxx_depend_tpg(struct work_struct *work) --{ -- struct tcm_qla2xxx_tpg *base_tpg = container_of(work, -- struct tcm_qla2xxx_tpg, tpg_base_work); -- struct se_portal_group *se_tpg = &base_tpg->se_tpg; -- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha; -- -- if (!target_depend_item(&se_tpg->tpg_group.cg_item)) { -- atomic_set(&base_tpg->lport_tpg_enabled, 1); -- qlt_enable_vha(base_vha); -- } -- complete(&base_tpg->tpg_base_comp); --} -- --static void tcm_qla2xxx_undepend_tpg(struct work_struct *work) --{ -- struct tcm_qla2xxx_tpg *base_tpg = container_of(work, -- struct tcm_qla2xxx_tpg, tpg_base_work); -- struct se_portal_group *se_tpg = &base_tpg->se_tpg; -- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha; -- -- if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) { -- atomic_set(&base_tpg->lport_tpg_enabled, 0); -- target_undepend_item(&se_tpg->tpg_group.cg_item); -- } -- complete(&base_tpg->tpg_base_comp); --} -- - static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item, - const char *page, size_t count) - { - struct se_portal_group *se_tpg = to_tpg(item); -+ struct se_wwn *se_wwn = se_tpg->se_tpg_wwn; -+ struct tcm_qla2xxx_lport *lport = container_of(se_wwn, -+ struct tcm_qla2xxx_lport, lport_wwn); -+ struct scsi_qla_host *vha = lport->qla_vha; - struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg, - struct tcm_qla2xxx_tpg, se_tpg); - unsigned long op; -@@ -953,24 +929,16 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item, - if (atomic_read(&tpg->lport_tpg_enabled)) - return -EEXIST; - -- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg); -+ atomic_set(&tpg->lport_tpg_enabled, 1); -+ qlt_enable_vha(vha); - } else { - if (!atomic_read(&tpg->lport_tpg_enabled)) - return count; - -- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg); -+ atomic_set(&tpg->lport_tpg_enabled, 0); -+ qlt_stop_phase1(vha->vha_tgt.qla_tgt); - } -- init_completion(&tpg->tpg_base_comp); -- schedule_work(&tpg->tpg_base_work); -- wait_for_completion(&tpg->tpg_base_comp); - -- if (op) { -- if (!atomic_read(&tpg->lport_tpg_enabled)) -- return -ENODEV; -- } else { -- if (atomic_read(&tpg->lport_tpg_enabled)) -- return -EPERM; -- } - return count; - } - -diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h -index 7550ba2831c3..147cf6c90366 100644 ---- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h -+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h -@@ -48,9 +48,6 @@ struct tcm_qla2xxx_tpg { - struct tcm_qla2xxx_tpg_attrib tpg_attrib; - /* Returned by tcm_qla2xxx_make_tpg() */ - struct se_portal_group se_tpg; -- /* Items for dealing with configfs_depend_item */ -- struct completion tpg_base_comp; -- struct work_struct tpg_base_work; - }; - - struct tcm_qla2xxx_fc_loopid { -diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c -index aca52654825b..811cada301ac 100644 ---- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c -+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c -@@ -1630,14 +1630,15 @@ static void _rtl92e_hard_data_xmit(struct sk_buff *skb, struct net_device *dev, - memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev)); - skb_push(skb, priv->rtllib->tx_headroom); - ret = _rtl92e_tx(dev, skb); -- if (ret != 0) -- kfree_skb(skb); - - if (queue_index != MGNT_QUEUE) { - priv->rtllib->stats.tx_bytes += (skb->len - - priv->rtllib->tx_headroom); - priv->rtllib->stats.tx_packets++; - } -+ -+ if (ret != 0) -+ kfree_skb(skb); - } - - static int _rtl92e_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) -diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c -index 943324877707..33e052106ce7 100644 ---- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c -+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c -@@ -25,18 +25,13 @@ - static const struct sdio_device_id sdio_ids[] = - { - { SDIO_DEVICE(0x024c, 0x0523), }, -+ { SDIO_DEVICE(0x024c, 0x0525), }, - { SDIO_DEVICE(0x024c, 0x0623), }, - { SDIO_DEVICE(0x024c, 0x0626), }, - { SDIO_DEVICE(0x024c, 0xb723), }, - { /* end: all zeroes */ }, - }; --static const struct acpi_device_id acpi_ids[] = { -- {"OBDA8723", 0x0000}, -- {} --}; -- - MODULE_DEVICE_TABLE(sdio, sdio_ids); --MODULE_DEVICE_TABLE(acpi, acpi_ids); - - static int rtw_drv_init(struct sdio_func *func, const struct sdio_device_id *id); - static void rtw_dev_remove(struct sdio_func *func); -diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c -index d29b512a7d9f..c698ebab6d3b 100644 ---- a/drivers/tty/serial/8250/8250_core.c -+++ b/drivers/tty/serial/8250/8250_core.c -@@ -953,6 +953,21 @@ static struct uart_8250_port *serial8250_find_match_or_unused(struct uart_port * - return NULL; - } - -+static void serial_8250_overrun_backoff_work(struct work_struct *work) -+{ -+ struct uart_8250_port *up = -+ container_of(to_delayed_work(work), struct uart_8250_port, -+ overrun_backoff); -+ struct uart_port *port = &up->port; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&port->lock, flags); -+ up->ier |= UART_IER_RLSI | UART_IER_RDI; -+ up->port.read_status_mask |= UART_LSR_DR; -+ serial_out(up, UART_IER, up->ier); -+ spin_unlock_irqrestore(&port->lock, flags); -+} -+ - /** - * serial8250_register_8250_port - register a serial port - * @up: serial port template -@@ -1062,7 +1077,18 @@ int serial8250_register_8250_port(struct uart_8250_port *up) - - ret = 0; - } -+ -+ /* Initialise interrupt backoff work if required */ -+ if (up->overrun_backoff_time_ms > 0) { -+ uart->overrun_backoff_time_ms = -+ up->overrun_backoff_time_ms; -+ INIT_DELAYED_WORK(&uart->overrun_backoff, -+ serial_8250_overrun_backoff_work); -+ } else { -+ uart->overrun_backoff_time_ms = 0; -+ } - } -+ - mutex_unlock(&serial_mutex); - - return ret; -diff --git a/drivers/tty/serial/8250/8250_fsl.c b/drivers/tty/serial/8250/8250_fsl.c -index 910bfee5a88b..cc138c24ae88 100644 ---- a/drivers/tty/serial/8250/8250_fsl.c -+++ b/drivers/tty/serial/8250/8250_fsl.c -@@ -48,8 +48,29 @@ int fsl8250_handle_irq(struct uart_port *port) - - lsr = orig_lsr = up->port.serial_in(&up->port, UART_LSR); - -- if (lsr & (UART_LSR_DR | UART_LSR_BI)) -+ /* Process incoming characters first */ -+ if ((lsr & (UART_LSR_DR | UART_LSR_BI)) && -+ (up->ier & (UART_IER_RLSI | UART_IER_RDI))) { - lsr = serial8250_rx_chars(up, lsr); -+ } -+ -+ /* Stop processing interrupts on input overrun */ -+ if ((orig_lsr & UART_LSR_OE) && (up->overrun_backoff_time_ms > 0)) { -+ unsigned long delay; -+ -+ up->ier = port->serial_in(port, UART_IER); -+ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { -+ port->ops->stop_rx(port); -+ } else { -+ /* Keep restarting the timer until -+ * the input overrun subsides. -+ */ -+ cancel_delayed_work(&up->overrun_backoff); -+ } -+ -+ delay = msecs_to_jiffies(up->overrun_backoff_time_ms); -+ schedule_delayed_work(&up->overrun_backoff, delay); -+ } - - serial8250_modem_status(up); - -diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c -index ec510e342e06..c51044ba503c 100644 ---- a/drivers/tty/serial/8250/8250_of.c -+++ b/drivers/tty/serial/8250/8250_of.c -@@ -232,6 +232,11 @@ static int of_platform_serial_probe(struct platform_device *ofdev) - if (of_property_read_bool(ofdev->dev.of_node, "auto-flow-control")) - port8250.capabilities |= UART_CAP_AFE; - -+ if (of_property_read_u32(ofdev->dev.of_node, -+ "overrun-throttle-ms", -+ &port8250.overrun_backoff_time_ms) != 0) -+ port8250.overrun_backoff_time_ms = 0; -+ - ret = serial8250_register_8250_port(&port8250); - if (ret < 0) - goto err_dispose; -diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c -index 0969a0d97b2b..cec995ec11ea 100644 ---- a/drivers/tty/serial/max310x.c -+++ b/drivers/tty/serial/max310x.c -@@ -769,12 +769,9 @@ static void max310x_start_tx(struct uart_port *port) - - static unsigned int max310x_tx_empty(struct uart_port *port) - { -- unsigned int lvl, sts; -+ u8 lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG); - -- lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG); -- sts = max310x_port_read(port, MAX310X_IRQSTS_REG); -- -- return ((sts & MAX310X_IRQ_TXEMPTY_BIT) && !lvl) ? TIOCSER_TEMT : 0; -+ return lvl ? 0 : TIOCSER_TEMT; - } - - static unsigned int max310x_get_mctrl(struct uart_port *port) -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 8b5c99df0f2b..a962065227c4 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1028,6 +1028,9 @@ static const struct usb_device_id id_table_combined[] = { - /* Sienna devices */ - { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) }, - { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) }, -+ /* U-Blox devices */ -+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, -+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 22d66217cb41..e8373528264c 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -1558,3 +1558,10 @@ - */ - #define UNJO_VID 0x22B7 - #define UNJO_ISODEBUG_V1_PID 0x150D -+ -+/* -+ * U-Blox products (http://www.u-blox.com). -+ */ -+#define UBLOX_VID 0x1546 -+#define UBLOX_C099F9P_ZED_PID 0x0502 -+#define UBLOX_C099F9P_ODIN_PID 0x0503 -diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c -index b4c68f3b82be..eba9aaf3cc17 100644 ---- a/drivers/vfio/vfio_iommu_spapr_tce.c -+++ b/drivers/vfio/vfio_iommu_spapr_tce.c -@@ -409,6 +409,7 @@ static void tce_iommu_release(void *iommu_data) - { - struct tce_container *container = iommu_data; - struct tce_iommu_group *tcegrp; -+ struct tce_iommu_prereg *tcemem, *tmtmp; - long i; - - while (tce_groups_attached(container)) { -@@ -431,13 +432,8 @@ static void tce_iommu_release(void *iommu_data) - tce_iommu_free_table(container, tbl); - } - -- while (!list_empty(&container->prereg_list)) { -- struct tce_iommu_prereg *tcemem; -- -- tcemem = list_first_entry(&container->prereg_list, -- struct tce_iommu_prereg, next); -- WARN_ON_ONCE(tce_iommu_prereg_free(container, tcemem)); -- } -+ list_for_each_entry_safe(tcemem, tmtmp, &container->prereg_list, next) -+ WARN_ON(tce_iommu_prereg_free(container, tcemem)); - - tce_iommu_disable(container); - if (container->mm) -diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c -index 69a5a57f1446..61297a6ab43a 100644 ---- a/drivers/watchdog/meson_gxbb_wdt.c -+++ b/drivers/watchdog/meson_gxbb_wdt.c -@@ -137,8 +137,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev) - - reg = readl(data->reg_base + GXBB_WDT_TCNT_REG); - -- return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) - -- (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000; -+ return ((reg & GXBB_WDT_TCNT_SETUP_MASK) - -+ (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000; - } - - static const struct watchdog_ops meson_gxbb_wdt_ops = { -diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c -index 0ae947c3d7bc..d8cf2039c6a4 100644 ---- a/drivers/watchdog/sama5d4_wdt.c -+++ b/drivers/watchdog/sama5d4_wdt.c -@@ -111,9 +111,7 @@ static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd, - u32 value = WDT_SEC2TICKS(timeout); - - wdt->mr &= ~AT91_WDT_WDV; -- wdt->mr &= ~AT91_WDT_WDD; - wdt->mr |= AT91_WDT_SET_WDV(value); -- wdt->mr |= AT91_WDT_SET_WDD(value); - - /* - * WDDIS has to be 0 when updating WDD/WDV. The datasheet states: When -@@ -255,7 +253,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev) - - timeout = WDT_SEC2TICKS(wdd->timeout); - -- wdt->mr |= AT91_WDT_SET_WDD(timeout); -+ wdt->mr |= AT91_WDT_SET_WDD(WDT_SEC2TICKS(MAX_WDT_TIMEOUT)); - wdt->mr |= AT91_WDT_SET_WDV(timeout); - - ret = sama5d4_wdt_init(wdt); -diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c -index 9e480fdebe1f..8c250f4a3a97 100644 ---- a/drivers/xen/xen-pciback/pci_stub.c -+++ b/drivers/xen/xen-pciback/pci_stub.c -@@ -106,7 +106,8 @@ static void pcistub_device_release(struct kref *kref) - * is called from "unbind" which takes a device_lock mutex. - */ - __pci_reset_function_locked(dev); -- if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state)) -+ if (dev_data && -+ pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state)) - dev_info(&dev->dev, "Could not reload PCI state\n"); - else - pci_restore_state(dev); -diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c -index 93ffa898df6d..d56bd3625468 100644 ---- a/fs/btrfs/delayed-ref.c -+++ b/fs/btrfs/delayed-ref.c -@@ -195,8 +195,6 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans, - ref->in_tree = 0; - btrfs_put_delayed_ref(ref); - atomic_dec(&delayed_refs->num_entries); -- if (trans->delayed_ref_updates) -- trans->delayed_ref_updates--; - } - - static bool merge_ref(struct btrfs_trans_handle *trans, -@@ -458,7 +456,6 @@ add_tail: - if (ref->action == BTRFS_ADD_DELAYED_REF) - list_add_tail(&ref->add_list, &href->ref_add_list); - atomic_inc(&root->num_entries); -- trans->delayed_ref_updates++; - spin_unlock(&href->lock); - return ret; - } -diff --git a/fs/ceph/super.c b/fs/ceph/super.c -index f0694293b31a..088c4488b449 100644 ---- a/fs/ceph/super.c -+++ b/fs/ceph/super.c -@@ -232,6 +232,7 @@ static int parse_fsopt_token(char *c, void *private) - return -ENOMEM; - break; - case Opt_fscache_uniq: -+#ifdef CONFIG_CEPH_FSCACHE - kfree(fsopt->fscache_uniq); - fsopt->fscache_uniq = kstrndup(argstr[0].from, - argstr[0].to-argstr[0].from, -@@ -240,7 +241,10 @@ static int parse_fsopt_token(char *c, void *private) - return -ENOMEM; - fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE; - break; -- /* misc */ -+#else -+ pr_err("fscache support is disabled\n"); -+ return -EINVAL; -+#endif - case Opt_wsize: - if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) - return -EINVAL; -@@ -312,8 +316,13 @@ static int parse_fsopt_token(char *c, void *private) - fsopt->flags &= ~CEPH_MOUNT_OPT_INO32; - break; - case Opt_fscache: -+#ifdef CONFIG_CEPH_FSCACHE - fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE; - break; -+#else -+ pr_err("fscache support is disabled\n"); -+ return -EINVAL; -+#endif - case Opt_nofscache: - fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE; - break; -diff --git a/fs/exec.c b/fs/exec.c -index 4623fc3ac86b..7def97f6aac2 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -1007,7 +1007,7 @@ static int exec_mmap(struct mm_struct *mm) - /* Notify parent that we're no longer interested in the old VM */ - tsk = current; - old_mm = current->mm; -- mm_release(tsk, old_mm); -+ exec_mm_release(tsk, old_mm); - - if (old_mm) { - sync_mm_rss(old_mm); -diff --git a/fs/exofs/super.c b/fs/exofs/super.c -index c9ec652e2fcd..881d5798a181 100644 ---- a/fs/exofs/super.c -+++ b/fs/exofs/super.c -@@ -702,21 +702,18 @@ out: - /* - * Read the superblock from the OSD and fill in the fields - */ --static int exofs_fill_super(struct super_block *sb, void *data, int silent) -+static int exofs_fill_super(struct super_block *sb, -+ struct exofs_mountopt *opts, -+ struct exofs_sb_info *sbi, -+ int silent) - { - struct inode *root; -- struct exofs_mountopt *opts = data; -- struct exofs_sb_info *sbi; /*extended info */ - struct osd_dev *od; /* Master device */ - struct exofs_fscb fscb; /*on-disk superblock info */ - struct ore_comp comp; - unsigned table_count; - int ret; - -- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); -- if (!sbi) -- return -ENOMEM; -- - /* use mount options to fill superblock */ - if (opts->is_osdname) { - struct osd_dev_info odi = {.systemid_len = 0}; -@@ -860,7 +857,9 @@ static struct dentry *exofs_mount(struct file_system_type *type, - int flags, const char *dev_name, - void *data) - { -+ struct super_block *s; - struct exofs_mountopt opts; -+ struct exofs_sb_info *sbi; - int ret; - - ret = parse_options(data, &opts); -@@ -869,9 +868,31 @@ static struct dentry *exofs_mount(struct file_system_type *type, - return ERR_PTR(ret); - } - -+ sbi = kzalloc(sizeof(*sbi), GFP_KERNEL); -+ if (!sbi) { -+ kfree(opts.dev_name); -+ return ERR_PTR(-ENOMEM); -+ } -+ -+ s = sget(type, NULL, set_anon_super, flags, NULL); -+ -+ if (IS_ERR(s)) { -+ kfree(opts.dev_name); -+ kfree(sbi); -+ return ERR_CAST(s); -+ } -+ - if (!opts.dev_name) - opts.dev_name = dev_name; -- return mount_nodev(type, flags, &opts, exofs_fill_super); -+ -+ -+ ret = exofs_fill_super(s, &opts, sbi, flags & SB_SILENT ? 1 : 0); -+ if (ret) { -+ deactivate_locked_super(s); -+ return ERR_PTR(ret); -+ } -+ s->s_flags |= SB_ACTIVE; -+ return dget(s->s_root); - } - - /* -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 8c987a1994d4..b3d5fd84b485 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -5751,8 +5751,23 @@ static int __ext4_expand_extra_isize(struct inode *inode, - { - struct ext4_inode *raw_inode; - struct ext4_xattr_ibody_header *header; -+ unsigned int inode_size = EXT4_INODE_SIZE(inode->i_sb); -+ struct ext4_inode_info *ei = EXT4_I(inode); - int error; - -+ /* this was checked at iget time, but double check for good measure */ -+ if ((EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > inode_size) || -+ (ei->i_extra_isize & 3)) { -+ EXT4_ERROR_INODE(inode, "bad extra_isize %u (inode size %u)", -+ ei->i_extra_isize, -+ EXT4_INODE_SIZE(inode->i_sb)); -+ return -EFSCORRUPTED; -+ } -+ if ((new_extra_isize < ei->i_extra_isize) || -+ (new_extra_isize < 4) || -+ (new_extra_isize > inode_size - EXT4_GOOD_OLD_INODE_SIZE)) -+ return -EINVAL; /* Should never happen */ -+ - raw_inode = ext4_raw_inode(iloc); - - header = IHDR(inode, raw_inode); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 61d07608577e..1a0a56647974 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3458,12 +3458,15 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); - struct ext4_super_block *es = sbi->s_es; -+ unsigned def_extra_isize = sizeof(struct ext4_inode) - -+ EXT4_GOOD_OLD_INODE_SIZE; - -- /* determine the minimum size of new large inodes, if present */ -- if (sbi->s_inode_size > EXT4_GOOD_OLD_INODE_SIZE && -- sbi->s_want_extra_isize == 0) { -- sbi->s_want_extra_isize = sizeof(struct ext4_inode) - -- EXT4_GOOD_OLD_INODE_SIZE; -+ if (sbi->s_inode_size == EXT4_GOOD_OLD_INODE_SIZE) { -+ sbi->s_want_extra_isize = 0; -+ return; -+ } -+ if (sbi->s_want_extra_isize < 4) { -+ sbi->s_want_extra_isize = def_extra_isize; - if (ext4_has_feature_extra_isize(sb)) { - if (sbi->s_want_extra_isize < - le16_to_cpu(es->s_want_extra_isize)) -@@ -3476,10 +3479,10 @@ static void ext4_clamp_want_extra_isize(struct super_block *sb) - } - } - /* Check if enough inode space is available */ -- if (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize > -- sbi->s_inode_size) { -- sbi->s_want_extra_isize = sizeof(struct ext4_inode) - -- EXT4_GOOD_OLD_INODE_SIZE; -+ if ((sbi->s_want_extra_isize > sbi->s_inode_size) || -+ (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize > -+ sbi->s_inode_size)) { -+ sbi->s_want_extra_isize = def_extra_isize; - ext4_msg(sb, KERN_INFO, - "required extra inode space not available"); - } -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index 1b1792199445..d68b0132718a 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -1593,7 +1593,7 @@ static int __f2fs_ioc_setflags(struct inode *inode, unsigned int flags) - - inode->i_ctime = current_time(inode); - f2fs_set_inode_flags(inode); -- f2fs_mark_inode_dirty_sync(inode, false); -+ f2fs_mark_inode_dirty_sync(inode, true); - return 0; - } - -diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c -index 09432b25fe9b..b3a1b16d4e3e 100644 ---- a/fs/gfs2/bmap.c -+++ b/fs/gfs2/bmap.c -@@ -1445,6 +1445,8 @@ static int do_grow(struct inode *inode, u64 size) - } - - error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT + -+ (unstuff && -+ gfs2_is_jdata(ip) ? RES_JDATA : 0) + - (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF ? - 0 : RES_QUOTA), 0); - if (error) -diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c -index f7fba58618ef..2459ae9d2234 100644 ---- a/fs/ocfs2/journal.c -+++ b/fs/ocfs2/journal.c -@@ -1018,7 +1018,8 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb) - mlog_errno(status); - } - -- if (status == 0) { -+ /* Shutdown the kernel journal system */ -+ if (!jbd2_journal_destroy(journal->j_journal) && !status) { - /* - * Do not toggle if flush was unsuccessful otherwise - * will leave dirty metadata in a "clean" journal -@@ -1027,9 +1028,6 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb) - if (status < 0) - mlog_errno(status); - } -- -- /* Shutdown the kernel journal system */ -- jbd2_journal_destroy(journal->j_journal); - journal->j_journal = NULL; - - OCFS2_I(inode)->ip_open_count--; -diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c -index fa0bc4d46065..5f616a6a5358 100644 ---- a/fs/xfs/xfs_ioctl32.c -+++ b/fs/xfs/xfs_ioctl32.c -@@ -252,6 +252,32 @@ xfs_compat_ioc_bulkstat( - int done; - int error; - -+ /* -+ * Output structure handling functions. Depending on the command, -+ * either the xfs_bstat and xfs_inogrp structures are written out -+ * to userpace memory via bulkreq.ubuffer. Normally the compat -+ * functions and structure size are the correct ones to use ... -+ */ -+ inumbers_fmt_pf inumbers_func = xfs_inumbers_fmt_compat; -+ bulkstat_one_pf bs_one_func = xfs_bulkstat_one_compat; -+ size_t bs_one_size = sizeof(struct compat_xfs_bstat); -+ -+#ifdef CONFIG_X86_X32 -+ if (in_x32_syscall()) { -+ /* -+ * ... but on x32 the input xfs_fsop_bulkreq has pointers -+ * which must be handled in the "compat" (32-bit) way, while -+ * the xfs_bstat and xfs_inogrp structures follow native 64- -+ * bit layout convention. So adjust accordingly, otherwise -+ * the data written out in compat layout will not match what -+ * x32 userspace expects. -+ */ -+ inumbers_func = xfs_inumbers_fmt; -+ bs_one_func = xfs_bulkstat_one; -+ bs_one_size = sizeof(struct xfs_bstat); -+ } -+#endif -+ - /* done = 1 if there are more stats to get and if bulkstat */ - /* should be called again (unused here, but used in dmapi) */ - -@@ -283,15 +309,15 @@ xfs_compat_ioc_bulkstat( - - if (cmd == XFS_IOC_FSINUMBERS_32) { - error = xfs_inumbers(mp, &inlast, &count, -- bulkreq.ubuffer, xfs_inumbers_fmt_compat); -+ bulkreq.ubuffer, inumbers_func); - } else if (cmd == XFS_IOC_FSBULKSTAT_SINGLE_32) { - int res; - -- error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer, -- sizeof(compat_xfs_bstat_t), NULL, &res); -+ error = bs_one_func(mp, inlast, bulkreq.ubuffer, -+ bs_one_size, NULL, &res); - } else if (cmd == XFS_IOC_FSBULKSTAT_32) { - error = xfs_bulkstat(mp, &inlast, &count, -- xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t), -+ bs_one_func, bs_one_size, - bulkreq.ubuffer, &done); - } else - error = -EINVAL; -@@ -347,6 +373,7 @@ xfs_compat_attrlist_by_handle( - { - int error; - attrlist_cursor_kern_t *cursor; -+ compat_xfs_fsop_attrlist_handlereq_t __user *p = arg; - compat_xfs_fsop_attrlist_handlereq_t al_hreq; - struct dentry *dentry; - char *kbuf; -@@ -381,6 +408,11 @@ xfs_compat_attrlist_by_handle( - if (error) - goto out_kfree; - -+ if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) { -+ error = -EFAULT; -+ goto out_kfree; -+ } -+ - if (copy_to_user(compat_ptr(al_hreq.buffer), kbuf, al_hreq.buflen)) - error = -EFAULT; - -diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c -index 488719d43ca8..cdcb7235e41a 100644 ---- a/fs/xfs/xfs_rtalloc.c -+++ b/fs/xfs/xfs_rtalloc.c -@@ -1214,13 +1214,11 @@ xfs_rtmount_inodes( - xfs_sb_t *sbp; - - sbp = &mp->m_sb; -- if (sbp->sb_rbmino == NULLFSINO) -- return 0; - error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip); - if (error) - return error; - ASSERT(mp->m_rbmip != NULL); -- ASSERT(sbp->sb_rsumino != NULLFSINO); -+ - error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip); - if (error) { - IRELE(mp->m_rbmip); -diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h -index 8804753805ac..7bb2d8de9f30 100644 ---- a/include/linux/blktrace_api.h -+++ b/include/linux/blktrace_api.h -@@ -116,7 +116,13 @@ extern void blk_fill_rwbs(char *rwbs, unsigned int op, int bytes); - - static inline sector_t blk_rq_trace_sector(struct request *rq) - { -- return blk_rq_is_passthrough(rq) ? 0 : blk_rq_pos(rq); -+ /* -+ * Tracing should ignore starting sector for passthrough requests and -+ * requests where starting sector didn't get set. -+ */ -+ if (blk_rq_is_passthrough(rq) || blk_rq_pos(rq) == (sector_t)-1) -+ return 0; -+ return blk_rq_pos(rq); - } - - static inline unsigned int blk_rq_trace_nr_sectors(struct request *rq) -diff --git a/include/linux/compat.h b/include/linux/compat.h -index 23909d12f729..cec96d4794d0 100644 ---- a/include/linux/compat.h -+++ b/include/linux/compat.h -@@ -324,8 +324,6 @@ struct compat_kexec_segment; - struct compat_mq_attr; - struct compat_msgbuf; - --extern void compat_exit_robust_list(struct task_struct *curr); -- - asmlinkage long - compat_sys_set_robust_list(struct compat_robust_list_head __user *head, - compat_size_t len); -diff --git a/include/linux/futex.h b/include/linux/futex.h -index c0fb9a24bbd2..a4b6cba699bf 100644 ---- a/include/linux/futex.h -+++ b/include/linux/futex.h -@@ -2,7 +2,9 @@ - #ifndef _LINUX_FUTEX_H - #define _LINUX_FUTEX_H - -+#include - #include -+ - #include - - struct inode; -@@ -12,9 +14,6 @@ struct task_struct; - long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, - u32 __user *uaddr2, u32 val2, u32 val3); - --extern int --handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi); -- - /* - * Futexes are matched on equal values of this key. - * The key type depends on whether it's a shared or private mapping. -@@ -54,24 +53,35 @@ union futex_key { - #define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = NULL } } - - #ifdef CONFIG_FUTEX --extern void exit_robust_list(struct task_struct *curr); --#ifdef CONFIG_HAVE_FUTEX_CMPXCHG --#define futex_cmpxchg_enabled 1 --#else --extern int futex_cmpxchg_enabled; --#endif --#else --static inline void exit_robust_list(struct task_struct *curr) -+enum { -+ FUTEX_STATE_OK, -+ FUTEX_STATE_EXITING, -+ FUTEX_STATE_DEAD, -+}; -+ -+static inline void futex_init_task(struct task_struct *tsk) - { --} -+ tsk->robust_list = NULL; -+#ifdef CONFIG_COMPAT -+ tsk->compat_robust_list = NULL; - #endif -+ INIT_LIST_HEAD(&tsk->pi_state_list); -+ tsk->pi_state_cache = NULL; -+ tsk->futex_state = FUTEX_STATE_OK; -+ mutex_init(&tsk->futex_exit_mutex); -+} - --#ifdef CONFIG_FUTEX_PI --extern void exit_pi_state_list(struct task_struct *curr); -+void futex_exit_recursive(struct task_struct *tsk); -+void futex_exit_release(struct task_struct *tsk); -+void futex_exec_release(struct task_struct *tsk); -+ -+long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, -+ u32 __user *uaddr2, u32 val2, u32 val3); - #else --static inline void exit_pi_state_list(struct task_struct *curr) --{ --} -+static inline void futex_init_task(struct task_struct *tsk) { } -+static inline void futex_exit_recursive(struct task_struct *tsk) { } -+static inline void futex_exit_release(struct task_struct *tsk) { } -+static inline void futex_exec_release(struct task_struct *tsk) { } - #endif - - #endif -diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h -index 872f930f1b06..dd0a452373e7 100644 ---- a/include/linux/genalloc.h -+++ b/include/linux/genalloc.h -@@ -51,7 +51,8 @@ typedef unsigned long (*genpool_algo_t)(unsigned long *map, - unsigned long size, - unsigned long start, - unsigned int nr, -- void *data, struct gen_pool *pool); -+ void *data, struct gen_pool *pool, -+ unsigned long start_addr); - - /* - * General purpose special memory pool descriptor. -@@ -131,24 +132,24 @@ extern void gen_pool_set_algo(struct gen_pool *pool, genpool_algo_t algo, - - extern unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size, - unsigned long start, unsigned int nr, void *data, -- struct gen_pool *pool); -+ struct gen_pool *pool, unsigned long start_addr); - - extern unsigned long gen_pool_fixed_alloc(unsigned long *map, - unsigned long size, unsigned long start, unsigned int nr, -- void *data, struct gen_pool *pool); -+ void *data, struct gen_pool *pool, unsigned long start_addr); - - extern unsigned long gen_pool_first_fit_align(unsigned long *map, - unsigned long size, unsigned long start, unsigned int nr, -- void *data, struct gen_pool *pool); -+ void *data, struct gen_pool *pool, unsigned long start_addr); - - - extern unsigned long gen_pool_first_fit_order_align(unsigned long *map, - unsigned long size, unsigned long start, unsigned int nr, -- void *data, struct gen_pool *pool); -+ void *data, struct gen_pool *pool, unsigned long start_addr); - - extern unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size, - unsigned long start, unsigned int nr, void *data, -- struct gen_pool *pool); -+ struct gen_pool *pool, unsigned long start_addr); - - - extern struct gen_pool *devm_gen_pool_create(struct device *dev, -diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h -index c4a350d83578..79ad4f8b889d 100644 ---- a/include/linux/gpio/consumer.h -+++ b/include/linux/gpio/consumer.h -@@ -404,7 +404,7 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc) - - static inline struct gpio_desc *gpio_to_desc(unsigned gpio) - { -- return ERR_PTR(-EINVAL); -+ return NULL; - } - - static inline int desc_to_gpio(const struct gpio_desc *desc) -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 40b830d55fe5..4725a9d9597f 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -3522,7 +3522,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits) - if (debug_value == 0) /* no output */ - return 0; - /* set low N bits */ -- return (1 << debug_value) - 1; -+ return (1U << debug_value) - 1; - } - - static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu) -diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h -index adb88f8cefbc..576caaf0c9af 100644 ---- a/include/linux/reset-controller.h -+++ b/include/linux/reset-controller.h -@@ -7,7 +7,7 @@ - struct reset_controller_dev; - - /** -- * struct reset_control_ops -+ * struct reset_control_ops - reset controller driver callbacks - * - * @reset: for self-deasserting resets, does all necessary - * things to reset the device -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 866439c361a9..b06577652643 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -959,6 +959,8 @@ struct task_struct { - #endif - struct list_head pi_state_list; - struct futex_pi_state *pi_state_cache; -+ struct mutex futex_exit_mutex; -+ unsigned int futex_state; - #endif - #ifdef CONFIG_PERF_EVENTS - struct perf_event_context *perf_event_ctxp[perf_nr_task_contexts]; -@@ -1334,7 +1336,6 @@ extern struct pid *cad_pid; - */ - #define PF_IDLE 0x00000002 /* I am an IDLE thread */ - #define PF_EXITING 0x00000004 /* Getting shut down */ --#define PF_EXITPIDONE 0x00000008 /* PI exit done on shut down */ - #define PF_VCPU 0x00000010 /* I'm a virtual CPU */ - #define PF_WQ_WORKER 0x00000020 /* I'm a workqueue worker */ - #define PF_FORKNOEXEC 0x00000040 /* Forked but didn't exec */ -diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h -index 9f7cc1d7ec4a..efb9e12e7f91 100644 ---- a/include/linux/sched/mm.h -+++ b/include/linux/sched/mm.h -@@ -125,8 +125,10 @@ extern struct mm_struct *get_task_mm(struct task_struct *task); - * succeeds. - */ - extern struct mm_struct *mm_access(struct task_struct *task, unsigned int mode); --/* Remove the current tasks stale references to the old mm_struct */ --extern void mm_release(struct task_struct *, struct mm_struct *); -+/* Remove the current tasks stale references to the old mm_struct on exit() */ -+extern void exit_mm_release(struct task_struct *, struct mm_struct *); -+/* Remove the current tasks stale references to the old mm_struct on exec() */ -+extern void exec_mm_release(struct task_struct *, struct mm_struct *); - - #ifdef CONFIG_MEMCG - extern void mm_update_next_owner(struct mm_struct *mm); -diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h -index a74ec619ac51..11b4fba82950 100644 ---- a/include/linux/sched/task.h -+++ b/include/linux/sched/task.h -@@ -39,6 +39,8 @@ void __noreturn do_task_dead(void); - - extern void proc_caches_init(void); - -+extern void fork_init(void); -+ - extern void release_task(struct task_struct * p); - - #ifdef CONFIG_HAVE_COPY_THREAD_TLS -diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h -index a27ef5f56431..791a6be0e394 100644 ---- a/include/linux/serial_8250.h -+++ b/include/linux/serial_8250.h -@@ -134,6 +134,10 @@ struct uart_8250_port { - void (*dl_write)(struct uart_8250_port *, int); - - struct uart_8250_em485 *em485; -+ -+ /* Serial port overrun backoff */ -+ struct delayed_work overrun_backoff; -+ u32 overrun_backoff_time_ms; - }; - - static inline struct uart_8250_port *up_to_u8250p(struct uart_port *up) -diff --git a/include/linux/swap.h b/include/linux/swap.h -index e643866912b7..411953964c34 100644 ---- a/include/linux/swap.h -+++ b/include/linux/swap.h -@@ -363,14 +363,8 @@ extern unsigned long vm_total_pages; - extern int node_reclaim_mode; - extern int sysctl_min_unmapped_ratio; - extern int sysctl_min_slab_ratio; --extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int); - #else - #define node_reclaim_mode 0 --static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask, -- unsigned int order) --{ -- return 0; --} - #endif - - extern int page_evictable(struct page *page); -diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h -index 94c775773f58..c1f71dd464d3 100644 ---- a/include/net/sctp/structs.h -+++ b/include/net/sctp/structs.h -@@ -1181,6 +1181,9 @@ struct sctp_ep_common { - /* What socket does this endpoint belong to? */ - struct sock *sk; - -+ /* Cache netns and it won't change once set */ -+ struct net *net; -+ - /* This is where we receive inbound chunks. */ - struct sctp_inq inqueue; - -diff --git a/include/net/sock.h b/include/net/sock.h -index 780c6c0a86f0..0af46cbd3649 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -1232,7 +1232,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk) - percpu_counter_inc(sk->sk_prot->sockets_allocated); - } - --static inline int -+static inline u64 - sk_sockets_allocated_read_positive(struct sock *sk) - { - return percpu_counter_read_positive(sk->sk_prot->sockets_allocated); -diff --git a/init/main.c b/init/main.c -index 51067e2db509..b1ab36fe1a55 100644 ---- a/init/main.c -+++ b/init/main.c -@@ -98,7 +98,6 @@ - static int kernel_init(void *); - - extern void init_IRQ(void); --extern void fork_init(void); - extern void radix_tree_init(void); - - /* -diff --git a/kernel/Makefile b/kernel/Makefile -index 3085141c055c..43e92e3691ec 100644 ---- a/kernel/Makefile -+++ b/kernel/Makefile -@@ -49,9 +49,6 @@ obj-$(CONFIG_PROFILING) += profile.o - obj-$(CONFIG_STACKTRACE) += stacktrace.o - obj-y += time/ - obj-$(CONFIG_FUTEX) += futex.o --ifeq ($(CONFIG_COMPAT),y) --obj-$(CONFIG_FUTEX) += futex_compat.o --endif - obj-$(CONFIG_GENERIC_ISA_DMA) += dma.o - obj-$(CONFIG_SMP) += smp.o - ifneq ($(CONFIG_SMP),y) -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index 59d2e94ecb79..f5c1d5479ba3 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -348,12 +348,12 @@ static int map_create(union bpf_attr *attr) - err = bpf_map_new_fd(map); - if (err < 0) { - /* failed to allocate fd. -- * bpf_map_put() is needed because the above -+ * bpf_map_put_with_uref() is needed because the above - * bpf_map_alloc_id() has published the map - * to the userspace and the userspace may - * have refcnt-ed it through BPF_MAP_GET_FD_BY_ID. - */ -- bpf_map_put(map); -+ bpf_map_put_with_uref(map); - return err; - } - -@@ -1354,7 +1354,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr) - - fd = bpf_map_new_fd(map); - if (fd < 0) -- bpf_map_put(map); -+ bpf_map_put_with_uref(map); - - return fd; - } -diff --git a/kernel/exit.c b/kernel/exit.c -index 15437cfdcd70..57cb0eb1271c 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -497,7 +497,7 @@ static void exit_mm(void) - struct mm_struct *mm = current->mm; - struct core_state *core_state; - -- mm_release(current, mm); -+ exit_mm_release(current, mm); - if (!mm) - return; - sync_mm_rss(mm); -@@ -803,32 +803,12 @@ void __noreturn do_exit(long code) - */ - if (unlikely(tsk->flags & PF_EXITING)) { - pr_alert("Fixing recursive fault but reboot is needed!\n"); -- /* -- * We can do this unlocked here. The futex code uses -- * this flag just to verify whether the pi state -- * cleanup has been done or not. In the worst case it -- * loops once more. We pretend that the cleanup was -- * done as there is no way to return. Either the -- * OWNER_DIED bit is set by now or we push the blocked -- * task into the wait for ever nirwana as well. -- */ -- tsk->flags |= PF_EXITPIDONE; -+ futex_exit_recursive(tsk); - set_current_state(TASK_UNINTERRUPTIBLE); - schedule(); - } - - exit_signals(tsk); /* sets PF_EXITING */ -- /* -- * Ensure that all new tsk->pi_lock acquisitions must observe -- * PF_EXITING. Serializes against futex.c:attach_to_pi_owner(). -- */ -- smp_mb(); -- /* -- * Ensure that we must observe the pi_state in exit_mm() -> -- * mm_release() -> exit_pi_state_list(). -- */ -- raw_spin_lock_irq(&tsk->pi_lock); -- raw_spin_unlock_irq(&tsk->pi_lock); - - if (unlikely(in_atomic())) { - pr_info("note: %s[%d] exited with preempt_count %d\n", -@@ -902,12 +882,6 @@ void __noreturn do_exit(long code) - * Make sure we are holding no locks: - */ - debug_check_no_locks_held(); -- /* -- * We can do this unlocked here. The futex code uses this flag -- * just to verify whether the pi state cleanup has been done -- * or not. In the worst case it loops once more. -- */ -- tsk->flags |= PF_EXITPIDONE; - - if (tsk->io_context) - exit_io_context(tsk); -diff --git a/kernel/fork.c b/kernel/fork.c -index 3352fdbd5e20..0a328cf0cb13 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -162,10 +162,6 @@ static inline void free_task_struct(struct task_struct *tsk) - } - #endif - --void __weak arch_release_thread_stack(unsigned long *stack) --{ --} -- - #ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR - - /* -@@ -348,7 +344,6 @@ static void release_task_stack(struct task_struct *tsk) - return; /* Better to leak the stack than to free prematurely */ - - account_kernel_stack(tsk, -1); -- arch_release_thread_stack(tsk->stack); - free_thread_stack(tsk); - tsk->stack = NULL; - #ifdef CONFIG_VMAP_STACK -@@ -1137,24 +1132,8 @@ static int wait_for_vfork_done(struct task_struct *child, - * restoring the old one. . . - * Eric Biederman 10 January 1998 - */ --void mm_release(struct task_struct *tsk, struct mm_struct *mm) -+static void mm_release(struct task_struct *tsk, struct mm_struct *mm) - { -- /* Get rid of any futexes when releasing the mm */ --#ifdef CONFIG_FUTEX -- if (unlikely(tsk->robust_list)) { -- exit_robust_list(tsk); -- tsk->robust_list = NULL; -- } --#ifdef CONFIG_COMPAT -- if (unlikely(tsk->compat_robust_list)) { -- compat_exit_robust_list(tsk); -- tsk->compat_robust_list = NULL; -- } --#endif -- if (unlikely(!list_empty(&tsk->pi_state_list))) -- exit_pi_state_list(tsk); --#endif -- - uprobe_free_utask(tsk); - - /* Get rid of any cached register state */ -@@ -1187,6 +1166,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm) - complete_vfork_done(tsk); - } - -+void exit_mm_release(struct task_struct *tsk, struct mm_struct *mm) -+{ -+ futex_exit_release(tsk); -+ mm_release(tsk, mm); -+} -+ -+void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm) -+{ -+ futex_exec_release(tsk); -+ mm_release(tsk, mm); -+} -+ - /* - * Allocate a new mm structure and copy contents from the - * mm structure of the passed in task structure. -@@ -1801,14 +1792,8 @@ static __latent_entropy struct task_struct *copy_process( - #ifdef CONFIG_BLOCK - p->plug = NULL; - #endif --#ifdef CONFIG_FUTEX -- p->robust_list = NULL; --#ifdef CONFIG_COMPAT -- p->compat_robust_list = NULL; --#endif -- INIT_LIST_HEAD(&p->pi_state_list); -- p->pi_state_cache = NULL; --#endif -+ futex_init_task(p); -+ - /* - * sigaltstack should be cleared when sharing the same VM - */ -diff --git a/kernel/futex.c b/kernel/futex.c -index afe6a81584c9..f5aae14c247b 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -44,6 +44,7 @@ - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ -+#include - #include - #include - #include -@@ -173,8 +174,10 @@ - * double_lock_hb() and double_unlock_hb(), respectively. - */ - --#ifndef CONFIG_HAVE_FUTEX_CMPXCHG --int __read_mostly futex_cmpxchg_enabled; -+#ifdef CONFIG_HAVE_FUTEX_CMPXCHG -+#define futex_cmpxchg_enabled 1 -+#else -+static int __read_mostly futex_cmpxchg_enabled; - #endif - - /* -@@ -338,6 +341,12 @@ static inline bool should_fail_futex(bool fshared) - } - #endif /* CONFIG_FAIL_FUTEX */ - -+#ifdef CONFIG_COMPAT -+static void compat_exit_robust_list(struct task_struct *curr); -+#else -+static inline void compat_exit_robust_list(struct task_struct *curr) { } -+#endif -+ - static inline void futex_get_mm(union futex_key *key) - { - mmgrab(key->private.mm); -@@ -887,7 +896,7 @@ static struct task_struct *futex_find_get_task(pid_t pid) - * Kernel cleans up PI-state, but userspace is likely hosed. - * (Robust-futex cleanup is separate and might save the day for userspace.) - */ --void exit_pi_state_list(struct task_struct *curr) -+static void exit_pi_state_list(struct task_struct *curr) - { - struct list_head *next, *head = &curr->pi_state_list; - struct futex_pi_state *pi_state; -@@ -957,7 +966,8 @@ void exit_pi_state_list(struct task_struct *curr) - } - raw_spin_unlock_irq(&curr->pi_lock); - } -- -+#else -+static inline void exit_pi_state_list(struct task_struct *curr) { } - #endif - - /* -@@ -1166,16 +1176,47 @@ out_error: - return ret; - } - -+/** -+ * wait_for_owner_exiting - Block until the owner has exited -+ * @exiting: Pointer to the exiting task -+ * -+ * Caller must hold a refcount on @exiting. -+ */ -+static void wait_for_owner_exiting(int ret, struct task_struct *exiting) -+{ -+ if (ret != -EBUSY) { -+ WARN_ON_ONCE(exiting); -+ return; -+ } -+ -+ if (WARN_ON_ONCE(ret == -EBUSY && !exiting)) -+ return; -+ -+ mutex_lock(&exiting->futex_exit_mutex); -+ /* -+ * No point in doing state checking here. If the waiter got here -+ * while the task was in exec()->exec_futex_release() then it can -+ * have any FUTEX_STATE_* value when the waiter has acquired the -+ * mutex. OK, if running, EXITING or DEAD if it reached exit() -+ * already. Highly unlikely and not a problem. Just one more round -+ * through the futex maze. -+ */ -+ mutex_unlock(&exiting->futex_exit_mutex); -+ -+ put_task_struct(exiting); -+} -+ - static int handle_exit_race(u32 __user *uaddr, u32 uval, - struct task_struct *tsk) - { - u32 uval2; - - /* -- * If PF_EXITPIDONE is not yet set, then try again. -+ * If the futex exit state is not yet FUTEX_STATE_DEAD, tell the -+ * caller that the alleged owner is busy. - */ -- if (tsk && !(tsk->flags & PF_EXITPIDONE)) -- return -EAGAIN; -+ if (tsk && tsk->futex_state != FUTEX_STATE_DEAD) -+ return -EBUSY; - - /* - * Reread the user space value to handle the following situation: -@@ -1193,8 +1234,9 @@ static int handle_exit_race(u32 __user *uaddr, u32 uval, - * *uaddr = 0xC0000000; tsk = get_task(PID); - * } if (!tsk->flags & PF_EXITING) { - * ... attach(); -- * tsk->flags |= PF_EXITPIDONE; } else { -- * if (!(tsk->flags & PF_EXITPIDONE)) -+ * tsk->futex_state = } else { -+ * FUTEX_STATE_DEAD; if (tsk->futex_state != -+ * FUTEX_STATE_DEAD) - * return -EAGAIN; - * return -ESRCH; <--- FAIL - * } -@@ -1225,7 +1267,8 @@ static int handle_exit_race(u32 __user *uaddr, u32 uval, - * it after doing proper sanity checks. - */ - static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key, -- struct futex_pi_state **ps) -+ struct futex_pi_state **ps, -+ struct task_struct **exiting) - { - pid_t pid = uval & FUTEX_TID_MASK; - struct futex_pi_state *pi_state; -@@ -1250,22 +1293,33 @@ static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key, - } - - /* -- * We need to look at the task state flags to figure out, -- * whether the task is exiting. To protect against the do_exit -- * change of the task flags, we do this protected by -- * p->pi_lock: -+ * We need to look at the task state to figure out, whether the -+ * task is exiting. To protect against the change of the task state -+ * in futex_exit_release(), we do this protected by p->pi_lock: - */ - raw_spin_lock_irq(&p->pi_lock); -- if (unlikely(p->flags & PF_EXITING)) { -+ if (unlikely(p->futex_state != FUTEX_STATE_OK)) { - /* -- * The task is on the way out. When PF_EXITPIDONE is -- * set, we know that the task has finished the -- * cleanup: -+ * The task is on the way out. When the futex state is -+ * FUTEX_STATE_DEAD, we know that the task has finished -+ * the cleanup: - */ - int ret = handle_exit_race(uaddr, uval, p); - - raw_spin_unlock_irq(&p->pi_lock); -- put_task_struct(p); -+ /* -+ * If the owner task is between FUTEX_STATE_EXITING and -+ * FUTEX_STATE_DEAD then store the task pointer and keep -+ * the reference on the task struct. The calling code will -+ * drop all locks, wait for the task to reach -+ * FUTEX_STATE_DEAD and then drop the refcount. This is -+ * required to prevent a live lock when the current task -+ * preempted the exiting task between the two states. -+ */ -+ if (ret == -EBUSY) -+ *exiting = p; -+ else -+ put_task_struct(p); - return ret; - } - -@@ -1304,7 +1358,8 @@ static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key, - - static int lookup_pi_state(u32 __user *uaddr, u32 uval, - struct futex_hash_bucket *hb, -- union futex_key *key, struct futex_pi_state **ps) -+ union futex_key *key, struct futex_pi_state **ps, -+ struct task_struct **exiting) - { - struct futex_q *top_waiter = futex_top_waiter(hb, key); - -@@ -1319,7 +1374,7 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval, - * We are the first waiter - try to look up the owner based on - * @uval and attach to it. - */ -- return attach_to_pi_owner(uaddr, uval, key, ps); -+ return attach_to_pi_owner(uaddr, uval, key, ps, exiting); - } - - static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) -@@ -1347,6 +1402,8 @@ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) - * lookup - * @task: the task to perform the atomic lock work for. This will - * be "current" except in the case of requeue pi. -+ * @exiting: Pointer to store the task pointer of the owner task -+ * which is in the middle of exiting - * @set_waiters: force setting the FUTEX_WAITERS bit (1) or not (0) - * - * Return: -@@ -1355,11 +1412,17 @@ static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) - * - <0 - error - * - * The hb->lock and futex_key refs shall be held by the caller. -+ * -+ * @exiting is only set when the return value is -EBUSY. If so, this holds -+ * a refcount on the exiting task on return and the caller needs to drop it -+ * after waiting for the exit to complete. - */ - static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb, - union futex_key *key, - struct futex_pi_state **ps, -- struct task_struct *task, int set_waiters) -+ struct task_struct *task, -+ struct task_struct **exiting, -+ int set_waiters) - { - u32 uval, newval, vpid = task_pid_vnr(task); - struct futex_q *top_waiter; -@@ -1429,7 +1492,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb, - * attach to the owner. If that fails, no harm done, we only - * set the FUTEX_WAITERS bit in the user space variable. - */ -- return attach_to_pi_owner(uaddr, newval, key, ps); -+ return attach_to_pi_owner(uaddr, newval, key, ps, exiting); - } - - /** -@@ -1848,6 +1911,8 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key, - * @key1: the from futex key - * @key2: the to futex key - * @ps: address to store the pi_state pointer -+ * @exiting: Pointer to store the task pointer of the owner task -+ * which is in the middle of exiting - * @set_waiters: force setting the FUTEX_WAITERS bit (1) or not (0) - * - * Try and get the lock on behalf of the top waiter if we can do it atomically. -@@ -1855,16 +1920,20 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key, - * then direct futex_lock_pi_atomic() to force setting the FUTEX_WAITERS bit. - * hb1 and hb2 must be held by the caller. - * -+ * @exiting is only set when the return value is -EBUSY. If so, this holds -+ * a refcount on the exiting task on return and the caller needs to drop it -+ * after waiting for the exit to complete. -+ * - * Return: - * - 0 - failed to acquire the lock atomically; - * - >0 - acquired the lock, return value is vpid of the top_waiter - * - <0 - error - */ --static int futex_proxy_trylock_atomic(u32 __user *pifutex, -- struct futex_hash_bucket *hb1, -- struct futex_hash_bucket *hb2, -- union futex_key *key1, union futex_key *key2, -- struct futex_pi_state **ps, int set_waiters) -+static int -+futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1, -+ struct futex_hash_bucket *hb2, union futex_key *key1, -+ union futex_key *key2, struct futex_pi_state **ps, -+ struct task_struct **exiting, int set_waiters) - { - struct futex_q *top_waiter = NULL; - u32 curval; -@@ -1901,7 +1970,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex, - */ - vpid = task_pid_vnr(top_waiter->task); - ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task, -- set_waiters); -+ exiting, set_waiters); - if (ret == 1) { - requeue_pi_wake_futex(top_waiter, key2, hb2); - return vpid; -@@ -2030,6 +2099,8 @@ retry_private: - } - - if (requeue_pi && (task_count - nr_wake < nr_requeue)) { -+ struct task_struct *exiting = NULL; -+ - /* - * Attempt to acquire uaddr2 and wake the top waiter. If we - * intend to requeue waiters, force setting the FUTEX_WAITERS -@@ -2037,7 +2108,8 @@ retry_private: - * faults rather in the requeue loop below. - */ - ret = futex_proxy_trylock_atomic(uaddr2, hb1, hb2, &key1, -- &key2, &pi_state, nr_requeue); -+ &key2, &pi_state, -+ &exiting, nr_requeue); - - /* - * At this point the top_waiter has either taken uaddr2 or is -@@ -2064,7 +2136,8 @@ retry_private: - * If that call succeeds then we have pi_state and an - * initial refcount on it. - */ -- ret = lookup_pi_state(uaddr2, ret, hb2, &key2, &pi_state); -+ ret = lookup_pi_state(uaddr2, ret, hb2, &key2, -+ &pi_state, &exiting); - } - - switch (ret) { -@@ -2082,17 +2155,24 @@ retry_private: - if (!ret) - goto retry; - goto out; -+ case -EBUSY: - case -EAGAIN: - /* - * Two reasons for this: -- * - Owner is exiting and we just wait for the -+ * - EBUSY: Owner is exiting and we just wait for the - * exit to complete. -- * - The user space value changed. -+ * - EAGAIN: The user space value changed. - */ - double_unlock_hb(hb1, hb2); - hb_waiters_dec(hb2); - put_futex_key(&key2); - put_futex_key(&key1); -+ /* -+ * Handle the case where the owner is in the middle of -+ * exiting. Wait for the exit to complete otherwise -+ * this task might loop forever, aka. live lock. -+ */ -+ wait_for_owner_exiting(ret, exiting); - cond_resched(); - goto retry; - default: -@@ -2808,6 +2888,7 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, - { - struct hrtimer_sleeper timeout, *to = NULL; - struct futex_pi_state *pi_state = NULL; -+ struct task_struct *exiting = NULL; - struct rt_mutex_waiter rt_waiter; - struct futex_hash_bucket *hb; - struct futex_q q = futex_q_init; -@@ -2835,7 +2916,8 @@ retry: - retry_private: - hb = queue_lock(&q); - -- ret = futex_lock_pi_atomic(uaddr, hb, &q.key, &q.pi_state, current, 0); -+ ret = futex_lock_pi_atomic(uaddr, hb, &q.key, &q.pi_state, current, -+ &exiting, 0); - if (unlikely(ret)) { - /* - * Atomic work succeeded and we got the lock, -@@ -2848,15 +2930,22 @@ retry_private: - goto out_unlock_put_key; - case -EFAULT: - goto uaddr_faulted; -+ case -EBUSY: - case -EAGAIN: - /* - * Two reasons for this: -- * - Task is exiting and we just wait for the -+ * - EBUSY: Task is exiting and we just wait for the - * exit to complete. -- * - The user space value changed. -+ * - EAGAIN: The user space value changed. - */ - queue_unlock(hb); - put_futex_key(&q.key); -+ /* -+ * Handle the case where the owner is in the middle of -+ * exiting. Wait for the exit to complete otherwise -+ * this task might loop forever, aka. live lock. -+ */ -+ wait_for_owner_exiting(ret, exiting); - cond_resched(); - goto retry; - default: -@@ -3472,11 +3561,16 @@ err_unlock: - return ret; - } - -+/* Constants for the pending_op argument of handle_futex_death */ -+#define HANDLE_DEATH_PENDING true -+#define HANDLE_DEATH_LIST false -+ - /* - * Process a futex-list entry, check whether it's owned by the - * dying task, and do notification if so: - */ --int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi) -+static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, -+ bool pi, bool pending_op) - { - u32 uval, uninitialized_var(nval), mval; - int err; -@@ -3489,6 +3583,42 @@ retry: - if (get_user(uval, uaddr)) - return -1; - -+ /* -+ * Special case for regular (non PI) futexes. The unlock path in -+ * user space has two race scenarios: -+ * -+ * 1. The unlock path releases the user space futex value and -+ * before it can execute the futex() syscall to wake up -+ * waiters it is killed. -+ * -+ * 2. A woken up waiter is killed before it can acquire the -+ * futex in user space. -+ * -+ * In both cases the TID validation below prevents a wakeup of -+ * potential waiters which can cause these waiters to block -+ * forever. -+ * -+ * In both cases the following conditions are met: -+ * -+ * 1) task->robust_list->list_op_pending != NULL -+ * @pending_op == true -+ * 2) User space futex value == 0 -+ * 3) Regular futex: @pi == false -+ * -+ * If these conditions are met, it is safe to attempt waking up a -+ * potential waiter without touching the user space futex value and -+ * trying to set the OWNER_DIED bit. The user space futex value is -+ * uncontended and the rest of the user space mutex state is -+ * consistent, so a woken waiter will just take over the -+ * uncontended futex. Setting the OWNER_DIED bit would create -+ * inconsistent state and malfunction of the user space owner died -+ * handling. -+ */ -+ if (pending_op && !pi && !uval) { -+ futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY); -+ return 0; -+ } -+ - if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr)) - return 0; - -@@ -3567,7 +3697,7 @@ static inline int fetch_robust_entry(struct robust_list __user **entry, - * - * We silently return on any sign of list-walking problem. - */ --void exit_robust_list(struct task_struct *curr) -+static void exit_robust_list(struct task_struct *curr) - { - struct robust_list_head __user *head = curr->robust_list; - struct robust_list __user *entry, *next_entry, *pending; -@@ -3608,10 +3738,11 @@ void exit_robust_list(struct task_struct *curr) - * A pending lock might already be on the list, so - * don't process it twice: - */ -- if (entry != pending) -+ if (entry != pending) { - if (handle_futex_death((void __user *)entry + futex_offset, -- curr, pi)) -+ curr, pi, HANDLE_DEATH_LIST)) - return; -+ } - if (rc) - return; - entry = next_entry; -@@ -3625,9 +3756,118 @@ void exit_robust_list(struct task_struct *curr) - cond_resched(); - } - -- if (pending) -+ if (pending) { - handle_futex_death((void __user *)pending + futex_offset, -- curr, pip); -+ curr, pip, HANDLE_DEATH_PENDING); -+ } -+} -+ -+static void futex_cleanup(struct task_struct *tsk) -+{ -+ if (unlikely(tsk->robust_list)) { -+ exit_robust_list(tsk); -+ tsk->robust_list = NULL; -+ } -+ -+#ifdef CONFIG_COMPAT -+ if (unlikely(tsk->compat_robust_list)) { -+ compat_exit_robust_list(tsk); -+ tsk->compat_robust_list = NULL; -+ } -+#endif -+ -+ if (unlikely(!list_empty(&tsk->pi_state_list))) -+ exit_pi_state_list(tsk); -+} -+ -+/** -+ * futex_exit_recursive - Set the tasks futex state to FUTEX_STATE_DEAD -+ * @tsk: task to set the state on -+ * -+ * Set the futex exit state of the task lockless. The futex waiter code -+ * observes that state when a task is exiting and loops until the task has -+ * actually finished the futex cleanup. The worst case for this is that the -+ * waiter runs through the wait loop until the state becomes visible. -+ * -+ * This is called from the recursive fault handling path in do_exit(). -+ * -+ * This is best effort. Either the futex exit code has run already or -+ * not. If the OWNER_DIED bit has been set on the futex then the waiter can -+ * take it over. If not, the problem is pushed back to user space. If the -+ * futex exit code did not run yet, then an already queued waiter might -+ * block forever, but there is nothing which can be done about that. -+ */ -+void futex_exit_recursive(struct task_struct *tsk) -+{ -+ /* If the state is FUTEX_STATE_EXITING then futex_exit_mutex is held */ -+ if (tsk->futex_state == FUTEX_STATE_EXITING) -+ mutex_unlock(&tsk->futex_exit_mutex); -+ tsk->futex_state = FUTEX_STATE_DEAD; -+} -+ -+static void futex_cleanup_begin(struct task_struct *tsk) -+{ -+ /* -+ * Prevent various race issues against a concurrent incoming waiter -+ * including live locks by forcing the waiter to block on -+ * tsk->futex_exit_mutex when it observes FUTEX_STATE_EXITING in -+ * attach_to_pi_owner(). -+ */ -+ mutex_lock(&tsk->futex_exit_mutex); -+ -+ /* -+ * Switch the state to FUTEX_STATE_EXITING under tsk->pi_lock. -+ * -+ * This ensures that all subsequent checks of tsk->futex_state in -+ * attach_to_pi_owner() must observe FUTEX_STATE_EXITING with -+ * tsk->pi_lock held. -+ * -+ * It guarantees also that a pi_state which was queued right before -+ * the state change under tsk->pi_lock by a concurrent waiter must -+ * be observed in exit_pi_state_list(). -+ */ -+ raw_spin_lock_irq(&tsk->pi_lock); -+ tsk->futex_state = FUTEX_STATE_EXITING; -+ raw_spin_unlock_irq(&tsk->pi_lock); -+} -+ -+static void futex_cleanup_end(struct task_struct *tsk, int state) -+{ -+ /* -+ * Lockless store. The only side effect is that an observer might -+ * take another loop until it becomes visible. -+ */ -+ tsk->futex_state = state; -+ /* -+ * Drop the exit protection. This unblocks waiters which observed -+ * FUTEX_STATE_EXITING to reevaluate the state. -+ */ -+ mutex_unlock(&tsk->futex_exit_mutex); -+} -+ -+void futex_exec_release(struct task_struct *tsk) -+{ -+ /* -+ * The state handling is done for consistency, but in the case of -+ * exec() there is no way to prevent futher damage as the PID stays -+ * the same. But for the unlikely and arguably buggy case that a -+ * futex is held on exec(), this provides at least as much state -+ * consistency protection which is possible. -+ */ -+ futex_cleanup_begin(tsk); -+ futex_cleanup(tsk); -+ /* -+ * Reset the state to FUTEX_STATE_OK. The task is alive and about -+ * exec a new binary. -+ */ -+ futex_cleanup_end(tsk, FUTEX_STATE_OK); -+} -+ -+void futex_exit_release(struct task_struct *tsk) -+{ -+ futex_cleanup_begin(tsk); -+ futex_cleanup(tsk); -+ futex_cleanup_end(tsk, FUTEX_STATE_DEAD); - } - - long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, -@@ -3723,6 +3963,193 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, - return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); - } - -+#ifdef CONFIG_COMPAT -+/* -+ * Fetch a robust-list pointer. Bit 0 signals PI futexes: -+ */ -+static inline int -+compat_fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry, -+ compat_uptr_t __user *head, unsigned int *pi) -+{ -+ if (get_user(*uentry, head)) -+ return -EFAULT; -+ -+ *entry = compat_ptr((*uentry) & ~1); -+ *pi = (unsigned int)(*uentry) & 1; -+ -+ return 0; -+} -+ -+static void __user *futex_uaddr(struct robust_list __user *entry, -+ compat_long_t futex_offset) -+{ -+ compat_uptr_t base = ptr_to_compat(entry); -+ void __user *uaddr = compat_ptr(base + futex_offset); -+ -+ return uaddr; -+} -+ -+/* -+ * Walk curr->robust_list (very carefully, it's a userspace list!) -+ * and mark any locks found there dead, and notify any waiters. -+ * -+ * We silently return on any sign of list-walking problem. -+ */ -+static void compat_exit_robust_list(struct task_struct *curr) -+{ -+ struct compat_robust_list_head __user *head = curr->compat_robust_list; -+ struct robust_list __user *entry, *next_entry, *pending; -+ unsigned int limit = ROBUST_LIST_LIMIT, pi, pip; -+ unsigned int uninitialized_var(next_pi); -+ compat_uptr_t uentry, next_uentry, upending; -+ compat_long_t futex_offset; -+ int rc; -+ -+ if (!futex_cmpxchg_enabled) -+ return; -+ -+ /* -+ * Fetch the list head (which was registered earlier, via -+ * sys_set_robust_list()): -+ */ -+ if (compat_fetch_robust_entry(&uentry, &entry, &head->list.next, &pi)) -+ return; -+ /* -+ * Fetch the relative futex offset: -+ */ -+ if (get_user(futex_offset, &head->futex_offset)) -+ return; -+ /* -+ * Fetch any possibly pending lock-add first, and handle it -+ * if it exists: -+ */ -+ if (compat_fetch_robust_entry(&upending, &pending, -+ &head->list_op_pending, &pip)) -+ return; -+ -+ next_entry = NULL; /* avoid warning with gcc */ -+ while (entry != (struct robust_list __user *) &head->list) { -+ /* -+ * Fetch the next entry in the list before calling -+ * handle_futex_death: -+ */ -+ rc = compat_fetch_robust_entry(&next_uentry, &next_entry, -+ (compat_uptr_t __user *)&entry->next, &next_pi); -+ /* -+ * A pending lock might already be on the list, so -+ * dont process it twice: -+ */ -+ if (entry != pending) { -+ void __user *uaddr = futex_uaddr(entry, futex_offset); -+ -+ if (handle_futex_death(uaddr, curr, pi, -+ HANDLE_DEATH_LIST)) -+ return; -+ } -+ if (rc) -+ return; -+ uentry = next_uentry; -+ entry = next_entry; -+ pi = next_pi; -+ /* -+ * Avoid excessively long or circular lists: -+ */ -+ if (!--limit) -+ break; -+ -+ cond_resched(); -+ } -+ if (pending) { -+ void __user *uaddr = futex_uaddr(pending, futex_offset); -+ -+ handle_futex_death(uaddr, curr, pip, HANDLE_DEATH_PENDING); -+ } -+} -+ -+COMPAT_SYSCALL_DEFINE2(set_robust_list, -+ struct compat_robust_list_head __user *, head, -+ compat_size_t, len) -+{ -+ if (!futex_cmpxchg_enabled) -+ return -ENOSYS; -+ -+ if (unlikely(len != sizeof(*head))) -+ return -EINVAL; -+ -+ current->compat_robust_list = head; -+ -+ return 0; -+} -+ -+COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, -+ compat_uptr_t __user *, head_ptr, -+ compat_size_t __user *, len_ptr) -+{ -+ struct compat_robust_list_head __user *head; -+ unsigned long ret; -+ struct task_struct *p; -+ -+ if (!futex_cmpxchg_enabled) -+ return -ENOSYS; -+ -+ rcu_read_lock(); -+ -+ ret = -ESRCH; -+ if (!pid) -+ p = current; -+ else { -+ p = find_task_by_vpid(pid); -+ if (!p) -+ goto err_unlock; -+ } -+ -+ ret = -EPERM; -+ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) -+ goto err_unlock; -+ -+ head = p->compat_robust_list; -+ rcu_read_unlock(); -+ -+ if (put_user(sizeof(*head), len_ptr)) -+ return -EFAULT; -+ return put_user(ptr_to_compat(head), head_ptr); -+ -+err_unlock: -+ rcu_read_unlock(); -+ -+ return ret; -+} -+ -+COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, -+ struct compat_timespec __user *, utime, u32 __user *, uaddr2, -+ u32, val3) -+{ -+ struct timespec ts; -+ ktime_t t, *tp = NULL; -+ int val2 = 0; -+ int cmd = op & FUTEX_CMD_MASK; -+ -+ if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI || -+ cmd == FUTEX_WAIT_BITSET || -+ cmd == FUTEX_WAIT_REQUEUE_PI)) { -+ if (compat_get_timespec(&ts, utime)) -+ return -EFAULT; -+ if (!timespec_valid(&ts)) -+ return -EINVAL; -+ -+ t = timespec_to_ktime(ts); -+ if (cmd == FUTEX_WAIT) -+ t = ktime_add_safe(ktime_get(), t); -+ tp = &t; -+ } -+ if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE || -+ cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP) -+ val2 = (int) (unsigned long) utime; -+ -+ return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); -+} -+#endif /* CONFIG_COMPAT */ -+ - static void __init futex_detect_cmpxchg(void) - { - #ifndef CONFIG_HAVE_FUTEX_CMPXCHG -diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c -deleted file mode 100644 -index 83f830acbb5f..000000000000 ---- a/kernel/futex_compat.c -+++ /dev/null -@@ -1,202 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/* -- * linux/kernel/futex_compat.c -- * -- * Futex compatibililty routines. -- * -- * Copyright 2006, Red Hat, Inc., Ingo Molnar -- */ -- --#include --#include --#include --#include --#include --#include -- --#include -- -- --/* -- * Fetch a robust-list pointer. Bit 0 signals PI futexes: -- */ --static inline int --fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry, -- compat_uptr_t __user *head, unsigned int *pi) --{ -- if (get_user(*uentry, head)) -- return -EFAULT; -- -- *entry = compat_ptr((*uentry) & ~1); -- *pi = (unsigned int)(*uentry) & 1; -- -- return 0; --} -- --static void __user *futex_uaddr(struct robust_list __user *entry, -- compat_long_t futex_offset) --{ -- compat_uptr_t base = ptr_to_compat(entry); -- void __user *uaddr = compat_ptr(base + futex_offset); -- -- return uaddr; --} -- --/* -- * Walk curr->robust_list (very carefully, it's a userspace list!) -- * and mark any locks found there dead, and notify any waiters. -- * -- * We silently return on any sign of list-walking problem. -- */ --void compat_exit_robust_list(struct task_struct *curr) --{ -- struct compat_robust_list_head __user *head = curr->compat_robust_list; -- struct robust_list __user *entry, *next_entry, *pending; -- unsigned int limit = ROBUST_LIST_LIMIT, pi, pip; -- unsigned int uninitialized_var(next_pi); -- compat_uptr_t uentry, next_uentry, upending; -- compat_long_t futex_offset; -- int rc; -- -- if (!futex_cmpxchg_enabled) -- return; -- -- /* -- * Fetch the list head (which was registered earlier, via -- * sys_set_robust_list()): -- */ -- if (fetch_robust_entry(&uentry, &entry, &head->list.next, &pi)) -- return; -- /* -- * Fetch the relative futex offset: -- */ -- if (get_user(futex_offset, &head->futex_offset)) -- return; -- /* -- * Fetch any possibly pending lock-add first, and handle it -- * if it exists: -- */ -- if (fetch_robust_entry(&upending, &pending, -- &head->list_op_pending, &pip)) -- return; -- -- next_entry = NULL; /* avoid warning with gcc */ -- while (entry != (struct robust_list __user *) &head->list) { -- /* -- * Fetch the next entry in the list before calling -- * handle_futex_death: -- */ -- rc = fetch_robust_entry(&next_uentry, &next_entry, -- (compat_uptr_t __user *)&entry->next, &next_pi); -- /* -- * A pending lock might already be on the list, so -- * dont process it twice: -- */ -- if (entry != pending) { -- void __user *uaddr = futex_uaddr(entry, futex_offset); -- -- if (handle_futex_death(uaddr, curr, pi)) -- return; -- } -- if (rc) -- return; -- uentry = next_uentry; -- entry = next_entry; -- pi = next_pi; -- /* -- * Avoid excessively long or circular lists: -- */ -- if (!--limit) -- break; -- -- cond_resched(); -- } -- if (pending) { -- void __user *uaddr = futex_uaddr(pending, futex_offset); -- -- handle_futex_death(uaddr, curr, pip); -- } --} -- --COMPAT_SYSCALL_DEFINE2(set_robust_list, -- struct compat_robust_list_head __user *, head, -- compat_size_t, len) --{ -- if (!futex_cmpxchg_enabled) -- return -ENOSYS; -- -- if (unlikely(len != sizeof(*head))) -- return -EINVAL; -- -- current->compat_robust_list = head; -- -- return 0; --} -- --COMPAT_SYSCALL_DEFINE3(get_robust_list, int, pid, -- compat_uptr_t __user *, head_ptr, -- compat_size_t __user *, len_ptr) --{ -- struct compat_robust_list_head __user *head; -- unsigned long ret; -- struct task_struct *p; -- -- if (!futex_cmpxchg_enabled) -- return -ENOSYS; -- -- rcu_read_lock(); -- -- ret = -ESRCH; -- if (!pid) -- p = current; -- else { -- p = find_task_by_vpid(pid); -- if (!p) -- goto err_unlock; -- } -- -- ret = -EPERM; -- if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS)) -- goto err_unlock; -- -- head = p->compat_robust_list; -- rcu_read_unlock(); -- -- if (put_user(sizeof(*head), len_ptr)) -- return -EFAULT; -- return put_user(ptr_to_compat(head), head_ptr); -- --err_unlock: -- rcu_read_unlock(); -- -- return ret; --} -- --COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val, -- struct compat_timespec __user *, utime, u32 __user *, uaddr2, -- u32, val3) --{ -- struct timespec ts; -- ktime_t t, *tp = NULL; -- int val2 = 0; -- int cmd = op & FUTEX_CMD_MASK; -- -- if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI || -- cmd == FUTEX_WAIT_BITSET || -- cmd == FUTEX_WAIT_REQUEUE_PI)) { -- if (compat_get_timespec(&ts, utime)) -- return -EFAULT; -- if (!timespec_valid(&ts)) -- return -EINVAL; -- -- t = timespec_to_ktime(ts); -- if (cmd == FUTEX_WAIT) -- t = ktime_add_safe(ktime_get(), t); -- tp = &t; -- } -- if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE || -- cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP) -- val2 = (int) (unsigned long) utime; -- -- return do_futex(uaddr, op, val, tp, uaddr2, val2, val3); --} -diff --git a/lib/genalloc.c b/lib/genalloc.c -index ca06adc4f445..7e85d1e37a6e 100644 ---- a/lib/genalloc.c -+++ b/lib/genalloc.c -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - - static inline size_t chunk_size(const struct gen_pool_chunk *chunk) - { -@@ -187,7 +188,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy - int nbytes = sizeof(struct gen_pool_chunk) + - BITS_TO_LONGS(nbits) * sizeof(long); - -- chunk = kzalloc_node(nbytes, GFP_KERNEL, nid); -+ chunk = vzalloc_node(nbytes, nid); - if (unlikely(chunk == NULL)) - return -ENOMEM; - -@@ -251,7 +252,7 @@ void gen_pool_destroy(struct gen_pool *pool) - bit = find_next_bit(chunk->bits, end_bit, 0); - BUG_ON(bit < end_bit); - -- kfree(chunk); -+ vfree(chunk); - } - kfree_const(pool->name); - kfree(pool); -@@ -311,7 +312,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size, - end_bit = chunk_size(chunk) >> order; - retry: - start_bit = algo(chunk->bits, end_bit, start_bit, -- nbits, data, pool); -+ nbits, data, pool, chunk->start_addr); - if (start_bit >= end_bit) - continue; - remain = bitmap_set_ll(chunk->bits, start_bit, nbits); -@@ -525,7 +526,7 @@ EXPORT_SYMBOL(gen_pool_set_algo); - */ - unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size, - unsigned long start, unsigned int nr, void *data, -- struct gen_pool *pool) -+ struct gen_pool *pool, unsigned long start_addr) - { - return bitmap_find_next_zero_area(map, size, start, nr, 0); - } -@@ -543,16 +544,19 @@ EXPORT_SYMBOL(gen_pool_first_fit); - */ - unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size, - unsigned long start, unsigned int nr, void *data, -- struct gen_pool *pool) -+ struct gen_pool *pool, unsigned long start_addr) - { - struct genpool_data_align *alignment; -- unsigned long align_mask; -+ unsigned long align_mask, align_off; - int order; - - alignment = data; - order = pool->min_alloc_order; - align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1; -- return bitmap_find_next_zero_area(map, size, start, nr, align_mask); -+ align_off = (start_addr & (alignment->align - 1)) >> order; -+ -+ return bitmap_find_next_zero_area_off(map, size, start, nr, -+ align_mask, align_off); - } - EXPORT_SYMBOL(gen_pool_first_fit_align); - -@@ -567,7 +571,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_align); - */ - unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size, - unsigned long start, unsigned int nr, void *data, -- struct gen_pool *pool) -+ struct gen_pool *pool, unsigned long start_addr) - { - struct genpool_data_fixed *fixed_data; - int order; -@@ -601,7 +605,8 @@ EXPORT_SYMBOL(gen_pool_fixed_alloc); - */ - unsigned long gen_pool_first_fit_order_align(unsigned long *map, - unsigned long size, unsigned long start, -- unsigned int nr, void *data, struct gen_pool *pool) -+ unsigned int nr, void *data, struct gen_pool *pool, -+ unsigned long start_addr) - { - unsigned long align_mask = roundup_pow_of_two(nr) - 1; - -@@ -624,7 +629,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align); - */ - unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size, - unsigned long start, unsigned int nr, void *data, -- struct gen_pool *pool) -+ struct gen_pool *pool, unsigned long start_addr) - { - unsigned long start_bit = size; - unsigned long len = size + 1; -diff --git a/lib/radix-tree.c b/lib/radix-tree.c -index d172f0341b80..ff00c816266b 100644 ---- a/lib/radix-tree.c -+++ b/lib/radix-tree.c -@@ -2184,7 +2184,7 @@ void __rcu **idr_get_free_cmn(struct radix_tree_root *root, - offset = radix_tree_find_next_bit(node, IDR_FREE, - offset + 1); - start = next_index(start, node, offset); -- if (start > max) -+ if (start > max || start == 0) - return ERR_PTR(-ENOSPC); - while (offset == RADIX_TREE_MAP_SIZE) { - offset = node->offset + 1; -diff --git a/mm/internal.h b/mm/internal.h -index 1df011f62480..a182506242c4 100644 ---- a/mm/internal.h -+++ b/mm/internal.h -@@ -455,6 +455,16 @@ static inline void mminit_validate_memmodel_limits(unsigned long *start_pfn, - #define NODE_RECLAIM_SOME 0 - #define NODE_RECLAIM_SUCCESS 1 - -+#ifdef CONFIG_NUMA -+extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int); -+#else -+static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask, -+ unsigned int order) -+{ -+ return NODE_RECLAIM_NOSCAN; -+} -+#endif -+ - extern int hwpoison_filter(struct page *p); - - extern u32 hwpoison_filter_dev_major; -diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c -index dfc86a0199da..1d8c834d9018 100644 ---- a/net/bridge/netfilter/ebt_dnat.c -+++ b/net/bridge/netfilter/ebt_dnat.c -@@ -19,7 +19,6 @@ static unsigned int - ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) - { - const struct ebt_nat_info *info = par->targinfo; -- struct net_device *dev; - - if (!skb_make_writable(skb, 0)) - return EBT_DROP; -@@ -32,10 +31,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) - else - skb->pkt_type = PACKET_MULTICAST; - } else { -- if (xt_hooknum(par) != NF_BR_BROUTING) -- dev = br_port_get_rcu(xt_in(par))->br->dev; -- else -+ const struct net_device *dev; -+ -+ switch (xt_hooknum(par)) { -+ case NF_BR_BROUTING: - dev = xt_in(par); -+ break; -+ case NF_BR_PRE_ROUTING: -+ dev = br_port_get_rcu(xt_in(par))->br->dev; -+ break; -+ default: -+ dev = NULL; -+ break; -+ } -+ -+ if (!dev) /* NF_BR_LOCAL_OUT */ -+ return info->target; - - if (ether_addr_equal(info->mac, dev->dev_addr)) - skb->pkt_type = PACKET_HOST; -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index eb3efeabac91..2664ad58e5c0 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -18,6 +18,7 @@ - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - - #include -+#include - #include - #include - #include -@@ -361,12 +362,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift) - ret = kmalloc(sizeof(*ret), GFP_ATOMIC); - if (!ret) - return NULL; -- if (size <= PAGE_SIZE) -+ if (size <= PAGE_SIZE) { - buckets = kzalloc(size, GFP_ATOMIC); -- else -+ } else { - buckets = (struct neighbour __rcu **) - __get_free_pages(GFP_ATOMIC | __GFP_ZERO, - get_order(size)); -+ kmemleak_alloc(buckets, size, 1, GFP_ATOMIC); -+ } - if (!buckets) { - kfree(ret); - return NULL; -@@ -386,10 +389,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head) - size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *); - struct neighbour __rcu **buckets = nht->hash_buckets; - -- if (size <= PAGE_SIZE) -+ if (size <= PAGE_SIZE) { - kfree(buckets); -- else -+ } else { -+ kmemleak_free(buckets); - free_pages((unsigned long)buckets, get_order(size)); -+ } - kfree(nht); - } - -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index 60b88718b1d4..1af25d53f63c 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -854,7 +854,8 @@ static int __init net_ns_init(void) - - mutex_unlock(&net_mutex); - -- register_pernet_subsys(&net_ns_ops); -+ if (register_pernet_subsys(&net_ns_ops)) -+ panic("Could not register network namespace subsystems"); - - rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, - RTNL_FLAG_DOIT_UNLOCKED); -diff --git a/net/core/sock.c b/net/core/sock.c -index 7ccbcd853cbc..90ccbbf9e6b0 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -2357,7 +2357,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind) - } - - if (sk_has_memory_pressure(sk)) { -- int alloc; -+ u64 alloc; - - if (!sk_under_memory_pressure(sk)) - return 1; -diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c -index df042b6d80b8..22876a197ebe 100644 ---- a/net/decnet/dn_dev.c -+++ b/net/decnet/dn_dev.c -@@ -56,7 +56,7 @@ - #include - #include - --#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn)) -+#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn)) - - static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00}; - static char dn_rt_all_rt_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x03,0x00,0x00}; -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index fabc299cb875..7a31287ff123 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -661,13 +661,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, - dst = tnl_params->daddr; - if (dst == 0) { - /* NBMA tunnel */ -+ struct ip_tunnel_info *tun_info; - - if (!skb_dst(skb)) { - dev->stats.tx_fifo_errors++; - goto tx_error; - } - -- if (skb->protocol == htons(ETH_P_IP)) { -+ tun_info = skb_tunnel_info(skb); -+ if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) && -+ ip_tunnel_info_af(tun_info) == AF_INET && -+ tun_info->key.u.ipv4.dst) -+ dst = tun_info->key.u.ipv4.dst; -+ else if (skb->protocol == htons(ETH_P_IP)) { - rt = skb_rtable(skb); - dst = rt_nexthop(rt, inner_iph->daddr); - } -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index f1b496222bda..1a86974b02e3 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -2313,7 +2313,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta) - { - struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta); - -- if (time_after(stats->last_rx, sta->status_stats.last_ack)) -+ if (!sta->status_stats.last_ack || -+ time_after(stats->last_rx, sta->status_stats.last_ack)) - return stats->last_rx; - return sta->status_stats.last_ack; - } -diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c -index 2de2a923ff2b..3248cf04d0b3 100644 ---- a/net/openvswitch/datapath.c -+++ b/net/openvswitch/datapath.c -@@ -724,9 +724,13 @@ static size_t ovs_flow_cmd_msg_size(const struct sw_flow_actions *acts, - { - size_t len = NLMSG_ALIGN(sizeof(struct ovs_header)); - -- /* OVS_FLOW_ATTR_UFID */ -+ /* OVS_FLOW_ATTR_UFID, or unmasked flow key as fallback -+ * see ovs_nla_put_identifier() -+ */ - if (sfid && ovs_identifier_is_ufid(sfid)) - len += nla_total_size(sfid->ufid_len); -+ else -+ len += nla_total_size(ovs_key_attr_size()); - - /* OVS_FLOW_ATTR_KEY */ - if (!sfid || should_fill_key(sfid, ufid_flags)) -@@ -902,7 +906,10 @@ static struct sk_buff *ovs_flow_cmd_build_info(const struct sw_flow *flow, - retval = ovs_flow_cmd_fill_info(flow, dp_ifindex, skb, - info->snd_portid, info->snd_seq, 0, - cmd, ufid_flags); -- BUG_ON(retval < 0); -+ if (WARN_ON_ONCE(retval < 0)) { -+ kfree_skb(skb); -+ skb = ERR_PTR(retval); -+ } - return skb; - } - -@@ -1365,7 +1372,10 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info) - OVS_FLOW_CMD_DEL, - ufid_flags); - rcu_read_unlock(); -- BUG_ON(err < 0); -+ if (WARN_ON_ONCE(err < 0)) { -+ kfree_skb(reply); -+ goto out_free; -+ } - - ovs_notify(&dp_flow_genl_family, reply, info); - } else { -@@ -1373,6 +1383,7 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info) - } - } - -+out_free: - ovs_flow_free(flow, true); - return 0; - unlock: -diff --git a/net/psample/psample.c b/net/psample/psample.c -index 4cea353221da..30e8239bd774 100644 ---- a/net/psample/psample.c -+++ b/net/psample/psample.c -@@ -223,7 +223,7 @@ void psample_sample_packet(struct psample_group *group, struct sk_buff *skb, - data_len = PSAMPLE_MAX_PACKET_SIZE - meta_len - NLA_HDRLEN - - NLA_ALIGNTO; - -- nl_skb = genlmsg_new(meta_len + data_len, GFP_ATOMIC); -+ nl_skb = genlmsg_new(meta_len + nla_total_size(data_len), GFP_ATOMIC); - if (unlikely(!nl_skb)) - return; - -diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c -index f3a3e507422b..442ac9c3f16f 100644 ---- a/net/sched/sch_mq.c -+++ b/net/sched/sch_mq.c -@@ -191,7 +191,8 @@ static int mq_dump_class_stats(struct Qdisc *sch, unsigned long cl, - struct netdev_queue *dev_queue = mq_queue_get(sch, cl); - - sch = dev_queue->qdisc_sleeping; -- if (gnet_stats_copy_basic(&sch->running, d, NULL, &sch->bstats) < 0 || -+ if (gnet_stats_copy_basic(&sch->running, d, sch->cpu_bstats, -+ &sch->bstats) < 0 || - gnet_stats_copy_queue(d, NULL, &sch->qstats, sch->q.qlen) < 0) - return -1; - return 0; -diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c -index 6bcdfe6e7b63..bb8d3fbc13bb 100644 ---- a/net/sched/sch_mqprio.c -+++ b/net/sched/sch_mqprio.c -@@ -366,8 +366,8 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl, - struct netdev_queue *dev_queue = mqprio_queue_get(sch, cl); - - sch = dev_queue->qdisc_sleeping; -- if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), -- d, NULL, &sch->bstats) < 0 || -+ if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), d, -+ sch->cpu_bstats, &sch->bstats) < 0 || - gnet_stats_copy_queue(d, NULL, - &sch->qstats, sch->q.qlen) < 0) - return -1; -diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c -index ff4fc3e0facd..65aa03d46857 100644 ---- a/net/sched/sch_multiq.c -+++ b/net/sched/sch_multiq.c -@@ -340,7 +340,7 @@ static int multiq_dump_class_stats(struct Qdisc *sch, unsigned long cl, - - cl_q = q->queues[cl - 1]; - if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), -- d, NULL, &cl_q->bstats) < 0 || -+ d, cl_q->cpu_bstats, &cl_q->bstats) < 0 || - gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0) - return -1; - -diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c -index 2dd6c68ae91e..c60777351de1 100644 ---- a/net/sched/sch_prio.c -+++ b/net/sched/sch_prio.c -@@ -298,7 +298,7 @@ static int prio_dump_class_stats(struct Qdisc *sch, unsigned long cl, - - cl_q = q->queues[cl - 1]; - if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), -- d, NULL, &cl_q->bstats) < 0 || -+ d, cl_q->cpu_bstats, &cl_q->bstats) < 0 || - gnet_stats_copy_queue(d, NULL, &cl_q->qstats, cl_q->q.qlen) < 0) - return -1; - -diff --git a/net/sctp/associola.c b/net/sctp/associola.c -index 23fec3817e0c..dd1a3bd80be5 100644 ---- a/net/sctp/associola.c -+++ b/net/sctp/associola.c -@@ -80,6 +80,7 @@ static struct sctp_association *sctp_association_init( - /* Discarding const is appropriate here. */ - asoc->ep = (struct sctp_endpoint *)ep; - asoc->base.sk = (struct sock *)sk; -+ asoc->base.net = sock_net(sk); - - sctp_endpoint_hold(asoc->ep); - sock_hold(asoc->base.sk); -diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c -index 5d4079ef3de6..c71b4191df1e 100644 ---- a/net/sctp/endpointola.c -+++ b/net/sctp/endpointola.c -@@ -165,6 +165,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep, - - /* Remember who we are attached to. */ - ep->base.sk = sk; -+ ep->base.net = sock_net(sk); - sock_hold(ep->base.sk); - - return ep; -diff --git a/net/sctp/input.c b/net/sctp/input.c -index 0247cc432e02..3c0affecf272 100644 ---- a/net/sctp/input.c -+++ b/net/sctp/input.c -@@ -813,7 +813,7 @@ static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg, - if (!sctp_transport_hold(t)) - return err; - -- if (!net_eq(sock_net(t->asoc->base.sk), x->net)) -+ if (!net_eq(t->asoc->base.net, x->net)) - goto out; - if (x->lport != htons(t->asoc->base.bind_addr.port)) - goto out; -@@ -828,7 +828,7 @@ static inline __u32 sctp_hash_obj(const void *data, u32 len, u32 seed) - { - const struct sctp_transport *t = data; - const union sctp_addr *paddr = &t->ipaddr; -- const struct net *net = sock_net(t->asoc->base.sk); -+ const struct net *net = t->asoc->base.net; - __be16 lport = htons(t->asoc->base.bind_addr.port); - __u32 addr; - -diff --git a/net/sctp/transport.c b/net/sctp/transport.c -index 43105cf04bc4..274df899e7bf 100644 ---- a/net/sctp/transport.c -+++ b/net/sctp/transport.c -@@ -210,7 +210,8 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport) - - /* When a data chunk is sent, reset the heartbeat interval. */ - expires = jiffies + sctp_transport_timeout(transport); -- if (time_before(transport->hb_timer.expires, expires) && -+ if ((time_before(transport->hb_timer.expires, expires) || -+ !timer_pending(&transport->hb_timer)) && - !mod_timer(&transport->hb_timer, - expires + prandom_u32_max(transport->rto))) - sctp_transport_hold(transport); -diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c -index f04a037dc967..0de788fa43e9 100644 ---- a/net/smc/smc_core.c -+++ b/net/smc/smc_core.c -@@ -103,6 +103,8 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn) - struct smc_link_group *lgr = conn->lgr; - int reduced = 0; - -+ if (!lgr) -+ return; - write_lock_bh(&lgr->conns_lock); - if (conn->alert_token_local) { - reduced = 1; -@@ -431,6 +433,8 @@ int smc_conn_create(struct smc_sock *smc, __be32 peer_in_addr, - local_contact = SMC_REUSE_CONTACT; - conn->lgr = lgr; - smc_lgr_register_conn(conn); /* add smc conn to lgr */ -+ if (delayed_work_pending(&lgr->free_work)) -+ cancel_delayed_work(&lgr->free_work); - write_unlock_bh(&lgr->conns_lock); - break; - } -diff --git a/net/tipc/link.c b/net/tipc/link.c -index 631bfc7e9127..da749916faac 100644 ---- a/net/tipc/link.c -+++ b/net/tipc/link.c -@@ -1073,7 +1073,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb, - default: - pr_warn("Dropping received illegal msg type\n"); - kfree_skb(skb); -- return false; -+ return true; - }; - } - -diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c -index ad4dcc663c6d..fa0522cd683e 100644 ---- a/net/tipc/netlink_compat.c -+++ b/net/tipc/netlink_compat.c -@@ -539,7 +539,7 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg, - if (len <= 0) - return -EINVAL; - -- len = min_t(int, len, TIPC_MAX_BEARER_NAME); -+ len = min_t(int, len, TIPC_MAX_LINK_NAME); - if (!string_is_valid(name, len)) - return -EINVAL; - -@@ -821,7 +821,7 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd, - if (len <= 0) - return -EINVAL; - -- len = min_t(int, len, TIPC_MAX_BEARER_NAME); -+ len = min_t(int, len, TIPC_MAX_LINK_NAME); - if (!string_is_valid(name, len)) - return -EINVAL; - -@@ -974,6 +974,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock) - - hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI, - TIPC_NL_PUBL_GET); -+ if (!hdr) { -+ kfree_skb(args); -+ return -EMSGSIZE; -+ } - - nest = nla_nest_start(args, TIPC_NLA_SOCK); - if (!nest) { -@@ -1021,8 +1025,11 @@ static int tipc_nl_compat_sk_dump(struct tipc_nl_compat_msg *msg, - u32 node; - struct nlattr *con[TIPC_NLA_CON_MAX + 1]; - -- nla_parse_nested(con, TIPC_NLA_CON_MAX, -- sock[TIPC_NLA_SOCK_CON], NULL, NULL); -+ err = nla_parse_nested(con, TIPC_NLA_CON_MAX, -+ sock[TIPC_NLA_SOCK_CON], NULL, NULL); -+ -+ if (err) -+ return err; - - node = nla_get_u32(con[TIPC_NLA_CON_NODE]); - tipc_tlv_sprintf(msg->rep, " connected to <%u.%u.%u:%u>", -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index 1939b77e98b7..73eac97e19fb 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -107,6 +107,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -487,9 +488,13 @@ out: - static int __vsock_bind_stream(struct vsock_sock *vsk, - struct sockaddr_vm *addr) - { -- static u32 port = LAST_RESERVED_PORT + 1; -+ static u32 port = 0; - struct sockaddr_vm new_addr; - -+ if (!port) -+ port = LAST_RESERVED_PORT + 1 + -+ prandom_u32_max(U32_MAX - LAST_RESERVED_PORT); -+ - vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port); - - if (addr->svm_port == VMADDR_PORT_ANY) { -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index bd16e6882017..190ca59d5ba3 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -449,6 +449,8 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x) - x->type->destructor(x); - xfrm_put_type(x->type); - } -+ if (x->xfrag.page) -+ put_page(x->xfrag.page); - xfrm_dev_state_free(x); - security_xfrm_state_free(x); - kfree(x); -diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c -index ca495686b9c3..f8c7249fa705 100644 ---- a/samples/vfio-mdev/mtty.c -+++ b/samples/vfio-mdev/mtty.c -@@ -171,7 +171,7 @@ static struct mdev_state *find_mdev_state_by_uuid(uuid_le uuid) - return NULL; - } - --void dump_buffer(char *buf, uint32_t count) -+void dump_buffer(u8 *buf, uint32_t count) - { - #if defined(DEBUG) - int i; -@@ -250,7 +250,7 @@ static void mtty_create_config_space(struct mdev_state *mdev_state) - } - - static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset, -- char *buf, u32 count) -+ u8 *buf, u32 count) - { - u32 cfg_addr, bar_mask, bar_index = 0; - -@@ -304,7 +304,7 @@ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset, - } - - static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state, -- u16 offset, char *buf, u32 count) -+ u16 offset, u8 *buf, u32 count) - { - u8 data = *buf; - -@@ -475,7 +475,7 @@ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state, - } - - static void handle_bar_read(unsigned int index, struct mdev_state *mdev_state, -- u16 offset, char *buf, u32 count) -+ u16 offset, u8 *buf, u32 count) - { - /* Handle read requests by guest */ - switch (offset) { -@@ -650,7 +650,7 @@ static void mdev_read_base(struct mdev_state *mdev_state) - } - } - --static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, -+static ssize_t mdev_access(struct mdev_device *mdev, u8 *buf, size_t count, - loff_t pos, bool is_write) - { - struct mdev_state *mdev_state; -@@ -698,7 +698,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, - #if defined(DEBUG_REGS) - pr_info("%s: BAR%d WR @0x%llx %s val:0x%02x dlab:%d\n", - __func__, index, offset, wr_reg[offset], -- (u8)*buf, mdev_state->s[index].dlab); -+ *buf, mdev_state->s[index].dlab); - #endif - handle_bar_write(index, mdev_state, offset, buf, count); - } else { -@@ -708,7 +708,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, - #if defined(DEBUG_REGS) - pr_info("%s: BAR%d RD @0x%llx %s val:0x%02x dlab:%d\n", - __func__, index, offset, rd_reg[offset], -- (u8)*buf, mdev_state->s[index].dlab); -+ *buf, mdev_state->s[index].dlab); - #endif - } - break; -@@ -827,7 +827,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count, - if (count >= 4 && !(*ppos % 4)) { - u32 val; - -- ret = mdev_access(mdev, (char *)&val, sizeof(val), -+ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), - *ppos, false); - if (ret <= 0) - goto read_err; -@@ -839,7 +839,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count, - } else if (count >= 2 && !(*ppos % 2)) { - u16 val; - -- ret = mdev_access(mdev, (char *)&val, sizeof(val), -+ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), - *ppos, false); - if (ret <= 0) - goto read_err; -@@ -851,7 +851,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count, - } else { - u8 val; - -- ret = mdev_access(mdev, (char *)&val, sizeof(val), -+ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), - *ppos, false); - if (ret <= 0) - goto read_err; -@@ -889,7 +889,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, - if (copy_from_user(&val, buf, sizeof(val))) - goto write_err; - -- ret = mdev_access(mdev, (char *)&val, sizeof(val), -+ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), - *ppos, true); - if (ret <= 0) - goto write_err; -@@ -901,7 +901,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, - if (copy_from_user(&val, buf, sizeof(val))) - goto write_err; - -- ret = mdev_access(mdev, (char *)&val, sizeof(val), -+ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), - *ppos, true); - if (ret <= 0) - goto write_err; -@@ -913,7 +913,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf, - if (copy_from_user(&val, buf, sizeof(val))) - goto write_err; - -- ret = mdev_access(mdev, (char *)&val, sizeof(val), -+ ret = mdev_access(mdev, (u8 *)&val, sizeof(val), - *ppos, true); - if (ret <= 0) - goto write_err; -diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py -index 004b0ac7fa72..4644f1a83b57 100644 ---- a/scripts/gdb/linux/symbols.py -+++ b/scripts/gdb/linux/symbols.py -@@ -99,7 +99,8 @@ lx-symbols command.""" - attrs[n]['name'].string(): attrs[n]['address'] - for n in range(int(sect_attrs['nsections']))} - args = [] -- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]: -+ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss", -+ ".text", ".text.hot", ".text.unlikely"]: - address = section_name_to_address.get(section_name) - if address: - args.append(" -s {name} {addr}".format( -diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c -index dd746bd69a9b..c106988c1b25 100644 ---- a/security/apparmor/apparmorfs.c -+++ b/security/apparmor/apparmorfs.c -@@ -363,6 +363,7 @@ static void aafs_remove(struct dentry *dentry) - simple_rmdir(dir, dentry); - else - simple_unlink(dir, dentry); -+ d_delete(dentry); - dput(dentry); - } - inode_unlock(dir); -diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c -index 2e2d18468491..7ae8e24dc1e6 100644 ---- a/sound/core/compress_offload.c -+++ b/sound/core/compress_offload.c -@@ -529,7 +529,7 @@ static int snd_compress_check_input(struct snd_compr_params *params) - { - /* first let's check the buffer parameter's */ - if (params->buffer.fragment_size == 0 || -- params->buffer.fragments > INT_MAX / params->buffer.fragment_size || -+ params->buffer.fragments > U32_MAX / params->buffer.fragment_size || - params->buffer.fragments == 0) - return -EINVAL; - -diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c -index 0b9b014b4bb6..969283737787 100644 ---- a/sound/soc/codecs/msm8916-wcd-analog.c -+++ b/sound/soc/codecs/msm8916-wcd-analog.c -@@ -303,7 +303,7 @@ struct pm8916_wcd_analog_priv { - }; - - static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" }; --static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" }; -+static const char *const rdac2_mux_text[] = { "RX1", "RX2" }; - static const char *const hph_text[] = { "ZERO", "Switch", }; - - static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT( -@@ -318,7 +318,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT( - - /* RDAC2 MUX */ - static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE( -- CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text); -+ CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text); - - static const struct snd_kcontrol_new spkr_switch[] = { - SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0) -diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c -index 105a73cc5158..149b7cba10fb 100644 ---- a/sound/soc/kirkwood/kirkwood-i2s.c -+++ b/sound/soc/kirkwood/kirkwood-i2s.c -@@ -569,10 +569,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev) - return PTR_ERR(priv->clk); - } - -- err = clk_prepare_enable(priv->clk); -- if (err < 0) -- return err; -- - priv->extclk = devm_clk_get(&pdev->dev, "extclk"); - if (IS_ERR(priv->extclk)) { - if (PTR_ERR(priv->extclk) == -EPROBE_DEFER) -@@ -588,6 +584,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev) - } - } - -+ err = clk_prepare_enable(priv->clk); -+ if (err < 0) -+ return err; -+ - /* Some sensible defaults - this reflects the powerup values */ - priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24; - priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24; -diff --git a/sound/soc/stm/stm32_i2s.c b/sound/soc/stm/stm32_i2s.c -index 6d0bf78d114d..aa2b1196171a 100644 ---- a/sound/soc/stm/stm32_i2s.c -+++ b/sound/soc/stm/stm32_i2s.c -@@ -246,8 +246,8 @@ static irqreturn_t stm32_i2s_isr(int irq, void *devid) - return IRQ_NONE; - } - -- regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG, -- I2S_IFCR_MASK, flags); -+ regmap_write_bits(i2s->regmap, STM32_I2S_IFCR_REG, -+ I2S_IFCR_MASK, flags); - - if (flags & I2S_SR_OVR) { - dev_dbg(&pdev->dev, "Overrun\n"); -@@ -276,7 +276,6 @@ static bool stm32_i2s_readable_reg(struct device *dev, unsigned int reg) - case STM32_I2S_CFG2_REG: - case STM32_I2S_IER_REG: - case STM32_I2S_SR_REG: -- case STM32_I2S_IFCR_REG: - case STM32_I2S_TXDR_REG: - case STM32_I2S_RXDR_REG: - case STM32_I2S_CGFR_REG: -@@ -488,7 +487,7 @@ static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai, - { - struct stm32_i2s_data *i2s = snd_soc_dai_get_drvdata(cpu_dai); - int format = params_width(params); -- u32 cfgr, cfgr_mask, cfg1, cfg1_mask; -+ u32 cfgr, cfgr_mask, cfg1; - unsigned int fthlv; - int ret; - -@@ -501,7 +500,7 @@ static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai, - switch (format) { - case 16: - cfgr = I2S_CGFR_DATLEN_SET(I2S_I2SMOD_DATLEN_16); -- cfgr_mask = I2S_CGFR_DATLEN_MASK; -+ cfgr_mask = I2S_CGFR_DATLEN_MASK | I2S_CGFR_CHLEN; - break; - case 32: - cfgr = I2S_CGFR_DATLEN_SET(I2S_I2SMOD_DATLEN_32) | -@@ -529,15 +528,11 @@ static int stm32_i2s_configure(struct snd_soc_dai *cpu_dai, - if (ret < 0) - return ret; - -- cfg1 = I2S_CFG1_RXDMAEN | I2S_CFG1_TXDMAEN; -- cfg1_mask = cfg1; -- - fthlv = STM32_I2S_FIFO_SIZE * I2S_FIFO_TH_ONE_QUARTER / 4; -- cfg1 |= I2S_CFG1_FTHVL_SET(fthlv - 1); -- cfg1_mask |= I2S_CFG1_FTHVL_MASK; -+ cfg1 = I2S_CFG1_FTHVL_SET(fthlv - 1); - - return regmap_update_bits(i2s->regmap, STM32_I2S_CFG1_REG, -- cfg1_mask, cfg1); -+ I2S_CFG1_FTHVL_MASK, cfg1); - } - - static int stm32_i2s_startup(struct snd_pcm_substream *substream, -@@ -551,8 +546,8 @@ static int stm32_i2s_startup(struct snd_pcm_substream *substream, - i2s->refcount++; - spin_unlock(&i2s->lock_fd); - -- return regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG, -- I2S_IFCR_MASK, I2S_IFCR_MASK); -+ return regmap_write_bits(i2s->regmap, STM32_I2S_IFCR_REG, -+ I2S_IFCR_MASK, I2S_IFCR_MASK); - } - - static int stm32_i2s_hw_params(struct snd_pcm_substream *substream, -@@ -589,6 +584,10 @@ static int stm32_i2s_trigger(struct snd_pcm_substream *substream, int cmd, - /* Enable i2s */ - dev_dbg(cpu_dai->dev, "start I2S\n"); - -+ cfg1_mask = I2S_CFG1_RXDMAEN | I2S_CFG1_TXDMAEN; -+ regmap_update_bits(i2s->regmap, STM32_I2S_CFG1_REG, -+ cfg1_mask, cfg1_mask); -+ - ret = regmap_update_bits(i2s->regmap, STM32_I2S_CR1_REG, - I2S_CR1_SPE, I2S_CR1_SPE); - if (ret < 0) { -@@ -603,8 +602,8 @@ static int stm32_i2s_trigger(struct snd_pcm_substream *substream, int cmd, - return ret; - } - -- regmap_update_bits(i2s->regmap, STM32_I2S_IFCR_REG, -- I2S_IFCR_MASK, I2S_IFCR_MASK); -+ regmap_write_bits(i2s->regmap, STM32_I2S_IFCR_REG, -+ I2S_IFCR_MASK, I2S_IFCR_MASK); - - if (playback_flg) { - ier = I2S_IER_UDRIE; -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index cdaacdf7bc87..deff4b3eb972 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -3989,7 +3989,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm) - } - add_uevent_var(env, "PID=%d", kvm->userspace_pid); - -- if (kvm->debugfs_dentry) { -+ if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) { - char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL); - - if (p) { diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.158-159.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.158-159.patch deleted file mode 100644 index b9bf3342f2..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.158-159.patch +++ /dev/null @@ -1,7973 +0,0 @@ -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index b0da6050a254..933465eff40e 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -4693,13 +4693,13 @@ - Flags is a set of characters, each corresponding - to a common usb-storage quirk flag as follows: - a = SANE_SENSE (collect more than 18 bytes -- of sense data); -+ of sense data, not on uas); - b = BAD_SENSE (don't collect more than 18 -- bytes of sense data); -+ bytes of sense data, not on uas); - c = FIX_CAPACITY (decrease the reported - device capacity by one sector); - d = NO_READ_DISC_INFO (don't use -- READ_DISC_INFO command); -+ READ_DISC_INFO command, not on uas); - e = NO_READ_CAPACITY_16 (don't use - READ_CAPACITY_16 command); - f = NO_REPORT_OPCODES (don't use report opcodes -@@ -4714,17 +4714,18 @@ - j = NO_REPORT_LUNS (don't use report luns - command, uas only); - l = NOT_LOCKABLE (don't try to lock and -- unlock ejectable media); -+ unlock ejectable media, not on uas); - m = MAX_SECTORS_64 (don't transfer more -- than 64 sectors = 32 KB at a time); -+ than 64 sectors = 32 KB at a time, -+ not on uas); - n = INITIAL_READ10 (force a retry of the -- initial READ(10) command); -+ initial READ(10) command, not on uas); - o = CAPACITY_OK (accept the capacity -- reported by the device); -+ reported by the device, not on uas); - p = WRITE_CACHE (the device cache is ON -- by default); -+ by default, not on uas); - r = IGNORE_RESIDUE (the device reports -- bogus residue values); -+ bogus residue values, not on uas); - s = SINGLE_LUN (the device has only one - Logical Unit); - t = NO_ATA_1X (don't allow ATA(12) and ATA(16) -@@ -4733,7 +4734,8 @@ - w = NO_WP_DETECT (don't test whether the - medium is write-protected). - y = ALWAYS_SYNC (issue a SYNCHRONIZE_CACHE -- even if the device claims no cache) -+ even if the device claims no cache, -+ not on uas) - Example: quirks=0419:aaf5:rl,0421:0433:rc - - user_debug= [KNL,ARM] -diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt -index be789685a1c2..18b892d010d8 100644 ---- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt -+++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt -@@ -27,4 +27,4 @@ and valid to enable charging: - - - "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V) - - "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output -- resistor, the other values are in ohm. -+ resistor, the other values are in kOhm. -diff --git a/Makefile b/Makefile -index d97288c0754f..e14ad8f064ec 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 158 -+SUBLEVEL = 159 - EXTRAVERSION = - NAME = Petit Gorille - -@@ -1529,9 +1529,6 @@ else # KBUILD_EXTMOD - - # We are always building modules - KBUILD_MODULES := 1 --PHONY += crmodverdir --crmodverdir: -- $(cmd_crmodverdir) - - PHONY += $(objtree)/Module.symvers - $(objtree)/Module.symvers: -@@ -1543,7 +1540,7 @@ $(objtree)/Module.symvers: - - module-dirs := $(addprefix _module_,$(KBUILD_EXTMOD)) - PHONY += $(module-dirs) modules --$(module-dirs): crmodverdir $(objtree)/Module.symvers -+$(module-dirs): prepare $(objtree)/Module.symvers - $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) - - modules: $(module-dirs) -@@ -1584,7 +1581,8 @@ help: - - # Dummies... - PHONY += prepare scripts --prepare: ; -+prepare: -+ $(cmd_crmodverdir) - scripts: ; - endif # KBUILD_EXTMOD - -@@ -1709,17 +1707,14 @@ endif - - # Modules - /: prepare scripts FORCE -- $(cmd_crmodverdir) - $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ - $(build)=$(build-dir) - # Make sure the latest headers are built for Documentation - Documentation/ samples/: headers_install - %/: prepare scripts FORCE -- $(cmd_crmodverdir) - $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ - $(build)=$(build-dir) - %.ko: prepare scripts FORCE -- $(cmd_crmodverdir) - $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ - $(build)=$(build-dir) $(@:.ko=.o) - $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost -diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug -index fd4b679945d3..b14f154919a5 100644 ---- a/arch/arm/Kconfig.debug -+++ b/arch/arm/Kconfig.debug -@@ -1023,14 +1023,21 @@ choice - Say Y here if you want kernel low-level debugging support - on SOCFPGA(Cyclone 5 and Arria 5) based platforms. - -- config DEBUG_SOCFPGA_UART1 -+ config DEBUG_SOCFPGA_ARRIA10_UART1 - depends on ARCH_SOCFPGA -- bool "Use SOCFPGA UART1 for low-level debug" -+ bool "Use SOCFPGA Arria10 UART1 for low-level debug" - select DEBUG_UART_8250 - help - Say Y here if you want kernel low-level debugging support - on SOCFPGA(Arria 10) based platforms. - -+ config DEBUG_SOCFPGA_CYCLONE5_UART1 -+ depends on ARCH_SOCFPGA -+ bool "Use SOCFPGA Cyclone 5 UART1 for low-level debug" -+ select DEBUG_UART_8250 -+ help -+ Say Y here if you want kernel low-level debugging support -+ on SOCFPGA(Cyclone 5 and Arria 5) based platforms. - - config DEBUG_SUN9I_UART0 - bool "Kernel low-level debugging messages via sun9i UART0" -@@ -1585,7 +1592,8 @@ config DEBUG_UART_PHYS - default 0xfe800000 if ARCH_IOP32X - default 0xff690000 if DEBUG_RK32_UART2 - default 0xffc02000 if DEBUG_SOCFPGA_UART0 -- default 0xffc02100 if DEBUG_SOCFPGA_UART1 -+ default 0xffc02100 if DEBUG_SOCFPGA_ARRIA10_UART1 -+ default 0xffc03000 if DEBUG_SOCFPGA_CYCLONE5_UART1 - default 0xffd82340 if ARCH_IOP13XX - default 0xffe40000 if DEBUG_RCAR_GEN1_SCIF0 - default 0xffe42000 if DEBUG_RCAR_GEN1_SCIF2 -@@ -1689,7 +1697,8 @@ config DEBUG_UART_VIRT - default 0xfeb30c00 if DEBUG_KEYSTONE_UART0 - default 0xfeb31000 if DEBUG_KEYSTONE_UART1 - default 0xfec02000 if DEBUG_SOCFPGA_UART0 -- default 0xfec02100 if DEBUG_SOCFPGA_UART1 -+ default 0xfec02100 if DEBUG_SOCFPGA_ARRIA10_UART1 -+ default 0xfec03000 if DEBUG_SOCFPGA_CYCLONE5_UART1 - default 0xfec12000 if (DEBUG_MVEBU_UART0 || DEBUG_MVEBU_UART0_ALTERNATE) && ARCH_MVEBU - default 0xfec12100 if DEBUG_MVEBU_UART1_ALTERNATE - default 0xfec10000 if DEBUG_SIRFATLAS7_UART0 -@@ -1737,9 +1746,9 @@ config DEBUG_UART_8250_WORD - depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250 - depends on DEBUG_UART_8250_SHIFT >= 2 - default y if DEBUG_PICOXCELL_UART || \ -- DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_UART1 || \ -- DEBUG_KEYSTONE_UART0 || DEBUG_KEYSTONE_UART1 || \ -- DEBUG_ALPINE_UART0 || \ -+ DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_ARRIA10_UART1 || \ -+ DEBUG_SOCFPGA_CYCLONE5_UART1 || DEBUG_KEYSTONE_UART0 || \ -+ DEBUG_KEYSTONE_UART1 || DEBUG_ALPINE_UART0 || \ - DEBUG_DAVINCI_DMx_UART0 || DEBUG_DAVINCI_DA8XX_UART1 || \ - DEBUG_DAVINCI_DA8XX_UART2 || \ - DEBUG_BCM_KONA_UART || DEBUG_RK32_UART2 -diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts -index c1fd5615ddfe..939c108c24a6 100644 ---- a/arch/arm/boot/dts/arm-realview-pb1176.dts -+++ b/arch/arm/boot/dts/arm-realview-pb1176.dts -@@ -45,7 +45,7 @@ - }; - - /* The voltage to the MMC card is hardwired at 3.3V */ -- vmmc: fixedregulator@0 { -+ vmmc: regulator-vmmc { - compatible = "regulator-fixed"; - regulator-name = "vmmc"; - regulator-min-microvolt = <3300000>; -@@ -53,7 +53,7 @@ - regulator-boot-on; - }; - -- veth: fixedregulator@0 { -+ veth: regulator-veth { - compatible = "regulator-fixed"; - regulator-name = "veth"; - regulator-min-microvolt = <3300000>; -diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts -index e306f1cceb4e..95037c48182d 100644 ---- a/arch/arm/boot/dts/arm-realview-pb11mp.dts -+++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts -@@ -145,7 +145,7 @@ - }; - - /* The voltage to the MMC card is hardwired at 3.3V */ -- vmmc: fixedregulator@0 { -+ vmmc: regulator-vmmc { - compatible = "regulator-fixed"; - regulator-name = "vmmc"; - regulator-min-microvolt = <3300000>; -@@ -153,7 +153,7 @@ - regulator-boot-on; - }; - -- veth: fixedregulator@0 { -+ veth: regulator-veth { - compatible = "regulator-fixed"; - regulator-name = "veth"; - regulator-min-microvolt = <3300000>; -diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi -index 2bf3958b2e6b..068293254fbb 100644 ---- a/arch/arm/boot/dts/arm-realview-pbx.dtsi -+++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi -@@ -43,7 +43,7 @@ - }; - - /* The voltage to the MMC card is hardwired at 3.3V */ -- vmmc: fixedregulator@0 { -+ vmmc: regulator-vmmc { - compatible = "regulator-fixed"; - regulator-name = "vmmc"; - regulator-min-microvolt = <3300000>; -@@ -51,7 +51,7 @@ - regulator-boot-on; - }; - -- veth: fixedregulator@0 { -+ veth: regulator-veth { - compatible = "regulator-fixed"; - regulator-name = "veth"; - regulator-min-microvolt = <3300000>; -@@ -539,4 +539,3 @@ - }; - }; - }; -- -diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi -index aa06a02c3ff5..5ba662254909 100644 ---- a/arch/arm/boot/dts/exynos3250.dtsi -+++ b/arch/arm/boot/dts/exynos3250.dtsi -@@ -359,7 +359,7 @@ - }; - - hsotg: hsotg@12480000 { -- compatible = "snps,dwc2"; -+ compatible = "samsung,s3c6400-hsotg", "snps,dwc2"; - reg = <0x12480000 0x20000>; - interrupts = ; - clocks = <&cmu CLK_USBOTG>; -diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi -index 47e5b63339d1..e95deed6a797 100644 ---- a/arch/arm/boot/dts/mmp2.dtsi -+++ b/arch/arm/boot/dts/mmp2.dtsi -@@ -180,7 +180,7 @@ - clocks = <&soc_clocks MMP2_CLK_GPIO>; - resets = <&soc_clocks MMP2_CLK_GPIO>; - interrupt-controller; -- #interrupt-cells = <1>; -+ #interrupt-cells = <2>; - ranges; - - gcb0: gpio@d4019000 { -diff --git a/arch/arm/boot/dts/omap3-pandora-common.dtsi b/arch/arm/boot/dts/omap3-pandora-common.dtsi -index 53e007abdc71..964240a0f4a9 100644 ---- a/arch/arm/boot/dts/omap3-pandora-common.dtsi -+++ b/arch/arm/boot/dts/omap3-pandora-common.dtsi -@@ -221,6 +221,17 @@ - gpio = <&gpio6 4 GPIO_ACTIVE_HIGH>; /* GPIO_164 */ - }; - -+ /* wl1251 wifi+bt module */ -+ wlan_en: fixed-regulator-wg7210_en { -+ compatible = "regulator-fixed"; -+ regulator-name = "vwlan"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ startup-delay-us = <50000>; -+ enable-active-high; -+ gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>; -+ }; -+ - /* wg7210 (wifi+bt module) 32k clock buffer */ - wg7210_32k: fixed-regulator-wg7210_32k { - compatible = "regulator-fixed"; -@@ -514,9 +525,30 @@ - /*wp-gpios = <&gpio4 31 GPIO_ACTIVE_HIGH>;*/ /* GPIO_127 */ - }; - --/* mmc3 is probed using pdata-quirks to pass wl1251 card data */ - &mmc3 { -- status = "disabled"; -+ vmmc-supply = <&wlan_en>; -+ -+ bus-width = <4>; -+ non-removable; -+ ti,non-removable; -+ cap-power-off-card; -+ -+ pinctrl-names = "default"; -+ pinctrl-0 = <&mmc3_pins>; -+ -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ wlan: wifi@1 { -+ compatible = "ti,wl1251"; -+ -+ reg = <1>; -+ -+ interrupt-parent = <&gpio1>; -+ interrupts = <21 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_21 */ -+ -+ ti,wl1251-has-eeprom; -+ }; - }; - - /* bluetooth*/ -diff --git a/arch/arm/boot/dts/omap3-tao3530.dtsi b/arch/arm/boot/dts/omap3-tao3530.dtsi -index 9a601d15247b..5b7bda74752b 100644 ---- a/arch/arm/boot/dts/omap3-tao3530.dtsi -+++ b/arch/arm/boot/dts/omap3-tao3530.dtsi -@@ -224,7 +224,7 @@ - pinctrl-0 = <&mmc1_pins>; - vmmc-supply = <&vmmc1>; - vqmmc-supply = <&vsim>; -- cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_HIGH>; -+ cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>; - bus-width = <8>; - }; - -diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi -index 3228ad5fb725..ccbecad9c5c7 100644 ---- a/arch/arm/boot/dts/pxa27x.dtsi -+++ b/arch/arm/boot/dts/pxa27x.dtsi -@@ -35,7 +35,7 @@ - clocks = <&clks CLK_NONE>; - }; - -- pxa27x_ohci: usb@4c000000 { -+ usb0: usb@4c000000 { - compatible = "marvell,pxa-ohci"; - reg = <0x4c000000 0x10000>; - interrupts = <3>; -diff --git a/arch/arm/boot/dts/pxa2xx.dtsi b/arch/arm/boot/dts/pxa2xx.dtsi -index e4ebcde17837..a03bca81ae8a 100644 ---- a/arch/arm/boot/dts/pxa2xx.dtsi -+++ b/arch/arm/boot/dts/pxa2xx.dtsi -@@ -117,13 +117,6 @@ - status = "disabled"; - }; - -- usb0: ohci@4c000000 { -- compatible = "marvell,pxa-ohci"; -- reg = <0x4c000000 0x10000>; -- interrupts = <3>; -- status = "disabled"; -- }; -- - mmc0: mmc@41100000 { - compatible = "marvell,pxa-mmc"; - reg = <0x41100000 0x1000>; -diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi -index 55c75b67351c..affa5b6f6da1 100644 ---- a/arch/arm/boot/dts/pxa3xx.dtsi -+++ b/arch/arm/boot/dts/pxa3xx.dtsi -@@ -189,7 +189,7 @@ - status = "disabled"; - }; - -- pxa3xx_ohci: usb@4c000000 { -+ usb0: usb@4c000000 { - compatible = "marvell,pxa-ohci"; - reg = <0x4c000000 0x10000>; - interrupts = <3>; -diff --git a/arch/arm/boot/dts/rk3288-rock2-som.dtsi b/arch/arm/boot/dts/rk3288-rock2-som.dtsi -index b9c471fcbd42..862c2248fcb6 100644 ---- a/arch/arm/boot/dts/rk3288-rock2-som.dtsi -+++ b/arch/arm/boot/dts/rk3288-rock2-som.dtsi -@@ -63,7 +63,7 @@ - - vcc_flash: flash-regulator { - compatible = "regulator-fixed"; -- regulator-name = "vcc_sys"; -+ regulator-name = "vcc_flash"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - startup-delay-us = <150>; -diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi -index e7cd1315db1b..aa4119eaea98 100644 ---- a/arch/arm/boot/dts/rv1108.dtsi -+++ b/arch/arm/boot/dts/rv1108.dtsi -@@ -101,7 +101,7 @@ - - arm-pmu { - compatible = "arm,cortex-a7-pmu"; -- interrupts = ; -+ interrupts = ; - }; - - timer { -@@ -522,7 +522,7 @@ - compatible = "rockchip,gpio-bank"; - reg = <0x20030000 0x100>; - interrupts = ; -- clocks = <&xin24m>; -+ clocks = <&cru PCLK_GPIO0_PMU>; - - gpio-controller; - #gpio-cells = <2>; -@@ -535,7 +535,7 @@ - compatible = "rockchip,gpio-bank"; - reg = <0x10310000 0x100>; - interrupts = ; -- clocks = <&xin24m>; -+ clocks = <&cru PCLK_GPIO1>; - - gpio-controller; - #gpio-cells = <2>; -@@ -548,7 +548,7 @@ - compatible = "rockchip,gpio-bank"; - reg = <0x10320000 0x100>; - interrupts = ; -- clocks = <&xin24m>; -+ clocks = <&cru PCLK_GPIO2>; - - gpio-controller; - #gpio-cells = <2>; -@@ -561,7 +561,7 @@ - compatible = "rockchip,gpio-bank"; - reg = <0x10330000 0x100>; - interrupts = ; -- clocks = <&xin24m>; -+ clocks = <&cru PCLK_GPIO3>; - - gpio-controller; - #gpio-cells = <2>; -diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi -index 18f25c5e75ae..396fb6632bf0 100644 ---- a/arch/arm/boot/dts/sun5i-a10s.dtsi -+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi -@@ -104,8 +104,6 @@ - }; - - hdmi_out: port@1 { -- #address-cells = <1>; -- #size-cells = <0>; - reg = <1>; - }; - }; -diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi -index eef072a21acc..0bb82d0442a5 100644 ---- a/arch/arm/boot/dts/sun6i-a31.dtsi -+++ b/arch/arm/boot/dts/sun6i-a31.dtsi -@@ -173,7 +173,7 @@ - }; - - pmu { -- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; -+ compatible = "arm,cortex-a7-pmu"; - interrupts = , - , - , -diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi -index 96bee776e145..77f04dbdf996 100644 ---- a/arch/arm/boot/dts/sun7i-a20.dtsi -+++ b/arch/arm/boot/dts/sun7i-a20.dtsi -@@ -171,7 +171,7 @@ - }; - - pmu { -- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; -+ compatible = "arm,cortex-a7-pmu"; - interrupts = , - ; - }; -diff --git a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts -index 387fc2aa546d..333df90e8037 100644 ---- a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts -+++ b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts -@@ -78,7 +78,7 @@ - }; - - &mmc0 { -- pinctrl-0 = <&mmc0_pins_a>; -+ pinctrl-0 = <&mmc0_pins>; - pinctrl-names = "default"; - broken-cd; - bus-width = <4>; -@@ -87,7 +87,7 @@ - }; - - &uart0 { -- pinctrl-0 = <&uart0_pins_a>; -+ pinctrl-0 = <&uart0_pb_pins>; - pinctrl-names = "default"; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi -index 3a06dc5b3746..da5823c6fa3e 100644 ---- a/arch/arm/boot/dts/sun8i-v3s.dtsi -+++ b/arch/arm/boot/dts/sun8i-v3s.dtsi -@@ -292,17 +292,17 @@ - interrupt-controller; - #interrupt-cells = <3>; - -- i2c0_pins: i2c0 { -+ i2c0_pins: i2c0-pins { - pins = "PB6", "PB7"; - function = "i2c0"; - }; - -- uart0_pins_a: uart0@0 { -+ uart0_pb_pins: uart0-pb-pins { - pins = "PB8", "PB9"; - function = "uart0"; - }; - -- mmc0_pins_a: mmc0@0 { -+ mmc0_pins: mmc0-pins { - pins = "PF0", "PF1", "PF2", "PF3", - "PF4", "PF5"; - function = "mmc0"; -@@ -310,7 +310,7 @@ - bias-pull-up; - }; - -- mmc1_pins: mmc1 { -+ mmc1_pins: mmc1-pins { - pins = "PG0", "PG1", "PG2", "PG3", - "PG4", "PG5"; - function = "mmc1"; -@@ -318,7 +318,7 @@ - bias-pull-up; - }; - -- spi0_pins: spi0 { -+ spi0_pins: spi0-pins { - pins = "PC0", "PC1", "PC2", "PC3"; - function = "spi0"; - }; -diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h -index a5807b67ca8a..fe47d24955ea 100644 ---- a/arch/arm/include/asm/uaccess.h -+++ b/arch/arm/include/asm/uaccess.h -@@ -349,6 +349,13 @@ do { \ - #define __get_user_asm_byte(x, addr, err) \ - __get_user_asm(x, addr, err, ldrb) - -+#if __LINUX_ARM_ARCH__ >= 6 -+ -+#define __get_user_asm_half(x, addr, err) \ -+ __get_user_asm(x, addr, err, ldrh) -+ -+#else -+ - #ifndef __ARMEB__ - #define __get_user_asm_half(x, __gu_addr, err) \ - ({ \ -@@ -367,6 +374,8 @@ do { \ - }) - #endif - -+#endif /* __LINUX_ARM_ARCH__ >= 6 */ -+ - #define __get_user_asm_word(x, addr, err) \ - __get_user_asm(x, addr, err, ldr) - #endif -@@ -442,6 +451,13 @@ do { \ - #define __put_user_asm_byte(x, __pu_addr, err) \ - __put_user_asm(x, __pu_addr, err, strb) - -+#if __LINUX_ARM_ARCH__ >= 6 -+ -+#define __put_user_asm_half(x, __pu_addr, err) \ -+ __put_user_asm(x, __pu_addr, err, strh) -+ -+#else -+ - #ifndef __ARMEB__ - #define __put_user_asm_half(x, __pu_addr, err) \ - ({ \ -@@ -458,6 +474,8 @@ do { \ - }) - #endif - -+#endif /* __LINUX_ARM_ARCH__ >= 6 */ -+ - #define __put_user_asm_word(x, __pu_addr, err) \ - __put_user_asm(x, __pu_addr, err, str) - -diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S -index 746e7801dcdf..b2e4bc3a635e 100644 ---- a/arch/arm/lib/getuser.S -+++ b/arch/arm/lib/getuser.S -@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1) - - ENTRY(__get_user_2) - check_uaccess r0, 2, r1, r2, __get_user_bad -+#if __LINUX_ARM_ARCH__ >= 6 -+ -+2: TUSER(ldrh) r2, [r0] -+ -+#else -+ - #ifdef CONFIG_CPU_USE_DOMAINS - rb .req ip - 2: ldrbt r2, [r0], #1 -@@ -56,6 +62,9 @@ rb .req r0 - #else - orr r2, rb, r2, lsl #8 - #endif -+ -+#endif /* __LINUX_ARM_ARCH__ >= 6 */ -+ - mov r0, #0 - ret lr - ENDPROC(__get_user_2) -@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8) - .pushsection __ex_table, "a" - .long 1b, __get_user_bad - .long 2b, __get_user_bad -+#if __LINUX_ARM_ARCH__ < 6 - .long 3b, __get_user_bad -+#endif - .long 4b, __get_user_bad - .long 5b, __get_user_bad8 - .long 6b, __get_user_bad8 -diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S -index 38d660d3705f..515eeaa9975c 100644 ---- a/arch/arm/lib/putuser.S -+++ b/arch/arm/lib/putuser.S -@@ -41,16 +41,13 @@ ENDPROC(__put_user_1) - - ENTRY(__put_user_2) - check_uaccess r0, 2, r1, ip, __put_user_bad -- mov ip, r2, lsr #8 --#ifdef CONFIG_THUMB2_KERNEL --#ifndef __ARMEB__ --2: TUSER(strb) r2, [r0] --3: TUSER(strb) ip, [r0, #1] -+#if __LINUX_ARM_ARCH__ >= 6 -+ -+2: TUSER(strh) r2, [r0] -+ - #else --2: TUSER(strb) ip, [r0] --3: TUSER(strb) r2, [r0, #1] --#endif --#else /* !CONFIG_THUMB2_KERNEL */ -+ -+ mov ip, r2, lsr #8 - #ifndef __ARMEB__ - 2: TUSER(strb) r2, [r0], #1 - 3: TUSER(strb) ip, [r0] -@@ -58,7 +55,8 @@ ENTRY(__put_user_2) - 2: TUSER(strb) ip, [r0], #1 - 3: TUSER(strb) r2, [r0] - #endif --#endif /* CONFIG_THUMB2_KERNEL */ -+ -+#endif /* __LINUX_ARM_ARCH__ >= 6 */ - mov r0, #0 - ret lr - ENDPROC(__put_user_2) -@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad) - .pushsection __ex_table, "a" - .long 1b, __put_user_bad - .long 2b, __put_user_bad -+#if __LINUX_ARM_ARCH__ < 6 - .long 3b, __put_user_bad -+#endif - .long 4b, __put_user_bad - .long 5b, __put_user_bad - .long 6b, __put_user_bad -diff --git a/arch/arm/mach-omap1/id.c b/arch/arm/mach-omap1/id.c -index 52de382fc804..7e49dfda3d2f 100644 ---- a/arch/arm/mach-omap1/id.c -+++ b/arch/arm/mach-omap1/id.c -@@ -200,10 +200,10 @@ void __init omap_check_revision(void) - printk(KERN_INFO "Unknown OMAP cpu type: 0x%02x\n", cpu_type); - } - -- printk(KERN_INFO "OMAP%04x", omap_revision >> 16); -+ pr_info("OMAP%04x", omap_revision >> 16); - if ((omap_revision >> 8) & 0xff) -- printk(KERN_INFO "%x", (omap_revision >> 8) & 0xff); -- printk(KERN_INFO " revision %i handled as %02xxx id: %08x%08x\n", -+ pr_cont("%x", (omap_revision >> 8) & 0xff); -+ pr_cont(" revision %i handled as %02xxx id: %08x%08x\n", - die_rev, omap_revision & 0xff, system_serial_low, - system_serial_high); - } -diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c -index 16cb1c195fd8..79d71b1eae59 100644 ---- a/arch/arm/mach-omap2/id.c -+++ b/arch/arm/mach-omap2/id.c -@@ -199,8 +199,8 @@ void __init omap2xxx_check_revision(void) - - pr_info("%s", soc_name); - if ((omap_rev() >> 8) & 0x0f) -- pr_info("%s", soc_rev); -- pr_info("\n"); -+ pr_cont("%s", soc_rev); -+ pr_cont("\n"); - } - - #define OMAP3_SHOW_FEATURE(feat) \ -diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c -index 6b433fce65a5..2477f6086de4 100644 ---- a/arch/arm/mach-omap2/pdata-quirks.c -+++ b/arch/arm/mach-omap2/pdata-quirks.c -@@ -307,108 +307,15 @@ static void __init omap3_logicpd_torpedo_init(void) - } - - /* omap3pandora legacy devices */ --#define PANDORA_WIFI_IRQ_GPIO 21 --#define PANDORA_WIFI_NRESET_GPIO 23 - - static struct platform_device pandora_backlight = { - .name = "pandora-backlight", - .id = -1, - }; - --static struct regulator_consumer_supply pandora_vmmc3_supply[] = { -- REGULATOR_SUPPLY("vmmc", "omap_hsmmc.2"), --}; -- --static struct regulator_init_data pandora_vmmc3 = { -- .constraints = { -- .valid_ops_mask = REGULATOR_CHANGE_STATUS, -- }, -- .num_consumer_supplies = ARRAY_SIZE(pandora_vmmc3_supply), -- .consumer_supplies = pandora_vmmc3_supply, --}; -- --static struct fixed_voltage_config pandora_vwlan = { -- .supply_name = "vwlan", -- .microvolts = 1800000, /* 1.8V */ -- .gpio = PANDORA_WIFI_NRESET_GPIO, -- .startup_delay = 50000, /* 50ms */ -- .enable_high = 1, -- .init_data = &pandora_vmmc3, --}; -- --static struct platform_device pandora_vwlan_device = { -- .name = "reg-fixed-voltage", -- .id = 1, -- .dev = { -- .platform_data = &pandora_vwlan, -- }, --}; -- --static void pandora_wl1251_init_card(struct mmc_card *card) --{ -- /* -- * We have TI wl1251 attached to MMC3. Pass this information to -- * SDIO core because it can't be probed by normal methods. -- */ -- if (card->type == MMC_TYPE_SDIO || card->type == MMC_TYPE_SD_COMBO) { -- card->quirks |= MMC_QUIRK_NONSTD_SDIO; -- card->cccr.wide_bus = 1; -- card->cis.vendor = 0x104c; -- card->cis.device = 0x9066; -- card->cis.blksize = 512; -- card->cis.max_dtr = 24000000; -- card->ocr = 0x80; -- } --} -- --static struct omap2_hsmmc_info pandora_mmc3[] = { -- { -- .mmc = 3, -- .caps = MMC_CAP_4_BIT_DATA | MMC_CAP_POWER_OFF_CARD, -- .gpio_cd = -EINVAL, -- .gpio_wp = -EINVAL, -- .init_card = pandora_wl1251_init_card, -- }, -- {} /* Terminator */ --}; -- --static void __init pandora_wl1251_init(void) --{ -- struct wl1251_platform_data pandora_wl1251_pdata; -- int ret; -- -- memset(&pandora_wl1251_pdata, 0, sizeof(pandora_wl1251_pdata)); -- -- pandora_wl1251_pdata.power_gpio = -1; -- -- ret = gpio_request_one(PANDORA_WIFI_IRQ_GPIO, GPIOF_IN, "wl1251 irq"); -- if (ret < 0) -- goto fail; -- -- pandora_wl1251_pdata.irq = gpio_to_irq(PANDORA_WIFI_IRQ_GPIO); -- if (pandora_wl1251_pdata.irq < 0) -- goto fail_irq; -- -- pandora_wl1251_pdata.use_eeprom = true; -- ret = wl1251_set_platform_data(&pandora_wl1251_pdata); -- if (ret < 0) -- goto fail_irq; -- -- return; -- --fail_irq: -- gpio_free(PANDORA_WIFI_IRQ_GPIO); --fail: -- pr_err("wl1251 board initialisation failed\n"); --} -- - static void __init omap3_pandora_legacy_init(void) - { - platform_device_register(&pandora_backlight); -- platform_device_register(&pandora_vwlan_device); -- omap_hsmmc_init(pandora_mmc3); -- omap_hsmmc_late_init(pandora_mmc3); -- pandora_wl1251_init(); - } - #endif /* CONFIG_ARCH_OMAP3 */ - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -index 4b17a76959b2..c83c028e95af 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts -@@ -178,7 +178,7 @@ - pinctrl-names = "default"; - }; - --&pinctrl_aobus { -+&gpio_ao { - gpio-line-names = "UART TX", "UART RX", "Power Control", "Power Key In", - "VCCK En", "CON1 Header Pin31", - "I2S Header Pin6", "IR In", "I2S Header Pin7", -@@ -186,7 +186,7 @@ - "I2S Header Pin5", "HDMI CEC", "SYS LED"; - }; - --&pinctrl_periphs { -+&gpio { - gpio-line-names = /* Bank GPIOZ */ - "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk", - "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2", -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -index c3c65b06ba76..4ea23df81f21 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -@@ -189,7 +189,7 @@ - pinctrl-names = "default"; - }; - --&pinctrl_aobus { -+&gpio_ao { - gpio-line-names = "UART TX", "UART RX", "VCCK En", "TF 3V3/1V8 En", - "USB HUB nRESET", "USB OTG Power En", - "J7 Header Pin2", "IR In", "J7 Header Pin4", -@@ -197,7 +197,7 @@ - "HDMI CEC", "SYS LED"; - }; - --&pinctrl_periphs { -+&gpio { - gpio-line-names = /* Bank GPIOZ */ - "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk", - "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2", -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -index edc512ad0bac..fb5db5f33e8c 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts -@@ -112,7 +112,7 @@ - linux,rc-map-name = "rc-geekbox"; - }; - --&pinctrl_aobus { -+&gpio_ao { - gpio-line-names = "UART TX", - "UART RX", - "Power Key In", -@@ -125,7 +125,7 @@ - "SYS LED"; - }; - --&pinctrl_periphs { -+&gpio { - gpio-line-names = /* Bank GPIOZ */ - "", "", "", "", "", "", "", - "", "", "", "", "", "", "", -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts -index 0814b6b29b86..e2c71753e327 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts -@@ -139,7 +139,7 @@ - }; - }; - --&pinctrl_aobus { -+&gpio_ao { - gpio-line-names = "UART TX", - "UART RX", - "Blue LED", -@@ -152,7 +152,7 @@ - "7J1 Header Pin13"; - }; - --&pinctrl_periphs { -+&gpio { - gpio-line-names = /* Bank GPIOZ */ - "", "", "", "", "", "", "", - "", "", "", "", "", "", "", -diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi -index d67ef4319f3b..97f31bc4fa1e 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi -@@ -1584,7 +1584,7 @@ - regulator-name = "VDD_HDMI_5V0"; - regulator-min-microvolt = <5000000>; - regulator-max-microvolt = <5000000>; -- gpio = <&exp1 12 GPIO_ACTIVE_LOW>; -+ gpio = <&exp1 12 GPIO_ACTIVE_HIGH>; - enable-active-high; - vin-supply = <&vdd_5v0_sys>; - }; -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index ae4450e891ab..7e267d657c56 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -812,6 +812,7 @@ config SIBYTE_LITTLESUR - select SYS_SUPPORTS_BIG_ENDIAN - select SYS_SUPPORTS_HIGHMEM - select SYS_SUPPORTS_LITTLE_ENDIAN -+ select ZONE_DMA32 if 64BIT - - config SIBYTE_SENTOSA - bool "Sibyte BCM91250E-Sentosa" -diff --git a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c -index 8241fc6aa17d..3839feba68f2 100644 ---- a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c -+++ b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c -@@ -266,7 +266,7 @@ int cvmx_cmd_queue_length(cvmx_cmd_queue_id_t queue_id) - } else { - union cvmx_pko_mem_debug8 debug8; - debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); -- return debug8.cn58xx.doorbell; -+ return debug8.cn50xx.doorbell; - } - case CVMX_CMD_QUEUE_ZIP: - case CVMX_CMD_QUEUE_DFA: -diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c -index 1d92efb82c37..e1e24118c169 100644 ---- a/arch/mips/cavium-octeon/octeon-platform.c -+++ b/arch/mips/cavium-octeon/octeon-platform.c -@@ -501,7 +501,7 @@ static void __init octeon_fdt_set_phy(int eth, int phy_addr) - if (phy_addr >= 256 && alt_phy > 0) { - const struct fdt_property *phy_prop; - struct fdt_property *alt_prop; -- u32 phy_handle_name; -+ fdt32_t phy_handle_name; - - /* Use the alt phy node instead.*/ - phy_prop = fdt_get_property(initial_boot_params, eth, "phy-handle", NULL); -diff --git a/arch/mips/include/asm/octeon/cvmx-pko.h b/arch/mips/include/asm/octeon/cvmx-pko.h -index 5f47f76ed510..20eb9c46a75a 100644 ---- a/arch/mips/include/asm/octeon/cvmx-pko.h -+++ b/arch/mips/include/asm/octeon/cvmx-pko.h -@@ -611,7 +611,7 @@ static inline void cvmx_pko_get_port_status(uint64_t port_num, uint64_t clear, - pko_reg_read_idx.s.index = cvmx_pko_get_base_queue(port_num); - cvmx_write_csr(CVMX_PKO_REG_READ_IDX, pko_reg_read_idx.u64); - debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); -- status->doorbell = debug8.cn58xx.doorbell; -+ status->doorbell = debug8.cn50xx.doorbell; - } - } - -diff --git a/arch/powerpc/include/asm/sfp-machine.h b/arch/powerpc/include/asm/sfp-machine.h -index d89beaba26ff..8b957aabb826 100644 ---- a/arch/powerpc/include/asm/sfp-machine.h -+++ b/arch/powerpc/include/asm/sfp-machine.h -@@ -213,30 +213,18 @@ - * respectively. The result is placed in HIGH_SUM and LOW_SUM. Overflow - * (i.e. carry out) is not stored anywhere, and is lost. - */ --#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ -+#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ - do { \ - if (__builtin_constant_p (bh) && (bh) == 0) \ -- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \ -- : "=r" ((USItype)(sh)), \ -- "=&r" ((USItype)(sl)) \ -- : "%r" ((USItype)(ah)), \ -- "%r" ((USItype)(al)), \ -- "rI" ((USItype)(bl))); \ -- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ -- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \ -- : "=r" ((USItype)(sh)), \ -- "=&r" ((USItype)(sl)) \ -- : "%r" ((USItype)(ah)), \ -- "%r" ((USItype)(al)), \ -- "rI" ((USItype)(bl))); \ -+ __asm__ ("add%I4c %1,%3,%4\n\taddze %0,%2" \ -+ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ -+ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ -+ __asm__ ("add%I4c %1,%3,%4\n\taddme %0,%2" \ -+ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ - else \ -- __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \ -- : "=r" ((USItype)(sh)), \ -- "=&r" ((USItype)(sl)) \ -- : "%r" ((USItype)(ah)), \ -- "r" ((USItype)(bh)), \ -- "%r" ((USItype)(al)), \ -- "rI" ((USItype)(bl))); \ -+ __asm__ ("add%I5c %1,%4,%5\n\tadde %0,%2,%3" \ -+ : "=r" (sh), "=&r" (sl) \ -+ : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl)); \ - } while (0) - - /* sub_ddmmss is used in op-2.h and udivmodti4.c and should be equivalent to -@@ -248,44 +236,24 @@ - * and LOW_DIFFERENCE. Overflow (i.e. carry out) is not stored anywhere, - * and is lost. - */ --#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ -+#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ - do { \ - if (__builtin_constant_p (ah) && (ah) == 0) \ -- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \ -- : "=r" ((USItype)(sh)), \ -- "=&r" ((USItype)(sl)) \ -- : "r" ((USItype)(bh)), \ -- "rI" ((USItype)(al)), \ -- "r" ((USItype)(bl))); \ -- else if (__builtin_constant_p (ah) && (ah) ==~(USItype) 0) \ -- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \ -- : "=r" ((USItype)(sh)), \ -- "=&r" ((USItype)(sl)) \ -- : "r" ((USItype)(bh)), \ -- "rI" ((USItype)(al)), \ -- "r" ((USItype)(bl))); \ -+ __asm__ ("subf%I3c %1,%4,%3\n\tsubfze %0,%2" \ -+ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ -+ else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0) \ -+ __asm__ ("subf%I3c %1,%4,%3\n\tsubfme %0,%2" \ -+ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ - else if (__builtin_constant_p (bh) && (bh) == 0) \ -- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \ -- : "=r" ((USItype)(sh)), \ -- "=&r" ((USItype)(sl)) \ -- : "r" ((USItype)(ah)), \ -- "rI" ((USItype)(al)), \ -- "r" ((USItype)(bl))); \ -- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ -- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \ -- : "=r" ((USItype)(sh)), \ -- "=&r" ((USItype)(sl)) \ -- : "r" ((USItype)(ah)), \ -- "rI" ((USItype)(al)), \ -- "r" ((USItype)(bl))); \ -+ __asm__ ("subf%I3c %1,%4,%3\n\taddme %0,%2" \ -+ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ -+ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ -+ __asm__ ("subf%I3c %1,%4,%3\n\taddze %0,%2" \ -+ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ - else \ -- __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \ -- : "=r" ((USItype)(sh)), \ -- "=&r" ((USItype)(sl)) \ -- : "r" ((USItype)(ah)), \ -- "r" ((USItype)(bh)), \ -- "rI" ((USItype)(al)), \ -- "r" ((USItype)(bl))); \ -+ __asm__ ("subf%I4c %1,%5,%4\n\tsubfe %0,%3,%2" \ -+ : "=r" (sh), "=&r" (sl) \ -+ : "r" (ah), "r" (bh), "rI" (al), "r" (bl)); \ - } while (0) - - /* asm fragments for mul and div */ -@@ -294,13 +262,10 @@ - * UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype - * word product in HIGH_PROD and LOW_PROD. - */ --#define umul_ppmm(ph, pl, m0, m1) \ -+#define umul_ppmm(ph, pl, m0, m1) \ - do { \ - USItype __m0 = (m0), __m1 = (m1); \ -- __asm__ ("mulhwu %0,%1,%2" \ -- : "=r" ((USItype)(ph)) \ -- : "%r" (__m0), \ -- "r" (__m1)); \ -+ __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1)); \ - (pl) = __m0 * __m1; \ - } while (0) - -@@ -312,9 +277,10 @@ - * significant bit of DENOMINATOR must be 1, then the pre-processor symbol - * UDIV_NEEDS_NORMALIZATION is defined to 1. - */ --#define udiv_qrnnd(q, r, n1, n0, d) \ -+#define udiv_qrnnd(q, r, n1, n0, d) \ - do { \ -- UWtype __d1, __d0, __q1, __q0, __r1, __r0, __m; \ -+ UWtype __d1, __d0, __q1, __q0; \ -+ UWtype __r1, __r0, __m; \ - __d1 = __ll_highpart (d); \ - __d0 = __ll_lowpart (d); \ - \ -@@ -325,7 +291,7 @@ - if (__r1 < __m) \ - { \ - __q1--, __r1 += (d); \ -- if (__r1 >= (d)) /* we didn't get carry when adding to __r1 */ \ -+ if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\ - if (__r1 < __m) \ - __q1--, __r1 += (d); \ - } \ -diff --git a/arch/powerpc/include/asm/vdso_datapage.h b/arch/powerpc/include/asm/vdso_datapage.h -index 1afe90ade595..674c03350cd1 100644 ---- a/arch/powerpc/include/asm/vdso_datapage.h -+++ b/arch/powerpc/include/asm/vdso_datapage.h -@@ -86,6 +86,7 @@ struct vdso_data { - __s32 wtom_clock_nsec; - struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ - __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ -+ __u32 hrtimer_res; /* hrtimer resolution */ - __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */ - __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ - }; -@@ -107,6 +108,7 @@ struct vdso_data { - __s32 wtom_clock_nsec; - struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ - __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ -+ __u32 hrtimer_res; /* hrtimer resolution */ - __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ - __u32 dcache_block_size; /* L1 d-cache block size */ - __u32 icache_block_size; /* L1 i-cache block size */ -diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile -index 142b08d40642..5607ce67d178 100644 ---- a/arch/powerpc/kernel/Makefile -+++ b/arch/powerpc/kernel/Makefile -@@ -5,8 +5,8 @@ - - CFLAGS_ptrace.o += -DUTS_MACHINE='"$(UTS_MACHINE)"' - --# Disable clang warning for using setjmp without setjmp.h header --CFLAGS_crash.o += $(call cc-disable-warning, builtin-requires-header) -+# Avoid clang warnings around longjmp/setjmp declarations -+CFLAGS_crash.o += -ffreestanding - - subdir-ccflags-$(CONFIG_PPC_WERROR) := -Werror - -diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c -index 2e5ea300258a..1bc761e537a9 100644 ---- a/arch/powerpc/kernel/asm-offsets.c -+++ b/arch/powerpc/kernel/asm-offsets.c -@@ -373,6 +373,7 @@ int main(void) - OFFSET(WTOM_CLOCK_NSEC, vdso_data, wtom_clock_nsec); - OFFSET(STAMP_XTIME, vdso_data, stamp_xtime); - OFFSET(STAMP_SEC_FRAC, vdso_data, stamp_sec_fraction); -+ OFFSET(CLOCK_HRTIMER_RES, vdso_data, hrtimer_res); - OFFSET(CFG_ICACHE_BLOCKSZ, vdso_data, icache_block_size); - OFFSET(CFG_DCACHE_BLOCKSZ, vdso_data, dcache_block_size); - OFFSET(CFG_ICACHE_LOGBLOCKSZ, vdso_data, icache_log_block_size); -@@ -401,7 +402,6 @@ int main(void) - DEFINE(CLOCK_REALTIME, CLOCK_REALTIME); - DEFINE(CLOCK_MONOTONIC, CLOCK_MONOTONIC); - DEFINE(NSEC_PER_SEC, NSEC_PER_SEC); -- DEFINE(CLOCK_REALTIME_RES, MONOTONIC_RES_NSEC); - - #ifdef CONFIG_BUG - DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry)); -diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S -index 09af857ca099..afe086f48e7c 100644 ---- a/arch/powerpc/kernel/misc_64.S -+++ b/arch/powerpc/kernel/misc_64.S -@@ -86,7 +86,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) - subf r8,r6,r4 /* compute length */ - add r8,r8,r5 /* ensure we get enough */ - lwz r9,DCACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of cache block size */ -- srw. r8,r8,r9 /* compute line count */ -+ srd. r8,r8,r9 /* compute line count */ - beqlr /* nothing to do? */ - mtctr r8 - 1: dcbst 0,r6 -@@ -102,7 +102,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) - subf r8,r6,r4 /* compute length */ - add r8,r8,r5 - lwz r9,ICACHEL1LOGBLOCKSIZE(r10) /* Get log-2 of Icache block size */ -- srw. r8,r8,r9 /* compute line count */ -+ srd. r8,r8,r9 /* compute line count */ - beqlr /* nothing to do? */ - mtctr r8 - 2: icbi 0,r6 -diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c -index 7c7c5a16284d..14f3f28a089e 100644 ---- a/arch/powerpc/kernel/time.c -+++ b/arch/powerpc/kernel/time.c -@@ -920,6 +920,7 @@ void update_vsyscall(struct timekeeper *tk) - vdso_data->wtom_clock_nsec = tk->wall_to_monotonic.tv_nsec; - vdso_data->stamp_xtime = xt; - vdso_data->stamp_sec_fraction = frac_sec; -+ vdso_data->hrtimer_res = hrtimer_resolution; - smp_wmb(); - ++(vdso_data->tb_update_count); - } -diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S -index 1e0bc5955a40..03a65fee8020 100644 ---- a/arch/powerpc/kernel/vdso32/gettimeofday.S -+++ b/arch/powerpc/kernel/vdso32/gettimeofday.S -@@ -160,12 +160,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) - cror cr0*4+eq,cr0*4+eq,cr1*4+eq - bne cr0,99f - -+ mflr r12 -+ .cfi_register lr,r12 -+ bl __get_datapage@local /* get data page */ -+ lwz r5, CLOCK_HRTIMER_RES(r3) -+ mtlr r12 - li r3,0 - cmpli cr0,r4,0 - crclr cr0*4+so - beqlr -- lis r5,CLOCK_REALTIME_RES@h -- ori r5,r5,CLOCK_REALTIME_RES@l - stw r3,TSPC32_TV_SEC(r4) - stw r5,TSPC32_TV_NSEC(r4) - blr -diff --git a/arch/powerpc/kernel/vdso64/cacheflush.S b/arch/powerpc/kernel/vdso64/cacheflush.S -index 69c5af2b3c96..228a4a2383d6 100644 ---- a/arch/powerpc/kernel/vdso64/cacheflush.S -+++ b/arch/powerpc/kernel/vdso64/cacheflush.S -@@ -39,7 +39,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) - subf r8,r6,r4 /* compute length */ - add r8,r8,r5 /* ensure we get enough */ - lwz r9,CFG_DCACHE_LOGBLOCKSZ(r10) -- srw. r8,r8,r9 /* compute line count */ -+ srd. r8,r8,r9 /* compute line count */ - crclr cr0*4+so - beqlr /* nothing to do? */ - mtctr r8 -@@ -56,7 +56,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) - subf r8,r6,r4 /* compute length */ - add r8,r8,r5 - lwz r9,CFG_ICACHE_LOGBLOCKSZ(r10) -- srw. r8,r8,r9 /* compute line count */ -+ srd. r8,r8,r9 /* compute line count */ - crclr cr0*4+so - beqlr /* nothing to do? */ - mtctr r8 -diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S -index 09b2a49f6dd5..c973378e1f2b 100644 ---- a/arch/powerpc/kernel/vdso64/gettimeofday.S -+++ b/arch/powerpc/kernel/vdso64/gettimeofday.S -@@ -145,12 +145,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) - cror cr0*4+eq,cr0*4+eq,cr1*4+eq - bne cr0,99f - -+ mflr r12 -+ .cfi_register lr,r12 -+ bl V_LOCAL_FUNC(__get_datapage) -+ lwz r5, CLOCK_HRTIMER_RES(r3) -+ mtlr r12 - li r3,0 - cmpldi cr0,r4,0 - crclr cr0*4+so - beqlr -- lis r5,CLOCK_REALTIME_RES@h -- ori r5,r5,CLOCK_REALTIME_RES@l - std r3,TSPC64_TV_SEC(r4) - std r5,TSPC64_TV_NSEC(r4) - blr -diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c -index 110d8bb16ebb..a820370883d9 100644 ---- a/arch/powerpc/sysdev/xive/common.c -+++ b/arch/powerpc/sysdev/xive/common.c -@@ -967,6 +967,15 @@ static int xive_irq_alloc_data(unsigned int virq, irq_hw_number_t hw) - xd->target = XIVE_INVALID_TARGET; - irq_set_handler_data(virq, xd); - -+ /* -+ * Turn OFF by default the interrupt being mapped. A side -+ * effect of this check is the mapping the ESB page of the -+ * interrupt in the Linux address space. This prevents page -+ * fault issues in the crash handler which masks all -+ * interrupts. -+ */ -+ xive_esb_read(xd, XIVE_ESB_SET_PQ_01); -+ - return 0; - } - -diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c -index 091f1d0d0af1..7fc41bf30fd5 100644 ---- a/arch/powerpc/sysdev/xive/spapr.c -+++ b/arch/powerpc/sysdev/xive/spapr.c -@@ -293,20 +293,28 @@ static int xive_spapr_populate_irq_data(u32 hw_irq, struct xive_irq_data *data) - data->esb_shift = esb_shift; - data->trig_page = trig_page; - -+ data->hw_irq = hw_irq; -+ - /* - * No chip-id for the sPAPR backend. This has an impact how we - * pick a target. See xive_pick_irq_target(). - */ - data->src_chip = XIVE_INVALID_CHIP_ID; - -+ /* -+ * When the H_INT_ESB flag is set, the H_INT_ESB hcall should -+ * be used for interrupt management. Skip the remapping of the -+ * ESB pages which are not available. -+ */ -+ if (data->flags & XIVE_IRQ_FLAG_H_INT_ESB) -+ return 0; -+ - data->eoi_mmio = ioremap(data->eoi_page, 1u << data->esb_shift); - if (!data->eoi_mmio) { - pr_err("Failed to map EOI page for irq 0x%x\n", hw_irq); - return -ENOMEM; - } - -- data->hw_irq = hw_irq; -- - /* Full function page supports trigger */ - if (flags & XIVE_SRC_TRIGGER) { - data->trig_mmio = data->eoi_mmio; -diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile -index ac5ee067aa51..a60c44b4a3e5 100644 ---- a/arch/powerpc/xmon/Makefile -+++ b/arch/powerpc/xmon/Makefile -@@ -1,8 +1,8 @@ - # SPDX-License-Identifier: GPL-2.0 - # Makefile for xmon - --# Disable clang warning for using setjmp without setjmp.h header --subdir-ccflags-y := $(call cc-disable-warning, builtin-requires-header) -+# Avoid clang warnings around longjmp/setjmp declarations -+subdir-ccflags-y := -ffreestanding - - subdir-ccflags-$(CONFIG_PPC_WERROR) += -Werror - -diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h -index d7fe9838084d..328710b386e3 100644 ---- a/arch/s390/include/asm/pgtable.h -+++ b/arch/s390/include/asm/pgtable.h -@@ -1126,8 +1126,6 @@ int pgste_perform_essa(struct mm_struct *mm, unsigned long hva, int orc, - static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, - pte_t *ptep, pte_t entry) - { -- if (!MACHINE_HAS_NX) -- pte_val(entry) &= ~_PAGE_NOEXEC; - if (pte_present(entry)) - pte_val(entry) &= ~_PAGE_UNUSED; - if (mm_has_pgste(mm)) -@@ -1144,6 +1142,8 @@ static inline pte_t mk_pte_phys(unsigned long physpage, pgprot_t pgprot) - { - pte_t __pte; - pte_val(__pte) = physpage + pgprot_val(pgprot); -+ if (!MACHINE_HAS_NX) -+ pte_val(__pte) &= ~_PAGE_NOEXEC; - return pte_mkyoung(__pte); - } - -diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c -index adfb4581bd80..dfb1a62abe93 100644 ---- a/arch/sparc/net/bpf_jit_comp_64.c -+++ b/arch/sparc/net/bpf_jit_comp_64.c -@@ -1326,6 +1326,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) - const u8 tmp2 = bpf2sparc[TMP_REG_2]; - u32 opcode = 0, rs2; - -+ if (insn->dst_reg == BPF_REG_FP) -+ ctx->saw_frame_pointer = true; -+ - ctx->tmp_2_used = true; - emit_loadimm(imm, tmp2, ctx); - -@@ -1364,6 +1367,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) - const u8 tmp = bpf2sparc[TMP_REG_1]; - u32 opcode = 0, rs2; - -+ if (insn->dst_reg == BPF_REG_FP) -+ ctx->saw_frame_pointer = true; -+ - switch (BPF_SIZE(code)) { - case BPF_W: - opcode = ST32; -@@ -1396,6 +1402,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) - const u8 tmp2 = bpf2sparc[TMP_REG_2]; - const u8 tmp3 = bpf2sparc[TMP_REG_3]; - -+ if (insn->dst_reg == BPF_REG_FP) -+ ctx->saw_frame_pointer = true; -+ - ctx->tmp_1_used = true; - ctx->tmp_2_used = true; - ctx->tmp_3_used = true; -@@ -1416,6 +1425,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) - const u8 tmp2 = bpf2sparc[TMP_REG_2]; - const u8 tmp3 = bpf2sparc[TMP_REG_3]; - -+ if (insn->dst_reg == BPF_REG_FP) -+ ctx->saw_frame_pointer = true; -+ - ctx->tmp_1_used = true; - ctx->tmp_2_used = true; - ctx->tmp_3_used = true; -diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c -index 4f3be91f0b0b..c7bd2e549a6a 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce.c -+++ b/arch/x86/kernel/cpu/mcheck/mce.c -@@ -1660,36 +1660,6 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c) - if (c->x86 == 0x15 && c->x86_model <= 0xf) - mce_flags.overflow_recov = 1; - -- /* -- * Turn off MC4_MISC thresholding banks on those models since -- * they're not supported there. -- */ -- if (c->x86 == 0x15 && -- (c->x86_model >= 0x10 && c->x86_model <= 0x1f)) { -- int i; -- u64 hwcr; -- bool need_toggle; -- u32 msrs[] = { -- 0x00000413, /* MC4_MISC0 */ -- 0xc0000408, /* MC4_MISC1 */ -- }; -- -- rdmsrl(MSR_K7_HWCR, hwcr); -- -- /* McStatusWrEn has to be set */ -- need_toggle = !(hwcr & BIT(18)); -- -- if (need_toggle) -- wrmsrl(MSR_K7_HWCR, hwcr | BIT(18)); -- -- /* Clear CntP bit safely */ -- for (i = 0; i < ARRAY_SIZE(msrs); i++) -- msr_clear_bit(msrs[i], 62); -- -- /* restore old settings */ -- if (need_toggle) -- wrmsrl(MSR_K7_HWCR, hwcr); -- } - } - - if (c->x86_vendor == X86_VENDOR_INTEL) { -diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c -index 4fa97a44e73f..b434780ae680 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce_amd.c -+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c -@@ -544,6 +544,40 @@ out: - return offset; - } - -+/* -+ * Turn off MC4_MISC thresholding banks on all family 0x15 models since -+ * they're not supported there. -+ */ -+void disable_err_thresholding(struct cpuinfo_x86 *c) -+{ -+ int i; -+ u64 hwcr; -+ bool need_toggle; -+ u32 msrs[] = { -+ 0x00000413, /* MC4_MISC0 */ -+ 0xc0000408, /* MC4_MISC1 */ -+ }; -+ -+ if (c->x86 != 0x15) -+ return; -+ -+ rdmsrl(MSR_K7_HWCR, hwcr); -+ -+ /* McStatusWrEn has to be set */ -+ need_toggle = !(hwcr & BIT(18)); -+ -+ if (need_toggle) -+ wrmsrl(MSR_K7_HWCR, hwcr | BIT(18)); -+ -+ /* Clear CntP bit safely */ -+ for (i = 0; i < ARRAY_SIZE(msrs); i++) -+ msr_clear_bit(msrs[i], 62); -+ -+ /* restore old settings */ -+ if (need_toggle) -+ wrmsrl(MSR_K7_HWCR, hwcr); -+} -+ - /* cpu init entry point, called from mce.c with preempt off */ - void mce_amd_feature_init(struct cpuinfo_x86 *c) - { -@@ -551,6 +585,8 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c) - unsigned int bank, block, cpu = smp_processor_id(); - int offset = -1; - -+ disable_err_thresholding(c); -+ - for (bank = 0; bank < mca_cfg.banks; ++bank) { - if (mce_flags.smca) - smca_configure(bank, cpu); -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 33f87b696487..38959b173a42 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -404,7 +404,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, - - r = -E2BIG; - -- if (*nent >= maxnent) -+ if (WARN_ON(*nent >= maxnent)) - goto out; - - do_cpuid_1_ent(entry, function, index); -@@ -707,6 +707,9 @@ out: - static int do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 func, - u32 idx, int *nent, int maxnent, unsigned int type) - { -+ if (*nent >= maxnent) -+ return -E2BIG; -+ - if (type == KVM_GET_EMULATED_CPUID) - return __do_cpuid_ent_emulated(entry, func, idx, nent, maxnent); - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 1f9360320a82..8a51442247c5 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -276,13 +276,14 @@ int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask) - struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu); - int err; - -- if (((value ^ smsr->values[slot].curr) & mask) == 0) -+ value = (value & mask) | (smsr->values[slot].host & ~mask); -+ if (value == smsr->values[slot].curr) - return 0; -- smsr->values[slot].curr = value; - err = wrmsrl_safe(shared_msrs_global.msrs[slot], value); - if (err) - return 1; - -+ smsr->values[slot].curr = value; - if (!smsr->registered) { - smsr->urn.on_user_return = kvm_on_user_return; - user_return_notifier_register(&smsr->urn); -@@ -1112,10 +1113,15 @@ u64 kvm_get_arch_capabilities(void) - * If TSX is disabled on the system, guests are also mitigated against - * TAA and clear CPU buffer mitigation is not required for guests. - */ -- if (boot_cpu_has_bug(X86_BUG_TAA) && boot_cpu_has(X86_FEATURE_RTM) && -- (data & ARCH_CAP_TSX_CTRL_MSR)) -+ if (!boot_cpu_has(X86_FEATURE_RTM)) -+ data &= ~ARCH_CAP_TAA_NO; -+ else if (!boot_cpu_has_bug(X86_BUG_TAA)) -+ data |= ARCH_CAP_TAA_NO; -+ else if (data & ARCH_CAP_TSX_CTRL_MSR) - data &= ~ARCH_CAP_MDS_NO; - -+ /* KVM does not emulate MSR_IA32_TSX_CTRL. */ -+ data &= ~ARCH_CAP_TSX_CTRL_MSR; - return data; - } - -diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c -index 4210da7b44de..33e9b4f1ce20 100644 ---- a/arch/x86/pci/fixup.c -+++ b/arch/x86/pci/fixup.c -@@ -588,6 +588,17 @@ static void pci_fixup_amd_ehci_pme(struct pci_dev *dev) - } - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7808, pci_fixup_amd_ehci_pme); - -+/* -+ * Device [1022:7914] -+ * When in D0, PME# doesn't get asserted when plugging USB 2.0 device. -+ */ -+static void pci_fixup_amd_fch_xhci_pme(struct pci_dev *dev) -+{ -+ dev_info(&dev->dev, "PME# does not work under D0, disabling it\n"); -+ dev->pme_support &= ~(PCI_PM_CAP_PME_D0 >> PCI_PM_CAP_PME_SHIFT); -+} -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7914, pci_fixup_amd_fch_xhci_pme); -+ - /* - * Apple MacBook Pro: Avoid [mem 0x7fa00000-0x7fbfffff] - * -diff --git a/block/blk-merge.c b/block/blk-merge.c -index 94650cdf2924..f61b50a01bc7 100644 ---- a/block/blk-merge.c -+++ b/block/blk-merge.c -@@ -765,7 +765,7 @@ static struct request *attempt_merge(struct request_queue *q, - - req->__data_len += blk_rq_bytes(next); - -- if (req_op(req) != REQ_OP_DISCARD) -+ if (!blk_discard_mergable(req)) - elv_merge_requests(q, req, next); - - /* -diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c -index 79969c3c234f..c97fafa1b206 100644 ---- a/block/blk-mq-sysfs.c -+++ b/block/blk-mq-sysfs.c -@@ -145,20 +145,25 @@ static ssize_t blk_mq_hw_sysfs_nr_reserved_tags_show(struct blk_mq_hw_ctx *hctx, - - static ssize_t blk_mq_hw_sysfs_cpus_show(struct blk_mq_hw_ctx *hctx, char *page) - { -+ const size_t size = PAGE_SIZE - 1; - unsigned int i, first = 1; -- ssize_t ret = 0; -+ int ret = 0, pos = 0; - - for_each_cpu(i, hctx->cpumask) { - if (first) -- ret += sprintf(ret + page, "%u", i); -+ ret = snprintf(pos + page, size - pos, "%u", i); - else -- ret += sprintf(ret + page, ", %u", i); -+ ret = snprintf(pos + page, size - pos, ", %u", i); -+ -+ if (ret >= size - pos) -+ break; - - first = 0; -+ pos += ret; - } - -- ret += sprintf(ret + page, "\n"); -- return ret; -+ ret = snprintf(pos + page, size + 1 - pos, "\n"); -+ return pos + ret; - } - - static struct attribute *default_ctx_attrs[] = { -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index f816a7289104..422bba808f73 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -1086,7 +1086,7 @@ void af_alg_async_cb(struct crypto_async_request *_req, int err) - af_alg_free_resources(areq); - sock_put(sk); - -- iocb->ki_complete(iocb, err ? err : resultlen, 0); -+ iocb->ki_complete(iocb, err ? err : (int)resultlen, 0); - } - EXPORT_SYMBOL_GPL(af_alg_async_cb); - -diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c -index 5e457a7dd1c9..b6899be8065d 100644 ---- a/crypto/crypto_user.c -+++ b/crypto/crypto_user.c -@@ -288,8 +288,10 @@ static int crypto_report(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, - drop_alg: - crypto_mod_put(alg); - -- if (err) -+ if (err) { -+ kfree_skb(skb); - return err; -+ } - - return nlmsg_unicast(crypto_nlsk, skb, NETLINK_CB(in_skb).portid); - } -diff --git a/crypto/ecc.c b/crypto/ecc.c -index 18f32f2a5e1c..65ee29dda063 100644 ---- a/crypto/ecc.c -+++ b/crypto/ecc.c -@@ -898,36 +898,50 @@ static void ecc_point_mult(struct ecc_point *result, - static inline void ecc_swap_digits(const u64 *in, u64 *out, - unsigned int ndigits) - { -+ const __be64 *src = (__force __be64 *)in; - int i; - - for (i = 0; i < ndigits; i++) -- out[i] = __swab64(in[ndigits - 1 - i]); -+ out[i] = be64_to_cpu(src[ndigits - 1 - i]); - } - --int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits, -- const u64 *private_key, unsigned int private_key_len) -+static int __ecc_is_key_valid(const struct ecc_curve *curve, -+ const u64 *private_key, unsigned int ndigits) - { -- int nbytes; -- const struct ecc_curve *curve = ecc_get_curve(curve_id); -+ u64 one[ECC_MAX_DIGITS] = { 1, }; -+ u64 res[ECC_MAX_DIGITS]; - - if (!private_key) - return -EINVAL; - -- nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT; -- -- if (private_key_len != nbytes) -+ if (curve->g.ndigits != ndigits) - return -EINVAL; - -- if (vli_is_zero(private_key, ndigits)) -+ /* Make sure the private key is in the range [2, n-3]. */ -+ if (vli_cmp(one, private_key, ndigits) != -1) - return -EINVAL; -- -- /* Make sure the private key is in the range [1, n-1]. */ -- if (vli_cmp(curve->n, private_key, ndigits) != 1) -+ vli_sub(res, curve->n, one, ndigits); -+ vli_sub(res, res, one, ndigits); -+ if (vli_cmp(res, private_key, ndigits) != 1) - return -EINVAL; - - return 0; - } - -+int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits, -+ const u64 *private_key, unsigned int private_key_len) -+{ -+ int nbytes; -+ const struct ecc_curve *curve = ecc_get_curve(curve_id); -+ -+ nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT; -+ -+ if (private_key_len != nbytes) -+ return -EINVAL; -+ -+ return __ecc_is_key_valid(curve, private_key, ndigits); -+} -+ - /* - * ECC private keys are generated using the method of extra random bits, - * equivalent to that described in FIPS 186-4, Appendix B.4.1. -@@ -971,11 +985,8 @@ int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey) - if (err) - return err; - -- if (vli_is_zero(priv, ndigits)) -- return -EINVAL; -- -- /* Make sure the private key is in the range [1, n-1]. */ -- if (vli_cmp(curve->n, priv, ndigits) != 1) -+ /* Make sure the private key is in the valid range. */ -+ if (__ecc_is_key_valid(curve, priv, ndigits)) - return -EINVAL; - - ecc_swap_digits(priv, privkey, ndigits); -diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c -index f0348e388d01..1cb7c6a52f61 100644 ---- a/drivers/acpi/bus.c -+++ b/drivers/acpi/bus.c -@@ -196,7 +196,7 @@ int acpi_bus_get_private_data(acpi_handle handle, void **data) - { - acpi_status status; - -- if (!*data) -+ if (!data) - return -EINVAL; - - status = acpi_get_data(handle, acpi_bus_private_data_handler, data); -diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c -index 18af71057b44..fc300ce3ae8e 100644 ---- a/drivers/acpi/device_pm.c -+++ b/drivers/acpi/device_pm.c -@@ -1154,9 +1154,19 @@ static void acpi_dev_pm_detach(struct device *dev, bool power_off) - */ - int acpi_dev_pm_attach(struct device *dev, bool power_on) - { -+ /* -+ * Skip devices whose ACPI companions match the device IDs below, -+ * because they require special power management handling incompatible -+ * with the generic ACPI PM domain. -+ */ -+ static const struct acpi_device_id special_pm_ids[] = { -+ {"PNP0C0B", }, /* Generic ACPI fan */ -+ {"INT3404", }, /* Fan */ -+ {} -+ }; - struct acpi_device *adev = ACPI_COMPANION(dev); - -- if (!adev) -+ if (!adev || !acpi_match_device_ids(adev, special_pm_ids)) - return -ENODEV; - - if (dev->pm_domain) -diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c -index 9da7e7d874bd..ff36b0101ff0 100644 ---- a/drivers/acpi/osl.c -+++ b/drivers/acpi/osl.c -@@ -371,19 +371,21 @@ void *__ref acpi_os_map_memory(acpi_physical_address phys, acpi_size size) - } - EXPORT_SYMBOL_GPL(acpi_os_map_memory); - --static void acpi_os_drop_map_ref(struct acpi_ioremap *map) -+/* Must be called with mutex_lock(&acpi_ioremap_lock) */ -+static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map) - { -- if (!--map->refcount) -+ unsigned long refcount = --map->refcount; -+ -+ if (!refcount) - list_del_rcu(&map->list); -+ return refcount; - } - - static void acpi_os_map_cleanup(struct acpi_ioremap *map) - { -- if (!map->refcount) { -- synchronize_rcu_expedited(); -- acpi_unmap(map->phys, map->virt); -- kfree(map); -- } -+ synchronize_rcu_expedited(); -+ acpi_unmap(map->phys, map->virt); -+ kfree(map); - } - - /** -@@ -403,6 +405,7 @@ static void acpi_os_map_cleanup(struct acpi_ioremap *map) - void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) - { - struct acpi_ioremap *map; -+ unsigned long refcount; - - if (!acpi_permanent_mmap) { - __acpi_unmap_table(virt, size); -@@ -416,10 +419,11 @@ void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) - WARN(true, PREFIX "%s: bad address %p\n", __func__, virt); - return; - } -- acpi_os_drop_map_ref(map); -+ refcount = acpi_os_drop_map_ref(map); - mutex_unlock(&acpi_ioremap_lock); - -- acpi_os_map_cleanup(map); -+ if (!refcount) -+ acpi_os_map_cleanup(map); - } - EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem); - -@@ -454,6 +458,7 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) - { - u64 addr; - struct acpi_ioremap *map; -+ unsigned long refcount; - - if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY) - return; -@@ -469,10 +474,11 @@ void acpi_os_unmap_generic_address(struct acpi_generic_address *gas) - mutex_unlock(&acpi_ioremap_lock); - return; - } -- acpi_os_drop_map_ref(map); -+ refcount = acpi_os_drop_map_ref(map); - mutex_unlock(&acpi_ioremap_lock); - -- acpi_os_map_cleanup(map); -+ if (!refcount) -+ acpi_os_map_cleanup(map); - } - EXPORT_SYMBOL(acpi_os_unmap_generic_address); - -diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c -index e0b0399ff7ec..9d5cb3b7a7a2 100644 ---- a/drivers/android/binder_alloc.c -+++ b/drivers/android/binder_alloc.c -@@ -289,8 +289,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, - return 0; - - free_range: -- for (page_addr = end - PAGE_SIZE; page_addr >= start; -- page_addr -= PAGE_SIZE) { -+ for (page_addr = end - PAGE_SIZE; 1; page_addr -= PAGE_SIZE) { - bool ret; - size_t index; - -@@ -303,6 +302,8 @@ free_range: - WARN_ON(!ret); - - trace_binder_free_lru_end(alloc, index); -+ if (page_addr == start) -+ break; - continue; - - err_vm_insert_page_failed: -@@ -312,7 +313,8 @@ err_map_kernel_failed: - page->page_ptr = NULL; - err_alloc_page_failed: - err_page_ptr_cleared: -- ; -+ if (page_addr == start) -+ break; - } - err_no_vma: - if (mm) { -diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c -index 0813c654c893..b452359b6aae 100644 ---- a/drivers/block/drbd/drbd_state.c -+++ b/drivers/block/drbd/drbd_state.c -@@ -688,11 +688,9 @@ request_detach(struct drbd_device *device) - CS_VERBOSE | CS_ORDERED | CS_INHIBIT_MD_IO); - } - --enum drbd_state_rv --drbd_request_detach_interruptible(struct drbd_device *device) -+int drbd_request_detach_interruptible(struct drbd_device *device) - { -- enum drbd_state_rv rv; -- int ret; -+ int ret, rv; - - drbd_suspend_io(device); /* so no-one is stuck in drbd_al_begin_io */ - wait_event_interruptible(device->state_wait, -diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h -index b2a390ba73a0..f87371e55e68 100644 ---- a/drivers/block/drbd/drbd_state.h -+++ b/drivers/block/drbd/drbd_state.h -@@ -162,8 +162,7 @@ static inline int drbd_request_state(struct drbd_device *device, - } - - /* for use in adm_detach() (drbd_adm_detach(), drbd_adm_down()) */ --enum drbd_state_rv --drbd_request_detach_interruptible(struct drbd_device *device); -+int drbd_request_detach_interruptible(struct drbd_device *device); - - enum drbd_role conn_highest_role(struct drbd_connection *connection); - enum drbd_role conn_highest_peer(struct drbd_connection *connection); -diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c -index 34997df132e2..6beafaa335c7 100644 ---- a/drivers/block/rsxx/core.c -+++ b/drivers/block/rsxx/core.c -@@ -1025,8 +1025,10 @@ static void rsxx_pci_remove(struct pci_dev *dev) - - cancel_work_sync(&card->event_work); - -+ destroy_workqueue(card->event_wq); - rsxx_destroy_dev(card); - rsxx_dma_destroy(card); -+ destroy_workqueue(card->creg_ctrl.creg_wq); - - spin_lock_irqsave(&card->irq_lock, flags); - rsxx_disable_ier_and_isr(card, CR_INTR_ALL); -diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c -index 25173454efa3..091753765d99 100644 ---- a/drivers/char/hw_random/omap-rng.c -+++ b/drivers/char/hw_random/omap-rng.c -@@ -66,6 +66,13 @@ - #define OMAP4_RNG_OUTPUT_SIZE 0x8 - #define EIP76_RNG_OUTPUT_SIZE 0x10 - -+/* -+ * EIP76 RNG takes approx. 700us to produce 16 bytes of output data -+ * as per testing results. And to account for the lack of udelay()'s -+ * reliability, we keep the timeout as 1000us. -+ */ -+#define RNG_DATA_FILL_TIMEOUT 100 -+ - enum { - RNG_OUTPUT_0_REG = 0, - RNG_OUTPUT_1_REG, -@@ -175,7 +182,7 @@ static int omap_rng_do_read(struct hwrng *rng, void *data, size_t max, - if (max < priv->pdata->data_size) - return 0; - -- for (i = 0; i < 20; i++) { -+ for (i = 0; i < RNG_DATA_FILL_TIMEOUT; i++) { - present = priv->pdata->data_present(priv); - if (present || !wait) - break; -diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c -index d256110ba672..0023bde4d4ff 100644 ---- a/drivers/char/ppdev.c -+++ b/drivers/char/ppdev.c -@@ -623,20 +623,27 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - if (copy_from_user(time32, argp, sizeof(time32))) - return -EFAULT; - -+ if ((time32[0] < 0) || (time32[1] < 0)) -+ return -EINVAL; -+ - return pp_set_timeout(pp->pdev, time32[0], time32[1]); - - case PPSETTIME64: - if (copy_from_user(time64, argp, sizeof(time64))) - return -EFAULT; - -+ if ((time64[0] < 0) || (time64[1] < 0)) -+ return -EINVAL; -+ -+ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) -+ time64[1] >>= 32; -+ - return pp_set_timeout(pp->pdev, time64[0], time64[1]); - - case PPGETTIME32: - jiffies_to_timespec64(pp->pdev->timeout, &ts); - time32[0] = ts.tv_sec; - time32[1] = ts.tv_nsec / NSEC_PER_USEC; -- if ((time32[0] < 0) || (time32[1] < 0)) -- return -EINVAL; - - if (copy_to_user(argp, time32, sizeof(time32))) - return -EFAULT; -@@ -647,8 +654,9 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - jiffies_to_timespec64(pp->pdev->timeout, &ts); - time64[0] = ts.tv_sec; - time64[1] = ts.tv_nsec / NSEC_PER_USEC; -- if ((time64[0] < 0) || (time64[1] < 0)) -- return -EINVAL; -+ -+ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall()) -+ time64[1] <<= 32; - - if (copy_to_user(argp, time64, sizeof(time64))) - return -EFAULT; -diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c -index 44a3d16231f6..dd64b3b37400 100644 ---- a/drivers/char/tpm/tpm2-cmd.c -+++ b/drivers/char/tpm/tpm2-cmd.c -@@ -1029,6 +1029,10 @@ static int tpm2_get_cc_attrs_tbl(struct tpm_chip *chip) - - chip->cc_attrs_tbl = devm_kzalloc(&chip->dev, 4 * nr_commands, - GFP_KERNEL); -+ if (!chip->cc_attrs_tbl) { -+ rc = -ENOMEM; -+ goto out; -+ } - - rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY); - if (rc) -diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c -index e594cf8ee63b..8434d5530fb1 100644 ---- a/drivers/clk/renesas/r8a77995-cpg-mssr.c -+++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c -@@ -141,8 +141,8 @@ static const struct mssr_mod_clk r8a77995_mod_clks[] __initconst = { - DEF_MOD("vspbs", 627, R8A77995_CLK_S0D1), - DEF_MOD("ehci0", 703, R8A77995_CLK_S3D2), - DEF_MOD("hsusb", 704, R8A77995_CLK_S3D2), -- DEF_MOD("du1", 723, R8A77995_CLK_S2D1), -- DEF_MOD("du0", 724, R8A77995_CLK_S2D1), -+ DEF_MOD("du1", 723, R8A77995_CLK_S1D1), -+ DEF_MOD("du0", 724, R8A77995_CLK_S1D1), - DEF_MOD("lvds", 727, R8A77995_CLK_S2D1), - DEF_MOD("vin7", 804, R8A77995_CLK_S1D2), - DEF_MOD("vin6", 805, R8A77995_CLK_S1D2), -diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c -index 2b0d772b4f43..8cdfcd77e3ad 100644 ---- a/drivers/clk/rockchip/clk-rk3188.c -+++ b/drivers/clk/rockchip/clk-rk3188.c -@@ -362,8 +362,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { - RK2928_CLKGATE_CON(2), 5, GFLAGS), - MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT, - RK2928_CLKSEL_CON(21), 4, 1, MFLAGS), -- GATE(0, "sclk_mac_lbtest", "sclk_macref", -- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS), -+ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0, -+ RK2928_CLKGATE_CON(2), 12, GFLAGS), - - COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0, - RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS, -@@ -391,8 +391,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { - * Clock-Architecture Diagram 4 - */ - -- GATE(SCLK_SMC, "sclk_smc", "hclk_peri", -- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS), -+ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0, -+ RK2928_CLKGATE_CON(2), 4, GFLAGS), - - COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0, - RK2928_CLKSEL_CON(25), 0, 7, DFLAGS, -diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c -index 33d1cf4e6d80..0e5222d1944b 100644 ---- a/drivers/clk/rockchip/clk-rk3328.c -+++ b/drivers/clk/rockchip/clk-rk3328.c -@@ -392,7 +392,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = { - RK3328_CLKGATE_CON(1), 5, GFLAGS, - &rk3328_i2s1_fracmux), - GATE(SCLK_I2S1, "clk_i2s1", "i2s1_pre", CLK_SET_RATE_PARENT, -- RK3328_CLKGATE_CON(0), 6, GFLAGS), -+ RK3328_CLKGATE_CON(1), 6, GFLAGS), - COMPOSITE_NODIV(SCLK_I2S1_OUT, "i2s1_out", mux_i2s1out_p, 0, - RK3328_CLKSEL_CON(8), 12, 1, MFLAGS, - RK3328_CLKGATE_CON(1), 7, GFLAGS), -diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c -index 36a30a3cfad7..eaafc038368f 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c -+++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c -@@ -565,7 +565,7 @@ static const char * const dsi_dphy_parents[] = { "pll-video0", "pll-periph0" }; - static const u8 dsi_dphy_table[] = { 0, 2, }; - static SUNXI_CCU_M_WITH_MUX_TABLE_GATE(dsi_dphy_clk, "dsi-dphy", - dsi_dphy_parents, dsi_dphy_table, -- 0x168, 0, 4, 8, 2, BIT(31), CLK_SET_RATE_PARENT); -+ 0x168, 0, 4, 8, 2, BIT(15), CLK_SET_RATE_PARENT); - - static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu", - 0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT); -diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c -index 1729ff6a5aae..b09acda71abe 100644 ---- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c -+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c -@@ -460,7 +460,7 @@ static const char * const csi_sclk_parents[] = { "pll-periph0", "pll-periph1" }; - static SUNXI_CCU_M_WITH_MUX_GATE(csi_sclk_clk, "csi-sclk", csi_sclk_parents, - 0x134, 16, 4, 24, 3, BIT(31), 0); - --static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph0" }; -+static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph1" }; - static SUNXI_CCU_M_WITH_MUX_GATE(csi_mclk_clk, "csi-mclk", csi_mclk_parents, - 0x134, 0, 5, 8, 3, BIT(15), 0); - -diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c -index a28bb8f3f395..33854bf127f9 100644 ---- a/drivers/cpufreq/powernv-cpufreq.c -+++ b/drivers/cpufreq/powernv-cpufreq.c -@@ -1002,9 +1002,14 @@ static struct cpufreq_driver powernv_cpufreq_driver = { - - static int init_chip_info(void) - { -- unsigned int chip[256]; -+ unsigned int *chip; - unsigned int cpu, i; - unsigned int prev_chip_id = UINT_MAX; -+ int ret = 0; -+ -+ chip = kcalloc(num_possible_cpus(), sizeof(*chip), GFP_KERNEL); -+ if (!chip) -+ return -ENOMEM; - - for_each_possible_cpu(cpu) { - unsigned int id = cpu_to_chip_id(cpu); -@@ -1016,8 +1021,10 @@ static int init_chip_info(void) - } - - chips = kcalloc(nr_chips, sizeof(struct chip), GFP_KERNEL); -- if (!chips) -- return -ENOMEM; -+ if (!chips) { -+ ret = -ENOMEM; -+ goto free_and_return; -+ } - - for (i = 0; i < nr_chips; i++) { - chips[i].id = chip[i]; -@@ -1027,7 +1034,9 @@ static int init_chip_info(void) - per_cpu(chip_info, cpu) = &chips[i]; - } - -- return 0; -+free_and_return: -+ kfree(chip); -+ return ret; - } - - static inline void clean_chip_info(void) -diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c -index dc32f34e68d9..01acd88c4193 100644 ---- a/drivers/cpuidle/driver.c -+++ b/drivers/cpuidle/driver.c -@@ -62,24 +62,23 @@ static inline void __cpuidle_unset_driver(struct cpuidle_driver *drv) - * __cpuidle_set_driver - set per CPU driver variables for the given driver. - * @drv: a valid pointer to a struct cpuidle_driver - * -- * For each CPU in the driver's cpumask, unset the registered driver per CPU -- * to @drv. -- * -- * Returns 0 on success, -EBUSY if the CPUs have driver(s) already. -+ * Returns 0 on success, -EBUSY if any CPU in the cpumask have a driver -+ * different from drv already. - */ - static inline int __cpuidle_set_driver(struct cpuidle_driver *drv) - { - int cpu; - - for_each_cpu(cpu, drv->cpumask) { -+ struct cpuidle_driver *old_drv; - -- if (__cpuidle_get_cpu_driver(cpu)) { -- __cpuidle_unset_driver(drv); -+ old_drv = __cpuidle_get_cpu_driver(cpu); -+ if (old_drv && old_drv != drv) - return -EBUSY; -- } -+ } - -+ for_each_cpu(cpu, drv->cpumask) - per_cpu(cpuidle_drivers, cpu) = drv; -- } - - return 0; - } -diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c -index 8d4d8db244e9..d1d041de7f8a 100644 ---- a/drivers/crypto/amcc/crypto4xx_core.c -+++ b/drivers/crypto/amcc/crypto4xx_core.c -@@ -399,12 +399,8 @@ static u32 crypto4xx_build_sdr(struct crypto4xx_device *dev) - dma_alloc_coherent(dev->core_dev->device, - dev->scatter_buffer_size * PPC4XX_NUM_SD, - &dev->scatter_buffer_pa, GFP_ATOMIC); -- if (!dev->scatter_buffer_va) { -- dma_free_coherent(dev->core_dev->device, -- sizeof(struct ce_sd) * PPC4XX_NUM_SD, -- dev->sdr, dev->sdr_pa); -+ if (!dev->scatter_buffer_va) - return -ENOMEM; -- } - - sd_array = dev->sdr; - -diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c -index b6be383a51a6..84422435f39b 100644 ---- a/drivers/crypto/bcm/cipher.c -+++ b/drivers/crypto/bcm/cipher.c -@@ -4637,12 +4637,16 @@ static int spu_register_ahash(struct iproc_alg_s *driver_alg) - hash->halg.statesize = sizeof(struct spu_hash_export_s); - - if (driver_alg->auth_info.mode != HASH_MODE_HMAC) { -- hash->setkey = ahash_setkey; - hash->init = ahash_init; - hash->update = ahash_update; - hash->final = ahash_final; - hash->finup = ahash_finup; - hash->digest = ahash_digest; -+ if ((driver_alg->auth_info.alg == HASH_ALG_AES) && -+ ((driver_alg->auth_info.mode == HASH_MODE_XCBC) || -+ (driver_alg->auth_info.mode == HASH_MODE_CMAC))) { -+ hash->setkey = ahash_setkey; -+ } - } else { - hash->setkey = ahash_hmac_setkey; - hash->init = ahash_hmac_init; -diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c -index d608043c0280..df82af3dd970 100644 ---- a/drivers/crypto/ccp/ccp-dmaengine.c -+++ b/drivers/crypto/ccp/ccp-dmaengine.c -@@ -341,6 +341,7 @@ static struct ccp_dma_desc *ccp_alloc_dma_desc(struct ccp_dma_chan *chan, - desc->tx_desc.flags = flags; - desc->tx_desc.tx_submit = ccp_tx_submit; - desc->ccp = chan->ccp; -+ INIT_LIST_HEAD(&desc->entry); - INIT_LIST_HEAD(&desc->pending); - INIT_LIST_HEAD(&desc->active); - desc->status = DMA_IN_PROGRESS; -diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c -index 8a411514a7c5..dc9c0032c97b 100644 ---- a/drivers/devfreq/devfreq.c -+++ b/drivers/devfreq/devfreq.c -@@ -133,6 +133,7 @@ int devfreq_update_status(struct devfreq *devfreq, unsigned long freq) - int lev, prev_lev, ret = 0; - unsigned long cur_time; - -+ lockdep_assert_held(&devfreq->lock); - cur_time = jiffies; - - /* Immediately exit if previous_freq is not initialized yet. */ -@@ -1161,12 +1162,17 @@ static ssize_t trans_stat_show(struct device *dev, - int i, j; - unsigned int max_state = devfreq->profile->max_state; - -- if (!devfreq->stop_polling && -- devfreq_update_status(devfreq, devfreq->previous_freq)) -- return 0; - if (max_state == 0) - return sprintf(buf, "Not Supported.\n"); - -+ mutex_lock(&devfreq->lock); -+ if (!devfreq->stop_polling && -+ devfreq_update_status(devfreq, devfreq->previous_freq)) { -+ mutex_unlock(&devfreq->lock); -+ return 0; -+ } -+ mutex_unlock(&devfreq->lock); -+ - len = sprintf(buf, " From : To\n"); - len += sprintf(buf + len, " :"); - for (i = 0; i < max_state; i++) -diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c -index 74794c9859f6..6d7d2d54eacf 100644 ---- a/drivers/dma/coh901318.c -+++ b/drivers/dma/coh901318.c -@@ -1797,13 +1797,10 @@ static struct dma_chan *coh901318_xlate(struct of_phandle_args *dma_spec, - static int coh901318_config(struct coh901318_chan *cohc, - struct coh901318_params *param) - { -- unsigned long flags; - const struct coh901318_params *p; - int channel = cohc->id; - void __iomem *virtbase = cohc->base->virtbase; - -- spin_lock_irqsave(&cohc->lock, flags); -- - if (param) - p = param; - else -@@ -1823,8 +1820,6 @@ static int coh901318_config(struct coh901318_chan *cohc, - coh901318_set_conf(cohc, p->config); - coh901318_set_ctrl(cohc, p->ctrl_lli_last); - -- spin_unlock_irqrestore(&cohc->lock, flags); -- - return 0; - } - -diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c -index 0f389e008ce6..055d83b6cb68 100644 ---- a/drivers/dma/dw/core.c -+++ b/drivers/dma/dw/core.c -@@ -160,12 +160,14 @@ static void dwc_initialize_chan_idma32(struct dw_dma_chan *dwc) - - static void dwc_initialize_chan_dw(struct dw_dma_chan *dwc) - { -+ struct dw_dma *dw = to_dw_dma(dwc->chan.device); - u32 cfghi = DWC_CFGH_FIFO_MODE; - u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority); - bool hs_polarity = dwc->dws.hs_polarity; - - cfghi |= DWC_CFGH_DST_PER(dwc->dws.dst_id); - cfghi |= DWC_CFGH_SRC_PER(dwc->dws.src_id); -+ cfghi |= DWC_CFGH_PROTCTL(dw->pdata->protctl); - - /* Set polarity of handshake interface */ - cfglo |= hs_polarity ? DWC_CFGL_HS_DST_POL | DWC_CFGL_HS_SRC_POL : 0; -diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c -index bc31fe802061..46a519e07195 100644 ---- a/drivers/dma/dw/platform.c -+++ b/drivers/dma/dw/platform.c -@@ -162,6 +162,12 @@ dw_dma_parse_dt(struct platform_device *pdev) - pdata->multi_block[tmp] = 1; - } - -+ if (!of_property_read_u32(np, "snps,dma-protection-control", &tmp)) { -+ if (tmp > CHAN_PROTCTL_MASK) -+ return NULL; -+ pdata->protctl = tmp; -+ } -+ - return pdata; - } - #else -diff --git a/drivers/dma/dw/regs.h b/drivers/dma/dw/regs.h -index 09e7dfdbb790..646c9c960c07 100644 ---- a/drivers/dma/dw/regs.h -+++ b/drivers/dma/dw/regs.h -@@ -200,6 +200,10 @@ enum dw_dma_msize { - #define DWC_CFGH_FCMODE (1 << 0) - #define DWC_CFGH_FIFO_MODE (1 << 1) - #define DWC_CFGH_PROTCTL(x) ((x) << 2) -+#define DWC_CFGH_PROTCTL_DATA (0 << 2) /* data access - always set */ -+#define DWC_CFGH_PROTCTL_PRIV (1 << 2) /* privileged -> AHB HPROT[1] */ -+#define DWC_CFGH_PROTCTL_BUFFER (2 << 2) /* bufferable -> AHB HPROT[2] */ -+#define DWC_CFGH_PROTCTL_CACHE (4 << 2) /* cacheable -> AHB HPROT[3] */ - #define DWC_CFGH_DS_UPD_EN (1 << 5) - #define DWC_CFGH_SS_UPD_EN (1 << 6) - #define DWC_CFGH_SRC_PER(x) ((x) << 7) -diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c -index 4a0612fb9c07..b9b48d45a6dc 100644 ---- a/drivers/extcon/extcon-max8997.c -+++ b/drivers/extcon/extcon-max8997.c -@@ -321,12 +321,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info, - { - int ret = 0; - -- if (usb_type == MAX8997_USB_HOST) { -- ret = max8997_muic_set_path(info, info->path_usb, attached); -- if (ret < 0) { -- dev_err(info->dev, "failed to update muic register\n"); -- return ret; -- } -+ ret = max8997_muic_set_path(info, info->path_usb, attached); -+ if (ret < 0) { -+ dev_err(info->dev, "failed to update muic register\n"); -+ return ret; - } - - switch (usb_type) { -diff --git a/drivers/firmware/qcom_scm-64.c b/drivers/firmware/qcom_scm-64.c -index 6e6d561708e2..e9001075f676 100644 ---- a/drivers/firmware/qcom_scm-64.c -+++ b/drivers/firmware/qcom_scm-64.c -@@ -158,7 +158,7 @@ static int qcom_scm_call(struct device *dev, u32 svc_id, u32 cmd_id, - kfree(args_virt); - } - -- if (res->a0 < 0) -+ if ((long)res->a0 < 0) - return qcom_scm_remap_error(res->a0); - - return 0; -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index 715babaa886a..3aa7fe6baf2a 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -1314,11 +1314,28 @@ late_initcall_sync(acpi_gpio_handle_deferred_request_irqs); - - static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { - { -+ /* -+ * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for -+ * a non existing micro-USB-B connector which puts the HDMI -+ * DDC pins in GPIO mode, breaking HDMI support. -+ */ - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "MINIX"), - DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), - } - }, -+ { -+ /* -+ * The Terra Pad 1061 has a micro-USB-B id-pin handler, which -+ * instead of controlling the actual micro-USB-B turns the 5V -+ * boost for its USB-A connector off. The actual micro-USB-B -+ * connector is wired for charging only. -+ */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"), -+ } -+ }, - {} /* Terminating entry */ - }; - -diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c -index 576a417690d4..128d6cfb7bbb 100644 ---- a/drivers/gpu/drm/i810/i810_dma.c -+++ b/drivers/gpu/drm/i810/i810_dma.c -@@ -721,7 +721,7 @@ static void i810_dma_dispatch_vertex(struct drm_device *dev, - if (nbox > I810_NR_SAREA_CLIPRECTS) - nbox = I810_NR_SAREA_CLIPRECTS; - -- if (used > 4 * 1024) -+ if (used < 0 || used > 4 * 1024) - used = 0; - - if (sarea_priv->dirty) -@@ -1041,7 +1041,7 @@ static void i810_dma_dispatch_mc(struct drm_device *dev, struct drm_buf *buf, in - if (u != I810_BUF_CLIENT) - DRM_DEBUG("MC found buffer that isn't mine!\n"); - -- if (used > 4 * 1024) -+ if (used < 0 || used > 4 * 1024) - used = 0; - - sarea_priv->dirty = 0x7f; -diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c -index 4e6eab53e34e..2f021c1a2fa6 100644 ---- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c -+++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c -@@ -667,10 +667,13 @@ static ssize_t cyc_threshold_store(struct device *dev, - - if (kstrtoul(buf, 16, &val)) - return -EINVAL; -+ -+ /* mask off max threshold before checking min value */ -+ val &= ETM_CYC_THRESHOLD_MASK; - if (val < drvdata->ccitmin) - return -EINVAL; - -- config->ccctlr = val & ETM_CYC_THRESHOLD_MASK; -+ config->ccctlr = val; - return size; - } - static DEVICE_ATTR_RW(cyc_threshold); -@@ -701,14 +704,16 @@ static ssize_t bb_ctrl_store(struct device *dev, - return -EINVAL; - if (!drvdata->nr_addr_cmp) - return -EINVAL; -+ - /* -- * Bit[7:0] selects which address range comparator is used for -- * branch broadcast control. -+ * Bit[8] controls include(1) / exclude(0), bits[0-7] select -+ * individual range comparators. If include then at least 1 -+ * range must be selected. - */ -- if (BMVAL(val, 0, 7) > drvdata->nr_addr_cmp) -+ if ((val & BIT(8)) && (BMVAL(val, 0, 7) == 0)) - return -EINVAL; - -- config->bb_ctrl = val; -+ config->bb_ctrl = val & GENMASK(8, 0); - return size; - } - static DEVICE_ATTR_RW(bb_ctrl); -@@ -1341,8 +1346,8 @@ static ssize_t seq_event_store(struct device *dev, - - spin_lock(&drvdata->spinlock); - idx = config->seq_idx; -- /* RST, bits[7:0] */ -- config->seq_ctrl[idx] = val & 0xFF; -+ /* Seq control has two masks B[15:8] F[7:0] */ -+ config->seq_ctrl[idx] = val & 0xFFFF; - spin_unlock(&drvdata->spinlock); - return size; - } -@@ -1597,7 +1602,7 @@ static ssize_t res_ctrl_store(struct device *dev, - if (idx % 2 != 0) - /* PAIRINV, bit[21] */ - val &= ~BIT(21); -- config->res_ctrl[idx] = val; -+ config->res_ctrl[idx] = val & GENMASK(21, 0); - spin_unlock(&drvdata->spinlock); - return size; - } -diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c -index 757801d27604..6a451b4fc04d 100644 ---- a/drivers/hwtracing/intel_th/core.c -+++ b/drivers/hwtracing/intel_th/core.c -@@ -628,10 +628,8 @@ intel_th_subdevice_alloc(struct intel_th *th, - } - - err = intel_th_device_add_resources(thdev, res, subdev->nres); -- if (err) { -- put_device(&thdev->dev); -+ if (err) - goto fail_put_device; -- } - - if (subdev->type == INTEL_TH_OUTPUT) { - thdev->dev.devt = MKDEV(th->major, th->num_thdevs); -@@ -644,10 +642,8 @@ intel_th_subdevice_alloc(struct intel_th *th, - } - - err = device_add(&thdev->dev); -- if (err) { -- put_device(&thdev->dev); -+ if (err) - goto fail_free_res; -- } - - /* need switch driver to be loaded to enumerate the rest */ - if (subdev->type == INTEL_TH_SWITCH && !req) { -diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c -index 7486d5d67186..c224b92a80f1 100644 ---- a/drivers/hwtracing/intel_th/pci.c -+++ b/drivers/hwtracing/intel_th/pci.c -@@ -193,6 +193,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = { - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5), - .driver_data = (kernel_ulong_t)&intel_th_2x, - }, -+ { -+ /* Ice Lake CPU */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8a29), -+ .driver_data = (kernel_ulong_t)&intel_th_2x, -+ }, -+ { -+ /* Tiger Lake CPU */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9a33), -+ .driver_data = (kernel_ulong_t)&intel_th_2x, -+ }, - { - /* Tiger Lake PCH */ - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6), -diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c -index b73dd837fb53..26f83029f64a 100644 ---- a/drivers/i2c/busses/i2c-imx.c -+++ b/drivers/i2c/busses/i2c-imx.c -@@ -1088,7 +1088,8 @@ static int i2c_imx_probe(struct platform_device *pdev) - /* Get I2C clock */ - i2c_imx->clk = devm_clk_get(&pdev->dev, NULL); - if (IS_ERR(i2c_imx->clk)) { -- dev_err(&pdev->dev, "can't get I2C clock\n"); -+ if (PTR_ERR(i2c_imx->clk) != -EPROBE_DEFER) -+ dev_err(&pdev->dev, "can't get I2C clock\n"); - return PTR_ERR(i2c_imx->clk); - } - -diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c -index 8d474bb1dc15..17d727e0b842 100644 ---- a/drivers/i2c/i2c-core-of.c -+++ b/drivers/i2c/i2c-core-of.c -@@ -238,14 +238,14 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action, - } - - client = of_i2c_register_device(adap, rd->dn); -- put_device(&adap->dev); -- - if (IS_ERR(client)) { - dev_err(&adap->dev, "failed to create client for '%pOF'\n", - rd->dn); -+ put_device(&adap->dev); - of_node_clear_flag(rd->dn, OF_POPULATED); - return notifier_from_errno(PTR_ERR(client)); - } -+ put_device(&adap->dev); - break; - case OF_RECONFIG_CHANGE_REMOVE: - /* already depopulated? */ -diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c -index 7851bd90ef64..b470cb8132da 100644 ---- a/drivers/iio/humidity/hdc100x.c -+++ b/drivers/iio/humidity/hdc100x.c -@@ -237,7 +237,7 @@ static int hdc100x_read_raw(struct iio_dev *indio_dev, - *val2 = 65536; - return IIO_VAL_FRACTIONAL; - } else { -- *val = 100; -+ *val = 100000; - *val2 = 65536; - return IIO_VAL_FRACTIONAL; - } -diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c -index 6f975538996c..c950aa10d0ae 100644 ---- a/drivers/iio/imu/adis16480.c -+++ b/drivers/iio/imu/adis16480.c -@@ -724,6 +724,7 @@ static const struct iio_info adis16480_info = { - .write_raw = &adis16480_write_raw, - .update_scan_mode = adis_update_scan_mode, - .driver_module = THIS_MODULE, -+ .debugfs_reg_access = adis_debugfs_reg_access, - }; - - static int adis16480_stop_device(struct iio_dev *indio_dev) -diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c -index 9dcdc0a8685e..9f78bb07744c 100644 ---- a/drivers/infiniband/hw/hfi1/chip.c -+++ b/drivers/infiniband/hw/hfi1/chip.c -@@ -1074,6 +1074,8 @@ static void log_state_transition(struct hfi1_pportdata *ppd, u32 state); - static void log_physical_state(struct hfi1_pportdata *ppd, u32 state); - static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state, - int msecs); -+static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd, -+ int msecs); - static void read_planned_down_reason_code(struct hfi1_devdata *dd, u8 *pdrrc); - static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr); - static void handle_temp_err(struct hfi1_devdata *dd); -@@ -10731,13 +10733,15 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state) - break; - - ppd->port_error_action = 0; -- ppd->host_link_state = HLS_DN_POLL; - - if (quick_linkup) { - /* quick linkup does not go into polling */ - ret = do_quick_linkup(dd); - } else { - ret1 = set_physical_link_state(dd, PLS_POLLING); -+ if (!ret1) -+ ret1 = wait_phys_link_out_of_offline(ppd, -+ 3000); - if (ret1 != HCMD_SUCCESS) { - dd_dev_err(dd, - "Failed to transition to Polling link state, return 0x%x\n", -@@ -10745,6 +10749,14 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state) - ret = -EINVAL; - } - } -+ -+ /* -+ * Change the host link state after requesting DC8051 to -+ * change its physical state so that we can ignore any -+ * interrupt with stale LNI(XX) error, which will not be -+ * cleared until DC8051 transitions to Polling state. -+ */ -+ ppd->host_link_state = HLS_DN_POLL; - ppd->offline_disabled_reason = - HFI1_ODR_MASK(OPA_LINKDOWN_REASON_NONE); - /* -@@ -12870,6 +12882,39 @@ static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd, - return read_state; - } - -+/* -+ * wait_phys_link_out_of_offline - wait for any out of offline state -+ * @ppd: port device -+ * @msecs: the number of milliseconds to wait -+ * -+ * Wait up to msecs milliseconds for any out of offline physical link -+ * state change to occur. -+ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT. -+ */ -+static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd, -+ int msecs) -+{ -+ u32 read_state; -+ unsigned long timeout; -+ -+ timeout = jiffies + msecs_to_jiffies(msecs); -+ while (1) { -+ read_state = read_physical_state(ppd->dd); -+ if ((read_state & 0xF0) != PLS_OFFLINE) -+ break; -+ if (time_after(jiffies, timeout)) { -+ dd_dev_err(ppd->dd, -+ "timeout waiting for phy link out of offline. Read state 0x%x, %dms\n", -+ read_state, msecs); -+ return -ETIMEDOUT; -+ } -+ usleep_range(1950, 2050); /* sleep 2ms-ish */ -+ } -+ -+ log_state_transition(ppd, read_state); -+ return read_state; -+} -+ - #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \ - (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK) - -diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c -index c3c96c5869ed..718dcdef946e 100644 ---- a/drivers/infiniband/hw/hfi1/vnic_sdma.c -+++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c -@@ -57,7 +57,6 @@ - - #define HFI1_VNIC_TXREQ_NAME_LEN 32 - #define HFI1_VNIC_SDMA_DESC_WTRMRK 64 --#define HFI1_VNIC_SDMA_RETRY_COUNT 1 - - /* - * struct vnic_txreq - VNIC transmit descriptor -@@ -67,7 +66,6 @@ - * @pad: pad buffer - * @plen: pad length - * @pbc_val: pbc value -- * @retry_count: tx retry count - */ - struct vnic_txreq { - struct sdma_txreq txreq; -@@ -77,8 +75,6 @@ struct vnic_txreq { - unsigned char pad[HFI1_VNIC_MAX_PAD]; - u16 plen; - __le64 pbc_val; -- -- u32 retry_count; - }; - - static void vnic_sdma_complete(struct sdma_txreq *txreq, -@@ -196,7 +192,6 @@ int hfi1_vnic_send_dma(struct hfi1_devdata *dd, u8 q_idx, - ret = build_vnic_tx_desc(sde, tx, pbc); - if (unlikely(ret)) - goto free_desc; -- tx->retry_count = 0; - - ret = sdma_send_txreq(sde, &vnic_sdma->wait, &tx->txreq, - vnic_sdma->pkts_sent); -@@ -238,14 +233,14 @@ static int hfi1_vnic_sdma_sleep(struct sdma_engine *sde, - struct hfi1_vnic_sdma *vnic_sdma = - container_of(wait, struct hfi1_vnic_sdma, wait); - struct hfi1_ibdev *dev = &vnic_sdma->dd->verbs_dev; -- struct vnic_txreq *tx = container_of(txreq, struct vnic_txreq, txreq); - -- if (sdma_progress(sde, seq, txreq)) -- if (tx->retry_count++ < HFI1_VNIC_SDMA_RETRY_COUNT) -- return -EAGAIN; -+ write_seqlock(&dev->iowait_lock); -+ if (sdma_progress(sde, seq, txreq)) { -+ write_sequnlock(&dev->iowait_lock); -+ return -EAGAIN; -+ } - - vnic_sdma->state = HFI1_VNIC_SDMA_Q_DEFERRED; -- write_seqlock(&dev->iowait_lock); - if (list_empty(&vnic_sdma->wait.list)) - iowait_queue(pkts_sent, wait, &sde->dmawait); - write_sequnlock(&dev->iowait_lock); -diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h -index 435748858252..8e8917ebb013 100644 ---- a/drivers/infiniband/hw/hns/hns_roce_hem.h -+++ b/drivers/infiniband/hw/hns/hns_roce_hem.h -@@ -52,7 +52,7 @@ enum { - - #define HNS_ROCE_HEM_CHUNK_LEN \ - ((256 - sizeof(struct list_head) - 2 * sizeof(int)) / \ -- (sizeof(struct scatterlist))) -+ (sizeof(struct scatterlist) + sizeof(void *))) - - enum { - HNS_ROCE_HEM_PAGE_SHIFT = 12, -diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c -index e219093d2764..d2da28d613f2 100644 ---- a/drivers/infiniband/hw/mlx4/sysfs.c -+++ b/drivers/infiniband/hw/mlx4/sysfs.c -@@ -353,16 +353,12 @@ err: - - static void get_name(struct mlx4_ib_dev *dev, char *name, int i, int max) - { -- char base_name[9]; -- -- /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n */ -- strlcpy(name, pci_name(dev->dev->persist->pdev), max); -- strncpy(base_name, name, 8); /*till xxxx:yy:*/ -- base_name[8] = '\0'; -- /* with no ARI only 3 last bits are used so when the fn is higher than 8 -+ /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n -+ * with no ARI only 3 last bits are used so when the fn is higher than 8 - * need to add it to the dev num, so count in the last number will be - * modulo 8 */ -- sprintf(name, "%s%.2d.%d", base_name, (i/8), (i%8)); -+ snprintf(name, max, "%.8s%.2d.%d", pci_name(dev->dev->persist->pdev), -+ i / 8, i % 8); - } - - struct mlx4_port { -diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c -index ca2638d8f35e..d831f3e61ae8 100644 ---- a/drivers/infiniband/hw/qib/qib_sysfs.c -+++ b/drivers/infiniband/hw/qib/qib_sysfs.c -@@ -301,6 +301,9 @@ static ssize_t qib_portattr_show(struct kobject *kobj, - struct qib_pportdata *ppd = - container_of(kobj, struct qib_pportdata, pport_kobj); - -+ if (!pattr->show) -+ return -EIO; -+ - return pattr->show(ppd, buf); - } - -@@ -312,6 +315,9 @@ static ssize_t qib_portattr_store(struct kobject *kobj, - struct qib_pportdata *ppd = - container_of(kobj, struct qib_pportdata, pport_kobj); - -+ if (!pattr->store) -+ return -EIO; -+ - return pattr->store(ppd, buf, len); - } - -diff --git a/drivers/input/joystick/psxpad-spi.c b/drivers/input/joystick/psxpad-spi.c -index 28b473f6cbb6..092096ee06b9 100644 ---- a/drivers/input/joystick/psxpad-spi.c -+++ b/drivers/input/joystick/psxpad-spi.c -@@ -292,7 +292,7 @@ static int psxpad_spi_probe(struct spi_device *spi) - if (!pad) - return -ENOMEM; - -- pdev = input_allocate_polled_device(); -+ pdev = devm_input_allocate_polled_device(&spi->dev); - if (!pdev) { - dev_err(&spi->dev, "failed to allocate input device\n"); - return -ENOMEM; -diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c -index 7db53eab7012..111a71190547 100644 ---- a/drivers/input/mouse/synaptics.c -+++ b/drivers/input/mouse/synaptics.c -@@ -175,6 +175,7 @@ static const char * const smbus_pnp_ids[] = { - "LEN0071", /* T480 */ - "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */ - "LEN0073", /* X1 Carbon G5 (Elantech) */ -+ "LEN0091", /* X1 Carbon 6 */ - "LEN0092", /* X1 Carbon 6 */ - "LEN0093", /* T480 */ - "LEN0096", /* X280 */ -diff --git a/drivers/input/rmi4/rmi_f34v7.c b/drivers/input/rmi4/rmi_f34v7.c -index 3991d2943660..099dde68e332 100644 ---- a/drivers/input/rmi4/rmi_f34v7.c -+++ b/drivers/input/rmi4/rmi_f34v7.c -@@ -1192,6 +1192,9 @@ int rmi_f34v7_do_reflash(struct f34_data *f34, const struct firmware *fw) - { - int ret; - -+ f34->fn->rmi_dev->driver->set_irq_bits(f34->fn->rmi_dev, -+ f34->fn->irq_mask); -+ - rmi_f34v7_read_queries_bl_version(f34); - - f34->v7.image = fw->data; -diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c -index b6ccf39c6a7b..4b2466cf2fb1 100644 ---- a/drivers/input/rmi4/rmi_smbus.c -+++ b/drivers/input/rmi4/rmi_smbus.c -@@ -166,7 +166,6 @@ static int rmi_smb_write_block(struct rmi_transport_dev *xport, u16 rmiaddr, - /* prepare to write next block of bytes */ - cur_len -= SMB_MAX_COUNT; - databuff += SMB_MAX_COUNT; -- rmiaddr += SMB_MAX_COUNT; - } - exit: - mutex_unlock(&rmi_smb->page_mutex); -@@ -218,7 +217,6 @@ static int rmi_smb_read_block(struct rmi_transport_dev *xport, u16 rmiaddr, - /* prepare to read next block of bytes */ - cur_len -= SMB_MAX_COUNT; - databuff += SMB_MAX_COUNT; -- rmiaddr += SMB_MAX_COUNT; - } - - retval = 0; -diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c -index beaf61ce775b..a9af83de88bb 100644 ---- a/drivers/input/touchscreen/cyttsp4_core.c -+++ b/drivers/input/touchscreen/cyttsp4_core.c -@@ -1972,11 +1972,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) - - /* get sysinfo */ - md->si = &cd->sysinfo; -- if (!md->si) { -- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n", -- __func__, md->si); -- goto error_get_sysinfo; -- } - - rc = cyttsp4_setup_input_device(cd); - if (rc) -@@ -1986,8 +1981,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) - - error_init_input: - input_free_device(md->input); --error_get_sysinfo: -- input_set_drvdata(md->input, NULL); - error_alloc_failed: - dev_err(dev, "%s failed.\n", __func__); - return rc; -diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c -index 2bfa89ec552c..777dd5b159d3 100644 ---- a/drivers/input/touchscreen/goodix.c -+++ b/drivers/input/touchscreen/goodix.c -@@ -92,6 +92,15 @@ static const unsigned long goodix_irq_flags[] = { - */ - static const struct dmi_system_id rotated_screen[] = { - #if defined(CONFIG_DMI) && defined(CONFIG_X86) -+ { -+ .ident = "Teclast X89", -+ .matches = { -+ /* tPAD is too generic, also match on bios date */ -+ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), -+ DMI_MATCH(DMI_BOARD_NAME, "tPAD"), -+ DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), -+ }, -+ }, - { - .ident = "WinBook TW100", - .matches = { -diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c -index eade36dafa34..4c239f18240d 100644 ---- a/drivers/isdn/gigaset/usb-gigaset.c -+++ b/drivers/isdn/gigaset/usb-gigaset.c -@@ -574,8 +574,7 @@ static int gigaset_initcshw(struct cardstate *cs) - { - struct usb_cardstate *ucs; - -- cs->hw.usb = ucs = -- kmalloc(sizeof(struct usb_cardstate), GFP_KERNEL); -+ cs->hw.usb = ucs = kzalloc(sizeof(struct usb_cardstate), GFP_KERNEL); - if (!ucs) { - pr_err("out of memory\n"); - return -ENOMEM; -@@ -587,9 +586,6 @@ static int gigaset_initcshw(struct cardstate *cs) - ucs->bchars[3] = 0; - ucs->bchars[4] = 0x11; - ucs->bchars[5] = 0x13; -- ucs->bulk_out_buffer = NULL; -- ucs->bulk_out_urb = NULL; -- ucs->read_urb = NULL; - tasklet_init(&cs->write_tasklet, - gigaset_modem_fill, (unsigned long) cs); - -@@ -688,6 +684,11 @@ static int gigaset_probe(struct usb_interface *interface, - return -ENODEV; - } - -+ if (hostif->desc.bNumEndpoints < 2) { -+ dev_err(&interface->dev, "missing endpoints\n"); -+ return -ENODEV; -+ } -+ - dev_info(&udev->dev, "%s: Device matched ... !\n", __func__); - - /* allocate memory for our device state and initialize it */ -@@ -707,6 +708,12 @@ static int gigaset_probe(struct usb_interface *interface, - - endpoint = &hostif->endpoint[0].desc; - -+ if (!usb_endpoint_is_bulk_out(endpoint)) { -+ dev_err(&interface->dev, "missing bulk-out endpoint\n"); -+ retval = -ENODEV; -+ goto error; -+ } -+ - buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); - ucs->bulk_out_size = buffer_size; - ucs->bulk_out_epnum = usb_endpoint_num(endpoint); -@@ -726,6 +733,12 @@ static int gigaset_probe(struct usb_interface *interface, - - endpoint = &hostif->endpoint[1].desc; - -+ if (!usb_endpoint_is_int_in(endpoint)) { -+ dev_err(&interface->dev, "missing int-in endpoint\n"); -+ retval = -ENODEV; -+ goto error; -+ } -+ - ucs->busy = 0; - - ucs->read_urb = usb_alloc_urb(0, GFP_KERNEL); -diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c -index b322821a6323..9b78f4a74a12 100644 ---- a/drivers/md/dm-zoned-metadata.c -+++ b/drivers/md/dm-zoned-metadata.c -@@ -552,6 +552,7 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd, - TASK_UNINTERRUPTIBLE); - if (test_bit(DMZ_META_ERROR, &mblk->state)) { - dmz_release_mblock(zmd, mblk); -+ dmz_check_bdev(zmd->dev); - return ERR_PTR(-EIO); - } - -@@ -623,6 +624,8 @@ static int dmz_rdwr_block(struct dmz_metadata *zmd, int op, sector_t block, - ret = submit_bio_wait(bio); - bio_put(bio); - -+ if (ret) -+ dmz_check_bdev(zmd->dev); - return ret; - } - -@@ -689,6 +692,7 @@ static int dmz_write_dirty_mblocks(struct dmz_metadata *zmd, - TASK_UNINTERRUPTIBLE); - if (test_bit(DMZ_META_ERROR, &mblk->state)) { - clear_bit(DMZ_META_ERROR, &mblk->state); -+ dmz_check_bdev(zmd->dev); - ret = -EIO; - } - nr_mblks_submitted--; -@@ -766,7 +770,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) - /* If there are no dirty metadata blocks, just flush the device cache */ - if (list_empty(&write_list)) { - ret = blkdev_issue_flush(zmd->dev->bdev, GFP_NOIO, NULL); -- goto out; -+ goto err; - } - - /* -@@ -776,7 +780,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) - */ - ret = dmz_log_dirty_mblocks(zmd, &write_list); - if (ret) -- goto out; -+ goto err; - - /* - * The log is on disk. It is now safe to update in place -@@ -784,11 +788,11 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) - */ - ret = dmz_write_dirty_mblocks(zmd, &write_list, zmd->mblk_primary); - if (ret) -- goto out; -+ goto err; - - ret = dmz_write_sb(zmd, zmd->mblk_primary); - if (ret) -- goto out; -+ goto err; - - while (!list_empty(&write_list)) { - mblk = list_first_entry(&write_list, struct dmz_mblock, link); -@@ -803,16 +807,20 @@ int dmz_flush_metadata(struct dmz_metadata *zmd) - - zmd->sb_gen++; - out: -- if (ret && !list_empty(&write_list)) { -- spin_lock(&zmd->mblk_lock); -- list_splice(&write_list, &zmd->mblk_dirty_list); -- spin_unlock(&zmd->mblk_lock); -- } -- - dmz_unlock_flush(zmd); - up_write(&zmd->mblk_sem); - - return ret; -+ -+err: -+ if (!list_empty(&write_list)) { -+ spin_lock(&zmd->mblk_lock); -+ list_splice(&write_list, &zmd->mblk_dirty_list); -+ spin_unlock(&zmd->mblk_lock); -+ } -+ if (!dmz_check_bdev(zmd->dev)) -+ ret = -EIO; -+ goto out; - } - - /* -@@ -1235,6 +1243,7 @@ static int dmz_update_zone(struct dmz_metadata *zmd, struct dm_zone *zone) - if (ret) { - dmz_dev_err(zmd->dev, "Get zone %u report failed", - dmz_id(zmd, zone)); -+ dmz_check_bdev(zmd->dev); - return ret; - } - -diff --git a/drivers/md/dm-zoned-reclaim.c b/drivers/md/dm-zoned-reclaim.c -index a9f84a998476..2fad512dce98 100644 ---- a/drivers/md/dm-zoned-reclaim.c -+++ b/drivers/md/dm-zoned-reclaim.c -@@ -81,6 +81,7 @@ static int dmz_reclaim_align_wp(struct dmz_reclaim *zrc, struct dm_zone *zone, - "Align zone %u wp %llu to %llu (wp+%u) blocks failed %d", - dmz_id(zmd, zone), (unsigned long long)wp_block, - (unsigned long long)block, nr_blocks, ret); -+ dmz_check_bdev(zrc->dev); - return ret; - } - -@@ -490,12 +491,7 @@ static void dmz_reclaim_work(struct work_struct *work) - ret = dmz_do_reclaim(zrc); - if (ret) { - dmz_dev_debug(zrc->dev, "Reclaim error %d\n", ret); -- if (ret == -EIO) -- /* -- * LLD might be performing some error handling sequence -- * at the underlying device. To not interfere, do not -- * attempt to schedule the next reclaim run immediately. -- */ -+ if (!dmz_check_bdev(zrc->dev)) - return; - } - -diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c -index 4694763f9d40..497a2bc5da51 100644 ---- a/drivers/md/dm-zoned-target.c -+++ b/drivers/md/dm-zoned-target.c -@@ -79,6 +79,8 @@ static inline void dmz_bio_endio(struct bio *bio, blk_status_t status) - - if (status != BLK_STS_OK && bio->bi_status == BLK_STS_OK) - bio->bi_status = status; -+ if (bio->bi_status != BLK_STS_OK) -+ bioctx->target->dev->flags |= DMZ_CHECK_BDEV; - - if (atomic_dec_and_test(&bioctx->ref)) { - struct dm_zone *zone = bioctx->zone; -@@ -564,31 +566,51 @@ out: - } - - /* -- * Check the backing device availability. If it's on the way out, -+ * Check if the backing device is being removed. If it's on the way out, - * start failing I/O. Reclaim and metadata components also call this - * function to cleanly abort operation in the event of such failure. - */ - bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev) - { -- struct gendisk *disk; -+ if (dmz_dev->flags & DMZ_BDEV_DYING) -+ return true; - -- if (!(dmz_dev->flags & DMZ_BDEV_DYING)) { -- disk = dmz_dev->bdev->bd_disk; -- if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) { -- dmz_dev_warn(dmz_dev, "Backing device queue dying"); -- dmz_dev->flags |= DMZ_BDEV_DYING; -- } else if (disk->fops->check_events) { -- if (disk->fops->check_events(disk, 0) & -- DISK_EVENT_MEDIA_CHANGE) { -- dmz_dev_warn(dmz_dev, "Backing device offline"); -- dmz_dev->flags |= DMZ_BDEV_DYING; -- } -- } -+ if (dmz_dev->flags & DMZ_CHECK_BDEV) -+ return !dmz_check_bdev(dmz_dev); -+ -+ if (blk_queue_dying(bdev_get_queue(dmz_dev->bdev))) { -+ dmz_dev_warn(dmz_dev, "Backing device queue dying"); -+ dmz_dev->flags |= DMZ_BDEV_DYING; - } - - return dmz_dev->flags & DMZ_BDEV_DYING; - } - -+/* -+ * Check the backing device availability. This detects such events as -+ * backing device going offline due to errors, media removals, etc. -+ * This check is less efficient than dmz_bdev_is_dying() and should -+ * only be performed as a part of error handling. -+ */ -+bool dmz_check_bdev(struct dmz_dev *dmz_dev) -+{ -+ struct gendisk *disk; -+ -+ dmz_dev->flags &= ~DMZ_CHECK_BDEV; -+ -+ if (dmz_bdev_is_dying(dmz_dev)) -+ return false; -+ -+ disk = dmz_dev->bdev->bd_disk; -+ if (disk->fops->check_events && -+ disk->fops->check_events(disk, 0) & DISK_EVENT_MEDIA_CHANGE) { -+ dmz_dev_warn(dmz_dev, "Backing device offline"); -+ dmz_dev->flags |= DMZ_BDEV_DYING; -+ } -+ -+ return !(dmz_dev->flags & DMZ_BDEV_DYING); -+} -+ - /* - * Process a new BIO. - */ -@@ -901,8 +923,8 @@ static int dmz_prepare_ioctl(struct dm_target *ti, - { - struct dmz_target *dmz = ti->private; - -- if (dmz_bdev_is_dying(dmz->dev)) -- return -ENODEV; -+ if (!dmz_check_bdev(dmz->dev)) -+ return -EIO; - - *bdev = dmz->dev->bdev; - -diff --git a/drivers/md/dm-zoned.h b/drivers/md/dm-zoned.h -index 93a64529f219..2662746ba8b9 100644 ---- a/drivers/md/dm-zoned.h -+++ b/drivers/md/dm-zoned.h -@@ -71,6 +71,7 @@ struct dmz_dev { - - /* Device flags. */ - #define DMZ_BDEV_DYING (1 << 0) -+#define DMZ_CHECK_BDEV (2 << 0) - - /* - * Zone descriptor. -@@ -254,5 +255,6 @@ void dmz_schedule_reclaim(struct dmz_reclaim *zrc); - * Functions defined in dm-zoned-target.c - */ - bool dmz_bdev_is_dying(struct dmz_dev *dmz_dev); -+bool dmz_check_bdev(struct dmz_dev *dmz_dev); - - #endif /* DM_ZONED_H */ -diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c -index 449c4dd060fc..204adde004a3 100644 ---- a/drivers/md/raid0.c -+++ b/drivers/md/raid0.c -@@ -616,7 +616,7 @@ static bool raid0_make_request(struct mddev *mddev, struct bio *bio) - tmp_dev = map_sector(mddev, zone, sector, §or); - break; - default: -- WARN("md/raid0:%s: Invalid layout\n", mdname(mddev)); -+ WARN(1, "md/raid0:%s: Invalid layout\n", mdname(mddev)); - bio_io_error(bio); - return true; - } -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 4c49bed40f1f..d5c14d56a714 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -5721,7 +5721,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) - do_flush = false; - } - -- if (!sh->batch_head) -+ if (!sh->batch_head || sh == sh->batch_head) - set_bit(STRIPE_HANDLE, &sh->state); - clear_bit(STRIPE_DELAYED, &sh->state); - if ((!sh->batch_head || sh == sh->batch_head) && -diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c -index f8a808d45034..27e57915eb4d 100644 ---- a/drivers/media/cec/cec-adap.c -+++ b/drivers/media/cec/cec-adap.c -@@ -1403,6 +1403,13 @@ configured: - las->log_addr[i], - cec_phys_addr_exp(adap->phys_addr)); - cec_transmit_msg_fh(adap, &msg, NULL, false); -+ -+ /* Report Vendor ID */ -+ if (adap->log_addrs.vendor_id != CEC_VENDOR_ID_NONE) { -+ cec_msg_device_vendor_id(&msg, -+ adap->log_addrs.vendor_id); -+ cec_transmit_msg_fh(adap, &msg, NULL, false); -+ } - } - adap->kthread_config = NULL; - complete(&adap->config_completion); -diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c -index c9e9576bb08a..5f0965593a0d 100644 ---- a/drivers/media/platform/qcom/venus/vdec.c -+++ b/drivers/media/platform/qcom/venus/vdec.c -@@ -1060,9 +1060,6 @@ static const struct v4l2_file_operations vdec_fops = { - .unlocked_ioctl = video_ioctl2, - .poll = v4l2_m2m_fop_poll, - .mmap = v4l2_m2m_fop_mmap, --#ifdef CONFIG_COMPAT -- .compat_ioctl32 = v4l2_compat_ioctl32, --#endif - }; - - static int vdec_probe(struct platform_device *pdev) -diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c -index 3fcf0e9b7b29..a8af4a09485e 100644 ---- a/drivers/media/platform/qcom/venus/venc.c -+++ b/drivers/media/platform/qcom/venus/venc.c -@@ -1166,9 +1166,6 @@ static const struct v4l2_file_operations venc_fops = { - .unlocked_ioctl = video_ioctl2, - .poll = v4l2_m2m_fop_poll, - .mmap = v4l2_m2m_fop_mmap, --#ifdef CONFIG_COMPAT -- .compat_ioctl32 = v4l2_compat_ioctl32, --#endif - }; - - static int venc_probe(struct platform_device *pdev) -diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c -index 939da6da7644..601ca2b2ecd3 100644 ---- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c -+++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c -@@ -651,8 +651,7 @@ static int bdisp_release(struct file *file) - - dev_dbg(bdisp->dev, "%s\n", __func__); - -- if (mutex_lock_interruptible(&bdisp->lock)) -- return -ERESTARTSYS; -+ mutex_lock(&bdisp->lock); - - v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); - -diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c -index 743554de724d..a9ab3871ccda 100644 ---- a/drivers/media/platform/vimc/vimc-common.c -+++ b/drivers/media/platform/vimc/vimc-common.c -@@ -241,6 +241,8 @@ int vimc_pipeline_s_stream(struct media_entity *ent, int enable) - - /* Start the stream in the subdevice direct connected */ - pad = media_entity_remote_pad(&ent->pads[i]); -+ if (!pad) -+ continue; - - if (!is_media_entity_v4l2_subdev(pad->entity)) - return -EINVAL; -diff --git a/drivers/media/platform/vimc/vimc-core.c b/drivers/media/platform/vimc/vimc-core.c -index 57e5d6a020b0..447a01ff4e23 100644 ---- a/drivers/media/platform/vimc/vimc-core.c -+++ b/drivers/media/platform/vimc/vimc-core.c -@@ -243,10 +243,7 @@ static void vimc_comp_unbind(struct device *master) - - static int vimc_comp_compare(struct device *comp, void *data) - { -- const struct platform_device *pdev = to_platform_device(comp); -- const char *name = data; -- -- return !strcmp(pdev->dev.platform_data, name); -+ return comp == data; - } - - static struct component_match *vimc_add_subdevs(struct vimc_device *vimc) -@@ -275,7 +272,7 @@ static struct component_match *vimc_add_subdevs(struct vimc_device *vimc) - } - - component_match_add(&vimc->pdev.dev, &match, vimc_comp_compare, -- (void *)vimc->pipe_cfg->ents[i].name); -+ &vimc->subdevs[i]->dev); - } - - return match; -diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c -index 903fcd5e99c0..fc1ae86911b9 100644 ---- a/drivers/media/radio/radio-wl1273.c -+++ b/drivers/media/radio/radio-wl1273.c -@@ -1156,8 +1156,7 @@ static int wl1273_fm_fops_release(struct file *file) - if (radio->rds_users > 0) { - radio->rds_users--; - if (radio->rds_users == 0) { -- if (mutex_lock_interruptible(&core->lock)) -- return -EINTR; -+ mutex_lock(&core->lock); - - radio->irq_flags &= ~WL1273_RDS_EVENT; - -diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c -index 50146f263d90..12da631c0fda 100644 ---- a/drivers/media/usb/pulse8-cec/pulse8-cec.c -+++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c -@@ -585,7 +585,7 @@ unlock: - else - pulse8->config_pending = true; - mutex_unlock(&pulse8->config_lock); -- return err; -+ return log_addr == CEC_LOG_ADDR_INVALID ? 0 : err; - } - - static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts, -diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c -index a7da1356a36e..6992e84f8a8b 100644 ---- a/drivers/media/usb/stkwebcam/stk-webcam.c -+++ b/drivers/media/usb/stkwebcam/stk-webcam.c -@@ -164,7 +164,11 @@ int stk_camera_read_reg(struct stk_camera *dev, u16 index, u8 *value) - *value = *buf; - - kfree(buf); -- return ret; -+ -+ if (ret < 0) -+ return ret; -+ else -+ return 0; - } - - static int stk_start_stream(struct stk_camera *dev) -diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c -index f53e217e963f..494e263daa74 100644 ---- a/drivers/misc/altera-stapl/altera.c -+++ b/drivers/misc/altera-stapl/altera.c -@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size, - key_ptr = &p[note_strings + - get_unaligned_be32( - &p[note_table + (8 * i)])]; -- if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) && -- (key != NULL)) { -+ if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) { - status = 0; - - value_ptr = &p[note_strings + -diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c -index 3f3ff7530b76..ea12712bd2c3 100644 ---- a/drivers/mmc/host/omap_hsmmc.c -+++ b/drivers/mmc/host/omap_hsmmc.c -@@ -1678,6 +1678,36 @@ static void omap_hsmmc_init_card(struct mmc_host *mmc, struct mmc_card *card) - - if (mmc_pdata(host)->init_card) - mmc_pdata(host)->init_card(card); -+ else if (card->type == MMC_TYPE_SDIO || -+ card->type == MMC_TYPE_SD_COMBO) { -+ struct device_node *np = mmc_dev(mmc)->of_node; -+ -+ /* -+ * REVISIT: should be moved to sdio core and made more -+ * general e.g. by expanding the DT bindings of child nodes -+ * to provide a mechanism to provide this information: -+ * Documentation/devicetree/bindings/mmc/mmc-card.txt -+ */ -+ -+ np = of_get_compatible_child(np, "ti,wl1251"); -+ if (np) { -+ /* -+ * We have TI wl1251 attached to MMC3. Pass this -+ * information to the SDIO core because it can't be -+ * probed by normal methods. -+ */ -+ -+ dev_info(host->dev, "found wl1251\n"); -+ card->quirks |= MMC_QUIRK_NONSTD_SDIO; -+ card->cccr.wide_bus = 1; -+ card->cis.vendor = 0x104c; -+ card->cis.device = 0x9066; -+ card->cis.blksize = 512; -+ card->cis.max_dtr = 24000000; -+ card->ocr = 0x80; -+ of_node_put(np); -+ } -+ } - } - - static void omap_hsmmc_enable_sdio_irq(struct mmc_host *mmc, int enable) -diff --git a/drivers/mtd/devices/spear_smi.c b/drivers/mtd/devices/spear_smi.c -index ddf478976013..c2922e129db8 100644 ---- a/drivers/mtd/devices/spear_smi.c -+++ b/drivers/mtd/devices/spear_smi.c -@@ -595,6 +595,26 @@ static int spear_mtd_read(struct mtd_info *mtd, loff_t from, size_t len, - return 0; - } - -+/* -+ * The purpose of this function is to ensure a memcpy_toio() with byte writes -+ * only. Its structure is inspired from the ARM implementation of _memcpy_toio() -+ * which also does single byte writes but cannot be used here as this is just an -+ * implementation detail and not part of the API. Not mentioning the comment -+ * stating that _memcpy_toio() should be optimized. -+ */ -+static void spear_smi_memcpy_toio_b(volatile void __iomem *dest, -+ const void *src, size_t len) -+{ -+ const unsigned char *from = src; -+ -+ while (len) { -+ len--; -+ writeb(*from, dest); -+ from++; -+ dest++; -+ } -+} -+ - static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank, - void __iomem *dest, const void *src, size_t len) - { -@@ -617,7 +637,23 @@ static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank, - ctrlreg1 = readl(dev->io_base + SMI_CR1); - writel((ctrlreg1 | WB_MODE) & ~SW_MODE, dev->io_base + SMI_CR1); - -- memcpy_toio(dest, src, len); -+ /* -+ * In Write Burst mode (WB_MODE), the specs states that writes must be: -+ * - incremental -+ * - of the same size -+ * The ARM implementation of memcpy_toio() will optimize the number of -+ * I/O by using as much 4-byte writes as possible, surrounded by -+ * 2-byte/1-byte access if: -+ * - the destination is not 4-byte aligned -+ * - the length is not a multiple of 4-byte. -+ * Avoid this alternance of write access size by using our own 'byte -+ * access' helper if at least one of the two conditions above is true. -+ */ -+ if (IS_ALIGNED(len, sizeof(u32)) && -+ IS_ALIGNED((uintptr_t)dest, sizeof(u32))) -+ memcpy_toio(dest, src, len); -+ else -+ spear_smi_memcpy_toio_b(dest, src, len); - - writel(ctrlreg1, dev->io_base + SMI_CR1); - -diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c -index 49427f44dc5b..a42737b4ac79 100644 ---- a/drivers/net/can/slcan.c -+++ b/drivers/net/can/slcan.c -@@ -613,6 +613,7 @@ err_free_chan: - sl->tty = NULL; - tty->disc_data = NULL; - clear_bit(SLF_INUSE, &sl->flags); -+ slc_free_netdev(sl->dev); - free_netdev(sl->dev); - - err_exit: -diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c -index be17194487c6..10ea01459a36 100644 ---- a/drivers/net/dsa/mv88e6xxx/chip.c -+++ b/drivers/net/dsa/mv88e6xxx/chip.c -@@ -2196,11 +2196,22 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg) - mutex_unlock(&chip->reg_lock); - - if (reg == MII_PHYSID2) { -- /* Some internal PHYS don't have a model number. Use -- * the mv88e6390 family model number instead. -- */ -- if (!(val & 0x3f0)) -- val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4; -+ /* Some internal PHYs don't have a model number. */ -+ if (chip->info->family != MV88E6XXX_FAMILY_6165) -+ /* Then there is the 6165 family. It gets is -+ * PHYs correct. But it can also have two -+ * SERDES interfaces in the PHY address -+ * space. And these don't have a model -+ * number. But they are not PHYs, so we don't -+ * want to give them something a PHY driver -+ * will recognise. -+ * -+ * Use the mv88e6390 family model number -+ * instead, for anything which really could be -+ * a PHY, -+ */ -+ if (!(val & 0x3f0)) -+ val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4; - } - - return err ? err : val; -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h -index 57e796870595..ea4b7e97c61e 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h -@@ -40,8 +40,8 @@ - #define AQ_CFG_IS_LRO_DEF 1U - - /* RSS */ --#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 128U --#define AQ_CFG_RSS_HASHKEY_SIZE 320U -+#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 64U -+#define AQ_CFG_RSS_HASHKEY_SIZE 40U - - #define AQ_CFG_IS_RSS_DEF 1U - #define AQ_CFG_NUM_RSS_QUEUES_DEF AQ_CFG_VECS_DEF -diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c -index cc658a29cc33..a69f5f1ad32a 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c -+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c -@@ -43,7 +43,7 @@ static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues) - struct aq_rss_parameters *rss_params = &cfg->aq_rss; - int i = 0; - -- static u8 rss_key[40] = { -+ static u8 rss_key[AQ_CFG_RSS_HASHKEY_SIZE] = { - 0x1e, 0xad, 0x71, 0x87, 0x65, 0xfc, 0x26, 0x7d, - 0x0d, 0x45, 0x67, 0x74, 0xcd, 0x06, 0x1a, 0x18, - 0xb6, 0xc1, 0xf0, 0xc7, 0xbb, 0x18, 0xbe, 0xf8, -diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c -index 8996ebbd222e..26ba18ea08c6 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c -+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c -@@ -714,6 +714,10 @@ static int adapter_up(struct adapter *adapter) - - if (adapter->flags & USING_MSIX) - name_msix_vecs(adapter); -+ -+ /* Initialize hash mac addr list*/ -+ INIT_LIST_HEAD(&adapter->mac_hlist); -+ - adapter->flags |= FULL_INIT_DONE; - } - -@@ -739,8 +743,6 @@ static int adapter_up(struct adapter *adapter) - enable_rx(adapter); - t4vf_sge_start(adapter); - -- /* Initialize hash mac addr list*/ -- INIT_LIST_HEAD(&adapter->mac_hlist); - return 0; - } - -diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c -index e2a702996db4..82bd918bf967 100644 ---- a/drivers/net/ethernet/cirrus/ep93xx_eth.c -+++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c -@@ -767,6 +767,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev) - { - struct net_device *dev; - struct ep93xx_priv *ep; -+ struct resource *mem; - - dev = platform_get_drvdata(pdev); - if (dev == NULL) -@@ -782,8 +783,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev) - iounmap(ep->base_addr); - - if (ep->res != NULL) { -- release_resource(ep->res); -- kfree(ep->res); -+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ release_mem_region(mem->start, resource_size(mem)); - } - - free_netdev(dev); -diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c -index a696b5b2d40e..44c73215d026 100644 ---- a/drivers/net/ethernet/huawei/hinic/hinic_main.c -+++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c -@@ -598,9 +598,6 @@ static int add_mac_addr(struct net_device *netdev, const u8 *addr) - u16 vid = 0; - int err; - -- if (!is_valid_ether_addr(addr)) -- return -EADDRNOTAVAIL; -- - netif_info(nic_dev, drv, netdev, "set mac addr = %02x %02x %02x %02x %02x %02x\n", - addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); - -@@ -724,6 +721,7 @@ static void set_rx_mode(struct work_struct *work) - { - struct hinic_rx_mode_work *rx_mode_work = work_to_rx_mode_work(work); - struct hinic_dev *nic_dev = rx_mode_work_to_nic_dev(rx_mode_work); -+ struct netdev_hw_addr *ha; - - netif_info(nic_dev, drv, nic_dev->netdev, "set rx mode work\n"); - -@@ -731,6 +729,9 @@ static void set_rx_mode(struct work_struct *work) - - __dev_uc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr); - __dev_mc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr); -+ -+ netdev_for_each_mc_addr(ha, nic_dev->netdev) -+ add_mac_addr(nic_dev->netdev, ha->addr); - } - - static void hinic_set_rx_mode(struct net_device *netdev) -diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c -index 4d10270ddf8f..90974462743b 100644 ---- a/drivers/net/ethernet/intel/e100.c -+++ b/drivers/net/ethernet/intel/e100.c -@@ -1370,8 +1370,8 @@ static inline int e100_load_ucode_wait(struct nic *nic) - - fw = e100_request_firmware(nic); - /* If it's NULL, then no ucode is required */ -- if (!fw || IS_ERR(fw)) -- return PTR_ERR(fw); -+ if (IS_ERR_OR_NULL(fw)) -+ return PTR_ERR_OR_ZERO(fw); - - if ((err = e100_exec_cb(nic, (void *)fw, e100_setup_ucode))) - netif_err(nic, probe, nic->netdev, -diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c -index ef22793d6a03..751ac5616884 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c -@@ -969,6 +969,7 @@ static int i40e_set_pauseparam(struct net_device *netdev, - i40e_status status; - u8 aq_failures; - int err = 0; -+ u32 is_an; - - /* Changing the port's flow control is not supported if this isn't the - * port's controlling PF -@@ -981,15 +982,14 @@ static int i40e_set_pauseparam(struct net_device *netdev, - if (vsi != pf->vsi[pf->lan_vsi]) - return -EOPNOTSUPP; - -- if (pause->autoneg != ((hw_link_info->an_info & I40E_AQ_AN_COMPLETED) ? -- AUTONEG_ENABLE : AUTONEG_DISABLE)) { -+ is_an = hw_link_info->an_info & I40E_AQ_AN_COMPLETED; -+ if (pause->autoneg != is_an) { - netdev_info(netdev, "To change autoneg please use: ethtool -s autoneg \n"); - return -EOPNOTSUPP; - } - - /* If we have link and don't have autoneg */ -- if (!test_bit(__I40E_DOWN, pf->state) && -- !(hw_link_info->an_info & I40E_AQ_AN_COMPLETED)) { -+ if (!test_bit(__I40E_DOWN, pf->state) && !is_an) { - /* Send message that it might not necessarily work*/ - netdev_info(netdev, "Autoneg did not complete so changing settings may not result in an actual change.\n"); - } -@@ -1040,7 +1040,7 @@ static int i40e_set_pauseparam(struct net_device *netdev, - err = -EAGAIN; - } - -- if (!test_bit(__I40E_DOWN, pf->state)) { -+ if (!test_bit(__I40E_DOWN, pf->state) && is_an) { - /* Give it a little more time to try to come back */ - msleep(75); - if (!test_bit(__I40E_DOWN, pf->state)) -diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c -index c273a3ebb8e8..12d4b891301b 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/main.c -+++ b/drivers/net/ethernet/mellanox/mlx4/main.c -@@ -199,7 +199,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev, - for (i = 0; i < dev->caps.num_ports - 1; i++) { - if (port_type[i] != port_type[i + 1]) { - mlx4_err(dev, "Only same port types supported on this HCA, aborting\n"); -- return -EINVAL; -+ return -EOPNOTSUPP; - } - } - } -@@ -208,7 +208,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev, - if (!(port_type[i] & dev->caps.supported_type[i+1])) { - mlx4_err(dev, "Requested port type for port %d is not supported on this HCA\n", - i + 1); -- return -EINVAL; -+ return -EOPNOTSUPP; - } - } - return 0; -@@ -1152,8 +1152,7 @@ static int __set_port_type(struct mlx4_port_info *info, - mlx4_err(mdev, - "Requested port type for port %d is not supported on this HCA\n", - info->port); -- err = -EINVAL; -- goto err_sup; -+ return -EOPNOTSUPP; - } - - mlx4_stop_sense(mdev); -@@ -1175,7 +1174,7 @@ static int __set_port_type(struct mlx4_port_info *info, - for (i = 1; i <= mdev->caps.num_ports; i++) { - if (mdev->caps.possible_type[i] == MLX4_PORT_TYPE_AUTO) { - mdev->caps.possible_type[i] = mdev->caps.port_type[i]; -- err = -EINVAL; -+ err = -EOPNOTSUPP; - } - } - } -@@ -1201,7 +1200,7 @@ static int __set_port_type(struct mlx4_port_info *info, - out: - mlx4_start_sense(mdev); - mutex_unlock(&priv->port_mutex); --err_sup: -+ - return err; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index f6beb5ef5971..c3f1e2d76a46 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -1625,7 +1625,7 @@ static int mlx5e_get_module_info(struct net_device *netdev, - break; - case MLX5_MODULE_ID_SFP: - modinfo->type = ETH_MODULE_SFF_8472; -- modinfo->eeprom_len = MLX5_EEPROM_PAGE_LENGTH; -+ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN; - break; - default: - netdev_err(priv->netdev, "%s: cable type not recognized:0x%x\n", -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c -index 889130edb715..5f091c6ea049 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c -@@ -124,7 +124,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type) - if (!is_event_type_allowed((rsn >> MLX5_USER_INDEX_LEN), event_type)) { - mlx5_core_warn(dev, "event 0x%.2x is not allowed on resource 0x%.8x\n", - event_type, rsn); -- return; -+ goto out; - } - - switch (common->res) { -@@ -138,7 +138,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type) - default: - mlx5_core_warn(dev, "invalid resource type for 0x%x\n", rsn); - } -- -+out: - mlx5_core_put_rsc(common); - } - -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -index 3ed4fb346f23..05a2006a20b9 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c -@@ -1252,15 +1252,12 @@ mlxsw_sp_ipip_entry_matches_decap(struct mlxsw_sp *mlxsw_sp, - { - u32 ul_tb_id = l3mdev_fib_table(ul_dev) ? : RT_TABLE_MAIN; - enum mlxsw_sp_ipip_type ipipt = ipip_entry->ipipt; -- struct net_device *ipip_ul_dev; - - if (mlxsw_sp->router->ipip_ops_arr[ipipt]->ul_proto != ul_proto) - return false; - -- ipip_ul_dev = __mlxsw_sp_ipip_netdev_ul_dev_get(ipip_entry->ol_dev); - return mlxsw_sp_ipip_entry_saddr_matches(mlxsw_sp, ul_proto, ul_dip, -- ul_tb_id, ipip_entry) && -- (!ipip_ul_dev || ipip_ul_dev == ul_dev); -+ ul_tb_id, ipip_entry); - } - - /* Given decap parameters, find the corresponding IPIP entry. */ -@@ -1765,7 +1762,7 @@ static void mlxsw_sp_router_probe_unresolved_nexthops(struct work_struct *work) - static void - mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp *mlxsw_sp, - struct mlxsw_sp_neigh_entry *neigh_entry, -- bool removing); -+ bool removing, bool dead); - - static enum mlxsw_reg_rauht_op mlxsw_sp_rauht_op(bool adding) - { -@@ -1894,7 +1891,8 @@ static void mlxsw_sp_router_neigh_event_work(struct work_struct *work) - - memcpy(neigh_entry->ha, ha, ETH_ALEN); - mlxsw_sp_neigh_entry_update(mlxsw_sp, neigh_entry, entry_connected); -- mlxsw_sp_nexthop_neigh_update(mlxsw_sp, neigh_entry, !entry_connected); -+ mlxsw_sp_nexthop_neigh_update(mlxsw_sp, neigh_entry, !entry_connected, -+ dead); - - if (!neigh_entry->connected && list_empty(&neigh_entry->nexthop_list)) - mlxsw_sp_neigh_entry_destroy(mlxsw_sp, neigh_entry); -@@ -2538,13 +2536,79 @@ static void __mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp_nexthop *nh, - nh->update = 1; - } - -+static int -+mlxsw_sp_nexthop_dead_neigh_replace(struct mlxsw_sp *mlxsw_sp, -+ struct mlxsw_sp_neigh_entry *neigh_entry) -+{ -+ struct neighbour *n, *old_n = neigh_entry->key.n; -+ struct mlxsw_sp_nexthop *nh; -+ bool entry_connected; -+ u8 nud_state, dead; -+ int err; -+ -+ nh = list_first_entry(&neigh_entry->nexthop_list, -+ struct mlxsw_sp_nexthop, neigh_list_node); -+ -+ n = neigh_lookup(nh->nh_grp->neigh_tbl, &nh->gw_addr, nh->rif->dev); -+ if (!n) { -+ n = neigh_create(nh->nh_grp->neigh_tbl, &nh->gw_addr, -+ nh->rif->dev); -+ if (IS_ERR(n)) -+ return PTR_ERR(n); -+ neigh_event_send(n, NULL); -+ } -+ -+ mlxsw_sp_neigh_entry_remove(mlxsw_sp, neigh_entry); -+ neigh_entry->key.n = n; -+ err = mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry); -+ if (err) -+ goto err_neigh_entry_insert; -+ -+ read_lock_bh(&n->lock); -+ nud_state = n->nud_state; -+ dead = n->dead; -+ read_unlock_bh(&n->lock); -+ entry_connected = nud_state & NUD_VALID && !dead; -+ -+ list_for_each_entry(nh, &neigh_entry->nexthop_list, -+ neigh_list_node) { -+ neigh_release(old_n); -+ neigh_clone(n); -+ __mlxsw_sp_nexthop_neigh_update(nh, !entry_connected); -+ mlxsw_sp_nexthop_group_refresh(mlxsw_sp, nh->nh_grp); -+ } -+ -+ neigh_release(n); -+ -+ return 0; -+ -+err_neigh_entry_insert: -+ neigh_entry->key.n = old_n; -+ mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry); -+ neigh_release(n); -+ return err; -+} -+ - static void - mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp *mlxsw_sp, - struct mlxsw_sp_neigh_entry *neigh_entry, -- bool removing) -+ bool removing, bool dead) - { - struct mlxsw_sp_nexthop *nh; - -+ if (list_empty(&neigh_entry->nexthop_list)) -+ return; -+ -+ if (dead) { -+ int err; -+ -+ err = mlxsw_sp_nexthop_dead_neigh_replace(mlxsw_sp, -+ neigh_entry); -+ if (err) -+ dev_err(mlxsw_sp->bus_info->dev, "Failed to replace dead neigh\n"); -+ return; -+ } -+ - list_for_each_entry(nh, &neigh_entry->nexthop_list, - neigh_list_node) { - __mlxsw_sp_nexthop_neigh_update(nh, removing); -diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c -index 7d1281d81248..23c953496a0d 100644 ---- a/drivers/net/ethernet/ti/cpts.c -+++ b/drivers/net/ethernet/ti/cpts.c -@@ -116,9 +116,7 @@ static bool cpts_match_tx_ts(struct cpts *cpts, struct cpts_event *event) - mtype, seqid); - } else if (time_after(jiffies, skb_cb->tmo)) { - /* timeout any expired skbs over 1s */ -- dev_dbg(cpts->dev, -- "expiring tx timestamp mtype %u seqid %04x\n", -- mtype, seqid); -+ dev_dbg(cpts->dev, "expiring tx timestamp from txq\n"); - __skb_unlink(skb, &cpts->txq); - dev_consume_skb_any(skb); - } -diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c -index 68f0463ed8df..ad4a1efc57c9 100644 ---- a/drivers/net/wireless/ath/ar5523/ar5523.c -+++ b/drivers/net/wireless/ath/ar5523/ar5523.c -@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata, - - if (flags & AR5523_CMD_FLAG_MAGIC) - hdr->magic = cpu_to_be32(1 << 24); -- memcpy(hdr + 1, idata, ilen); -+ if (ilen) -+ memcpy(hdr + 1, idata, ilen); - - cmd->odata = odata; - cmd->olen = olen; -diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c -index 0298ddc1ff06..f9e409caca68 100644 ---- a/drivers/net/wireless/ath/ath10k/pci.c -+++ b/drivers/net/wireless/ath/ath10k/pci.c -@@ -1771,6 +1771,11 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) - - ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif stop\n"); - -+ ath10k_pci_irq_disable(ar); -+ ath10k_pci_irq_sync(ar); -+ napi_synchronize(&ar->napi); -+ napi_disable(&ar->napi); -+ - /* Most likely the device has HTT Rx ring configured. The only way to - * prevent the device from accessing (and possible corrupting) host - * memory is to reset the chip now. -@@ -1784,10 +1789,6 @@ static void ath10k_pci_hif_stop(struct ath10k *ar) - */ - ath10k_pci_safe_chip_reset(ar); - -- ath10k_pci_irq_disable(ar); -- ath10k_pci_irq_sync(ar); -- napi_synchronize(&ar->napi); -- napi_disable(&ar->napi); - ath10k_pci_flush(ar); - - spin_lock_irqsave(&ar_pci->ps_lock, flags); -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -index 77ed6ecf5ee5..b86c7a36d3f1 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -@@ -822,6 +822,21 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw, - !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) - sta = NULL; - -+ /* If there is no sta, and it's not offchannel - send through AP */ -+ if (info->control.vif->type == NL80211_IFTYPE_STATION && -+ info->hw_queue != IWL_MVM_OFFCHANNEL_QUEUE && !sta) { -+ struct iwl_mvm_vif *mvmvif = -+ iwl_mvm_vif_from_mac80211(info->control.vif); -+ u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id); -+ -+ if (ap_sta_id < IWL_MVM_STATION_COUNT) { -+ /* mac80211 holds rcu read lock */ -+ sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]); -+ if (IS_ERR_OR_NULL(sta)) -+ goto drop; -+ } -+ } -+ - if (sta) { - if (iwl_mvm_defer_tx(mvm, sta, skb)) - return; -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -index d16e2ed4419f..0cfdbaa2af3a 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -@@ -436,6 +436,16 @@ static int iwl_mvm_remove_sta_queue_marking(struct iwl_mvm *mvm, int queue) - - rcu_read_unlock(); - -+ /* -+ * The TX path may have been using this TXQ_ID from the tid_data, -+ * so make sure it's no longer running so that we can safely reuse -+ * this TXQ later. We've set all the TIDs to IWL_MVM_INVALID_QUEUE -+ * above, but nothing guarantees we've stopped using them. Thus, -+ * without this, we could get to iwl_mvm_disable_txq() and remove -+ * the queue while still sending frames to it. -+ */ -+ synchronize_net(); -+ - return disable_agg_tids; - } - -diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c -index 6f45c8148b27..bbb39d6ec2ee 100644 ---- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c -+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c -@@ -232,27 +232,23 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, - struct ieee80211_hdr *hdr = (void *)skb->data; - unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room; - unsigned int mss = skb_shinfo(skb)->gso_size; -- u16 length, iv_len, amsdu_pad; -+ u16 length, amsdu_pad; - u8 *start_hdr; - struct iwl_tso_hdr_page *hdr_page; - struct page **page_ptr; - struct tso_t tso; - -- /* if the packet is protected, then it must be CCMP or GCMP */ -- iv_len = ieee80211_has_protected(hdr->frame_control) ? -- IEEE80211_CCMP_HDR_LEN : 0; -- - trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd), - &dev_cmd->hdr, start_len, 0); - - ip_hdrlen = skb_transport_header(skb) - skb_network_header(skb); - snap_ip_tcp_hdrlen = 8 + ip_hdrlen + tcp_hdrlen(skb); -- total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len - iv_len; -+ total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len; - amsdu_pad = 0; - - /* total amount of header we may need for this A-MSDU */ - hdr_room = DIV_ROUND_UP(total_len, mss) * -- (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len; -+ (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)); - - /* Our device supports 9 segments at most, it will fit in 1 page */ - hdr_page = get_page_hdr(trans, hdr_room); -@@ -263,14 +259,12 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, - start_hdr = hdr_page->pos; - page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs); - *page_ptr = hdr_page->page; -- memcpy(hdr_page->pos, skb->data + hdr_len, iv_len); -- hdr_page->pos += iv_len; - - /* -- * Pull the ieee80211 header + IV to be able to use TSO core, -+ * Pull the ieee80211 header to be able to use TSO core, - * we will restore it for the tx_status flow. - */ -- skb_pull(skb, hdr_len + iv_len); -+ skb_pull(skb, hdr_len); - - /* - * Remove the length of all the headers that we don't actually -@@ -348,8 +342,8 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, - } - } - -- /* re -add the WiFi header and IV */ -- skb_push(skb, hdr_len + iv_len); -+ /* re -add the WiFi header */ -+ skb_push(skb, hdr_len); - - return 0; - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c -index cf28d25c551f..80002292cd27 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/hw.c -@@ -1198,6 +1198,7 @@ void rtl92de_enable_interrupt(struct ieee80211_hw *hw) - - rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); - rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); -+ rtlpci->irq_enabled = true; - } - - void rtl92de_disable_interrupt(struct ieee80211_hw *hw) -@@ -1207,7 +1208,7 @@ void rtl92de_disable_interrupt(struct ieee80211_hw *hw) - - rtl_write_dword(rtlpriv, REG_HIMR, IMR8190_DISABLED); - rtl_write_dword(rtlpriv, REG_HIMRE, IMR8190_DISABLED); -- synchronize_irq(rtlpci->pdev->irq); -+ rtlpci->irq_enabled = false; - } - - static void _rtl92de_poweroff_adapter(struct ieee80211_hw *hw) -@@ -1378,7 +1379,7 @@ void rtl92de_set_beacon_related_registers(struct ieee80211_hw *hw) - - bcn_interval = mac->beacon_interval; - atim_window = 2; -- /*rtl92de_disable_interrupt(hw); */ -+ rtl92de_disable_interrupt(hw); - rtl_write_word(rtlpriv, REG_ATIMWND, atim_window); - rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval); - rtl_write_word(rtlpriv, REG_BCNTCFG, 0x660f); -@@ -1398,9 +1399,9 @@ void rtl92de_set_beacon_interval(struct ieee80211_hw *hw) - - RT_TRACE(rtlpriv, COMP_BEACON, DBG_DMESG, - "beacon_interval:%d\n", bcn_interval); -- /* rtl92de_disable_interrupt(hw); */ -+ rtl92de_disable_interrupt(hw); - rtl_write_word(rtlpriv, REG_BCN_INTERVAL, bcn_interval); -- /* rtl92de_enable_interrupt(hw); */ -+ rtl92de_enable_interrupt(hw); - } - - void rtl92de_update_interrupt_mask(struct ieee80211_hw *hw, -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c -index a6549f5f6c59..3ec75032b9be 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/sw.c -@@ -237,6 +237,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = { - .led_control = rtl92de_led_control, - .set_desc = rtl92de_set_desc, - .get_desc = rtl92de_get_desc, -+ .is_tx_desc_closed = rtl92de_is_tx_desc_closed, - .tx_polling = rtl92de_tx_polling, - .enable_hw_sec = rtl92de_enable_hw_security_config, - .set_key = rtl92de_set_key, -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c -index 86019f654428..d1e56e09cfe8 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.c -@@ -839,13 +839,15 @@ u32 rtl92de_get_desc(u8 *p_desc, bool istx, u8 desc_name) - break; - } - } else { -- struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc; - switch (desc_name) { - case HW_DESC_OWN: -- ret = GET_RX_DESC_OWN(pdesc); -+ ret = GET_RX_DESC_OWN(p_desc); - break; - case HW_DESC_RXPKT_LEN: -- ret = GET_RX_DESC_PKT_LEN(pdesc); -+ ret = GET_RX_DESC_PKT_LEN(p_desc); -+ break; -+ case HW_DESC_RXBUFF_ADDR: -+ ret = GET_RX_DESC_BUFF_ADDR(p_desc); - break; - default: - WARN_ONCE(true, "rtl8192de: ERR rxdesc :%d not processed\n", -@@ -856,6 +858,23 @@ u32 rtl92de_get_desc(u8 *p_desc, bool istx, u8 desc_name) - return ret; - } - -+bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw, -+ u8 hw_queue, u16 index) -+{ -+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); -+ struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue]; -+ u8 *entry = (u8 *)(&ring->desc[ring->idx]); -+ u8 own = (u8)rtl92de_get_desc(entry, true, HW_DESC_OWN); -+ -+ /* a beacon packet will only use the first -+ * descriptor by defaut, and the own bit may not -+ * be cleared by the hardware -+ */ -+ if (own) -+ return false; -+ return true; -+} -+ - void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue) - { - struct rtl_priv *rtlpriv = rtl_priv(hw); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h -index 9bb6cc648590..6cf23c278953 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/trx.h -@@ -736,6 +736,8 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw, - void rtl92de_set_desc(struct ieee80211_hw *hw, u8 *pdesc, bool istx, - u8 desc_name, u8 *val); - u32 rtl92de_get_desc(u8 *pdesc, bool istx, u8 desc_name); -+bool rtl92de_is_tx_desc_closed(struct ieee80211_hw *hw, -+ u8 hw_queue, u16 index); - void rtl92de_tx_polling(struct ieee80211_hw *hw, u8 hw_queue); - void rtl92de_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc, - bool b_firstseg, bool b_lastseg, -diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c -index f7b550f900c4..234e41e1cb57 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c -+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c -@@ -1576,6 +1576,7 @@ static int rsi_send_beacon(struct rsi_common *common) - skb_pull(skb, (64 - dword_align_bytes)); - if (rsi_prepare_beacon(common, skb)) { - rsi_dbg(ERR_ZONE, "Failed to prepare beacon\n"); -+ dev_kfree_skb(skb); - return -EINVAL; - } - skb_queue_tail(&common->tx_queue[MGMT_BEACON_Q], skb); -diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c -index 198585bbc771..d9492cffd00e 100644 ---- a/drivers/nfc/nxp-nci/i2c.c -+++ b/drivers/nfc/nxp-nci/i2c.c -@@ -236,8 +236,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id) - - if (r == -EREMOTEIO) { - phy->hard_fault = r; -- skb = NULL; -- } else if (r < 0) { -+ if (info->mode == NXP_NCI_MODE_FW) -+ nxp_nci_fw_recv_frame(phy->ndev, NULL); -+ } -+ if (r < 0) { - nfc_err(&client->dev, "Read failed with error %d\n", r); - goto exit_irq_handled; - } -diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c -index 9d204649c963..4bf6a9db6ac0 100644 ---- a/drivers/of/unittest.c -+++ b/drivers/of/unittest.c -@@ -965,8 +965,10 @@ static void attach_node_and_children(struct device_node *np) - full_name = kasprintf(GFP_KERNEL, "%pOF", np); - - if (!strcmp(full_name, "/__local_fixups__") || -- !strcmp(full_name, "/__fixups__")) -+ !strcmp(full_name, "/__fixups__")) { -+ kfree(full_name); - return; -+ } - - dup = of_find_node_by_path(full_name); - kfree(full_name); -diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c -index 7f5e36bfeee8..f8c7ce89d8d7 100644 ---- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c -+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include - - /******* USB2.0 Host registers (original offset is +0x200) *******/ -@@ -234,9 +235,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr, - */ - is_b_device = rcar_gen3_check_id(ch); - is_host = rcar_gen3_is_host(ch); -- if (!strncmp(buf, "host", strlen("host"))) -+ if (sysfs_streq(buf, "host")) - new_mode_is_host = true; -- else if (!strncmp(buf, "peripheral", strlen("peripheral"))) -+ else if (sysfs_streq(buf, "peripheral")) - new_mode_is_host = false; - else - return -EINVAL; -diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c -index 0e153bae322e..6bed433e5420 100644 ---- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c -+++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c -@@ -762,12 +762,23 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev) - return ret; - } - -- ret = gpiochip_add_pin_range(&pctrl->chip, -- dev_name(pctrl->dev), -- 0, 0, pctrl->chip.ngpio); -- if (ret) { -- dev_err(pctrl->dev, "failed to add pin range\n"); -- goto unregister_gpiochip; -+ /* -+ * For DeviceTree-supported systems, the gpio core checks the -+ * pinctrl's device node for the "gpio-ranges" property. -+ * If it is present, it takes care of adding the pin ranges -+ * for the driver. In this case the driver can skip ahead. -+ * -+ * In order to remain compatible with older, existing DeviceTree -+ * files which don't set the "gpio-ranges" property or systems that -+ * utilize ACPI the driver has to call gpiochip_add_pin_range(). -+ */ -+ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) { -+ ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), -+ 0, 0, pctrl->chip.ngpio); -+ if (ret) { -+ dev_err(pctrl->dev, "failed to add pin range\n"); -+ goto unregister_gpiochip; -+ } - } - - platform_set_drvdata(pdev, pctrl); -diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c -index c8d0de7ea160..1c534d823fd7 100644 ---- a/drivers/pinctrl/samsung/pinctrl-exynos.c -+++ b/drivers/pinctrl/samsung/pinctrl-exynos.c -@@ -467,8 +467,10 @@ int exynos_eint_wkup_init(struct samsung_pinctrl_drv_data *d) - if (match) { - irq_chip = kmemdup(match->data, - sizeof(*irq_chip), GFP_KERNEL); -- if (!irq_chip) -+ if (!irq_chip) { -+ of_node_put(np); - return -ENOMEM; -+ } - wkup_np = np; - break; - } -diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c -index 67da1cf18b68..46b1a9b2238b 100644 ---- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c -+++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c -@@ -495,8 +495,10 @@ static int s3c24xx_eint_init(struct samsung_pinctrl_drv_data *d) - return -ENODEV; - - eint_data = devm_kzalloc(dev, sizeof(*eint_data), GFP_KERNEL); -- if (!eint_data) -+ if (!eint_data) { -+ of_node_put(eint_np); - return -ENOMEM; -+ } - - eint_data->drvdata = d; - -@@ -508,12 +510,14 @@ static int s3c24xx_eint_init(struct samsung_pinctrl_drv_data *d) - irq = irq_of_parse_and_map(eint_np, i); - if (!irq) { - dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); -+ of_node_put(eint_np); - return -ENXIO; - } - - eint_data->parents[i] = irq; - irq_set_chained_handler_and_data(irq, handlers[i], eint_data); - } -+ of_node_put(eint_np); - - bank = d->pin_banks; - for (i = 0; i < d->nr_banks; ++i, ++bank) { -diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c -index 0bdc1e683181..cf3a3af82321 100644 ---- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c -+++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c -@@ -709,8 +709,10 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) - return -ENODEV; - - data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); -- if (!data) -+ if (!data) { -+ of_node_put(eint0_np); - return -ENOMEM; -+ } - data->drvdata = d; - - for (i = 0; i < NUM_EINT0_IRQ; ++i) { -@@ -719,6 +721,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) - irq = irq_of_parse_and_map(eint0_np, i); - if (!irq) { - dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); -+ of_node_put(eint0_np); - return -ENXIO; - } - -@@ -726,6 +729,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d) - s3c64xx_eint0_handlers[i], - data); - } -+ of_node_put(eint0_np); - - bank = d->pin_banks; - for (i = 0; i < d->nr_banks; ++i, ++bank) { -diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c -index 26e8fab736f1..7c0f5d4e89f3 100644 ---- a/drivers/pinctrl/samsung/pinctrl-samsung.c -+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c -@@ -277,6 +277,7 @@ static int samsung_dt_node_to_map(struct pinctrl_dev *pctldev, - &reserved_maps, num_maps); - if (ret < 0) { - samsung_dt_free_map(pctldev, *map, *num_maps); -+ of_node_put(np); - return ret; - } - } -@@ -761,8 +762,10 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions( - if (!of_get_child_count(cfg_np)) { - ret = samsung_pinctrl_create_function(dev, drvdata, - cfg_np, func); -- if (ret < 0) -+ if (ret < 0) { -+ of_node_put(cfg_np); - return ERR_PTR(ret); -+ } - if (ret > 0) { - ++func; - ++func_cnt; -@@ -773,8 +776,11 @@ static struct samsung_pmx_func *samsung_pinctrl_create_functions( - for_each_child_of_node(cfg_np, func_np) { - ret = samsung_pinctrl_create_function(dev, drvdata, - func_np, func); -- if (ret < 0) -+ if (ret < 0) { -+ of_node_put(func_np); -+ of_node_put(cfg_np); - return ERR_PTR(ret); -+ } - if (ret > 0) { - ++func; - ++func_cnt; -diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c -index fe7fcf3a2ad0..7df9d432ee42 100644 ---- a/drivers/power/supply/cpcap-battery.c -+++ b/drivers/power/supply/cpcap-battery.c -@@ -82,7 +82,7 @@ struct cpcap_battery_config { - }; - - struct cpcap_coulomb_counter_data { -- s32 sample; /* 24-bits */ -+ s32 sample; /* 24 or 32 bits */ - s32 accumulator; - s16 offset; /* 10-bits */ - }; -@@ -213,7 +213,7 @@ static int cpcap_battery_get_current(struct cpcap_battery_ddata *ddata) - * TI or ST coulomb counter in the PMIC. - */ - static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata, -- u32 sample, s32 accumulator, -+ s32 sample, s32 accumulator, - s16 offset, u32 divider) - { - s64 acc; -@@ -224,7 +224,6 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata, - if (!divider) - return 0; - -- sample &= 0xffffff; /* 24-bits, unsigned */ - offset &= 0x7ff; /* 10-bits, signed */ - - switch (ddata->vendor) { -@@ -259,7 +258,7 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata, - - /* 3600000μAms = 1μAh */ - static int cpcap_battery_cc_to_uah(struct cpcap_battery_ddata *ddata, -- u32 sample, s32 accumulator, -+ s32 sample, s32 accumulator, - s16 offset) - { - return cpcap_battery_cc_raw_div(ddata, sample, -@@ -268,7 +267,7 @@ static int cpcap_battery_cc_to_uah(struct cpcap_battery_ddata *ddata, - } - - static int cpcap_battery_cc_to_ua(struct cpcap_battery_ddata *ddata, -- u32 sample, s32 accumulator, -+ s32 sample, s32 accumulator, - s16 offset) - { - return cpcap_battery_cc_raw_div(ddata, sample, -@@ -312,6 +311,8 @@ cpcap_battery_read_accumulated(struct cpcap_battery_ddata *ddata, - /* Sample value CPCAP_REG_CCS1 & 2 */ - ccd->sample = (buf[1] & 0x0fff) << 16; - ccd->sample |= buf[0]; -+ if (ddata->vendor == CPCAP_VENDOR_TI) -+ ccd->sample = sign_extend32(24, ccd->sample); - - /* Accumulator value CPCAP_REG_CCA1 & 2 */ - ccd->accumulator = ((s16)buf[3]) << 16; -diff --git a/drivers/rtc/rtc-max8997.c b/drivers/rtc/rtc-max8997.c -index db984d4bf952..4cce5bd448f6 100644 ---- a/drivers/rtc/rtc-max8997.c -+++ b/drivers/rtc/rtc-max8997.c -@@ -221,7 +221,7 @@ static int max8997_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) - - out: - mutex_unlock(&info->lock); -- return 0; -+ return ret; - } - - static int max8997_rtc_stop_alarm(struct max8997_rtc_info *info) -diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c -index a8992c227f61..4120a305954a 100644 ---- a/drivers/rtc/rtc-s3c.c -+++ b/drivers/rtc/rtc-s3c.c -@@ -327,7 +327,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm) - struct rtc_time *tm = &alrm->time; - unsigned int alrm_en; - int ret; -- int year = tm->tm_year - 100; - - dev_dbg(dev, "s3c_rtc_setalarm: %d, %04d.%02d.%02d %02d:%02d:%02d\n", - alrm->enabled, -@@ -356,11 +355,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm) - writeb(bin2bcd(tm->tm_hour), info->base + S3C2410_ALMHOUR); - } - -- if (year < 100 && year >= 0) { -- alrm_en |= S3C2410_RTCALM_YEAREN; -- writeb(bin2bcd(year), info->base + S3C2410_ALMYEAR); -- } -- - if (tm->tm_mon < 12 && tm->tm_mon >= 0) { - alrm_en |= S3C2410_RTCALM_MONEN; - writeb(bin2bcd(tm->tm_mon + 1), info->base + S3C2410_ALMMON); -diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c -index 599447032e50..bc6c1d6a1c42 100644 ---- a/drivers/s390/scsi/zfcp_dbf.c -+++ b/drivers/s390/scsi/zfcp_dbf.c -@@ -94,11 +94,9 @@ void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req) - memcpy(rec->u.res.fsf_status_qual, &q_head->fsf_status_qual, - FSF_STATUS_QUALIFIER_SIZE); - -- if (req->fsf_command != FSF_QTCB_FCP_CMND) { -- rec->pl_len = q_head->log_length; -- zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, -- rec->pl_len, "fsf_res", req->req_id); -- } -+ rec->pl_len = q_head->log_length; -+ zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, -+ rec->pl_len, "fsf_res", req->req_id); - - debug_event(dbf->hba, level, rec, sizeof(*rec)); - spin_unlock_irqrestore(&dbf->hba_lock, flags); -diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c -index 64d70de98cdb..8f90e4cea254 100644 ---- a/drivers/s390/scsi/zfcp_erp.c -+++ b/drivers/s390/scsi/zfcp_erp.c -@@ -179,9 +179,6 @@ static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter, - adapter, ZFCP_STATUS_COMMON_ERP_FAILED); - } - break; -- default: -- need = 0; -- break; - } - - return need; -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 03e95a3216c8..5fc41aa53ceb 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -969,7 +969,8 @@ struct lpfc_hba { - struct list_head port_list; - struct lpfc_vport *pport; /* physical lpfc_vport pointer */ - uint16_t max_vpi; /* Maximum virtual nports */ --#define LPFC_MAX_VPI 0xFFFF /* Max number of VPI supported */ -+#define LPFC_MAX_VPI 0xFF /* Max number VPI supported 0 - 0xff */ -+#define LPFC_MAX_VPORTS 0x100 /* Max vports per port, with pport */ - uint16_t max_vports; /* - * For IOV HBAs max_vpi can change - * after a reset. max_vports is max -diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c -index 82ce5d193018..f447355cc9c0 100644 ---- a/drivers/scsi/lpfc/lpfc_attr.c -+++ b/drivers/scsi/lpfc/lpfc_attr.c -@@ -1478,6 +1478,9 @@ lpfc_get_hba_info(struct lpfc_hba *phba, - max_vpi = (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) > 0) ? - (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) - 1) : 0; - -+ /* Limit the max we support */ -+ if (max_vpi > LPFC_MAX_VPI) -+ max_vpi = LPFC_MAX_VPI; - if (mvpi) - *mvpi = max_vpi; - if (avpi) -@@ -1493,8 +1496,13 @@ lpfc_get_hba_info(struct lpfc_hba *phba, - *axri = pmb->un.varRdConfig.avail_xri; - if (mvpi) - *mvpi = pmb->un.varRdConfig.max_vpi; -- if (avpi) -- *avpi = pmb->un.varRdConfig.avail_vpi; -+ if (avpi) { -+ /* avail_vpi is only valid if link is up and ready */ -+ if (phba->link_state == LPFC_HBA_READY) -+ *avpi = pmb->un.varRdConfig.avail_vpi; -+ else -+ *avpi = pmb->un.varRdConfig.max_vpi; -+ } - } - - mempool_free(pmboxq, phba->mbox_mem_pool); -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index c69c2a2b2ead..9fc5507ee39e 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -7643,6 +7643,9 @@ lpfc_sli4_read_config(struct lpfc_hba *phba) - bf_get(lpfc_mbx_rd_conf_xri_base, rd_config); - phba->sli4_hba.max_cfg_param.max_vpi = - bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config); -+ /* Limit the max we support */ -+ if (phba->sli4_hba.max_cfg_param.max_vpi > LPFC_MAX_VPORTS) -+ phba->sli4_hba.max_cfg_param.max_vpi = LPFC_MAX_VPORTS; - phba->sli4_hba.max_cfg_param.vpi_base = - bf_get(lpfc_mbx_rd_conf_vpi_base, rd_config); - phba->sli4_hba.max_cfg_param.max_rpi = -diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c -index 6c4499db969c..fcf4b4175d77 100644 ---- a/drivers/scsi/lpfc/lpfc_nvme.c -+++ b/drivers/scsi/lpfc/lpfc_nvme.c -@@ -1544,7 +1544,6 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport, - bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG); - - /* word 7 */ -- bf_set(wqe_ct, &abts_wqe->abort_cmd.wqe_com, 0); - bf_set(wqe_cmnd, &abts_wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_CX); - bf_set(wqe_class, &abts_wqe->abort_cmd.wqe_com, - nvmereq_wqe->iocb.ulpClass); -@@ -1559,7 +1558,6 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport, - abts_buf->iotag); - - /* word 10 */ -- bf_set(wqe_wqid, &abts_wqe->abort_cmd.wqe_com, nvmereq_wqe->hba_wqidx); - bf_set(wqe_qosd, &abts_wqe->abort_cmd.wqe_com, 1); - bf_set(wqe_lenloc, &abts_wqe->abort_cmd.wqe_com, LPFC_WQE_LENLOC_NONE); - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 62bea4ffdc25..d3bad0dbfaf7 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -10722,19 +10722,12 @@ lpfc_sli4_abort_nvme_io(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - - /* Complete prepping the abort wqe and issue to the FW. */ - abts_wqe = &abtsiocbp->wqe; -- bf_set(abort_cmd_ia, &abts_wqe->abort_cmd, 0); -- bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG); -- -- /* Explicitly set reserved fields to zero.*/ -- abts_wqe->abort_cmd.rsrvd4 = 0; -- abts_wqe->abort_cmd.rsrvd5 = 0; - -- /* WQE Common - word 6. Context is XRI tag. Set 0. */ -- bf_set(wqe_xri_tag, &abts_wqe->abort_cmd.wqe_com, 0); -- bf_set(wqe_ctxt_tag, &abts_wqe->abort_cmd.wqe_com, 0); -+ /* Clear any stale WQE contents */ -+ memset(abts_wqe, 0, sizeof(union lpfc_wqe)); -+ bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG); - - /* word 7 */ -- bf_set(wqe_ct, &abts_wqe->abort_cmd.wqe_com, 0); - bf_set(wqe_cmnd, &abts_wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_CX); - bf_set(wqe_class, &abts_wqe->abort_cmd.wqe_com, - cmdiocb->iocb.ulpClass); -@@ -10749,7 +10742,6 @@ lpfc_sli4_abort_nvme_io(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - abtsiocbp->iotag); - - /* word 10 */ -- bf_set(wqe_wqid, &abts_wqe->abort_cmd.wqe_com, cmdiocb->hba_wqidx); - bf_set(wqe_qosd, &abts_wqe->abort_cmd.wqe_com, 1); - bf_set(wqe_lenloc, &abts_wqe->abort_cmd.wqe_com, LPFC_WQE_LENLOC_NONE); - -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index 1844c2f59460..656253285db9 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -652,7 +652,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, - break; - } else { - /* Make sure FC side is not in reset */ -- qla2x00_wait_for_hba_online(vha); -+ WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) != -+ QLA_SUCCESS); - - /* Issue MPI reset */ - scsi_block_requests(vha->host); -diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c -index 7472d3882ad4..c1ca21a88a09 100644 ---- a/drivers/scsi/qla2xxx/qla_bsg.c -+++ b/drivers/scsi/qla2xxx/qla_bsg.c -@@ -342,6 +342,8 @@ qla2x00_process_els(struct bsg_job *bsg_job) - dma_map_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list, - bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE); - if (!req_sg_cnt) { -+ dma_unmap_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list, -+ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE); - rval = -ENOMEM; - goto done_free_fcport; - } -@@ -349,6 +351,8 @@ qla2x00_process_els(struct bsg_job *bsg_job) - rsp_sg_cnt = dma_map_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list, - bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE); - if (!rsp_sg_cnt) { -+ dma_unmap_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list, -+ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE); - rval = -ENOMEM; - goto done_free_fcport; - } -@@ -1778,8 +1782,8 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job) - uint16_t nextlid = 0; - uint32_t tot_dsds; - srb_t *sp = NULL; -- uint32_t req_data_len = 0; -- uint32_t rsp_data_len = 0; -+ uint32_t req_data_len; -+ uint32_t rsp_data_len; - - /* Check the type of the adapter */ - if (!IS_BIDI_CAPABLE(ha)) { -@@ -1884,6 +1888,9 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job) - goto done_unmap_sg; - } - -+ req_data_len = bsg_job->request_payload.payload_len; -+ rsp_data_len = bsg_job->reply_payload.payload_len; -+ - if (req_data_len != rsp_data_len) { - rval = EXT_STATUS_BUSY; - ql_log(ql_log_warn, vha, 0x70aa, -@@ -1891,10 +1898,6 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job) - goto done_unmap_sg; - } - -- req_data_len = bsg_job->request_payload.payload_len; -- rsp_data_len = bsg_job->reply_payload.payload_len; -- -- - /* Alloc SRB structure */ - sp = qla2x00_get_sp(vha, &(vha->bidir_fcport), GFP_KERNEL); - if (!sp) { -diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c -index 0e154fea693e..bd2421863510 100644 ---- a/drivers/scsi/qla2xxx/qla_init.c -+++ b/drivers/scsi/qla2xxx/qla_init.c -@@ -8092,8 +8092,6 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair) - struct qla_hw_data *ha = qpair->hw; - - qpair->delete_in_progress = 1; -- while (atomic_read(&qpair->ref_count)) -- msleep(500); - - ret = qla25xx_delete_req_que(vha, qpair->req); - if (ret != QLA_SUCCESS) -diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c -index 6a76d7217515..ebca1a470e9b 100644 ---- a/drivers/scsi/qla2xxx/qla_isr.c -+++ b/drivers/scsi/qla2xxx/qla_isr.c -@@ -3369,10 +3369,8 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp) - ha->msix_count, ret); - goto msix_out; - } else if (ret < ha->msix_count) { -- ql_log(ql_log_warn, vha, 0x00c6, -- "MSI-X: Failed to enable support " -- "with %d vectors, using %d vectors.\n", -- ha->msix_count, ret); -+ ql_log(ql_log_info, vha, 0x00c6, -+ "MSI-X: Using %d vectors\n", ret); - ha->msix_count = ret; - /* Recalculate queue values */ - if (ha->mqiobase && ql2xmqsupport) { -diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c -index 11753ed3433c..69ed544d80ef 100644 ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -5918,7 +5918,6 @@ static void qlt_abort_work(struct qla_tgt *tgt, - struct qla_hw_data *ha = vha->hw; - struct fc_port *sess = NULL; - unsigned long flags = 0, flags2 = 0; -- uint32_t be_s_id; - uint8_t s_id[3]; - int rc; - -@@ -5931,8 +5930,7 @@ static void qlt_abort_work(struct qla_tgt *tgt, - s_id[1] = prm->abts.fcp_hdr_le.s_id[1]; - s_id[2] = prm->abts.fcp_hdr_le.s_id[0]; - -- sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, -- (unsigned char *)&be_s_id); -+ sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, s_id); - if (!sess) { - spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2); - -@@ -6396,7 +6394,8 @@ qlt_enable_vha(struct scsi_qla_host *vha) - } else { - set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags); - qla2xxx_wake_dpc(base_vha); -- qla2x00_wait_for_hba_online(base_vha); -+ WARN_ON_ONCE(qla2x00_wait_for_hba_online(base_vha) != -+ QLA_SUCCESS); - } - } - EXPORT_SYMBOL(qlt_enable_vha); -@@ -6426,7 +6425,9 @@ static void qlt_disable_vha(struct scsi_qla_host *vha) - - set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); - qla2xxx_wake_dpc(vha); -- qla2x00_wait_for_hba_online(vha); -+ if (qla2x00_wait_for_hba_online(vha) != QLA_SUCCESS) -+ ql_dbg(ql_dbg_tgt, vha, 0xe081, -+ "qla2x00_wait_for_hba_online() failed\n"); - } - - /* -diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c -index 047875861df1..d19331b66222 100644 ---- a/drivers/spi/spi-atmel.c -+++ b/drivers/spi/spi-atmel.c -@@ -1150,10 +1150,8 @@ static int atmel_spi_setup(struct spi_device *spi) - as = spi_master_get_devdata(spi->master); - - /* see notes above re chipselect */ -- if (!atmel_spi_is_v2(as) -- && spi->chip_select == 0 -- && (spi->mode & SPI_CS_HIGH)) { -- dev_dbg(&spi->dev, "setup: can't be active-high\n"); -+ if (!as->use_cs_gpios && (spi->mode & SPI_CS_HIGH)) { -+ dev_warn(&spi->dev, "setup: non GPIO CS can't be active-high\n"); - return -EINVAL; - } - -diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c -index f66dd3ebbab1..856bcfa60c6c 100644 ---- a/drivers/staging/iio/addac/adt7316-i2c.c -+++ b/drivers/staging/iio/addac/adt7316-i2c.c -@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data) - return ret; - } - -+ *data = ret; -+ - return 0; - } - -diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -index 77c339a93525..3733b73863b6 100644 ---- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c -+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -@@ -78,7 +78,7 @@ static struct dvobj_priv *usb_dvobj_init(struct usb_interface *usb_intf) - phost_conf = pusbd->actconfig; - pconf_desc = &phost_conf->desc; - -- phost_iface = &usb_intf->altsetting[0]; -+ phost_iface = usb_intf->cur_altsetting; - piface_desc = &phost_iface->desc; - - pdvobjpriv->NumInterfaces = pconf_desc->bNumInterfaces; -diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c -index b3e266bd57ab..8be4fcc54ad6 100644 ---- a/drivers/staging/rtl8712/usb_intf.c -+++ b/drivers/staging/rtl8712/usb_intf.c -@@ -275,7 +275,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter) - - pdvobjpriv->padapter = padapter; - padapter->EepromAddressSize = 6; -- phost_iface = &pintf->altsetting[0]; -+ phost_iface = pintf->cur_altsetting; - piface_desc = &phost_iface->desc; - pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints; - if (pusbd->speed == USB_SPEED_HIGH) { -diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c -index 456ef213dc14..fcefafe7df48 100644 ---- a/drivers/thermal/thermal_core.c -+++ b/drivers/thermal/thermal_core.c -@@ -299,7 +299,7 @@ static void thermal_zone_device_set_polling(struct thermal_zone_device *tz, - mod_delayed_work(system_freezable_wq, &tz->poll_queue, - msecs_to_jiffies(delay)); - else -- cancel_delayed_work_sync(&tz->poll_queue); -+ cancel_delayed_work(&tz->poll_queue); - } - - static void monitor_thermal_zone(struct thermal_zone_device *tz) -@@ -1350,7 +1350,7 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) - - mutex_unlock(&thermal_list_lock); - -- thermal_zone_device_set_polling(tz, 0); -+ cancel_delayed_work_sync(&tz->poll_queue); - - thermal_set_governor(tz, NULL); - -diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c -index e83dea8d6633..19c4aa800c81 100644 ---- a/drivers/tty/n_hdlc.c -+++ b/drivers/tty/n_hdlc.c -@@ -614,7 +614,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, - } - - /* no data */ -- if (file->f_flags & O_NONBLOCK) { -+ if (tty_io_nonblock(tty, file)) { - ret = -EAGAIN; - break; - } -@@ -681,7 +681,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file, - if (tbuf) - break; - -- if (file->f_flags & O_NONBLOCK) { -+ if (tty_io_nonblock(tty, file)) { - error = -EAGAIN; - break; - } -diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c -index 305b6490d405..08ac04d08991 100644 ---- a/drivers/tty/n_r3964.c -+++ b/drivers/tty/n_r3964.c -@@ -1080,7 +1080,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file, - pMsg = remove_msg(pInfo, pClient); - if (pMsg == NULL) { - /* no messages available. */ -- if (file->f_flags & O_NONBLOCK) { -+ if (tty_io_nonblock(tty, file)) { - ret = -EAGAIN; - goto unlock; - } -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 904fc9c37fde..8214b0326b3a 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -1704,7 +1704,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, - - down_read(&tty->termios_rwsem); - -- while (1) { -+ do { - /* - * When PARMRK is set, each input char may take up to 3 chars - * in the read buf; reduce the buffer space avail by 3x -@@ -1746,7 +1746,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, - fp += n; - count -= n; - rcvd += n; -- } -+ } while (!test_bit(TTY_LDISC_CHANGING, &tty->flags)); - - tty->receive_room = room; - -@@ -2213,7 +2213,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, - break; - if (!timeout) - break; -- if (file->f_flags & O_NONBLOCK) { -+ if (tty_io_nonblock(tty, file)) { - retval = -EAGAIN; - break; - } -@@ -2367,7 +2367,7 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file, - } - if (!nr) - break; -- if (file->f_flags & O_NONBLOCK) { -+ if (tty_io_nonblock(tty, file)) { - retval = -EAGAIN; - break; - } -diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c -index 4a4a9f33715c..637f72fb6427 100644 ---- a/drivers/tty/serial/amba-pl011.c -+++ b/drivers/tty/serial/amba-pl011.c -@@ -829,10 +829,8 @@ __acquires(&uap->port.lock) - if (!uap->using_tx_dma) - return; - -- /* Avoid deadlock with the DMA engine callback */ -- spin_unlock(&uap->port.lock); -- dmaengine_terminate_all(uap->dmatx.chan); -- spin_lock(&uap->port.lock); -+ dmaengine_terminate_async(uap->dmatx.chan); -+ - if (uap->dmatx.queued) { - dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, - DMA_TO_DEVICE); -diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c -index 32a473f9d1d3..fb2dcb3f8591 100644 ---- a/drivers/tty/serial/fsl_lpuart.c -+++ b/drivers/tty/serial/fsl_lpuart.c -@@ -380,8 +380,8 @@ static void lpuart_dma_tx(struct lpuart_port *sport) - } - - sport->dma_tx_desc = dmaengine_prep_slave_sg(sport->dma_tx_chan, sgl, -- sport->dma_tx_nents, -- DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT); -+ ret, DMA_MEM_TO_DEV, -+ DMA_PREP_INTERRUPT); - if (!sport->dma_tx_desc) { - dma_unmap_sg(dev, sgl, sport->dma_tx_nents, DMA_TO_DEVICE); - dev_err(dev, "Cannot prepare TX slave DMA!\n"); -diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c -index f190a84a0246..d54ebe6b1d50 100644 ---- a/drivers/tty/serial/ifx6x60.c -+++ b/drivers/tty/serial/ifx6x60.c -@@ -1245,6 +1245,9 @@ static int ifx_spi_spi_remove(struct spi_device *spi) - struct ifx_spi_device *ifx_dev = spi_get_drvdata(spi); - /* stop activity */ - tasklet_kill(&ifx_dev->io_work_tasklet); -+ -+ pm_runtime_disable(&spi->dev); -+ - /* free irq */ - free_irq(gpio_to_irq(ifx_dev->gpio.reset_out), ifx_dev); - free_irq(gpio_to_irq(ifx_dev->gpio.srdy), ifx_dev); -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 4e827e5a52a3..aae68230fb7b 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -1956,7 +1956,7 @@ imx_console_setup(struct console *co, char *options) - - retval = clk_prepare(sport->clk_per); - if (retval) -- clk_disable_unprepare(sport->clk_ipg); -+ clk_unprepare(sport->clk_ipg); - - error_console: - return retval; -diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c -index 0e0ccc132ab0..e937fb189034 100644 ---- a/drivers/tty/serial/msm_serial.c -+++ b/drivers/tty/serial/msm_serial.c -@@ -988,6 +988,7 @@ static unsigned int msm_get_mctrl(struct uart_port *port) - static void msm_reset(struct uart_port *port) - { - struct msm_port *msm_port = UART_TO_MSM(port); -+ unsigned int mr; - - /* reset everything */ - msm_write(port, UART_CR_CMD_RESET_RX, UART_CR); -@@ -995,7 +996,10 @@ static void msm_reset(struct uart_port *port) - msm_write(port, UART_CR_CMD_RESET_ERR, UART_CR); - msm_write(port, UART_CR_CMD_RESET_BREAK_INT, UART_CR); - msm_write(port, UART_CR_CMD_RESET_CTS, UART_CR); -- msm_write(port, UART_CR_CMD_SET_RFR, UART_CR); -+ msm_write(port, UART_CR_CMD_RESET_RFR, UART_CR); -+ mr = msm_read(port, UART_MR1); -+ mr &= ~UART_MR1_RX_RDY_CTL; -+ msm_write(port, mr, UART_MR1); - - /* Disable DM modes */ - if (msm_port->is_uartdm) -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index 17e2311f7b00..38bb8f85e88d 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -1125,7 +1125,7 @@ static int uart_break_ctl(struct tty_struct *tty, int break_state) - if (!uport) - goto out; - -- if (uport->type != PORT_UNKNOWN) -+ if (uport->type != PORT_UNKNOWN && uport->ops->break_ctl) - uport->ops->break_ctl(uport, break_state); - ret = 0; - out: -diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c -index 01fcdc7ff077..62dd2abb57fe 100644 ---- a/drivers/tty/tty_ldisc.c -+++ b/drivers/tty/tty_ldisc.c -@@ -348,6 +348,11 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) - { - int ret; - -+ /* Kindly asking blocked readers to release the read side */ -+ set_bit(TTY_LDISC_CHANGING, &tty->flags); -+ wake_up_interruptible_all(&tty->read_wait); -+ wake_up_interruptible_all(&tty->write_wait); -+ - ret = __tty_ldisc_lock(tty, timeout); - if (!ret) - return -EBUSY; -@@ -358,6 +363,8 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) - void tty_ldisc_unlock(struct tty_struct *tty) - { - clear_bit(TTY_LDISC_HALTED, &tty->flags); -+ /* Can be cleared here - ldisc_unlock will wake up writers firstly */ -+ clear_bit(TTY_LDISC_CHANGING, &tty->flags); - __tty_ldisc_unlock(tty); - } - -diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c -index 7506bbcf8259..b9ec4e2828e2 100644 ---- a/drivers/tty/vt/keyboard.c -+++ b/drivers/tty/vt/keyboard.c -@@ -1460,7 +1460,7 @@ static void kbd_event(struct input_handle *handle, unsigned int event_type, - - if (event_type == EV_MSC && event_code == MSC_RAW && HW_RAW(handle->dev)) - kbd_rawcode(value); -- if (event_type == EV_KEY) -+ if (event_type == EV_KEY && event_code <= KEY_MAX) - kbd_keycode(event_code, value, HW_RAW(handle->dev)); - - spin_unlock(&kbd_event_lock); -diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c -index ba7616395db2..f649b7b83200 100644 ---- a/drivers/usb/atm/ueagle-atm.c -+++ b/drivers/usb/atm/ueagle-atm.c -@@ -2167,10 +2167,11 @@ resubmit: - /* - * Start the modem : init the data and start kernel thread - */ --static int uea_boot(struct uea_softc *sc) -+static int uea_boot(struct uea_softc *sc, struct usb_interface *intf) - { -- int ret, size; - struct intr_pkt *intr; -+ int ret = -ENOMEM; -+ int size; - - uea_enters(INS_TO_USBDEV(sc)); - -@@ -2195,6 +2196,11 @@ static int uea_boot(struct uea_softc *sc) - if (UEA_CHIP_VERSION(sc) == ADI930) - load_XILINX_firmware(sc); - -+ if (intf->cur_altsetting->desc.bNumEndpoints < 1) { -+ ret = -ENODEV; -+ goto err0; -+ } -+ - intr = kmalloc(size, GFP_KERNEL); - if (!intr) - goto err0; -@@ -2206,8 +2212,7 @@ static int uea_boot(struct uea_softc *sc) - usb_fill_int_urb(sc->urb_int, sc->usb_dev, - usb_rcvintpipe(sc->usb_dev, UEA_INTR_PIPE), - intr, size, uea_intr, sc, -- sc->usb_dev->actconfig->interface[0]->altsetting[0]. -- endpoint[0].desc.bInterval); -+ intf->cur_altsetting->endpoint[0].desc.bInterval); - - ret = usb_submit_urb(sc->urb_int, GFP_KERNEL); - if (ret < 0) { -@@ -2222,6 +2227,7 @@ static int uea_boot(struct uea_softc *sc) - sc->kthread = kthread_create(uea_kthread, sc, "ueagle-atm"); - if (IS_ERR(sc->kthread)) { - uea_err(INS_TO_USBDEV(sc), "failed to create thread\n"); -+ ret = PTR_ERR(sc->kthread); - goto err2; - } - -@@ -2236,7 +2242,7 @@ err1: - kfree(intr); - err0: - uea_leaves(INS_TO_USBDEV(sc)); -- return -ENOMEM; -+ return ret; - } - - /* -@@ -2597,7 +2603,7 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf, - if (ret < 0) - goto error; - -- ret = uea_boot(sc); -+ ret = uea_boot(sc, intf); - if (ret < 0) - goto error_rm_grp; - -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index bb20aa433e98..4efccf8bf99f 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -5630,7 +5630,7 @@ re_enumerate_no_bos: - - /** - * usb_reset_device - warn interface drivers and perform a USB port reset -- * @udev: device to reset (not in SUSPENDED or NOTATTACHED state) -+ * @udev: device to reset (not in NOTATTACHED state) - * - * Warns all drivers bound to registered interfaces (using their pre_reset - * method), performs the port reset, and then lets the drivers know that -@@ -5658,8 +5658,7 @@ int usb_reset_device(struct usb_device *udev) - struct usb_host_config *config = udev->actconfig; - struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); - -- if (udev->state == USB_STATE_NOTATTACHED || -- udev->state == USB_STATE_SUSPENDED) { -+ if (udev->state == USB_STATE_NOTATTACHED) { - dev_dbg(&udev->dev, "device reset not allowed in state %d\n", - udev->state); - return -EINVAL; -diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c -index 8b800e34407b..83bd48734af5 100644 ---- a/drivers/usb/core/urb.c -+++ b/drivers/usb/core/urb.c -@@ -45,6 +45,7 @@ void usb_init_urb(struct urb *urb) - if (urb) { - memset(urb, 0, sizeof(*urb)); - kref_init(&urb->kref); -+ INIT_LIST_HEAD(&urb->urb_list); - INIT_LIST_HEAD(&urb->anchor_list); - } - } -diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c -index 48755c501201..a497b878c3e2 100644 ---- a/drivers/usb/dwc3/core.c -+++ b/drivers/usb/dwc3/core.c -@@ -1261,7 +1261,8 @@ static int dwc3_probe(struct platform_device *pdev) - - ret = dwc3_core_init(dwc); - if (ret) { -- dev_err(dev, "failed to initialize core\n"); -+ if (ret != -EPROBE_DEFER) -+ dev_err(dev, "failed to initialize core: %d\n", ret); - goto err4; - } - -diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h -index 5e9c070ec874..1b4c2f8bb3da 100644 ---- a/drivers/usb/dwc3/debug.h -+++ b/drivers/usb/dwc3/debug.h -@@ -124,6 +124,35 @@ dwc3_gadget_link_string(enum dwc3_link_state link_state) - } - } - -+/** -+ * dwc3_gadget_hs_link_string - returns highspeed and below link name -+ * @link_state: link state code -+ */ -+static inline const char * -+dwc3_gadget_hs_link_string(enum dwc3_link_state link_state) -+{ -+ switch (link_state) { -+ case DWC3_LINK_STATE_U0: -+ return "On"; -+ case DWC3_LINK_STATE_U2: -+ return "Sleep"; -+ case DWC3_LINK_STATE_U3: -+ return "Suspend"; -+ case DWC3_LINK_STATE_SS_DIS: -+ return "Disconnected"; -+ case DWC3_LINK_STATE_RX_DET: -+ return "Early Suspend"; -+ case DWC3_LINK_STATE_RECOV: -+ return "Recovery"; -+ case DWC3_LINK_STATE_RESET: -+ return "Reset"; -+ case DWC3_LINK_STATE_RESUME: -+ return "Resume"; -+ default: -+ return "UNKNOWN link state\n"; -+ } -+} -+ - /** - * dwc3_trb_type_string - returns TRB type as a string - * @type: the type of the TRB -diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c -index 4e09be80e59f..0d6a6a168a7e 100644 ---- a/drivers/usb/dwc3/debugfs.c -+++ b/drivers/usb/dwc3/debugfs.c -@@ -436,13 +436,17 @@ static int dwc3_link_state_show(struct seq_file *s, void *unused) - unsigned long flags; - enum dwc3_link_state state; - u32 reg; -+ u8 speed; - - spin_lock_irqsave(&dwc->lock, flags); - reg = dwc3_readl(dwc->regs, DWC3_DSTS); - state = DWC3_DSTS_USBLNKST(reg); -- spin_unlock_irqrestore(&dwc->lock, flags); -+ speed = reg & DWC3_DSTS_CONNECTSPD; - -- seq_printf(s, "%s\n", dwc3_gadget_link_string(state)); -+ seq_printf(s, "%s\n", (speed >= DWC3_DSTS_SUPERSPEED) ? -+ dwc3_gadget_link_string(state) : -+ dwc3_gadget_hs_link_string(state)); -+ spin_unlock_irqrestore(&dwc->lock, flags); - - return 0; - } -@@ -460,6 +464,8 @@ static ssize_t dwc3_link_state_write(struct file *file, - unsigned long flags; - enum dwc3_link_state state = 0; - char buf[32]; -+ u32 reg; -+ u8 speed; - - if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) - return -EFAULT; -@@ -480,6 +486,15 @@ static ssize_t dwc3_link_state_write(struct file *file, - return -EINVAL; - - spin_lock_irqsave(&dwc->lock, flags); -+ reg = dwc3_readl(dwc->regs, DWC3_DSTS); -+ speed = reg & DWC3_DSTS_CONNECTSPD; -+ -+ if (speed < DWC3_DSTS_SUPERSPEED && -+ state != DWC3_LINK_STATE_RECOV) { -+ spin_unlock_irqrestore(&dwc->lock, flags); -+ return -EINVAL; -+ } -+ - dwc3_gadget_set_link_state(dwc, state); - spin_unlock_irqrestore(&dwc->lock, flags); - -diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c -index 89fe53c846ef..cb50806d2459 100644 ---- a/drivers/usb/dwc3/ep0.c -+++ b/drivers/usb/dwc3/ep0.c -@@ -1147,6 +1147,9 @@ static void dwc3_ep0_xfernotready(struct dwc3 *dwc, - void dwc3_ep0_interrupt(struct dwc3 *dwc, - const struct dwc3_event_depevt *event) - { -+ struct dwc3_ep *dep = dwc->eps[event->endpoint_number]; -+ u8 cmd; -+ - switch (event->endpoint_event) { - case DWC3_DEPEVT_XFERCOMPLETE: - dwc3_ep0_xfer_complete(dwc, event); -@@ -1159,7 +1162,12 @@ void dwc3_ep0_interrupt(struct dwc3 *dwc, - case DWC3_DEPEVT_XFERINPROGRESS: - case DWC3_DEPEVT_RXTXFIFOEVT: - case DWC3_DEPEVT_STREAMEVT: -+ break; - case DWC3_DEPEVT_EPCMDCMPLT: -+ cmd = DEPEVT_PARAMETER_CMD(event->parameters); -+ -+ if (cmd == DWC3_DEPCMD_ENDTRANSFER) -+ dep->flags &= ~DWC3_EP_TRANSFER_STARTED; - break; - } - } -diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c -index d0143d02e2f7..78a5832c209c 100644 ---- a/drivers/usb/gadget/configfs.c -+++ b/drivers/usb/gadget/configfs.c -@@ -1543,6 +1543,7 @@ static struct config_group *gadgets_make( - gi->composite.resume = NULL; - gi->composite.max_speed = USB_SPEED_SUPER; - -+ spin_lock_init(&gi->spinlock); - mutex_init(&gi->lock); - INIT_LIST_HEAD(&gi->string_list); - INIT_LIST_HEAD(&gi->available_func); -diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c -index 4176216d54be..520ace49f91d 100644 ---- a/drivers/usb/gadget/function/u_serial.c -+++ b/drivers/usb/gadget/function/u_serial.c -@@ -1392,8 +1392,10 @@ int gserial_alloc_line(unsigned char *line_num) - __func__, port_num, PTR_ERR(tty_dev)); - - ret = PTR_ERR(tty_dev); -+ mutex_lock(&ports[port_num].lock); - port = ports[port_num].port; - ports[port_num].port = NULL; -+ mutex_unlock(&ports[port_num].lock); - gserial_free_port(port); - goto err; - } -diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c -index 84dcbcd756f0..08bbe2c24134 100644 ---- a/drivers/usb/gadget/udc/pch_udc.c -+++ b/drivers/usb/gadget/udc/pch_udc.c -@@ -1523,7 +1523,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev, - td = phys_to_virt(addr); - addr2 = (dma_addr_t)td->next; - dma_pool_free(dev->data_requests, td, addr); -- td->next = 0x00; - addr = addr2; - } - req->chain_len = 1; -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 997ff183c9cb..95503bb9b067 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -855,7 +855,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - struct xhci_bus_state *bus_state, - __le32 __iomem **port_array, - u16 wIndex, u32 raw_port_status, -- unsigned long flags) -+ unsigned long *flags) - __releases(&xhci->lock) - __acquires(&xhci->lock) - { -@@ -937,12 +937,12 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - xhci_set_link_state(xhci, port_array, wIndex, - XDEV_U0); - -- spin_unlock_irqrestore(&xhci->lock, flags); -+ spin_unlock_irqrestore(&xhci->lock, *flags); - time_left = wait_for_completion_timeout( - &bus_state->rexit_done[wIndex], - msecs_to_jiffies( - XHCI_MAX_REXIT_TIMEOUT_MS)); -- spin_lock_irqsave(&xhci->lock, flags); -+ spin_lock_irqsave(&xhci->lock, *flags); - - if (time_left) { - slot_id = xhci_find_slot_id_by_port(hcd, -@@ -1090,7 +1090,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - break; - } - status = xhci_get_port_status(hcd, bus_state, port_array, -- wIndex, temp, flags); -+ wIndex, temp, &flags); - if (status == 0xffffffff) - goto error; - -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index b7b55eb82714..a80a57decda1 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1866,10 +1866,14 @@ no_bw: - kfree(xhci->port_array); - kfree(xhci->rh_bw); - kfree(xhci->ext_caps); -+ kfree(xhci->usb2_rhub.psi); -+ kfree(xhci->usb3_rhub.psi); - - xhci->usb2_ports = NULL; - xhci->usb3_ports = NULL; - xhci->port_array = NULL; -+ xhci->usb2_rhub.psi = NULL; -+ xhci->usb3_rhub.psi = NULL; - xhci->rh_bw = NULL; - xhci->ext_caps = NULL; - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index 1de006aebec5..021a2d320acc 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -499,6 +499,18 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) - } - #endif /* CONFIG_PM */ - -+static void xhci_pci_shutdown(struct usb_hcd *hcd) -+{ -+ struct xhci_hcd *xhci = hcd_to_xhci(hcd); -+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller); -+ -+ xhci_shutdown(hcd); -+ -+ /* Yet another workaround for spurious wakeups at shutdown with HSW */ -+ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) -+ pci_set_power_state(pdev, PCI_D3hot); -+} -+ - /*-------------------------------------------------------------------------*/ - - /* PCI driver selection metadata; PCI hotplugging uses this */ -@@ -534,6 +546,7 @@ static int __init xhci_pci_init(void) - #ifdef CONFIG_PM - xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend; - xhci_pci_hc_driver.pci_resume = xhci_pci_resume; -+ xhci_pci_hc_driver.shutdown = xhci_pci_shutdown; - #endif - return pci_register_driver(&xhci_pci_driver); - } -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 009b6796f405..89af395cd89c 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -2398,7 +2398,8 @@ static int handle_tx_event(struct xhci_hcd *xhci, - case COMP_SUCCESS: - if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) - break; -- if (xhci->quirks & XHCI_TRUST_TX_LENGTH) -+ if (xhci->quirks & XHCI_TRUST_TX_LENGTH || -+ ep_ring->last_td_was_short) - trb_comp_code = COMP_SHORT_PACKET; - else - xhci_warn_ratelimited(xhci, -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 465d7fd507ad..6c0a0ca316d3 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -717,7 +717,7 @@ static void xhci_stop(struct usb_hcd *hcd) - * - * This will only ever be called with the main usb_hcd (the USB3 roothub). - */ --static void xhci_shutdown(struct usb_hcd *hcd) -+void xhci_shutdown(struct usb_hcd *hcd) - { - struct xhci_hcd *xhci = hcd_to_xhci(hcd); - -@@ -736,11 +736,8 @@ static void xhci_shutdown(struct usb_hcd *hcd) - xhci_dbg_trace(xhci, trace_xhci_dbg_init, - "xhci_shutdown completed - status = %x", - readl(&xhci->op_regs->status)); -- -- /* Yet another workaround for spurious wakeups at shutdown with HSW */ -- if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) -- pci_set_power_state(to_pci_dev(hcd->self.sysdev), PCI_D3hot); - } -+EXPORT_SYMBOL_GPL(xhci_shutdown); - - #ifdef CONFIG_PM - static void xhci_save_registers(struct xhci_hcd *xhci) -@@ -911,7 +908,7 @@ static bool xhci_pending_portevent(struct xhci_hcd *xhci) - int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) - { - int rc = 0; -- unsigned int delay = XHCI_MAX_HALT_USEC; -+ unsigned int delay = XHCI_MAX_HALT_USEC * 2; - struct usb_hcd *hcd = xhci_to_hcd(xhci); - u32 command; - u32 res; -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index cbc91536e512..db1af99d53bd 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -2022,6 +2022,7 @@ int xhci_start(struct xhci_hcd *xhci); - int xhci_reset(struct xhci_hcd *xhci); - int xhci_run(struct usb_hcd *hcd); - int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); -+void xhci_shutdown(struct usb_hcd *hcd); - void xhci_init_driver(struct hc_driver *drv, - const struct xhci_driver_overrides *over); - int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); -diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c -index c8c8fa3f1f46..45390045c75d 100644 ---- a/drivers/usb/misc/adutux.c -+++ b/drivers/usb/misc/adutux.c -@@ -671,7 +671,7 @@ static int adu_probe(struct usb_interface *interface, - init_waitqueue_head(&dev->read_wait); - init_waitqueue_head(&dev->write_wait); - -- res = usb_find_common_endpoints_reverse(&interface->altsetting[0], -+ res = usb_find_common_endpoints_reverse(interface->cur_altsetting, - NULL, NULL, - &dev->interrupt_in_endpoint, - &dev->interrupt_out_endpoint); -diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c -index 39d8fedfaf3b..01ef2551be46 100644 ---- a/drivers/usb/misc/idmouse.c -+++ b/drivers/usb/misc/idmouse.c -@@ -341,7 +341,7 @@ static int idmouse_probe(struct usb_interface *interface, - int result; - - /* check if we have gotten the data or the hid interface */ -- iface_desc = &interface->altsetting[0]; -+ iface_desc = interface->cur_altsetting; - if (iface_desc->desc.bInterfaceClass != 0x0A) - return -ENODEV; - -diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c -index f932f40302df..156aebf62e61 100644 ---- a/drivers/usb/mon/mon_bin.c -+++ b/drivers/usb/mon/mon_bin.c -@@ -1038,12 +1038,18 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg - - mutex_lock(&rp->fetch_lock); - spin_lock_irqsave(&rp->b_lock, flags); -- mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE); -- kfree(rp->b_vec); -- rp->b_vec = vec; -- rp->b_size = size; -- rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0; -- rp->cnt_lost = 0; -+ if (rp->mmap_active) { -+ mon_free_buff(vec, size/CHUNK_SIZE); -+ kfree(vec); -+ ret = -EBUSY; -+ } else { -+ mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE); -+ kfree(rp->b_vec); -+ rp->b_vec = vec; -+ rp->b_size = size; -+ rp->b_read = rp->b_in = rp->b_out = rp->b_cnt = 0; -+ rp->cnt_lost = 0; -+ } - spin_unlock_irqrestore(&rp->b_lock, flags); - mutex_unlock(&rp->fetch_lock); - } -@@ -1215,13 +1221,21 @@ mon_bin_poll(struct file *file, struct poll_table_struct *wait) - static void mon_bin_vma_open(struct vm_area_struct *vma) - { - struct mon_reader_bin *rp = vma->vm_private_data; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&rp->b_lock, flags); - rp->mmap_active++; -+ spin_unlock_irqrestore(&rp->b_lock, flags); - } - - static void mon_bin_vma_close(struct vm_area_struct *vma) - { -+ unsigned long flags; -+ - struct mon_reader_bin *rp = vma->vm_private_data; -+ spin_lock_irqsave(&rp->b_lock, flags); - rp->mmap_active--; -+ spin_unlock_irqrestore(&rp->b_lock, flags); - } - - /* -@@ -1233,16 +1247,12 @@ static int mon_bin_vma_fault(struct vm_fault *vmf) - unsigned long offset, chunk_idx; - struct page *pageptr; - -- mutex_lock(&rp->fetch_lock); - offset = vmf->pgoff << PAGE_SHIFT; -- if (offset >= rp->b_size) { -- mutex_unlock(&rp->fetch_lock); -+ if (offset >= rp->b_size) - return VM_FAULT_SIGBUS; -- } - chunk_idx = offset / CHUNK_SIZE; - pageptr = rp->b_vec[chunk_idx].pg; - get_page(pageptr); -- mutex_unlock(&rp->fetch_lock); - vmf->page = pageptr; - return 0; - } -diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c -index 7d9ba8a52368..c87947fb2694 100644 ---- a/drivers/usb/mtu3/mtu3_qmu.c -+++ b/drivers/usb/mtu3/mtu3_qmu.c -@@ -372,7 +372,7 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum) - return; - } - -- dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, mreq); -+ dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, req); - - mtu3_clrbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_DMAREQEN); - -diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c -index 01f3ac7769f3..51b61545ccf2 100644 ---- a/drivers/usb/serial/io_edgeport.c -+++ b/drivers/usb/serial/io_edgeport.c -@@ -2918,16 +2918,18 @@ static int edge_startup(struct usb_serial *serial) - response = 0; - - if (edge_serial->is_epic) { -+ struct usb_host_interface *alt; -+ -+ alt = serial->interface->cur_altsetting; -+ - /* EPIC thing, set up our interrupt polling now and our read - * urb, so that the device knows it really is connected. */ - interrupt_in_found = bulk_in_found = bulk_out_found = false; -- for (i = 0; i < serial->interface->altsetting[0] -- .desc.bNumEndpoints; ++i) { -+ for (i = 0; i < alt->desc.bNumEndpoints; ++i) { - struct usb_endpoint_descriptor *endpoint; - int buffer_size; - -- endpoint = &serial->interface->altsetting[0]. -- endpoint[i].desc; -+ endpoint = &alt->endpoint[i].desc; - buffer_size = usb_endpoint_maxp(endpoint); - if (!interrupt_in_found && - (usb_endpoint_is_int_in(endpoint))) { -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index 1e62f2134b3a..8391a88cf90f 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -832,6 +832,10 @@ static int uas_slave_configure(struct scsi_device *sdev) - sdev->wce_default_on = 1; - } - -+ /* Some disks cannot handle READ_CAPACITY_16 */ -+ if (devinfo->flags & US_FL_NO_READ_CAPACITY_16) -+ sdev->no_read_capacity_16 = 1; -+ - /* - * Some disks return the total number of blocks in response - * to READ CAPACITY rather than the highest block number. -@@ -840,6 +844,12 @@ static int uas_slave_configure(struct scsi_device *sdev) - if (devinfo->flags & US_FL_FIX_CAPACITY) - sdev->fix_capacity = 1; - -+ /* -+ * in some cases we have to guess -+ */ -+ if (devinfo->flags & US_FL_CAPACITY_HEURISTICS) -+ sdev->guess_capacity = 1; -+ - /* - * Some devices don't like MODE SENSE with page=0x3f, - * which is the command used for checking if a device -diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c -index 111a0ab6280a..ce7c4a269f77 100644 ---- a/drivers/video/hdmi.c -+++ b/drivers/video/hdmi.c -@@ -1036,12 +1036,12 @@ static int hdmi_avi_infoframe_unpack(struct hdmi_avi_infoframe *frame, - if (ptr[0] & 0x10) - frame->active_aspect = ptr[1] & 0xf; - if (ptr[0] & 0x8) { -- frame->top_bar = (ptr[5] << 8) + ptr[6]; -- frame->bottom_bar = (ptr[7] << 8) + ptr[8]; -+ frame->top_bar = (ptr[6] << 8) | ptr[5]; -+ frame->bottom_bar = (ptr[8] << 8) | ptr[7]; - } - if (ptr[0] & 0x4) { -- frame->left_bar = (ptr[9] << 8) + ptr[10]; -- frame->right_bar = (ptr[11] << 8) + ptr[12]; -+ frame->left_bar = (ptr[10] << 8) | ptr[9]; -+ frame->right_bar = (ptr[12] << 8) | ptr[11]; - } - frame->scan_mode = ptr[0] & 0x3; - -diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c -index d9873aa014a6..499531608fa2 100644 ---- a/drivers/virtio/virtio_balloon.c -+++ b/drivers/virtio/virtio_balloon.c -@@ -492,6 +492,17 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, - - get_page(newpage); /* balloon reference */ - -+ /* -+ * When we migrate a page to a different zone and adjusted the -+ * managed page count when inflating, we have to fixup the count of -+ * both involved zones. -+ */ -+ if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM) && -+ page_zone(page) != page_zone(newpage)) { -+ adjust_managed_page_count(page, 1); -+ adjust_managed_page_count(newpage, -1); -+ } -+ - /* balloon's page migration 1st step -- inflate "newpage" */ - spin_lock_irqsave(&vb_dev_info->pages_lock, flags); - balloon_page_insert(vb_dev_info, newpage); -diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c -index cee7334b2a00..f5835cbd5d41 100644 ---- a/drivers/watchdog/aspeed_wdt.c -+++ b/drivers/watchdog/aspeed_wdt.c -@@ -204,11 +204,6 @@ static int aspeed_wdt_probe(struct platform_device *pdev) - if (IS_ERR(wdt->base)) - return PTR_ERR(wdt->base); - -- /* -- * The ast2400 wdt can run at PCLK, or 1MHz. The ast2500 only -- * runs at 1MHz. We chose to always run at 1MHz, as there's no -- * good reason to have a faster watchdog counter. -- */ - wdt->wdd.info = &aspeed_wdt_info; - wdt->wdd.ops = &aspeed_wdt_ops; - wdt->wdd.max_hw_heartbeat_ms = WDT_MAX_TIMEOUT_MS; -@@ -224,7 +219,16 @@ static int aspeed_wdt_probe(struct platform_device *pdev) - return -EINVAL; - config = ofdid->data; - -- wdt->ctrl = WDT_CTRL_1MHZ_CLK; -+ /* -+ * On clock rates: -+ * - ast2400 wdt can run at PCLK, or 1MHz -+ * - ast2500 only runs at 1MHz, hard coding bit 4 to 1 -+ * - ast2600 always runs at 1MHz -+ * -+ * Set the ast2400 to run at 1MHz as it simplifies the driver. -+ */ -+ if (of_device_is_compatible(np, "aspeed,ast2400-wdt")) -+ wdt->ctrl = WDT_CTRL_1MHZ_CLK; - - /* - * Control reset on a per-device basis to ensure the -diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c -index 141f9bc213a3..94a0017c923b 100644 ---- a/fs/autofs4/expire.c -+++ b/fs/autofs4/expire.c -@@ -472,9 +472,10 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb, - */ - flags &= ~AUTOFS_EXP_LEAVES; - found = should_expire(expired, mnt, timeout, how); -- if (!found || found != expired) -- /* Something has changed, continue */ -+ if (found != expired) { // something has changed, continue -+ dput(found); - goto next; -+ } - - if (expired != dentry) - dput(dentry); -diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c -index 04f39111fafb..87414fc9e268 100644 ---- a/fs/btrfs/delayed-inode.c -+++ b/fs/btrfs/delayed-inode.c -@@ -1975,12 +1975,19 @@ void btrfs_kill_all_delayed_nodes(struct btrfs_root *root) - } - - inode_id = delayed_nodes[n - 1]->inode_id + 1; -- -- for (i = 0; i < n; i++) -- refcount_inc(&delayed_nodes[i]->refs); -+ for (i = 0; i < n; i++) { -+ /* -+ * Don't increase refs in case the node is dead and -+ * about to be removed from the tree in the loop below -+ */ -+ if (!refcount_inc_not_zero(&delayed_nodes[i]->refs)) -+ delayed_nodes[i] = NULL; -+ } - spin_unlock(&root->inode_lock); - - for (i = 0; i < n; i++) { -+ if (!delayed_nodes[i]) -+ continue; - __btrfs_kill_delayed_node(delayed_nodes[i]); - btrfs_release_delayed_node(delayed_nodes[i]); - } -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 6fbae1357644..bf654d48eb46 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -1625,6 +1625,7 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file, - break; - } - -+ only_release_metadata = false; - sector_offset = pos & (fs_info->sectorsize - 1); - reserve_bytes = round_up(write_bytes + sector_offset, - fs_info->sectorsize); -@@ -1778,7 +1779,6 @@ again: - set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, - lockend, EXTENT_NORESERVE, NULL, - NULL, GFP_NOFS); -- only_release_metadata = false; - } - - btrfs_drop_pages(pages, num_pages); -diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c -index 9f31b81a5e27..abeb26d48d0a 100644 ---- a/fs/btrfs/free-space-cache.c -+++ b/fs/btrfs/free-space-cache.c -@@ -398,6 +398,12 @@ static int io_ctl_prepare_pages(struct btrfs_io_ctl *io_ctl, struct inode *inode - if (uptodate && !PageUptodate(page)) { - btrfs_readpage(NULL, page); - lock_page(page); -+ if (page->mapping != inode->i_mapping) { -+ btrfs_err(BTRFS_I(inode)->root->fs_info, -+ "free space cache page truncated"); -+ io_ctl_drop_pages(io_ctl); -+ return -EIO; -+ } - if (!PageUptodate(page)) { - btrfs_err(BTRFS_I(inode)->root->fs_info, - "error reading free space cache"); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index ddc1d1d1a29f..739f45b04b52 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -9839,6 +9839,9 @@ static int btrfs_rename_exchange(struct inode *old_dir, - goto out_notrans; - } - -+ if (dest != root) -+ btrfs_record_root_in_trans(trans, dest); -+ - /* - * We need to find a free sequence number both in the source and - * in the destination directory for the exchange. -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index a5905f97b3db..1211fdcd425d 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -36,6 +36,14 @@ - #include "transaction.h" - #include "compression.h" - -+/* -+ * Maximum number of references an extent can have in order for us to attempt to -+ * issue clone operations instead of write operations. This currently exists to -+ * avoid hitting limitations of the backreference walking code (taking a lot of -+ * time and using too much memory for extents with large number of references). -+ */ -+#define SEND_MAX_EXTENT_REFS 64 -+ - /* - * A fs_path is a helper to dynamically build path names with unknown size. - * It reallocates the internal buffer on demand. -@@ -1324,6 +1332,7 @@ static int find_extent_clone(struct send_ctx *sctx, - struct clone_root *cur_clone_root; - struct btrfs_key found_key; - struct btrfs_path *tmp_path; -+ struct btrfs_extent_item *ei; - int compressed; - u32 i; - -@@ -1373,7 +1382,6 @@ static int find_extent_clone(struct send_ctx *sctx, - ret = extent_from_logical(fs_info, disk_byte, tmp_path, - &found_key, &flags); - up_read(&fs_info->commit_root_sem); -- btrfs_release_path(tmp_path); - - if (ret < 0) - goto out; -@@ -1382,6 +1390,21 @@ static int find_extent_clone(struct send_ctx *sctx, - goto out; - } - -+ ei = btrfs_item_ptr(tmp_path->nodes[0], tmp_path->slots[0], -+ struct btrfs_extent_item); -+ /* -+ * Backreference walking (iterate_extent_inodes() below) is currently -+ * too expensive when an extent has a large number of references, both -+ * in time spent and used memory. So for now just fallback to write -+ * operations instead of clone operations when an extent has more than -+ * a certain amount of references. -+ */ -+ if (btrfs_extent_refs(tmp_path->nodes[0], ei) > SEND_MAX_EXTENT_REFS) { -+ ret = -ENOENT; -+ goto out; -+ } -+ btrfs_release_path(tmp_path); -+ - /* - * Setup the clone roots. - */ -diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h -index f6ae6cdf233d..07b805d08e55 100644 ---- a/fs/btrfs/volumes.h -+++ b/fs/btrfs/volumes.h -@@ -317,7 +317,6 @@ struct btrfs_bio { - u64 map_type; /* get from map_lookup->type */ - bio_end_io_t *end_io; - struct bio *orig_bio; -- unsigned long flags; - void *private; - atomic_t error; - int max_errors; -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 40f22932343c..6dc0e092b0fc 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -312,9 +312,6 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, - INIT_LIST_HEAD(&fdlocks->locks); - fdlocks->cfile = cfile; - cfile->llist = fdlocks; -- cifs_down_write(&cinode->lock_sem); -- list_add(&fdlocks->llist, &cinode->llist); -- up_write(&cinode->lock_sem); - - cfile->count = 1; - cfile->pid = current->tgid; -@@ -338,6 +335,10 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, - oplock = 0; - } - -+ cifs_down_write(&cinode->lock_sem); -+ list_add(&fdlocks->llist, &cinode->llist); -+ up_write(&cinode->lock_sem); -+ - spin_lock(&tcon->open_file_lock); - if (fid->pending_open->oplock != CIFS_OPLOCK_NO_CHANGE && oplock) - oplock = fid->pending_open->oplock; -diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c -index 31f01f09d25a..ff2ad15f67d6 100644 ---- a/fs/cifs/smb2misc.c -+++ b/fs/cifs/smb2misc.c -@@ -622,10 +622,10 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) - spin_lock(&cifs_tcp_ses_lock); - list_for_each(tmp, &server->smb_ses_list) { - ses = list_entry(tmp, struct cifs_ses, smb_ses_list); -+ - list_for_each(tmp1, &ses->tcon_list) { - tcon = list_entry(tmp1, struct cifs_tcon, tcon_list); - -- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks); - spin_lock(&tcon->open_file_lock); - list_for_each(tmp2, &tcon->openFileList) { - cfile = list_entry(tmp2, struct cifsFileInfo, -@@ -637,6 +637,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) - continue; - - cifs_dbg(FYI, "file id match, oplock break\n"); -+ cifs_stats_inc( -+ &tcon->stats.cifs_stats.num_oplock_brks); - cinode = CIFS_I(d_inode(cfile->dentry)); - spin_lock(&cfile->file_info_lock); - if (!CIFS_CACHE_WRITE(cinode) && -@@ -669,9 +671,6 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) - return true; - } - spin_unlock(&tcon->open_file_lock); -- spin_unlock(&cifs_tcp_ses_lock); -- cifs_dbg(FYI, "No matching file for oplock break\n"); -- return true; - } - } - spin_unlock(&cifs_tcp_ses_lock); -diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c -index 610f72ae7ad6..9c8c9a09b4a6 100644 ---- a/fs/dlm/lockspace.c -+++ b/fs/dlm/lockspace.c -@@ -807,6 +807,7 @@ static int release_lockspace(struct dlm_ls *ls, int force) - - dlm_delete_debug_file(ls); - -+ idr_destroy(&ls->ls_recover_idr); - kfree(ls->ls_recover_buf); - - /* -diff --git a/fs/dlm/member.c b/fs/dlm/member.c -index cad6d85911a8..0bc43b35d2c5 100644 ---- a/fs/dlm/member.c -+++ b/fs/dlm/member.c -@@ -671,7 +671,7 @@ int dlm_ls_stop(struct dlm_ls *ls) - int dlm_ls_start(struct dlm_ls *ls) - { - struct dlm_recover *rv, *rv_old; -- struct dlm_config_node *nodes; -+ struct dlm_config_node *nodes = NULL; - int error, count; - - rv = kzalloc(sizeof(*rv), GFP_NOFS); -diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c -index 7cd24bccd4fe..37be29f21d04 100644 ---- a/fs/dlm/memory.c -+++ b/fs/dlm/memory.c -@@ -38,10 +38,8 @@ int __init dlm_memory_init(void) - - void dlm_memory_exit(void) - { -- if (lkb_cache) -- kmem_cache_destroy(lkb_cache); -- if (rsb_cache) -- kmem_cache_destroy(rsb_cache); -+ kmem_cache_destroy(lkb_cache); -+ kmem_cache_destroy(rsb_cache); - } - - char *dlm_allocate_lvb(struct dlm_ls *ls) -@@ -86,8 +84,7 @@ void dlm_free_lkb(struct dlm_lkb *lkb) - struct dlm_user_args *ua; - ua = lkb->lkb_ua; - if (ua) { -- if (ua->lksb.sb_lvbptr) -- kfree(ua->lksb.sb_lvbptr); -+ kfree(ua->lksb.sb_lvbptr); - kfree(ua); - } - } -diff --git a/fs/dlm/user.c b/fs/dlm/user.c -index 1f0c071d4a86..02de11695d0b 100644 ---- a/fs/dlm/user.c -+++ b/fs/dlm/user.c -@@ -25,6 +25,7 @@ - #include "lvb_table.h" - #include "user.h" - #include "ast.h" -+#include "config.h" - - static const char name_prefix[] = "dlm"; - static const struct file_operations device_fops; -@@ -404,7 +405,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params) - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; - -- error = dlm_new_lockspace(params->name, NULL, params->flags, -+ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags, - DLM_USER_LVB_LEN, NULL, NULL, NULL, - &lockspace); - if (error) -diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c -index c22cc9d2a5c9..a561ae17cf43 100644 ---- a/fs/exportfs/expfs.c -+++ b/fs/exportfs/expfs.c -@@ -508,26 +508,33 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid, - * inode is actually connected to the parent. - */ - err = exportfs_get_name(mnt, target_dir, nbuf, result); -- if (!err) { -- inode_lock(target_dir->d_inode); -- nresult = lookup_one_len(nbuf, target_dir, -- strlen(nbuf)); -- inode_unlock(target_dir->d_inode); -- if (!IS_ERR(nresult)) { -- if (nresult->d_inode) { -- dput(result); -- result = nresult; -- } else -- dput(nresult); -- } -+ if (err) { -+ dput(target_dir); -+ goto err_result; - } - -+ inode_lock(target_dir->d_inode); -+ nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf)); -+ if (!IS_ERR(nresult)) { -+ if (unlikely(nresult->d_inode != result->d_inode)) { -+ dput(nresult); -+ nresult = ERR_PTR(-ESTALE); -+ } -+ } -+ inode_unlock(target_dir->d_inode); - /* - * At this point we are done with the parent, but it's pinned - * by the child dentry anyway. - */ - dput(target_dir); - -+ if (IS_ERR(nresult)) { -+ err = PTR_ERR(nresult); -+ goto err_result; -+ } -+ dput(result); -+ result = nresult; -+ - /* - * And finally make sure the dentry is actually acceptable - * to NFSD. -diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c -index a7c87d593083..31c5a7b5f1f3 100644 ---- a/fs/ext2/inode.c -+++ b/fs/ext2/inode.c -@@ -699,10 +699,13 @@ static int ext2_get_blocks(struct inode *inode, - if (!partial) { - count++; - mutex_unlock(&ei->truncate_mutex); -- if (err) -- goto cleanup; - goto got_it; - } -+ -+ if (err) { -+ mutex_unlock(&ei->truncate_mutex); -+ goto cleanup; -+ } - } - - /* -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index b3d5fd84b485..11bc4c69bf16 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -195,7 +195,12 @@ void ext4_evict_inode(struct inode *inode) - { - handle_t *handle; - int err; -- int extra_credits = 3; -+ /* -+ * Credits for final inode cleanup and freeing: -+ * sb + inode (ext4_orphan_del()), block bitmap, group descriptor -+ * (xattr block freeing), bitmap, group descriptor (inode freeing) -+ */ -+ int extra_credits = 6; - struct ext4_xattr_inode_array *ea_inode_array = NULL; - - trace_ext4_evict_inode(inode); -@@ -251,8 +256,12 @@ void ext4_evict_inode(struct inode *inode) - if (!IS_NOQUOTA(inode)) - extra_credits += EXT4_MAXQUOTAS_DEL_BLOCKS(inode->i_sb); - -+ /* -+ * Block bitmap, group descriptor, and inode are accounted in both -+ * ext4_blocks_for_truncate() and extra_credits. So subtract 3. -+ */ - handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, -- ext4_blocks_for_truncate(inode)+extra_credits); -+ ext4_blocks_for_truncate(inode) + extra_credits - 3); - if (IS_ERR(handle)) { - ext4_std_error(inode->i_sb, PTR_ERR(handle)); - /* -@@ -5296,11 +5305,15 @@ static void ext4_wait_for_tail_page_commit(struct inode *inode) - - offset = inode->i_size & (PAGE_SIZE - 1); - /* -- * All buffers in the last page remain valid? Then there's nothing to -- * do. We do the check mainly to optimize the common PAGE_SIZE == -- * blocksize case -+ * If the page is fully truncated, we don't need to wait for any commit -+ * (and we even should not as __ext4_journalled_invalidatepage() may -+ * strip all buffers from the page but keep the page dirty which can then -+ * confuse e.g. concurrent ext4_writepage() seeing dirty page without -+ * buffers). Also we don't need to wait for any commit if all buffers in -+ * the page remain valid. This is most beneficial for the common case of -+ * blocksize == PAGESIZE. - */ -- if (offset > PAGE_SIZE - i_blocksize(inode)) -+ if (!offset || offset > (PAGE_SIZE - i_blocksize(inode))) - return; - while (1) { - page = find_lock_page(inode->i_mapping, -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 212b01861d94..b4e0c270def4 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -3065,18 +3065,17 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry) - if (IS_DIRSYNC(dir)) - ext4_handle_sync(handle); - -- if (inode->i_nlink == 0) { -- ext4_warning_inode(inode, "Deleting file '%.*s' with no links", -- dentry->d_name.len, dentry->d_name.name); -- set_nlink(inode, 1); -- } - retval = ext4_delete_entry(handle, dir, de, bh); - if (retval) - goto end_unlink; - dir->i_ctime = dir->i_mtime = current_time(dir); - ext4_update_dx_flag(dir); - ext4_mark_inode_dirty(handle, dir); -- drop_nlink(inode); -+ if (inode->i_nlink == 0) -+ ext4_warning_inode(inode, "Deleting file '%.*s' with no links", -+ dentry->d_name.len, dentry->d_name.name); -+ else -+ drop_nlink(inode); - if (!inode->i_nlink) - ext4_orphan_add(handle, inode); - inode->i_ctime = current_time(inode); -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index d68b0132718a..a90173b856f6 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -2029,7 +2029,7 @@ do_more: - } - - ret = f2fs_gc(sbi, range.sync, true, GET_SEGNO(sbi, range.start)); -- range.start += sbi->blocks_per_seg; -+ range.start += BLKS_PER_SEC(sbi); - if (range.start <= end) - goto do_more; - out: -diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c -index 67120181dc2a..c2e4c6ce2cf7 100644 ---- a/fs/f2fs/gc.c -+++ b/fs/f2fs/gc.c -@@ -330,8 +330,7 @@ static int get_victim_by_default(struct f2fs_sb_info *sbi, - p.min_cost = get_max_cost(sbi, &p); - - if (*result != NULL_SEGNO) { -- if (IS_DATASEG(get_seg_entry(sbi, *result)->type) && -- get_valid_blocks(sbi, *result, false) && -+ if (get_valid_blocks(sbi, *result, false) && - !sec_usage_check(sbi, GET_SEC_FROM_SEG(sbi, *result))) - p.min_segno = *result; - goto out; -@@ -952,9 +951,9 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, - GET_SUM_BLOCK(sbi, segno)); - f2fs_put_page(sum_page, 0); - -- if (get_valid_blocks(sbi, segno, false) == 0 || -- !PageUptodate(sum_page) || -- unlikely(f2fs_cp_error(sbi))) -+ if (get_valid_blocks(sbi, segno, false) == 0) -+ goto freed; -+ if (!PageUptodate(sum_page) || unlikely(f2fs_cp_error(sbi))) - goto next; - - sum = page_address(sum_page); -@@ -981,6 +980,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, - - stat_inc_seg_count(sbi, type, gc_type); - -+freed: - if (gc_type == FG_GC && - get_valid_blocks(sbi, segno, false) == 0) - seg_freed++; -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index b79bba77652a..4d95a416fc36 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -234,7 +234,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags) - kfree(forget); - if (ret == -ENOMEM) - goto out; -- if (ret || (outarg.attr.mode ^ inode->i_mode) & S_IFMT) -+ if (ret || fuse_invalid_attr(&outarg.attr) || -+ (outarg.attr.mode ^ inode->i_mode) & S_IFMT) - goto invalid; - - forget_all_cached_acls(inode); -@@ -297,6 +298,12 @@ int fuse_valid_type(int m) - S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m); - } - -+bool fuse_invalid_attr(struct fuse_attr *attr) -+{ -+ return !fuse_valid_type(attr->mode) || -+ attr->size > LLONG_MAX; -+} -+ - int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name, - struct fuse_entry_out *outarg, struct inode **inode) - { -@@ -328,7 +335,7 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name - err = -EIO; - if (!outarg->nodeid) - goto out_put_forget; -- if (!fuse_valid_type(outarg->attr.mode)) -+ if (fuse_invalid_attr(&outarg->attr)) - goto out_put_forget; - - *inode = fuse_iget(sb, outarg->nodeid, outarg->generation, -@@ -451,7 +458,8 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, - goto out_free_ff; - - err = -EIO; -- if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid)) -+ if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid) || -+ fuse_invalid_attr(&outentry.attr)) - goto out_free_ff; - - ff->fh = outopen.fh; -@@ -557,7 +565,7 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args, - goto out_put_forget_req; - - err = -EIO; -- if (invalid_nodeid(outarg.nodeid)) -+ if (invalid_nodeid(outarg.nodeid) || fuse_invalid_attr(&outarg.attr)) - goto out_put_forget_req; - - if ((outarg.attr.mode ^ mode) & S_IFMT) -@@ -830,7 +838,8 @@ static int fuse_link(struct dentry *entry, struct inode *newdir, - - spin_lock(&fc->lock); - fi->attr_version = ++fc->attr_version; -- inc_nlink(inode); -+ if (likely(inode->i_nlink < UINT_MAX)) -+ inc_nlink(inode); - spin_unlock(&fc->lock); - fuse_invalidate_attr(inode); - fuse_update_ctime(inode); -@@ -910,7 +919,8 @@ static int fuse_do_getattr(struct inode *inode, struct kstat *stat, - args.out.args[0].value = &outarg; - err = fuse_simple_request(fc, &args); - if (!err) { -- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { -+ if (fuse_invalid_attr(&outarg.attr) || -+ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { - make_bad_inode(inode); - err = -EIO; - } else { -@@ -1214,7 +1224,7 @@ static int fuse_direntplus_link(struct file *file, - - if (invalid_nodeid(o->nodeid)) - return -EIO; -- if (!fuse_valid_type(o->attr.mode)) -+ if (fuse_invalid_attr(&o->attr)) - return -EIO; - - fc = get_fuse_conn(dir); -@@ -1691,7 +1701,8 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, - goto error; - } - -- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { -+ if (fuse_invalid_attr(&outarg.attr) || -+ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { - make_bad_inode(inode); - err = -EIO; - goto error; -diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h -index e682f2eff6c0..338aa5e266d6 100644 ---- a/fs/fuse/fuse_i.h -+++ b/fs/fuse/fuse_i.h -@@ -896,6 +896,8 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc); - */ - int fuse_valid_type(int m); - -+bool fuse_invalid_attr(struct fuse_attr *attr); -+ - /** - * Is current process allowed to perform filesystem operation? - */ -diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c -index 483b82e2be92..a3208511f35a 100644 ---- a/fs/gfs2/log.c -+++ b/fs/gfs2/log.c -@@ -594,6 +594,14 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd) - list_add(&bd->bd_list, &sdp->sd_log_le_revoke); - } - -+void gfs2_glock_remove_revoke(struct gfs2_glock *gl) -+{ -+ if (atomic_dec_return(&gl->gl_revokes) == 0) { -+ clear_bit(GLF_LFLUSH, &gl->gl_flags); -+ gfs2_glock_queue_put(gl); -+ } -+} -+ - void gfs2_write_revokes(struct gfs2_sbd *sdp) - { - struct gfs2_trans *tr; -diff --git a/fs/gfs2/log.h b/fs/gfs2/log.h -index 9499a6049212..3b7b7839ec6a 100644 ---- a/fs/gfs2/log.h -+++ b/fs/gfs2/log.h -@@ -80,6 +80,7 @@ extern void gfs2_ail1_flush(struct gfs2_sbd *sdp, struct writeback_control *wbc) - extern void gfs2_log_shutdown(struct gfs2_sbd *sdp); - extern int gfs2_logd(void *data); - extern void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd); -+extern void gfs2_glock_remove_revoke(struct gfs2_glock *gl); - extern void gfs2_write_revokes(struct gfs2_sbd *sdp); - - #endif /* __LOG_DOT_H__ */ -diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c -index 049f8c6721b4..a5041e6d2c0d 100644 ---- a/fs/gfs2/lops.c -+++ b/fs/gfs2/lops.c -@@ -660,10 +660,7 @@ static void revoke_lo_after_commit(struct gfs2_sbd *sdp, struct gfs2_trans *tr) - bd = list_entry(head->next, struct gfs2_bufdata, bd_list); - list_del_init(&bd->bd_list); - gl = bd->bd_gl; -- if (atomic_dec_return(&gl->gl_revokes) == 0) { -- clear_bit(GLF_LFLUSH, &gl->gl_flags); -- gfs2_glock_queue_put(gl); -- } -+ gfs2_glock_remove_revoke(gl); - kmem_cache_free(gfs2_bufdata_cachep, bd); - } - } -diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c -index affef3c066e0..69e3402a3cc5 100644 ---- a/fs/gfs2/trans.c -+++ b/fs/gfs2/trans.c -@@ -277,6 +277,8 @@ void gfs2_trans_add_unrevoke(struct gfs2_sbd *sdp, u64 blkno, unsigned int len) - list_del_init(&bd->bd_list); - gfs2_assert_withdraw(sdp, sdp->sd_log_num_revoke); - sdp->sd_log_num_revoke--; -+ if (bd->bd_gl) -+ gfs2_glock_remove_revoke(bd->bd_gl); - kmem_cache_free(gfs2_bufdata_cachep, bd); - tr->tr_num_revoke_rm++; - if (--n == 0) -diff --git a/fs/iomap.c b/fs/iomap.c -index 467d98bf7054..3f5b1655cfce 100644 ---- a/fs/iomap.c -+++ b/fs/iomap.c -@@ -941,7 +941,14 @@ iomap_dio_actor(struct inode *inode, loff_t pos, loff_t length, - dio->submit.cookie = submit_bio(bio); - } while (nr_pages); - -- if (need_zeroout) { -+ /* -+ * We need to zeroout the tail of a sub-block write if the extent type -+ * requires zeroing or the write extends beyond EOF. If we don't zero -+ * the block tail in the latter case, we can expose stale data via mmap -+ * reads of the EOF block. -+ */ -+ if (need_zeroout || -+ ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) { - /* zero out from the end of the write to the end of the block */ - pad = pos & (fs_block_size - 1); - if (pad) -@@ -1046,8 +1053,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, - } - pos += ret; - -- if (iov_iter_rw(iter) == READ && pos >= dio->i_size) -+ if (iov_iter_rw(iter) == READ && pos >= dio->i_size) { -+ /* -+ * We only report that we've read data up to i_size. -+ * Revert iter to a state corresponding to that as -+ * some callers (such as splice code) rely on it. -+ */ -+ iov_iter_revert(iter, pos - dio->i_size); - break; -+ } - } while ((count = iov_iter_count(iter)) > 0); - blk_finish_plug(&plug); - -diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c -index 9e9117533fd7..8697b750b1c9 100644 ---- a/fs/kernfs/dir.c -+++ b/fs/kernfs/dir.c -@@ -623,7 +623,6 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, - { - struct kernfs_node *kn; - u32 gen; -- int cursor; - int ret; - - name = kstrdup_const(name, GFP_KERNEL); -@@ -636,11 +635,11 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, - - idr_preload(GFP_KERNEL); - spin_lock(&kernfs_idr_lock); -- cursor = idr_get_cursor(&root->ino_idr); - ret = idr_alloc_cyclic(&root->ino_idr, kn, 1, 0, GFP_ATOMIC); -- if (ret >= 0 && ret < cursor) -+ if (ret >= 0 && ret < root->last_ino) - root->next_generation++; - gen = root->next_generation; -+ root->last_ino = ret; - spin_unlock(&kernfs_idr_lock); - idr_preload_end(); - if (ret < 0) -diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c -index 00d5ef5f99f7..214a2fa1f1e3 100644 ---- a/fs/lockd/clnt4xdr.c -+++ b/fs/lockd/clnt4xdr.c -@@ -128,24 +128,14 @@ static void encode_netobj(struct xdr_stream *xdr, - static int decode_netobj(struct xdr_stream *xdr, - struct xdr_netobj *obj) - { -- u32 length; -- __be32 *p; -+ ssize_t ret; - -- p = xdr_inline_decode(xdr, 4); -- if (unlikely(p == NULL)) -- goto out_overflow; -- length = be32_to_cpup(p++); -- if (unlikely(length > XDR_MAX_NETOBJ)) -- goto out_size; -- obj->len = length; -- obj->data = (u8 *)p; -+ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data, -+ XDR_MAX_NETOBJ); -+ if (unlikely(ret < 0)) -+ return -EIO; -+ obj->len = ret; - return 0; --out_size: -- dprintk("NFS: returned netobj was too long: %u\n", length); -- return -EIO; --out_overflow: -- print_overflow_msg(__func__, xdr); -- return -EIO; - } - - /* -diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c -index 2c6176387143..747b9c8c940a 100644 ---- a/fs/lockd/clntxdr.c -+++ b/fs/lockd/clntxdr.c -@@ -125,24 +125,14 @@ static void encode_netobj(struct xdr_stream *xdr, - static int decode_netobj(struct xdr_stream *xdr, - struct xdr_netobj *obj) - { -- u32 length; -- __be32 *p; -+ ssize_t ret; - -- p = xdr_inline_decode(xdr, 4); -- if (unlikely(p == NULL)) -- goto out_overflow; -- length = be32_to_cpup(p++); -- if (unlikely(length > XDR_MAX_NETOBJ)) -- goto out_size; -- obj->len = length; -- obj->data = (u8 *)p; -+ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data, -+ XDR_MAX_NETOBJ); -+ if (unlikely(ret < 0)) -+ return -EIO; -+ obj->len = ret; - return 0; --out_size: -- dprintk("NFS: returned netobj was too long: %u\n", length); -- return -EIO; --out_overflow: -- print_overflow_msg(__func__, xdr); -- return -EIO; - } - - /* -diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c -index 66eaeb1e8c2c..dc9586feab31 100644 ---- a/fs/nfsd/nfs4recover.c -+++ b/fs/nfsd/nfs4recover.c -@@ -661,7 +661,7 @@ struct cld_net { - struct cld_upcall { - struct list_head cu_list; - struct cld_net *cu_net; -- struct task_struct *cu_task; -+ struct completion cu_done; - struct cld_msg cu_msg; - }; - -@@ -670,23 +670,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg) - { - int ret; - struct rpc_pipe_msg msg; -+ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg); - - memset(&msg, 0, sizeof(msg)); - msg.data = cmsg; - msg.len = sizeof(*cmsg); - -- /* -- * Set task state before we queue the upcall. That prevents -- * wake_up_process in the downcall from racing with schedule. -- */ -- set_current_state(TASK_UNINTERRUPTIBLE); - ret = rpc_queue_upcall(pipe, &msg); - if (ret < 0) { -- set_current_state(TASK_RUNNING); - goto out; - } - -- schedule(); -+ wait_for_completion(&cup->cu_done); - - if (msg.errno < 0) - ret = msg.errno; -@@ -753,7 +748,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) - if (copy_from_user(&cup->cu_msg, src, mlen) != 0) - return -EFAULT; - -- wake_up_process(cup->cu_task); -+ complete(&cup->cu_done); - return mlen; - } - -@@ -768,7 +763,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg) - if (msg->errno >= 0) - return; - -- wake_up_process(cup->cu_task); -+ complete(&cup->cu_done); - } - - static const struct rpc_pipe_ops cld_upcall_ops = { -@@ -899,7 +894,7 @@ restart_search: - goto restart_search; - } - } -- new->cu_task = current; -+ init_completion(&new->cu_done); - new->cu_msg.cm_vers = CLD_UPCALL_VERSION; - put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid); - new->cu_net = cn; -diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c -index f55527ef21e8..06d1f2edf2ec 100644 ---- a/fs/nfsd/vfs.c -+++ b/fs/nfsd/vfs.c -@@ -396,10 +396,23 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, - bool get_write_count; - bool size_change = (iap->ia_valid & ATTR_SIZE); - -- if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) -+ if (iap->ia_valid & ATTR_SIZE) { - accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE; -- if (iap->ia_valid & ATTR_SIZE) - ftype = S_IFREG; -+ } -+ -+ /* -+ * If utimes(2) and friends are called with times not NULL, we should -+ * not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission -+ * will return EACCESS, when the caller's effective UID does not match -+ * the owner of the file, and the caller is not privileged. In this -+ * situation, we should return EPERM(notify_change will return this). -+ */ -+ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) { -+ accmode |= NFSD_MAY_OWNER_OVERRIDE; -+ if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET))) -+ accmode |= NFSD_MAY_WRITE; -+ } - - /* Callers that do fh_verify should do the fh_want_write: */ - get_write_count = !fhp->fh_dentry; -diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c -index b39d14cbfa34..d212d09c00b1 100644 ---- a/fs/ocfs2/quota_global.c -+++ b/fs/ocfs2/quota_global.c -@@ -727,7 +727,7 @@ static int ocfs2_release_dquot(struct dquot *dquot) - - mutex_lock(&dquot->dq_lock); - /* Check whether we are not racing with some other dqget() */ -- if (atomic_read(&dquot->dq_count) > 1) -+ if (dquot_is_busy(dquot)) - goto out; - /* Running from downconvert thread? Postpone quota processing to wq */ - if (current == osb->dc_task) { -diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c -index ef11fa7b869e..8c561703275a 100644 ---- a/fs/overlayfs/dir.c -+++ b/fs/overlayfs/dir.c -@@ -1042,7 +1042,7 @@ static int ovl_rename(struct inode *olddir, struct dentry *old, - if (newdentry == trap) - goto out_dput; - -- if (WARN_ON(olddentry->d_inode == newdentry->d_inode)) -+ if (olddentry->d_inode == newdentry->d_inode) - goto out_dput; - - err = 0; -diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c -index 40bfc6c58374..1e675be10926 100644 ---- a/fs/pstore/ram.c -+++ b/fs/pstore/ram.c -@@ -297,6 +297,7 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record) - GFP_KERNEL); - if (!tmp_prz) - return -ENOMEM; -+ prz = tmp_prz; - free_prz = true; - - while (cxt->ftrace_read_cnt < cxt->max_ftrace_cnt) { -@@ -319,7 +320,6 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record) - goto out; - } - record->id = 0; -- prz = tmp_prz; - } - } - -diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c -index 9c81fd973418..3254c90fd899 100644 ---- a/fs/quota/dquot.c -+++ b/fs/quota/dquot.c -@@ -491,7 +491,7 @@ int dquot_release(struct dquot *dquot) - - mutex_lock(&dquot->dq_lock); - /* Check whether we are not racing with some other dqget() */ -- if (atomic_read(&dquot->dq_count) > 1) -+ if (dquot_is_busy(dquot)) - goto out_dqlock; - if (dqopt->ops[dquot->dq_id.type]->release_dqblk) { - ret = dqopt->ops[dquot->dq_id.type]->release_dqblk(dquot); -@@ -617,7 +617,7 @@ EXPORT_SYMBOL(dquot_scan_active); - /* Write all dquot structures to quota files */ - int dquot_writeback_dquots(struct super_block *sb, int type) - { -- struct list_head *dirty; -+ struct list_head dirty; - struct dquot *dquot; - struct quota_info *dqopt = sb_dqopt(sb); - int cnt; -@@ -631,9 +631,10 @@ int dquot_writeback_dquots(struct super_block *sb, int type) - if (!sb_has_quota_active(sb, cnt)) - continue; - spin_lock(&dq_list_lock); -- dirty = &dqopt->info[cnt].dqi_dirty_list; -- while (!list_empty(dirty)) { -- dquot = list_first_entry(dirty, struct dquot, -+ /* Move list away to avoid livelock. */ -+ list_replace_init(&dqopt->info[cnt].dqi_dirty_list, &dirty); -+ while (!list_empty(&dirty)) { -+ dquot = list_first_entry(&dirty, struct dquot, - dq_dirty); - - WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)); -diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c -index 11a48affa882..683496322aa8 100644 ---- a/fs/reiserfs/inode.c -+++ b/fs/reiserfs/inode.c -@@ -2096,6 +2096,15 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th, - goto out_inserted_sd; - } - -+ /* -+ * Mark it private if we're creating the privroot -+ * or something under it. -+ */ -+ if (IS_PRIVATE(dir) || dentry == REISERFS_SB(sb)->priv_root) { -+ inode->i_flags |= S_PRIVATE; -+ inode->i_opflags &= ~IOP_XATTR; -+ } -+ - if (reiserfs_posixacl(inode->i_sb)) { - reiserfs_write_unlock(inode->i_sb); - retval = reiserfs_inherit_default_acl(th, dir, dentry, inode); -@@ -2110,8 +2119,7 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th, - reiserfs_warning(inode->i_sb, "jdm-13090", - "ACLs aren't enabled in the fs, " - "but vfs thinks they are!"); -- } else if (IS_PRIVATE(dir)) -- inode->i_flags |= S_PRIVATE; -+ } - - if (security->name) { - reiserfs_write_unlock(inode->i_sb); -diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c -index 5089dac02660..14ba7a12b89d 100644 ---- a/fs/reiserfs/namei.c -+++ b/fs/reiserfs/namei.c -@@ -377,10 +377,13 @@ static struct dentry *reiserfs_lookup(struct inode *dir, struct dentry *dentry, - - /* - * Propagate the private flag so we know we're -- * in the priv tree -+ * in the priv tree. Also clear IOP_XATTR -+ * since we don't have xattrs on xattr files. - */ -- if (IS_PRIVATE(dir)) -+ if (IS_PRIVATE(dir)) { - inode->i_flags |= S_PRIVATE; -+ inode->i_opflags &= ~IOP_XATTR; -+ } - } - reiserfs_write_unlock(dir->i_sb); - if (retval == IO_ERROR) { -diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h -index eabf85371ece..0efe7c7c4124 100644 ---- a/fs/reiserfs/reiserfs.h -+++ b/fs/reiserfs/reiserfs.h -@@ -1168,6 +1168,8 @@ static inline int bmap_would_wrap(unsigned bmap_nr) - return bmap_nr > ((1LL << 16) - 1); - } - -+extern const struct xattr_handler *reiserfs_xattr_handlers[]; -+ - /* - * this says about version of key of all items (but stat data) the - * object consists of -diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c -index 4885c7b6e44f..cc0b22c72e83 100644 ---- a/fs/reiserfs/super.c -+++ b/fs/reiserfs/super.c -@@ -2052,6 +2052,8 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent) - if (replay_only(s)) - goto error_unlocked; - -+ s->s_xattr = reiserfs_xattr_handlers; -+ - if (bdev_read_only(s->s_bdev) && !sb_rdonly(s)) { - SWARN(silent, s, "clm-7000", - "Detected readonly device, marking FS readonly"); -diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c -index 83423192588c..29a0c0969e91 100644 ---- a/fs/reiserfs/xattr.c -+++ b/fs/reiserfs/xattr.c -@@ -122,13 +122,13 @@ static struct dentry *open_xa_root(struct super_block *sb, int flags) - struct dentry *xaroot; - - if (d_really_is_negative(privroot)) -- return ERR_PTR(-ENODATA); -+ return ERR_PTR(-EOPNOTSUPP); - - inode_lock_nested(d_inode(privroot), I_MUTEX_XATTR); - - xaroot = dget(REISERFS_SB(sb)->xattr_root); - if (!xaroot) -- xaroot = ERR_PTR(-ENODATA); -+ xaroot = ERR_PTR(-EOPNOTSUPP); - else if (d_really_is_negative(xaroot)) { - int err = -ENODATA; - -@@ -610,6 +610,10 @@ int reiserfs_xattr_set(struct inode *inode, const char *name, - int error, error2; - size_t jbegin_count = reiserfs_xattr_nblocks(inode, buffer_size); - -+ /* Check before we start a transaction and then do nothing. */ -+ if (!d_really_is_positive(REISERFS_SB(inode->i_sb)->priv_root)) -+ return -EOPNOTSUPP; -+ - if (!(flags & XATTR_REPLACE)) - jbegin_count += reiserfs_xattr_jcreate_nblocks(inode); - -@@ -832,8 +836,7 @@ ssize_t reiserfs_listxattr(struct dentry * dentry, char *buffer, size_t size) - if (d_really_is_negative(dentry)) - return -EINVAL; - -- if (!dentry->d_sb->s_xattr || -- get_inode_sd_version(d_inode(dentry)) == STAT_DATA_V1) -+ if (get_inode_sd_version(d_inode(dentry)) == STAT_DATA_V1) - return -EOPNOTSUPP; - - dir = open_xa_dir(d_inode(dentry), XATTR_REPLACE); -@@ -873,6 +876,7 @@ static int create_privroot(struct dentry *dentry) - } - - d_inode(dentry)->i_flags |= S_PRIVATE; -+ d_inode(dentry)->i_opflags &= ~IOP_XATTR; - reiserfs_info(dentry->d_sb, "Created %s - reserved for xattr " - "storage.\n", PRIVROOT_NAME); - -@@ -886,7 +890,7 @@ static int create_privroot(struct dentry *dentry) { return 0; } - #endif - - /* Actual operations that are exported to VFS-land */ --static const struct xattr_handler *reiserfs_xattr_handlers[] = { -+const struct xattr_handler *reiserfs_xattr_handlers[] = { - #ifdef CONFIG_REISERFS_FS_XATTR - &reiserfs_xattr_user_handler, - &reiserfs_xattr_trusted_handler, -@@ -957,8 +961,10 @@ int reiserfs_lookup_privroot(struct super_block *s) - if (!IS_ERR(dentry)) { - REISERFS_SB(s)->priv_root = dentry; - d_set_d_op(dentry, &xattr_lookup_poison_ops); -- if (d_really_is_positive(dentry)) -+ if (d_really_is_positive(dentry)) { - d_inode(dentry)->i_flags |= S_PRIVATE; -+ d_inode(dentry)->i_opflags &= ~IOP_XATTR; -+ } - } else - err = PTR_ERR(dentry); - inode_unlock(d_inode(s->s_root)); -@@ -987,7 +993,6 @@ int reiserfs_xattr_init(struct super_block *s, int mount_flags) - } - - if (d_really_is_positive(privroot)) { -- s->s_xattr = reiserfs_xattr_handlers; - inode_lock(d_inode(privroot)); - if (!REISERFS_SB(s)->xattr_root) { - struct dentry *dentry; -diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c -index aa9380bac196..05f666794561 100644 ---- a/fs/reiserfs/xattr_acl.c -+++ b/fs/reiserfs/xattr_acl.c -@@ -320,10 +320,8 @@ reiserfs_inherit_default_acl(struct reiserfs_transaction_handle *th, - * would be useless since permissions are ignored, and a pain because - * it introduces locking cycles - */ -- if (IS_PRIVATE(dir)) { -- inode->i_flags |= S_PRIVATE; -+ if (IS_PRIVATE(inode)) - goto apply_umask; -- } - - err = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl); - if (err) -diff --git a/include/dt-bindings/clock/rk3328-cru.h b/include/dt-bindings/clock/rk3328-cru.h -index d2b26a4b43eb..4a9db1b2669b 100644 ---- a/include/dt-bindings/clock/rk3328-cru.h -+++ b/include/dt-bindings/clock/rk3328-cru.h -@@ -178,7 +178,7 @@ - #define HCLK_TSP 309 - #define HCLK_GMAC 310 - #define HCLK_I2S0_8CH 311 --#define HCLK_I2S1_8CH 313 -+#define HCLK_I2S1_8CH 312 - #define HCLK_I2S2_2CH 313 - #define HCLK_SPDIF_8CH 314 - #define HCLK_VOP 315 -diff --git a/include/linux/acpi.h b/include/linux/acpi.h -index d7a9700b9333..4bb3bca75004 100644 ---- a/include/linux/acpi.h -+++ b/include/linux/acpi.h -@@ -99,7 +99,7 @@ static inline bool has_acpi_companion(struct device *dev) - static inline void acpi_preset_companion(struct device *dev, - struct acpi_device *parent, u64 addr) - { -- ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, NULL)); -+ ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, false)); - } - - static inline const char *acpi_dev_name(struct acpi_device *adev) -diff --git a/include/linux/atalk.h b/include/linux/atalk.h -index 03885e63f92b..2664b9e89f9b 100644 ---- a/include/linux/atalk.h -+++ b/include/linux/atalk.h -@@ -108,7 +108,7 @@ static __inline__ struct elapaarp *aarp_hdr(struct sk_buff *skb) - #define AARP_RESOLVE_TIME (10 * HZ) - - extern struct datalink_proto *ddp_dl, *aarp_dl; --extern void aarp_proto_init(void); -+extern int aarp_proto_init(void); - - /* Inter module exports */ - -diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h -index 7bf3b99e6fbb..9aee5f345e29 100644 ---- a/include/linux/dma-mapping.h -+++ b/include/linux/dma-mapping.h -@@ -650,8 +650,7 @@ static inline unsigned int dma_get_max_seg_size(struct device *dev) - return SZ_64K; - } - --static inline unsigned int dma_set_max_seg_size(struct device *dev, -- unsigned int size) -+static inline int dma_set_max_seg_size(struct device *dev, unsigned int size) - { - if (dev->dma_parms) { - dev->dma_parms->max_segment_size = size; -diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h -index 11b3ab68f6a7..cb41329a3ee4 100644 ---- a/include/linux/jbd2.h -+++ b/include/linux/jbd2.h -@@ -1584,7 +1584,7 @@ static inline int jbd2_space_needed(journal_t *journal) - static inline unsigned long jbd2_log_space_left(journal_t *journal) - { - /* Allow for rounding errors */ -- unsigned long free = journal->j_free - 32; -+ long free = journal->j_free - 32; - - if (journal->j_committing_transaction) { - unsigned long committing = atomic_read(&journal-> -@@ -1593,7 +1593,7 @@ static inline unsigned long jbd2_log_space_left(journal_t *journal) - /* Transaction + control blocks */ - free -= committing + (committing >> JBD2_CONTROL_BLOCKS_SHIFT); - } -- return free; -+ return max_t(long, free, 0); - } - - /* -diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h -index ab25c8b6d9e3..5e539e5bb70c 100644 ---- a/include/linux/kernfs.h -+++ b/include/linux/kernfs.h -@@ -185,6 +185,7 @@ struct kernfs_root { - - /* private fields, do not use outside kernfs proper */ - struct idr ino_idr; -+ u32 last_ino; - u32 next_generation; - struct kernfs_syscall_ops *syscall_ops; - -diff --git a/include/linux/mfd/rk808.h b/include/linux/mfd/rk808.h -index d3156594674c..338e0f6e2226 100644 ---- a/include/linux/mfd/rk808.h -+++ b/include/linux/mfd/rk808.h -@@ -443,7 +443,7 @@ enum { - enum { - RK805_ID = 0x8050, - RK808_ID = 0x0000, -- RK818_ID = 0x8181, -+ RK818_ID = 0x8180, - }; - - struct rk808 { -diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h -index 6cd0f6b7658b..aadc2ee050f1 100644 ---- a/include/linux/mtd/mtd.h -+++ b/include/linux/mtd/mtd.h -@@ -401,7 +401,7 @@ static inline struct device_node *mtd_get_of_node(struct mtd_info *mtd) - return dev_of_node(&mtd->dev); - } - --static inline int mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops) -+static inline u32 mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops) - { - return ops->mode == MTD_OPS_AUTO_OOB ? mtd->oobavail : mtd->oobsize; - } -diff --git a/include/linux/platform_data/dma-dw.h b/include/linux/platform_data/dma-dw.h -index 896cb71a382c..1a1d58ebffbf 100644 ---- a/include/linux/platform_data/dma-dw.h -+++ b/include/linux/platform_data/dma-dw.h -@@ -49,6 +49,7 @@ struct dw_dma_slave { - * @data_width: Maximum data width supported by hardware per AHB master - * (in bytes, power of 2) - * @multi_block: Multi block transfers supported by hardware per channel. -+ * @protctl: Protection control signals setting per channel. - */ - struct dw_dma_platform_data { - unsigned int nr_channels; -@@ -65,6 +66,11 @@ struct dw_dma_platform_data { - unsigned char nr_masters; - unsigned char data_width[DW_DMA_MAX_NR_MASTERS]; - unsigned char multi_block[DW_DMA_MAX_NR_CHANNELS]; -+#define CHAN_PROTCTL_PRIVILEGED BIT(0) -+#define CHAN_PROTCTL_BUFFERABLE BIT(1) -+#define CHAN_PROTCTL_CACHEABLE BIT(2) -+#define CHAN_PROTCTL_MASK GENMASK(2, 0) -+ unsigned char protctl; - }; - - #endif /* _PLATFORM_DATA_DMA_DW_H */ -diff --git a/include/linux/qcom_scm.h b/include/linux/qcom_scm.h -index e5380471c2cd..428278a44c7d 100644 ---- a/include/linux/qcom_scm.h -+++ b/include/linux/qcom_scm.h -@@ -44,6 +44,9 @@ extern int qcom_scm_restore_sec_cfg(u32 device_id, u32 spare); - extern int qcom_scm_iommu_secure_ptbl_size(u32 spare, size_t *size); - extern int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare); - #else -+ -+#include -+ - static inline - int qcom_scm_set_cold_boot_addr(void *entry, const cpumask_t *cpus) - { -diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h -index a109e6107c06..50ab5d6ccc4e 100644 ---- a/include/linux/quotaops.h -+++ b/include/linux/quotaops.h -@@ -51,6 +51,16 @@ static inline struct dquot *dqgrab(struct dquot *dquot) - atomic_inc(&dquot->dq_count); - return dquot; - } -+ -+static inline bool dquot_is_busy(struct dquot *dquot) -+{ -+ if (test_bit(DQ_MOD_B, &dquot->dq_flags)) -+ return true; -+ if (atomic_read(&dquot->dq_count) > 1) -+ return true; -+ return false; -+} -+ - void dqput(struct dquot *dquot); - int dquot_scan_active(struct super_block *sb, - int (*fn)(struct dquot *dquot, unsigned long priv), -diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h -index 25602afd4844..f3f76051e8b0 100644 ---- a/include/linux/regulator/consumer.h -+++ b/include/linux/regulator/consumer.h -@@ -508,7 +508,7 @@ static inline int regulator_get_error_flags(struct regulator *regulator, - - static inline int regulator_set_load(struct regulator *regulator, int load_uA) - { -- return REGULATOR_MODE_NORMAL; -+ return 0; - } - - static inline int regulator_allow_bypass(struct regulator *regulator, -diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h -index 868b60a79c0b..b2a7b7c15451 100644 ---- a/include/linux/serial_core.h -+++ b/include/linux/serial_core.h -@@ -166,6 +166,7 @@ struct uart_port { - struct console *cons; /* struct console, if any */ - #if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ) - unsigned long sysrq; /* sysrq timeout */ -+ unsigned int sysrq_ch; /* char for sysrq */ - #endif - - /* flags must be updated while holding port mutex */ -@@ -474,8 +475,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) - } - return 0; - } -+static inline int -+uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) -+{ -+ if (port->sysrq) { -+ if (ch && time_before(jiffies, port->sysrq)) { -+ port->sysrq_ch = ch; -+ port->sysrq = 0; -+ return 1; -+ } -+ port->sysrq = 0; -+ } -+ return 0; -+} -+static inline void -+uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) -+{ -+ int sysrq_ch; -+ -+ sysrq_ch = port->sysrq_ch; -+ port->sysrq_ch = 0; -+ -+ spin_unlock_irqrestore(&port->lock, irqflags); -+ -+ if (sysrq_ch) -+ handle_sysrq(sysrq_ch); -+} - #else --#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; }) -+static inline int -+uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } -+static inline int -+uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } -+static inline void -+uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) -+{ -+ spin_unlock_irqrestore(&port->lock, irqflags); -+} - #endif - - /* -diff --git a/include/linux/tty.h b/include/linux/tty.h -index 1dd587ba6d88..0cd621d8c7f0 100644 ---- a/include/linux/tty.h -+++ b/include/linux/tty.h -@@ -365,6 +365,7 @@ struct tty_file_private { - #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */ - #define TTY_HUPPED 18 /* Post driver->hangup() */ - #define TTY_HUPPING 19 /* Hangup in progress */ -+#define TTY_LDISC_CHANGING 20 /* Change pending - non-block IO */ - #define TTY_LDISC_HALTED 22 /* Line discipline is halted */ - - /* Values for tty->flow_change */ -@@ -382,6 +383,12 @@ static inline void tty_set_flow_change(struct tty_struct *tty, int val) - smp_mb(); - } - -+static inline bool tty_io_nonblock(struct tty_struct *tty, struct file *file) -+{ -+ return file->f_flags & O_NONBLOCK || -+ test_bit(TTY_LDISC_CHANGING, &tty->flags); -+} -+ - static inline bool tty_io_error(struct tty_struct *tty) - { - return test_bit(TTY_IO_ERROR, &tty->flags); -diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h -index 3f284bc03180..5650c1628383 100644 ---- a/include/math-emu/soft-fp.h -+++ b/include/math-emu/soft-fp.h -@@ -138,7 +138,7 @@ do { \ - _FP_FRAC_ADDI_##wc(X, _FP_WORK_ROUND); \ - } while (0) - --#define _FP_ROUND_ZERO(wc, X) 0 -+#define _FP_ROUND_ZERO(wc, X) (void)0 - - #define _FP_ROUND_PINF(wc, X) \ - do { \ -diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h -index c3114c989e91..f50dd34e4f7b 100644 ---- a/include/uapi/linux/cec.h -+++ b/include/uapi/linux/cec.h -@@ -789,8 +789,8 @@ struct cec_event { - #define CEC_MSG_SELECT_DIGITAL_SERVICE 0x93 - #define CEC_MSG_TUNER_DEVICE_STATUS 0x07 - /* Recording Flag Operand (rec_flag) */ --#define CEC_OP_REC_FLAG_USED 0 --#define CEC_OP_REC_FLAG_NOT_USED 1 -+#define CEC_OP_REC_FLAG_NOT_USED 0 -+#define CEC_OP_REC_FLAG_USED 1 - /* Tuner Display Info Operand (tuner_display_info) */ - #define CEC_OP_TUNER_DISPLAY_INFO_DIGITAL 0 - #define CEC_OP_TUNER_DISPLAY_INFO_NONE 1 -diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c -index 4a98f6e314a9..35f1d706bd5b 100644 ---- a/kernel/audit_watch.c -+++ b/kernel/audit_watch.c -@@ -365,12 +365,12 @@ static int audit_get_nd(struct audit_watch *watch, struct path *parent) - struct dentry *d = kern_path_locked(watch->path, parent); - if (IS_ERR(d)) - return PTR_ERR(d); -- inode_unlock(d_backing_inode(parent->dentry)); - if (d_is_positive(d)) { - /* update watch filter fields */ - watch->dev = d->d_sb->s_dev; - watch->ino = d_backing_inode(d)->i_ino; - } -+ inode_unlock(d_backing_inode(parent->dentry)); - dput(d); - return 0; - } -diff --git a/kernel/cgroup/pids.c b/kernel/cgroup/pids.c -index c9960baaa14f..940d2e8db776 100644 ---- a/kernel/cgroup/pids.c -+++ b/kernel/cgroup/pids.c -@@ -48,7 +48,7 @@ struct pids_cgroup { - * %PIDS_MAX = (%PID_MAX_LIMIT + 1). - */ - atomic64_t counter; -- int64_t limit; -+ atomic64_t limit; - - /* Handle for "pids.events" */ - struct cgroup_file events_file; -@@ -76,8 +76,8 @@ pids_css_alloc(struct cgroup_subsys_state *parent) - if (!pids) - return ERR_PTR(-ENOMEM); - -- pids->limit = PIDS_MAX; - atomic64_set(&pids->counter, 0); -+ atomic64_set(&pids->limit, PIDS_MAX); - atomic64_set(&pids->events_limit, 0); - return &pids->css; - } -@@ -149,13 +149,14 @@ static int pids_try_charge(struct pids_cgroup *pids, int num) - - for (p = pids; parent_pids(p); p = parent_pids(p)) { - int64_t new = atomic64_add_return(num, &p->counter); -+ int64_t limit = atomic64_read(&p->limit); - - /* - * Since new is capped to the maximum number of pid_t, if - * p->limit is %PIDS_MAX then we know that this test will never - * fail. - */ -- if (new > p->limit) -+ if (new > limit) - goto revert; - } - -@@ -280,7 +281,7 @@ set_limit: - * Limit updates don't need to be mutex'd, since it isn't - * critical that any racing fork()s follow the new limit. - */ -- pids->limit = limit; -+ atomic64_set(&pids->limit, limit); - return nbytes; - } - -@@ -288,7 +289,7 @@ static int pids_max_show(struct seq_file *sf, void *v) - { - struct cgroup_subsys_state *css = seq_css(sf); - struct pids_cgroup *pids = css_pids(css); -- int64_t limit = pids->limit; -+ int64_t limit = atomic64_read(&pids->limit); - - if (limit >= PIDS_MAX) - seq_printf(sf, "%s\n", PIDS_MAX_STR); -diff --git a/kernel/module.c b/kernel/module.c -index 468567591241..feb1e0fbc3e8 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -1020,6 +1020,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, - strlcpy(last_unloaded_module, mod->name, sizeof(last_unloaded_module)); - - free_module(mod); -+ /* someone could wait for the module in add_unformed_module() */ -+ wake_up_all(&module_wq); - return 0; - out: - mutex_unlock(&module_mutex); -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index bbf8b32fc69e..97a27726ea21 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -5242,10 +5242,11 @@ void init_idle(struct task_struct *idle, int cpu) - struct rq *rq = cpu_rq(cpu); - unsigned long flags; - -+ __sched_fork(0, idle); -+ - raw_spin_lock_irqsave(&idle->pi_lock, flags); - raw_spin_lock(&rq->lock); - -- __sched_fork(0, idle); - idle->state = TASK_RUNNING; - idle->se.exec_start = sched_clock(); - idle->flags |= PF_IDLE; -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 67433fbdcb5a..0b4e997fea1a 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -4655,20 +4655,28 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer) - if (++count > 3) { - u64 new, old = ktime_to_ns(cfs_b->period); - -- new = (old * 147) / 128; /* ~115% */ -- new = min(new, max_cfs_quota_period); -- -- cfs_b->period = ns_to_ktime(new); -- -- /* since max is 1s, this is limited to 1e9^2, which fits in u64 */ -- cfs_b->quota *= new; -- cfs_b->quota = div64_u64(cfs_b->quota, old); -- -- pr_warn_ratelimited( -- "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n", -- smp_processor_id(), -- div_u64(new, NSEC_PER_USEC), -- div_u64(cfs_b->quota, NSEC_PER_USEC)); -+ /* -+ * Grow period by a factor of 2 to avoid losing precision. -+ * Precision loss in the quota/period ratio can cause __cfs_schedulable -+ * to fail. -+ */ -+ new = old * 2; -+ if (new < max_cfs_quota_period) { -+ cfs_b->period = ns_to_ktime(new); -+ cfs_b->quota *= 2; -+ -+ pr_warn_ratelimited( -+ "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us = %lld, cfs_quota_us = %lld)\n", -+ smp_processor_id(), -+ div_u64(new, NSEC_PER_USEC), -+ div_u64(cfs_b->quota, NSEC_PER_USEC)); -+ } else { -+ pr_warn_ratelimited( -+ "cfs_period_timer[cpu%d]: period too short, but cannot scale up without losing precision (cfs_period_us = %lld, cfs_quota_us = %lld)\n", -+ smp_processor_id(), -+ div_u64(old, NSEC_PER_USEC), -+ div_u64(cfs_b->quota, NSEC_PER_USEC)); -+ } - - /* reset count so we don't come right back in here */ - count = 0; -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 08bc551976b2..a37f5dc7cb39 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -2366,8 +2366,14 @@ repeat: - */ - if (need_to_create_worker(pool)) { - spin_lock(&wq_mayday_lock); -- get_pwq(pwq); -- list_move_tail(&pwq->mayday_node, &wq->maydays); -+ /* -+ * Queue iff we aren't racing destruction -+ * and somebody else hasn't queued it already. -+ */ -+ if (wq->rescuer && list_empty(&pwq->mayday_node)) { -+ get_pwq(pwq); -+ list_add_tail(&pwq->mayday_node, &wq->maydays); -+ } - spin_unlock(&wq_mayday_lock); - } - } -@@ -4084,9 +4090,29 @@ void destroy_workqueue(struct workqueue_struct *wq) - struct pool_workqueue *pwq; - int node; - -+ /* -+ * Remove it from sysfs first so that sanity check failure doesn't -+ * lead to sysfs name conflicts. -+ */ -+ workqueue_sysfs_unregister(wq); -+ - /* drain it before proceeding with destruction */ - drain_workqueue(wq); - -+ /* kill rescuer, if sanity checks fail, leave it w/o rescuer */ -+ if (wq->rescuer) { -+ struct worker *rescuer = wq->rescuer; -+ -+ /* this prevents new queueing */ -+ spin_lock_irq(&wq_mayday_lock); -+ wq->rescuer = NULL; -+ spin_unlock_irq(&wq_mayday_lock); -+ -+ /* rescuer will empty maydays list before exiting */ -+ kthread_stop(rescuer->task); -+ kfree(rescuer); -+ } -+ - /* sanity checks */ - mutex_lock(&wq->mutex); - for_each_pwq(pwq, wq) { -@@ -4118,11 +4144,6 @@ void destroy_workqueue(struct workqueue_struct *wq) - list_del_rcu(&wq->list); - mutex_unlock(&wq_pool_mutex); - -- workqueue_sysfs_unregister(wq); -- -- if (wq->rescuer) -- kthread_stop(wq->rescuer->task); -- - if (!(wq->flags & WQ_UNBOUND)) { - /* - * The base ref is never dropped on per-cpu pwqs. Directly -@@ -4399,7 +4420,8 @@ static void show_pwq(struct pool_workqueue *pwq) - pr_info(" pwq %d:", pool->id); - pr_cont_pool_info(pool); - -- pr_cont(" active=%d/%d%s\n", pwq->nr_active, pwq->max_active, -+ pr_cont(" active=%d/%d refcnt=%d%s\n", -+ pwq->nr_active, pwq->max_active, pwq->refcnt, - !list_empty(&pwq->mayday_node) ? " MAYDAY" : ""); - - hash_for_each(pool->busy_hash, bkt, worker, hentry) { -diff --git a/lib/raid6/unroll.awk b/lib/raid6/unroll.awk -index c6aa03631df8..0809805a7e23 100644 ---- a/lib/raid6/unroll.awk -+++ b/lib/raid6/unroll.awk -@@ -13,7 +13,7 @@ BEGIN { - for (i = 0; i < rep; ++i) { - tmp = $0 - gsub(/\$\$/, i, tmp) -- gsub(/\$\#/, n, tmp) -+ gsub(/\$#/, n, tmp) - gsub(/\$\*/, "$", tmp) - print tmp - } -diff --git a/mm/shmem.c b/mm/shmem.c -index e55aa460a2c0..69106c600692 100644 ---- a/mm/shmem.c -+++ b/mm/shmem.c -@@ -2895,7 +2895,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset, - } - - shmem_falloc.waitq = &shmem_falloc_waitq; -- shmem_falloc.start = unmap_start >> PAGE_SHIFT; -+ shmem_falloc.start = (u64)unmap_start >> PAGE_SHIFT; - shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT; - spin_lock(&inode->i_lock); - inode->i_private = &shmem_falloc; -diff --git a/mm/vmstat.c b/mm/vmstat.c -index ba9168326413..e2197b03da57 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -1805,12 +1805,13 @@ static bool need_update(int cpu) - - /* - * The fast way of checking if there are any vmstat diffs. -- * This works because the diffs are byte sized items. - */ -- if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS)) -+ if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS * -+ sizeof(p->vm_stat_diff[0]))) - return true; - #ifdef CONFIG_NUMA -- if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS)) -+ if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS * -+ sizeof(p->vm_numa_stat_diff[0]))) - return true; - #endif - } -diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c -index 8ad3ec2610b6..b9e85a4751a6 100644 ---- a/net/appletalk/aarp.c -+++ b/net/appletalk/aarp.c -@@ -879,15 +879,24 @@ static struct notifier_block aarp_notifier = { - - static unsigned char aarp_snap_id[] = { 0x00, 0x00, 0x00, 0x80, 0xF3 }; - --void __init aarp_proto_init(void) -+int __init aarp_proto_init(void) - { -+ int rc; -+ - aarp_dl = register_snap_client(aarp_snap_id, aarp_rcv); -- if (!aarp_dl) -+ if (!aarp_dl) { - printk(KERN_CRIT "Unable to register AARP with SNAP.\n"); -+ return -ENOMEM; -+ } - setup_timer(&aarp_timer, aarp_expire_timeout, 0); - aarp_timer.expires = jiffies + sysctl_aarp_expiry_time; - add_timer(&aarp_timer); -- register_netdevice_notifier(&aarp_notifier); -+ rc = register_netdevice_notifier(&aarp_notifier); -+ if (rc) { -+ del_timer_sync(&aarp_timer); -+ unregister_snap_client(aarp_dl); -+ } -+ return rc; - } - - /* Remove the AARP entries associated with a device. */ -diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c -index 475f332b1ad2..b4268bd2e557 100644 ---- a/net/appletalk/ddp.c -+++ b/net/appletalk/ddp.c -@@ -1911,9 +1911,6 @@ static unsigned char ddp_snap_id[] = { 0x08, 0x00, 0x07, 0x80, 0x9B }; - EXPORT_SYMBOL(atrtr_get_dev); - EXPORT_SYMBOL(atalk_find_dev_addr); - --static const char atalk_err_snap[] __initconst = -- KERN_CRIT "Unable to register DDP with SNAP.\n"; -- - /* Called by proto.c on kernel start up */ - static int __init atalk_init(void) - { -@@ -1928,17 +1925,23 @@ static int __init atalk_init(void) - goto out_proto; - - ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv); -- if (!ddp_dl) -- printk(atalk_err_snap); -+ if (!ddp_dl) { -+ pr_crit("Unable to register DDP with SNAP.\n"); -+ rc = -ENOMEM; -+ goto out_sock; -+ } - - dev_add_pack(<alk_packet_type); - dev_add_pack(&ppptalk_packet_type); - - rc = register_netdevice_notifier(&ddp_notifier); - if (rc) -- goto out_sock; -+ goto out_snap; -+ -+ rc = aarp_proto_init(); -+ if (rc) -+ goto out_dev; - -- aarp_proto_init(); - rc = atalk_proc_init(); - if (rc) - goto out_aarp; -@@ -1952,11 +1955,13 @@ out_proc: - atalk_proc_exit(); - out_aarp: - aarp_cleanup_module(); -+out_dev: - unregister_netdevice_notifier(&ddp_notifier); --out_sock: -+out_snap: - dev_remove_pack(&ppptalk_packet_type); - dev_remove_pack(<alk_packet_type); - unregister_snap_client(ddp_dl); -+out_sock: - sock_unregister(PF_APPLETALK); - out_proto: - proto_unregister(&ddp_proto); -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 5b808089eff8..6025cc509d97 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2932,7 +2932,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) - if (likely(!err)) { - TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS; - } else if (err != -EBUSY) { -- NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL); -+ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL, segs); - } - return err; - } -diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c -index 592d6e9967a9..895129b0928c 100644 ---- a/net/ipv4/tcp_timer.c -+++ b/net/ipv4/tcp_timer.c -@@ -358,7 +358,7 @@ static void tcp_probe_timer(struct sock *sk) - return; - } - -- if (icsk->icsk_probes_out > max_probes) { -+ if (icsk->icsk_probes_out >= max_probes) { - abort: tcp_write_err(sk); - } else { - /* Only send another probe if we didn't close things up. */ -@@ -413,6 +413,7 @@ void tcp_retransmit_timer(struct sock *sk) - struct tcp_sock *tp = tcp_sk(sk); - struct net *net = sock_net(sk); - struct inet_connection_sock *icsk = inet_csk(sk); -+ struct sk_buff *skb; - - if (tp->fastopen_rsk) { - WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV && -@@ -423,10 +424,13 @@ void tcp_retransmit_timer(struct sock *sk) - */ - return; - } -+ - if (!tp->packets_out) -- goto out; -+ return; - -- WARN_ON(tcp_write_queue_empty(sk)); -+ skb = tcp_rtx_queue_head(sk); -+ if (WARN_ON_ONCE(!skb)) -+ return; - - tp->tlp_high_seq = 0; - -@@ -459,16 +463,17 @@ void tcp_retransmit_timer(struct sock *sk) - goto out; - } - tcp_enter_loss(sk); -- tcp_retransmit_skb(sk, tcp_write_queue_head(sk), 1); -+ tcp_retransmit_skb(sk, skb, 1); - __sk_dst_reset(sk); - goto out_reset_timer; - } - -+ __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTS); - if (tcp_write_timeout(sk)) - goto out; - - if (icsk->icsk_retransmits == 0) { -- int mib_idx; -+ int mib_idx = 0; - - if (icsk->icsk_ca_state == TCP_CA_Recovery) { - if (tcp_is_sack(tp)) -@@ -483,10 +488,9 @@ void tcp_retransmit_timer(struct sock *sk) - mib_idx = LINUX_MIB_TCPSACKFAILURES; - else - mib_idx = LINUX_MIB_TCPRENOFAILURES; -- } else { -- mib_idx = LINUX_MIB_TCPTIMEOUTS; - } -- __NET_INC_STATS(sock_net(sk), mib_idx); -+ if (mib_idx) -+ __NET_INC_STATS(sock_net(sk), mib_idx); - } - - tcp_enter_loss(sk); -diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c -index de4537f66832..ed6736a1a112 100644 ---- a/net/smc/smc_wr.c -+++ b/net/smc/smc_wr.c -@@ -223,12 +223,14 @@ int smc_wr_tx_put_slot(struct smc_link *link, - - pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv); - if (pend->idx < link->wr_tx_cnt) { -+ u32 idx = pend->idx; -+ - /* clear the full struct smc_wr_tx_pend including .priv */ - memset(&link->wr_tx_pends[pend->idx], 0, - sizeof(link->wr_tx_pends[pend->idx])); - memset(&link->wr_tx_bufs[pend->idx], 0, - sizeof(link->wr_tx_bufs[pend->idx])); -- test_and_clear_bit(pend->idx, link->wr_tx_mask); -+ test_and_clear_bit(idx, link->wr_tx_mask); - return 1; - } - -diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c -index 475b453dc7ae..556989b0b5fc 100644 ---- a/net/sunrpc/cache.c -+++ b/net/sunrpc/cache.c -@@ -54,9 +54,6 @@ static void cache_init(struct cache_head *h, struct cache_detail *detail) - h->last_refresh = now; - } - --static inline int cache_is_valid(struct cache_head *h); --static void cache_fresh_locked(struct cache_head *head, time_t expiry, -- struct cache_detail *detail); - static void cache_fresh_unlocked(struct cache_head *head, - struct cache_detail *detail); - -@@ -101,9 +98,6 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail, - if (cache_is_expired(detail, tmp)) { - hlist_del_init(&tmp->cache_list); - detail->entries --; -- if (cache_is_valid(tmp) == -EAGAIN) -- set_bit(CACHE_NEGATIVE, &tmp->flags); -- cache_fresh_locked(tmp, 0, detail); - freeme = tmp; - break; - } -diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c -index 1b830a6ee3ff..a156b6dc3a72 100644 ---- a/net/x25/af_x25.c -+++ b/net/x25/af_x25.c -@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb, - } - - len = *skb->data; -- needed = 1 + (len >> 4) + (len & 0x0f); -+ needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2; - - if (!pskb_may_pull(skb, needed)) { - /* packet is too short to hold the addresses it claims -@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr, - sk_for_each(s, &x25_list) - if ((!strcmp(addr->x25_addr, - x25_sk(s)->source_addr.x25_addr) || -- !strcmp(addr->x25_addr, -+ !strcmp(x25_sk(s)->source_addr.x25_addr, - null_x25_address.x25_addr)) && - s->sk_state == TCP_LISTEN) { - /* -@@ -684,11 +684,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - goto out; - } - -- len = strlen(addr->sx25_addr.x25_addr); -- for (i = 0; i < len; i++) { -- if (!isdigit(addr->sx25_addr.x25_addr[i])) { -- rc = -EINVAL; -- goto out; -+ /* check for the null_x25_address */ -+ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) { -+ -+ len = strlen(addr->sx25_addr.x25_addr); -+ for (i = 0; i < len; i++) { -+ if (!isdigit(addr->sx25_addr.x25_addr[i])) { -+ rc = -EINVAL; -+ goto out; -+ } - } - } - -diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c -index fc0a9ce1be18..311597401b82 100644 ---- a/net/xfrm/xfrm_input.c -+++ b/net/xfrm/xfrm_input.c -@@ -245,6 +245,9 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) - else - XFRM_INC_STATS(net, - LINUX_MIB_XFRMINSTATEINVALID); -+ -+ if (encap_type == -1) -+ dev_put(skb->dev); - goto drop; - } - -diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c -index c22041a4fc36..b6eb929899c5 100644 ---- a/scripts/mod/modpost.c -+++ b/scripts/mod/modpost.c -@@ -1174,6 +1174,14 @@ static const struct sectioncheck *section_mismatch( - * fromsec = text section - * refsymname = *.constprop.* - * -+ * Pattern 6: -+ * Hide section mismatch warnings for ELF local symbols. The goal -+ * is to eliminate false positive modpost warnings caused by -+ * compiler-generated ELF local symbol names such as ".LANCHOR1". -+ * Autogenerated symbol names bypass modpost's "Pattern 2" -+ * whitelisting, which relies on pattern-matching against symbol -+ * names to work. (One situation where gcc can autogenerate ELF -+ * local symbols is when "-fsection-anchors" is used.) - **/ - static int secref_whitelist(const struct sectioncheck *mismatch, - const char *fromsec, const char *fromsym, -@@ -1212,6 +1220,10 @@ static int secref_whitelist(const struct sectioncheck *mismatch, - match(fromsym, optim_symbols)) - return 0; - -+ /* Check for pattern 6 */ -+ if (strstarts(fromsym, ".L")) -+ return 0; -+ - return 1; - } - -diff --git a/sound/core/oss/linear.c b/sound/core/oss/linear.c -index 2045697f449d..797d838a2f9e 100644 ---- a/sound/core/oss/linear.c -+++ b/sound/core/oss/linear.c -@@ -107,6 +107,8 @@ static snd_pcm_sframes_t linear_transfer(struct snd_pcm_plugin *plugin, - } - } - #endif -+ if (frames > dst_channels[0].frames) -+ frames = dst_channels[0].frames; - convert(plugin, src_channels, dst_channels, frames); - return frames; - } -diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c -index 7915564bd394..3788906421a7 100644 ---- a/sound/core/oss/mulaw.c -+++ b/sound/core/oss/mulaw.c -@@ -269,6 +269,8 @@ static snd_pcm_sframes_t mulaw_transfer(struct snd_pcm_plugin *plugin, - } - } - #endif -+ if (frames > dst_channels[0].frames) -+ frames = dst_channels[0].frames; - data = (struct mulaw_priv *)plugin->extra_data; - data->func(plugin, src_channels, dst_channels, frames); - return frames; -diff --git a/sound/core/oss/route.c b/sound/core/oss/route.c -index c8171f5783c8..72dea04197ef 100644 ---- a/sound/core/oss/route.c -+++ b/sound/core/oss/route.c -@@ -57,6 +57,8 @@ static snd_pcm_sframes_t route_transfer(struct snd_pcm_plugin *plugin, - return -ENXIO; - if (frames == 0) - return 0; -+ if (frames > dst_channels[0].frames) -+ frames = dst_channels[0].frames; - - nsrcs = plugin->src_format.channels; - ndsts = plugin->dst_format.channels; -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index 729a85a6211d..80453266a2de 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -1803,11 +1803,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) - struct snd_pcm_runtime *runtime; - unsigned long flags; - -- if (PCM_RUNTIME_CHECK(substream)) -+ if (snd_BUG_ON(!substream)) - return; -- runtime = substream->runtime; - - snd_pcm_stream_lock_irqsave(substream, flags); -+ if (PCM_RUNTIME_CHECK(substream)) -+ goto _unlock; -+ runtime = substream->runtime; -+ - if (!snd_pcm_running(substream) || - snd_pcm_update_hw_ptr0(substream, 1) < 0) - goto _end; -@@ -1818,6 +1821,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) - #endif - _end: - kill_fasync(&runtime->fasync, SIGIO, POLL_IN); -+ _unlock: - snd_pcm_stream_unlock_irqrestore(substream, flags); - } - EXPORT_SYMBOL(snd_pcm_period_elapsed); -diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c -index 8db1890605f6..c175b2cf63f7 100644 ---- a/sound/pci/hda/hda_bind.c -+++ b/sound/pci/hda/hda_bind.c -@@ -42,6 +42,10 @@ static void hda_codec_unsol_event(struct hdac_device *dev, unsigned int ev) - { - struct hda_codec *codec = container_of(dev, struct hda_codec, core); - -+ /* ignore unsol events during shutdown */ -+ if (codec->bus->shutdown) -+ return; -+ - if (codec->patch_ops.unsol_event) - codec->patch_ops.unsol_event(codec, ev); - } -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 96e9b3944b92..890793ad85ca 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -1450,8 +1450,11 @@ static int azx_free(struct azx *chip) - static int azx_dev_disconnect(struct snd_device *device) - { - struct azx *chip = device->device_data; -+ struct hdac_bus *bus = azx_bus(chip); - - chip->bus.shutdown = 1; -+ cancel_work_sync(&bus->unsol_work); -+ - return 0; - } - -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index 49be42d27761..382b6d2ed803 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -960,6 +960,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { - SND_PCI_QUIRK(0x103c, 0x837f, "HP ProBook 470 G5", CXT_FIXUP_MUTE_LED_GPIO), - SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), -+ SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO), - SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), - SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 404c50ab28fa..41e3c77d5fb7 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -333,9 +333,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) - case 0x10ec0215: - case 0x10ec0233: - case 0x10ec0235: -- case 0x10ec0236: - case 0x10ec0255: -- case 0x10ec0256: - case 0x10ec0257: - case 0x10ec0282: - case 0x10ec0283: -@@ -347,6 +345,11 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) - case 0x10ec0300: - alc_update_coef_idx(codec, 0x10, 1<<9, 0); - break; -+ case 0x10ec0236: -+ case 0x10ec0256: -+ alc_write_coef_idx(codec, 0x36, 0x5757); -+ alc_update_coef_idx(codec, 0x10, 1<<9, 0); -+ break; - case 0x10ec0275: - alc_update_coef_idx(codec, 0xe, 0, 1<<0); - break; -diff --git a/sound/soc/codecs/nau8540.c b/sound/soc/codecs/nau8540.c -index f9c9933acffb..c0c64f90a61b 100644 ---- a/sound/soc/codecs/nau8540.c -+++ b/sound/soc/codecs/nau8540.c -@@ -548,7 +548,7 @@ static int nau8540_calc_fll_param(unsigned int fll_in, - fvco_max = 0; - fvco_sel = ARRAY_SIZE(mclk_src_scaling); - for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) { -- fvco = 256 * fs * 2 * mclk_src_scaling[i].param; -+ fvco = 256ULL * fs * 2 * mclk_src_scaling[i].param; - if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX && - fvco_max < fvco) { - fvco_max = fvco; -diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c -index ab0bbef7eb48..f203c0878e69 100644 ---- a/sound/soc/sh/rcar/core.c -+++ b/sound/soc/sh/rcar/core.c -@@ -1278,6 +1278,18 @@ int rsnd_kctrl_new(struct rsnd_mod *mod, - }; - int ret; - -+ /* -+ * 1) Avoid duplicate register for DVC with MIX case -+ * 2) Allow duplicate register for MIX -+ * 3) re-register if card was rebinded -+ */ -+ list_for_each_entry(kctrl, &card->controls, list) { -+ struct rsnd_kctrl_cfg *c = kctrl->private_data; -+ -+ if (c == cfg) -+ return 0; -+ } -+ - if (size > RSND_MAX_CHANNELS) - return -EINVAL; - -diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c -index 99902ae1a2d9..b04ecc633da3 100644 ---- a/sound/soc/soc-jack.c -+++ b/sound/soc/soc-jack.c -@@ -127,10 +127,9 @@ void snd_soc_jack_report(struct snd_soc_jack *jack, int status, int mask) - unsigned int sync = 0; - int enable; - -- trace_snd_soc_jack_report(jack, mask, status); -- - if (!jack) - return; -+ trace_snd_soc_jack_report(jack, mask, status); - - dapm = &jack->card->dapm; - -diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c -index 084edc9dc553..f16a55012ea3 100644 ---- a/virt/kvm/arm/vgic/vgic-v3.c -+++ b/virt/kvm/arm/vgic/vgic-v3.c -@@ -331,8 +331,8 @@ retry: - int vgic_v3_save_pending_tables(struct kvm *kvm) - { - struct vgic_dist *dist = &kvm->arch.vgic; -- int last_byte_offset = -1; - struct vgic_irq *irq; -+ gpa_t last_ptr = ~(gpa_t)0; - int ret; - u8 val; - -@@ -352,11 +352,11 @@ int vgic_v3_save_pending_tables(struct kvm *kvm) - bit_nr = irq->intid % BITS_PER_BYTE; - ptr = pendbase + byte_offset; - -- if (byte_offset != last_byte_offset) { -+ if (ptr != last_ptr) { - ret = kvm_read_guest_lock(kvm, ptr, &val, 1); - if (ret) - return ret; -- last_byte_offset = byte_offset; -+ last_ptr = ptr; - } - - stored = val & (1U << bit_nr); diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.159-160.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.159-160.patch deleted file mode 100644 index 016b01fefa..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.159-160.patch +++ /dev/null @@ -1,1086 +0,0 @@ -diff --git a/Makefile b/Makefile -index e14ad8f064ec..f011cb69545f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 159 -+SUBLEVEL = 160 - EXTRAVERSION = - NAME = Petit Gorille - -diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts -index f4afda3594f8..de04d8764b0f 100644 ---- a/arch/arm/boot/dts/s3c6410-mini6410.dts -+++ b/arch/arm/boot/dts/s3c6410-mini6410.dts -@@ -167,6 +167,10 @@ - }; - }; - -+&clocks { -+ clocks = <&fin_pll>; -+}; -+ - &sdhci0 { - pinctrl-names = "default"; - pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; -diff --git a/arch/arm/boot/dts/s3c6410-smdk6410.dts b/arch/arm/boot/dts/s3c6410-smdk6410.dts -index ecf35ec466f7..7ade1a0686d2 100644 ---- a/arch/arm/boot/dts/s3c6410-smdk6410.dts -+++ b/arch/arm/boot/dts/s3c6410-smdk6410.dts -@@ -71,6 +71,10 @@ - }; - }; - -+&clocks { -+ clocks = <&fin_pll>; -+}; -+ - &sdhci0 { - pinctrl-names = "default"; - pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; -diff --git a/arch/arm/mach-tegra/reset-handler.S b/arch/arm/mach-tegra/reset-handler.S -index 805f306fa6f7..e31f167a8199 100644 ---- a/arch/arm/mach-tegra/reset-handler.S -+++ b/arch/arm/mach-tegra/reset-handler.S -@@ -56,16 +56,16 @@ ENTRY(tegra_resume) - cmp r6, #TEGRA20 - beq 1f @ Yes - /* Clear the flow controller flags for this CPU. */ -- cpu_to_csr_reg r1, r0 -+ cpu_to_csr_reg r3, r0 - mov32 r2, TEGRA_FLOW_CTRL_BASE -- ldr r1, [r2, r1] -+ ldr r1, [r2, r3] - /* Clear event & intr flag */ - orr r1, r1, \ - #FLOW_CTRL_CSR_INTR_FLAG | FLOW_CTRL_CSR_EVENT_FLAG - movw r0, #0x3FFD @ enable, cluster_switch, immed, bitmaps - @ & ext flags for CPU power mgnt - bic r1, r1, r0 -- str r1, [r2] -+ str r1, [r2, r3] - 1: - - mov32 r9, 0xc09 -diff --git a/arch/xtensa/mm/tlb.c b/arch/xtensa/mm/tlb.c -index 35c822286bbe..3ce5ccdb054d 100644 ---- a/arch/xtensa/mm/tlb.c -+++ b/arch/xtensa/mm/tlb.c -@@ -218,6 +218,8 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb) - unsigned tlbidx = w | (e << PAGE_SHIFT); - unsigned r0 = dtlb ? - read_dtlb_virtual(tlbidx) : read_itlb_virtual(tlbidx); -+ unsigned r1 = dtlb ? -+ read_dtlb_translation(tlbidx) : read_itlb_translation(tlbidx); - unsigned vpn = (r0 & PAGE_MASK) | (e << PAGE_SHIFT); - unsigned pte = get_pte_for_vaddr(vpn); - unsigned mm_asid = (get_rasid_register() >> 8) & ASID_MASK; -@@ -233,8 +235,6 @@ static int check_tlb_entry(unsigned w, unsigned e, bool dtlb) - } - - if (tlb_asid == mm_asid) { -- unsigned r1 = dtlb ? read_dtlb_translation(tlbidx) : -- read_itlb_translation(tlbidx); - if ((pte ^ r1) & PAGE_MASK) { - pr_err("%cTLB: way: %u, entry: %u, mapping: %08x->%08x, PTE: %08x\n", - dtlb ? 'D' : 'I', w, e, r0, r1, pte); -diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c -index 03830634e141..bf65e634590b 100644 ---- a/drivers/dma-buf/sync_file.c -+++ b/drivers/dma-buf/sync_file.c -@@ -230,7 +230,7 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a, - a_fences = get_fences(a, &a_num_fences); - b_fences = get_fences(b, &b_num_fences); - if (a_num_fences > INT_MAX - b_num_fences) -- return NULL; -+ goto err; - - num_fences = a_num_fences + b_num_fences; - -diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c -index c31e660e35db..a4929372090d 100644 ---- a/drivers/gpu/drm/radeon/r100.c -+++ b/drivers/gpu/drm/radeon/r100.c -@@ -1820,8 +1820,8 @@ static int r100_packet0_check(struct radeon_cs_parser *p, - track->textures[i].use_pitch = 1; - } else { - track->textures[i].use_pitch = 0; -- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); -- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); -+ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); -+ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); - } - if (idx_value & RADEON_TXFORMAT_CUBIC_MAP_ENABLE) - track->textures[i].tex_coord_type = 2; -diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c -index c22321cc5a41..c2b506c707a2 100644 ---- a/drivers/gpu/drm/radeon/r200.c -+++ b/drivers/gpu/drm/radeon/r200.c -@@ -476,8 +476,8 @@ int r200_packet0_check(struct radeon_cs_parser *p, - track->textures[i].use_pitch = 1; - } else { - track->textures[i].use_pitch = 0; -- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); -- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); -+ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); -+ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); - } - if (idx_value & R200_TXFORMAT_LOOKUP_DISABLE) - track->textures[i].lookup_disable = true; -diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index 21ea537bd55e..eff04fa23dfa 100644 ---- a/drivers/md/persistent-data/dm-btree-remove.c -+++ b/drivers/md/persistent-data/dm-btree-remove.c -@@ -203,7 +203,13 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent, - struct btree_node *right = r->n; - uint32_t nr_left = le32_to_cpu(left->header.nr_entries); - uint32_t nr_right = le32_to_cpu(right->header.nr_entries); -- unsigned threshold = 2 * merge_threshold(left) + 1; -+ /* -+ * Ensure the number of entries in each child will be greater -+ * than or equal to (max_entries / 3 + 1), so no matter which -+ * child is used for removal, the number will still be not -+ * less than (max_entries / 3). -+ */ -+ unsigned int threshold = 2 * (merge_threshold(left) + 1); - - if (nr_left + nr_right < threshold) { - /* -diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c -index 5e5c4d7796b8..586e35593310 100644 ---- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c -+++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c -@@ -915,7 +915,7 @@ static int bgx_lmac_enable(struct bgx *bgx, u8 lmacid) - phy_interface_mode(lmac->lmac_type))) - return -ENODEV; - -- phy_start_aneg(lmac->phydev); -+ phy_start(lmac->phydev); - return 0; - } - -diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h -index d824bf942a8f..efc4a1a8343a 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/common.h -+++ b/drivers/net/ethernet/stmicro/stmmac/common.h -@@ -367,7 +367,7 @@ struct dma_features { - struct stmmac_desc_ops { - /* DMA RX descriptor ring initialization */ - void (*init_rx_desc) (struct dma_desc *p, int disable_rx_ic, int mode, -- int end); -+ int end, int bfsize); - /* DMA TX descriptor ring initialization */ - void (*init_tx_desc) (struct dma_desc *p, int mode, int end); - -diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h -index 40d6356a7e73..3dfb07a78952 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h -+++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h -@@ -29,11 +29,13 @@ - /* Specific functions used for Ring mode */ - - /* Enhanced descriptors */ --static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end) -+static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end, -+ int bfsize) - { -- p->des1 |= cpu_to_le32((BUF_SIZE_8KiB -- << ERDES1_BUFFER2_SIZE_SHIFT) -- & ERDES1_BUFFER2_SIZE_MASK); -+ if (bfsize == BUF_SIZE_16KiB) -+ p->des1 |= cpu_to_le32((BUF_SIZE_8KiB -+ << ERDES1_BUFFER2_SIZE_SHIFT) -+ & ERDES1_BUFFER2_SIZE_MASK); - - if (end) - p->des1 |= cpu_to_le32(ERDES1_END_RING); -@@ -59,11 +61,15 @@ static inline void enh_set_tx_desc_len_on_ring(struct dma_desc *p, int len) - } - - /* Normal descriptors */ --static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end) -+static inline void ndesc_rx_set_on_ring(struct dma_desc *p, int end, int bfsize) - { -- p->des1 |= cpu_to_le32(((BUF_SIZE_2KiB - 1) -- << RDES1_BUFFER2_SIZE_SHIFT) -- & RDES1_BUFFER2_SIZE_MASK); -+ if (bfsize >= BUF_SIZE_2KiB) { -+ int bfsize2; -+ -+ bfsize2 = min(bfsize - BUF_SIZE_2KiB + 1, BUF_SIZE_2KiB - 1); -+ p->des1 |= cpu_to_le32((bfsize2 << RDES1_BUFFER2_SIZE_SHIFT) -+ & RDES1_BUFFER2_SIZE_MASK); -+ } - - if (end) - p->des1 |= cpu_to_le32(RDES1_END_RING); -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c -index 37b77e7da132..2896ec100c75 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c -@@ -293,7 +293,7 @@ exit: - } - - static void dwmac4_rd_init_rx_desc(struct dma_desc *p, int disable_rx_ic, -- int mode, int end) -+ int mode, int end, int bfsize) - { - p->des3 = cpu_to_le32(RDES3_OWN | RDES3_BUFFER1_VALID_ADDR); - -diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -index f2150efddc88..dfa6599ca1a7 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -+++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c -@@ -265,15 +265,19 @@ static int enh_desc_get_rx_status(void *data, struct stmmac_extra_stats *x, - } - - static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, -- int mode, int end) -+ int mode, int end, int bfsize) - { -+ int bfsize1; -+ - p->des0 |= cpu_to_le32(RDES0_OWN); -- p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK); -+ -+ bfsize1 = min(bfsize, BUF_SIZE_8KiB); -+ p->des1 |= cpu_to_le32(bfsize1 & ERDES1_BUFFER1_SIZE_MASK); - - if (mode == STMMAC_CHAIN_MODE) - ehn_desc_rx_set_on_chain(p); - else -- ehn_desc_rx_set_on_ring(p, end); -+ ehn_desc_rx_set_on_ring(p, end, bfsize); - - if (disable_rx_ic) - p->des1 |= cpu_to_le32(ERDES1_DISABLE_IC); -diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -index 66c17bab5997..44a4666290da 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -+++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c -@@ -133,15 +133,19 @@ static int ndesc_get_rx_status(void *data, struct stmmac_extra_stats *x, - } - - static void ndesc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, int mode, -- int end) -+ int end, int bfsize) - { -+ int bfsize1; -+ - p->des0 |= cpu_to_le32(RDES0_OWN); -- p->des1 |= cpu_to_le32((BUF_SIZE_2KiB - 1) & RDES1_BUFFER1_SIZE_MASK); -+ -+ bfsize1 = min(bfsize, BUF_SIZE_2KiB - 1); -+ p->des1 |= cpu_to_le32(bfsize1 & RDES1_BUFFER1_SIZE_MASK); - - if (mode == STMMAC_CHAIN_MODE) - ndesc_rx_set_on_chain(p, end); - else -- ndesc_rx_set_on_ring(p, end); -+ ndesc_rx_set_on_ring(p, end, bfsize); - - if (disable_rx_ic) - p->des1 |= cpu_to_le32(RDES1_DISABLE_IC); -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 612773b94ae3..e6d16c48ffef 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -1072,11 +1072,13 @@ static void stmmac_clear_rx_descriptors(struct stmmac_priv *priv, u32 queue) - if (priv->extend_desc) - priv->hw->desc->init_rx_desc(&rx_q->dma_erx[i].basic, - priv->use_riwt, priv->mode, -- (i == DMA_RX_SIZE - 1)); -+ (i == DMA_RX_SIZE - 1), -+ priv->dma_buf_sz); - else - priv->hw->desc->init_rx_desc(&rx_q->dma_rx[i], - priv->use_riwt, priv->mode, -- (i == DMA_RX_SIZE - 1)); -+ (i == DMA_RX_SIZE - 1), -+ priv->dma_buf_sz); - } - - /** -@@ -3299,7 +3301,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue) - dma_wmb(); - - if (unlikely(priv->synopsys_id >= DWMAC_CORE_4_00)) -- priv->hw->desc->init_rx_desc(p, priv->use_riwt, 0, 0); -+ priv->hw->desc->init_rx_desc(p, priv->use_riwt, 0, 0, priv->dma_buf_sz); - else - priv->hw->desc->set_rx_owner(p); - -@@ -3321,9 +3323,8 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv, u32 queue) - static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) - { - struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue]; -- unsigned int entry = rx_q->cur_rx; - int coe = priv->hw->rx_csum; -- unsigned int next_entry; -+ unsigned int next_entry = rx_q->cur_rx; - unsigned int count = 0; - - if (netif_msg_rx_status(priv)) { -@@ -3338,10 +3339,12 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) - priv->hw->desc->display_ring(rx_head, DMA_RX_SIZE, true); - } - while (count < limit) { -- int status; -+ int entry, status; - struct dma_desc *p; - struct dma_desc *np; - -+ entry = next_entry; -+ - if (priv->extend_desc) - p = (struct dma_desc *)(rx_q->dma_erx + entry); - else -@@ -3408,7 +3411,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) - "len %d larger than size (%d)\n", - frame_len, priv->dma_buf_sz); - priv->dev->stats.rx_length_errors++; -- break; -+ continue; - } - - /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3 -@@ -3444,7 +3447,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) - dev_warn(priv->device, - "packet dropped\n"); - priv->dev->stats.rx_dropped++; -- break; -+ continue; - } - - dma_sync_single_for_cpu(priv->device, -@@ -3469,7 +3472,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) - "%s: Inconsistent Rx chain\n", - priv->dev->name); - priv->dev->stats.rx_dropped++; -- break; -+ continue; - } - prefetch(skb->data - NET_IP_ALIGN); - rx_q->rx_skbuff[entry] = NULL; -@@ -3504,7 +3507,6 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) - priv->dev->stats.rx_packets++; - priv->dev->stats.rx_bytes += frame_len; - } -- entry = next_entry; - } - - stmmac_rx_refill(priv, queue); -diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c -index a44838aac97d..3189afcd5888 100644 ---- a/drivers/net/ethernet/ti/cpsw.c -+++ b/drivers/net/ethernet/ti/cpsw.c -@@ -862,8 +862,8 @@ static irqreturn_t cpsw_rx_interrupt(int irq, void *dev_id) - { - struct cpsw_common *cpsw = dev_id; - -- cpdma_ctlr_eoi(cpsw->dma, CPDMA_EOI_RX); - writel(0, &cpsw->wr_regs->rx_en); -+ cpdma_ctlr_eoi(cpsw->dma, CPDMA_EOI_RX); - - if (cpsw->quirk_irq) { - disable_irq_nosync(cpsw->irqs_table[0]); -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 768ac752a6e3..f543b9932c83 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -1331,7 +1331,7 @@ static int nvme_pr_reserve(struct block_device *bdev, u64 key, - static int nvme_pr_preempt(struct block_device *bdev, u64 old, u64 new, - enum pr_type type, bool abort) - { -- u32 cdw10 = nvme_pr_type(type) << 8 | abort ? 2 : 1; -+ u32 cdw10 = nvme_pr_type(type) << 8 | (abort ? 2 : 1); - return nvme_pr_command(bdev, cdw10, old, new, nvme_cmd_resv_acquire); - } - -@@ -1343,7 +1343,7 @@ static int nvme_pr_clear(struct block_device *bdev, u64 key) - - static int nvme_pr_release(struct block_device *bdev, u64 key, enum pr_type type) - { -- u32 cdw10 = nvme_pr_type(type) << 8 | key ? 1 << 3 : 0; -+ u32 cdw10 = nvme_pr_type(type) << 8 | (key ? 1 << 3 : 0); - return nvme_pr_command(bdev, cdw10, key, 0, nvme_cmd_resv_release); - } - -diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c -index d66ef88e13cf..2a203055b16e 100644 ---- a/drivers/pci/msi.c -+++ b/drivers/pci/msi.c -@@ -211,7 +211,7 @@ u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag) - return 0; - - mask_bits &= ~PCI_MSIX_ENTRY_CTRL_MASKBIT; -- if (flag) -+ if (flag & PCI_MSIX_ENTRY_CTRL_MASKBIT) - mask_bits |= PCI_MSIX_ENTRY_CTRL_MASKBIT; - writel(mask_bits, pci_msix_desc_addr(desc) + PCI_MSIX_ENTRY_VECTOR_CTRL); - -diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c -index 7e4bec75fcde..522e59274b5d 100644 ---- a/drivers/pci/pci-driver.c -+++ b/drivers/pci/pci-driver.c -@@ -967,17 +967,22 @@ static int pci_pm_thaw_noirq(struct device *dev) - return error; - } - -- if (pci_has_legacy_pm_support(pci_dev)) -- return pci_legacy_resume_early(dev); -- - /* -- * pci_restore_state() requires the device to be in D0 (because of MSI -- * restoration among other things), so force it into D0 in case the -- * driver's "freeze" callbacks put it into a low-power state directly. -+ * Both the legacy ->resume_early() and the new pm->thaw_noirq() -+ * callbacks assume the device has been returned to D0 and its -+ * config state has been restored. -+ * -+ * In addition, pci_restore_state() restores MSI-X state in MMIO -+ * space, which requires the device to be in D0, so return it to D0 -+ * in case the driver's "freeze" callbacks put it into a low-power -+ * state. - */ - pci_set_power_state(pci_dev, PCI_D0); - pci_restore_state(pci_dev); - -+ if (pci_has_legacy_pm_support(pci_dev)) -+ return pci_legacy_resume_early(dev); -+ - if (drv && drv->pm && drv->pm->thaw_noirq) - error = drv->pm->thaw_noirq(dev); - -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 45c3fbd38f50..90df085e9f92 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -4252,15 +4252,21 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags) - - static bool pci_quirk_cavium_acs_match(struct pci_dev *dev) - { -+ if (!pci_is_pcie(dev) || pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT) -+ return false; -+ -+ switch (dev->device) { - /* -- * Effectively selects all downstream ports for whole ThunderX 1 -- * family by 0xf800 mask (which represents 8 SoCs), while the lower -- * bits of device ID are used to indicate which subdevice is used -- * within the SoC. -+ * Effectively selects all downstream ports for whole ThunderX1 -+ * (which represents 8 SoCs). - */ -- return (pci_is_pcie(dev) && -- (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) && -- ((dev->device & 0xf800) == 0xa000)); -+ case 0xa000 ... 0xa7ff: /* ThunderX1 */ -+ case 0xaf84: /* ThunderX2 */ -+ case 0xb884: /* ThunderX3 */ -+ return true; -+ default: -+ return false; -+ } - } - - static int pci_quirk_cavium_acs(struct pci_dev *dev, u16 acs_flags) -@@ -4600,7 +4606,7 @@ int pci_dev_specific_acs_enabled(struct pci_dev *dev, u16 acs_flags) - #define INTEL_BSPR_REG_BPPD (1 << 9) - - /* Upstream Peer Decode Configuration Register */ --#define INTEL_UPDCR_REG 0x1114 -+#define INTEL_UPDCR_REG 0x1014 - /* 5:0 Peer Decode Enable bits */ - #define INTEL_UPDCR_REG_MASK 0x3f - -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index d2428c262b7c..b2cb4f497ef6 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -4503,7 +4503,7 @@ static int __init regulator_init(void) - /* init early to allow our consumers to complete system booting */ - core_initcall(regulator_init); - --static int regulator_late_cleanup(struct device *dev, void *data) -+static int __init regulator_late_cleanup(struct device *dev, void *data) - { - struct regulator_dev *rdev = dev_to_rdev(dev); - const struct regulator_ops *ops = rdev->desc->ops; -@@ -4552,8 +4552,17 @@ unlock: - return 0; - } - --static void regulator_init_complete_work_function(struct work_struct *work) -+static int __init regulator_init_complete(void) - { -+ /* -+ * Since DT doesn't provide an idiomatic mechanism for -+ * enabling full constraints and since it's much more natural -+ * with DT to provide them just assume that a DT enabled -+ * system has full constraints. -+ */ -+ if (of_have_populated_dt()) -+ has_full_constraints = true; -+ - /* - * Regulators may had failed to resolve their input supplies - * when were registered, either because the input supply was -@@ -4571,35 +4580,6 @@ static void regulator_init_complete_work_function(struct work_struct *work) - */ - class_for_each_device(®ulator_class, NULL, NULL, - regulator_late_cleanup); --} -- --static DECLARE_DELAYED_WORK(regulator_init_complete_work, -- regulator_init_complete_work_function); -- --static int __init regulator_init_complete(void) --{ -- /* -- * Since DT doesn't provide an idiomatic mechanism for -- * enabling full constraints and since it's much more natural -- * with DT to provide them just assume that a DT enabled -- * system has full constraints. -- */ -- if (of_have_populated_dt()) -- has_full_constraints = true; -- -- /* -- * We punt completion for an arbitrary amount of time since -- * systems like distros will load many drivers from userspace -- * so consumers might not always be ready yet, this is -- * particularly an issue with laptops where this might bounce -- * the display off then on. Ideally we'd get a notification -- * from userspace when this happens but we don't so just wait -- * a bit and hope we waited long enough. It'd be better if -- * we'd only do this on systems that need it, and a kernel -- * command line option might be useful. -- */ -- schedule_delayed_work(®ulator_init_complete_work, -- msecs_to_jiffies(30000)); - - return 0; - } -diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c -index e8e12c2b1d0e..1e6253f1e070 100644 ---- a/drivers/rpmsg/qcom_glink_native.c -+++ b/drivers/rpmsg/qcom_glink_native.c -@@ -243,10 +243,31 @@ static void qcom_glink_channel_release(struct kref *ref) - { - struct glink_channel *channel = container_of(ref, struct glink_channel, - refcount); -+ struct glink_core_rx_intent *intent; -+ struct glink_core_rx_intent *tmp; - unsigned long flags; -+ int iid; -+ -+ /* cancel pending rx_done work */ -+ cancel_work_sync(&channel->intent_work); - - spin_lock_irqsave(&channel->intent_lock, flags); -+ /* Free all non-reuse intents pending rx_done work */ -+ list_for_each_entry_safe(intent, tmp, &channel->done_intents, node) { -+ if (!intent->reuse) { -+ kfree(intent->data); -+ kfree(intent); -+ } -+ } -+ -+ idr_for_each_entry(&channel->liids, tmp, iid) { -+ kfree(tmp->data); -+ kfree(tmp); -+ } - idr_destroy(&channel->liids); -+ -+ idr_for_each_entry(&channel->riids, tmp, iid) -+ kfree(tmp); - idr_destroy(&channel->riids); - spin_unlock_irqrestore(&channel->intent_lock, flags); - -@@ -1095,13 +1116,12 @@ static int qcom_glink_create_remote(struct qcom_glink *glink, - close_link: - /* - * Send a close request to "undo" our open-ack. The close-ack will -- * release the last reference. -+ * release qcom_glink_send_open_req() reference and the last reference -+ * will be relesed after receiving remote_close or transport unregister -+ * by calling qcom_glink_native_remove(). - */ - qcom_glink_send_close_req(glink, channel); - -- /* Release qcom_glink_send_open_req() reference */ -- kref_put(&channel->refcount, qcom_glink_channel_release); -- - return ret; - } - -@@ -1392,15 +1412,13 @@ static int qcom_glink_rx_open(struct qcom_glink *glink, unsigned int rcid, - - ret = rpmsg_register_device(rpdev); - if (ret) -- goto free_rpdev; -+ goto rcid_remove; - - channel->rpdev = rpdev; - } - - return 0; - --free_rpdev: -- kfree(rpdev); - rcid_remove: - spin_lock_irqsave(&glink->idr_lock, flags); - idr_remove(&glink->rcids, channel->rcid); -@@ -1521,6 +1539,18 @@ static void qcom_glink_work(struct work_struct *work) - } - } - -+static void qcom_glink_cancel_rx_work(struct qcom_glink *glink) -+{ -+ struct glink_defer_cmd *dcmd; -+ struct glink_defer_cmd *tmp; -+ -+ /* cancel any pending deferred rx_work */ -+ cancel_work_sync(&glink->rx_work); -+ -+ list_for_each_entry_safe(dcmd, tmp, &glink->rx_queue, node) -+ kfree(dcmd); -+} -+ - struct qcom_glink *qcom_glink_native_probe(struct device *dev, - unsigned long features, - struct qcom_glink_pipe *rx, -@@ -1591,23 +1621,24 @@ void qcom_glink_native_remove(struct qcom_glink *glink) - struct glink_channel *channel; - int cid; - int ret; -- unsigned long flags; - - disable_irq(glink->irq); -- cancel_work_sync(&glink->rx_work); -+ qcom_glink_cancel_rx_work(glink); - - ret = device_for_each_child(glink->dev, NULL, qcom_glink_remove_device); - if (ret) - dev_warn(glink->dev, "Can't remove GLINK devices: %d\n", ret); - -- spin_lock_irqsave(&glink->idr_lock, flags); - /* Release any defunct local channels, waiting for close-ack */ - idr_for_each_entry(&glink->lcids, channel, cid) - kref_put(&channel->refcount, qcom_glink_channel_release); - -+ /* Release any defunct local channels, waiting for close-req */ -+ idr_for_each_entry(&glink->rcids, channel, cid) -+ kref_put(&channel->refcount, qcom_glink_channel_release); -+ - idr_destroy(&glink->lcids); - idr_destroy(&glink->rcids); -- spin_unlock_irqrestore(&glink->idr_lock, flags); - mbox_free_channel(glink->mbox_chan); - } - EXPORT_SYMBOL_GPL(qcom_glink_native_remove); -diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c -index 5cdaa5f8fb61..53b3a43160f4 100644 ---- a/drivers/rpmsg/qcom_glink_smem.c -+++ b/drivers/rpmsg/qcom_glink_smem.c -@@ -119,7 +119,7 @@ static void glink_smem_rx_advance(struct qcom_glink_pipe *np, - tail = le32_to_cpu(*pipe->tail); - - tail += count; -- if (tail > pipe->native.length) -+ if (tail >= pipe->native.length) - tail -= pipe->native.length; - - *pipe->tail = cpu_to_le32(tail); -diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c -index 5ea5d42bac76..662df16b07a4 100644 ---- a/drivers/scsi/libiscsi.c -+++ b/drivers/scsi/libiscsi.c -@@ -1983,7 +1983,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) - - ISCSI_DBG_EH(session, "scsi cmd %p timedout\n", sc); - -- spin_lock(&session->frwd_lock); -+ spin_lock_bh(&session->frwd_lock); - task = (struct iscsi_task *)sc->SCp.ptr; - if (!task) { - /* -@@ -2110,7 +2110,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) - done: - if (task) - task->last_timeout = jiffies; -- spin_unlock(&session->frwd_lock); -+ spin_unlock_bh(&session->frwd_lock); - ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ? - "timer reset" : "shutdown or nh"); - return rc; -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 95503bb9b067..d1363f3fabfa 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -887,6 +887,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - status |= USB_PORT_STAT_C_BH_RESET << 16; - if ((raw_port_status & PORT_CEC)) - status |= USB_PORT_STAT_C_CONFIG_ERROR << 16; -+ -+ /* USB3 remote wake resume signaling completed */ -+ if (bus_state->port_remote_wakeup & (1 << wIndex) && -+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME && -+ (raw_port_status & PORT_PLS_MASK) != XDEV_RECOVERY) { -+ bus_state->port_remote_wakeup &= ~(1 << wIndex); -+ usb_hcd_end_port_resume(&hcd->self, wIndex); -+ } - } - - if (hcd->speed < HCD_USB3) { -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 89af395cd89c..61fa3007a74a 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -1679,9 +1679,6 @@ static void handle_port_status(struct xhci_hcd *xhci, - usb_hcd_resume_root_hub(hcd); - } - -- if (hcd->speed >= HCD_USB3 && (portsc & PORT_PLS_MASK) == XDEV_INACTIVE) -- bus_state->port_remote_wakeup &= ~(1 << faked_port_index); -- - if ((portsc & PORT_PLC) && (portsc & PORT_PLS_MASK) == XDEV_RESUME) { - xhci_dbg(xhci, "port resume event for port %d\n", port_id); - -@@ -1700,6 +1697,7 @@ static void handle_port_status(struct xhci_hcd *xhci, - bus_state->port_remote_wakeup |= 1 << faked_port_index; - xhci_test_and_clear_bit(xhci, port_array, - faked_port_index, PORT_PLC); -+ usb_hcd_start_port_resume(&hcd->self, faked_port_index); - xhci_set_link_state(xhci, port_array, faked_port_index, - XDEV_U0); - /* Need to wait until the next link state change -@@ -1737,8 +1735,6 @@ static void handle_port_status(struct xhci_hcd *xhci, - if (slot_id && xhci->devs[slot_id]) - xhci_ring_device(xhci, slot_id); - if (bus_state->port_remote_wakeup & (1 << faked_port_index)) { -- bus_state->port_remote_wakeup &= -- ~(1 << faked_port_index); - xhci_test_and_clear_bit(xhci, port_array, - faked_port_index, PORT_PLC); - usb_wakeup_notification(hcd->self.root_hub, -diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c -index 1c46045b0e7f..94594dc63c41 100644 ---- a/drivers/vfio/pci/vfio_pci_intrs.c -+++ b/drivers/vfio/pci/vfio_pci_intrs.c -@@ -297,8 +297,8 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, - irq = pci_irq_vector(pdev, vector); - - if (vdev->ctx[vector].trigger) { -- free_irq(irq, vdev->ctx[vector].trigger); - irq_bypass_unregister_producer(&vdev->ctx[vector].producer); -+ free_irq(irq, vdev->ctx[vector].trigger); - kfree(vdev->ctx[vector].name); - eventfd_ctx_put(vdev->ctx[vector].trigger); - vdev->ctx[vector].trigger = NULL; -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 6dc0e092b0fc..5e75c5f77f4c 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -722,6 +722,13 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush) - if (backup_cred(cifs_sb)) - create_options |= CREATE_OPEN_BACKUP_INTENT; - -+ /* O_SYNC also has bit for O_DSYNC so following check picks up either */ -+ if (cfile->f_flags & O_SYNC) -+ create_options |= CREATE_WRITE_THROUGH; -+ -+ if (cfile->f_flags & O_DIRECT) -+ create_options |= CREATE_NO_BUFFER; -+ - if (server->ops->get_lease_key) - server->ops->get_lease_key(inode, &cfile->fid); - -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 4725a9d9597f..8818291815bc 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -1718,6 +1718,11 @@ struct net_device { - unsigned char if_port; - unsigned char dma; - -+ /* Note : dev->mtu is often read without holding a lock. -+ * Writers usually hold RTNL. -+ * It is recommended to use READ_ONCE() to annotate the reads, -+ * and to use WRITE_ONCE() to annotate the writes. -+ */ - unsigned int mtu; - unsigned int min_mtu; - unsigned int max_mtu; -diff --git a/include/linux/time.h b/include/linux/time.h -index 87c36cf1cec2..21086c5143d9 100644 ---- a/include/linux/time.h -+++ b/include/linux/time.h -@@ -301,4 +301,17 @@ static inline bool itimerspec64_valid(const struct itimerspec64 *its) - */ - #define time_after32(a, b) ((s32)((u32)(b) - (u32)(a)) < 0) - #define time_before32(b, a) time_after32(a, b) -+ -+/** -+ * time_between32 - check if a 32-bit timestamp is within a given time range -+ * @t: the time which may be within [l,h] -+ * @l: the lower bound of the range -+ * @h: the higher bound of the range -+ * -+ * time_before32(t, l, h) returns true if @l <= @t <= @h. All operands are -+ * treated as 32-bit integers. -+ * -+ * Equivalent to !(time_before32(@t, @l) || time_after32(@t, @h)). -+ */ -+#define time_between32(t, l, h) ((u32)(h) - (u32)(l) >= (u32)(t) - (u32)(l)) - #endif -diff --git a/include/net/ip.h b/include/net/ip.h -index b8ebee43941f..666d89ca4e2e 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -644,4 +644,9 @@ extern int sysctl_icmp_msgs_burst; - int ip_misc_proc_init(void); - #endif - -+static inline bool inetdev_valid_mtu(unsigned int mtu) -+{ -+ return likely(mtu >= IPV4_MIN_MTU); -+} -+ - #endif /* _IP_H */ -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 785c4ef4e1bf..00d10f0e1194 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -500,19 +500,27 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb); - */ - static inline void tcp_synq_overflow(const struct sock *sk) - { -- unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; -+ unsigned long last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); - unsigned long now = jiffies; - -- if (time_after(now, last_overflow + HZ)) -- tcp_sk(sk)->rx_opt.ts_recent_stamp = now; -+ if (!time_between32(now, last_overflow, last_overflow + HZ)) -+ WRITE_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp, now); - } - - /* syncookies: no recent synqueue overflow on this listening socket? */ - static inline bool tcp_synq_no_recent_overflow(const struct sock *sk) - { -- unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; -+ unsigned long last_overflow = READ_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); - -- return time_after(jiffies, last_overflow + TCP_SYNCOOKIE_VALID); -+ /* If last_overflow <= jiffies <= last_overflow + TCP_SYNCOOKIE_VALID, -+ * then we're under synflood. However, we have to use -+ * 'last_overflow - HZ' as lower bound. That's because a concurrent -+ * tcp_synq_overflow() could update .ts_recent_stamp after we read -+ * jiffies but before we store .ts_recent_stamp into last_overflow, -+ * which could lead to rejecting a valid syncookie. -+ */ -+ return !time_between32(jiffies, last_overflow - HZ, -+ last_overflow + TCP_SYNCOOKIE_VALID); - } - - static inline u32 tcp_cookie_time(void) -diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c -index f6b6a92f1c48..b7cc322acdc8 100644 ---- a/net/bridge/br_device.c -+++ b/net/bridge/br_device.c -@@ -217,6 +217,12 @@ static int br_set_mac_address(struct net_device *dev, void *p) - if (!is_valid_ether_addr(addr->sa_data)) - return -EADDRNOTAVAIL; - -+ /* dev_set_mac_addr() can be called by a master device on bridge's -+ * NETDEV_UNREGISTER, but since it's being destroyed do nothing -+ */ -+ if (dev->reg_state != NETREG_REGISTERED) -+ return -EBUSY; -+ - spin_lock_bh(&br->lock); - if (!ether_addr_equal(dev->dev_addr, addr->sa_data)) { - /* Mac address will be changed in br_stp_change_bridge_id(). */ -diff --git a/net/core/dev.c b/net/core/dev.c -index 3ce68484ed5a..f9f05b3df460 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -6876,7 +6876,8 @@ int __dev_set_mtu(struct net_device *dev, int new_mtu) - if (ops->ndo_change_mtu) - return ops->ndo_change_mtu(dev, new_mtu); - -- dev->mtu = new_mtu; -+ /* Pairs with all the lockless reads of dev->mtu in the stack */ -+ WRITE_ONCE(dev->mtu, new_mtu); - return 0; - } - EXPORT_SYMBOL(__dev_set_mtu); -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 7be5c20a93a5..071de3013364 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -450,9 +450,10 @@ bool __skb_flow_dissect(const struct sk_buff *skb, - nhoff = skb_network_offset(skb); - hlen = skb_headlen(skb); - #if IS_ENABLED(CONFIG_NET_DSA) -- if (unlikely(skb->dev && netdev_uses_dsa(skb->dev))) { -+ if (unlikely(skb->dev && netdev_uses_dsa(skb->dev) && -+ proto == htons(ETH_P_XDSA))) { - const struct dsa_device_ops *ops; -- int offset; -+ int offset = 0; - - ops = skb->dev->dsa_ptr->tag_ops; - if (ops->flow_dissect && -diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c -index 5264510c9983..5f020c051af9 100644 ---- a/net/ipv4/devinet.c -+++ b/net/ipv4/devinet.c -@@ -1426,11 +1426,6 @@ skip: - } - } - --static bool inetdev_valid_mtu(unsigned int mtu) --{ -- return mtu >= IPV4_MIN_MTU; --} -- - static void inetdev_send_gratuitous_arp(struct net_device *dev, - struct in_device *in_dev) - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 34d49f76d1a7..73cd64c7692f 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1123,13 +1123,17 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork, - rt = *rtp; - if (unlikely(!rt)) - return -EFAULT; -- /* -- * We steal reference to this route, caller should not release it -- */ -- *rtp = NULL; -+ - cork->fragsize = ip_sk_use_pmtu(sk) ? -- dst_mtu(&rt->dst) : rt->dst.dev->mtu; -+ dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu); -+ -+ if (!inetdev_valid_mtu(cork->fragsize)) -+ return -ENETUNREACH; -+ - cork->dst = &rt->dst; -+ /* We stole this route, caller should not release it. */ -+ *rtp = NULL; -+ - cork->length = 0; - cork->ttl = ipc->ttl; - cork->tos = ipc->tos; -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 6025cc509d97..e3b28140c10b 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -708,8 +708,9 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb - min_t(unsigned int, eff_sacks, - (remaining - TCPOLEN_SACK_BASE_ALIGNED) / - TCPOLEN_SACK_PERBLOCK); -- size += TCPOLEN_SACK_BASE_ALIGNED + -- opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; -+ if (likely(opts->num_sack_blocks)) -+ size += TCPOLEN_SACK_BASE_ALIGNED + -+ opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; - } - - return size; -diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c -index 48d81857961c..737e37b28d93 100644 ---- a/net/openvswitch/conntrack.c -+++ b/net/openvswitch/conntrack.c -@@ -879,6 +879,17 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, - } - err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); - -+ if (err == NF_ACCEPT && -+ ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { -+ if (maniptype == NF_NAT_MANIP_SRC) -+ maniptype = NF_NAT_MANIP_DST; -+ else -+ maniptype = NF_NAT_MANIP_SRC; -+ -+ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, -+ maniptype); -+ } -+ - /* Mark NAT done if successful and update the flow key. */ - if (err == NF_ACCEPT) - ovs_nat_update_key(key, skb, maniptype); -diff --git a/net/tipc/core.c b/net/tipc/core.c -index 67ac10434ba2..35f162ece2b7 100644 ---- a/net/tipc/core.c -+++ b/net/tipc/core.c -@@ -116,14 +116,6 @@ static int __init tipc_init(void) - sysctl_tipc_rmem[1] = RCVBUF_DEF; - sysctl_tipc_rmem[2] = RCVBUF_MAX; - -- err = tipc_netlink_start(); -- if (err) -- goto out_netlink; -- -- err = tipc_netlink_compat_start(); -- if (err) -- goto out_netlink_compat; -- - err = tipc_register_sysctl(); - if (err) - goto out_sysctl; -@@ -144,8 +136,21 @@ static int __init tipc_init(void) - if (err) - goto out_bearer; - -+ err = tipc_netlink_start(); -+ if (err) -+ goto out_netlink; -+ -+ err = tipc_netlink_compat_start(); -+ if (err) -+ goto out_netlink_compat; -+ - pr_info("Started in single node mode\n"); - return 0; -+ -+out_netlink_compat: -+ tipc_netlink_stop(); -+out_netlink: -+ tipc_bearer_cleanup(); - out_bearer: - unregister_pernet_device(&tipc_topsrv_net_ops); - out_pernet_topsrv: -@@ -155,22 +160,18 @@ out_socket: - out_pernet: - tipc_unregister_sysctl(); - out_sysctl: -- tipc_netlink_compat_stop(); --out_netlink_compat: -- tipc_netlink_stop(); --out_netlink: - pr_err("Unable to start in single node mode\n"); - return err; - } - - static void __exit tipc_exit(void) - { -+ tipc_netlink_compat_stop(); -+ tipc_netlink_stop(); - tipc_bearer_cleanup(); - unregister_pernet_device(&tipc_topsrv_net_ops); - tipc_socket_stop(); - unregister_pernet_device(&tipc_net_ops); -- tipc_netlink_stop(); -- tipc_netlink_compat_stop(); - tipc_unregister_sysctl(); - - pr_info("Deactivated\n"); diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.160-161.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.160-161.patch deleted file mode 100644 index a74a8d40da..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.160-161.patch +++ /dev/null @@ -1,4240 +0,0 @@ -diff --git a/Makefile b/Makefile -index f011cb69545f..6b4528888a75 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 160 -+SUBLEVEL = 161 - EXTRAVERSION = - NAME = Petit Gorille - -diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c -index e8edbf13302a..3856d51c645b 100644 ---- a/arch/arm64/kernel/psci.c -+++ b/arch/arm64/kernel/psci.c -@@ -84,7 +84,8 @@ static void cpu_psci_cpu_die(unsigned int cpu) - - static int cpu_psci_cpu_kill(unsigned int cpu) - { -- int err, i; -+ int err; -+ unsigned long start, end; - - if (!psci_ops.affinity_info) - return 0; -@@ -94,16 +95,18 @@ static int cpu_psci_cpu_kill(unsigned int cpu) - * while it is dying. So, try again a few times. - */ - -- for (i = 0; i < 10; i++) { -+ start = jiffies; -+ end = start + msecs_to_jiffies(100); -+ do { - err = psci_ops.affinity_info(cpu_logical_map(cpu), 0); - if (err == PSCI_0_2_AFFINITY_LEVEL_OFF) { -- pr_info("CPU%d killed.\n", cpu); -+ pr_info("CPU%d killed (polled %d ms)\n", cpu, -+ jiffies_to_msecs(jiffies - start)); - return 0; - } - -- msleep(10); -- pr_info("Retrying again to check for CPU kill\n"); -- } -+ usleep_range(100, 1000); -+ } while (time_before(jiffies, end)); - - pr_warn("CPU%d may not have shut down cleanly (AFFINITY_INFO reports %d)\n", - cpu, err); -diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c -index cfbf7bd0dfba..32ae5c9daac4 100644 ---- a/arch/arm64/kvm/sys_regs.c -+++ b/arch/arm64/kvm/sys_regs.c -@@ -1785,8 +1785,11 @@ static const struct sys_reg_desc *index_to_sys_reg_desc(struct kvm_vcpu *vcpu, - if ((id & KVM_REG_ARM_COPROC_MASK) != KVM_REG_ARM64_SYSREG) - return NULL; - -+ if (!index_to_params(id, ¶ms)) -+ return NULL; -+ - table = get_target_table(vcpu->arch.target, true, &num); -- r = find_reg_by_id(id, ¶ms, table, num); -+ r = find_reg(¶ms, table, num); - if (!r) - r = find_reg(¶ms, sys_reg_descs, ARRAY_SIZE(sys_reg_descs)); - -diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h -index a2252c2a9ded..d0b9912fb63f 100644 ---- a/arch/mips/include/asm/pgtable-64.h -+++ b/arch/mips/include/asm/pgtable-64.h -@@ -18,10 +18,12 @@ - #include - - #define __ARCH_USE_5LEVEL_HACK --#if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48) -+#if CONFIG_PGTABLE_LEVELS == 2 - #include --#elif !(defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_MIPS_VA_BITS_48)) -+#elif CONFIG_PGTABLE_LEVELS == 3 - #include -+#else -+#include - #endif - - /* -@@ -222,6 +224,9 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd) - return pgd_val(pgd); - } - -+#define pgd_phys(pgd) virt_to_phys((void *)pgd_val(pgd)) -+#define pgd_page(pgd) (pfn_to_page(pgd_phys(pgd) >> PAGE_SHIFT)) -+ - static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address) - { - return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(address); -diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c -index 0ce8b0e5d7ba..207ba53a500b 100644 ---- a/arch/powerpc/kernel/irq.c -+++ b/arch/powerpc/kernel/irq.c -@@ -561,8 +561,6 @@ void __do_irq(struct pt_regs *regs) - - trace_irq_entry(regs); - -- check_stack_overflow(); -- - /* - * Query the platform PIC for the interrupt & ack it. - * -@@ -594,6 +592,8 @@ void do_IRQ(struct pt_regs *regs) - irqtp = hardirq_ctx[raw_smp_processor_id()]; - sirqtp = softirq_ctx[raw_smp_processor_id()]; - -+ check_stack_overflow(); -+ - /* Already there ? */ - if (unlikely(curtp == irqtp || curtp == sirqtp)) { - __do_irq(regs); -diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h -index bbe99cb8219d..11857fea993c 100644 ---- a/arch/s390/include/asm/pgalloc.h -+++ b/arch/s390/include/asm/pgalloc.h -@@ -70,7 +70,12 @@ static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long address) - crst_table_init(table, _REGION2_ENTRY_EMPTY); - return (p4d_t *) table; - } --#define p4d_free(mm, p4d) crst_table_free(mm, (unsigned long *) p4d) -+ -+static inline void p4d_free(struct mm_struct *mm, p4d_t *p4d) -+{ -+ if (!mm_p4d_folded(mm)) -+ crst_table_free(mm, (unsigned long *) p4d); -+} - - static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) - { -@@ -79,7 +84,12 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) - crst_table_init(table, _REGION3_ENTRY_EMPTY); - return (pud_t *) table; - } --#define pud_free(mm, pud) crst_table_free(mm, (unsigned long *) pud) -+ -+static inline void pud_free(struct mm_struct *mm, pud_t *pud) -+{ -+ if (!mm_pud_folded(mm)) -+ crst_table_free(mm, (unsigned long *) pud); -+} - - static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) - { -@@ -97,6 +107,8 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) - - static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd) - { -+ if (mm_pmd_folded(mm)) -+ return; - pgtable_pmd_page_dtor(virt_to_page(pmd)); - crst_table_free(mm, (unsigned long *) pmd); - } -diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h -index 64539c221672..2dc9eb4e1acc 100644 ---- a/arch/s390/include/asm/timex.h -+++ b/arch/s390/include/asm/timex.h -@@ -10,8 +10,9 @@ - #ifndef _ASM_S390_TIMEX_H - #define _ASM_S390_TIMEX_H - --#include -+#include - #include -+#include - - /* The value of the TOD clock for 1.1.1970. */ - #define TOD_UNIX_EPOCH 0x7d91048bca000000ULL -@@ -186,15 +187,18 @@ extern unsigned char tod_clock_base[16] __aligned(8); - /** - * get_clock_monotonic - returns current time in clock rate units - * -- * The caller must ensure that preemption is disabled. - * The clock and tod_clock_base get changed via stop_machine. -- * Therefore preemption must be disabled when calling this -- * function, otherwise the returned value is not guaranteed to -- * be monotonic. -+ * Therefore preemption must be disabled, otherwise the returned -+ * value is not guaranteed to be monotonic. - */ - static inline unsigned long long get_tod_clock_monotonic(void) - { -- return get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; -+ unsigned long long tod; -+ -+ preempt_disable_notrace(); -+ tod = get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; -+ preempt_enable_notrace(); -+ return tod; - } - - /** -diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c -index 2394557653d5..6d154069c962 100644 ---- a/arch/s390/kernel/dis.c -+++ b/arch/s390/kernel/dis.c -@@ -1930,10 +1930,11 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr) - ptr += sprintf(ptr, "%%c%i", value); - else if (operand->flags & OPERAND_VR) - ptr += sprintf(ptr, "%%v%i", value); -- else if (operand->flags & OPERAND_PCREL) -- ptr += sprintf(ptr, "%lx", (signed int) value -- + addr); -- else if (operand->flags & OPERAND_SIGNED) -+ else if (operand->flags & OPERAND_PCREL) { -+ void *pcrel = (void *)((int)value + addr); -+ -+ ptr += sprintf(ptr, "%px", pcrel); -+ } else if (operand->flags & OPERAND_SIGNED) - ptr += sprintf(ptr, "%i", value); - else - ptr += sprintf(ptr, "%u", value); -@@ -2005,7 +2006,7 @@ void show_code(struct pt_regs *regs) - else - *ptr++ = ' '; - addr = regs->psw.addr + start - 32; -- ptr += sprintf(ptr, "%016lx: ", addr); -+ ptr += sprintf(ptr, "%px: ", (void *)addr); - if (start + opsize >= end) - break; - for (i = 0; i < opsize; i++) -@@ -2033,7 +2034,7 @@ void print_fn_code(unsigned char *code, unsigned long len) - opsize = insn_length(*code); - if (opsize > len) - break; -- ptr += sprintf(ptr, "%p: ", code); -+ ptr += sprintf(ptr, "%px: ", code); - for (i = 0; i < opsize; i++) - ptr += sprintf(ptr, "%02x", code[i]); - *ptr++ = '\t'; -diff --git a/arch/sh/include/cpu-sh4/cpu/sh7734.h b/arch/sh/include/cpu-sh4/cpu/sh7734.h -index 96f0246ad2f2..82b63208135a 100644 ---- a/arch/sh/include/cpu-sh4/cpu/sh7734.h -+++ b/arch/sh/include/cpu-sh4/cpu/sh7734.h -@@ -134,7 +134,7 @@ enum { - GPIO_FN_EX_WAIT1, GPIO_FN_SD1_DAT0_A, GPIO_FN_DREQ2, GPIO_FN_CAN1_TX_C, - GPIO_FN_ET0_LINK_C, GPIO_FN_ET0_ETXD5_A, - GPIO_FN_EX_WAIT0, GPIO_FN_TCLK1_B, -- GPIO_FN_RD_WR, GPIO_FN_TCLK0, -+ GPIO_FN_RD_WR, GPIO_FN_TCLK0, GPIO_FN_CAN_CLK_B, GPIO_FN_ET0_ETXD4, - GPIO_FN_EX_CS5, GPIO_FN_SD1_CMD_A, GPIO_FN_ATADIR, GPIO_FN_QSSL_B, - GPIO_FN_ET0_ETXD3_A, - GPIO_FN_EX_CS4, GPIO_FN_SD1_WP_A, GPIO_FN_ATAWR, GPIO_FN_QMI_QIO1_B, -diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h -index a7adb2bfbf0b..6b8ad6fa3979 100644 ---- a/arch/x86/include/asm/crash.h -+++ b/arch/x86/include/asm/crash.h -@@ -2,6 +2,8 @@ - #ifndef _ASM_X86_CRASH_H - #define _ASM_X86_CRASH_H - -+struct kimage; -+ - int crash_load_segments(struct kimage *image); - int crash_copy_backup_region(struct kimage *image); - int crash_setup_memmap_entries(struct kimage *image, -diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h -index 6390bd8c141b..5e12b2319d7a 100644 ---- a/arch/x86/include/asm/fixmap.h -+++ b/arch/x86/include/asm/fixmap.h -@@ -159,7 +159,7 @@ extern pte_t *kmap_pte; - extern pte_t *pkmap_page_table; - - void __native_set_fixmap(enum fixed_addresses idx, pte_t pte); --void native_set_fixmap(enum fixed_addresses idx, -+void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, - phys_addr_t phys, pgprot_t flags); - - #ifndef CONFIG_PARAVIRT -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index 566b7bc5deaa..2271adbc3c42 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -1690,9 +1690,10 @@ static bool io_apic_level_ack_pending(struct mp_chip_data *data) - - static inline bool ioapic_irqd_mask(struct irq_data *data) - { -- /* If we are moving the irq we need to mask it */ -+ /* If we are moving the IRQ we need to mask it */ - if (unlikely(irqd_is_setaffinity_pending(data))) { -- mask_ioapic_irq(data); -+ if (!irqd_irq_masked(data)) -+ mask_ioapic_irq(data); - return true; - } - return false; -@@ -1729,7 +1730,9 @@ static inline void ioapic_irqd_unmask(struct irq_data *data, bool masked) - */ - if (!io_apic_level_ack_pending(data->chip_data)) - irq_move_masked_irq(data); -- unmask_ioapic_irq(data); -+ /* If the IRQ is masked in the core, leave it: */ -+ if (!irqd_irq_masked(data)) -+ unmask_ioapic_irq(data); - } - } - #else -diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c -index b434780ae680..a8f47697276b 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce_amd.c -+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c -@@ -228,10 +228,10 @@ static void smca_configure(unsigned int bank, unsigned int cpu) - } - - /* Return early if this bank was already initialized. */ -- if (smca_banks[bank].hwid) -+ if (smca_banks[bank].hwid && smca_banks[bank].hwid->hwid_mcatype != 0) - return; - -- if (rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { -+ if (rdmsr_safe(MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { - pr_warn("Failed to read MCA_IPID for bank %d\n", bank); - return; - } -diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c -index ee229ceee745..ec6a07b04fdb 100644 ---- a/arch/x86/kernel/cpu/mcheck/therm_throt.c -+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c -@@ -185,7 +185,7 @@ static void therm_throt_process(bool new_event, int event, int level) - /* if we just entered the thermal event */ - if (new_event) { - if (event == THERMAL_THROTTLING_EVENT) -- pr_crit("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", -+ pr_warn("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", - this_cpu, - level == CORE_LEVEL ? "Core" : "Package", - state->count); -diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt -index e0b85930dd77..0a0e9112f284 100644 ---- a/arch/x86/lib/x86-opcode-map.txt -+++ b/arch/x86/lib/x86-opcode-map.txt -@@ -333,7 +333,7 @@ AVXcode: 1 - 06: CLTS - 07: SYSRET (o64) - 08: INVD --09: WBINVD -+09: WBINVD | WBNOINVD (F3) - 0a: - 0b: UD2 (1B) - 0c: -@@ -364,7 +364,7 @@ AVXcode: 1 - # a ModR/M byte. - 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev - 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv --1c: -+1c: Grp20 (1A),(1C) - 1d: - 1e: - 1f: NOP Ev -@@ -792,6 +792,8 @@ f3: Grp17 (1A) - f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) - f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) - f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) -+f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) -+f9: MOVDIRI My,Gy - EndTable - - Table: 3-byte opcode 2 (0x0f 0x3a) -@@ -943,9 +945,9 @@ GrpTable: Grp6 - EndTable - - GrpTable: Grp7 --0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) --1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) --2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) -+0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) -+1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) -+2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) - 3: LIDT Ms - 4: SMSW Mw/Rv - 5: rdpkru (110),(11B) | wrpkru (111),(11B) -@@ -1020,7 +1022,7 @@ GrpTable: Grp15 - 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) - 4: XSAVE | ptwrite Ey (F3),(11B) - 5: XRSTOR | lfence (11B) --6: XSAVEOPT | clwb (66) | mfence (11B) -+6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) - 7: clflush | clflushopt (66) | sfence (11B) - EndTable - -@@ -1051,6 +1053,10 @@ GrpTable: Grp19 - 6: vscatterpf1qps/d Wx (66),(ev) - EndTable - -+GrpTable: Grp20 -+0: cldemote Mb -+EndTable -+ - # AMD's Prefetch Group - GrpTable: GrpP - 0: PREFETCH -diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c -index b4fd36271f90..55338b392221 100644 ---- a/arch/x86/mm/pgtable.c -+++ b/arch/x86/mm/pgtable.c -@@ -590,8 +590,8 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) - fixmaps_set++; - } - --void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys, -- pgprot_t flags) -+void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, -+ phys_addr_t phys, pgprot_t flags) - { - __native_set_fixmap(idx, pfn_pte(phys >> PAGE_SHIFT, flags)); - } -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index cbb162b683b6..08f67c109429 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -6676,6 +6676,9 @@ void ata_host_detach(struct ata_host *host) - { - int i; - -+ /* Ensure ata_port probe has completed */ -+ async_synchronize_full(); -+ - for (i = 0; i < host->n_ports; i++) - ata_port_detach(host->ports[i]); - -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index ec61dd873c93..453e3728e657 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -414,18 +414,20 @@ out_free_page: - return ret; - } - --static int lo_discard(struct loop_device *lo, struct request *rq, loff_t pos) -+static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos, -+ int mode) - { - /* -- * We use punch hole to reclaim the free space used by the -- * image a.k.a. discard. However we do not support discard if -- * encryption is enabled, because it may give an attacker -- * useful information. -+ * We use fallocate to manipulate the space mappings used by the image -+ * a.k.a. discard/zerorange. However we do not support this if -+ * encryption is enabled, because it may give an attacker useful -+ * information. - */ - struct file *file = lo->lo_backing_file; -- int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE; - int ret; - -+ mode |= FALLOC_FL_KEEP_SIZE; -+ - if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) { - ret = -EOPNOTSUPP; - goto out; -@@ -565,9 +567,17 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq) - switch (req_op(rq)) { - case REQ_OP_FLUSH: - return lo_req_flush(lo, rq); -- case REQ_OP_DISCARD: - case REQ_OP_WRITE_ZEROES: -- return lo_discard(lo, rq, pos); -+ /* -+ * If the caller doesn't want deallocation, call zeroout to -+ * write zeroes the range. Otherwise, punch them out. -+ */ -+ return lo_fallocate(lo, rq, pos, -+ (rq->cmd_flags & REQ_NOUNMAP) ? -+ FALLOC_FL_ZERO_RANGE : -+ FALLOC_FL_PUNCH_HOLE); -+ case REQ_OP_DISCARD: -+ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE); - case REQ_OP_WRITE: - if (lo->transfer) - return lo_write_transfer(lo, rq, pos); -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 929bd255a290..4c661ad91e7d 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -1234,10 +1234,10 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b - mutex_unlock(&nbd->config_lock); - ret = wait_event_interruptible(config->recv_wq, - atomic_read(&config->recv_threads) == 0); -- if (ret) { -+ if (ret) - sock_shutdown(nbd); -- flush_workqueue(nbd->recv_workq); -- } -+ flush_workqueue(nbd->recv_workq); -+ - mutex_lock(&nbd->config_lock); - bd_set_size(bdev, 0); - /* user requested, ignore socket errors */ -diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c -index 38b719017186..648e39ce6bd9 100644 ---- a/drivers/char/hw_random/omap3-rom-rng.c -+++ b/drivers/char/hw_random/omap3-rom-rng.c -@@ -121,7 +121,8 @@ static int omap3_rom_rng_remove(struct platform_device *pdev) - { - cancel_delayed_work_sync(&idle_work); - hwrng_unregister(&omap3_rom_rng_ops); -- clk_disable_unprepare(rng_clk); -+ if (!rng_idle) -+ clk_disable_unprepare(rng_clk); - return 0; - } - -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 480e8c13567c..c798a1233e6a 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -2475,6 +2475,13 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) - if (cpufreq_disabled()) - return -ENODEV; - -+ /* -+ * The cpufreq core depends heavily on the availability of device -+ * structure, make sure they are available before proceeding further. -+ */ -+ if (!get_cpu_device(0)) -+ return -EPROBE_DEFER; -+ - if (!driver_data || !driver_data->verify || !driver_data->init || - !(driver_data->setpolicy || driver_data->target_index || - driver_data->target) || -diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c -index 5cf64746731a..22e491857925 100644 ---- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c -+++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c -@@ -81,7 +81,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) - oi = 0; - oo = 0; - do { -- todo = min3(rx_cnt, ileft, (mi.length - oi) / 4); -+ todo = min(rx_cnt, ileft); -+ todo = min_t(size_t, todo, (mi.length - oi) / 4); - if (todo) { - ileft -= todo; - writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo); -@@ -96,7 +97,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) - rx_cnt = SS_RXFIFO_SPACES(spaces); - tx_cnt = SS_TXFIFO_SPACES(spaces); - -- todo = min3(tx_cnt, oleft, (mo.length - oo) / 4); -+ todo = min(tx_cnt, oleft); -+ todo = min_t(size_t, todo, (mo.length - oo) / 4); - if (todo) { - oleft -= todo; - readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); -@@ -220,7 +222,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) - * todo is the number of consecutive 4byte word that we - * can read from current SG - */ -- todo = min3(rx_cnt, ileft / 4, (mi.length - oi) / 4); -+ todo = min(rx_cnt, ileft / 4); -+ todo = min_t(size_t, todo, (mi.length - oi) / 4); - if (todo && !ob) { - writesl(ss->base + SS_RXFIFO, mi.addr + oi, - todo); -@@ -234,8 +237,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) - * we need to be able to write all buf in one - * pass, so it is why we min() with rx_cnt - */ -- todo = min3(rx_cnt * 4 - ob, ileft, -- mi.length - oi); -+ todo = min(rx_cnt * 4 - ob, ileft); -+ todo = min_t(size_t, todo, mi.length - oi); - memcpy(buf + ob, mi.addr + oi, todo); - ileft -= todo; - oi += todo; -@@ -255,7 +258,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) - spaces = readl(ss->base + SS_FCSR); - rx_cnt = SS_RXFIFO_SPACES(spaces); - tx_cnt = SS_TXFIFO_SPACES(spaces); -- dev_dbg(ss->dev, "%x %u/%u %u/%u cnt=%u %u/%u %u/%u cnt=%u %u\n", -+ dev_dbg(ss->dev, -+ "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n", - mode, - oi, mi.length, ileft, areq->cryptlen, rx_cnt, - oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob); -@@ -263,7 +267,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) - if (!tx_cnt) - continue; - /* todo in 4bytes word */ -- todo = min3(tx_cnt, oleft / 4, (mo.length - oo) / 4); -+ todo = min(tx_cnt, oleft / 4); -+ todo = min_t(size_t, todo, (mo.length - oo) / 4); - if (todo) { - readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); - oleft -= todo * 4; -@@ -287,7 +292,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) - * no more than remaining buffer - * no need to test against oleft - */ -- todo = min(mo.length - oo, obl - obo); -+ todo = min_t(size_t, -+ mo.length - oo, obl - obo); - memcpy(mo.addr + oo, bufo + obo, todo); - oleft -= todo; - obo += todo; -diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c -index f6936bb3b7be..1a724263761b 100644 ---- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c -+++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c -@@ -276,8 +276,8 @@ static int sun4i_hash(struct ahash_request *areq) - */ - while (op->len < 64 && i < end) { - /* how many bytes we can read from current SG */ -- in_r = min3(mi.length - in_i, end - i, -- 64 - op->len); -+ in_r = min(end - i, 64 - op->len); -+ in_r = min_t(size_t, mi.length - in_i, in_r); - memcpy(op->buf + op->len, mi.addr + in_i, in_r); - op->len += in_r; - i += in_r; -@@ -297,8 +297,8 @@ static int sun4i_hash(struct ahash_request *areq) - } - if (mi.length - in_i > 3 && i < end) { - /* how many bytes we can read from current SG */ -- in_r = min3(mi.length - in_i, areq->nbytes - i, -- ((mi.length - in_i) / 4) * 4); -+ in_r = min_t(size_t, mi.length - in_i, areq->nbytes - i); -+ in_r = min_t(size_t, ((mi.length - in_i) / 4) * 4, in_r); - /* how many bytes we can write in the device*/ - todo = min3((u32)(end - i) / 4, rx_cnt, (u32)in_r / 4); - writesl(ss->base + SS_RXFIFO, mi.addr + in_i, todo); -@@ -324,8 +324,8 @@ static int sun4i_hash(struct ahash_request *areq) - if ((areq->nbytes - i) < 64) { - while (i < areq->nbytes && in_i < mi.length && op->len < 64) { - /* how many bytes we can read from current SG */ -- in_r = min3(mi.length - in_i, areq->nbytes - i, -- 64 - op->len); -+ in_r = min(areq->nbytes - i, 64 - op->len); -+ in_r = min_t(size_t, mi.length - in_i, in_r); - memcpy(op->buf + op->len, mi.addr + in_i, in_r); - op->len += in_r; - i += in_r; -diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c -index 5035b0dc1e40..e2231a1a05a1 100644 ---- a/drivers/crypto/virtio/virtio_crypto_algs.c -+++ b/drivers/crypto/virtio/virtio_crypto_algs.c -@@ -110,8 +110,6 @@ virtio_crypto_alg_validate_key(int key_len, uint32_t *alg) - *alg = VIRTIO_CRYPTO_CIPHER_AES_CBC; - break; - default: -- pr_err("virtio_crypto: Unsupported key length: %d\n", -- key_len); - return -EINVAL; - } - return 0; -@@ -485,6 +483,11 @@ static int virtio_crypto_ablkcipher_encrypt(struct ablkcipher_request *req) - /* Use the first data virtqueue as default */ - struct data_queue *data_vq = &vcrypto->data_vq[0]; - -+ if (!req->nbytes) -+ return 0; -+ if (req->nbytes % AES_BLOCK_SIZE) -+ return -EINVAL; -+ - vc_req->dataq = data_vq; - vc_req->alg_cb = virtio_crypto_dataq_sym_callback; - vc_sym_req->ablkcipher_ctx = ctx; -@@ -505,6 +508,11 @@ static int virtio_crypto_ablkcipher_decrypt(struct ablkcipher_request *req) - /* Use the first data virtqueue as default */ - struct data_queue *data_vq = &vcrypto->data_vq[0]; - -+ if (!req->nbytes) -+ return 0; -+ if (req->nbytes % AES_BLOCK_SIZE) -+ return -EINVAL; -+ - vc_req->dataq = data_vq; - vc_req->alg_cb = virtio_crypto_dataq_sym_callback; - vc_sym_req->ablkcipher_ctx = ctx; -diff --git a/drivers/crypto/vmx/Makefile b/drivers/crypto/vmx/Makefile -index cab32cfec9c4..709670d2b553 100644 ---- a/drivers/crypto/vmx/Makefile -+++ b/drivers/crypto/vmx/Makefile -@@ -3,13 +3,13 @@ obj-$(CONFIG_CRYPTO_DEV_VMX_ENCRYPT) += vmx-crypto.o - vmx-crypto-objs := vmx.o aesp8-ppc.o ghashp8-ppc.o aes.o aes_cbc.o aes_ctr.o aes_xts.o ghash.o - - ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) --TARGET := linux-ppc64le -+override flavour := linux-ppc64le - else --TARGET := linux-ppc64 -+override flavour := linux-ppc64 - endif - - quiet_cmd_perl = PERL $@ -- cmd_perl = $(PERL) $(<) $(TARGET) > $(@) -+ cmd_perl = $(PERL) $(<) $(flavour) > $(@) - - targets += aesp8-ppc.S ghashp8-ppc.S - -diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c -index 6f80eb65c26c..acae39278669 100644 ---- a/drivers/edac/ghes_edac.c -+++ b/drivers/edac/ghes_edac.c -@@ -187,6 +187,7 @@ void ghes_edac_report_mem_error(struct ghes *ghes, int sev, - /* Cleans the error report buffer */ - memset(e, 0, sizeof (*e)); - e->error_count = 1; -+ e->grain = 1; - strcpy(e->label, "unknown label"); - e->msg = pvt->msg; - e->other_detail = pvt->other_detail; -@@ -282,7 +283,7 @@ void ghes_edac_report_mem_error(struct ghes *ghes, int sev, - - /* Error grain */ - if (mem_err->validation_bits & CPER_MEM_VALID_PA_MASK) -- e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK); -+ e->grain = ~mem_err->physical_addr_mask + 1; - - /* Memory error location, mapped on e->location */ - p = e->location; -@@ -389,8 +390,13 @@ void ghes_edac_report_mem_error(struct ghes *ghes, int sev, - if (p > pvt->other_detail) - *(p - 1) = '\0'; - -+ /* Sanity-check driver-supplied grain value. */ -+ if (WARN_ON_ONCE(!e->grain)) -+ e->grain = 1; -+ -+ grain_bits = fls_long(e->grain - 1); -+ - /* Generate the trace event */ -- grain_bits = fls_long(e->grain); - snprintf(pvt->detail_location, sizeof(pvt->detail_location), - "APEI location: %s %s", e->location, e->other_detail); - trace_mc_event(type, e->msg, e->label, e->error_count, -diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c -index 106ef0297b53..1a1ee3db3455 100644 ---- a/drivers/extcon/extcon-sm5502.c -+++ b/drivers/extcon/extcon-sm5502.c -@@ -69,6 +69,10 @@ struct sm5502_muic_info { - /* Default value of SM5502 register to bring up MUIC device. */ - static struct reg_data sm5502_reg_data[] = { - { -+ .reg = SM5502_REG_RESET, -+ .val = SM5502_REG_RESET_MASK, -+ .invert = true, -+ }, { - .reg = SM5502_REG_CONTROL, - .val = SM5502_REG_CONTROL_MASK_INT_MASK, - .invert = false, -diff --git a/drivers/extcon/extcon-sm5502.h b/drivers/extcon/extcon-sm5502.h -index 974b53222f56..12f8b01e5753 100644 ---- a/drivers/extcon/extcon-sm5502.h -+++ b/drivers/extcon/extcon-sm5502.h -@@ -241,6 +241,8 @@ enum sm5502_reg { - #define DM_DP_SWITCH_UART ((DM_DP_CON_SWITCH_UART <dvdd10 = devm_regulator_get(dev, "dvdd10"); - if (IS_ERR(pdata->dvdd10)) { -- DRM_ERROR("DVDD10 regulator not found\n"); -+ if (PTR_ERR(pdata->dvdd10) != -EPROBE_DEFER) -+ DRM_ERROR("DVDD10 regulator not found\n"); -+ - return PTR_ERR(pdata->dvdd10); - } - -@@ -1344,7 +1346,9 @@ static int anx78xx_i2c_probe(struct i2c_client *client, - - err = anx78xx_init_pdata(anx78xx); - if (err) { -- DRM_ERROR("Failed to initialize pdata: %d\n", err); -+ if (err != -EPROBE_DEFER) -+ DRM_ERROR("Failed to initialize pdata: %d\n", err); -+ - return err; - } - -diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -index 4db31b89507c..cc1094f90125 100644 ---- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -+++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c -@@ -39,6 +39,7 @@ - - #include - -+#define DDC_CI_ADDR 0x37 - #define DDC_SEGMENT_ADDR 0x30 - - #define HDMI_EDID_LEN 512 -@@ -320,6 +321,15 @@ static int dw_hdmi_i2c_xfer(struct i2c_adapter *adap, - u8 addr = msgs[0].addr; - int i, ret = 0; - -+ if (addr == DDC_CI_ADDR) -+ /* -+ * The internal I2C controller does not support the multi-byte -+ * read and write operations needed for DDC/CI. -+ * TOFIX: Blacklist the DDC/CI address until we filter out -+ * unsupported I2C operations. -+ */ -+ return -EOPNOTSUPP; -+ - dev_dbg(hdmi->dev, "xfer: num: %d, addr: %#x\n", num, addr); - - for (i = 0; i < num; i++) { -@@ -1733,7 +1743,7 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode) - - /* HDMI Initialization Step E - Configure audio */ - hdmi_clk_regenerator_update_pixel_clock(hdmi); -- hdmi_enable_audio_clk(hdmi, true); -+ hdmi_enable_audio_clk(hdmi, hdmi->audio_enable); - } - - /* not for DVI mode */ -diff --git a/drivers/gpu/drm/gma500/oaktrail_crtc.c b/drivers/gpu/drm/gma500/oaktrail_crtc.c -index 0fff269d3fe6..42785f3df60f 100644 ---- a/drivers/gpu/drm/gma500/oaktrail_crtc.c -+++ b/drivers/gpu/drm/gma500/oaktrail_crtc.c -@@ -139,6 +139,7 @@ static bool mrst_sdvo_find_best_pll(const struct gma_limit_t *limit, - s32 freq_error, min_error = 100000; - - memset(best_clock, 0, sizeof(*best_clock)); -+ memset(&clock, 0, sizeof(clock)); - - for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { - for (clock.n = limit->n.min; clock.n <= limit->n.max; -@@ -195,6 +196,7 @@ static bool mrst_lvds_find_best_pll(const struct gma_limit_t *limit, - int err = target; - - memset(best_clock, 0, sizeof(*best_clock)); -+ memset(&clock, 0, sizeof(clock)); - - for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { - for (clock.p1 = limit->p1.min; clock.p1 <= limit->p1.max; -diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c -index acd99783bbca..67f3c050c4cf 100644 ---- a/drivers/gpu/host1x/job.c -+++ b/drivers/gpu/host1x/job.c -@@ -545,7 +545,8 @@ out: - return err; - } - --static inline int copy_gathers(struct host1x_job *job, struct device *dev) -+static inline int copy_gathers(struct device *host, struct host1x_job *job, -+ struct device *dev) - { - struct host1x_firewall fw; - size_t size = 0; -@@ -570,12 +571,12 @@ static inline int copy_gathers(struct host1x_job *job, struct device *dev) - * Try a non-blocking allocation from a higher priority pools first, - * as awaiting for the allocation here is a major performance hit. - */ -- job->gather_copy_mapped = dma_alloc_wc(dev, size, &job->gather_copy, -+ job->gather_copy_mapped = dma_alloc_wc(host, size, &job->gather_copy, - GFP_NOWAIT); - - /* the higher priority allocation failed, try the generic-blocking */ - if (!job->gather_copy_mapped) -- job->gather_copy_mapped = dma_alloc_wc(dev, size, -+ job->gather_copy_mapped = dma_alloc_wc(host, size, - &job->gather_copy, - GFP_KERNEL); - if (!job->gather_copy_mapped) -@@ -636,7 +637,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev) - goto out; - - if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) { -- err = copy_gathers(job, dev); -+ err = copy_gathers(host->dev, job, dev); - if (err) - goto out; - } -@@ -701,7 +702,7 @@ void host1x_job_unpin(struct host1x_job *job) - job->num_unpins = 0; - - if (job->gather_copy_size) -- dma_free_wc(job->channel->dev, job->gather_copy_size, -+ dma_free_wc(host->dev, job->gather_copy_size, - job->gather_copy_mapped, job->gather_copy); - } - EXPORT_SYMBOL(host1x_job_unpin); -diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c -index c224b92a80f1..fc371444407d 100644 ---- a/drivers/hwtracing/intel_th/pci.c -+++ b/drivers/hwtracing/intel_th/pci.c -@@ -188,6 +188,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x06a6), - .driver_data = (kernel_ulong_t)&intel_th_2x, - }, -+ { -+ /* Comet Lake PCH-V */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa3a6), -+ .driver_data = (kernel_ulong_t)&intel_th_2x, -+ }, - { - /* Ice Lake NNPI */ - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5), -@@ -213,6 +218,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6), - .driver_data = (kernel_ulong_t)&intel_th_2x, - }, -+ { -+ /* Elkhart Lake */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26), -+ .driver_data = (kernel_ulong_t)&intel_th_2x, -+ }, - { 0 }, - }; - -diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c -index ab8d6aed5085..2a299bbd6acf 100644 ---- a/drivers/iio/adc/dln2-adc.c -+++ b/drivers/iio/adc/dln2-adc.c -@@ -528,6 +528,10 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) - u16 conflict; - unsigned int trigger_chan; - -+ ret = iio_triggered_buffer_postenable(indio_dev); -+ if (ret) -+ return ret; -+ - mutex_lock(&dln2->mutex); - - /* Enable ADC */ -@@ -541,6 +545,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) - (int)conflict); - ret = -EBUSY; - } -+ iio_triggered_buffer_predisable(indio_dev); - return ret; - } - -@@ -554,6 +559,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) - mutex_unlock(&dln2->mutex); - if (ret < 0) { - dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); -+ iio_triggered_buffer_predisable(indio_dev); - return ret; - } - } else { -@@ -561,12 +567,12 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) - mutex_unlock(&dln2->mutex); - } - -- return iio_triggered_buffer_postenable(indio_dev); -+ return 0; - } - - static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) - { -- int ret; -+ int ret, ret2; - struct dln2_adc *dln2 = iio_priv(indio_dev); - - mutex_lock(&dln2->mutex); -@@ -581,12 +587,14 @@ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) - ret = dln2_adc_set_port_enabled(dln2, false, NULL); - - mutex_unlock(&dln2->mutex); -- if (ret < 0) { -+ if (ret < 0) - dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); -- return ret; -- } - -- return iio_triggered_buffer_predisable(indio_dev); -+ ret2 = iio_triggered_buffer_predisable(indio_dev); -+ if (ret == 0) -+ ret = ret2; -+ -+ return ret; - } - - static const struct iio_buffer_setup_ops dln2_adc_buffer_setup_ops = { -diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c -index ebc715927e63..03af02769370 100644 ---- a/drivers/iio/adc/max1027.c -+++ b/drivers/iio/adc/max1027.c -@@ -462,6 +462,14 @@ static int max1027_probe(struct spi_device *spi) - goto fail_dev_register; - } - -+ /* Internal reset */ -+ st->reg = MAX1027_RST_REG; -+ ret = spi_write(st->spi, &st->reg, 1); -+ if (ret < 0) { -+ dev_err(&indio_dev->dev, "Failed to reset the ADC\n"); -+ return ret; -+ } -+ - /* Disable averaging */ - st->reg = MAX1027_AVG_REG; - ret = spi_write(st->spi, &st->reg, 1); -diff --git a/drivers/iio/light/bh1750.c b/drivers/iio/light/bh1750.c -index 6c61187e630f..0b7ba02c8d16 100644 ---- a/drivers/iio/light/bh1750.c -+++ b/drivers/iio/light/bh1750.c -@@ -62,9 +62,9 @@ struct bh1750_chip_info { - - u16 int_time_low_mask; - u16 int_time_high_mask; --} -+}; - --static const bh1750_chip_info_tbl[] = { -+static const struct bh1750_chip_info bh1750_chip_info_tbl[] = { - [BH1710] = { 140, 1022, 300, 400, 250000000, 2, 0x001F, 0x03E0 }, - [BH1721] = { 140, 1020, 300, 400, 250000000, 2, 0x0010, 0x03E0 }, - [BH1750] = { 31, 254, 69, 1740, 57500000, 1, 0x001F, 0x00E0 }, -diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c -index 7f4cc9336442..656e7c1a4449 100644 ---- a/drivers/infiniband/hw/qedr/verbs.c -+++ b/drivers/infiniband/hw/qedr/verbs.c -@@ -1343,6 +1343,14 @@ static void qedr_cleanup_user(struct qedr_dev *dev, struct qedr_qp *qp) - if (qp->urq.umem) - ib_umem_release(qp->urq.umem); - qp->urq.umem = NULL; -+ -+ if (rdma_protocol_roce(&dev->ibdev, 1)) { -+ qedr_free_pbl(dev, &qp->usq.pbl_info, qp->usq.pbl_tbl); -+ qedr_free_pbl(dev, &qp->urq.pbl_info, qp->urq.pbl_tbl); -+ } else { -+ kfree(qp->usq.pbl_tbl); -+ kfree(qp->urq.pbl_tbl); -+ } - } - - static int qedr_create_user_qp(struct qedr_dev *dev, -@@ -2331,8 +2339,8 @@ int qedr_dereg_mr(struct ib_mr *ib_mr) - - dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid); - -- if ((mr->type != QEDR_MR_DMA) && (mr->type != QEDR_MR_FRMR)) -- qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table); -+ if (mr->type != QEDR_MR_DMA) -+ free_mr_info(dev, &mr->info); - - /* it could be user registered memory. */ - if (mr->umem) -diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c -index 19624e023ebd..b5a789567b4e 100644 ---- a/drivers/infiniband/ulp/iser/iscsi_iser.c -+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c -@@ -648,6 +648,7 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, - if (ib_conn->pi_support) { - u32 sig_caps = ib_conn->device->ib_device->attrs.sig_prot_cap; - -+ shost->sg_prot_tablesize = shost->sg_tablesize; - scsi_host_set_prot(shost, iser_dif_prot_caps(sig_caps)); - scsi_host_set_guard(shost, SHOST_DIX_GUARD_IP | - SHOST_DIX_GUARD_CRC); -diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c -index ce23f436e130..44b0584eb8a6 100644 ---- a/drivers/media/i2c/ov2659.c -+++ b/drivers/media/i2c/ov2659.c -@@ -419,10 +419,14 @@ static struct sensor_register ov2659_720p[] = { - { REG_TIMING_YINC, 0x11 }, - { REG_TIMING_VERT_FORMAT, 0x80 }, - { REG_TIMING_HORIZ_FORMAT, 0x00 }, -+ { 0x370a, 0x12 }, - { 0x3a03, 0xe8 }, - { 0x3a09, 0x6f }, - { 0x3a0b, 0x5d }, - { 0x3a15, 0x9a }, -+ { REG_VFIFO_READ_START_H, 0x00 }, -+ { REG_VFIFO_READ_START_L, 0x80 }, -+ { REG_ISP_CTRL02, 0x00 }, - { REG_NULL, 0x00 }, - }; - -@@ -1203,11 +1207,15 @@ static int ov2659_s_stream(struct v4l2_subdev *sd, int on) - goto unlock; - } - -- ov2659_set_pixel_clock(ov2659); -- ov2659_set_frame_size(ov2659); -- ov2659_set_format(ov2659); -- ov2659_set_streaming(ov2659, 1); -- ov2659->streaming = on; -+ ret = ov2659_set_pixel_clock(ov2659); -+ if (!ret) -+ ret = ov2659_set_frame_size(ov2659); -+ if (!ret) -+ ret = ov2659_set_format(ov2659); -+ if (!ret) { -+ ov2659_set_streaming(ov2659, 1); -+ ov2659->streaming = on; -+ } - - unlock: - mutex_unlock(&ov2659->lock); -diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c -index 025869eec2ac..348296be4925 100644 ---- a/drivers/media/i2c/ov6650.c -+++ b/drivers/media/i2c/ov6650.c -@@ -469,38 +469,39 @@ static int ov6650_set_selection(struct v4l2_subdev *sd, - { - struct i2c_client *client = v4l2_get_subdevdata(sd); - struct ov6650 *priv = to_ov6650(client); -- struct v4l2_rect rect = sel->r; - int ret; - - if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE || - sel->target != V4L2_SEL_TGT_CROP) - return -EINVAL; - -- v4l_bound_align_image(&rect.width, 2, W_CIF, 1, -- &rect.height, 2, H_CIF, 1, 0); -- v4l_bound_align_image(&rect.left, DEF_HSTRT << 1, -- (DEF_HSTRT << 1) + W_CIF - (__s32)rect.width, 1, -- &rect.top, DEF_VSTRT << 1, -- (DEF_VSTRT << 1) + H_CIF - (__s32)rect.height, 1, -- 0); -+ v4l_bound_align_image(&sel->r.width, 2, W_CIF, 1, -+ &sel->r.height, 2, H_CIF, 1, 0); -+ v4l_bound_align_image(&sel->r.left, DEF_HSTRT << 1, -+ (DEF_HSTRT << 1) + W_CIF - (__s32)sel->r.width, 1, -+ &sel->r.top, DEF_VSTRT << 1, -+ (DEF_VSTRT << 1) + H_CIF - (__s32)sel->r.height, -+ 1, 0); - -- ret = ov6650_reg_write(client, REG_HSTRT, rect.left >> 1); -+ ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1); - if (!ret) { -- priv->rect.left = rect.left; -+ priv->rect.width += priv->rect.left - sel->r.left; -+ priv->rect.left = sel->r.left; - ret = ov6650_reg_write(client, REG_HSTOP, -- (rect.left + rect.width) >> 1); -+ (sel->r.left + sel->r.width) >> 1); - } - if (!ret) { -- priv->rect.width = rect.width; -- ret = ov6650_reg_write(client, REG_VSTRT, rect.top >> 1); -+ priv->rect.width = sel->r.width; -+ ret = ov6650_reg_write(client, REG_VSTRT, sel->r.top >> 1); - } - if (!ret) { -- priv->rect.top = rect.top; -+ priv->rect.height += priv->rect.top - sel->r.top; -+ priv->rect.top = sel->r.top; - ret = ov6650_reg_write(client, REG_VSTOP, -- (rect.top + rect.height) >> 1); -+ (sel->r.top + sel->r.height) >> 1); - } - if (!ret) -- priv->rect.height = rect.height; -+ priv->rect.height = sel->r.height; - - return ret; - } -@@ -614,7 +615,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) - dev_err(&client->dev, "Pixel format not handled: 0x%x\n", code); - return -EINVAL; - } -- priv->code = code; - - if (code == MEDIA_BUS_FMT_Y8_1X8 || - code == MEDIA_BUS_FMT_SBGGR8_1X8) { -@@ -640,7 +640,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) - dev_dbg(&client->dev, "max resolution: CIF\n"); - coma_mask |= COMA_QCIF; - } -- priv->half_scale = half_scale; - - clkrc = CLKRC_12MHz; - mclk = 12000000; -@@ -658,8 +657,13 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) - ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask); - if (!ret) - ret = ov6650_reg_write(client, REG_CLKRC, clkrc); -- if (!ret) -+ if (!ret) { -+ priv->half_scale = half_scale; -+ - ret = ov6650_reg_rmw(client, REG_COML, coml_set, coml_mask); -+ } -+ if (!ret) -+ priv->code = code; - - if (!ret) { - mf->colorspace = priv->colorspace; -diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c -index 7d25ecd4404b..1748812bd7e5 100644 ---- a/drivers/media/pci/cx88/cx88-video.c -+++ b/drivers/media/pci/cx88/cx88-video.c -@@ -1310,7 +1310,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, - core = cx88_core_get(dev->pci); - if (!core) { - err = -EINVAL; -- goto fail_free; -+ goto fail_disable; - } - dev->core = core; - -@@ -1356,7 +1356,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, - cc->step, cc->default_value); - if (!vc) { - err = core->audio_hdl.error; -- goto fail_core; -+ goto fail_irq; - } - vc->priv = (void *)cc; - } -@@ -1370,7 +1370,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, - cc->step, cc->default_value); - if (!vc) { - err = core->video_hdl.error; -- goto fail_core; -+ goto fail_irq; - } - vc->priv = (void *)cc; - if (vc->id == V4L2_CID_CHROMA_AGC) -@@ -1533,11 +1533,14 @@ static int cx8800_initdev(struct pci_dev *pci_dev, - - fail_unreg: - cx8800_unregister_video(dev); -- free_irq(pci_dev->irq, dev); - mutex_unlock(&core->lock); -+fail_irq: -+ free_irq(pci_dev->irq, dev); - fail_core: - core->v4ldev = NULL; - cx88_core_put(core, dev->pci); -+fail_disable: -+ pci_disable_device(pci_dev); - fail_free: - kfree(dev); - return err; -diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c -index dfcc484cab89..e92c5b56be42 100644 ---- a/drivers/media/platform/am437x/am437x-vpfe.c -+++ b/drivers/media/platform/am437x/am437x-vpfe.c -@@ -1848,6 +1848,10 @@ static int vpfe_s_std(struct file *file, void *priv, v4l2_std_id std_id) - if (!(sdinfo->inputs[0].capabilities & V4L2_IN_CAP_STD)) - return -ENODATA; - -+ /* if trying to set the same std then nothing to do */ -+ if (vpfe_standards[vpfe->std_index].std_id == std_id) -+ return 0; -+ - /* If streaming is started, return error */ - if (vb2_is_busy(&vpfe->buffer_queue)) { - vpfe_err(vpfe, "%s device busy\n", __func__); -diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c -index 769e9e68562d..9360b36b82cd 100644 ---- a/drivers/media/platform/qcom/venus/core.c -+++ b/drivers/media/platform/qcom/venus/core.c -@@ -345,10 +345,11 @@ static const struct venus_resources msm8916_res = { - }; - - static const struct freq_tbl msm8996_freq_table[] = { -- { 1944000, 490000000 }, /* 4k UHD @ 60 */ -- { 972000, 320000000 }, /* 4k UHD @ 30 */ -- { 489600, 150000000 }, /* 1080p @ 60 */ -- { 244800, 75000000 }, /* 1080p @ 30 */ -+ { 1944000, 520000000 }, /* 4k UHD @ 60 (decode only) */ -+ { 972000, 520000000 }, /* 4k UHD @ 30 */ -+ { 489600, 346666667 }, /* 1080p @ 60 */ -+ { 244800, 150000000 }, /* 1080p @ 30 */ -+ { 108000, 75000000 }, /* 720p @ 30 */ - }; - - static const struct reg_val msm8996_reg_preset[] = { -diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c -index 522364ff0d5d..3871ed6a1fcb 100644 ---- a/drivers/media/platform/rcar_drif.c -+++ b/drivers/media/platform/rcar_drif.c -@@ -915,6 +915,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, - { - struct rcar_drif_sdr *sdr = video_drvdata(file); - -+ memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); - f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; - f->fmt.sdr.buffersize = sdr->fmt->buffersize; - -diff --git a/drivers/media/platform/ti-vpe/vpdma.h b/drivers/media/platform/ti-vpe/vpdma.h -index 7e611501c291..f29074c84915 100644 ---- a/drivers/media/platform/ti-vpe/vpdma.h -+++ b/drivers/media/platform/ti-vpe/vpdma.h -@@ -60,6 +60,7 @@ struct vpdma_data_format { - * line stride of source and dest - * buffers should be 16 byte aligned - */ -+#define VPDMA_MAX_STRIDE 65520 /* Max line stride 16 byte aligned */ - #define VPDMA_DTD_DESC_SIZE 32 /* 8 words */ - #define VPDMA_CFD_CTD_DESC_SIZE 16 /* 4 words */ - -diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c -index 45bd10544189..2e8970c7e22d 100644 ---- a/drivers/media/platform/ti-vpe/vpe.c -+++ b/drivers/media/platform/ti-vpe/vpe.c -@@ -352,20 +352,25 @@ enum { - }; - - /* find our format description corresponding to the passed v4l2_format */ --static struct vpe_fmt *find_format(struct v4l2_format *f) -+static struct vpe_fmt *__find_format(u32 fourcc) - { - struct vpe_fmt *fmt; - unsigned int k; - - for (k = 0; k < ARRAY_SIZE(vpe_formats); k++) { - fmt = &vpe_formats[k]; -- if (fmt->fourcc == f->fmt.pix.pixelformat) -+ if (fmt->fourcc == fourcc) - return fmt; - } - - return NULL; - } - -+static struct vpe_fmt *find_format(struct v4l2_format *f) -+{ -+ return __find_format(f->fmt.pix.pixelformat); -+} -+ - /* - * there is one vpe_dev structure in the driver, it is shared by - * all instances. -@@ -1044,11 +1049,14 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) - dma_addr_t dma_addr; - u32 flags = 0; - u32 offset = 0; -+ u32 stride; - - if (port == VPE_PORT_MV_OUT) { - vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; - dma_addr = ctx->mv_buf_dma[mv_buf_selector]; - q_data = &ctx->q_data[Q_DATA_SRC]; -+ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, -+ VPDMA_STRIDE_ALIGN); - } else { - /* to incorporate interleaved formats */ - int plane = fmt->coplanar ? p_data->vb_part : 0; -@@ -1075,6 +1083,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) - } - /* Apply the offset */ - dma_addr += offset; -+ stride = q_data->bytesperline[VPE_LUMA]; - } - - if (q_data->flags & Q_DATA_FRAME_1D) -@@ -1086,7 +1095,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) - MAX_W, MAX_H); - - vpdma_add_out_dtd(&ctx->desc_list, q_data->width, -- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, -+ stride, &q_data->c_rect, - vpdma_fmt, dma_addr, MAX_OUT_WIDTH_REG1, - MAX_OUT_HEIGHT_REG1, p_data->channel, flags); - } -@@ -1105,10 +1114,13 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) - dma_addr_t dma_addr; - u32 flags = 0; - u32 offset = 0; -+ u32 stride; - - if (port == VPE_PORT_MV_IN) { - vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; - dma_addr = ctx->mv_buf_dma[mv_buf_selector]; -+ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, -+ VPDMA_STRIDE_ALIGN); - } else { - /* to incorporate interleaved formats */ - int plane = fmt->coplanar ? p_data->vb_part : 0; -@@ -1135,6 +1147,7 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) - } - /* Apply the offset */ - dma_addr += offset; -+ stride = q_data->bytesperline[VPE_LUMA]; - - if (q_data->flags & Q_DATA_INTERLACED_SEQ_TB) { - /* -@@ -1170,10 +1183,10 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) - if (p_data->vb_part && fmt->fourcc == V4L2_PIX_FMT_NV12) - frame_height /= 2; - -- vpdma_add_in_dtd(&ctx->desc_list, q_data->width, -- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, -- vpdma_fmt, dma_addr, p_data->channel, field, flags, frame_width, -- frame_height, 0, 0); -+ vpdma_add_in_dtd(&ctx->desc_list, q_data->width, stride, -+ &q_data->c_rect, vpdma_fmt, dma_addr, -+ p_data->channel, field, flags, frame_width, -+ frame_height, 0, 0); - } - - /* -@@ -1422,9 +1435,6 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) - /* the previous dst mv buffer becomes the next src mv buffer */ - ctx->src_mv_buf_selector = !ctx->src_mv_buf_selector; - -- if (ctx->aborting) -- goto finished; -- - s_vb = ctx->src_vbs[0]; - d_vb = ctx->dst_vb; - -@@ -1435,6 +1445,7 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) - d_vb->timecode = s_vb->timecode; - - d_vb->sequence = ctx->sequence; -+ s_vb->sequence = ctx->sequence; - - d_q_data = &ctx->q_data[Q_DATA_DST]; - if (d_q_data->flags & Q_IS_INTERLACED) { -@@ -1488,6 +1499,9 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) - ctx->src_vbs[0] = NULL; - ctx->dst_vb = NULL; - -+ if (ctx->aborting) -+ goto finished; -+ - ctx->bufs_completed++; - if (ctx->bufs_completed < ctx->bufs_per_job && job_ready(ctx)) { - device_run(ctx); -@@ -1600,9 +1614,9 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, - unsigned int stride = 0; - - if (!fmt || !(fmt->types & type)) { -- vpe_err(ctx->dev, "Fourcc format (0x%08x) invalid.\n", -+ vpe_dbg(ctx->dev, "Fourcc format (0x%08x) invalid.\n", - pix->pixelformat); -- return -EINVAL; -+ fmt = __find_format(V4L2_PIX_FMT_YUYV); - } - - if (pix->field != V4L2_FIELD_NONE && pix->field != V4L2_FIELD_ALTERNATE -@@ -1649,7 +1663,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, - &pix->height, MIN_H, MAX_H, H_ALIGN, - S_ALIGN); - -- if (!pix->num_planes) -+ if (!pix->num_planes || pix->num_planes > 2) - pix->num_planes = fmt->coplanar ? 2 : 1; - else if (pix->num_planes > 1 && !fmt->coplanar) - pix->num_planes = 1; -@@ -1688,6 +1702,10 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, - if (stride > plane_fmt->bytesperline) - plane_fmt->bytesperline = stride; - -+ plane_fmt->bytesperline = clamp_t(u32, plane_fmt->bytesperline, -+ stride, -+ VPDMA_MAX_STRIDE); -+ - plane_fmt->bytesperline = ALIGN(plane_fmt->bytesperline, - VPDMA_STRIDE_ALIGN); - -@@ -2308,7 +2326,7 @@ static int vpe_open(struct file *file) - v4l2_ctrl_handler_setup(hdl); - - s_q_data = &ctx->q_data[Q_DATA_SRC]; -- s_q_data->fmt = &vpe_formats[2]; -+ s_q_data->fmt = __find_format(V4L2_PIX_FMT_YUYV); - s_q_data->width = 1920; - s_q_data->height = 1080; - s_q_data->nplanes = 1; -@@ -2386,6 +2404,12 @@ static int vpe_release(struct file *file) - - mutex_lock(&dev->dev_mutex); - free_mv_buffers(ctx); -+ -+ vpdma_unmap_desc_buf(dev->vpdma, &ctx->desc_list.buf); -+ vpdma_unmap_desc_buf(dev->vpdma, &ctx->mmr_adb); -+ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_h); -+ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_v); -+ - vpdma_free_desc_list(&ctx->desc_list); - vpdma_free_desc_buf(&ctx->mmr_adb); - -diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c -index 8ce6f9cff746..b60fb6ed5aeb 100644 ---- a/drivers/media/radio/si470x/radio-si470x-i2c.c -+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c -@@ -455,6 +455,8 @@ static int si470x_i2c_remove(struct i2c_client *client) - video_unregister_device(&radio->videodev); - kfree(radio); - -+ v4l2_ctrl_handler_free(&radio->hdl); -+ v4l2_device_unregister(&radio->v4l2_dev); - return 0; - } - -diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c -index ac4fddfd0a43..f1807c16438d 100644 ---- a/drivers/media/usb/b2c2/flexcop-usb.c -+++ b/drivers/media/usb/b2c2/flexcop-usb.c -@@ -503,7 +503,13 @@ urb_error: - static int flexcop_usb_init(struct flexcop_usb *fc_usb) - { - /* use the alternate setting with the larges buffer */ -- usb_set_interface(fc_usb->udev,0,1); -+ int ret = usb_set_interface(fc_usb->udev, 0, 1); -+ -+ if (ret) { -+ err("set interface failed."); -+ return ret; -+ } -+ - switch (fc_usb->udev->speed) { - case USB_SPEED_LOW: - err("cannot handle USB speed because it is too slow."); -diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c -index 4320bda9352d..e0413db26781 100644 ---- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c -+++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c -@@ -915,8 +915,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp) - pvr2_v4l2_dev_disassociate_parent(vp->dev_video); - pvr2_v4l2_dev_disassociate_parent(vp->dev_radio); - if (!list_empty(&vp->dev_video->devbase.fh_list) || -- !list_empty(&vp->dev_radio->devbase.fh_list)) -+ (vp->dev_radio && -+ !list_empty(&vp->dev_radio->devbase.fh_list))) { -+ pvr2_trace(PVR2_TRACE_STRUCT, -+ "pvr2_v4l2 internal_check exit-empty id=%p", vp); - return; -+ } - pvr2_v4l2_destroy_no_lock(vp); - } - -@@ -990,7 +994,8 @@ static int pvr2_v4l2_release(struct file *file) - kfree(fhp); - if (vp->channel.mc_head->disconnect_flag && - list_empty(&vp->dev_video->devbase.fh_list) && -- list_empty(&vp->dev_radio->devbase.fh_list)) { -+ (!vp->dev_radio || -+ list_empty(&vp->dev_radio->devbase.fh_list))) { - pvr2_v4l2_destroy_no_lock(vp); - } - return 0; -diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c -index 681eef972e63..7cafc8a57950 100644 ---- a/drivers/media/v4l2-core/v4l2-ioctl.c -+++ b/drivers/media/v4l2-core/v4l2-ioctl.c -@@ -1363,10 +1363,26 @@ static int v4l_enum_fmt(const struct v4l2_ioctl_ops *ops, - return ret; - } - -+static void v4l_pix_format_touch(struct v4l2_pix_format *p) -+{ -+ /* -+ * The v4l2_pix_format structure contains fields that make no sense for -+ * touch. Set them to default values in this case. -+ */ -+ -+ p->field = V4L2_FIELD_NONE; -+ p->colorspace = V4L2_COLORSPACE_RAW; -+ p->flags = 0; -+ p->ycbcr_enc = 0; -+ p->quantization = 0; -+ p->xfer_func = 0; -+} -+ - static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, - struct file *file, void *fh, void *arg) - { - struct v4l2_format *p = arg; -+ struct video_device *vfd = video_devdata(file); - int ret = check_fmt(file, p->type); - - if (ret) -@@ -1404,6 +1420,8 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, - ret = ops->vidioc_g_fmt_vid_cap(file, fh, arg); - /* just in case the driver zeroed it again */ - p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC; -+ if (vfd->vfl_type == VFL_TYPE_TOUCH) -+ v4l_pix_format_touch(&p->fmt.pix); - return ret; - case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: - return ops->vidioc_g_fmt_vid_cap_mplane(file, fh, arg); -@@ -1439,21 +1457,6 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, - return -EINVAL; - } - --static void v4l_pix_format_touch(struct v4l2_pix_format *p) --{ -- /* -- * The v4l2_pix_format structure contains fields that make no sense for -- * touch. Set them to default values in this case. -- */ -- -- p->field = V4L2_FIELD_NONE; -- p->colorspace = V4L2_COLORSPACE_RAW; -- p->flags = 0; -- p->ycbcr_enc = 0; -- p->quantization = 0; -- p->xfer_func = 0; --} -- - static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops, - struct file *file, void *fh, void *arg) - { -diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c -index a2ac9938d945..1a5d5c40324b 100644 ---- a/drivers/mmc/host/mtk-sd.c -+++ b/drivers/mmc/host/mtk-sd.c -@@ -212,6 +212,8 @@ - #define MSDC_PATCH_BIT_SPCPUSH (0x1 << 29) /* RW */ - #define MSDC_PATCH_BIT_DECRCTMO (0x1 << 30) /* RW */ - -+#define MSDC_PATCH_BIT1_CMDTA (0x7 << 3) /* RW */ -+ - #define MSDC_PAD_TUNE_DATWRDLY (0x1f << 0) /* RW */ - #define MSDC_PAD_TUNE_DATRRDLY (0x1f << 8) /* RW */ - #define MSDC_PAD_TUNE_CMDRDLY (0x1f << 16) /* RW */ -@@ -1442,6 +1444,7 @@ static int hs400_tune_response(struct mmc_host *mmc, u32 opcode) - - /* select EMMC50 PAD CMD tune */ - sdr_set_bits(host->base + PAD_CMD_TUNE, BIT(0)); -+ sdr_set_field(host->base + MSDC_PATCH_BIT1, MSDC_PATCH_BIT1_CMDTA, 2); - - if (mmc->ios.timing == MMC_TIMING_MMC_HS200 || - mmc->ios.timing == MMC_TIMING_UHS_SDR104) -diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c -index 176cbc67d08a..9a1ab39ee35e 100644 ---- a/drivers/mmc/host/sdhci-of-esdhc.c -+++ b/drivers/mmc/host/sdhci-of-esdhc.c -@@ -615,9 +615,6 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask) - sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); - sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE); - -- if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) -- mdelay(5); -- - if (mask & SDHCI_RESET_ALL) { - val = sdhci_readl(host, ESDHC_TBCTL); - val &= ~ESDHC_TB_EN; -@@ -889,8 +886,8 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) - host->quirks &= ~SDHCI_QUIRK_NO_BUSY_IRQ; - - if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) { -- host->quirks2 |= SDHCI_QUIRK_RESET_AFTER_REQUEST; -- host->quirks2 |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; -+ host->quirks |= SDHCI_QUIRK_RESET_AFTER_REQUEST; -+ host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; - } - - if (of_device_is_compatible(np, "fsl,p5040-esdhc") || -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 5807028c8309..645775dd4edb 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -1635,9 +1635,7 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing) - ctrl_2 |= SDHCI_CTRL_UHS_SDR104; - else if (timing == MMC_TIMING_UHS_SDR12) - ctrl_2 |= SDHCI_CTRL_UHS_SDR12; -- else if (timing == MMC_TIMING_SD_HS || -- timing == MMC_TIMING_MMC_HS || -- timing == MMC_TIMING_UHS_SDR25) -+ else if (timing == MMC_TIMING_UHS_SDR25) - ctrl_2 |= SDHCI_CTRL_UHS_SDR25; - else if (timing == MMC_TIMING_UHS_SDR50) - ctrl_2 |= SDHCI_CTRL_UHS_SDR50; -@@ -2164,8 +2162,8 @@ static void __sdhci_execute_tuning(struct sdhci_host *host, u32 opcode) - sdhci_send_tuning(host, opcode); - - if (!host->tuning_done) { -- pr_info("%s: Tuning timeout, falling back to fixed sampling clock\n", -- mmc_hostname(host->mmc)); -+ pr_debug("%s: Tuning timeout, falling back to fixed sampling clock\n", -+ mmc_hostname(host->mmc)); - sdhci_abort_tuning(host, opcode); - return; - } -diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c -index 2fd862dc9770..a09aad9155a5 100644 ---- a/drivers/mmc/host/tmio_mmc_core.c -+++ b/drivers/mmc/host/tmio_mmc_core.c -@@ -1220,7 +1220,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host, - _host->start_signal_voltage_switch; - mmc->ops = &tmio_mmc_ops; - -- mmc->caps |= MMC_CAP_4_BIT_DATA | pdata->capabilities; -+ mmc->caps |= MMC_CAP_ERASE | MMC_CAP_4_BIT_DATA | pdata->capabilities; - mmc->caps2 |= pdata->capabilities2; - mmc->max_segs = pdata->max_segs ? : 32; - mmc->max_blk_size = 512; -diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig -index 83a9bc892a3b..6ae13f2419e3 100644 ---- a/drivers/net/dsa/Kconfig -+++ b/drivers/net/dsa/Kconfig -@@ -55,6 +55,7 @@ config NET_DSA_QCA8K - config NET_DSA_SMSC_LAN9303 - tristate - select NET_DSA_TAG_LAN9303 -+ select REGMAP - ---help--- - This enables support for the SMSC/Microchip LAN9303 3 port ethernet - switch chips. -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -index 9ca994d0bab6..1977e0c552df 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -@@ -2389,15 +2389,21 @@ static int bnx2x_set_pf_tx_switching(struct bnx2x *bp, bool enable) - /* send the ramrod on all the queues of the PF */ - for_each_eth_queue(bp, i) { - struct bnx2x_fastpath *fp = &bp->fp[i]; -+ int tx_idx; - - /* Set the appropriate Queue object */ - q_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj; - -- /* Update the Queue state */ -- rc = bnx2x_queue_state_change(bp, &q_params); -- if (rc) { -- BNX2X_ERR("Failed to configure Tx switching\n"); -- return rc; -+ for (tx_idx = FIRST_TX_COS_INDEX; -+ tx_idx < fp->max_cos; tx_idx++) { -+ q_params.params.update.cid_index = tx_idx; -+ -+ /* Update the Queue state */ -+ rc = bnx2x_queue_state_change(bp, &q_params); -+ if (rc) { -+ BNX2X_ERR("Failed to configure Tx switching\n"); -+ return rc; -+ } - } - } - -diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c -index 84c0f22ac2db..d5489cb0afff 100644 ---- a/drivers/net/ethernet/hisilicon/hip04_eth.c -+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c -@@ -456,9 +456,9 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) - skb_tx_timestamp(skb); - - hip04_set_xmit_desc(priv, phys); -- priv->tx_head = TX_NEXT(tx_head); - count++; - netdev_sent_queue(ndev, skb->len); -+ priv->tx_head = TX_NEXT(tx_head); - - stats->tx_bytes += skb->len; - stats->tx_packets++; -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index 4801d96c4fa9..0edfd199937d 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -8379,7 +8379,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, - - if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && - adapter->ptp_clock) { -- if (!test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, -+ if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON && -+ !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, - &adapter->state)) { - skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; - tx_flags |= IXGBE_TX_FLAGS_TSTAMP; -diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c -index f79e36e4060a..e7ad95de3da8 100644 ---- a/drivers/net/ethernet/qlogic/qede/qede_filter.c -+++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c -@@ -1181,7 +1181,7 @@ qede_configure_mcast_filtering(struct net_device *ndev, - netif_addr_lock_bh(ndev); - - mc_count = netdev_mc_count(ndev); -- if (mc_count < 64) { -+ if (mc_count <= 64) { - netdev_for_each_mc_addr(ha, ndev) { - ether_addr_copy(temp, ha->addr); - temp += ETH_ALEN; -diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c -index 5fca9a75780c..cc53ee26bd3e 100644 ---- a/drivers/net/ethernet/qlogic/qla3xxx.c -+++ b/drivers/net/ethernet/qlogic/qla3xxx.c -@@ -2756,6 +2756,9 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) - int err; - - for (i = 0; i < qdev->num_large_buffers; i++) { -+ lrg_buf_cb = &qdev->lrg_buf[i]; -+ memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); -+ - skb = netdev_alloc_skb(qdev->ndev, - qdev->lrg_buffer_len); - if (unlikely(!skb)) { -@@ -2766,11 +2769,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) - ql_free_large_buffers(qdev); - return -ENOMEM; - } else { -- -- lrg_buf_cb = &qdev->lrg_buf[i]; -- memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); - lrg_buf_cb->index = i; -- lrg_buf_cb->skb = skb; - /* - * We save some space to copy the ethhdr from first - * buffer -@@ -2792,6 +2791,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) - return -ENOMEM; - } - -+ lrg_buf_cb->skb = skb; - dma_unmap_addr_set(lrg_buf_cb, mapaddr, map); - dma_unmap_len_set(lrg_buf_cb, maplen, - qdev->lrg_buffer_len - -diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c -index 14d6579b292a..314e3eac09b9 100644 ---- a/drivers/net/fjes/fjes_main.c -+++ b/drivers/net/fjes/fjes_main.c -@@ -181,6 +181,9 @@ static int fjes_acpi_add(struct acpi_device *device) - /* create platform_device */ - plat_dev = platform_device_register_simple(DRV_NAME, 0, fjes_resource, - ARRAY_SIZE(fjes_resource)); -+ if (IS_ERR(plat_dev)) -+ return PTR_ERR(plat_dev); -+ - device->driver_data = plat_dev; - - return 0; -diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c -index e03e91d5f1b1..0cbcced0870e 100644 ---- a/drivers/net/phy/dp83867.c -+++ b/drivers/net/phy/dp83867.c -@@ -84,6 +84,10 @@ - #define DP83867_IO_MUX_CFG_IO_IMPEDANCE_MAX 0x0 - #define DP83867_IO_MUX_CFG_IO_IMPEDANCE_MIN 0x1f - -+/* CFG3 bits */ -+#define DP83867_CFG3_INT_OE BIT(7) -+#define DP83867_CFG3_ROBUST_AUTO_MDIX BIT(9) -+ - /* CFG4 bits */ - #define DP83867_CFG4_PORT_MIRROR_EN BIT(0) - -@@ -320,12 +324,13 @@ static int dp83867_config_init(struct phy_device *phydev) - return ret; - } - -+ val = phy_read(phydev, DP83867_CFG3); - /* Enable Interrupt output INT_OE in CFG3 register */ -- if (phy_interrupt_is_valid(phydev)) { -- val = phy_read(phydev, DP83867_CFG3); -- val |= BIT(7); -- phy_write(phydev, DP83867_CFG3, val); -- } -+ if (phy_interrupt_is_valid(phydev)) -+ val |= DP83867_CFG3_INT_OE; -+ -+ val |= DP83867_CFG3_ROBUST_AUTO_MDIX; -+ phy_write(phydev, DP83867_CFG3, val); - - if (dp83867->port_mirroring != DP83867_PORT_MIRROING_KEEP) - dp83867_config_port_mirroring(phydev); -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index ed7e3c70b511..a98c227a4c2e 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -367,8 +367,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, - mdiodev->device_free = phy_mdio_device_free; - mdiodev->device_remove = phy_mdio_device_remove; - -- dev->speed = 0; -- dev->duplex = -1; -+ dev->speed = SPEED_UNKNOWN; -+ dev->duplex = DUPLEX_UNKNOWN; - dev->pause = 0; - dev->asym_pause = 0; - dev->link = 1; -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 2229284d16f5..7d1d5b30ecc3 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -1765,6 +1765,7 @@ static int lan78xx_mdio_init(struct lan78xx_net *dev) - dev->mdiobus->read = lan78xx_mdiobus_read; - dev->mdiobus->write = lan78xx_mdiobus_write; - dev->mdiobus->name = "lan78xx-mdiobus"; -+ dev->mdiobus->parent = &dev->udev->dev; - - snprintf(dev->mdiobus->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", - dev->udev->bus->busnum, dev->udev->devnum); -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index dff34448588f..ea47ad4b2343 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -3627,7 +3627,7 @@ static int ath10k_mac_tx(struct ath10k *ar, - struct ieee80211_vif *vif, - enum ath10k_hw_txrx_mode txmode, - enum ath10k_mac_tx_path txpath, -- struct sk_buff *skb) -+ struct sk_buff *skb, bool noque_offchan) - { - struct ieee80211_hw *hw = ar->hw; - struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); -@@ -3655,10 +3655,10 @@ static int ath10k_mac_tx(struct ath10k *ar, - } - } - -- if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { -+ if (!noque_offchan && info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { - if (!ath10k_mac_tx_frm_has_freq(ar)) { -- ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n", -- skb); -+ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac queued offchannel skb %pK len %d\n", -+ skb, skb->len); - - skb_queue_tail(&ar->offchan_tx_queue, skb); - ieee80211_queue_work(hw, &ar->offchan_tx_work); -@@ -3720,8 +3720,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) - - mutex_lock(&ar->conf_mutex); - -- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n", -- skb); -+ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK len %d\n", -+ skb, skb->len); - - hdr = (struct ieee80211_hdr *)skb->data; - peer_addr = ieee80211_get_DA(hdr); -@@ -3767,7 +3767,7 @@ void ath10k_offchan_tx_work(struct work_struct *work) - txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb); - txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode); - -- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); -+ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, true); - if (ret) { - ath10k_warn(ar, "failed to transmit offchannel frame: %d\n", - ret); -@@ -3777,8 +3777,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) - time_left = - wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ); - if (time_left == 0) -- ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n", -- skb); -+ ath10k_warn(ar, "timed out waiting for offchannel skb %pK, len: %d\n", -+ skb, skb->len); - - if (!peer && tmp_peer_created) { - ret = ath10k_peer_delete(ar, vdev_id, peer_addr); -@@ -3957,7 +3957,7 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw, - spin_unlock_bh(&ar->htt.tx_lock); - } - -- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); -+ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); - if (unlikely(ret)) { - ath10k_warn(ar, "failed to push frame: %d\n", ret); - -@@ -4239,7 +4239,7 @@ static void ath10k_mac_op_tx(struct ieee80211_hw *hw, - spin_unlock_bh(&ar->htt.tx_lock); - } - -- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); -+ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); - if (ret) { - ath10k_warn(ar, "failed to transmit frame: %d\n", ret); - if (is_htt) { -diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c -index d4986f626c35..9999c8c40269 100644 ---- a/drivers/net/wireless/ath/ath10k/txrx.c -+++ b/drivers/net/wireless/ath/ath10k/txrx.c -@@ -100,6 +100,8 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, - - info = IEEE80211_SKB_CB(msdu); - memset(&info->status, 0, sizeof(info->status)); -+ info->status.rates[0].idx = -1; -+ - trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id); - - if (tx_done->status == HTT_TX_COMPL_STATE_DISCARD) { -diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/led.c b/drivers/net/wireless/intel/iwlwifi/dvm/led.c -index 1bbd17ada974..20e16c423990 100644 ---- a/drivers/net/wireless/intel/iwlwifi/dvm/led.c -+++ b/drivers/net/wireless/intel/iwlwifi/dvm/led.c -@@ -185,6 +185,9 @@ void iwl_leds_init(struct iwl_priv *priv) - - priv->led.name = kasprintf(GFP_KERNEL, "%s-led", - wiphy_name(priv->hw->wiphy)); -+ if (!priv->led.name) -+ return; -+ - priv->led.brightness_set = iwl_led_brightness_set; - priv->led.blink_set = iwl_led_blink_set; - priv->led.max_brightness = 1; -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c -index b27269504a62..072f80c90ce4 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c -@@ -131,6 +131,9 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm) - - mvm->led.name = kasprintf(GFP_KERNEL, "%s-led", - wiphy_name(mvm->hw->wiphy)); -+ if (!mvm->led.name) -+ return -ENOMEM; -+ - mvm->led.brightness_set = iwl_led_brightness_set; - mvm->led.max_brightness = 1; - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c -index c73e4be9bde3..c31303d13069 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c -@@ -62,6 +62,7 @@ - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - *****************************************************************************/ -+#include - #include - #include - #include "iwl-trans.h" -@@ -290,7 +291,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi, - rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data; - hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res)); - len = le16_to_cpu(rx_res->byte_count); -- rx_pkt_status = le32_to_cpup((__le32 *) -+ rx_pkt_status = get_unaligned_le32((__le32 *) - (pkt->data + sizeof(*rx_res) + len)); - - /* Dont use dev_alloc_skb(), we'll have enough headroom once -diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c -index 39bf85d0ade0..c7f8a29d2606 100644 ---- a/drivers/net/wireless/marvell/libertas/if_sdio.c -+++ b/drivers/net/wireless/marvell/libertas/if_sdio.c -@@ -1183,6 +1183,10 @@ static int if_sdio_probe(struct sdio_func *func, - - spin_lock_init(&card->lock); - card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0); -+ if (unlikely(!card->workqueue)) { -+ ret = -ENOMEM; -+ goto err_queue; -+ } - INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker); - init_waitqueue_head(&card->pwron_waitq); - -@@ -1234,6 +1238,7 @@ err_activate_card: - lbs_remove_card(priv); - free: - destroy_workqueue(card->workqueue); -+err_queue: - while (card->packets) { - packet = card->packets; - card->packets = card->packets->next; -diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c -index 9511f5fe62f4..9d0d790a1319 100644 ---- a/drivers/net/wireless/marvell/mwifiex/pcie.c -+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c -@@ -677,8 +677,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) - skb_put(skb, MAX_EVENT_SIZE); - - if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, -- PCI_DMA_FROMDEVICE)) -+ PCI_DMA_FROMDEVICE)) { -+ kfree_skb(skb); -+ kfree(card->evtbd_ring_vbase); - return -1; -+ } - - buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); - -diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h -index 95e3993d8a33..a895b6fd6f85 100644 ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h -@@ -1349,6 +1349,7 @@ struct rtl8xxxu_fileops { - u8 has_s0s1:1; - u8 has_tx_report:1; - u8 gen2_thermal_meter:1; -+ u8 needs_full_init:1; - u32 adda_1t_init; - u32 adda_1t_path_on; - u32 adda_2t_path_on_a; -diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c -index c4b86a84a721..27e97df996c7 100644 ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c -@@ -1673,6 +1673,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops = { - .has_s0s1 = 1, - .has_tx_report = 1, - .gen2_thermal_meter = 1, -+ .needs_full_init = 1, - .adda_1t_init = 0x01c00014, - .adda_1t_path_on = 0x01c00014, - .adda_2t_path_on_a = 0x01c00014, -diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -index 91b01ca32e75..b58bf8e2cad2 100644 ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -@@ -3905,6 +3905,9 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) - else - macpower = true; - -+ if (fops->needs_full_init) -+ macpower = false; -+ - ret = fops->power_on(priv); - if (ret < 0) { - dev_warn(dev, "%s: Failed power on\n", __func__); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c -index 530e80f0ef0b..1ee7f796113b 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c -@@ -1556,6 +1556,8 @@ static bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb) - * This is maybe necessary: - * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb); - */ -+ dev_kfree_skb(skb); -+ - return true; - } - -diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c -index 2401c8bdb211..93eda23f0123 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/usb.c -+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c -@@ -1068,8 +1068,10 @@ int rtl_usb_probe(struct usb_interface *intf, - rtlpriv->hw = hw; - rtlpriv->usb_data = kzalloc(RTL_USB_MAX_RX_COUNT * sizeof(u32), - GFP_KERNEL); -- if (!rtlpriv->usb_data) -+ if (!rtlpriv->usb_data) { -+ ieee80211_free_hw(hw); - return -ENOMEM; -+ } - - /* this spin lock must be initialized early */ - spin_lock_init(&rtlpriv->locks.usb_lock); -@@ -1130,6 +1132,7 @@ error_out2: - _rtl_usb_io_handler_release(hw); - usb_put_dev(udev); - complete(&rtlpriv->firmware_loading_complete); -+ kfree(rtlpriv->usb_data); - return -ENODEV; - } - EXPORT_SYMBOL(rtl_usb_probe); -diff --git a/drivers/parport/share.c b/drivers/parport/share.c -index 7b4ee33c1935..15c81cffd2de 100644 ---- a/drivers/parport/share.c -+++ b/drivers/parport/share.c -@@ -230,6 +230,18 @@ static int port_check(struct device *dev, void *dev_drv) - return 0; - } - -+/* -+ * Iterates through all the devices connected to the bus and return 1 -+ * if the device is a parallel port. -+ */ -+ -+static int port_detect(struct device *dev, void *dev_drv) -+{ -+ if (is_parport(dev)) -+ return 1; -+ return 0; -+} -+ - /** - * parport_register_driver - register a parallel port device driver - * @drv: structure describing the driver -@@ -282,6 +294,15 @@ int __parport_register_driver(struct parport_driver *drv, struct module *owner, - if (ret) - return ret; - -+ /* -+ * check if bus has any parallel port registered, if -+ * none is found then load the lowlevel driver. -+ */ -+ ret = bus_for_each_dev(&parport_bus_type, NULL, NULL, -+ port_detect); -+ if (!ret) -+ get_lowlevel_driver(); -+ - mutex_lock(®istration_lock); - if (drv->match_port) - bus_for_each_dev(&parport_bus_type, NULL, drv, -diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hs.c b/drivers/phy/qualcomm/phy-qcom-usb-hs.c -index 2d0c70b5589f..643934a2a70c 100644 ---- a/drivers/phy/qualcomm/phy-qcom-usb-hs.c -+++ b/drivers/phy/qualcomm/phy-qcom-usb-hs.c -@@ -159,8 +159,8 @@ static int qcom_usb_hs_phy_power_on(struct phy *phy) - /* setup initial state */ - qcom_usb_hs_phy_vbus_notifier(&uphy->vbus_notify, state, - uphy->vbus_edev); -- ret = devm_extcon_register_notifier(&ulpi->dev, uphy->vbus_edev, -- EXTCON_USB, &uphy->vbus_notify); -+ ret = extcon_register_notifier(uphy->vbus_edev, EXTCON_USB, -+ &uphy->vbus_notify); - if (ret) - goto err_ulpi; - } -@@ -181,6 +181,9 @@ static int qcom_usb_hs_phy_power_off(struct phy *phy) - { - struct qcom_usb_hs_phy *uphy = phy_get_drvdata(phy); - -+ if (uphy->vbus_edev) -+ extcon_unregister_notifier(uphy->vbus_edev, EXTCON_USB, -+ &uphy->vbus_notify); - regulator_disable(uphy->v3p3); - regulator_disable(uphy->v1p8); - clk_disable_unprepare(uphy->sleep_clk); -diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c -index c4aa411f5935..3a7c2d6e4d5f 100644 ---- a/drivers/pinctrl/devicetree.c -+++ b/drivers/pinctrl/devicetree.c -@@ -40,6 +40,13 @@ struct pinctrl_dt_map { - static void dt_free_map(struct pinctrl_dev *pctldev, - struct pinctrl_map *map, unsigned num_maps) - { -+ int i; -+ -+ for (i = 0; i < num_maps; ++i) { -+ kfree_const(map[i].dev_name); -+ map[i].dev_name = NULL; -+ } -+ - if (pctldev) { - const struct pinctrl_ops *ops = pctldev->desc->pctlops; - if (ops->dt_free_map) -@@ -74,7 +81,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, - - /* Initialize common mapping table entry fields */ - for (i = 0; i < num_maps; i++) { -- map[i].dev_name = dev_name(p->dev); -+ const char *devname; -+ -+ devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL); -+ if (!devname) -+ goto err_free_map; -+ -+ map[i].dev_name = devname; - map[i].name = statename; - if (pctldev) - map[i].ctrl_dev_name = dev_name(pctldev->dev); -@@ -82,10 +95,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, - - /* Remember the converted mapping table entries */ - dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL); -- if (!dt_map) { -- dt_free_map(pctldev, map, num_maps); -- return -ENOMEM; -- } -+ if (!dt_map) -+ goto err_free_map; - - dt_map->pctldev = pctldev; - dt_map->map = map; -@@ -93,6 +104,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, - list_add_tail(&dt_map->node, &p->dt_maps); - - return pinctrl_register_map(map, num_maps, false); -+ -+err_free_map: -+ dt_free_map(pctldev, map, num_maps); -+ return -ENOMEM; - } - - struct pinctrl_dev *of_pinctrl_get(struct device_node *np) -diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c -index b78f42abff2f..7385cd81498c 100644 ---- a/drivers/pinctrl/pinctrl-amd.c -+++ b/drivers/pinctrl/pinctrl-amd.c -@@ -509,7 +509,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id) - irqreturn_t ret = IRQ_NONE; - unsigned int i, irqnr; - unsigned long flags; -- u32 *regs, regval; -+ u32 __iomem *regs; -+ u32 regval; - u64 status, mask; - - /* Read the wake status */ -diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c -index 33232041ee86..3eccc9b3ca84 100644 ---- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c -+++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c -@@ -1453,7 +1453,7 @@ static const struct pinmux_func pinmux_func_gpios[] = { - GPIO_FN(ET0_ETXD2_A), - GPIO_FN(EX_CS5), GPIO_FN(SD1_CMD_A), GPIO_FN(ATADIR), GPIO_FN(QSSL_B), - GPIO_FN(ET0_ETXD3_A), -- GPIO_FN(RD_WR), GPIO_FN(TCLK1_B), -+ GPIO_FN(RD_WR), GPIO_FN(TCLK0), GPIO_FN(CAN_CLK_B), GPIO_FN(ET0_ETXD4), - GPIO_FN(EX_WAIT0), GPIO_FN(TCLK1_B), - GPIO_FN(EX_WAIT1), GPIO_FN(SD1_DAT0_A), GPIO_FN(DREQ2), - GPIO_FN(CAN1_TX_C), GPIO_FN(ET0_LINK_C), GPIO_FN(ET0_ETXD5_A), -@@ -1949,7 +1949,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { - /* IP3_20 [1] */ - FN_EX_WAIT0, FN_TCLK1_B, - /* IP3_19_18 [2] */ -- FN_RD_WR, FN_TCLK1_B, 0, 0, -+ FN_RD_WR, FN_TCLK0, FN_CAN_CLK_B, FN_ET0_ETXD4, - /* IP3_17_15 [3] */ - FN_EX_CS5, FN_SD1_CMD_A, FN_ATADIR, FN_QSSL_B, - FN_ET0_ETXD3_A, 0, 0, 0, -diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c -index d0ffdd5d9199..06a3c1ef8eee 100644 ---- a/drivers/platform/x86/hp-wmi.c -+++ b/drivers/platform/x86/hp-wmi.c -@@ -313,7 +313,7 @@ static int __init hp_wmi_bios_2008_later(void) - - static int __init hp_wmi_bios_2009_later(void) - { -- int state = 0; -+ u8 state[128]; - int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, HPWMI_READ, &state, - sizeof(state), sizeof(state)); - if (!ret) -diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c -index 860400d2cd85..a8f2f07239fb 100644 ---- a/drivers/regulator/max8907-regulator.c -+++ b/drivers/regulator/max8907-regulator.c -@@ -299,7 +299,10 @@ static int max8907_regulator_probe(struct platform_device *pdev) - memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc)); - - /* Backwards compatibility with MAX8907B; SD1 uses different voltages */ -- regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); -+ ret = regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); -+ if (ret) -+ return ret; -+ - if ((val & MAX8907_II2RR_VERSION_MASK) == - MAX8907_II2RR_VERSION_REV_B) { - pmic->desc[MAX8907_SD1].min_uV = 637500; -@@ -336,14 +339,20 @@ static int max8907_regulator_probe(struct platform_device *pdev) - } - - if (pmic->desc[i].ops == &max8907_ldo_ops) { -- regmap_read(config.regmap, pmic->desc[i].enable_reg, -+ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, - &val); -+ if (ret) -+ return ret; -+ - if ((val & MAX8907_MASK_LDO_SEQ) != - MAX8907_MASK_LDO_SEQ) - pmic->desc[i].ops = &max8907_ldo_hwctl_ops; - } else if (pmic->desc[i].ops == &max8907_out5v_ops) { -- regmap_read(config.regmap, pmic->desc[i].enable_reg, -+ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, - &val); -+ if (ret) -+ return ret; -+ - if ((val & (MAX8907_MASK_OUT5V_VINEN | - MAX8907_MASK_OUT5V_ENSRC)) != - MAX8907_MASK_OUT5V_ENSRC) -diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c -index 7a37090dabbe..2e65b70c7879 100644 ---- a/drivers/spi/spi-img-spfi.c -+++ b/drivers/spi/spi-img-spfi.c -@@ -673,6 +673,8 @@ static int img_spfi_probe(struct platform_device *pdev) - dma_release_channel(spfi->tx_ch); - if (spfi->rx_ch) - dma_release_channel(spfi->rx_ch); -+ spfi->tx_ch = NULL; -+ spfi->rx_ch = NULL; - dev_warn(spfi->dev, "Failed to get DMA channels, falling back to PIO mode\n"); - } else { - master->dma_tx = spfi->tx_ch; -diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c -index 9bf3e5f945c7..b2245cdce230 100644 ---- a/drivers/spi/spi-pxa2xx.c -+++ b/drivers/spi/spi-pxa2xx.c -@@ -1559,7 +1559,13 @@ pxa2xx_spi_init_pdata(struct platform_device *pdev) - } - - ssp->clk = devm_clk_get(&pdev->dev, NULL); -+ if (IS_ERR(ssp->clk)) -+ return NULL; -+ - ssp->irq = platform_get_irq(pdev, 0); -+ if (ssp->irq < 0) -+ return NULL; -+ - ssp->type = type; - ssp->pdev = pdev; - ssp->port_id = pxa2xx_spi_get_port_id(adev); -diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c -index a4e43fc19ece..5df01ffdef46 100644 ---- a/drivers/spi/spi-st-ssc4.c -+++ b/drivers/spi/spi-st-ssc4.c -@@ -385,6 +385,7 @@ static int spi_st_probe(struct platform_device *pdev) - return 0; - - clk_disable: -+ pm_runtime_disable(&pdev->dev); - clk_disable_unprepare(spi_st->clk); - put_master: - spi_master_put(master); -@@ -396,6 +397,8 @@ static int spi_st_remove(struct platform_device *pdev) - struct spi_master *master = platform_get_drvdata(pdev); - struct spi_st *spi_st = spi_master_get_devdata(master); - -+ pm_runtime_disable(&pdev->dev); -+ - clk_disable_unprepare(spi_st->clk); - - pinctrl_pm_select_sleep_state(&pdev->dev); -diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c -index 9831c1106945..62b074b167a9 100644 ---- a/drivers/spi/spi-tegra20-slink.c -+++ b/drivers/spi/spi-tegra20-slink.c -@@ -1078,7 +1078,7 @@ static int tegra_slink_probe(struct platform_device *pdev) - ret = clk_enable(tspi->clk); - if (ret < 0) { - dev_err(&pdev->dev, "Clock enable failed %d\n", ret); -- goto exit_free_master; -+ goto exit_clk_unprepare; - } - - spi_irq = platform_get_irq(pdev, 0); -@@ -1151,6 +1151,8 @@ exit_free_irq: - free_irq(spi_irq, tspi); - exit_clk_disable: - clk_disable(tspi->clk); -+exit_clk_unprepare: -+ clk_unprepare(tspi->clk); - exit_free_master: - spi_master_put(master); - return ret; -@@ -1164,6 +1166,7 @@ static int tegra_slink_remove(struct platform_device *pdev) - free_irq(tspi->irq, tspi); - - clk_disable(tspi->clk); -+ clk_unprepare(tspi->clk); - - if (tspi->tx_dma_chan) - tegra_slink_deinit_dma_param(tspi, false); -diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c -index c5fe08bc34a0..028725573e63 100644 ---- a/drivers/spi/spidev.c -+++ b/drivers/spi/spidev.c -@@ -634,6 +634,9 @@ static int spidev_release(struct inode *inode, struct file *filp) - if (dofree) - kfree(spidev); - } -+#ifdef CONFIG_SPI_SLAVE -+ spi_slave_abort(spidev->spi); -+#endif - mutex_unlock(&device_list_lock); - - return 0; -diff --git a/drivers/staging/comedi/drivers/gsc_hpdi.c b/drivers/staging/comedi/drivers/gsc_hpdi.c -index e5b948405fd9..a09631f9d813 100644 ---- a/drivers/staging/comedi/drivers/gsc_hpdi.c -+++ b/drivers/staging/comedi/drivers/gsc_hpdi.c -@@ -632,6 +632,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, - dma_alloc_coherent(&pcidev->dev, DMA_BUFFER_SIZE, - &devpriv->dio_buffer_phys_addr[i], - GFP_KERNEL); -+ if (!devpriv->dio_buffer[i]) { -+ dev_warn(dev->class_dev, -+ "failed to allocate DMA buffer\n"); -+ return -ENOMEM; -+ } - } - /* allocate dma descriptors */ - devpriv->dma_desc = dma_alloc_coherent(&pcidev->dev, -@@ -639,6 +644,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, - NUM_DMA_DESCRIPTORS, - &devpriv->dma_desc_phys_addr, - GFP_KERNEL); -+ if (!devpriv->dma_desc) { -+ dev_warn(dev->class_dev, -+ "failed to allocate DMA descriptors\n"); -+ return -ENOMEM; -+ } - if (devpriv->dma_desc_phys_addr & 0xf) { - dev_warn(dev->class_dev, - " dma descriptors not quad-word aligned (bug)\n"); -diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c -index 0cbcbad8f074..b81c6dfa5b24 100644 ---- a/drivers/staging/fbtft/fbtft-core.c -+++ b/drivers/staging/fbtft/fbtft-core.c -@@ -780,7 +780,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, - fbdefio->deferred_io = fbtft_deferred_io; - fb_deferred_io_init(info); - -- strncpy(info->fix.id, dev->driver->name, 16); -+ snprintf(info->fix.id, sizeof(info->fix.id), "%s", dev->driver->name); - info->fix.type = FB_TYPE_PACKED_PIXELS; - info->fix.visual = FB_VISUAL_TRUECOLOR; - info->fix.xpanstep = 0; -diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c -index 904b988ecc4e..7c895af1ba31 100644 ---- a/drivers/staging/rtl8188eu/core/rtw_xmit.c -+++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c -@@ -805,7 +805,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr - memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN); - memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN); - -- if (psta->qos_option) -+ if (psta && psta->qos_option) - qos_option = true; - } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || - check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { -@@ -813,7 +813,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr - memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN); - memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN); - -- if (psta->qos_option) -+ if (psta && psta->qos_option) - qos_option = true; - } else { - RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv))); -diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c -index db3eb7ec5809..fbbd1b59dc11 100644 ---- a/drivers/staging/rtl8192u/r8192U_core.c -+++ b/drivers/staging/rtl8192u/r8192U_core.c -@@ -1506,7 +1506,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) - (tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN); - struct usb_device *udev = priv->udev; - int pend; -- int status; -+ int status, rt = -1; - struct urb *tx_urb = NULL, *tx_urb_zero = NULL; - unsigned int idx_pipe; - -@@ -1650,8 +1650,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) - } - if (bSend0Byte) { - tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC); -- if (!tx_urb_zero) -- return -ENOMEM; -+ if (!tx_urb_zero) { -+ rt = -ENOMEM; -+ goto error; -+ } - usb_fill_bulk_urb(tx_urb_zero, udev, - usb_sndbulkpipe(udev, idx_pipe), - &zero, 0, tx_zero_isr, dev); -@@ -1661,7 +1663,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) - "Error TX URB for zero byte %d, error %d", - atomic_read(&priv->tx_pending[tcb_desc->queue_index]), - status); -- return -1; -+ goto error; - } - } - netif_trans_update(dev); -@@ -1672,7 +1674,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) - RT_TRACE(COMP_ERR, "Error TX URB %d, error %d", - atomic_read(&priv->tx_pending[tcb_desc->queue_index]), - status); -- return -1; -+ -+error: -+ dev_kfree_skb_any(skb); -+ usb_free_urb(tx_urb); -+ usb_free_urb(tx_urb_zero); -+ return rt; - } - - static short rtl8192_usb_initendpoints(struct net_device *dev) -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 62b2a7105f02..4fb4cf8c2f14 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -755,8 +755,15 @@ static int claimintf(struct usb_dev_state *ps, unsigned int ifnum) - intf = usb_ifnum_to_if(dev, ifnum); - if (!intf) - err = -ENOENT; -- else -+ else { -+ unsigned int old_suppress; -+ -+ /* suppress uevents while claiming interface */ -+ old_suppress = dev_get_uevent_suppress(&intf->dev); -+ dev_set_uevent_suppress(&intf->dev, 1); - err = usb_driver_claim_interface(&usbfs_driver, intf, ps); -+ dev_set_uevent_suppress(&intf->dev, old_suppress); -+ } - if (err == 0) - set_bit(ifnum, &ps->ifclaimed); - return err; -@@ -776,7 +783,13 @@ static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum) - if (!intf) - err = -ENOENT; - else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) { -+ unsigned int old_suppress; -+ -+ /* suppress uevents while releasing interface */ -+ old_suppress = dev_get_uevent_suppress(&intf->dev); -+ dev_set_uevent_suppress(&intf->dev, 1); - usb_driver_release_interface(&usbfs_driver, intf); -+ dev_set_uevent_suppress(&intf->dev, old_suppress); - err = 0; - } - return err; -diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c -index 8f3f055c05fa..477ba3842cc4 100644 ---- a/drivers/usb/host/ehci-q.c -+++ b/drivers/usb/host/ehci-q.c -@@ -40,6 +40,10 @@ - - /*-------------------------------------------------------------------------*/ - -+/* PID Codes that are used here, from EHCI specification, Table 3-16. */ -+#define PID_CODE_IN 1 -+#define PID_CODE_SETUP 2 -+ - /* fill a qtd, returning how much of the buffer we were able to queue up */ - - static int -@@ -203,7 +207,7 @@ static int qtd_copy_status ( - int status = -EINPROGRESS; - - /* count IN/OUT bytes, not SETUP (even short packets) */ -- if (likely (QTD_PID (token) != 2)) -+ if (likely(QTD_PID(token) != PID_CODE_SETUP)) - urb->actual_length += length - QTD_LENGTH (token); - - /* don't modify error codes */ -@@ -219,6 +223,13 @@ static int qtd_copy_status ( - if (token & QTD_STS_BABBLE) { - /* FIXME "must" disable babbling device's port too */ - status = -EOVERFLOW; -+ /* -+ * When MMF is active and PID Code is IN, queue is halted. -+ * EHCI Specification, Table 4-13. -+ */ -+ } else if ((token & QTD_STS_MMF) && -+ (QTD_PID(token) == PID_CODE_IN)) { -+ status = -EPROTO; - /* CERR nonzero + halt --> stall */ - } else if (QTD_CERR(token)) { - status = -EPIPE; -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index 021a2d320acc..09f228279c01 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -497,7 +497,6 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) - retval = xhci_resume(xhci, hibernated); - return retval; - } --#endif /* CONFIG_PM */ - - static void xhci_pci_shutdown(struct usb_hcd *hcd) - { -@@ -510,6 +509,7 @@ static void xhci_pci_shutdown(struct usb_hcd *hcd) - if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) - pci_set_power_state(pdev, PCI_D3hot); - } -+#endif /* CONFIG_PM */ - - /*-------------------------------------------------------------------------*/ - -diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h -index b8620aa6b72e..8424c165f732 100644 ---- a/drivers/usb/renesas_usbhs/common.h -+++ b/drivers/usb/renesas_usbhs/common.h -@@ -163,11 +163,12 @@ struct usbhs_priv; - #define VBSTS (1 << 7) /* VBUS_0 and VBUSIN_0 Input Status */ - #define VALID (1 << 3) /* USB Request Receive */ - --#define DVSQ_MASK (0x3 << 4) /* Device State */ -+#define DVSQ_MASK (0x7 << 4) /* Device State */ - #define POWER_STATE (0 << 4) - #define DEFAULT_STATE (1 << 4) - #define ADDRESS_STATE (2 << 4) - #define CONFIGURATION_STATE (3 << 4) -+#define SUSPENDED_STATE (4 << 4) - - #define CTSQ_MASK (0x7) /* Control Transfer Stage */ - #define IDLE_SETUP_STAGE 0 /* Idle stage or setup stage */ -diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c -index 0dedb0d91dcc..b27f2135b66d 100644 ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -465,12 +465,18 @@ static int usbhsg_irq_dev_state(struct usbhs_priv *priv, - { - struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv); - struct device *dev = usbhsg_gpriv_to_dev(gpriv); -+ int state = usbhs_status_get_device_state(irq_state); - - gpriv->gadget.speed = usbhs_bus_get_speed(priv); - -- dev_dbg(dev, "state = %x : speed : %d\n", -- usbhs_status_get_device_state(irq_state), -- gpriv->gadget.speed); -+ dev_dbg(dev, "state = %x : speed : %d\n", state, gpriv->gadget.speed); -+ -+ if (gpriv->gadget.speed != USB_SPEED_UNKNOWN && -+ (state & SUSPENDED_STATE)) { -+ if (gpriv->driver && gpriv->driver->suspend) -+ gpriv->driver->suspend(&gpriv->gadget); -+ usb_gadget_set_state(&gpriv->gadget, USB_STATE_SUSPENDED); -+ } - - return 0; - } -diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c -index da03451328cd..cd01f1e278ee 100644 ---- a/drivers/usb/usbip/usbip_common.c -+++ b/drivers/usb/usbip/usbip_common.c -@@ -742,6 +742,9 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) - - copy -= recv; - ret += recv; -+ -+ if (!copy) -+ break; - } - - if (ret != size) -diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c -index 3f998b605f03..c13dd526b996 100644 ---- a/drivers/usb/usbip/vhci_rx.c -+++ b/drivers/usb/usbip/vhci_rx.c -@@ -91,16 +91,21 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, - usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0); - - /* recv transfer buffer */ -- if (usbip_recv_xbuff(ud, urb) < 0) -- return; -+ if (usbip_recv_xbuff(ud, urb) < 0) { -+ urb->status = -EPROTO; -+ goto error; -+ } - - /* recv iso_packet_descriptor */ -- if (usbip_recv_iso(ud, urb) < 0) -- return; -+ if (usbip_recv_iso(ud, urb) < 0) { -+ urb->status = -EPROTO; -+ goto error; -+ } - - /* restore the padding in iso packets */ - usbip_pad_iso(ud, urb); - -+error: - if (usbip_dbg_flag_vhci_rx) - usbip_dump_urb(urb); - -diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c -index e00c8a9fd5bb..72d7589072f5 100644 ---- a/fs/btrfs/async-thread.c -+++ b/fs/btrfs/async-thread.c -@@ -265,16 +265,17 @@ out: - } - } - --static void run_ordered_work(struct __btrfs_workqueue *wq) -+static void run_ordered_work(struct __btrfs_workqueue *wq, -+ struct btrfs_work *self) - { - struct list_head *list = &wq->ordered_list; - struct btrfs_work *work; - spinlock_t *lock = &wq->list_lock; - unsigned long flags; -+ void *wtag; -+ bool free_self = false; - - while (1) { -- void *wtag; -- - spin_lock_irqsave(lock, flags); - if (list_empty(list)) - break; -@@ -300,16 +301,47 @@ static void run_ordered_work(struct __btrfs_workqueue *wq) - list_del(&work->ordered_list); - spin_unlock_irqrestore(lock, flags); - -- /* -- * We don't want to call the ordered free functions with the -- * lock held though. Save the work as tag for the trace event, -- * because the callback could free the structure. -- */ -- wtag = work; -- work->ordered_free(work); -- trace_btrfs_all_work_done(wq->fs_info, wtag); -+ if (work == self) { -+ /* -+ * This is the work item that the worker is currently -+ * executing. -+ * -+ * The kernel workqueue code guarantees non-reentrancy -+ * of work items. I.e., if a work item with the same -+ * address and work function is queued twice, the second -+ * execution is blocked until the first one finishes. A -+ * work item may be freed and recycled with the same -+ * work function; the workqueue code assumes that the -+ * original work item cannot depend on the recycled work -+ * item in that case (see find_worker_executing_work()). -+ * -+ * Note that the work of one Btrfs filesystem may depend -+ * on the work of another Btrfs filesystem via, e.g., a -+ * loop device. Therefore, we must not allow the current -+ * work item to be recycled until we are really done, -+ * otherwise we break the above assumption and can -+ * deadlock. -+ */ -+ free_self = true; -+ } else { -+ /* -+ * We don't want to call the ordered free functions with -+ * the lock held though. Save the work as tag for the -+ * trace event, because the callback could free the -+ * structure. -+ */ -+ wtag = work; -+ work->ordered_free(work); -+ trace_btrfs_all_work_done(wq->fs_info, wtag); -+ } - } - spin_unlock_irqrestore(lock, flags); -+ -+ if (free_self) { -+ wtag = self; -+ self->ordered_free(self); -+ trace_btrfs_all_work_done(wq->fs_info, wtag); -+ } - } - - static void normal_work_helper(struct btrfs_work *work) -@@ -337,7 +369,7 @@ static void normal_work_helper(struct btrfs_work *work) - work->func(work); - if (need_order) { - set_bit(WORK_DONE_BIT, &work->flags); -- run_ordered_work(wq); -+ run_ordered_work(wq, work); - } - if (!need_order) - trace_btrfs_all_work_done(wq->fs_info, wtag); -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index d2263caff307..740ef428acdd 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -427,7 +427,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info, - for (node = rb_first(tm_root); node; node = next) { - next = rb_next(node); - tm = rb_entry(node, struct tree_mod_elem, node); -- if (tm->seq > min_seq) -+ if (tm->seq >= min_seq) - continue; - rb_erase(node, tm_root); - kfree(tm); -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 813834552aa1..a8ea56218d6b 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -1679,8 +1679,8 @@ static void end_workqueue_fn(struct btrfs_work *work) - bio->bi_status = end_io_wq->status; - bio->bi_private = end_io_wq->private; - bio->bi_end_io = end_io_wq->end_io; -- kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); - bio_endio(bio); -+ kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); - } - - static int cleaner_kthread(void *arg) -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 4cc534584665..fced434bbddc 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -4949,12 +4949,14 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, - return eb; - eb = alloc_dummy_extent_buffer(fs_info, start); - if (!eb) -- return NULL; -+ return ERR_PTR(-ENOMEM); - eb->fs_info = fs_info; - again: - ret = radix_tree_preload(GFP_NOFS); -- if (ret) -+ if (ret) { -+ exists = ERR_PTR(ret); - goto free_eb; -+ } - spin_lock(&fs_info->buffer_lock); - ret = radix_tree_insert(&fs_info->buffer_radix, - start >> PAGE_SHIFT, eb); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 739f45b04b52..f2dc517768f0 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -5729,7 +5729,6 @@ static void inode_tree_add(struct inode *inode) - - static void inode_tree_del(struct inode *inode) - { -- struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); - struct btrfs_root *root = BTRFS_I(inode)->root; - int empty = 0; - -@@ -5742,7 +5741,6 @@ static void inode_tree_del(struct inode *inode) - spin_unlock(&root->inode_lock); - - if (empty && btrfs_root_refs(&root->root_item) == 0) { -- synchronize_srcu(&fs_info->subvol_srcu); - spin_lock(&root->inode_lock); - empty = RB_EMPTY_ROOT(&root->inode_tree); - spin_unlock(&root->inode_lock); -@@ -9820,9 +9818,8 @@ static int btrfs_rename_exchange(struct inode *old_dir, - return -EXDEV; - - /* close the race window with snapshot create/destroy ioctl */ -- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) -- down_read(&fs_info->subvol_sem); -- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) -+ if (old_ino == BTRFS_FIRST_FREE_OBJECTID || -+ new_ino == BTRFS_FIRST_FREE_OBJECTID) - down_read(&fs_info->subvol_sem); - - /* -@@ -10014,9 +10011,8 @@ out_fail: - ret2 = btrfs_end_transaction(trans); - ret = ret ? ret : ret2; - out_notrans: -- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) -- up_read(&fs_info->subvol_sem); -- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) -+ if (new_ino == BTRFS_FIRST_FREE_OBJECTID || -+ old_ino == BTRFS_FIRST_FREE_OBJECTID) - up_read(&fs_info->subvol_sem); - - return ret; -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index dd3b4820ac30..e82b4f3f490c 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -580,12 +580,18 @@ static noinline int create_subvol(struct inode *dir, - - btrfs_i_size_write(BTRFS_I(dir), dir->i_size + namelen * 2); - ret = btrfs_update_inode(trans, root, dir); -- BUG_ON(ret); -+ if (ret) { -+ btrfs_abort_transaction(trans, ret); -+ goto fail; -+ } - - ret = btrfs_add_root_ref(trans, fs_info, - objectid, root->root_key.objectid, - btrfs_ino(BTRFS_I(dir)), index, name, namelen); -- BUG_ON(ret); -+ if (ret) { -+ btrfs_abort_transaction(trans, ret); -+ goto fail; -+ } - - ret = btrfs_uuid_tree_add(trans, fs_info, root_item->uuid, - BTRFS_UUID_KEY_SUBVOL, objectid); -diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c -index 3a4e15b39cc1..440c0d5d2050 100644 ---- a/fs/btrfs/reada.c -+++ b/fs/btrfs/reada.c -@@ -734,21 +734,19 @@ static int reada_start_machine_dev(struct btrfs_device *dev) - static void reada_start_machine_worker(struct btrfs_work *work) - { - struct reada_machine_work *rmw; -- struct btrfs_fs_info *fs_info; - int old_ioprio; - - rmw = container_of(work, struct reada_machine_work, work); -- fs_info = rmw->fs_info; -- -- kfree(rmw); - - old_ioprio = IOPRIO_PRIO_VALUE(task_nice_ioclass(current), - task_nice_ioprio(current)); - set_task_ioprio(current, BTRFS_IOPRIO_READA); -- __reada_start_machine(fs_info); -+ __reada_start_machine(rmw->fs_info); - set_task_ioprio(current, old_ioprio); - -- atomic_dec(&fs_info->reada_works_cnt); -+ atomic_dec(&rmw->fs_info->reada_works_cnt); -+ -+ kfree(rmw); - } - - static void __reada_start_machine(struct btrfs_fs_info *fs_info) -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index 9fa6db6a6f7d..d4c00edd16d2 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -4587,6 +4587,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) - fs_root = read_fs_root(fs_info, reloc_root->root_key.offset); - if (IS_ERR(fs_root)) { - err = PTR_ERR(fs_root); -+ list_add_tail(&reloc_root->root_list, &reloc_roots); - goto out_free; - } - -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index 61192c536e6c..2ebae9773978 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -2421,14 +2421,13 @@ static void scrub_missing_raid56_worker(struct btrfs_work *work) - scrub_write_block_to_dev_replace(sblock); - } - -- scrub_block_put(sblock); -- - if (sctx->is_dev_replace && sctx->flush_all_writes) { - mutex_lock(&sctx->wr_lock); - scrub_wr_submit(sctx); - mutex_unlock(&sctx->wr_lock); - } - -+ scrub_block_put(sblock); - scrub_pending_bio_dec(sctx); - } - -diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c -index 8444a018cca2..f6c783e959b7 100644 ---- a/fs/btrfs/tests/free-space-tree-tests.c -+++ b/fs/btrfs/tests/free-space-tree-tests.c -@@ -475,9 +475,9 @@ static int run_test(test_func_t test_func, int bitmaps, u32 sectorsize, - root->fs_info->tree_root = root; - - root->node = alloc_test_extent_buffer(root->fs_info, nodesize); -- if (!root->node) { -- test_msg("Couldn't allocate dummy buffer\n"); -- ret = -ENOMEM; -+ if (IS_ERR(root->node)) { -+ test_msg("couldn't allocate dummy buffer\n"); -+ ret = PTR_ERR(root->node); - goto out; - } - btrfs_set_header_level(root->node, 0); -diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c -index 578fd045e859..eb72cf280546 100644 ---- a/fs/btrfs/tests/qgroup-tests.c -+++ b/fs/btrfs/tests/qgroup-tests.c -@@ -487,9 +487,9 @@ int btrfs_test_qgroups(u32 sectorsize, u32 nodesize) - * *cough*backref walking code*cough* - */ - root->node = alloc_test_extent_buffer(root->fs_info, nodesize); -- if (!root->node) { -+ if (IS_ERR(root->node)) { - test_msg("Couldn't allocate dummy buffer\n"); -- ret = -ENOMEM; -+ ret = PTR_ERR(root->node); - goto out; - } - btrfs_set_header_level(root->node, 0); -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index e35301e5fe8e..98c397eb054c 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -6018,9 +6018,28 @@ again: - wc.replay_dest = btrfs_read_fs_root_no_name(fs_info, &tmp_key); - if (IS_ERR(wc.replay_dest)) { - ret = PTR_ERR(wc.replay_dest); -+ -+ /* -+ * We didn't find the subvol, likely because it was -+ * deleted. This is ok, simply skip this log and go to -+ * the next one. -+ * -+ * We need to exclude the root because we can't have -+ * other log replays overwriting this log as we'll read -+ * it back in a few more times. This will keep our -+ * block from being modified, and we'll just bail for -+ * each subsequent pass. -+ */ -+ if (ret == -ENOENT) -+ ret = btrfs_pin_extent_for_log_replay(fs_info, -+ log->node->start, -+ log->node->len); - free_extent_buffer(log->node); - free_extent_buffer(log->commit_root); - kfree(log); -+ -+ if (!ret) -+ goto next; - btrfs_handle_fs_error(fs_info, ret, - "Couldn't read target root for tree log recovery."); - goto error; -@@ -6052,7 +6071,6 @@ again: - &root->highest_objectid); - } - -- key.offset = found_key.offset - 1; - wc.replay_dest->log_root = NULL; - free_extent_buffer(log->node); - free_extent_buffer(log->commit_root); -@@ -6060,9 +6078,10 @@ again: - - if (ret) - goto error; -- -+next: - if (found_key.offset == 0) - break; -+ key.offset = found_key.offset - 1; - } - btrfs_release_path(path); - -diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c -index 726f928238d0..331f3a1ad23b 100644 ---- a/fs/btrfs/uuid-tree.c -+++ b/fs/btrfs/uuid-tree.c -@@ -336,6 +336,8 @@ again_search_slot: - } - if (ret < 0 && ret != -ENOENT) - goto out; -+ key.offset++; -+ goto again_search_slot; - } - item_size -= sizeof(subid_le); - offset += sizeof(subid_le); -diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c -index 446b6c375b6f..c17855fead7b 100644 ---- a/fs/ext4/dir.c -+++ b/fs/ext4/dir.c -@@ -76,6 +76,11 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, - error_msg = "rec_len is too small for name_len"; - else if (unlikely(((char *) de - buf) + rlen > size)) - error_msg = "directory entry overrun"; -+ else if (unlikely(((char *) de - buf) + rlen > -+ size - EXT4_DIR_REC_LEN(1) && -+ ((char *) de - buf) + rlen != size)) { -+ error_msg = "directory entry too close to block end"; -+ } - else if (unlikely(le32_to_cpu(de->inode) > - le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) - error_msg = "inode out of bounds"; -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 11bc4c69bf16..c2920cbfa3bf 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -5874,7 +5874,7 @@ int ext4_expand_extra_isize(struct inode *inode, - error = ext4_journal_get_write_access(handle, iloc->bh); - if (error) { - brelse(iloc->bh); -- goto out_stop; -+ goto out_unlock; - } - - error = __ext4_expand_extra_isize(inode, new_extra_isize, iloc, -@@ -5884,8 +5884,8 @@ int ext4_expand_extra_isize(struct inode *inode, - if (!error) - error = rc; - -+out_unlock: - ext4_write_unlock_xattr(inode, &no_expand); --out_stop: - ext4_journal_stop(handle); - return error; - } -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index b4e0c270def4..0b5c36bd5418 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -2702,7 +2702,7 @@ bool ext4_empty_dir(struct inode *inode) - { - unsigned int offset; - struct buffer_head *bh; -- struct ext4_dir_entry_2 *de, *de1; -+ struct ext4_dir_entry_2 *de; - struct super_block *sb; - - if (ext4_has_inline_data(inode)) { -@@ -2727,19 +2727,25 @@ bool ext4_empty_dir(struct inode *inode) - return true; - - de = (struct ext4_dir_entry_2 *) bh->b_data; -- de1 = ext4_next_entry(de, sb->s_blocksize); -- if (le32_to_cpu(de->inode) != inode->i_ino || -- le32_to_cpu(de1->inode) == 0 || -- strcmp(".", de->name) || strcmp("..", de1->name)) { -- ext4_warning_inode(inode, "directory missing '.' and/or '..'"); -+ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, -+ 0) || -+ le32_to_cpu(de->inode) != inode->i_ino || strcmp(".", de->name)) { -+ ext4_warning_inode(inode, "directory missing '.'"); -+ brelse(bh); -+ return true; -+ } -+ offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); -+ de = ext4_next_entry(de, sb->s_blocksize); -+ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, -+ offset) || -+ le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) { -+ ext4_warning_inode(inode, "directory missing '..'"); - brelse(bh); - return true; - } -- offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize) + -- ext4_rec_len_from_disk(de1->rec_len, sb->s_blocksize); -- de = ext4_next_entry(de1, sb->s_blocksize); -+ offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); - while (offset < inode->i_size) { -- if ((void *) de >= (void *) (bh->b_data+sb->s_blocksize)) { -+ if (!(offset & (sb->s_blocksize - 1))) { - unsigned int lblock; - brelse(bh); - lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb); -@@ -2750,12 +2756,11 @@ bool ext4_empty_dir(struct inode *inode) - } - if (IS_ERR(bh)) - return true; -- de = (struct ext4_dir_entry_2 *) bh->b_data; - } -+ de = (struct ext4_dir_entry_2 *) (bh->b_data + -+ (offset & (sb->s_blocksize - 1))); - if (ext4_check_dir_entry(inode, NULL, de, bh, - bh->b_data, bh->b_size, offset)) { -- de = (struct ext4_dir_entry_2 *)(bh->b_data + -- sb->s_blocksize); - offset = (offset | (sb->s_blocksize - 1)) + 1; - continue; - } -@@ -2764,7 +2769,6 @@ bool ext4_empty_dir(struct inode *inode) - return false; - } - offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); -- de = ext4_next_entry(de, sb->s_blocksize); - } - brelse(bh); - return true; -diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h -index d55abb75f29a..eec6cba204ea 100644 ---- a/include/drm/drm_dp_mst_helper.h -+++ b/include/drm/drm_dp_mst_helper.h -@@ -313,7 +313,7 @@ struct drm_dp_resource_status_notify { - - struct drm_dp_query_payload_ack_reply { - u8 port_number; -- u8 allocated_pbn; -+ u16 allocated_pbn; - }; - - struct drm_dp_sideband_msg_req_body { -diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h -index 4de703d9e21f..5e1e50b8f8c4 100644 ---- a/include/linux/miscdevice.h -+++ b/include/linux/miscdevice.h -@@ -56,6 +56,7 @@ - #define UHID_MINOR 239 - #define USERIO_MINOR 240 - #define VHOST_VSOCK_MINOR 241 -+#define RFKILL_MINOR 242 - #define MISC_DYNAMIC_MINOR 255 - - struct device; -diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h -index 1c2e8d6b7274..6db347b58644 100644 ---- a/include/linux/mod_devicetable.h -+++ b/include/linux/mod_devicetable.h -@@ -519,9 +519,9 @@ struct platform_device_id { - #define MDIO_NAME_SIZE 32 - #define MDIO_MODULE_PREFIX "mdio:" - --#define MDIO_ID_FMT "%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d" -+#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u" - #define MDIO_ID_ARGS(_id) \ -- (_id)>>31, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ -+ ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ - ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \ - ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \ - ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \ -diff --git a/include/net/dst.h b/include/net/dst.h -index 2acd670fc86b..fe230dd62c28 100644 ---- a/include/net/dst.h -+++ b/include/net/dst.h -@@ -110,7 +110,7 @@ struct dst_entry { - struct dst_metrics { - u32 metrics[RTAX_MAX]; - refcount_t refcnt; --}; -+} __aligned(4); /* Low pointer bits contain DST_METRICS_FLAGS */ - extern const struct dst_metrics dst_default_metrics; - - u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old); -diff --git a/include/trace/events/wbt.h b/include/trace/events/wbt.h -index b048694070e2..37342a13c9cb 100644 ---- a/include/trace/events/wbt.h -+++ b/include/trace/events/wbt.h -@@ -33,7 +33,8 @@ TRACE_EVENT(wbt_stat, - ), - - TP_fast_assign( -- strncpy(__entry->name, dev_name(bdi->dev), 32); -+ strlcpy(__entry->name, dev_name(bdi->dev), -+ ARRAY_SIZE(__entry->name)); - __entry->rmean = stat[0].mean; - __entry->rmin = stat[0].min; - __entry->rmax = stat[0].max; -@@ -67,7 +68,8 @@ TRACE_EVENT(wbt_lat, - ), - - TP_fast_assign( -- strncpy(__entry->name, dev_name(bdi->dev), 32); -+ strlcpy(__entry->name, dev_name(bdi->dev), -+ ARRAY_SIZE(__entry->name)); - __entry->lat = div_u64(lat, 1000); - ), - -@@ -103,7 +105,8 @@ TRACE_EVENT(wbt_step, - ), - - TP_fast_assign( -- strncpy(__entry->name, dev_name(bdi->dev), 32); -+ strlcpy(__entry->name, dev_name(bdi->dev), -+ ARRAY_SIZE(__entry->name)); - __entry->msg = msg; - __entry->step = step; - __entry->window = div_u64(window, 1000); -@@ -138,7 +141,8 @@ TRACE_EVENT(wbt_timer, - ), - - TP_fast_assign( -- strncpy(__entry->name, dev_name(bdi->dev), 32); -+ strlcpy(__entry->name, dev_name(bdi->dev), -+ ARRAY_SIZE(__entry->name)); - __entry->status = status; - __entry->step = step; - __entry->inflight = inflight; -diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h -index 28e8a2a86e16..2a114f7a24d4 100644 ---- a/include/uapi/linux/cec-funcs.h -+++ b/include/uapi/linux/cec-funcs.h -@@ -952,7 +952,8 @@ static inline void cec_msg_give_deck_status(struct cec_msg *msg, - msg->len = 3; - msg->msg[1] = CEC_MSG_GIVE_DECK_STATUS; - msg->msg[2] = status_req; -- msg->reply = reply ? CEC_MSG_DECK_STATUS : 0; -+ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? -+ CEC_MSG_DECK_STATUS : 0; - } - - static inline void cec_ops_give_deck_status(const struct cec_msg *msg, -@@ -1056,7 +1057,8 @@ static inline void cec_msg_give_tuner_device_status(struct cec_msg *msg, - msg->len = 3; - msg->msg[1] = CEC_MSG_GIVE_TUNER_DEVICE_STATUS; - msg->msg[2] = status_req; -- msg->reply = reply ? CEC_MSG_TUNER_DEVICE_STATUS : 0; -+ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? -+ CEC_MSG_TUNER_DEVICE_STATUS : 0; - } - - static inline void cec_ops_give_tuner_device_status(const struct cec_msg *msg, -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index 6bc679cd3481..ff80a9d41ce1 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -802,8 +802,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt) - if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) { - struct hci_cp_le_write_def_data_len cp; - -- cp.tx_len = hdev->le_max_tx_len; -- cp.tx_time = hdev->le_max_tx_time; -+ cp.tx_len = cpu_to_le16(hdev->le_max_tx_len); -+ cp.tx_time = cpu_to_le16(hdev->le_max_tx_time); - hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp); - } - -@@ -4215,7 +4215,14 @@ static void hci_rx_work(struct work_struct *work) - hci_send_to_sock(hdev, skb); - } - -- if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { -+ /* If the device has been opened in HCI_USER_CHANNEL, -+ * the userspace has exclusive access to device. -+ * When device is HCI_INIT, we still need to process -+ * the data packets to the driver in order -+ * to complete its setup(). -+ */ -+ if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && -+ !test_bit(HCI_INIT, &hdev->flags)) { - kfree_skb(skb); - continue; - } -diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c -index b73ac149de34..759329bec399 100644 ---- a/net/bluetooth/hci_request.c -+++ b/net/bluetooth/hci_request.c -@@ -1095,6 +1095,14 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) - - instance_flags = get_adv_instance_flags(hdev, instance); - -+ /* If instance already has the flags set skip adding it once -+ * again. -+ */ -+ if (adv_instance && eir_get_data(adv_instance->adv_data, -+ adv_instance->adv_data_len, EIR_FLAGS, -+ NULL)) -+ goto skip_flags; -+ - /* The Add Advertising command allows userspace to set both the general - * and limited discoverable flags. - */ -@@ -1127,6 +1135,7 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) - } - } - -+skip_flags: - if (adv_instance) { - memcpy(ptr, adv_instance->adv_data, - adv_instance->adv_data_len); -diff --git a/net/mac80211/status.c b/net/mac80211/status.c -index b18466cf466c..fbe7354aeac7 100644 ---- a/net/mac80211/status.c -+++ b/net/mac80211/status.c -@@ -856,7 +856,8 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw, - I802_DEBUG_INC(local->dot11FailedCount); - } - -- if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) && -+ if ((ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) && -+ ieee80211_has_pm(fc) && - ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) && - !(info->flags & IEEE80211_TX_CTL_INJECTED) && - local->ps_sdata && !(local->scanning)) { -diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c -index 8d104c1db628..6f5addb5225c 100644 ---- a/net/nfc/nci/uart.c -+++ b/net/nfc/nci/uart.c -@@ -348,7 +348,7 @@ static int nci_uart_default_recv_buf(struct nci_uart *nu, const u8 *data, - nu->rx_packet_len = -1; - nu->rx_skb = nci_skb_alloc(nu->ndev, - NCI_MAX_PACKET_SIZE, -- GFP_KERNEL); -+ GFP_ATOMIC); - if (!nu->rx_skb) - return -ENOMEM; - } -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 1f86bf0d1649..4e1058159b08 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -593,7 +593,8 @@ static int prb_calc_retire_blk_tmo(struct packet_sock *po, - msec = 1; - div = ecmd.base.speed / 1000; - } -- } -+ } else -+ return DEFAULT_PRB_RETIRE_TOV; - - mbits = (blk_size_in_bytes * 8) / (1024 * 1024); - -diff --git a/net/rfkill/core.c b/net/rfkill/core.c -index 2064c3a35ef8..99a2e55b01cf 100644 ---- a/net/rfkill/core.c -+++ b/net/rfkill/core.c -@@ -1312,10 +1312,12 @@ static const struct file_operations rfkill_fops = { - .llseek = no_llseek, - }; - -+#define RFKILL_NAME "rfkill" -+ - static struct miscdevice rfkill_miscdev = { -- .name = "rfkill", - .fops = &rfkill_fops, -- .minor = MISC_DYNAMIC_MINOR, -+ .name = RFKILL_NAME, -+ .minor = RFKILL_MINOR, - }; - - static int __init rfkill_init(void) -@@ -1367,3 +1369,6 @@ static void __exit rfkill_exit(void) - class_unregister(&rfkill_class); - } - module_exit(rfkill_exit); -+ -+MODULE_ALIAS_MISCDEV(RFKILL_MINOR); -+MODULE_ALIAS("devname:" RFKILL_NAME); -diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c -index 01f88e9abbc6..bf39f317953a 100644 ---- a/net/sctp/protocol.c -+++ b/net/sctp/protocol.c -@@ -253,6 +253,7 @@ static void sctp_v4_from_skb(union sctp_addr *addr, struct sk_buff *skb, - sa->sin_port = sh->dest; - sa->sin_addr.s_addr = ip_hdr(skb)->daddr; - } -+ memset(sa->sin_zero, 0, sizeof(sa->sin_zero)); - } - - /* Initialize an sctp_addr from a socket. */ -@@ -261,6 +262,7 @@ static void sctp_v4_from_sk(union sctp_addr *addr, struct sock *sk) - addr->v4.sin_family = AF_INET; - addr->v4.sin_port = 0; - addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr; -+ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); - } - - /* Initialize sk->sk_rcv_saddr from sctp_addr. */ -@@ -283,6 +285,7 @@ static void sctp_v4_from_addr_param(union sctp_addr *addr, - addr->v4.sin_family = AF_INET; - addr->v4.sin_port = port; - addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; -+ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); - } - - /* Initialize an address parameter from a sctp_addr and return the length -@@ -307,6 +310,7 @@ static void sctp_v4_dst_saddr(union sctp_addr *saddr, struct flowi4 *fl4, - saddr->v4.sin_family = AF_INET; - saddr->v4.sin_port = port; - saddr->v4.sin_addr.s_addr = fl4->saddr; -+ memset(saddr->v4.sin_zero, 0, sizeof(saddr->v4.sin_zero)); - } - - /* Compare two addresses exactly. */ -@@ -329,6 +333,7 @@ static void sctp_v4_inaddr_any(union sctp_addr *addr, __be16 port) - addr->v4.sin_family = AF_INET; - addr->v4.sin_addr.s_addr = htonl(INADDR_ANY); - addr->v4.sin_port = port; -+ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); - } - - /* Is this a wildcard address? */ -diff --git a/samples/bpf/cgroup_helpers.c b/samples/bpf/cgroup_helpers.c -index 09afaddfc9ba..b5c09cd6c7bd 100644 ---- a/samples/bpf/cgroup_helpers.c -+++ b/samples/bpf/cgroup_helpers.c -@@ -43,7 +43,7 @@ - */ - int setup_cgroup_environment(void) - { -- char cgroup_workdir[PATH_MAX + 1]; -+ char cgroup_workdir[PATH_MAX - 24]; - - format_cgroup_path(cgroup_workdir, ""); - -diff --git a/samples/pktgen/functions.sh b/samples/pktgen/functions.sh -index 205e4cde4601..065a7e296ee3 100644 ---- a/samples/pktgen/functions.sh -+++ b/samples/pktgen/functions.sh -@@ -5,6 +5,8 @@ - # Author: Jesper Dangaaard Brouer - # License: GPL - -+set -o errexit -+ - ## -- General shell logging cmds -- - function err() { - local exitcode=$1 -@@ -58,6 +60,7 @@ function pg_set() { - function proc_cmd() { - local result - local proc_file=$1 -+ local status=0 - # after shift, the remaining args are contained in $@ - shift - local proc_ctrl=${PROC_DIR}/$proc_file -@@ -73,13 +76,13 @@ function proc_cmd() { - echo "cmd: $@ > $proc_ctrl" - fi - # Quoting of "$@" is important for space expansion -- echo "$@" > "$proc_ctrl" -- local status=$? -+ echo "$@" > "$proc_ctrl" || status=$? - -- result=$(grep "Result: OK:" $proc_ctrl) -- # Due to pgctrl, cannot use exit code $? from grep -- if [[ "$result" == "" ]]; then -- grep "Result:" $proc_ctrl >&2 -+ if [[ "$proc_file" != "pgctrl" ]]; then -+ result=$(grep "Result: OK:" $proc_ctrl) || true -+ if [[ "$result" == "" ]]; then -+ grep "Result:" $proc_ctrl >&2 -+ fi - fi - if (( $status != 0 )); then - err 5 "Write error($status) occurred cmd: \"$@ > $proc_ctrl\"" -@@ -105,6 +108,8 @@ function pgset() { - fi - } - -+[[ $EUID -eq 0 ]] && trap 'pg_ctrl "reset"' EXIT -+ - ## -- General shell tricks -- - - function root_check_run_with_sudo() { -diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c -index 182e4afd21eb..14b1ee29509d 100644 ---- a/sound/core/pcm_native.c -+++ b/sound/core/pcm_native.c -@@ -720,6 +720,10 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, - while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size) - runtime->boundary *= 2; - -+ /* clear the buffer for avoiding possible kernel info leaks */ -+ if (runtime->dma_area && !substream->ops->copy_user) -+ memset(runtime->dma_area, 0, runtime->dma_bytes); -+ - snd_pcm_timer_resolution_change(substream); - snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP); - -diff --git a/sound/core/timer.c b/sound/core/timer.c -index c60dfd52e8a6..22589a073423 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -88,6 +88,9 @@ static LIST_HEAD(snd_timer_slave_list); - /* lock for slave active lists */ - static DEFINE_SPINLOCK(slave_active_lock); - -+#define MAX_SLAVE_INSTANCES 1000 -+static int num_slaves; -+ - static DEFINE_MUTEX(register_mutex); - - static int snd_timer_free(struct snd_timer *timer); -@@ -266,6 +269,10 @@ int snd_timer_open(struct snd_timer_instance **ti, - err = -EINVAL; - goto unlock; - } -+ if (num_slaves >= MAX_SLAVE_INSTANCES) { -+ err = -EBUSY; -+ goto unlock; -+ } - timeri = snd_timer_instance_new(owner, NULL); - if (!timeri) { - err = -ENOMEM; -@@ -275,6 +282,7 @@ int snd_timer_open(struct snd_timer_instance **ti, - timeri->slave_id = tid->device; - timeri->flags |= SNDRV_TIMER_IFLG_SLAVE; - list_add_tail(&timeri->open_list, &snd_timer_slave_list); -+ num_slaves++; - err = snd_timer_check_slave(timeri); - if (err < 0) { - snd_timer_close_locked(timeri, &card_dev_to_put); -@@ -364,6 +372,8 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri, - struct snd_timer_instance *slave, *tmp; - - list_del(&timeri->open_list); -+ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) -+ num_slaves--; - - /* force to stop the timer */ - snd_timer_stop(timeri); -diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c -index 9876d8dc2ede..92f5f452bee2 100644 ---- a/sound/pci/hda/patch_ca0132.c -+++ b/sound/pci/hda/patch_ca0132.c -@@ -1300,13 +1300,14 @@ struct scp_msg { - - static void dspio_clear_response_queue(struct hda_codec *codec) - { -+ unsigned long timeout = jiffies + msecs_to_jiffies(1000); - unsigned int dummy = 0; -- int status = -1; -+ int status; - - /* clear all from the response queue */ - do { - status = dspio_read(codec, &dummy); -- } while (status == 0); -+ } while (status == 0 && time_before(jiffies, timeout)); - } - - static int dspio_get_response_data(struct hda_codec *codec) -@@ -4424,12 +4425,14 @@ static void ca0132_process_dsp_response(struct hda_codec *codec, - struct ca0132_spec *spec = codec->spec; - - codec_dbg(codec, "ca0132_process_dsp_response\n"); -+ snd_hda_power_up_pm(codec); - if (spec->wait_scp) { - if (dspio_get_response_data(codec) >= 0) - spec->wait_scp = 0; - } - - dspio_clear_response_queue(codec); -+ snd_hda_power_down_pm(codec); - } - - static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb) -diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c -index 1cd20b88a3a9..82ee8f4b965b 100644 ---- a/sound/soc/codecs/rt5677.c -+++ b/sound/soc/codecs/rt5677.c -@@ -297,6 +297,7 @@ static bool rt5677_volatile_register(struct device *dev, unsigned int reg) - case RT5677_I2C_MASTER_CTRL7: - case RT5677_I2C_MASTER_CTRL8: - case RT5677_HAP_GENE_CTRL2: -+ case RT5677_PWR_ANLG2: /* Modified by DSP firmware */ - case RT5677_PWR_DSP_ST: - case RT5677_PRIV_DATA: - case RT5677_ASRC_22: -diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c -index 41cb1fefbd42..405196283688 100644 ---- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c -+++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c -@@ -422,6 +422,9 @@ static int kabylake_dmic_startup(struct snd_pcm_substream *substream) - snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS, - dmic_constraints); - -+ runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; -+ snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16); -+ - return snd_pcm_hw_constraint_list(substream->runtime, 0, - SNDRV_PCM_HW_PARAM_RATE, &constraints_rates); - } -diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile -index 5b2cd5e58df0..5dbb0dde208c 100644 ---- a/tools/lib/subcmd/Makefile -+++ b/tools/lib/subcmd/Makefile -@@ -28,7 +28,9 @@ ifeq ($(DEBUG),0) - endif - endif - --ifeq ($(CC_NO_CLANG), 0) -+ifeq ($(DEBUG),1) -+ CFLAGS += -O0 -+else ifeq ($(CC_NO_CLANG), 0) - CFLAGS += -O3 - else - CFLAGS += -O6 -diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c -index 5e10ba796a6f..569bceff5f51 100644 ---- a/tools/lib/traceevent/parse-filter.c -+++ b/tools/lib/traceevent/parse-filter.c -@@ -1492,8 +1492,10 @@ static int copy_filter_type(struct event_filter *filter, - if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) { - /* Add trivial event */ - arg = allocate_arg(); -- if (arg == NULL) -+ if (arg == NULL) { -+ free(str); - return -1; -+ } - - arg->type = FILTER_ARG_BOOLEAN; - if (strcmp(str, "TRUE") == 0) -@@ -1502,8 +1504,11 @@ static int copy_filter_type(struct event_filter *filter, - arg->boolean.value = 0; - - filter_type = add_filter_type(filter, event->id); -- if (filter_type == NULL) -+ if (filter_type == NULL) { -+ free(str); -+ free_arg(arg); - return -1; -+ } - - filter_type->filter = arg; - -diff --git a/tools/objtool/arch/x86/lib/x86-opcode-map.txt b/tools/objtool/arch/x86/lib/x86-opcode-map.txt -index e0b85930dd77..0a0e9112f284 100644 ---- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt -+++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt -@@ -333,7 +333,7 @@ AVXcode: 1 - 06: CLTS - 07: SYSRET (o64) - 08: INVD --09: WBINVD -+09: WBINVD | WBNOINVD (F3) - 0a: - 0b: UD2 (1B) - 0c: -@@ -364,7 +364,7 @@ AVXcode: 1 - # a ModR/M byte. - 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev - 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv --1c: -+1c: Grp20 (1A),(1C) - 1d: - 1e: - 1f: NOP Ev -@@ -792,6 +792,8 @@ f3: Grp17 (1A) - f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) - f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) - f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) -+f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) -+f9: MOVDIRI My,Gy - EndTable - - Table: 3-byte opcode 2 (0x0f 0x3a) -@@ -943,9 +945,9 @@ GrpTable: Grp6 - EndTable - - GrpTable: Grp7 --0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) --1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) --2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) -+0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) -+1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) -+2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) - 3: LIDT Ms - 4: SMSW Mw/Rv - 5: rdpkru (110),(11B) | wrpkru (111),(11B) -@@ -1020,7 +1022,7 @@ GrpTable: Grp15 - 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) - 4: XSAVE | ptwrite Ey (F3),(11B) - 5: XRSTOR | lfence (11B) --6: XSAVEOPT | clwb (66) | mfence (11B) -+6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) - 7: clflush | clflushopt (66) | sfence (11B) - EndTable - -@@ -1051,6 +1053,10 @@ GrpTable: Grp19 - 6: vscatterpf1qps/d Wx (66),(ev) - EndTable - -+GrpTable: Grp20 -+0: cldemote Mb -+EndTable -+ - # AMD's Prefetch Group - GrpTable: GrpP - 0: PREFETCH -diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c -index 4ddb0726eebc..fd4dd12b8f9d 100644 ---- a/tools/perf/builtin-report.c -+++ b/tools/perf/builtin-report.c -@@ -342,6 +342,13 @@ static int report__setup_sample_type(struct report *rep) - PERF_SAMPLE_BRANCH_ANY)) - rep->nonany_branch_mode = true; - -+#ifndef HAVE_LIBUNWIND_SUPPORT -+ if (dwarf_callchain_users) { -+ ui__warning("Please install libunwind development packages " -+ "during the perf build.\n"); -+ } -+#endif -+ - return 0; - } - -diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c -index 89c8e1604ca7..94fe5464bc6f 100644 ---- a/tools/perf/tests/task-exit.c -+++ b/tools/perf/tests/task-exit.c -@@ -104,6 +104,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused - if (perf_evlist__mmap(evlist, 128, true) < 0) { - pr_debug("failed to mmap events: %d (%s)\n", errno, - str_error_r(errno, sbuf, sizeof(sbuf))); -+ err = -1; - goto out_delete_evlist; - } - -diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c -index f5acda13dcfa..289ef63208fb 100644 ---- a/tools/perf/util/dwarf-aux.c -+++ b/tools/perf/util/dwarf-aux.c -@@ -320,21 +320,51 @@ bool die_is_func_def(Dwarf_Die *dw_die) - dwarf_attr(dw_die, DW_AT_declaration, &attr) == NULL); - } - -+/** -+ * die_entrypc - Returns entry PC (the lowest address) of a DIE -+ * @dw_die: a DIE -+ * @addr: where to store entry PC -+ * -+ * Since dwarf_entrypc() does not return entry PC if the DIE has only address -+ * range, we have to use this to retrieve the lowest address from the address -+ * range attribute. -+ */ -+int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) -+{ -+ Dwarf_Addr base, end; -+ -+ if (!addr) -+ return -EINVAL; -+ -+ if (dwarf_entrypc(dw_die, addr) == 0) -+ return 0; -+ -+ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; -+} -+ - /** - * die_is_func_instance - Ensure that this DIE is an instance of a subprogram - * @dw_die: a DIE - * - * Ensure that this DIE is an instance (which has an entry address). -- * This returns true if @dw_die is a function instance. If not, you need to -- * call die_walk_instances() to find actual instances. -+ * This returns true if @dw_die is a function instance. If not, the @dw_die -+ * must be a prototype. You can use die_walk_instances() to find actual -+ * instances. - **/ - bool die_is_func_instance(Dwarf_Die *dw_die) - { - Dwarf_Addr tmp; -+ Dwarf_Attribute attr_mem; -+ int tag = dwarf_tag(dw_die); - -- /* Actually gcc optimizes non-inline as like as inlined */ -- return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0; -+ if (tag != DW_TAG_subprogram && -+ tag != DW_TAG_inlined_subroutine) -+ return false; -+ -+ return dwarf_entrypc(dw_die, &tmp) == 0 || -+ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL; - } -+ - /** - * die_get_data_member_location - Get the data-member offset - * @mb_die: a DIE of a member of a data structure -@@ -611,6 +641,9 @@ static int __die_walk_instances_cb(Dwarf_Die *inst, void *data) - Dwarf_Die *origin; - int tmp; - -+ if (!die_is_func_instance(inst)) -+ return DIE_FIND_CB_CONTINUE; -+ - attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem); - if (attr == NULL) - return DIE_FIND_CB_CONTINUE; -@@ -682,15 +715,14 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data) - if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) { - fname = die_get_call_file(in_die); - lineno = die_get_call_lineno(in_die); -- if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) { -+ if (fname && lineno > 0 && die_entrypc(in_die, &addr) == 0) { - lw->retval = lw->callback(fname, lineno, addr, lw->data); - if (lw->retval != 0) - return DIE_FIND_CB_END; - } -+ if (!lw->recursive) -+ return DIE_FIND_CB_SIBLING; - } -- if (!lw->recursive) -- /* Don't need to search recursively */ -- return DIE_FIND_CB_SIBLING; - - if (addr) { - fname = dwarf_decl_file(in_die); -@@ -723,7 +755,7 @@ static int __die_walk_funclines(Dwarf_Die *sp_die, bool recursive, - /* Handle function declaration line */ - fname = dwarf_decl_file(sp_die); - if (fname && dwarf_decl_line(sp_die, &lineno) == 0 && -- dwarf_entrypc(sp_die, &addr) == 0) { -+ die_entrypc(sp_die, &addr) == 0) { - lw.retval = callback(fname, lineno, addr, data); - if (lw.retval != 0) - goto done; -@@ -737,6 +769,10 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data) - { - struct __line_walk_param *lw = data; - -+ /* -+ * Since inlined function can include another inlined function in -+ * the same file, we need to walk in it recursively. -+ */ - lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data); - if (lw->retval != 0) - return DWARF_CB_ABORT; -@@ -761,11 +797,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) - Dwarf_Lines *lines; - Dwarf_Line *line; - Dwarf_Addr addr; -- const char *fname, *decf = NULL; -+ const char *fname, *decf = NULL, *inf = NULL; - int lineno, ret = 0; - int decl = 0, inl; - Dwarf_Die die_mem, *cu_die; - size_t nlines, i; -+ bool flag; - - /* Get the CU die */ - if (dwarf_tag(rt_die) != DW_TAG_compile_unit) { -@@ -796,6 +833,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) - "Possible error in debuginfo.\n"); - continue; - } -+ /* Skip end-of-sequence */ -+ if (dwarf_lineendsequence(line, &flag) != 0 || flag) -+ continue; -+ /* Skip Non statement line-info */ -+ if (dwarf_linebeginstatement(line, &flag) != 0 || !flag) -+ continue; - /* Filter lines based on address */ - if (rt_die != cu_die) { - /* -@@ -805,13 +848,21 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) - */ - if (!dwarf_haspc(rt_die, addr)) - continue; -+ - if (die_find_inlinefunc(rt_die, addr, &die_mem)) { -+ /* Call-site check */ -+ inf = die_get_call_file(&die_mem); -+ if ((inf && !strcmp(inf, decf)) && -+ die_get_call_lineno(&die_mem) == lineno) -+ goto found; -+ - dwarf_decl_line(&die_mem, &inl); - if (inl != decl || - decf != dwarf_decl_file(&die_mem)) - continue; - } - } -+found: - /* Get source line */ - fname = dwarf_linesrc(line, NULL, NULL); - -@@ -826,8 +877,9 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) - */ - if (rt_die != cu_die) - /* -- * Don't need walk functions recursively, because nested -- * inlined functions don't have lines of the specified DIE. -+ * Don't need walk inlined functions recursively, because -+ * inner inlined functions don't have the lines of the -+ * specified function. - */ - ret = __die_walk_funclines(rt_die, false, callback, data); - else { -@@ -1002,7 +1054,7 @@ static int die_get_var_innermost_scope(Dwarf_Die *sp_die, Dwarf_Die *vr_die, - bool first = true; - const char *name; - -- ret = dwarf_entrypc(sp_die, &entry); -+ ret = die_entrypc(sp_die, &entry); - if (ret) - return ret; - -@@ -1065,7 +1117,7 @@ int die_get_var_range(Dwarf_Die *sp_die, Dwarf_Die *vr_die, struct strbuf *buf) - bool first = true; - const char *name; - -- ret = dwarf_entrypc(sp_die, &entry); -+ ret = die_entrypc(sp_die, &entry); - if (ret) - return ret; - -diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h -index 8ac53bf1ec4e..ee15fac4e1d0 100644 ---- a/tools/perf/util/dwarf-aux.h -+++ b/tools/perf/util/dwarf-aux.h -@@ -41,6 +41,9 @@ int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr, - /* Get DW_AT_linkage_name (should be NULL for C binary) */ - const char *die_get_linkage_name(Dwarf_Die *dw_die); - -+/* Get the lowest PC in DIE (including range list) */ -+int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr); -+ - /* Ensure that this DIE is a subprogram and definition (not declaration) */ - bool die_is_func_def(Dwarf_Die *dw_die); - -diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c -index 29e2bb304168..096c52f296d7 100644 ---- a/tools/perf/util/parse-events.c -+++ b/tools/perf/util/parse-events.c -@@ -1253,8 +1253,15 @@ static int __parse_events_add_pmu(struct parse_events_state *parse_state, - if (get_config_terms(head_config, &config_terms)) - return -ENOMEM; - -- if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) -+ if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) { -+ struct perf_evsel_config_term *pos, *tmp; -+ -+ list_for_each_entry_safe(pos, tmp, &config_terms, list) { -+ list_del_init(&pos->list); -+ free(pos); -+ } - return -EINVAL; -+ } - - evsel = __add_event(list, &parse_state->idx, &attr, - get_config_name(head_config), pmu, -diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c -index a5731de0e5eb..30a5e92b67bd 100644 ---- a/tools/perf/util/probe-finder.c -+++ b/tools/perf/util/probe-finder.c -@@ -767,6 +767,16 @@ static int find_best_scope_cb(Dwarf_Die *fn_die, void *data) - return 0; - } - -+/* Return innermost DIE */ -+static int find_inner_scope_cb(Dwarf_Die *fn_die, void *data) -+{ -+ struct find_scope_param *fsp = data; -+ -+ memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die)); -+ fsp->found = true; -+ return 1; -+} -+ - /* Find an appropriate scope fits to given conditions */ - static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) - { -@@ -778,8 +788,13 @@ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) - .die_mem = die_mem, - .found = false, - }; -+ int ret; - -- cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp); -+ ret = cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, -+ &fsp); -+ if (!ret && !fsp.found) -+ cu_walk_functions_at(&pf->cu_die, pf->addr, -+ find_inner_scope_cb, &fsp); - - return fsp.found ? die_mem : NULL; - } -@@ -953,7 +968,7 @@ static int probe_point_inline_cb(Dwarf_Die *in_die, void *data) - ret = find_probe_point_lazy(in_die, pf); - else { - /* Get probe address */ -- if (dwarf_entrypc(in_die, &addr) != 0) { -+ if (die_entrypc(in_die, &addr) != 0) { - pr_warning("Failed to get entry address of %s.\n", - dwarf_diename(in_die)); - return -ENOENT; -@@ -1005,7 +1020,7 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data) - param->retval = find_probe_point_by_line(pf); - } else if (die_is_func_instance(sp_die)) { - /* Instances always have the entry address */ -- dwarf_entrypc(sp_die, &pf->addr); -+ die_entrypc(sp_die, &pf->addr); - /* But in some case the entry address is 0 */ - if (pf->addr == 0) { - pr_debug("%s has no entry PC. Skipped\n", -@@ -1417,6 +1432,18 @@ error: - return DIE_FIND_CB_END; - } - -+static bool available_var_finder_overlap(struct available_var_finder *af) -+{ -+ int i; -+ -+ for (i = 0; i < af->nvls; i++) { -+ if (af->pf.addr == af->vls[i].point.address) -+ return true; -+ } -+ return false; -+ -+} -+ - /* Add a found vars into available variables list */ - static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) - { -@@ -1427,6 +1454,14 @@ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) - Dwarf_Die die_mem; - int ret; - -+ /* -+ * For some reason (e.g. different column assigned to same address), -+ * this callback can be called with the address which already passed. -+ * Ignore it first. -+ */ -+ if (available_var_finder_overlap(af)) -+ return 0; -+ - /* Check number of tevs */ - if (af->nvls == af->max_vls) { - pr_warning("Too many( > %d) probe point found.\n", af->max_vls); -@@ -1570,7 +1605,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, - /* Get function entry information */ - func = basefunc = dwarf_diename(&spdie); - if (!func || -- dwarf_entrypc(&spdie, &baseaddr) != 0 || -+ die_entrypc(&spdie, &baseaddr) != 0 || - dwarf_decl_line(&spdie, &baseline) != 0) { - lineno = 0; - goto post; -@@ -1587,7 +1622,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, - while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr, - &indie)) { - /* There is an inline function */ -- if (dwarf_entrypc(&indie, &_addr) == 0 && -+ if (die_entrypc(&indie, &_addr) == 0 && - _addr == addr) { - /* - * addr is at an inline function entry. -diff --git a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c -index f794d6bbb7e9..3e4ff4a1cdf4 100644 ---- a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c -+++ b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c -@@ -40,7 +40,6 @@ static cstate_t hsw_ext_cstates[HSW_EXT_CSTATE_COUNT] = { - { - .name = "PC9", - .desc = N_("Processor Package C9"), -- .desc = N_("Processor Package C2"), - .id = PC9, - .range = RANGE_PACKAGE, - .get_count_percent = hsw_ext_get_count_percent, diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.161-162.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.161-162.patch deleted file mode 100644 index d65225708e..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.161-162.patch +++ /dev/null @@ -1,3364 +0,0 @@ -diff --git a/Makefile b/Makefile -index 6b4528888a75..cb57b5c58e2b 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 161 -+SUBLEVEL = 162 - EXTRAVERSION = - NAME = Petit Gorille - -diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h -index b36c0289a308..6a0f1f524466 100644 ---- a/arch/arm/boot/compressed/libfdt_env.h -+++ b/arch/arm/boot/compressed/libfdt_env.h -@@ -2,11 +2,13 @@ - #ifndef _ARM_LIBFDT_ENV_H - #define _ARM_LIBFDT_ENV_H - -+#include - #include - #include - #include - --#define INT_MAX ((int)(~0U>>1)) -+#define INT32_MAX S32_MAX -+#define UINT32_MAX U32_MAX - - typedef __be16 fdt16_t; - typedef __be32 fdt32_t; -diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h -index 39155d3b2cef..ac5d3c947e04 100644 ---- a/arch/powerpc/boot/libfdt_env.h -+++ b/arch/powerpc/boot/libfdt_env.h -@@ -6,6 +6,8 @@ - #include - - #define INT_MAX ((int)(~0U>>1)) -+#define UINT32_MAX ((u32)~0U) -+#define INT32_MAX ((s32)(UINT32_MAX >> 1)) - - #include "of.h" - -diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c -index f5d6541bf8c2..b3f540c9f410 100644 ---- a/arch/powerpc/kernel/security.c -+++ b/arch/powerpc/kernel/security.c -@@ -134,32 +134,33 @@ ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, cha - - thread_priv = security_ftr_enabled(SEC_FTR_L1D_THREAD_PRIV); - -- if (rfi_flush || thread_priv) { -+ if (rfi_flush) { - struct seq_buf s; - seq_buf_init(&s, buf, PAGE_SIZE - 1); - -- seq_buf_printf(&s, "Mitigation: "); -- -- if (rfi_flush) -- seq_buf_printf(&s, "RFI Flush"); -- -- if (rfi_flush && thread_priv) -- seq_buf_printf(&s, ", "); -- -+ seq_buf_printf(&s, "Mitigation: RFI Flush"); - if (thread_priv) -- seq_buf_printf(&s, "L1D private per thread"); -+ seq_buf_printf(&s, ", L1D private per thread"); - - seq_buf_printf(&s, "\n"); - - return s.len; - } - -+ if (thread_priv) -+ return sprintf(buf, "Vulnerable: L1D private per thread\n"); -+ - if (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) && - !security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)) - return sprintf(buf, "Not affected\n"); - - return sprintf(buf, "Vulnerable\n"); - } -+ -+ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf) -+{ -+ return cpu_show_meltdown(dev, attr, buf); -+} - #endif - - ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf) -diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c -index 14f3f28a089e..66a9987dc0f8 100644 ---- a/arch/powerpc/kernel/time.c -+++ b/arch/powerpc/kernel/time.c -@@ -241,7 +241,7 @@ static u64 scan_dispatch_log(u64 stop_tb) - * Accumulate stolen time by scanning the dispatch trace log. - * Called on entry from user mode. - */ --void accumulate_stolen_time(void) -+void notrace accumulate_stolen_time(void) - { - u64 sst, ust; - u8 save_soft_enabled = local_paca->soft_enabled; -diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c -index 58c14749bb0c..387600ecea60 100644 ---- a/arch/powerpc/mm/hash_utils_64.c -+++ b/arch/powerpc/mm/hash_utils_64.c -@@ -292,10 +292,18 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend, - ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot, - HPTE_V_BOLTED, psize, psize, - ssize); -- -+ if (ret == -1) { -+ /* Try to remove a non bolted entry */ -+ ret = mmu_hash_ops.hpte_remove(hpteg); -+ if (ret != -1) -+ ret = mmu_hash_ops.hpte_insert(hpteg, vpn, paddr, tprot, -+ HPTE_V_BOLTED, psize, psize, -+ ssize); -+ } - if (ret < 0) - break; - -+ cond_resched(); - #ifdef CONFIG_DEBUG_PAGEALLOC - if (debug_pagealloc_enabled() && - (paddr >> PAGE_SHIFT) < linear_map_hash_count) -diff --git a/arch/powerpc/platforms/pseries/cmm.c b/arch/powerpc/platforms/pseries/cmm.c -index 4ac419c7eb4c..25224c9e1dc0 100644 ---- a/arch/powerpc/platforms/pseries/cmm.c -+++ b/arch/powerpc/platforms/pseries/cmm.c -@@ -425,6 +425,10 @@ static struct bus_type cmm_subsys = { - .dev_name = "cmm", - }; - -+static void cmm_release_device(struct device *dev) -+{ -+} -+ - /** - * cmm_sysfs_register - Register with sysfs - * -@@ -440,6 +444,7 @@ static int cmm_sysfs_register(struct device *dev) - - dev->id = 0; - dev->bus = &cmm_subsys; -+ dev->release = cmm_release_device; - - if ((rc = device_register(dev))) - goto subsys_unregister; -diff --git a/arch/powerpc/tools/relocs_check.sh b/arch/powerpc/tools/relocs_check.sh -index ec2d5c835170..d6c16e7faa38 100755 ---- a/arch/powerpc/tools/relocs_check.sh -+++ b/arch/powerpc/tools/relocs_check.sh -@@ -23,7 +23,7 @@ objdump="$1" - vmlinux="$2" - - bad_relocs=$( --"$objdump" -R "$vmlinux" | -+$objdump -R "$vmlinux" | - # Only look at relocation lines. - grep -E '\:' | - awk '{print $1}' - ) - - BRANCHES=$( --"$objdump" -R "$vmlinux" -D --start-address=0xc000000000000000 \ -+$objdump -R "$vmlinux" -D --start-address=0xc000000000000000 \ - --stop-address=${end_intr} | - grep -e "^c[0-9a-f]*:[[:space:]]*\([0-9a-f][0-9a-f][[:space:]]\)\{4\}[[:space:]]*b" | - grep -v '\<__start_initialization_multiplatform>' | -diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c -index 2e2fd9535f86..45304085b6ee 100644 ---- a/arch/s390/kernel/perf_cpum_sf.c -+++ b/arch/s390/kernel/perf_cpum_sf.c -@@ -185,7 +185,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, - unsigned long num_sdb, gfp_t gfp_flags) - { - int i, rc; -- unsigned long *new, *tail; -+ unsigned long *new, *tail, *tail_prev = NULL; - - if (!sfb->sdbt || !sfb->tail) - return -EINVAL; -@@ -224,6 +224,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, - sfb->num_sdbt++; - /* Link current page to tail of chain */ - *tail = (unsigned long)(void *) new + 1; -+ tail_prev = tail; - tail = new; - } - -@@ -233,10 +234,22 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb, - * issue, a new realloc call (if required) might succeed. - */ - rc = alloc_sample_data_block(tail, gfp_flags); -- if (rc) -+ if (rc) { -+ /* Undo last SDBT. An SDBT with no SDB at its first -+ * entry but with an SDBT entry instead can not be -+ * handled by the interrupt handler code. -+ * Avoid this situation. -+ */ -+ if (tail_prev) { -+ sfb->num_sdbt--; -+ free_page((unsigned long) new); -+ tail = tail_prev; -+ } - break; -+ } - sfb->num_sdb++; - tail++; -+ tail_prev = new = NULL; /* Allocated at least one SBD */ - } - - /* Link sampling buffer to its origin */ -diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c -index c7bd2e549a6a..0b0e44f85393 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce.c -+++ b/arch/x86/kernel/cpu/mcheck/mce.c -@@ -802,8 +802,8 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp, - if (quirk_no_way_out) - quirk_no_way_out(i, m, regs); - -+ m->bank = i; - if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) { -- m->bank = i; - mce_read_aux(m, i); - *msg = tmp; - return 1; -diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c -index 90dd8e7291da..1c90da4af94f 100644 ---- a/drivers/cdrom/cdrom.c -+++ b/drivers/cdrom/cdrom.c -@@ -995,6 +995,12 @@ static void cdrom_count_tracks(struct cdrom_device_info *cdi, tracktype *tracks) - tracks->xa = 0; - tracks->error = 0; - cd_dbg(CD_COUNT_TRACKS, "entering cdrom_count_tracks\n"); -+ -+ if (!CDROM_CAN(CDC_PLAY_AUDIO)) { -+ tracks->error = CDS_NO_INFO; -+ return; -+ } -+ - /* Grab the TOC header so we can see how many tracks there are */ - ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCHDR, &header); - if (ret) { -@@ -1161,7 +1167,8 @@ int cdrom_open(struct cdrom_device_info *cdi, struct block_device *bdev, - ret = open_for_data(cdi); - if (ret) - goto err; -- cdrom_mmc3_profile(cdi); -+ if (CDROM_CAN(CDC_GENERIC_PACKET)) -+ cdrom_mmc3_profile(cdi); - if (mode & FMODE_WRITE) { - ret = -EROFS; - if (cdrom_open_write(cdi)) -@@ -2878,6 +2885,9 @@ int cdrom_get_last_written(struct cdrom_device_info *cdi, long *last_written) - it doesn't give enough information or fails. then we return - the toc contents. */ - use_toc: -+ if (!CDROM_CAN(CDC_PLAY_AUDIO)) -+ return -ENOSYS; -+ - toc.cdte_format = CDROM_MSF; - toc.cdte_track = CDROM_LEADOUT; - if ((ret = cdi->ops->audio_ioctl(cdi, CDROMREADTOCENTRY, &toc))) -diff --git a/drivers/clk/pxa/clk-pxa27x.c b/drivers/clk/pxa/clk-pxa27x.c -index 25a30194d27a..b67ea86ff156 100644 ---- a/drivers/clk/pxa/clk-pxa27x.c -+++ b/drivers/clk/pxa/clk-pxa27x.c -@@ -462,6 +462,7 @@ struct dummy_clk { - }; - static struct dummy_clk dummy_clks[] __initdata = { - DUMMY_CLK(NULL, "pxa27x-gpio", "osc_32_768khz"), -+ DUMMY_CLK(NULL, "pxa-rtc", "osc_32_768khz"), - DUMMY_CLK(NULL, "sa1100-rtc", "osc_32_768khz"), - DUMMY_CLK("UARTCLK", "pxa2xx-ir", "STUART"), - }; -diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c -index 1a0985ae20d2..a93439242565 100644 ---- a/drivers/clk/qcom/clk-rcg2.c -+++ b/drivers/clk/qcom/clk-rcg2.c -@@ -212,6 +212,8 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f, - p = clk_hw_get_parent_by_index(hw, index); - if (clk_flags & CLK_SET_RATE_PARENT) { - if (f->pre_div) { -+ if (!rate) -+ rate = req->rate; - rate /= 2; - rate *= f->pre_div + 1; - } -diff --git a/drivers/clk/qcom/common.c b/drivers/clk/qcom/common.c -index 28ceaf1e9937..ae9352f7706d 100644 ---- a/drivers/clk/qcom/common.c -+++ b/drivers/clk/qcom/common.c -@@ -37,6 +37,9 @@ struct freq_tbl *qcom_find_freq(const struct freq_tbl *f, unsigned long rate) - if (!f) - return NULL; - -+ if (!f->freq) -+ return f; -+ - for (; f->freq; f++) - if (rate <= f->freq) - return f; -diff --git a/drivers/clocksource/asm9260_timer.c b/drivers/clocksource/asm9260_timer.c -index 38cd2feb87c4..0ce760776406 100644 ---- a/drivers/clocksource/asm9260_timer.c -+++ b/drivers/clocksource/asm9260_timer.c -@@ -198,6 +198,10 @@ static int __init asm9260_timer_init(struct device_node *np) - } - - clk = of_clk_get(np, 0); -+ if (IS_ERR(clk)) { -+ pr_err("Failed to get clk!\n"); -+ return PTR_ERR(clk); -+ } - - ret = clk_prepare_enable(clk); - if (ret) { -diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c -index 8c93dec498fa..e7783b852d69 100644 ---- a/drivers/gpio/gpio-mpc8xxx.c -+++ b/drivers/gpio/gpio-mpc8xxx.c -@@ -337,7 +337,8 @@ static int mpc8xxx_probe(struct platform_device *pdev) - * It's assumed that only a single type of gpio controller is available - * on the current machine, so overwriting global data is fine. - */ -- mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type; -+ if (devtype->irq_set_type) -+ mpc8xxx_irq_chip.irq_set_type = devtype->irq_set_type; - - if (devtype->gpio_dir_out) - gc->direction_output = devtype->gpio_dir_out; -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 0c547bf841f4..6a04b56d161b 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -760,6 +760,10 @@ static void hid_scan_feature_usage(struct hid_parser *parser, u32 usage) - if (usage == 0xff0000c5 && parser->global.report_count == 256 && - parser->global.report_size == 8) - parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8; -+ -+ if (usage == 0xff0000c6 && parser->global.report_count == 1 && -+ parser->global.report_size == 8) -+ parser->scan_flags |= HID_SCAN_FLAG_MT_WIN_8; - } - - static void hid_scan_collection(struct hid_parser *parser, unsigned type) -diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c -index 4706fb852eaf..6ad776b4711b 100644 ---- a/drivers/hid/hid-logitech-hidpp.c -+++ b/drivers/hid/hid-logitech-hidpp.c -@@ -978,6 +978,9 @@ static int hidpp20_batterylevel_get_battery_capacity(struct hidpp_device *hidpp, - ret = hidpp_send_fap_command_sync(hidpp, feature_index, - CMD_BATTERY_LEVEL_STATUS_GET_BATTERY_LEVEL_STATUS, - NULL, 0, &response); -+ /* Ignore these intermittent errors */ -+ if (ret == HIDPP_ERROR_RESOURCE_ERROR) -+ return -EIO; - if (ret > 0) { - hid_err(hidpp->hid_dev, "%s: received protocol error 0x%02x\n", - __func__, ret); -diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c -index 59aaac43db91..138d1f3b12b2 100644 ---- a/drivers/input/touchscreen/atmel_mxt_ts.c -+++ b/drivers/input/touchscreen/atmel_mxt_ts.c -@@ -3257,6 +3257,8 @@ static int __maybe_unused mxt_suspend(struct device *dev) - - mutex_unlock(&input_dev->mutex); - -+ disable_irq(data->irq); -+ - return 0; - } - -@@ -3269,6 +3271,8 @@ static int __maybe_unused mxt_resume(struct device *dev) - if (!input_dev) - return 0; - -+ enable_irq(data->irq); -+ - mutex_lock(&input_dev->mutex); - - if (input_dev->users) -diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c -index 40eb8138546a..848dac3e4580 100644 ---- a/drivers/iommu/tegra-smmu.c -+++ b/drivers/iommu/tegra-smmu.c -@@ -156,9 +156,9 @@ static bool smmu_dma_addr_valid(struct tegra_smmu *smmu, dma_addr_t addr) - return (addr & smmu->pfn_mask) == addr; - } - --static dma_addr_t smmu_pde_to_dma(u32 pde) -+static dma_addr_t smmu_pde_to_dma(struct tegra_smmu *smmu, u32 pde) - { -- return pde << 12; -+ return (dma_addr_t)(pde & smmu->pfn_mask) << 12; - } - - static void smmu_flush_ptc_all(struct tegra_smmu *smmu) -@@ -543,6 +543,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova, - dma_addr_t *dmap) - { - unsigned int pd_index = iova_pd_index(iova); -+ struct tegra_smmu *smmu = as->smmu; - struct page *pt_page; - u32 *pd; - -@@ -551,7 +552,7 @@ static u32 *tegra_smmu_pte_lookup(struct tegra_smmu_as *as, unsigned long iova, - return NULL; - - pd = page_address(as->pd); -- *dmap = smmu_pde_to_dma(pd[pd_index]); -+ *dmap = smmu_pde_to_dma(smmu, pd[pd_index]); - - return tegra_smmu_pte_offset(pt_page, iova); - } -@@ -593,7 +594,7 @@ static u32 *as_get_pte(struct tegra_smmu_as *as, dma_addr_t iova, - } else { - u32 *pd = page_address(as->pd); - -- *dmap = smmu_pde_to_dma(pd[pde]); -+ *dmap = smmu_pde_to_dma(smmu, pd[pde]); - } - - return tegra_smmu_pte_offset(as->pts[pde], iova); -@@ -618,7 +619,7 @@ static void tegra_smmu_pte_put_use(struct tegra_smmu_as *as, unsigned long iova) - if (--as->count[pde] == 0) { - struct tegra_smmu *smmu = as->smmu; - u32 *pd = page_address(as->pd); -- dma_addr_t pte_dma = smmu_pde_to_dma(pd[pde]); -+ dma_addr_t pte_dma = smmu_pde_to_dma(smmu, pd[pde]); - - tegra_smmu_set_pde(as, iova, 0); - -diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c -index 0b9a8b709abf..b32988cac80c 100644 ---- a/drivers/irqchip/irq-bcm7038-l1.c -+++ b/drivers/irqchip/irq-bcm7038-l1.c -@@ -284,6 +284,10 @@ static int __init bcm7038_l1_init_one(struct device_node *dn, - pr_err("failed to map parent interrupt %d\n", parent_irq); - return -EINVAL; - } -+ -+ if (of_property_read_bool(dn, "brcm,irq-can-wake")) -+ enable_irq_wake(parent_irq); -+ - irq_set_chained_handler_and_data(parent_irq, bcm7038_l1_irq_handle, - intc); - -diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c -index fc5953dea509..b2e16dca76a6 100644 ---- a/drivers/irqchip/irq-ingenic.c -+++ b/drivers/irqchip/irq-ingenic.c -@@ -117,6 +117,14 @@ static int __init ingenic_intc_of_init(struct device_node *node, - goto out_unmap_irq; - } - -+ domain = irq_domain_add_legacy(node, num_chips * 32, -+ JZ4740_IRQ_BASE, 0, -+ &irq_domain_simple_ops, NULL); -+ if (!domain) { -+ err = -ENOMEM; -+ goto out_unmap_base; -+ } -+ - for (i = 0; i < num_chips; i++) { - /* Mask all irqs */ - writel(0xffffffff, intc->base + (i * CHIP_SIZE) + -@@ -143,14 +151,11 @@ static int __init ingenic_intc_of_init(struct device_node *node, - IRQ_NOPROBE | IRQ_LEVEL); - } - -- domain = irq_domain_add_legacy(node, num_chips * 32, JZ4740_IRQ_BASE, 0, -- &irq_domain_simple_ops, NULL); -- if (!domain) -- pr_warn("unable to register IRQ domain\n"); -- - setup_irq(parent_irq, &intc_cascade_action); - return 0; - -+out_unmap_base: -+ iounmap(intc->base); - out_unmap_irq: - irq_dispose_mapping(parent_irq); - out_free: -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 9406326216f1..96a6583e7b52 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -685,6 +685,8 @@ static unsigned long bch_mca_scan(struct shrinker *shrink, - * IO can always make forward progress: - */ - nr /= c->btree_pages; -+ if (nr == 0) -+ nr = 1; - nr = min_t(unsigned long, nr, mca_can_free(c)); - - i = 0; -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 5f6602cb191f..fef599eb822b 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2186,9 +2186,6 @@ static void bond_miimon_commit(struct bonding *bond) - } else if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) { - /* make it immediately active */ - bond_set_active_slave(slave); -- } else if (slave != primary) { -- /* prevent it from being the active one */ -- bond_set_backup_slave(slave); - } - - netdev_info(bond->dev, "link status definitely up for interface %s, %u Mbps %s duplex\n", -diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c -index db6f6a877f63..d22b138c2b09 100644 ---- a/drivers/net/ethernet/amazon/ena/ena_netdev.c -+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c -@@ -1196,8 +1196,8 @@ static int ena_io_poll(struct napi_struct *napi, int budget) - struct ena_napi *ena_napi = container_of(napi, struct ena_napi, napi); - struct ena_ring *tx_ring, *rx_ring; - -- u32 tx_work_done; -- u32 rx_work_done; -+ int tx_work_done; -+ int rx_work_done = 0; - int tx_budget; - int napi_comp_call = 0; - int ret; -@@ -1214,7 +1214,11 @@ static int ena_io_poll(struct napi_struct *napi, int budget) - } - - tx_work_done = ena_clean_tx_irq(tx_ring, tx_budget); -- rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget); -+ /* On netpoll the budget is zero and the handler should only clean the -+ * tx completions. -+ */ -+ if (likely(budget)) -+ rx_work_done = ena_clean_rx_irq(rx_ring, napi, budget); - - /* If the device is about to reset or down, avoid unmask - * the interrupt and return 0 so NAPI won't reschedule -diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c -index 993cb5ba934e..b99169a386eb 100644 ---- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c -+++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2.c -@@ -37,6 +37,7 @@ - #include - #include - #include -+#include - #include - #include "mlxfw_mfa2.h" - #include "mlxfw_mfa2_file.h" -@@ -579,7 +580,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file, - comp_size = be32_to_cpu(comp->size); - comp_buf_size = comp_size + mlxfw_mfa2_comp_magic_len; - -- comp_data = kmalloc(sizeof(*comp_data) + comp_buf_size, GFP_KERNEL); -+ comp_data = vzalloc(sizeof(*comp_data) + comp_buf_size); - if (!comp_data) - return ERR_PTR(-ENOMEM); - comp_data->comp.data_size = comp_size; -@@ -601,7 +602,7 @@ mlxfw_mfa2_file_component_get(const struct mlxfw_mfa2_file *mfa2_file, - comp_data->comp.data = comp_data->buff + mlxfw_mfa2_comp_magic_len; - return &comp_data->comp; - err_out: -- kfree(comp_data); -+ vfree(comp_data); - return ERR_PTR(err); - } - -@@ -610,7 +611,7 @@ void mlxfw_mfa2_file_component_put(struct mlxfw_mfa2_component *comp) - const struct mlxfw_mfa2_comp_data *comp_data; - - comp_data = container_of(comp, struct mlxfw_mfa2_comp_data, comp); -- kfree(comp_data); -+ vfree(comp_data); - } - - void mlxfw_mfa2_file_fini(struct mlxfw_mfa2_file *mfa2_file) -diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c -index 5de4053774b8..35905e9ee9ec 100644 ---- a/drivers/net/gtp.c -+++ b/drivers/net/gtp.c -@@ -42,7 +42,6 @@ struct pdp_ctx { - struct hlist_node hlist_addr; - - union { -- u64 tid; - struct { - u64 tid; - u16 flow; -@@ -545,7 +544,7 @@ static int gtp_build_skb_ip4(struct sk_buff *skb, struct net_device *dev, - mtu = dst_mtu(&rt->dst); - } - -- rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu); -+ rt->dst.ops->update_pmtu(&rt->dst, NULL, skb, mtu, false); - - if (!skb_is_gso(skb) && (iph->frag_off & htons(IP_DF)) && - mtu < ntohs(iph->tot_len)) { -@@ -645,9 +644,16 @@ static void gtp_link_setup(struct net_device *dev) - } - - static int gtp_hashtable_new(struct gtp_dev *gtp, int hsize); --static void gtp_hashtable_free(struct gtp_dev *gtp); - static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]); - -+static void gtp_destructor(struct net_device *dev) -+{ -+ struct gtp_dev *gtp = netdev_priv(dev); -+ -+ kfree(gtp->addr_hash); -+ kfree(gtp->tid_hash); -+} -+ - static int gtp_newlink(struct net *src_net, struct net_device *dev, - struct nlattr *tb[], struct nlattr *data[], - struct netlink_ext_ack *extack) -@@ -665,10 +671,13 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, - if (err < 0) - return err; - -- if (!data[IFLA_GTP_PDP_HASHSIZE]) -+ if (!data[IFLA_GTP_PDP_HASHSIZE]) { - hashsize = 1024; -- else -+ } else { - hashsize = nla_get_u32(data[IFLA_GTP_PDP_HASHSIZE]); -+ if (!hashsize) -+ hashsize = 1024; -+ } - - err = gtp_hashtable_new(gtp, hashsize); - if (err < 0) -@@ -682,13 +691,15 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, - - gn = net_generic(dev_net(dev), gtp_net_id); - list_add_rcu(>p->list, &gn->gtp_dev_list); -+ dev->priv_destructor = gtp_destructor; - - netdev_dbg(dev, "registered new GTP interface\n"); - - return 0; - - out_hashtable: -- gtp_hashtable_free(gtp); -+ kfree(gtp->addr_hash); -+ kfree(gtp->tid_hash); - out_encap: - gtp_encap_disable(gtp); - return err; -@@ -697,9 +708,14 @@ out_encap: - static void gtp_dellink(struct net_device *dev, struct list_head *head) - { - struct gtp_dev *gtp = netdev_priv(dev); -+ struct pdp_ctx *pctx; -+ int i; -+ -+ for (i = 0; i < gtp->hash_size; i++) -+ hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) -+ pdp_context_delete(pctx); - - gtp_encap_disable(gtp); -- gtp_hashtable_free(gtp); - list_del_rcu(>p->list); - unregister_netdevice_queue(dev, head); - } -@@ -775,20 +791,6 @@ err1: - return -ENOMEM; - } - --static void gtp_hashtable_free(struct gtp_dev *gtp) --{ -- struct pdp_ctx *pctx; -- int i; -- -- for (i = 0; i < gtp->hash_size; i++) -- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) -- pdp_context_delete(pctx); -- -- synchronize_rcu(); -- kfree(gtp->addr_hash); -- kfree(gtp->tid_hash); --} -- - static struct sock *gtp_encap_enable_socket(int fd, int type, - struct gtp_dev *gtp) - { -@@ -929,24 +931,31 @@ static void ipv4_pdp_fill(struct pdp_ctx *pctx, struct genl_info *info) - } - } - --static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, -- struct genl_info *info) -+static int gtp_pdp_add(struct gtp_dev *gtp, struct sock *sk, -+ struct genl_info *info) - { -+ struct pdp_ctx *pctx, *pctx_tid = NULL; - struct net_device *dev = gtp->dev; - u32 hash_ms, hash_tid = 0; -- struct pdp_ctx *pctx; -+ unsigned int version; - bool found = false; - __be32 ms_addr; - - ms_addr = nla_get_be32(info->attrs[GTPA_MS_ADDRESS]); - hash_ms = ipv4_hashfn(ms_addr) % gtp->hash_size; -+ version = nla_get_u32(info->attrs[GTPA_VERSION]); - -- hlist_for_each_entry_rcu(pctx, >p->addr_hash[hash_ms], hlist_addr) { -- if (pctx->ms_addr_ip4.s_addr == ms_addr) { -- found = true; -- break; -- } -- } -+ pctx = ipv4_pdp_find(gtp, ms_addr); -+ if (pctx) -+ found = true; -+ if (version == GTP_V0) -+ pctx_tid = gtp0_pdp_find(gtp, -+ nla_get_u64(info->attrs[GTPA_TID])); -+ else if (version == GTP_V1) -+ pctx_tid = gtp1_pdp_find(gtp, -+ nla_get_u32(info->attrs[GTPA_I_TEI])); -+ if (pctx_tid) -+ found = true; - - if (found) { - if (info->nlhdr->nlmsg_flags & NLM_F_EXCL) -@@ -954,6 +963,11 @@ static int ipv4_pdp_add(struct gtp_dev *gtp, struct sock *sk, - if (info->nlhdr->nlmsg_flags & NLM_F_REPLACE) - return -EOPNOTSUPP; - -+ if (pctx && pctx_tid) -+ return -EEXIST; -+ if (!pctx) -+ pctx = pctx_tid; -+ - ipv4_pdp_fill(pctx, info); - - if (pctx->gtp_version == GTP_V0) -@@ -1077,7 +1091,7 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct genl_info *info) - goto out_unlock; - } - -- err = ipv4_pdp_add(gtp, sk, info); -+ err = gtp_pdp_add(gtp, sk, info); - - out_unlock: - rcu_read_unlock(); -@@ -1235,43 +1249,46 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb, - struct netlink_callback *cb) - { - struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp; -+ int i, j, bucket = cb->args[0], skip = cb->args[1]; - struct net *net = sock_net(skb->sk); -- struct gtp_net *gn = net_generic(net, gtp_net_id); -- unsigned long tid = cb->args[1]; -- int i, k = cb->args[0], ret; - struct pdp_ctx *pctx; -+ struct gtp_net *gn; -+ -+ gn = net_generic(net, gtp_net_id); - - if (cb->args[4]) - return 0; - -+ rcu_read_lock(); - list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) { - if (last_gtp && last_gtp != gtp) - continue; - else - last_gtp = NULL; - -- for (i = k; i < gtp->hash_size; i++) { -- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) { -- if (tid && tid != pctx->u.tid) -- continue; -- else -- tid = 0; -- -- ret = gtp_genl_fill_info(skb, -- NETLINK_CB(cb->skb).portid, -- cb->nlh->nlmsg_seq, -- cb->nlh->nlmsg_type, pctx); -- if (ret < 0) { -+ for (i = bucket; i < gtp->hash_size; i++) { -+ j = 0; -+ hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], -+ hlist_tid) { -+ if (j >= skip && -+ gtp_genl_fill_info(skb, -+ NETLINK_CB(cb->skb).portid, -+ cb->nlh->nlmsg_seq, -+ cb->nlh->nlmsg_type, pctx)) { - cb->args[0] = i; -- cb->args[1] = pctx->u.tid; -+ cb->args[1] = j; - cb->args[2] = (unsigned long)gtp; - goto out; - } -+ j++; - } -+ skip = 0; - } -+ bucket = 0; - } - cb->args[4] = 1; - out: -+ rcu_read_unlock(); - return skb->len; - } - -diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c -index 021a8ec411ab..6d4742d10a78 100644 ---- a/drivers/net/hamradio/6pack.c -+++ b/drivers/net/hamradio/6pack.c -@@ -665,10 +665,10 @@ static void sixpack_close(struct tty_struct *tty) - { - struct sixpack *sp; - -- write_lock_bh(&disc_data_lock); -+ write_lock_irq(&disc_data_lock); - sp = tty->disc_data; - tty->disc_data = NULL; -- write_unlock_bh(&disc_data_lock); -+ write_unlock_irq(&disc_data_lock); - if (!sp) - return; - -diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c -index aec6c26563cf..9fd7dab42a53 100644 ---- a/drivers/net/hamradio/mkiss.c -+++ b/drivers/net/hamradio/mkiss.c -@@ -783,10 +783,10 @@ static void mkiss_close(struct tty_struct *tty) - { - struct mkiss *ax; - -- write_lock_bh(&disc_data_lock); -+ write_lock_irq(&disc_data_lock); - ax = tty->disc_data; - tty->disc_data = NULL; -- write_unlock_bh(&disc_data_lock); -+ write_unlock_irq(&disc_data_lock); - - if (!ax) - return; -diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c -index b2feda35966b..471498469d0a 100644 ---- a/drivers/nvdimm/btt.c -+++ b/drivers/nvdimm/btt.c -@@ -1259,11 +1259,11 @@ static int btt_read_pg(struct btt *btt, struct bio_integrity_payload *bip, - - ret = btt_data_read(arena, page, off, postmap, cur_len); - if (ret) { -- int rc; -- - /* Media error - set the e_flag */ -- rc = btt_map_write(arena, premap, postmap, 0, 1, -- NVDIMM_IO_ATOMIC); -+ if (btt_map_write(arena, premap, postmap, 0, 1, NVDIMM_IO_ATOMIC)) -+ dev_warn_ratelimited(to_dev(arena), -+ "Error persistently tracking bad blocks at %#x\n", -+ premap); - goto out_rtt; - } - -diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c -index beeb7cbb5015..9df5d29d708d 100644 ---- a/drivers/pinctrl/intel/pinctrl-baytrail.c -+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c -@@ -204,7 +204,6 @@ struct byt_gpio { - struct platform_device *pdev; - struct pinctrl_dev *pctl_dev; - struct pinctrl_desc pctl_desc; -- raw_spinlock_t lock; - const struct byt_pinctrl_soc_data *soc_data; - struct byt_community *communities_copy; - struct byt_gpio_pin_context *saved_context; -@@ -715,6 +714,8 @@ static const struct byt_pinctrl_soc_data *byt_soc_data[] = { - NULL, - }; - -+static DEFINE_RAW_SPINLOCK(byt_lock); -+ - static struct byt_community *byt_get_community(struct byt_gpio *vg, - unsigned int pin) - { -@@ -856,7 +857,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg, - unsigned long flags; - int i; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - - for (i = 0; i < group.npins; i++) { - void __iomem *padcfg0; -@@ -876,7 +877,7 @@ static void byt_set_group_simple_mux(struct byt_gpio *vg, - writel(value, padcfg0); - } - -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - } - - static void byt_set_group_mixed_mux(struct byt_gpio *vg, -@@ -886,7 +887,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg, - unsigned long flags; - int i; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - - for (i = 0; i < group.npins; i++) { - void __iomem *padcfg0; -@@ -906,7 +907,7 @@ static void byt_set_group_mixed_mux(struct byt_gpio *vg, - writel(value, padcfg0); - } - -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - } - - static int byt_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector, -@@ -955,11 +956,11 @@ static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned int offset) - unsigned long flags; - u32 value; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - value = readl(reg); - value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL); - writel(value, reg); -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - } - - static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev, -@@ -971,7 +972,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev, - u32 value, gpio_mux; - unsigned long flags; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - - /* - * In most cases, func pin mux 000 means GPIO function. -@@ -993,7 +994,7 @@ static int byt_gpio_request_enable(struct pinctrl_dev *pctl_dev, - "pin %u forcibly re-configured as GPIO\n", offset); - } - -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - - pm_runtime_get(&vg->pdev->dev); - -@@ -1021,7 +1022,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, - unsigned long flags; - u32 value; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - - value = readl(val_reg); - value &= ~BYT_DIR_MASK; -@@ -1038,7 +1039,7 @@ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev, - "Potential Error: Setting GPIO with direct_irq_en to output"); - writel(value, val_reg); - -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - - return 0; - } -@@ -1107,11 +1108,11 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset, - u32 conf, pull, val, debounce; - u16 arg = 0; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - conf = readl(conf_reg); - pull = conf & BYT_PULL_ASSIGN_MASK; - val = readl(val_reg); -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - - switch (param) { - case PIN_CONFIG_BIAS_DISABLE: -@@ -1138,9 +1139,9 @@ static int byt_pin_config_get(struct pinctrl_dev *pctl_dev, unsigned int offset, - if (!(conf & BYT_DEBOUNCE_EN)) - return -EINVAL; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - debounce = readl(db_reg); -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - - switch (debounce & BYT_DEBOUNCE_PULSE_MASK) { - case BYT_DEBOUNCE_PULSE_375US: -@@ -1192,7 +1193,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, - u32 conf, val, debounce; - int i, ret = 0; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - - conf = readl(conf_reg); - val = readl(val_reg); -@@ -1300,7 +1301,7 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, - if (!ret) - writel(conf, conf_reg); - -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - - return ret; - } -@@ -1325,9 +1326,9 @@ static int byt_gpio_get(struct gpio_chip *chip, unsigned offset) - unsigned long flags; - u32 val; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - val = readl(reg); -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - - return !!(val & BYT_LEVEL); - } -@@ -1342,13 +1343,13 @@ static void byt_gpio_set(struct gpio_chip *chip, unsigned offset, int value) - if (!reg) - return; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - old_val = readl(reg); - if (value) - writel(old_val | BYT_LEVEL, reg); - else - writel(old_val & ~BYT_LEVEL, reg); -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - } - - static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) -@@ -1361,9 +1362,9 @@ static int byt_gpio_get_direction(struct gpio_chip *chip, unsigned int offset) - if (!reg) - return -EINVAL; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - value = readl(reg); -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - - if (!(value & BYT_OUTPUT_EN)) - return GPIOF_DIR_OUT; -@@ -1406,14 +1407,14 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip) - const char *label; - unsigned int pin; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - pin = vg->soc_data->pins[i].number; - reg = byt_gpio_reg(vg, pin, BYT_CONF0_REG); - if (!reg) { - seq_printf(s, - "Could not retrieve pin %i conf0 reg\n", - pin); -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - continue; - } - conf0 = readl(reg); -@@ -1422,11 +1423,11 @@ static void byt_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip) - if (!reg) { - seq_printf(s, - "Could not retrieve pin %i val reg\n", pin); -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - continue; - } - val = readl(reg); -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - - comm = byt_get_community(vg, pin); - if (!comm) { -@@ -1510,9 +1511,9 @@ static void byt_irq_ack(struct irq_data *d) - if (!reg) - return; - -- raw_spin_lock(&vg->lock); -+ raw_spin_lock(&byt_lock); - writel(BIT(offset % 32), reg); -- raw_spin_unlock(&vg->lock); -+ raw_spin_unlock(&byt_lock); - } - - static void byt_irq_mask(struct irq_data *d) -@@ -1536,7 +1537,7 @@ static void byt_irq_unmask(struct irq_data *d) - if (!reg) - return; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - value = readl(reg); - - switch (irqd_get_trigger_type(d)) { -@@ -1557,7 +1558,7 @@ static void byt_irq_unmask(struct irq_data *d) - - writel(value, reg); - -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - } - - static int byt_irq_type(struct irq_data *d, unsigned int type) -@@ -1571,7 +1572,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type) - if (!reg || offset >= vg->chip.ngpio) - return -EINVAL; - -- raw_spin_lock_irqsave(&vg->lock, flags); -+ raw_spin_lock_irqsave(&byt_lock, flags); - value = readl(reg); - - WARN(value & BYT_DIRECT_IRQ_EN, -@@ -1593,7 +1594,7 @@ static int byt_irq_type(struct irq_data *d, unsigned int type) - else if (type & IRQ_TYPE_LEVEL_MASK) - irq_set_handler_locked(d, handle_level_irq); - -- raw_spin_unlock_irqrestore(&vg->lock, flags); -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - - return 0; - } -@@ -1629,9 +1630,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc) - continue; - } - -- raw_spin_lock(&vg->lock); -+ raw_spin_lock(&byt_lock); - pending = readl(reg); -- raw_spin_unlock(&vg->lock); -+ raw_spin_unlock(&byt_lock); - for_each_set_bit(pin, &pending, 32) { - virq = irq_find_mapping(vg->chip.irqdomain, base + pin); - generic_handle_irq(virq); -@@ -1833,8 +1834,6 @@ static int byt_pinctrl_probe(struct platform_device *pdev) - return PTR_ERR(vg->pctl_dev); - } - -- raw_spin_lock_init(&vg->lock); -- - ret = byt_gpio_probe(vg); - if (ret) - return ret; -@@ -1850,8 +1849,11 @@ static int byt_gpio_suspend(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct byt_gpio *vg = platform_get_drvdata(pdev); -+ unsigned long flags; - int i; - -+ raw_spin_lock_irqsave(&byt_lock, flags); -+ - for (i = 0; i < vg->soc_data->npins; i++) { - void __iomem *reg; - u32 value; -@@ -1872,6 +1874,7 @@ static int byt_gpio_suspend(struct device *dev) - vg->saved_context[i].val = value; - } - -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - return 0; - } - -@@ -1879,8 +1882,11 @@ static int byt_gpio_resume(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct byt_gpio *vg = platform_get_drvdata(pdev); -+ unsigned long flags; - int i; - -+ raw_spin_lock_irqsave(&byt_lock, flags); -+ - for (i = 0; i < vg->soc_data->npins; i++) { - void __iomem *reg; - u32 value; -@@ -1918,6 +1924,7 @@ static int byt_gpio_resume(struct device *dev) - } - } - -+ raw_spin_unlock_irqrestore(&byt_lock, flags); - return 0; - } - #endif -diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c -index c64903a5978f..b818f65480c1 100644 ---- a/drivers/ptp/ptp_clock.c -+++ b/drivers/ptp/ptp_clock.c -@@ -175,9 +175,9 @@ static struct posix_clock_operations ptp_clock_ops = { - .read = ptp_read, - }; - --static void delete_ptp_clock(struct posix_clock *pc) -+static void ptp_clock_release(struct device *dev) - { -- struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); -+ struct ptp_clock *ptp = container_of(dev, struct ptp_clock, dev); - - mutex_destroy(&ptp->tsevq_mux); - mutex_destroy(&ptp->pincfg_mux); -@@ -222,7 +222,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, - } - - ptp->clock.ops = ptp_clock_ops; -- ptp->clock.release = delete_ptp_clock; - ptp->info = info; - ptp->devid = MKDEV(major, index); - ptp->index = index; -@@ -249,15 +248,6 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, - if (err) - goto no_pin_groups; - -- /* Create a new device in our class. */ -- ptp->dev = device_create_with_groups(ptp_class, parent, ptp->devid, -- ptp, ptp->pin_attr_groups, -- "ptp%d", ptp->index); -- if (IS_ERR(ptp->dev)) { -- err = PTR_ERR(ptp->dev); -- goto no_device; -- } -- - /* Register a new PPS source. */ - if (info->pps) { - struct pps_source_info pps; -@@ -273,8 +263,18 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, - } - } - -- /* Create a posix clock. */ -- err = posix_clock_register(&ptp->clock, ptp->devid); -+ /* Initialize a new device of our class in our clock structure. */ -+ device_initialize(&ptp->dev); -+ ptp->dev.devt = ptp->devid; -+ ptp->dev.class = ptp_class; -+ ptp->dev.parent = parent; -+ ptp->dev.groups = ptp->pin_attr_groups; -+ ptp->dev.release = ptp_clock_release; -+ dev_set_drvdata(&ptp->dev, ptp); -+ dev_set_name(&ptp->dev, "ptp%d", ptp->index); -+ -+ /* Create a posix clock and link it to the device. */ -+ err = posix_clock_register(&ptp->clock, &ptp->dev); - if (err) { - pr_err("failed to create posix clock\n"); - goto no_clock; -@@ -286,8 +286,6 @@ no_clock: - if (ptp->pps_source) - pps_unregister_source(ptp->pps_source); - no_pps: -- device_destroy(ptp_class, ptp->devid); --no_device: - ptp_cleanup_pin_groups(ptp); - no_pin_groups: - if (ptp->kworker) -@@ -317,7 +315,6 @@ int ptp_clock_unregister(struct ptp_clock *ptp) - if (ptp->pps_source) - pps_unregister_source(ptp->pps_source); - -- device_destroy(ptp_class, ptp->devid); - ptp_cleanup_pin_groups(ptp); - - posix_clock_unregister(&ptp->clock); -diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h -index b86f1bfecd6f..45ed9e172bb4 100644 ---- a/drivers/ptp/ptp_private.h -+++ b/drivers/ptp/ptp_private.h -@@ -41,7 +41,7 @@ struct timestamp_event_queue { - - struct ptp_clock { - struct posix_clock clock; -- struct device *dev; -+ struct device dev; - struct ptp_clock_info *info; - dev_t devid; - int index; /* index into clocks.map */ -diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h -index 9499cd3a05f8..02a936db0092 100644 ---- a/drivers/s390/crypto/zcrypt_error.h -+++ b/drivers/s390/crypto/zcrypt_error.h -@@ -75,6 +75,7 @@ struct error_hdr { - #define REP82_ERROR_EVEN_MOD_IN_OPND 0x85 - #define REP82_ERROR_RESERVED_FIELD 0x88 - #define REP82_ERROR_INVALID_DOMAIN_PENDING 0x8A -+#define REP82_ERROR_FILTERED_BY_HYPERVISOR 0x8B - #define REP82_ERROR_TRANSPORT_FAIL 0x90 - #define REP82_ERROR_PACKET_TRUNCATED 0xA0 - #define REP82_ERROR_ZERO_BUFFER_LEN 0xB0 -@@ -105,6 +106,7 @@ static inline int convert_error(struct zcrypt_queue *zq, - case REP82_ERROR_INVALID_DOMAIN_PRECHECK: - case REP82_ERROR_INVALID_DOMAIN_PENDING: - case REP82_ERROR_INVALID_SPECIAL_CMD: -+ case REP82_ERROR_FILTERED_BY_HYPERVISOR: - // REP88_ERROR_INVALID_KEY // '82' CEX2A - // REP88_ERROR_OPERAND // '84' CEX2A - // REP88_ERROR_OPERAND_EVEN_MOD // '85' CEX2A -diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c -index 21377ac71168..79b0b4eece19 100644 ---- a/drivers/scsi/NCR5380.c -+++ b/drivers/scsi/NCR5380.c -@@ -129,6 +129,9 @@ - #define NCR5380_release_dma_irq(x) - #endif - -+static unsigned int disconnect_mask = ~0; -+module_param(disconnect_mask, int, 0444); -+ - static int do_abort(struct Scsi_Host *); - static void do_reset(struct Scsi_Host *); - static void bus_reset_cleanup(struct Scsi_Host *); -@@ -946,7 +949,8 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd) - int err; - bool ret = true; - bool can_disconnect = instance->irq != NO_IRQ && -- cmd->cmnd[0] != REQUEST_SENSE; -+ cmd->cmnd[0] != REQUEST_SENSE && -+ (disconnect_mask & BIT(scmd_id(cmd))); - - NCR5380_dprint(NDEBUG_ARBITRATION, instance); - dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n", -diff --git a/drivers/scsi/atari_scsi.c b/drivers/scsi/atari_scsi.c -index 89f5154c40b6..764c46d7333e 100644 ---- a/drivers/scsi/atari_scsi.c -+++ b/drivers/scsi/atari_scsi.c -@@ -742,7 +742,7 @@ static int __init atari_scsi_probe(struct platform_device *pdev) - atari_scsi_template.sg_tablesize = SG_ALL; - } else { - atari_scsi_template.can_queue = 1; -- atari_scsi_template.sg_tablesize = SG_NONE; -+ atari_scsi_template.sg_tablesize = 1; - } - - if (setup_can_queue > 0) -@@ -751,8 +751,8 @@ static int __init atari_scsi_probe(struct platform_device *pdev) - if (setup_cmd_per_lun > 0) - atari_scsi_template.cmd_per_lun = setup_cmd_per_lun; - -- /* Leave sg_tablesize at 0 on a Falcon! */ -- if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize >= 0) -+ /* Don't increase sg_tablesize on Falcon! */ -+ if (ATARIHW_PRESENT(TT_SCSI) && setup_sg_tablesize > 0) - atari_scsi_template.sg_tablesize = setup_sg_tablesize; - - if (setup_hostid >= 0) { -diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c -index be5ee2d37815..957767d38361 100644 ---- a/drivers/scsi/csiostor/csio_lnode.c -+++ b/drivers/scsi/csiostor/csio_lnode.c -@@ -301,6 +301,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) - struct fc_fdmi_port_name *port_name; - uint8_t buf[64]; - uint8_t *fc4_type; -+ unsigned long flags; - - if (fdmi_req->wr_status != FW_SUCCESS) { - csio_ln_dbg(ln, "WR error:%x in processing fdmi rhba cmd\n", -@@ -377,13 +378,13 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) - len = (uint32_t)(pld - (uint8_t *)cmd); - - /* Submit FDMI RPA request */ -- spin_lock_irq(&hw->lock); -+ spin_lock_irqsave(&hw->lock, flags); - if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_done, - FCOE_CT, &fdmi_req->dma_buf, len)) { - CSIO_INC_STATS(ln, n_fdmi_err); - csio_ln_dbg(ln, "Failed to issue fdmi rpa req\n"); - } -- spin_unlock_irq(&hw->lock); -+ spin_unlock_irqrestore(&hw->lock, flags); - } - - /* -@@ -404,6 +405,7 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) - struct fc_fdmi_rpl *reg_pl; - struct fs_fdmi_attrs *attrib_blk; - uint8_t buf[64]; -+ unsigned long flags; - - if (fdmi_req->wr_status != FW_SUCCESS) { - csio_ln_dbg(ln, "WR error:%x in processing fdmi dprt cmd\n", -@@ -483,13 +485,13 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) - attrib_blk->numattrs = htonl(numattrs); - - /* Submit FDMI RHBA request */ -- spin_lock_irq(&hw->lock); -+ spin_lock_irqsave(&hw->lock, flags); - if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_rhba_cbfn, - FCOE_CT, &fdmi_req->dma_buf, len)) { - CSIO_INC_STATS(ln, n_fdmi_err); - csio_ln_dbg(ln, "Failed to issue fdmi rhba req\n"); - } -- spin_unlock_irq(&hw->lock); -+ spin_unlock_irqrestore(&hw->lock, flags); - } - - /* -@@ -504,6 +506,7 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) - void *cmd; - struct fc_fdmi_port_name *port_name; - uint32_t len; -+ unsigned long flags; - - if (fdmi_req->wr_status != FW_SUCCESS) { - csio_ln_dbg(ln, "WR error:%x in processing fdmi dhba cmd\n", -@@ -534,13 +537,13 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) - len += sizeof(*port_name); - - /* Submit FDMI request */ -- spin_lock_irq(&hw->lock); -+ spin_lock_irqsave(&hw->lock, flags); - if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_dprt_cbfn, - FCOE_CT, &fdmi_req->dma_buf, len)) { - CSIO_INC_STATS(ln, n_fdmi_err); - csio_ln_dbg(ln, "Failed to issue fdmi dprt req\n"); - } -- spin_unlock_irq(&hw->lock); -+ spin_unlock_irqrestore(&hw->lock, flags); - } - - /** -diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c -index 045207b5560e..7e3a77d3c6f0 100644 ---- a/drivers/scsi/iscsi_tcp.c -+++ b/drivers/scsi/iscsi_tcp.c -@@ -372,8 +372,16 @@ static int iscsi_sw_tcp_pdu_xmit(struct iscsi_task *task) - { - struct iscsi_conn *conn = task->conn; - unsigned int noreclaim_flag; -+ struct iscsi_tcp_conn *tcp_conn = conn->dd_data; -+ struct iscsi_sw_tcp_conn *tcp_sw_conn = tcp_conn->dd_data; - int rc = 0; - -+ if (!tcp_sw_conn->sock) { -+ iscsi_conn_printk(KERN_ERR, conn, -+ "Transport not bound to socket!\n"); -+ return -EINVAL; -+ } -+ - noreclaim_flag = memalloc_noreclaim_save(); - - while (iscsi_sw_tcp_xmit_qlen(conn)) { -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index c851fd14ff3e..4c84c2ae1112 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -4102,7 +4102,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - mempool_free(mbox, phba->mbox_mem_pool); - } - out: -- if (ndlp && NLP_CHK_NODE_ACT(ndlp)) { -+ if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) { - spin_lock_irq(shost->host_lock); - ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI); - spin_unlock_irq(shost->host_lock); -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index 3f88f3d79622..4a0889dd4c1d 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -5220,9 +5220,14 @@ lpfc_setup_disc_node(struct lpfc_vport *vport, uint32_t did) - /* If we've already received a PLOGI from this NPort - * we don't need to try to discover it again. - */ -- if (ndlp->nlp_flag & NLP_RCV_PLOGI) -+ if (ndlp->nlp_flag & NLP_RCV_PLOGI && -+ !(ndlp->nlp_type & -+ (NLP_FCP_TARGET | NLP_NVME_TARGET))) - return NULL; - -+ ndlp->nlp_prev_state = ndlp->nlp_state; -+ lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE); -+ - spin_lock_irq(shost->host_lock); - ndlp->nlp_flag |= NLP_NPR_2B_DISC; - spin_unlock_irq(shost->host_lock); -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index 043bca6449cd..96411754aa43 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -483,8 +483,10 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - * single discovery thread, this will cause a huge delay in - * discovery. Also this will cause multiple state machines - * running in parallel for this node. -+ * This only applies to a fabric environment. - */ -- if (ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) { -+ if ((ndlp->nlp_state == NLP_STE_PLOGI_ISSUE) && -+ (vport->fc_flag & FC_FABRIC)) { - /* software abort outstanding PLOGI */ - lpfc_els_abort(phba, ndlp); - } -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index d3bad0dbfaf7..d8e0ba68879c 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -12689,13 +12689,19 @@ send_current_mbox: - phba->sli.sli_flag &= ~LPFC_SLI_MBOX_ACTIVE; - /* Setting active mailbox pointer need to be in sync to flag clear */ - phba->sli.mbox_active = NULL; -+ if (bf_get(lpfc_trailer_consumed, mcqe)) -+ lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq); - spin_unlock_irqrestore(&phba->hbalock, iflags); - /* Wake up worker thread to post the next pending mailbox command */ - lpfc_worker_wake_up(phba); -+ return workposted; -+ - out_no_mqe_complete: -+ spin_lock_irqsave(&phba->hbalock, iflags); - if (bf_get(lpfc_trailer_consumed, mcqe)) - lpfc_sli4_mq_release(phba->sli4_hba.mbx_wq); -- return workposted; -+ spin_unlock_irqrestore(&phba->hbalock, iflags); -+ return false; - } - - /** -@@ -17486,6 +17492,13 @@ lpfc_sli4_alloc_rpi(struct lpfc_hba *phba) - static void - __lpfc_sli4_free_rpi(struct lpfc_hba *phba, int rpi) - { -+ /* -+ * if the rpi value indicates a prior unreg has already -+ * been done, skip the unreg. -+ */ -+ if (rpi == LPFC_RPI_ALLOC_ERROR) -+ return; -+ - if (test_and_clear_bit(rpi, phba->sli4_hba.rpi_bmask)) { - phba->sli4_hba.rpi_count--; - phba->sli4_hba.max_cfg_param.rpi_used--; -diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c -index 643321fc152d..b5050c2ede00 100644 ---- a/drivers/scsi/mac_scsi.c -+++ b/drivers/scsi/mac_scsi.c -@@ -429,7 +429,7 @@ static int __init mac_scsi_probe(struct platform_device *pdev) - mac_scsi_template.can_queue = setup_can_queue; - if (setup_cmd_per_lun > 0) - mac_scsi_template.cmd_per_lun = setup_cmd_per_lun; -- if (setup_sg_tablesize >= 0) -+ if (setup_sg_tablesize > 0) - mac_scsi_template.sg_tablesize = setup_sg_tablesize; - if (setup_hostid >= 0) - mac_scsi_template.this_id = setup_hostid & 7; -diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c -index bdffb692bded..622dcf2984a9 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c -@@ -1502,7 +1502,8 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc, - " for diag buffers, requested size(%d)\n", - ioc->name, __func__, request_data_sz); - mpt3sas_base_free_smid(ioc, smid); -- return -ENOMEM; -+ rc = -ENOMEM; -+ goto out; - } - ioc->diag_buffer[buffer_type] = request_data; - ioc->diag_buffer_sz[buffer_type] = request_data_sz; -diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c -index 9edd61c063a1..df5f0bc29587 100644 ---- a/drivers/scsi/pm8001/pm80xx_hwi.c -+++ b/drivers/scsi/pm8001/pm80xx_hwi.c -@@ -2368,6 +2368,8 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb) - pm8001_printk("task 0x%p done with io_status 0x%x" - " resp 0x%x stat 0x%x but aborted by upper layer!\n", - t, status, ts->resp, ts->stat)); -+ if (t->slow_task) -+ complete(&t->slow_task->completion); - pm8001_ccb_task_free(pm8001_ha, t, ccb, tag); - } else { - spin_unlock_irqrestore(&t->task_state_lock, flags); -diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c -index 92bc5b2d24ae..ac936b5ca74e 100644 ---- a/drivers/scsi/scsi_debug.c -+++ b/drivers/scsi/scsi_debug.c -@@ -4960,6 +4960,11 @@ static int __init scsi_debug_init(void) - return -EINVAL; - } - -+ if (sdebug_num_tgts < 0) { -+ pr_err("num_tgts must be >= 0\n"); -+ return -EINVAL; -+ } -+ - if (sdebug_guard > 1) { - pr_err("guard must be 0 or 1\n"); - return -EINVAL; -diff --git a/drivers/scsi/scsi_trace.c b/drivers/scsi/scsi_trace.c -index 0ff083bbf5b1..617a60737590 100644 ---- a/drivers/scsi/scsi_trace.c -+++ b/drivers/scsi/scsi_trace.c -@@ -30,15 +30,18 @@ static const char * - scsi_trace_rw6(struct trace_seq *p, unsigned char *cdb, int len) - { - const char *ret = trace_seq_buffer_ptr(p); -- sector_t lba = 0, txlen = 0; -+ u32 lba = 0, txlen; - - lba |= ((cdb[1] & 0x1F) << 16); - lba |= (cdb[2] << 8); - lba |= cdb[3]; -- txlen = cdb[4]; -+ /* -+ * From SBC-2: a TRANSFER LENGTH field set to zero specifies that 256 -+ * logical blocks shall be read (READ(6)) or written (WRITE(6)). -+ */ -+ txlen = cdb[4] ? cdb[4] : 256; - -- trace_seq_printf(p, "lba=%llu txlen=%llu", -- (unsigned long long)lba, (unsigned long long)txlen); -+ trace_seq_printf(p, "lba=%u txlen=%u", lba, txlen); - trace_seq_putc(p, 0); - - return ret; -diff --git a/drivers/scsi/sun3_scsi.c b/drivers/scsi/sun3_scsi.c -index 9492638296c8..af8a7ef9c858 100644 ---- a/drivers/scsi/sun3_scsi.c -+++ b/drivers/scsi/sun3_scsi.c -@@ -498,7 +498,7 @@ static struct scsi_host_template sun3_scsi_template = { - .eh_host_reset_handler = sun3scsi_host_reset, - .can_queue = 16, - .this_id = 7, -- .sg_tablesize = SG_NONE, -+ .sg_tablesize = 1, - .cmd_per_lun = 2, - .use_clustering = DISABLE_CLUSTERING, - .cmd_size = NCR5380_CMD_SIZE, -@@ -520,7 +520,7 @@ static int __init sun3_scsi_probe(struct platform_device *pdev) - sun3_scsi_template.can_queue = setup_can_queue; - if (setup_cmd_per_lun > 0) - sun3_scsi_template.cmd_per_lun = setup_cmd_per_lun; -- if (setup_sg_tablesize >= 0) -+ if (setup_sg_tablesize > 0) - sun3_scsi_template.sg_tablesize = setup_sg_tablesize; - if (setup_hostid >= 0) - sun3_scsi_template.this_id = setup_hostid & 7; -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index 07cae5ea608c..d25082e573e0 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -2867,10 +2867,10 @@ static int __ufshcd_query_descriptor(struct ufs_hba *hba, - goto out_unlock; - } - -- hba->dev_cmd.query.descriptor = NULL; - *buf_len = be16_to_cpu(response->upiu_res.length); - - out_unlock: -+ hba->dev_cmd.query.descriptor = NULL; - mutex_unlock(&hba->dev_cmd.lock); - out: - ufshcd_release(hba); -@@ -3684,15 +3684,24 @@ static int __ufshcd_uic_hibern8_enter(struct ufs_hba *hba) - ktime_to_us(ktime_sub(ktime_get(), start)), ret); - - if (ret) { -+ int err; -+ - dev_err(hba->dev, "%s: hibern8 enter failed. ret = %d\n", - __func__, ret); - - /* -- * If link recovery fails then return error so that caller -- * don't retry the hibern8 enter again. -+ * If link recovery fails then return error code returned from -+ * ufshcd_link_recovery(). -+ * If link recovery succeeds then return -EAGAIN to attempt -+ * hibern8 enter retry again. - */ -- if (ufshcd_link_recovery(hba)) -- ret = -ENOLINK; -+ err = ufshcd_link_recovery(hba); -+ if (err) { -+ dev_err(hba->dev, "%s: link recovery failed", __func__); -+ ret = err; -+ } else { -+ ret = -EAGAIN; -+ } - } else - ufshcd_vops_hibern8_notify(hba, UIC_CMD_DME_HIBER_ENTER, - POST_CHANGE); -@@ -3706,7 +3715,7 @@ static int ufshcd_uic_hibern8_enter(struct ufs_hba *hba) - - for (retries = UIC_HIBERN8_ENTER_RETRIES; retries > 0; retries--) { - ret = __ufshcd_uic_hibern8_enter(hba); -- if (!ret || ret == -ENOLINK) -+ if (!ret) - goto out; - } - out: -diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c -index 8f2e97857e8b..8b79e36fab21 100644 ---- a/drivers/spi/spi-fsl-spi.c -+++ b/drivers/spi/spi-fsl-spi.c -@@ -832,9 +832,9 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) - if (ret) - goto err; - -- irq = irq_of_parse_and_map(np, 0); -- if (!irq) { -- ret = -EINVAL; -+ irq = platform_get_irq(ofdev, 0); -+ if (irq < 0) { -+ ret = irq; - goto err; - } - -@@ -847,7 +847,6 @@ static int of_fsl_spi_probe(struct platform_device *ofdev) - return 0; - - err: -- irq_dispose_mapping(irq); - if (type == TYPE_FSL) - of_fsl_spi_free_chipselects(dev); - return ret; -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index fb7bd422e2e1..21ce92ee1652 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -1158,7 +1158,9 @@ int iscsit_setup_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length, - conn->cid); - -- target_get_sess_cmd(&cmd->se_cmd, true); -+ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0) -+ return iscsit_add_reject_cmd(cmd, -+ ISCSI_REASON_WAITING_FOR_LOGOUT, buf); - - cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd, - scsilun_to_int(&hdr->lun)); -@@ -2004,7 +2006,9 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - conn->sess->se_sess, 0, DMA_NONE, - TCM_SIMPLE_TAG, cmd->sense_buffer + 2); - -- target_get_sess_cmd(&cmd->se_cmd, true); -+ if (target_get_sess_cmd(&cmd->se_cmd, true) < 0) -+ return iscsit_add_reject_cmd(cmd, -+ ISCSI_REASON_WAITING_FOR_LOGOUT, buf); - - /* - * TASK_REASSIGN for ERL=2 / connection stays inside of -@@ -4236,6 +4240,8 @@ int iscsit_close_connection( - * must wait until they have completed. - */ - iscsit_check_conn_usage_count(conn); -+ target_sess_cmd_list_set_waiting(sess->se_sess); -+ target_wait_for_sess_cmds(sess->se_sess); - - ahash_request_free(conn->conn_tx_hash); - if (conn->conn_rx_hash) { -diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c -index e2fa3a3bc81d..b6bf605fa5c1 100644 ---- a/drivers/target/iscsi/iscsi_target_auth.c -+++ b/drivers/target/iscsi/iscsi_target_auth.c -@@ -78,7 +78,7 @@ static int chap_check_algorithm(const char *a_str) - if (!token) - goto out; - -- if (!strncmp(token, "5", 1)) { -+ if (!strcmp(token, "5")) { - pr_debug("Selected MD5 Algorithm\n"); - kfree(orig); - return CHAP_DIGEST_MD5; -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index 9ee41ba0e55b..367ce812743e 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -2183,27 +2183,6 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, - mode |= ATMEL_US_USMODE_NORMAL; - } - -- /* set the mode, clock divisor, parity, stop bits and data size */ -- atmel_uart_writel(port, ATMEL_US_MR, mode); -- -- /* -- * when switching the mode, set the RTS line state according to the -- * new mode, otherwise keep the former state -- */ -- if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) { -- unsigned int rts_state; -- -- if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) { -- /* let the hardware control the RTS line */ -- rts_state = ATMEL_US_RTSDIS; -- } else { -- /* force RTS line to low level */ -- rts_state = ATMEL_US_RTSEN; -- } -- -- atmel_uart_writel(port, ATMEL_US_CR, rts_state); -- } -- - /* - * Set the baud rate: - * Fractional baudrate allows to setup output frequency more -@@ -2229,6 +2208,28 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios, - quot = cd | fp << ATMEL_US_FP_OFFSET; - - atmel_uart_writel(port, ATMEL_US_BRGR, quot); -+ -+ /* set the mode, clock divisor, parity, stop bits and data size */ -+ atmel_uart_writel(port, ATMEL_US_MR, mode); -+ -+ /* -+ * when switching the mode, set the RTS line state according to the -+ * new mode, otherwise keep the former state -+ */ -+ if ((old_mode & ATMEL_US_USMODE) != (mode & ATMEL_US_USMODE)) { -+ unsigned int rts_state; -+ -+ if ((mode & ATMEL_US_USMODE) == ATMEL_US_USMODE_HWHS) { -+ /* let the hardware control the RTS line */ -+ rts_state = ATMEL_US_RTSDIS; -+ } else { -+ /* force RTS line to low level */ -+ rts_state = ATMEL_US_RTSEN; -+ } -+ -+ atmel_uart_writel(port, ATMEL_US_CR, rts_state); -+ } -+ - atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_RSTSTA | ATMEL_US_RSTRX); - atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN | ATMEL_US_RXEN); - -diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c -index 491de830b8d9..6391dc5b0ebe 100644 ---- a/drivers/vhost/vsock.c -+++ b/drivers/vhost/vsock.c -@@ -436,7 +436,9 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) - virtio_transport_deliver_tap_pkt(pkt); - - /* Only accept correctly addressed packets */ -- if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid) -+ if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid && -+ le64_to_cpu(pkt->hdr.dst_cid) == -+ vhost_transport_get_local_cid()) - virtio_transport_recv_pkt(pkt); - else - virtio_transport_free_pkt(pkt); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index c2920cbfa3bf..a91b8404d3dc 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -3796,7 +3796,13 @@ static ssize_t ext4_direct_IO_read(struct kiocb *iocb, struct iov_iter *iter) - * writes & truncates and since we take care of writing back page cache, - * we are protected against page writeback as well. - */ -- inode_lock_shared(inode); -+ if (iocb->ki_flags & IOCB_NOWAIT) { -+ if (!inode_trylock_shared(inode)) -+ return -EAGAIN; -+ } else { -+ inode_lock_shared(inode); -+ } -+ - ret = filemap_write_and_wait_range(mapping, iocb->ki_pos, - iocb->ki_pos + count - 1); - if (ret) -diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c -index b80e7db3b55b..b13383948fca 100644 ---- a/fs/f2fs/namei.c -+++ b/fs/f2fs/namei.c -@@ -862,7 +862,8 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, - if (!old_dir_entry || whiteout) - file_lost_pino(old_inode); - else -- F2FS_I(old_inode)->i_pino = new_dir->i_ino; -+ /* adjust dir's i_pino to pass fsck check */ -+ f2fs_i_pino_write(old_inode, new_dir->i_ino); - up_write(&F2FS_I(old_inode)->i_sem); - - old_inode->i_ctime = current_time(old_inode); -@@ -1027,7 +1028,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry, - f2fs_set_link(old_dir, old_entry, old_page, new_inode); - - down_write(&F2FS_I(old_inode)->i_sem); -- file_lost_pino(old_inode); -+ if (!old_dir_entry) -+ file_lost_pino(old_inode); -+ else -+ /* adjust dir's i_pino to pass fsck check */ -+ f2fs_i_pino_write(old_inode, new_dir->i_ino); - up_write(&F2FS_I(old_inode)->i_sem); - - old_dir->i_ctime = current_time(old_dir); -@@ -1042,7 +1047,11 @@ static int f2fs_cross_rename(struct inode *old_dir, struct dentry *old_dentry, - f2fs_set_link(new_dir, new_entry, new_page, old_inode); - - down_write(&F2FS_I(new_inode)->i_sem); -- file_lost_pino(new_inode); -+ if (!new_dir_entry) -+ file_lost_pino(new_inode); -+ else -+ /* adjust dir's i_pino to pass fsck check */ -+ f2fs_i_pino_write(new_inode, old_dir->i_ino); - up_write(&F2FS_I(new_inode)->i_sem); - - new_dir->i_ctime = current_time(new_dir); -diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c -index 0567b17a970c..7dd613392592 100644 ---- a/fs/jbd2/commit.c -+++ b/fs/jbd2/commit.c -@@ -726,7 +726,6 @@ start_journal_io: - submit_bh(REQ_OP_WRITE, REQ_SYNC, bh); - } - cond_resched(); -- stats.run.rs_blocks_logged += bufs; - - /* Force a new descriptor to be generated next - time round the loop. */ -@@ -813,6 +812,7 @@ start_journal_io: - if (unlikely(!buffer_uptodate(bh))) - err = -EIO; - jbd2_unfile_log_bh(bh); -+ stats.run.rs_blocks_logged++; - - /* - * The list contains temporary buffer heads created by -@@ -858,6 +858,7 @@ start_journal_io: - BUFFER_TRACE(bh, "ph5: control buffer writeout done: unfile"); - clear_buffer_jwrite(bh); - jbd2_unfile_log_bh(bh); -+ stats.run.rs_blocks_logged++; - __brelse(bh); /* One for getblk */ - /* AKPM: bforget here */ - } -@@ -879,6 +880,7 @@ start_journal_io: - } - if (cbh) - err = journal_wait_on_commit_record(journal, cbh); -+ stats.run.rs_blocks_logged++; - if (jbd2_has_feature_async_commit(journal) && - journal->j_flags & JBD2_BARRIER) { - blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL); -diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c -index 917fadca8a7b..b73b78771915 100644 ---- a/fs/ocfs2/acl.c -+++ b/fs/ocfs2/acl.c -@@ -335,8 +335,8 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) - down_read(&OCFS2_I(inode)->ip_xattr_sem); - acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); - up_read(&OCFS2_I(inode)->ip_xattr_sem); -- if (IS_ERR(acl) || !acl) -- return PTR_ERR(acl); -+ if (IS_ERR_OR_NULL(acl)) -+ return PTR_ERR_OR_ZERO(acl); - ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); - if (ret) - return ret; -diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c -index 3254c90fd899..3fdbdd29702b 100644 ---- a/fs/quota/dquot.c -+++ b/fs/quota/dquot.c -@@ -2849,68 +2849,73 @@ EXPORT_SYMBOL(dquot_quotactl_sysfile_ops); - static int do_proc_dqstats(struct ctl_table *table, int write, - void __user *buffer, size_t *lenp, loff_t *ppos) - { -- unsigned int type = (int *)table->data - dqstats.stat; -+ unsigned int type = (unsigned long *)table->data - dqstats.stat; -+ s64 value = percpu_counter_sum(&dqstats.counter[type]); -+ -+ /* Filter negative values for non-monotonic counters */ -+ if (value < 0 && (type == DQST_ALLOC_DQUOTS || -+ type == DQST_FREE_DQUOTS)) -+ value = 0; - - /* Update global table */ -- dqstats.stat[type] = -- percpu_counter_sum_positive(&dqstats.counter[type]); -- return proc_dointvec(table, write, buffer, lenp, ppos); -+ dqstats.stat[type] = value; -+ return proc_doulongvec_minmax(table, write, buffer, lenp, ppos); - } - - static struct ctl_table fs_dqstats_table[] = { - { - .procname = "lookups", - .data = &dqstats.stat[DQST_LOOKUPS], -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0444, - .proc_handler = do_proc_dqstats, - }, - { - .procname = "drops", - .data = &dqstats.stat[DQST_DROPS], -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0444, - .proc_handler = do_proc_dqstats, - }, - { - .procname = "reads", - .data = &dqstats.stat[DQST_READS], -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0444, - .proc_handler = do_proc_dqstats, - }, - { - .procname = "writes", - .data = &dqstats.stat[DQST_WRITES], -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0444, - .proc_handler = do_proc_dqstats, - }, - { - .procname = "cache_hits", - .data = &dqstats.stat[DQST_CACHE_HITS], -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0444, - .proc_handler = do_proc_dqstats, - }, - { - .procname = "allocated_dquots", - .data = &dqstats.stat[DQST_ALLOC_DQUOTS], -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0444, - .proc_handler = do_proc_dqstats, - }, - { - .procname = "free_dquots", - .data = &dqstats.stat[DQST_FREE_DQUOTS], -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0444, - .proc_handler = do_proc_dqstats, - }, - { - .procname = "syncs", - .data = &dqstats.stat[DQST_SYNCS], -- .maxlen = sizeof(int), -+ .maxlen = sizeof(unsigned long), - .mode = 0444, - .proc_handler = do_proc_dqstats, - }, -diff --git a/fs/readdir.c b/fs/readdir.c -index d336db65a33e..0c357663e33a 100644 ---- a/fs/readdir.c -+++ b/fs/readdir.c -@@ -65,6 +65,40 @@ out: - } - EXPORT_SYMBOL(iterate_dir); - -+/* -+ * POSIX says that a dirent name cannot contain NULL or a '/'. -+ * -+ * It's not 100% clear what we should really do in this case. -+ * The filesystem is clearly corrupted, but returning a hard -+ * error means that you now don't see any of the other names -+ * either, so that isn't a perfect alternative. -+ * -+ * And if you return an error, what error do you use? Several -+ * filesystems seem to have decided on EUCLEAN being the error -+ * code for EFSCORRUPTED, and that may be the error to use. Or -+ * just EIO, which is perhaps more obvious to users. -+ * -+ * In order to see the other file names in the directory, the -+ * caller might want to make this a "soft" error: skip the -+ * entry, and return the error at the end instead. -+ * -+ * Note that this should likely do a "memchr(name, 0, len)" -+ * check too, since that would be filesystem corruption as -+ * well. However, that case can't actually confuse user space, -+ * which has to do a strlen() on the name anyway to find the -+ * filename length, and the above "soft error" worry means -+ * that it's probably better left alone until we have that -+ * issue clarified. -+ */ -+static int verify_dirent_name(const char *name, int len) -+{ -+ if (!len) -+ return -EIO; -+ if (memchr(name, '/', len)) -+ return -EIO; -+ return 0; -+} -+ - /* - * Traditional linux readdir() handling.. - * -@@ -174,6 +208,9 @@ static int filldir(struct dir_context *ctx, const char *name, int namlen, - int reclen = ALIGN(offsetof(struct linux_dirent, d_name) + namlen + 2, - sizeof(long)); - -+ buf->error = verify_dirent_name(name, namlen); -+ if (unlikely(buf->error)) -+ return buf->error; - buf->error = -EINVAL; /* only used if we fail.. */ - if (reclen > buf->count) - return -EINVAL; -@@ -260,6 +297,9 @@ static int filldir64(struct dir_context *ctx, const char *name, int namlen, - int reclen = ALIGN(offsetof(struct linux_dirent64, d_name) + namlen + 1, - sizeof(u64)); - -+ buf->error = verify_dirent_name(name, namlen); -+ if (unlikely(buf->error)) -+ return buf->error; - buf->error = -EINVAL; /* only used if we fail.. */ - if (reclen > buf->count) - return -EINVAL; -diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c -index a609d480606d..e2b2196fd942 100644 ---- a/fs/userfaultfd.c -+++ b/fs/userfaultfd.c -@@ -1807,13 +1807,12 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, - if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api))) - goto out; - features = uffdio_api.features; -- if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) { -- memset(&uffdio_api, 0, sizeof(uffdio_api)); -- if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api))) -- goto out; -- ret = -EINVAL; -- goto out; -- } -+ ret = -EINVAL; -+ if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) -+ goto err_out; -+ ret = -EPERM; -+ if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE)) -+ goto err_out; - /* report all available features and ioctls to userland */ - uffdio_api.features = UFFD_API_FEATURES; - uffdio_api.ioctls = UFFD_API_IOCTLS; -@@ -1826,6 +1825,11 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, - ret = 0; - out: - return ret; -+err_out: -+ memset(&uffdio_api, 0, sizeof(uffdio_api)); -+ if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api))) -+ ret = -EFAULT; -+ goto out; - } - - static long userfaultfd_ioctl(struct file *file, unsigned cmd, -diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h -index 012c37fdb688..5511dc963dd5 100644 ---- a/include/linux/hrtimer.h -+++ b/include/linux/hrtimer.h -@@ -408,12 +408,18 @@ extern u64 hrtimer_get_next_event(void); - - extern bool hrtimer_active(const struct hrtimer *timer); - --/* -- * Helper function to check, whether the timer is on one of the queues -+/** -+ * hrtimer_is_queued = check, whether the timer is on one of the queues -+ * @timer: Timer to check -+ * -+ * Returns: True if the timer is queued, false otherwise -+ * -+ * The function can be used lockless, but it gives only a current snapshot. - */ --static inline int hrtimer_is_queued(struct hrtimer *timer) -+static inline bool hrtimer_is_queued(struct hrtimer *timer) - { -- return timer->state & HRTIMER_STATE_ENQUEUED; -+ /* The READ_ONCE pairs with the update functions of timer->state */ -+ return !!(READ_ONCE(timer->state) & HRTIMER_STATE_ENQUEUED); - } - - /* -diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h -index 1aa707ab19bb..8b54c591678e 100644 ---- a/include/linux/libfdt_env.h -+++ b/include/linux/libfdt_env.h -@@ -7,6 +7,9 @@ - - #include - -+#define INT32_MAX S32_MAX -+#define UINT32_MAX U32_MAX -+ - typedef __be16 fdt16_t; - typedef __be32 fdt32_t; - typedef __be64 fdt64_t; -diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h -index 38d8225510f1..3097b08c55cb 100644 ---- a/include/linux/posix-clock.h -+++ b/include/linux/posix-clock.h -@@ -82,29 +82,32 @@ struct posix_clock_operations { - * - * @ops: Functional interface to the clock - * @cdev: Character device instance for this clock -- * @kref: Reference count. -+ * @dev: Pointer to the clock's device. - * @rwsem: Protects the 'zombie' field from concurrent access. - * @zombie: If 'zombie' is true, then the hardware has disappeared. -- * @release: A function to free the structure when the reference count reaches -- * zero. May be NULL if structure is statically allocated. - * - * Drivers should embed their struct posix_clock within a private - * structure, obtaining a reference to it during callbacks using - * container_of(). -+ * -+ * Drivers should supply an initialized but not exposed struct device -+ * to posix_clock_register(). It is used to manage lifetime of the -+ * driver's private structure. It's 'release' field should be set to -+ * a release function for this private structure. - */ - struct posix_clock { - struct posix_clock_operations ops; - struct cdev cdev; -- struct kref kref; -+ struct device *dev; - struct rw_semaphore rwsem; - bool zombie; -- void (*release)(struct posix_clock *clk); - }; - - /** - * posix_clock_register() - register a new clock -- * @clk: Pointer to the clock. Caller must provide 'ops' and 'release' -- * @devid: Allocated device id -+ * @clk: Pointer to the clock. Caller must provide 'ops' field -+ * @dev: Pointer to the initialized device. Caller must provide -+ * 'release' field - * - * A clock driver calls this function to register itself with the - * clock device subsystem. If 'clk' points to dynamically allocated -@@ -113,7 +116,7 @@ struct posix_clock { - * - * Returns zero on success, non-zero otherwise. - */ --int posix_clock_register(struct posix_clock *clk, dev_t devid); -+int posix_clock_register(struct posix_clock *clk, struct device *dev); - - /** - * posix_clock_unregister() - unregister a clock -diff --git a/include/linux/quota.h b/include/linux/quota.h -index 5ac9de4fcd6f..aa9a42eceab0 100644 ---- a/include/linux/quota.h -+++ b/include/linux/quota.h -@@ -263,7 +263,7 @@ enum { - }; - - struct dqstats { -- int stat[_DQST_DQSTAT_LAST]; -+ unsigned long stat[_DQST_DQSTAT_LAST]; - struct percpu_counter counter[_DQST_DQSTAT_LAST]; - }; - -diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h -index e4b257ff881b..a10da545b3f6 100644 ---- a/include/linux/rculist_nulls.h -+++ b/include/linux/rculist_nulls.h -@@ -100,6 +100,43 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n, - first->pprev = &n->next; - } - -+/** -+ * hlist_nulls_add_tail_rcu -+ * @n: the element to add to the hash list. -+ * @h: the list to add to. -+ * -+ * Description: -+ * Adds the specified element to the specified hlist_nulls, -+ * while permitting racing traversals. -+ * -+ * The caller must take whatever precautions are necessary -+ * (such as holding appropriate locks) to avoid racing -+ * with another list-mutation primitive, such as hlist_nulls_add_head_rcu() -+ * or hlist_nulls_del_rcu(), running on this same list. -+ * However, it is perfectly legal to run concurrently with -+ * the _rcu list-traversal primitives, such as -+ * hlist_nulls_for_each_entry_rcu(), used to prevent memory-consistency -+ * problems on Alpha CPUs. Regardless of the type of CPU, the -+ * list-traversal primitive must be guarded by rcu_read_lock(). -+ */ -+static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n, -+ struct hlist_nulls_head *h) -+{ -+ struct hlist_nulls_node *i, *last = NULL; -+ -+ /* Note: write side code, so rcu accessors are not needed. */ -+ for (i = h->first; !is_a_nulls(i); i = i->next) -+ last = i; -+ -+ if (last) { -+ n->next = last->next; -+ n->pprev = &last->next; -+ rcu_assign_pointer(hlist_next_rcu(last), n); -+ } else { -+ hlist_nulls_add_head_rcu(n, h); -+ } -+} -+ - /** - * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type - * @tpos: the type * to use as a loop cursor. -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index ec00d9264e5c..a9a764a17c28 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -1655,7 +1655,7 @@ static inline struct sk_buff *skb_peek_next(struct sk_buff *skb, - */ - static inline struct sk_buff *skb_peek_tail(const struct sk_buff_head *list_) - { -- struct sk_buff *skb = list_->prev; -+ struct sk_buff *skb = READ_ONCE(list_->prev); - - if (skb == (struct sk_buff *)list_) - skb = NULL; -@@ -1723,7 +1723,9 @@ static inline void __skb_insert(struct sk_buff *newsk, - struct sk_buff *prev, struct sk_buff *next, - struct sk_buff_head *list) - { -- /* see skb_queue_empty_lockless() for the opposite READ_ONCE() */ -+ /* See skb_queue_empty_lockless() and skb_peek_tail() -+ * for the opposite READ_ONCE() -+ */ - WRITE_ONCE(newsk->next, next); - WRITE_ONCE(newsk->prev, prev); - WRITE_ONCE(next->prev, newsk); -diff --git a/include/net/dst.h b/include/net/dst.h -index fe230dd62c28..5ebc7356a381 100644 ---- a/include/net/dst.h -+++ b/include/net/dst.h -@@ -528,7 +528,16 @@ static inline void skb_dst_update_pmtu(struct sk_buff *skb, u32 mtu) - struct dst_entry *dst = skb_dst(skb); - - if (dst && dst->ops->update_pmtu) -- dst->ops->update_pmtu(dst, NULL, skb, mtu); -+ dst->ops->update_pmtu(dst, NULL, skb, mtu, true); -+} -+ -+/* update dst pmtu but not do neighbor confirm */ -+static inline void skb_dst_update_pmtu_no_confirm(struct sk_buff *skb, u32 mtu) -+{ -+ struct dst_entry *dst = skb_dst(skb); -+ -+ if (dst && dst->ops->update_pmtu) -+ dst->ops->update_pmtu(dst, NULL, skb, mtu, false); - } - - #endif /* _NET_DST_H */ -diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h -index 5ec645f27ee3..443863c7b8da 100644 ---- a/include/net/dst_ops.h -+++ b/include/net/dst_ops.h -@@ -27,7 +27,8 @@ struct dst_ops { - struct dst_entry * (*negative_advice)(struct dst_entry *); - void (*link_failure)(struct sk_buff *); - void (*update_pmtu)(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu); -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh); - void (*redirect)(struct dst_entry *dst, struct sock *sk, - struct sk_buff *skb); - int (*local_out)(struct net *net, struct sock *sk, struct sk_buff *skb); -diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h -index 2dbbbff5e1e3..573ab110c9ec 100644 ---- a/include/net/inet_hashtables.h -+++ b/include/net/inet_hashtables.h -@@ -106,12 +106,18 @@ struct inet_bind_hashbucket { - struct hlist_head chain; - }; - --/* -- * Sockets can be hashed in established or listening table -+/* Sockets can be hashed in established or listening table. -+ * We must use different 'nulls' end-of-chain value for all hash buckets : -+ * A socket might transition from ESTABLISH to LISTEN state without -+ * RCU grace period. A lookup in ehash table needs to handle this case. - */ -+#define LISTENING_NULLS_BASE (1U << 29) - struct inet_listen_hashbucket { - spinlock_t lock; -- struct hlist_head head; -+ union { -+ struct hlist_head head; -+ struct hlist_nulls_head nulls_head; -+ }; - }; - - /* This is for listening sockets, thus all sockets which possess wildcards. */ -diff --git a/include/net/sock.h b/include/net/sock.h -index 0af46cbd3649..c6a003bc4737 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -693,6 +693,11 @@ static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_h - hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list); - } - -+static inline void __sk_nulls_add_node_tail_rcu(struct sock *sk, struct hlist_nulls_head *list) -+{ -+ hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list); -+} -+ - static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list) - { - sock_hold(sk); -diff --git a/include/scsi/iscsi_proto.h b/include/scsi/iscsi_proto.h -index df156f1d50b2..f0a01a54bd15 100644 ---- a/include/scsi/iscsi_proto.h -+++ b/include/scsi/iscsi_proto.h -@@ -638,6 +638,7 @@ struct iscsi_reject { - #define ISCSI_REASON_BOOKMARK_INVALID 9 - #define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10 - #define ISCSI_REASON_NEGOTIATION_RESET 11 -+#define ISCSI_REASON_WAITING_FOR_LOGOUT 12 - - /* Max. number of Key=Value pairs in a text message */ - #define MAX_KEY_VALUE_PAIRS 8192 -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index cfc2c0d1369a..74fc3a9d1923 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -1397,7 +1397,7 @@ static struct ctl_table vm_table[] = { - .procname = "drop_caches", - .data = &sysctl_drop_caches, - .maxlen = sizeof(int), -- .mode = 0644, -+ .mode = 0200, - .proc_handler = drop_caches_sysctl_handler, - .extra1 = &one, - .extra2 = &four, -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index d00e85ac10d6..ecce9122343b 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -845,7 +845,8 @@ static int enqueue_hrtimer(struct hrtimer *timer, - - base->cpu_base->active_bases |= 1 << base->index; - -- timer->state = HRTIMER_STATE_ENQUEUED; -+ /* Pairs with the lockless read in hrtimer_is_queued() */ -+ WRITE_ONCE(timer->state, HRTIMER_STATE_ENQUEUED); - - return timerqueue_add(&base->active, &timer->node); - } -@@ -867,7 +868,8 @@ static void __remove_hrtimer(struct hrtimer *timer, - struct hrtimer_cpu_base *cpu_base = base->cpu_base; - u8 state = timer->state; - -- timer->state = newstate; -+ /* Pairs with the lockless read in hrtimer_is_queued() */ -+ WRITE_ONCE(timer->state, newstate); - if (!(state & HRTIMER_STATE_ENQUEUED)) - return; - -@@ -894,8 +896,9 @@ static void __remove_hrtimer(struct hrtimer *timer, - static inline int - remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart) - { -- if (hrtimer_is_queued(timer)) { -- u8 state = timer->state; -+ u8 state = timer->state; -+ -+ if (state & HRTIMER_STATE_ENQUEUED) { - int reprogram; - - /* -diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c -index 17cdc554c9fe..e5706a826c1f 100644 ---- a/kernel/time/posix-clock.c -+++ b/kernel/time/posix-clock.c -@@ -27,8 +27,6 @@ - - #include "posix-timers.h" - --static void delete_clock(struct kref *kref); -- - /* - * Returns NULL if the posix_clock instance attached to 'fp' is old and stale. - */ -@@ -138,7 +136,7 @@ static int posix_clock_open(struct inode *inode, struct file *fp) - err = 0; - - if (!err) { -- kref_get(&clk->kref); -+ get_device(clk->dev); - fp->private_data = clk; - } - out: -@@ -154,7 +152,7 @@ static int posix_clock_release(struct inode *inode, struct file *fp) - if (clk->ops.release) - err = clk->ops.release(clk); - -- kref_put(&clk->kref, delete_clock); -+ put_device(clk->dev); - - fp->private_data = NULL; - -@@ -174,38 +172,35 @@ static const struct file_operations posix_clock_file_operations = { - #endif - }; - --int posix_clock_register(struct posix_clock *clk, dev_t devid) -+int posix_clock_register(struct posix_clock *clk, struct device *dev) - { - int err; - -- kref_init(&clk->kref); - init_rwsem(&clk->rwsem); - - cdev_init(&clk->cdev, &posix_clock_file_operations); -+ err = cdev_device_add(&clk->cdev, dev); -+ if (err) { -+ pr_err("%s unable to add device %d:%d\n", -+ dev_name(dev), MAJOR(dev->devt), MINOR(dev->devt)); -+ return err; -+ } - clk->cdev.owner = clk->ops.owner; -- err = cdev_add(&clk->cdev, devid, 1); -+ clk->dev = dev; - -- return err; -+ return 0; - } - EXPORT_SYMBOL_GPL(posix_clock_register); - --static void delete_clock(struct kref *kref) --{ -- struct posix_clock *clk = container_of(kref, struct posix_clock, kref); -- -- if (clk->release) -- clk->release(clk); --} -- - void posix_clock_unregister(struct posix_clock *clk) - { -- cdev_del(&clk->cdev); -+ cdev_device_del(&clk->cdev, clk->dev); - - down_write(&clk->rwsem); - clk->zombie = true; - up_write(&clk->rwsem); - -- kref_put(&clk->kref, delete_clock); -+ put_device(clk->dev); - } - EXPORT_SYMBOL_GPL(posix_clock_unregister); - -diff --git a/lib/dma-debug.c b/lib/dma-debug.c -index ea4cc3dde4f1..61e7240947f5 100644 ---- a/lib/dma-debug.c -+++ b/lib/dma-debug.c -@@ -437,6 +437,7 @@ void debug_dma_dump_mappings(struct device *dev) - } - - spin_unlock_irqrestore(&bucket->lock, flags); -+ cond_resched(); - } - } - EXPORT_SYMBOL(debug_dma_dump_mappings); -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index 89936e0d55c9..6feab2279143 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -643,6 +643,9 @@ static unsigned int br_nf_forward_arp(void *priv, - nf_bridge_pull_encap_header(skb); - } - -+ if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr)))) -+ return NF_DROP; -+ - if (arp_hdr(skb)->ar_pln != 4) { - if (IS_VLAN_ARP(skb)) - nf_bridge_push_encap_header(skb); -diff --git a/net/bridge/br_nf_core.c b/net/bridge/br_nf_core.c -index 20cbb727df4d..c217276bd76a 100644 ---- a/net/bridge/br_nf_core.c -+++ b/net/bridge/br_nf_core.c -@@ -26,7 +26,8 @@ - #endif - - static void fake_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu) -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh) - { - } - -diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c -index 100b4f88179a..35a670ec9077 100644 ---- a/net/bridge/netfilter/ebtables.c -+++ b/net/bridge/netfilter/ebtables.c -@@ -1876,7 +1876,7 @@ static int ebt_buf_count(struct ebt_entries_buf_state *state, unsigned int sz) - } - - static int ebt_buf_add(struct ebt_entries_buf_state *state, -- void *data, unsigned int sz) -+ const void *data, unsigned int sz) - { - if (state->buf_kern_start == NULL) - goto count_only; -@@ -1910,7 +1910,7 @@ enum compat_mwt { - EBT_COMPAT_TARGET, - }; - --static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, -+static int compat_mtw_from_user(const struct compat_ebt_entry_mwt *mwt, - enum compat_mwt compat_mwt, - struct ebt_entries_buf_state *state, - const unsigned char *base) -@@ -1986,22 +1986,23 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, - /* return size of all matches, watchers or target, including necessary - * alignment and padding. - */ --static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, -+static int ebt_size_mwt(const struct compat_ebt_entry_mwt *match32, - unsigned int size_left, enum compat_mwt type, - struct ebt_entries_buf_state *state, const void *base) - { -+ const char *buf = (const char *)match32; - int growth = 0; -- char *buf; - - if (size_left == 0) - return 0; - -- buf = (char *) match32; -- -- while (size_left >= sizeof(*match32)) { -+ do { - struct ebt_entry_match *match_kern; - int ret; - -+ if (size_left < sizeof(*match32)) -+ return -EINVAL; -+ - match_kern = (struct ebt_entry_match *) state->buf_kern_start; - if (match_kern) { - char *tmp; -@@ -2038,22 +2039,18 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, - if (match_kern) - match_kern->match_size = ret; - -- /* rule should have no remaining data after target */ -- if (type == EBT_COMPAT_TARGET && size_left) -- return -EINVAL; -- - match32 = (struct compat_ebt_entry_mwt *) buf; -- } -+ } while (size_left); - - return growth; - } - - /* called for all ebt_entry structures. */ --static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, -+static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *base, - unsigned int *total, - struct ebt_entries_buf_state *state) - { -- unsigned int i, j, startoff, new_offset = 0; -+ unsigned int i, j, startoff, next_expected_off, new_offset = 0; - /* stores match/watchers/targets & offset of next struct ebt_entry: */ - unsigned int offsets[4]; - unsigned int *offsets_update = NULL; -@@ -2140,11 +2137,13 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, - return ret; - } - -- startoff = state->buf_user_offset - startoff; -+ next_expected_off = state->buf_user_offset - startoff; -+ if (next_expected_off != entry->next_offset) -+ return -EINVAL; - -- if (WARN_ON(*total < startoff)) -+ if (*total < entry->next_offset) - return -EINVAL; -- *total -= startoff; -+ *total -= entry->next_offset; - return 0; - } - -diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c -index 144cd1acd7e3..069e3c4fcc44 100644 ---- a/net/core/sysctl_net_core.c -+++ b/net/core/sysctl_net_core.c -@@ -274,6 +274,7 @@ static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write, - return ret; - } - -+# ifdef CONFIG_HAVE_EBPF_JIT - static int - proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write, - void __user *buffer, size_t *lenp, -@@ -284,6 +285,7 @@ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write, - - return proc_dointvec_minmax(table, write, buffer, lenp, ppos); - } -+# endif /* CONFIG_HAVE_EBPF_JIT */ - - static int - proc_dolongvec_minmax_bpf_restricted(struct ctl_table *table, int write, -diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c -index 0bd3afd01dd2..ccc189bc3617 100644 ---- a/net/decnet/dn_route.c -+++ b/net/decnet/dn_route.c -@@ -118,7 +118,8 @@ static void dn_dst_ifdown(struct dst_entry *, struct net_device *dev, int how); - static struct dst_entry *dn_dst_negative_advice(struct dst_entry *); - static void dn_dst_link_failure(struct sk_buff *); - static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb , u32 mtu); -+ struct sk_buff *skb , u32 mtu, -+ bool confirm_neigh); - static void dn_dst_redirect(struct dst_entry *dst, struct sock *sk, - struct sk_buff *skb); - static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst, -@@ -259,7 +260,8 @@ static int dn_dst_gc(struct dst_ops *ops) - * advertise to the other end). - */ - static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu) -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh) - { - struct dn_route *rt = (struct dn_route *) dst; - struct neighbour *n = rt->n; -diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c -index f9d790b058d2..995ef3d23368 100644 ---- a/net/ipv4/icmp.c -+++ b/net/ipv4/icmp.c -@@ -254,10 +254,11 @@ bool icmp_global_allow(void) - bool rc = false; - - /* Check if token bucket is empty and cannot be refilled -- * without taking the spinlock. -+ * without taking the spinlock. The READ_ONCE() are paired -+ * with the following WRITE_ONCE() in this same function. - */ -- if (!icmp_global.credit) { -- delta = min_t(u32, now - icmp_global.stamp, HZ); -+ if (!READ_ONCE(icmp_global.credit)) { -+ delta = min_t(u32, now - READ_ONCE(icmp_global.stamp), HZ); - if (delta < HZ / 50) - return false; - } -@@ -267,14 +268,14 @@ bool icmp_global_allow(void) - if (delta >= HZ / 50) { - incr = sysctl_icmp_msgs_per_sec * delta / HZ ; - if (incr) -- icmp_global.stamp = now; -+ WRITE_ONCE(icmp_global.stamp, now); - } - credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); - if (credit) { - credit--; - rc = true; - } -- icmp_global.credit = credit; -+ WRITE_ONCE(icmp_global.credit, credit); - spin_unlock(&icmp_global.lock); - return rc; - } -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 9d6b172caf6c..f7224c4fc30f 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -1088,7 +1088,7 @@ struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu) - if (!dst) - goto out; - } -- dst->ops->update_pmtu(dst, sk, NULL, mtu); -+ dst->ops->update_pmtu(dst, sk, NULL, mtu, true); - - dst = __sk_dst_check(sk, 0); - if (!dst) -diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c -index 33edccfebc30..eb158badebc4 100644 ---- a/net/ipv4/inet_diag.c -+++ b/net/ipv4/inet_diag.c -@@ -911,11 +911,12 @@ void inet_diag_dump_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *skb, - - for (i = s_i; i < INET_LHTABLE_SIZE; i++) { - struct inet_listen_hashbucket *ilb; -+ struct hlist_nulls_node *node; - - num = 0; - ilb = &hashinfo->listening_hash[i]; - spin_lock(&ilb->lock); -- sk_for_each(sk, &ilb->head) { -+ sk_nulls_for_each(sk, node, &ilb->nulls_head) { - struct inet_sock *inet = inet_sk(sk); - - if (!net_eq(sock_net(sk), net)) -diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c -index 1f26627c7fad..0af13f5bdc9a 100644 ---- a/net/ipv4/inet_hashtables.c -+++ b/net/ipv4/inet_hashtables.c -@@ -219,9 +219,10 @@ struct sock *__inet_lookup_listener(struct net *net, - int score, hiscore = 0, matches = 0, reuseport = 0; - bool exact_dif = inet_exact_dif_match(net, skb); - struct sock *sk, *result = NULL; -+ struct hlist_nulls_node *node; - u32 phash = 0; - -- sk_for_each_rcu(sk, &ilb->head) { -+ sk_nulls_for_each_rcu(sk, node, &ilb->nulls_head) { - score = compute_score(sk, net, hnum, daddr, - dif, sdif, exact_dif); - if (score > hiscore) { -@@ -442,10 +443,11 @@ static int inet_reuseport_add_sock(struct sock *sk, - struct inet_listen_hashbucket *ilb) - { - struct inet_bind_bucket *tb = inet_csk(sk)->icsk_bind_hash; -+ const struct hlist_nulls_node *node; - struct sock *sk2; - kuid_t uid = sock_i_uid(sk); - -- sk_for_each_rcu(sk2, &ilb->head) { -+ sk_nulls_for_each_rcu(sk2, node, &ilb->nulls_head) { - if (sk2 != sk && - sk2->sk_family == sk->sk_family && - ipv6_only_sock(sk2) == ipv6_only_sock(sk) && -@@ -480,9 +482,9 @@ int __inet_hash(struct sock *sk, struct sock *osk) - } - if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport && - sk->sk_family == AF_INET6) -- hlist_add_tail_rcu(&sk->sk_node, &ilb->head); -+ __sk_nulls_add_node_tail_rcu(sk, &ilb->nulls_head); - else -- hlist_add_head_rcu(&sk->sk_node, &ilb->head); -+ __sk_nulls_add_node_rcu(sk, &ilb->nulls_head); - sock_set_flag(sk, SOCK_RCU_FREE); - sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); - unlock: -@@ -525,10 +527,7 @@ void inet_unhash(struct sock *sk) - spin_lock_bh(lock); - if (rcu_access_pointer(sk->sk_reuseport_cb)) - reuseport_detach_sock(sk); -- if (listener) -- done = __sk_del_node_init(sk); -- else -- done = __sk_nulls_del_node_init_rcu(sk); -+ done = __sk_nulls_del_node_init_rcu(sk); - if (done) - sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); - spin_unlock_bh(lock); -@@ -664,7 +663,8 @@ void inet_hashinfo_init(struct inet_hashinfo *h) - - for (i = 0; i < INET_LHTABLE_SIZE; i++) { - spin_lock_init(&h->listening_hash[i].lock); -- INIT_HLIST_HEAD(&h->listening_hash[i].head); -+ INIT_HLIST_NULLS_HEAD(&h->listening_hash[i].nulls_head, -+ i + LISTENING_NULLS_BASE); - } - } - EXPORT_SYMBOL_GPL(inet_hashinfo_init); -diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c -index f9cef27907ed..f94881412d5b 100644 ---- a/net/ipv4/inetpeer.c -+++ b/net/ipv4/inetpeer.c -@@ -159,7 +159,12 @@ static void inet_peer_gc(struct inet_peer_base *base, - base->total / inet_peer_threshold * HZ; - for (i = 0; i < gc_cnt; i++) { - p = gc_stack[i]; -- delta = (__u32)jiffies - p->dtime; -+ -+ /* The READ_ONCE() pairs with the WRITE_ONCE() -+ * in inet_putpeer() -+ */ -+ delta = (__u32)jiffies - READ_ONCE(p->dtime); -+ - if (delta < ttl || !refcount_dec_if_one(&p->refcnt)) - gc_stack[i] = NULL; - } -@@ -236,7 +241,10 @@ EXPORT_SYMBOL_GPL(inet_getpeer); - - void inet_putpeer(struct inet_peer *p) - { -- p->dtime = (__u32)jiffies; -+ /* The WRITE_ONCE() pairs with itself (we run lockless) -+ * and the READ_ONCE() in inet_peer_gc() -+ */ -+ WRITE_ONCE(p->dtime, (__u32)jiffies); - - if (refcount_dec_and_test(&p->refcnt)) - call_rcu(&p->rcu, inetpeer_free_rcu); -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index 7a31287ff123..f1784162acc2 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -521,7 +521,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, - else - mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu; - -- skb_dst_update_pmtu(skb, mtu); -+ skb_dst_update_pmtu_no_confirm(skb, mtu); - - if (skb->protocol == htons(ETH_P_IP)) { - if (!skb_is_gso(skb) && -diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c -index c07065b7e3b0..08c15dd42d93 100644 ---- a/net/ipv4/ip_vti.c -+++ b/net/ipv4/ip_vti.c -@@ -244,7 +244,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, - - mtu = dst_mtu(dst); - if (skb->len > mtu) { -- skb_dst_update_pmtu(skb, mtu); -+ skb_dst_update_pmtu_no_confirm(skb, mtu); - if (skb->protocol == htons(ETH_P_IP)) { - icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, - htonl(mtu)); -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index de7f955ffd0a..8b855d3eec9e 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -145,7 +145,8 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst); - static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst); - static void ipv4_link_failure(struct sk_buff *skb); - static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu); -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh); - static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, - struct sk_buff *skb); - static void ipv4_dst_destroy(struct dst_entry *dst); -@@ -1042,7 +1043,8 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) - } - - static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu) -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh) - { - struct rtable *rt = (struct rtable *) dst; - struct flowi4 fl4; -@@ -2529,7 +2531,8 @@ static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst) - } - - static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu) -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh) - { - } - -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 44a41ac2b0ca..b4f0fc34b0ed 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1936,13 +1936,14 @@ static void *listening_get_next(struct seq_file *seq, void *cur) - struct tcp_iter_state *st = seq->private; - struct net *net = seq_file_net(seq); - struct inet_listen_hashbucket *ilb; -+ struct hlist_nulls_node *node; - struct sock *sk = cur; - - if (!sk) { - get_head: - ilb = &tcp_hashinfo.listening_hash[st->bucket]; - spin_lock(&ilb->lock); -- sk = sk_head(&ilb->head); -+ sk = sk_nulls_head(&ilb->nulls_head); - st->offset = 0; - goto get_sk; - } -@@ -1950,9 +1951,9 @@ get_head: - ++st->num; - ++st->offset; - -- sk = sk_next(sk); -+ sk = sk_nulls_next(sk); - get_sk: -- sk_for_each_from(sk) { -+ sk_nulls_for_each_from(sk, node) { - if (!net_eq(sock_net(sk), net)) - continue; - if (sk->sk_family == st->family) -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index e3b28140c10b..e1eb56e21dd5 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2380,6 +2380,14 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, - if (tcp_small_queue_check(sk, skb, 0)) - break; - -+ /* Argh, we hit an empty skb(), presumably a thread -+ * is sleeping in sendmsg()/sk_stream_wait_memory(). -+ * We do not want to send a pure-ack packet and have -+ * a strange looking rtx queue with empty packet(s). -+ */ -+ if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) -+ break; -+ - if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp))) - break; - -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index ab3f272a0884..e33258d69246 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -1338,7 +1338,7 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb) - * queue contains some other skb - */ - rmem = atomic_add_return(size, &sk->sk_rmem_alloc); -- if (rmem > (size + sk->sk_rcvbuf)) -+ if (rmem > (size + (unsigned int)sk->sk_rcvbuf)) - goto uncharge_drop; - - spin_lock(&list->lock); -diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c -index 5952dca98e6b..08f00225ed1b 100644 ---- a/net/ipv4/xfrm4_policy.c -+++ b/net/ipv4/xfrm4_policy.c -@@ -222,12 +222,13 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) - } - - static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu) -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh) - { - struct xfrm_dst *xdst = (struct xfrm_dst *)dst; - struct dst_entry *path = xdst->route; - -- path->ops->update_pmtu(path, sk, skb, mtu); -+ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh); - } - - static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk, -diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c -index 9a31d13bf180..890adadcda16 100644 ---- a/net/ipv6/inet6_connection_sock.c -+++ b/net/ipv6/inet6_connection_sock.c -@@ -150,7 +150,7 @@ struct dst_entry *inet6_csk_update_pmtu(struct sock *sk, u32 mtu) - - if (IS_ERR(dst)) - return NULL; -- dst->ops->update_pmtu(dst, sk, NULL, mtu); -+ dst->ops->update_pmtu(dst, sk, NULL, mtu, true); - - dst = inet6_csk_route_socket(sk, &fl6); - return IS_ERR(dst) ? NULL : dst; -diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c -index 228983a5531b..24a21979d7df 100644 ---- a/net/ipv6/inet6_hashtables.c -+++ b/net/ipv6/inet6_hashtables.c -@@ -137,9 +137,10 @@ struct sock *inet6_lookup_listener(struct net *net, - int score, hiscore = 0, matches = 0, reuseport = 0; - bool exact_dif = inet6_exact_dif_match(net, skb); - struct sock *sk, *result = NULL; -+ struct hlist_nulls_node *node; - u32 phash = 0; - -- sk_for_each(sk, &ilb->head) { -+ sk_nulls_for_each(sk, node, &ilb->nulls_head) { - score = compute_score(sk, net, hnum, daddr, dif, sdif, exact_dif); - if (score > hiscore) { - reuseport = sk->sk_reuseport; -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index 4228f3b2f347..726ba41133a3 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -527,7 +527,7 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, - - /* TooBig packet may have updated dst->dev's mtu */ - if (dst && dst_mtu(dst) > dst->dev->mtu) -- dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu); -+ dst->ops->update_pmtu(dst, NULL, skb, dst->dev->mtu, false); - - return ip6_tnl_xmit(skb, dev, dsfield, fl6, encap_limit, pmtu, - NEXTHDR_GRE); -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 067fc78cc529..5bc2788e6ba4 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -652,7 +652,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - if (rel_info > dst_mtu(skb_dst(skb2))) - goto out; - -- skb_dst_update_pmtu(skb2, rel_info); -+ skb_dst_update_pmtu_no_confirm(skb2, rel_info); - } - if (rel_type == ICMP_REDIRECT) - skb_dst(skb2)->ops->redirect(skb_dst(skb2), NULL, skb2); -@@ -1138,7 +1138,7 @@ route_lookup: - mtu = max(mtu, skb->protocol == htons(ETH_P_IPV6) ? - IPV6_MIN_MTU : IPV4_MIN_MTU); - -- skb_dst_update_pmtu(skb, mtu); -+ skb_dst_update_pmtu_no_confirm(skb, mtu); - if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { - *pmtu = mtu; - err = -EMSGSIZE; -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 6b2416b4a53e..557fe3880a3f 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -483,7 +483,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) - - mtu = dst_mtu(dst); - if (skb->len > mtu) { -- skb_dst_update_pmtu(skb, mtu); -+ skb_dst_update_pmtu_no_confirm(skb, mtu); - - if (skb->protocol == htons(ETH_P_IPV6)) { - if (mtu < IPV6_MIN_MTU) -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 00f8fe8cebd5..b81522bcf223 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -93,7 +93,8 @@ static int ip6_pkt_prohibit(struct sk_buff *skb); - static int ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb); - static void ip6_link_failure(struct sk_buff *skb); - static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu); -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh); - static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, - struct sk_buff *skb); - static void rt6_dst_from_metrics_check(struct rt6_info *rt); -@@ -264,7 +265,8 @@ static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst) - } - - static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu) -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh) - { - } - -@@ -1471,7 +1473,8 @@ static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) - } - - static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, -- const struct ipv6hdr *iph, u32 mtu) -+ const struct ipv6hdr *iph, u32 mtu, -+ bool confirm_neigh) - { - const struct in6_addr *daddr, *saddr; - struct rt6_info *rt6 = (struct rt6_info *)dst; -@@ -1489,7 +1492,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, - daddr = NULL; - saddr = NULL; - } -- dst_confirm_neigh(dst, daddr); -+ -+ if (confirm_neigh) -+ dst_confirm_neigh(dst, daddr); -+ - mtu = max_t(u32, mtu, IPV6_MIN_MTU); - if (mtu >= dst_mtu(dst)) - return; -@@ -1518,9 +1524,11 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, - } - - static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu) -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh) - { -- __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu); -+ __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu, -+ confirm_neigh); - } - - void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu, -@@ -1540,7 +1548,7 @@ void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu, - - dst = ip6_route_output(net, NULL, &fl6); - if (!dst->error) -- __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu)); -+ __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu), true); - dst_release(dst); - } - EXPORT_SYMBOL_GPL(ip6_update_pmtu); -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index d2529c38e7e4..fb3f917db57a 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -932,7 +932,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, - } - - if (tunnel->parms.iph.daddr) -- skb_dst_update_pmtu(skb, mtu); -+ skb_dst_update_pmtu_no_confirm(skb, mtu); - - if (skb->len > mtu && !skb_is_gso(skb)) { - icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c -index d6b012295b45..b0d80cef7c2b 100644 ---- a/net/ipv6/xfrm6_policy.c -+++ b/net/ipv6/xfrm6_policy.c -@@ -219,12 +219,13 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) - } - - static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk, -- struct sk_buff *skb, u32 mtu) -+ struct sk_buff *skb, u32 mtu, -+ bool confirm_neigh) - { - struct xfrm_dst *xdst = (struct xfrm_dst *)dst; - struct dst_entry *path = xdst->route; - -- path->ops->update_pmtu(path, sk, skb, mtu); -+ path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh); - } - - static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk, -diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c -index 4527921b1c3a..97d411033f8a 100644 ---- a/net/netfilter/ipvs/ip_vs_xmit.c -+++ b/net/netfilter/ipvs/ip_vs_xmit.c -@@ -209,7 +209,7 @@ static inline void maybe_update_pmtu(int skb_af, struct sk_buff *skb, int mtu) - struct rtable *ort = skb_rtable(skb); - - if (!skb->dev && sk && sk_fullsock(sk)) -- ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu); -+ ort->dst.ops->update_pmtu(&ort->dst, sk, NULL, mtu, true); - } - - static inline bool ensure_mtu_is_adequate(struct netns_ipvs *ipvs, int skb_af, -diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c -index 37efcc1c8887..b06ef4c62522 100644 ---- a/net/netfilter/nf_queue.c -+++ b/net/netfilter/nf_queue.c -@@ -138,7 +138,7 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state, - goto err; - } - -- if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) { -+ if (skb_dst(skb) && !skb_dst_force(skb)) { - status = -ENETDOWN; - goto err; - } -diff --git a/net/sctp/transport.c b/net/sctp/transport.c -index 274df899e7bf..4c55b759a58e 100644 ---- a/net/sctp/transport.c -+++ b/net/sctp/transport.c -@@ -272,7 +272,7 @@ bool sctp_transport_update_pmtu(struct sctp_transport *t, u32 pmtu) - - pf->af->from_sk(&addr, sk); - pf->to_sk_daddr(&t->ipaddr, sk); -- dst->ops->update_pmtu(dst, sk, NULL, pmtu); -+ dst->ops->update_pmtu(dst, sk, NULL, pmtu, true); - pf->to_sk_daddr(&addr, sk); - - dst = sctp_transport_dst_check(t); -diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c -index b471022c8162..b43531899648 100644 ---- a/scripts/kallsyms.c -+++ b/scripts/kallsyms.c -@@ -510,6 +510,8 @@ static void build_initial_tok_table(void) - table[pos] = table[i]; - learn_symbol(table[pos].sym, table[pos].len); - pos++; -+ } else { -+ free(table[i].sym); - } - } - table_cnt = pos; -diff --git a/security/apparmor/label.c b/security/apparmor/label.c -index c5b99b954580..ea63710442ae 100644 ---- a/security/apparmor/label.c -+++ b/security/apparmor/label.c -@@ -1463,11 +1463,13 @@ static inline bool use_label_hname(struct aa_ns *ns, struct aa_label *label, - /* helper macro for snprint routines */ - #define update_for_len(total, len, size, str) \ - do { \ -+ size_t ulen = len; \ -+ \ - AA_BUG(len < 0); \ -- total += len; \ -- len = min(len, size); \ -- size -= len; \ -- str += len; \ -+ total += ulen; \ -+ ulen = min(ulen, size); \ -+ size -= ulen; \ -+ str += ulen; \ - } while (0) - - /** -@@ -1602,7 +1604,7 @@ int aa_label_snxprint(char *str, size_t size, struct aa_ns *ns, - struct aa_ns *prev_ns = NULL; - struct label_it i; - int count = 0, total = 0; -- size_t len; -+ ssize_t len; - - AA_BUG(!str && size != 0); - AA_BUG(!label); -diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c -index 8fcb421193e0..fa261b27d858 100644 ---- a/sound/pci/hda/hda_controller.c -+++ b/sound/pci/hda/hda_controller.c -@@ -883,7 +883,7 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr, - return -EAGAIN; /* give a chance to retry */ - } - -- dev_WARN(chip->card->dev, -+ dev_err(chip->card->dev, - "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n", - bus->last_cmd[addr]); - chip->single_cmd = 1; -diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c -index 76789523429a..09c4380bc225 100644 ---- a/tools/perf/builtin-script.c -+++ b/tools/perf/builtin-script.c -@@ -355,7 +355,7 @@ static int perf_evsel__check_attr(struct perf_evsel *evsel, - "selected. Hence, no address to lookup the source line number.\n"); - return -EINVAL; - } -- if (PRINT_FIELD(BRSTACKINSN) && -+ if (PRINT_FIELD(BRSTACKINSN) && !allow_user_set && - !(perf_evlist__combined_branch_type(session->evlist) & - PERF_SAMPLE_BRANCH_ANY)) { - pr_err("Display of branch stack assembler requested, but non all-branch filter set\n" -diff --git a/tools/perf/util/perf_regs.h b/tools/perf/util/perf_regs.h -index c9319f8d17a6..f732e3af2bd4 100644 ---- a/tools/perf/util/perf_regs.h -+++ b/tools/perf/util/perf_regs.h -@@ -34,7 +34,7 @@ int perf_reg_value(u64 *valp, struct regs_dump *regs, int id); - - static inline const char *perf_reg_name(int id __maybe_unused) - { -- return NULL; -+ return "unknown"; - } - - static inline int perf_reg_value(u64 *valp __maybe_unused, -diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c -index 9005fbe0780e..23092fd6451d 100644 ---- a/tools/perf/util/strbuf.c -+++ b/tools/perf/util/strbuf.c -@@ -109,7 +109,6 @@ static int strbuf_addv(struct strbuf *sb, const char *fmt, va_list ap) - return ret; - } - len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap_saved); -- va_end(ap_saved); - if (len > strbuf_avail(sb)) { - pr_debug("this should not happen, your vsnprintf is broken"); - va_end(ap_saved); diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.162-163.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.162-163.patch deleted file mode 100644 index b009853a4e..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.162-163.patch +++ /dev/null @@ -1,2380 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt -index e96e085271c1..83f6c6a7c41c 100644 ---- a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt -+++ b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt -@@ -46,7 +46,7 @@ Required properties: - Example (R-Car H3): - - usb2_clksel: clock-controller@e6590630 { -- compatible = "renesas,r8a77950-rcar-usb2-clock-sel", -+ compatible = "renesas,r8a7795-rcar-usb2-clock-sel", - "renesas,rcar-gen3-usb2-clock-sel"; - reg = <0 0xe6590630 0 0x02>; - clocks = <&cpg CPG_MOD 703>, <&usb_extal>, <&usb_xtal>; -diff --git a/Makefile b/Makefile -index cb57b5c58e2b..35a71a78d1d2 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 162 -+SUBLEVEL = 163 - EXTRAVERSION = - NAME = Petit Gorille - -diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -index 4ea23df81f21..5da604e5cf28 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts -@@ -295,7 +295,7 @@ - }; - - &usb0_phy { -- status = "okay"; -+ status = "disabled"; - phy-supply = <&usb_otg_pwr>; - }; - -@@ -305,7 +305,7 @@ - }; - - &usb0 { -- status = "okay"; -+ status = "disabled"; - }; - - &usb1 { -diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h -index 20e45733afa4..26efe251f076 100644 ---- a/arch/arm64/include/asm/pgtable-prot.h -+++ b/arch/arm64/include/asm/pgtable-prot.h -@@ -76,13 +76,12 @@ - #define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE) - #define PAGE_READONLY __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN) - #define PAGE_READONLY_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN) --#define PAGE_EXECONLY __pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN) - - #define __P000 PAGE_NONE - #define __P001 PAGE_READONLY - #define __P010 PAGE_READONLY - #define __P011 PAGE_READONLY --#define __P100 PAGE_EXECONLY -+#define __P100 PAGE_READONLY_EXEC - #define __P101 PAGE_READONLY_EXEC - #define __P110 PAGE_READONLY_EXEC - #define __P111 PAGE_READONLY_EXEC -@@ -91,7 +90,7 @@ - #define __S001 PAGE_READONLY - #define __S010 PAGE_SHARED - #define __S011 PAGE_SHARED --#define __S100 PAGE_EXECONLY -+#define __S100 PAGE_READONLY_EXEC - #define __S101 PAGE_READONLY_EXEC - #define __S110 PAGE_SHARED_EXEC - #define __S111 PAGE_SHARED_EXEC -diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index aa3b8dd8fc35..9b676c3dd3ce 100644 ---- a/arch/arm64/include/asm/pgtable.h -+++ b/arch/arm64/include/asm/pgtable.h -@@ -90,12 +90,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; - #define pte_dirty(pte) (pte_sw_dirty(pte) || pte_hw_dirty(pte)) - - #define pte_valid(pte) (!!(pte_val(pte) & PTE_VALID)) --/* -- * Execute-only user mappings do not have the PTE_USER bit set. All valid -- * kernel mappings have the PTE_UXN bit set. -- */ - #define pte_valid_not_user(pte) \ -- ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN)) -+ ((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID) - #define pte_valid_young(pte) \ - ((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF)) - #define pte_valid_user(pte) \ -@@ -111,8 +107,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; - - /* - * p??_access_permitted() is true for valid user mappings (subject to the -- * write permission check) other than user execute-only which do not have the -- * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set. -+ * write permission check). PROT_NONE mappings do not have the PTE_VALID bit -+ * set. - */ - #define pte_access_permitted(pte, write) \ - (pte_valid_user(pte) && (!(write) || pte_write(pte))) -diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index bf7c285d0c82..617787e4081f 100644 ---- a/arch/arm64/mm/fault.c -+++ b/arch/arm64/mm/fault.c -@@ -400,7 +400,7 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, - struct task_struct *tsk; - struct mm_struct *mm; - int fault, sig, code, major = 0; -- unsigned long vm_flags = VM_READ | VM_WRITE; -+ unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC; - unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; - - if (notify_page_fault(regs, esr)) -diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h -index 5e8927f99a76..a0338dbabeaa 100644 ---- a/arch/mips/include/asm/thread_info.h -+++ b/arch/mips/include/asm/thread_info.h -@@ -52,8 +52,26 @@ struct thread_info { - #define init_thread_info (init_thread_union.thread_info) - #define init_stack (init_thread_union.stack) - --/* How to get the thread information struct from C. */ -+/* -+ * A pointer to the struct thread_info for the currently executing thread is -+ * held in register $28/$gp. -+ * -+ * We declare __current_thread_info as a global register variable rather than a -+ * local register variable within current_thread_info() because clang doesn't -+ * support explicit local register variables. -+ * -+ * When building the VDSO we take care not to declare the global register -+ * variable because this causes GCC to not preserve the value of $28/$gp in -+ * functions that change its value (which is common in the PIC VDSO when -+ * accessing the GOT). Since the VDSO shouldn't be accessing -+ * __current_thread_info anyway we declare it extern in order to cause a link -+ * failure if it's referenced. -+ */ -+#ifdef __VDSO__ -+extern struct thread_info *__current_thread_info; -+#else - register struct thread_info *__current_thread_info __asm__("$28"); -+#endif - - static inline struct thread_info *current_thread_info(void) - { -diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c -index 74da18de853a..73ec15cd2708 100644 ---- a/arch/powerpc/platforms/pseries/hvconsole.c -+++ b/arch/powerpc/platforms/pseries/hvconsole.c -@@ -62,7 +62,7 @@ EXPORT_SYMBOL(hvc_get_chars); - * @vtermno: The vtermno or unit_address of the adapter from which the data - * originated. - * @buf: The character buffer that contains the character data to send to -- * firmware. -+ * firmware. Must be at least 16 bytes, even if count is less than 16. - * @count: Send this number of characters. - */ - int hvc_put_chars(uint32_t vtermno, const char *buf, int count) -diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c -index 45304085b6ee..b652593d7de6 100644 ---- a/arch/s390/kernel/perf_cpum_sf.c -+++ b/arch/s390/kernel/perf_cpum_sf.c -@@ -1294,18 +1294,28 @@ static void hw_perf_event_update(struct perf_event *event, int flush_all) - */ - if (flush_all && done) - break; -- -- /* If an event overflow happened, discard samples by -- * processing any remaining sample-data-blocks. -- */ -- if (event_overflow) -- flush_all = 1; - } - - /* Account sample overflows in the event hardware structure */ - if (sampl_overflow) - OVERFLOW_REG(hwc) = DIV_ROUND_UP(OVERFLOW_REG(hwc) + - sampl_overflow, 1 + num_sdb); -+ -+ /* Perf_event_overflow() and perf_event_account_interrupt() limit -+ * the interrupt rate to an upper limit. Roughly 1000 samples per -+ * task tick. -+ * Hitting this limit results in a large number -+ * of throttled REF_REPORT_THROTTLE entries and the samples -+ * are dropped. -+ * Slightly increase the interval to avoid hitting this limit. -+ */ -+ if (event_overflow) { -+ SAMPL_RATE(hwc) += DIV_ROUND_UP(SAMPL_RATE(hwc), 10); -+ debug_sprintf_event(sfdbg, 1, "%s: rate adjustment %ld\n", -+ __func__, -+ DIV_ROUND_UP(SAMPL_RATE(hwc), 10)); -+ } -+ - if (sampl_overflow || event_overflow) - debug_sprintf_event(sfdbg, 4, "hw_perf_event_update: " - "overflow stats: sample=%llu event=%llu\n", -diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c -index 27258db640d7..b649a6538350 100644 ---- a/arch/s390/kernel/smp.c -+++ b/arch/s390/kernel/smp.c -@@ -725,39 +725,67 @@ static void __ref smp_get_core_info(struct sclp_core_info *info, int early) - - static int smp_add_present_cpu(int cpu); - --static int __smp_rescan_cpus(struct sclp_core_info *info, int sysfs_add) -+static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail, -+ bool configured, bool early) - { - struct pcpu *pcpu; -- cpumask_t avail; -- int cpu, nr, i, j; -+ int cpu, nr, i; - u16 address; - - nr = 0; -- cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask); -- cpu = cpumask_first(&avail); -- for (i = 0; (i < info->combined) && (cpu < nr_cpu_ids); i++) { -- if (sclp.has_core_type && info->core[i].type != boot_core_type) -+ if (sclp.has_core_type && core->type != boot_core_type) -+ return nr; -+ cpu = cpumask_first(avail); -+ address = core->core_id << smp_cpu_mt_shift; -+ for (i = 0; (i <= smp_cpu_mtid) && (cpu < nr_cpu_ids); i++) { -+ if (pcpu_find_address(cpu_present_mask, address + i)) - continue; -- address = info->core[i].core_id << smp_cpu_mt_shift; -- for (j = 0; j <= smp_cpu_mtid; j++) { -- if (pcpu_find_address(cpu_present_mask, address + j)) -- continue; -- pcpu = pcpu_devices + cpu; -- pcpu->address = address + j; -- pcpu->state = -- (cpu >= info->configured*(smp_cpu_mtid + 1)) ? -- CPU_STATE_STANDBY : CPU_STATE_CONFIGURED; -- smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN); -- set_cpu_present(cpu, true); -- if (sysfs_add && smp_add_present_cpu(cpu) != 0) -- set_cpu_present(cpu, false); -- else -- nr++; -- cpu = cpumask_next(cpu, &avail); -- if (cpu >= nr_cpu_ids) -+ pcpu = pcpu_devices + cpu; -+ pcpu->address = address + i; -+ if (configured) -+ pcpu->state = CPU_STATE_CONFIGURED; -+ else -+ pcpu->state = CPU_STATE_STANDBY; -+ smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN); -+ set_cpu_present(cpu, true); -+ if (!early && smp_add_present_cpu(cpu) != 0) -+ set_cpu_present(cpu, false); -+ else -+ nr++; -+ cpumask_clear_cpu(cpu, avail); -+ cpu = cpumask_next(cpu, avail); -+ } -+ return nr; -+} -+ -+static int __smp_rescan_cpus(struct sclp_core_info *info, bool early) -+{ -+ struct sclp_core_entry *core; -+ cpumask_t avail; -+ bool configured; -+ u16 core_id; -+ int nr, i; -+ -+ nr = 0; -+ cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask); -+ /* -+ * Add IPL core first (which got logical CPU number 0) to make sure -+ * that all SMT threads get subsequent logical CPU numbers. -+ */ -+ if (early) { -+ core_id = pcpu_devices[0].address >> smp_cpu_mt_shift; -+ for (i = 0; i < info->configured; i++) { -+ core = &info->core[i]; -+ if (core->core_id == core_id) { -+ nr += smp_add_core(core, &avail, true, early); - break; -+ } - } - } -+ for (i = 0; i < info->combined; i++) { -+ configured = i < info->configured; -+ nr += smp_add_core(&info->core[i], &avail, configured, early); -+ } - return nr; - } - -@@ -803,7 +831,7 @@ void __init smp_detect_cpus(void) - - /* Add CPUs present at boot */ - get_online_cpus(); -- __smp_rescan_cpus(info, 0); -+ __smp_rescan_cpus(info, true); - put_online_cpus(); - memblock_free_early((unsigned long)info, sizeof(*info)); - } -@@ -1156,7 +1184,7 @@ int __ref smp_rescan_cpus(void) - smp_get_core_info(info, 0); - get_online_cpus(); - mutex_lock(&smp_cpu_state_mutex); -- nr = __smp_rescan_cpus(info, 1); -+ nr = __smp_rescan_cpus(info, false); - mutex_unlock(&smp_cpu_state_mutex); - put_online_cpus(); - kfree(info); -diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c -index 24ffa1e88cf9..4d3399405d06 100644 ---- a/arch/x86/events/intel/bts.c -+++ b/arch/x86/events/intel/bts.c -@@ -71,9 +71,17 @@ struct bts_buffer { - - static struct pmu bts_pmu; - -+static int buf_nr_pages(struct page *page) -+{ -+ if (!PagePrivate(page)) -+ return 1; -+ -+ return 1 << page_private(page); -+} -+ - static size_t buf_size(struct page *page) - { -- return 1 << (PAGE_SHIFT + page_private(page)); -+ return buf_nr_pages(page) * PAGE_SIZE; - } - - static void * -@@ -89,9 +97,7 @@ bts_buffer_setup_aux(int cpu, void **pages, int nr_pages, bool overwrite) - /* count all the high order buffers */ - for (pg = 0, nbuf = 0; pg < nr_pages;) { - page = virt_to_page(pages[pg]); -- if (WARN_ON_ONCE(!PagePrivate(page) && nr_pages > 1)) -- return NULL; -- pg += 1 << page_private(page); -+ pg += buf_nr_pages(page); - nbuf++; - } - -@@ -115,7 +121,7 @@ bts_buffer_setup_aux(int cpu, void **pages, int nr_pages, bool overwrite) - unsigned int __nr_pages; - - page = virt_to_page(pages[pg]); -- __nr_pages = PagePrivate(page) ? 1 << page_private(page) : 1; -+ __nr_pages = buf_nr_pages(page); - buf->buf[nbuf].page = page; - buf->buf[nbuf].offset = offset; - buf->buf[nbuf].displacement = (pad ? BTS_RECORD_SIZE - pad : 0); -diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c -index 6ca015f92766..6490b2759bcb 100644 ---- a/block/compat_ioctl.c -+++ b/block/compat_ioctl.c -@@ -6,6 +6,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -354,6 +355,8 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg) - * but we call blkdev_ioctl, which gets the lock for us - */ - case BLKRRPART: -+ case BLKREPORTZONE: -+ case BLKRESETZONE: - return blkdev_ioctl(bdev, mode, cmd, - (unsigned long)compat_ptr(arg)); - case BLKBSZSET_32: -@@ -401,6 +404,14 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg) - case BLKTRACETEARDOWN: /* compatible */ - ret = blk_trace_ioctl(bdev, cmd, compat_ptr(arg)); - return ret; -+ case IOC_PR_REGISTER: -+ case IOC_PR_RESERVE: -+ case IOC_PR_RELEASE: -+ case IOC_PR_PREEMPT: -+ case IOC_PR_PREEMPT_ABORT: -+ case IOC_PR_CLEAR: -+ return blkdev_ioctl(bdev, mode, cmd, -+ (unsigned long)compat_ptr(arg)); - default: - if (disk->fops->compat_ioctl) - ret = disk->fops->compat_ioctl(bdev, mode, cmd, arg); -diff --git a/drivers/ata/ahci_brcm.c b/drivers/ata/ahci_brcm.c -index 5936d1679bf3..8beb81b24f14 100644 ---- a/drivers/ata/ahci_brcm.c -+++ b/drivers/ata/ahci_brcm.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - #include - - #include "ahci.h" -@@ -87,6 +88,7 @@ struct brcm_ahci_priv { - u32 port_mask; - u32 quirks; - enum brcm_ahci_version version; -+ struct reset_control *rcdev; - }; - - static const struct ata_port_info ahci_brcm_port_info = { -@@ -221,19 +223,12 @@ static void brcm_sata_phys_disable(struct brcm_ahci_priv *priv) - brcm_sata_phy_disable(priv, i); - } - --static u32 brcm_ahci_get_portmask(struct platform_device *pdev, -+static u32 brcm_ahci_get_portmask(struct ahci_host_priv *hpriv, - struct brcm_ahci_priv *priv) - { -- void __iomem *ahci; -- struct resource *res; - u32 impl; - -- res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "ahci"); -- ahci = devm_ioremap_resource(&pdev->dev, res); -- if (IS_ERR(ahci)) -- return 0; -- -- impl = readl(ahci + HOST_PORTS_IMPL); -+ impl = readl(hpriv->mmio + HOST_PORTS_IMPL); - - if (fls(impl) > SATA_TOP_MAX_PHYS) - dev_warn(priv->dev, "warning: more ports than PHYs (%#x)\n", -@@ -241,9 +236,6 @@ static u32 brcm_ahci_get_portmask(struct platform_device *pdev, - else if (!impl) - dev_info(priv->dev, "no ports found\n"); - -- devm_iounmap(&pdev->dev, ahci); -- devm_release_mem_region(&pdev->dev, res->start, resource_size(res)); -- - return impl; - } - -@@ -270,11 +262,10 @@ static int brcm_ahci_suspend(struct device *dev) - struct ata_host *host = dev_get_drvdata(dev); - struct ahci_host_priv *hpriv = host->private_data; - struct brcm_ahci_priv *priv = hpriv->plat_data; -- int ret; - -- ret = ahci_platform_suspend(dev); - brcm_sata_phys_disable(priv); -- return ret; -+ -+ return ahci_platform_suspend(dev); - } - - static int brcm_ahci_resume(struct device *dev) -@@ -282,11 +273,44 @@ static int brcm_ahci_resume(struct device *dev) - struct ata_host *host = dev_get_drvdata(dev); - struct ahci_host_priv *hpriv = host->private_data; - struct brcm_ahci_priv *priv = hpriv->plat_data; -+ int ret; -+ -+ /* Make sure clocks are turned on before re-configuration */ -+ ret = ahci_platform_enable_clks(hpriv); -+ if (ret) -+ return ret; - - brcm_sata_init(priv); - brcm_sata_phys_enable(priv); - brcm_sata_alpm_init(hpriv); -- return ahci_platform_resume(dev); -+ -+ /* Since we had to enable clocks earlier on, we cannot use -+ * ahci_platform_resume() as-is since a second call to -+ * ahci_platform_enable_resources() would bump up the resources -+ * (regulators, clocks, PHYs) count artificially so we copy the part -+ * after ahci_platform_enable_resources(). -+ */ -+ ret = ahci_platform_enable_phys(hpriv); -+ if (ret) -+ goto out_disable_phys; -+ -+ ret = ahci_platform_resume_host(dev); -+ if (ret) -+ goto out_disable_platform_phys; -+ -+ /* We resumed so update PM runtime state */ -+ pm_runtime_disable(dev); -+ pm_runtime_set_active(dev); -+ pm_runtime_enable(dev); -+ -+ return 0; -+ -+out_disable_platform_phys: -+ ahci_platform_disable_phys(hpriv); -+out_disable_phys: -+ brcm_sata_phys_disable(priv); -+ ahci_platform_disable_clks(hpriv); -+ return ret; - } - #endif - -@@ -327,44 +351,74 @@ static int brcm_ahci_probe(struct platform_device *pdev) - if (IS_ERR(priv->top_ctrl)) - return PTR_ERR(priv->top_ctrl); - -+ /* Reset is optional depending on platform */ -+ priv->rcdev = devm_reset_control_get(&pdev->dev, "ahci"); -+ if (!IS_ERR_OR_NULL(priv->rcdev)) -+ reset_control_deassert(priv->rcdev); -+ - if ((priv->version == BRCM_SATA_BCM7425) || - (priv->version == BRCM_SATA_NSP)) { - priv->quirks |= BRCM_AHCI_QUIRK_NO_NCQ; - priv->quirks |= BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE; - } - -+ hpriv = ahci_platform_get_resources(pdev); -+ if (IS_ERR(hpriv)) { -+ ret = PTR_ERR(hpriv); -+ goto out_reset; -+ } -+ -+ ret = ahci_platform_enable_clks(hpriv); -+ if (ret) -+ goto out_reset; -+ -+ /* Must be first so as to configure endianness including that -+ * of the standard AHCI register space. -+ */ - brcm_sata_init(priv); - -- priv->port_mask = brcm_ahci_get_portmask(pdev, priv); -- if (!priv->port_mask) -- return -ENODEV; -+ /* Initializes priv->port_mask which is used below */ -+ priv->port_mask = brcm_ahci_get_portmask(hpriv, priv); -+ if (!priv->port_mask) { -+ ret = -ENODEV; -+ goto out_disable_clks; -+ } - -+ /* Must be done before ahci_platform_enable_phys() */ - brcm_sata_phys_enable(priv); - -- hpriv = ahci_platform_get_resources(pdev); -- if (IS_ERR(hpriv)) -- return PTR_ERR(hpriv); - hpriv->plat_data = priv; - hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP; - - brcm_sata_alpm_init(hpriv); - -- ret = ahci_platform_enable_resources(hpriv); -- if (ret) -- return ret; -- - if (priv->quirks & BRCM_AHCI_QUIRK_NO_NCQ) - hpriv->flags |= AHCI_HFLAG_NO_NCQ; - hpriv->flags |= AHCI_HFLAG_NO_WRITE_TO_RO; - -+ ret = ahci_platform_enable_phys(hpriv); -+ if (ret) -+ goto out_disable_phys; -+ - ret = ahci_platform_init_host(pdev, hpriv, &ahci_brcm_port_info, - &ahci_platform_sht); - if (ret) -- return ret; -+ goto out_disable_platform_phys; - - dev_info(dev, "Broadcom AHCI SATA3 registered\n"); - - return 0; -+ -+out_disable_platform_phys: -+ ahci_platform_disable_phys(hpriv); -+out_disable_phys: -+ brcm_sata_phys_disable(priv); -+out_disable_clks: -+ ahci_platform_disable_clks(hpriv); -+out_reset: -+ if (!IS_ERR_OR_NULL(priv->rcdev)) -+ reset_control_assert(priv->rcdev); -+ return ret; - } - - static int brcm_ahci_remove(struct platform_device *pdev) -@@ -374,12 +428,12 @@ static int brcm_ahci_remove(struct platform_device *pdev) - struct brcm_ahci_priv *priv = hpriv->plat_data; - int ret; - -+ brcm_sata_phys_disable(priv); -+ - ret = ata_platform_remove_one(pdev); - if (ret) - return ret; - -- brcm_sata_phys_disable(priv); -- - return 0; - } - -diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c -index 70cdbf1b0f9a..5929672b809e 100644 ---- a/drivers/ata/libahci_platform.c -+++ b/drivers/ata/libahci_platform.c -@@ -46,7 +46,7 @@ EXPORT_SYMBOL_GPL(ahci_platform_ops); - * RETURNS: - * 0 on success otherwise a negative error code - */ --static int ahci_platform_enable_phys(struct ahci_host_priv *hpriv) -+int ahci_platform_enable_phys(struct ahci_host_priv *hpriv) - { - int rc, i; - -@@ -71,6 +71,7 @@ disable_phys: - } - return rc; - } -+EXPORT_SYMBOL_GPL(ahci_platform_enable_phys); - - /** - * ahci_platform_disable_phys - Disable PHYs -@@ -78,7 +79,7 @@ disable_phys: - * - * This function disables all PHYs found in hpriv->phys. - */ --static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv) -+void ahci_platform_disable_phys(struct ahci_host_priv *hpriv) - { - int i; - -@@ -87,6 +88,7 @@ static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv) - phy_exit(hpriv->phys[i]); - } - } -+EXPORT_SYMBOL_GPL(ahci_platform_disable_phys); - - /** - * ahci_platform_enable_clks - Enable platform clocks -diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c -index 987d665e82de..c1d1b94f71b5 100644 ---- a/drivers/block/xen-blkback/blkback.c -+++ b/drivers/block/xen-blkback/blkback.c -@@ -929,6 +929,8 @@ next: - out_of_memory: - pr_alert("%s: out of memory\n", __func__); - put_free_pages(ring, pages_to_gnt, segs_to_map); -+ for (i = last_map; i < num; i++) -+ pages[i]->handle = BLKBACK_INVALID_HANDLE; - return -ENOMEM; - } - -diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c -index ed4e80779124..e9fa4a1fc791 100644 ---- a/drivers/block/xen-blkback/xenbus.c -+++ b/drivers/block/xen-blkback/xenbus.c -@@ -178,6 +178,15 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid) - blkif->domid = domid; - atomic_set(&blkif->refcnt, 1); - init_completion(&blkif->drain_complete); -+ -+ /* -+ * Because freeing back to the cache may be deferred, it is not -+ * safe to unload the module (and hence destroy the cache) until -+ * this has completed. To prevent premature unloading, take an -+ * extra module reference here and release only when the object -+ * has been freed back to the cache. -+ */ -+ __module_get(THIS_MODULE); - INIT_WORK(&blkif->free_work, xen_blkif_deferred_free); - - return blkif; -@@ -327,6 +336,7 @@ static void xen_blkif_free(struct xen_blkif *blkif) - - /* Make sure everything is drained before shutting down */ - kmem_cache_free(xen_blkif_cachep, blkif); -+ module_put(THIS_MODULE); - } - - int __init xen_blkif_interface_init(void) -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 73561bfd95d4..424f399cc79b 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -1123,7 +1123,7 @@ static int btusb_open(struct hci_dev *hdev) - if (data->setup_on_usb) { - err = data->setup_on_usb(hdev); - if (err < 0) -- return err; -+ goto setup_fail; - } - - data->intf->needs_remote_wakeup = 1; -@@ -1155,6 +1155,7 @@ done: - - failed: - clear_bit(BTUSB_INTR_RUNNING, &data->flags); -+setup_fail: - usb_autopm_put_interface(data->intf); - return err; - } -diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c -index dc9c0032c97b..ad18de955b6c 100644 ---- a/drivers/devfreq/devfreq.c -+++ b/drivers/devfreq/devfreq.c -@@ -484,11 +484,6 @@ static void devfreq_dev_release(struct device *dev) - struct devfreq *devfreq = to_devfreq(dev); - - mutex_lock(&devfreq_list_lock); -- if (IS_ERR(find_device_devfreq(devfreq->dev.parent))) { -- mutex_unlock(&devfreq_list_lock); -- dev_warn(&devfreq->dev, "releasing devfreq which doesn't exist\n"); -- return; -- } - list_del(&devfreq->node); - mutex_unlock(&devfreq_list_lock); - -@@ -547,6 +542,7 @@ struct devfreq *devfreq_add_device(struct device *dev, - devfreq->dev.parent = dev; - devfreq->dev.class = devfreq_class; - devfreq->dev.release = devfreq_dev_release; -+ INIT_LIST_HEAD(&devfreq->node); - devfreq->profile = profile; - strncpy(devfreq->governor_name, governor_name, DEVFREQ_NAME_LEN); - devfreq->previous_freq = profile->initial_freq; -@@ -978,7 +974,7 @@ static ssize_t available_governors_show(struct device *d, - * The devfreq with immutable governor (e.g., passive) shows - * only own governor. - */ -- if (df->governor->immutable) { -+ if (df->governor && df->governor->immutable) { - count = scnprintf(&buf[count], DEVFREQ_NAME_LEN, - "%s ", df->governor_name); - /* -diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c -index 242359c2d1f1..215f4f71b943 100644 ---- a/drivers/firewire/net.c -+++ b/drivers/firewire/net.c -@@ -249,7 +249,11 @@ static int fwnet_header_cache(const struct neighbour *neigh, - h = (struct fwnet_header *)((u8 *)hh->hh_data + HH_DATA_OFF(sizeof(*h))); - h->h_proto = type; - memcpy(h->h_dest, neigh->ha, net->addr_len); -- hh->hh_len = FWNET_HLEN; -+ -+ /* Pairs with the READ_ONCE() in neigh_resolve_output(), -+ * neigh_hh_output() and neigh_update_hhs(). -+ */ -+ smp_store_release(&hh->hh_len, FWNET_HLEN); - - return 0; - } -diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c -index c7f5f0be2d74..2b75aab8b3a0 100644 ---- a/drivers/gpio/gpiolib.c -+++ b/drivers/gpio/gpiolib.c -@@ -206,6 +206,14 @@ int gpiod_get_direction(struct gpio_desc *desc) - chip = gpiod_to_chip(desc); - offset = gpio_chip_hwgpio(desc); - -+ /* -+ * Open drain emulation using input mode may incorrectly report -+ * input here, fix that up. -+ */ -+ if (test_bit(FLAG_OPEN_DRAIN, &desc->flags) && -+ test_bit(FLAG_IS_OUT, &desc->flags)) -+ return 0; -+ - if (!chip->get_direction) - return status; - -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index bb9a9852ec22..ef86721c06f3 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -1540,7 +1540,11 @@ static void process_single_up_tx_qlock(struct drm_dp_mst_topology_mgr *mgr, - if (ret != 1) - DRM_DEBUG_KMS("failed to send msg in q %d\n", ret); - -- txmsg->dst->tx_slots[txmsg->seqno] = NULL; -+ if (txmsg->seqno != -1) { -+ WARN_ON((unsigned int)txmsg->seqno > -+ ARRAY_SIZE(txmsg->dst->tx_slots)); -+ txmsg->dst->tx_slots[txmsg->seqno] = NULL; -+ } - } - - static void drm_dp_queue_down_tx(struct drm_dp_mst_topology_mgr *mgr, -diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c -index 78e630771214..9decd981d94e 100644 ---- a/drivers/gpu/drm/drm_property.c -+++ b/drivers/gpu/drm/drm_property.c -@@ -540,7 +540,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, - struct drm_property_blob *blob; - int ret; - -- if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob)) -+ if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) - return ERR_PTR(-EINVAL); - - blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); -diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h -index dc7454e7f19a..b46e99f7641e 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_connector.h -+++ b/drivers/gpu/drm/nouveau/nouveau_connector.h -@@ -29,6 +29,7 @@ - - #include - -+#include - #include - #include - #include -@@ -37,6 +38,60 @@ - - struct nvkm_i2c_port; - -+#define nouveau_conn_atom(p) \ -+ container_of((p), struct nouveau_conn_atom, state) -+ -+struct nouveau_conn_atom { -+ struct drm_connector_state state; -+ -+ struct { -+ /* The enum values specifically defined here match nv50/gf119 -+ * hw values, and the code relies on this. -+ */ -+ enum { -+ DITHERING_MODE_OFF = 0x00, -+ DITHERING_MODE_ON = 0x01, -+ DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON, -+ DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON, -+ DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON, -+ DITHERING_MODE_AUTO -+ } mode; -+ enum { -+ DITHERING_DEPTH_6BPC = 0x00, -+ DITHERING_DEPTH_8BPC = 0x02, -+ DITHERING_DEPTH_AUTO -+ } depth; -+ } dither; -+ -+ struct { -+ int mode; /* DRM_MODE_SCALE_* */ -+ struct { -+ enum { -+ UNDERSCAN_OFF, -+ UNDERSCAN_ON, -+ UNDERSCAN_AUTO, -+ } mode; -+ u32 hborder; -+ u32 vborder; -+ } underscan; -+ bool full; -+ } scaler; -+ -+ struct { -+ int color_vibrance; -+ int vibrant_hue; -+ } procamp; -+ -+ union { -+ struct { -+ bool dither:1; -+ bool scaler:1; -+ bool procamp:1; -+ }; -+ u8 mask; -+ } set; -+}; -+ - struct nouveau_connector { - struct drm_connector base; - enum dcb_connector_type type; -@@ -111,61 +166,6 @@ extern int nouveau_ignorelid; - extern int nouveau_duallink; - extern int nouveau_hdmimhz; - --#include --#define nouveau_conn_atom(p) \ -- container_of((p), struct nouveau_conn_atom, state) -- --struct nouveau_conn_atom { -- struct drm_connector_state state; -- -- struct { -- /* The enum values specifically defined here match nv50/gf119 -- * hw values, and the code relies on this. -- */ -- enum { -- DITHERING_MODE_OFF = 0x00, -- DITHERING_MODE_ON = 0x01, -- DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON, -- DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON, -- DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON, -- DITHERING_MODE_AUTO -- } mode; -- enum { -- DITHERING_DEPTH_6BPC = 0x00, -- DITHERING_DEPTH_8BPC = 0x02, -- DITHERING_DEPTH_AUTO -- } depth; -- } dither; -- -- struct { -- int mode; /* DRM_MODE_SCALE_* */ -- struct { -- enum { -- UNDERSCAN_OFF, -- UNDERSCAN_ON, -- UNDERSCAN_AUTO, -- } mode; -- u32 hborder; -- u32 vborder; -- } underscan; -- bool full; -- } scaler; -- -- struct { -- int color_vibrance; -- int vibrant_hue; -- } procamp; -- -- union { -- struct { -- bool dither:1; -- bool scaler:1; -- bool procamp:1; -- }; -- u8 mask; -- } set; --}; -- - void nouveau_conn_attach_properties(struct drm_connector *); - void nouveau_conn_reset(struct drm_connector *); - struct drm_connector_state * -diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c -index 3cf1a6932fac..298d6a8bab12 100644 ---- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c -+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c -@@ -438,8 +438,6 @@ static void sun4i_hdmi_unbind(struct device *dev, struct device *master, - struct sun4i_hdmi *hdmi = dev_get_drvdata(dev); - - cec_unregister_adapter(hdmi->cec_adap); -- drm_connector_cleanup(&hdmi->connector); -- drm_encoder_cleanup(&hdmi->encoder); - i2c_del_adapter(hdmi->i2c); - clk_disable_unprepare(hdmi->mod_clk); - clk_disable_unprepare(hdmi->bus_clk); -diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c -index 33be07c78b96..8649a61c50bc 100644 ---- a/drivers/iio/adc/max9611.c -+++ b/drivers/iio/adc/max9611.c -@@ -92,6 +92,12 @@ - #define MAX9611_TEMP_SCALE_NUM 1000000 - #define MAX9611_TEMP_SCALE_DIV 2083 - -+/* -+ * Conversion time is 2 ms (typically) at Ta=25 degreeC -+ * No maximum value is known, so play it safe. -+ */ -+#define MAX9611_CONV_TIME_US_RANGE 3000, 3300 -+ - struct max9611_dev { - struct device *dev; - struct i2c_client *i2c_client; -@@ -239,11 +245,9 @@ static int max9611_read_single(struct max9611_dev *max9611, - return ret; - } - -- /* -- * need a delay here to make register configuration -- * stabilize. 1 msec at least, from empirical testing. -- */ -- usleep_range(1000, 2000); -+ /* need a delay here to make register configuration stabilize. */ -+ -+ usleep_range(MAX9611_CONV_TIME_US_RANGE); - - ret = i2c_smbus_read_word_swapped(max9611->i2c_client, reg_addr); - if (ret < 0) { -@@ -511,7 +515,7 @@ static int max9611_init(struct max9611_dev *max9611) - MAX9611_REG_CTRL2, 0); - return ret; - } -- usleep_range(1000, 2000); -+ usleep_range(MAX9611_CONV_TIME_US_RANGE); - - return 0; - } -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index f698c6a28c14..fc4630e4acdd 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -4568,6 +4568,7 @@ err: - unregister_netdevice_notifier(&cma_nb); - rdma_addr_unregister_client(&addr_client); - ib_sa_unregister_client(&sa_client); -+ unregister_pernet_subsys(&cma_pernet_operations); - err_wq: - destroy_workqueue(cma_wq); - return ret; -diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c -index 0299c0642de8..7e73a1a6cb67 100644 ---- a/drivers/infiniband/hw/mlx4/main.c -+++ b/drivers/infiniband/hw/mlx4/main.c -@@ -3073,16 +3073,17 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr) - ibdev->ib_active = false; - flush_workqueue(wq); - -- mlx4_ib_close_sriov(ibdev); -- mlx4_ib_mad_cleanup(ibdev); -- ib_unregister_device(&ibdev->ib_dev); -- mlx4_ib_diag_cleanup(ibdev); - if (ibdev->iboe.nb.notifier_call) { - if (unregister_netdevice_notifier(&ibdev->iboe.nb)) - pr_warn("failure unregistering notifier\n"); - ibdev->iboe.nb.notifier_call = NULL; - } - -+ mlx4_ib_close_sriov(ibdev); -+ mlx4_ib_mad_cleanup(ibdev); -+ ib_unregister_device(&ibdev->ib_dev); -+ mlx4_ib_diag_cleanup(ibdev); -+ - mlx4_qp_release_range(dev, ibdev->steer_qpn_base, - ibdev->steer_qpn_count); - kfree(ibdev->ib_uc_qpns_bitmap); -diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c -index 83412df726a5..b7098f7bb30e 100644 ---- a/drivers/infiniband/sw/rxe/rxe_recv.c -+++ b/drivers/infiniband/sw/rxe/rxe_recv.c -@@ -393,7 +393,7 @@ int rxe_rcv(struct sk_buff *skb) - - calc_icrc = rxe_icrc_hdr(pkt, skb); - calc_icrc = rxe_crc32(rxe, calc_icrc, (u8 *)payload_addr(pkt), -- payload_size(pkt)); -+ payload_size(pkt) + bth_pad(pkt)); - calc_icrc = (__force u32)cpu_to_be32(~calc_icrc); - if (unlikely(calc_icrc != pack_icrc)) { - if (skb->protocol == htons(ETH_P_IPV6)) -diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c -index 9fd4f04df3b3..e6785b1ea85f 100644 ---- a/drivers/infiniband/sw/rxe/rxe_req.c -+++ b/drivers/infiniband/sw/rxe/rxe_req.c -@@ -500,6 +500,12 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe, - if (err) - return err; - } -+ if (bth_pad(pkt)) { -+ u8 *pad = payload_addr(pkt) + paylen; -+ -+ memset(pad, 0, bth_pad(pkt)); -+ crc = rxe_crc32(rxe, crc, pad, bth_pad(pkt)); -+ } - } - p = payload_addr(pkt) + paylen + bth_pad(pkt); - -diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c -index 9207682b7a2e..a07a29b48863 100644 ---- a/drivers/infiniband/sw/rxe/rxe_resp.c -+++ b/drivers/infiniband/sw/rxe/rxe_resp.c -@@ -738,6 +738,13 @@ static enum resp_states read_reply(struct rxe_qp *qp, - if (err) - pr_err("Failed copying memory\n"); - -+ if (bth_pad(&ack_pkt)) { -+ struct rxe_dev *rxe = to_rdev(qp->ibqp.device); -+ u8 *pad = payload_addr(&ack_pkt) + payload; -+ -+ memset(pad, 0, bth_pad(&ack_pkt)); -+ icrc = rxe_crc32(rxe, icrc, pad, bth_pad(&ack_pkt)); -+ } - p = payload_addr(&ack_pkt) + payload + bth_pad(&ack_pkt); - *p = ~icrc; - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index f46ac9db9edb..0a9d623b13c2 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -2749,7 +2749,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr, - write_targets++; - } - } -- if (bio->bi_end_io) { -+ if (rdev && bio->bi_end_io) { - atomic_inc(&rdev->nr_pending); - bio->bi_iter.bi_sector = sector_nr + rdev->data_offset; - bio_set_dev(bio, rdev->bdev); -diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c -index 27e57915eb4d..0d7d687aeea0 100644 ---- a/drivers/media/cec/cec-adap.c -+++ b/drivers/media/cec/cec-adap.c -@@ -330,7 +330,8 @@ static void cec_data_cancel(struct cec_data *data) - } else { - list_del_init(&data->list); - if (!(data->msg.tx_status & CEC_TX_STATUS_OK)) -- data->adap->transmit_queue_sz--; -+ if (!WARN_ON(!data->adap->transmit_queue_sz)) -+ data->adap->transmit_queue_sz--; - } - - /* Mark it as an error */ -@@ -377,6 +378,14 @@ static void cec_flush(struct cec_adapter *adap) - * need to do anything special in that case. - */ - } -+ /* -+ * If something went wrong and this counter isn't what it should -+ * be, then this will reset it back to 0. Warn if it is not 0, -+ * since it indicates a bug, either in this framework or in a -+ * CEC driver. -+ */ -+ if (WARN_ON(adap->transmit_queue_sz)) -+ adap->transmit_queue_sz = 0; - } - - /* -@@ -465,7 +474,8 @@ int cec_thread_func(void *_adap) - data = list_first_entry(&adap->transmit_queue, - struct cec_data, list); - list_del_init(&data->list); -- adap->transmit_queue_sz--; -+ if (!WARN_ON(!data->adap->transmit_queue_sz)) -+ adap->transmit_queue_sz--; - - /* Make this the current transmitting message */ - adap->transmitting = data; -@@ -1031,11 +1041,11 @@ void cec_received_msg_ts(struct cec_adapter *adap, - valid_la = false; - else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED)) - valid_la = false; -- else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4)) -+ else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST)) - valid_la = false; - else if (cec_msg_is_broadcast(msg) && -- adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 && -- !(dir_fl & BCAST2_0)) -+ adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0 && -+ !(dir_fl & BCAST1_4)) - valid_la = false; - } - if (valid_la && min_len) { -diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c -index f1807c16438d..427cda457af6 100644 ---- a/drivers/media/usb/b2c2/flexcop-usb.c -+++ b/drivers/media/usb/b2c2/flexcop-usb.c -@@ -294,7 +294,7 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c, - - mutex_unlock(&fc_usb->data_mutex); - -- return 0; -+ return ret; - } - - /* actual bus specific access functions, -diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c -index 986763b1b2b3..c047a0bdf91f 100644 ---- a/drivers/media/usb/dvb-usb/af9005.c -+++ b/drivers/media/usb/dvb-usb/af9005.c -@@ -985,8 +985,9 @@ static int af9005_identify_state(struct usb_device *udev, - else if (reply == 0x02) - *cold = 0; - else -- return -EIO; -- deb_info("Identify state cold = %d\n", *cold); -+ ret = -EIO; -+ if (!ret) -+ deb_info("Identify state cold = %d\n", *cold); - - err: - kfree(buf); -diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c -index 12da631c0fda..f1615fb60015 100644 ---- a/drivers/media/usb/pulse8-cec/pulse8-cec.c -+++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c -@@ -121,6 +121,7 @@ struct pulse8 { - unsigned int vers; - struct completion cmd_done; - struct work_struct work; -+ u8 work_result; - struct delayed_work ping_eeprom_work; - struct cec_msg rx_msg; - u8 data[DATA_SIZE]; -@@ -142,8 +143,10 @@ static void pulse8_irq_work_handler(struct work_struct *work) - { - struct pulse8 *pulse8 = - container_of(work, struct pulse8, work); -+ u8 result = pulse8->work_result; - -- switch (pulse8->data[0] & 0x3f) { -+ pulse8->work_result = 0; -+ switch (result & 0x3f) { - case MSGCODE_FRAME_DATA: - cec_received_msg(pulse8->adap, &pulse8->rx_msg); - break; -@@ -177,12 +180,12 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data, - pulse8->escape = false; - } else if (data == MSGEND) { - struct cec_msg *msg = &pulse8->rx_msg; -+ u8 msgcode = pulse8->buf[0]; - - if (debug) - dev_info(pulse8->dev, "received: %*ph\n", - pulse8->idx, pulse8->buf); -- pulse8->data[0] = pulse8->buf[0]; -- switch (pulse8->buf[0] & 0x3f) { -+ switch (msgcode & 0x3f) { - case MSGCODE_FRAME_START: - msg->len = 1; - msg->msg[0] = pulse8->buf[1]; -@@ -191,14 +194,20 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data, - if (msg->len == CEC_MAX_MSG_SIZE) - break; - msg->msg[msg->len++] = pulse8->buf[1]; -- if (pulse8->buf[0] & MSGCODE_FRAME_EOM) -+ if (msgcode & MSGCODE_FRAME_EOM) { -+ WARN_ON(pulse8->work_result); -+ pulse8->work_result = msgcode; - schedule_work(&pulse8->work); -+ break; -+ } - break; - case MSGCODE_TRANSMIT_SUCCEEDED: - case MSGCODE_TRANSMIT_FAILED_LINE: - case MSGCODE_TRANSMIT_FAILED_ACK: - case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA: - case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE: -+ WARN_ON(pulse8->work_result); -+ pulse8->work_result = msgcode; - schedule_work(&pulse8->work); - break; - case MSGCODE_HIGH_ERROR: -diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c -index b38a586ea59a..4748f557c753 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c -+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c -@@ -973,6 +973,8 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, - struct ath_htc_rx_status *rxstatus; - struct ath_rx_status rx_stats; - bool decrypt_error = false; -+ __be16 rs_datalen; -+ bool is_phyerr; - - if (skb->len < HTC_RX_FRAME_HEADER_SIZE) { - ath_err(common, "Corrupted RX frame, dropping (len: %d)\n", -@@ -982,11 +984,24 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, - - rxstatus = (struct ath_htc_rx_status *)skb->data; - -- if (be16_to_cpu(rxstatus->rs_datalen) - -- (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0) { -+ rs_datalen = be16_to_cpu(rxstatus->rs_datalen); -+ if (unlikely(rs_datalen - -+ (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) { - ath_err(common, - "Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n", -- rxstatus->rs_datalen, skb->len); -+ rs_datalen, skb->len); -+ goto rx_next; -+ } -+ -+ is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY; -+ /* -+ * Discard zero-length packets and packets smaller than an ACK -+ * which are not PHY_ERROR (short radar pulses have a length of 3) -+ */ -+ if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) { -+ ath_warn(common, -+ "Short RX data len, dropping (dlen: %d)\n", -+ rs_datalen); - goto rx_next; - } - -@@ -1011,7 +1026,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, - * Process PHY errors and return so that the packet - * can be dropped. - */ -- if (rx_stats.rs_status & ATH9K_RXERR_PHY) { -+ if (unlikely(is_phyerr)) { - /* TODO: Not using DFS processing now. */ - if (ath_cmn_process_fft(&priv->spec_priv, hdr, - &rx_stats, rx_status->mactime)) { -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index 058d542647dd..9e4d2ecf736d 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -337,7 +337,8 @@ nvme_fc_register_localport(struct nvme_fc_port_info *pinfo, - !template->ls_req || !template->fcp_io || - !template->ls_abort || !template->fcp_abort || - !template->max_hw_queues || !template->max_sgl_segments || -- !template->max_dif_sgl_segments || !template->dma_boundary) { -+ !template->max_dif_sgl_segments || !template->dma_boundary || -+ !template->module) { - ret = -EINVAL; - goto out_reghost_failed; - } -@@ -1762,6 +1763,7 @@ nvme_fc_ctrl_free(struct kref *ref) - { - struct nvme_fc_ctrl *ctrl = - container_of(ref, struct nvme_fc_ctrl, ref); -+ struct nvme_fc_lport *lport = ctrl->lport; - unsigned long flags; - - if (ctrl->ctrl.tagset) { -@@ -1787,6 +1789,7 @@ nvme_fc_ctrl_free(struct kref *ref) - if (ctrl->ctrl.opts) - nvmf_free_options(ctrl->ctrl.opts); - kfree(ctrl); -+ module_put(lport->ops->module); - } - - static void -@@ -2765,10 +2768,15 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, - goto out_fail; - } - -+ if (!try_module_get(lport->ops->module)) { -+ ret = -EUNATCH; -+ goto out_free_ctrl; -+ } -+ - idx = ida_simple_get(&nvme_fc_ctrl_cnt, 0, 0, GFP_KERNEL); - if (idx < 0) { - ret = -ENOSPC; -- goto out_free_ctrl; -+ goto out_mod_put; - } - - ctrl->ctrl.opts = opts; -@@ -2915,6 +2923,8 @@ out_free_queues: - out_free_ida: - put_device(ctrl->dev); - ida_simple_remove(&nvme_fc_ctrl_cnt, ctrl->cnum); -+out_mod_put: -+ module_put(lport->ops->module); - out_free_ctrl: - kfree(ctrl); - out_fail: -diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c -index 096523d8dd42..b8fe8702065b 100644 ---- a/drivers/nvme/target/fcloop.c -+++ b/drivers/nvme/target/fcloop.c -@@ -693,6 +693,7 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport) - #define FCLOOP_DMABOUND_4G 0xFFFFFFFF - - static struct nvme_fc_port_template fctemplate = { -+ .module = THIS_MODULE, - .localport_delete = fcloop_localport_delete, - .remoteport_delete = fcloop_remoteport_delete, - .create_queue = fcloop_create_queue, -diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c -index 971ae892c611..74997194fd88 100644 ---- a/drivers/platform/x86/pmc_atom.c -+++ b/drivers/platform/x86/pmc_atom.c -@@ -482,6 +482,14 @@ static const struct dmi_system_id critclk_systems[] = { - DMI_MATCH(DMI_PRODUCT_VERSION, "6ES7647-8B"), - }, - }, -+ { -+ .ident = "CONNECT X300", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "SIEMENS AG"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "A5E45074588"), -+ }, -+ }, -+ - { /*sentinel*/ } - }; - -diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c -index 0f97514e3474..c9f20e1394e3 100644 ---- a/drivers/regulator/ab8500.c -+++ b/drivers/regulator/ab8500.c -@@ -1099,23 +1099,6 @@ static struct ab8500_regulator_info - .update_val_idle = 0x82, - .update_val_normal = 0x02, - }, -- [AB8505_LDO_USB] = { -- .desc = { -- .name = "LDO-USB", -- .ops = &ab8500_regulator_mode_ops, -- .type = REGULATOR_VOLTAGE, -- .id = AB8505_LDO_USB, -- .owner = THIS_MODULE, -- .n_voltages = 1, -- .volt_table = fixed_3300000_voltage, -- }, -- .update_bank = 0x03, -- .update_reg = 0x82, -- .update_mask = 0x03, -- .update_val = 0x01, -- .update_val_idle = 0x03, -- .update_val_normal = 0x01, -- }, - [AB8505_LDO_AUDIO] = { - .desc = { - .name = "LDO-AUDIO", -diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c -index 60de66252fa2..b200edc665a5 100644 ---- a/drivers/scsi/libsas/sas_discover.c -+++ b/drivers/scsi/libsas/sas_discover.c -@@ -97,12 +97,21 @@ static int sas_get_port_device(struct asd_sas_port *port) - else - dev->dev_type = SAS_SATA_DEV; - dev->tproto = SAS_PROTOCOL_SATA; -- } else { -+ } else if (port->oob_mode == SAS_OOB_MODE) { - struct sas_identify_frame *id = - (struct sas_identify_frame *) dev->frame_rcvd; - dev->dev_type = id->dev_type; - dev->iproto = id->initiator_bits; - dev->tproto = id->target_bits; -+ } else { -+ /* If the oob mode is OOB_NOT_CONNECTED, the port is -+ * disconnected due to race with PHY down. We cannot -+ * continue to discover this port -+ */ -+ sas_put_device(dev); -+ pr_warn("Port %016llx is disconnected when discovering\n", -+ SAS_ADDR(port->attached_sas_addr)); -+ return -ENODEV; - } - - sas_init_dev(dev); -diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c -index 6dde21dc82a3..08ed27b0d4c6 100644 ---- a/drivers/scsi/lpfc/lpfc_bsg.c -+++ b/drivers/scsi/lpfc/lpfc_bsg.c -@@ -4419,12 +4419,6 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, - phba->mbox_ext_buf_ctx.seqNum++; - nemb_tp = phba->mbox_ext_buf_ctx.nembType; - -- dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL); -- if (!dd_data) { -- rc = -ENOMEM; -- goto job_error; -- } -- - pbuf = (uint8_t *)dmabuf->virt; - size = job->request_payload.payload_len; - sg_copy_to_buffer(job->request_payload.sg_list, -@@ -4461,6 +4455,13 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, - "2968 SLI_CONFIG ext-buffer wr all %d " - "ebuffers received\n", - phba->mbox_ext_buf_ctx.numBuf); -+ -+ dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL); -+ if (!dd_data) { -+ rc = -ENOMEM; -+ goto job_error; -+ } -+ - /* mailbox command structure for base driver */ - pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL); - if (!pmboxq) { -@@ -4509,6 +4510,8 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, - return SLI_CONFIG_HANDLED; - - job_error: -+ if (pmboxq) -+ mempool_free(pmboxq, phba->mbox_mem_pool); - lpfc_bsg_dma_page_free(phba, dmabuf); - kfree(dd_data); - -diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c -index fcf4b4175d77..af937b91765e 100644 ---- a/drivers/scsi/lpfc/lpfc_nvme.c -+++ b/drivers/scsi/lpfc/lpfc_nvme.c -@@ -1591,6 +1591,8 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport, - - /* Declare and initialization an instance of the FC NVME template. */ - static struct nvme_fc_port_template lpfc_nvme_template = { -+ .module = THIS_MODULE, -+ - /* initiator-based functions */ - .localport_delete = lpfc_nvme_localport_delete, - .remoteport_delete = lpfc_nvme_remoteport_delete, -diff --git a/drivers/scsi/qedf/qedf_els.c b/drivers/scsi/qedf/qedf_els.c -index 59c18ca4cda9..e5927a09f7bc 100644 ---- a/drivers/scsi/qedf/qedf_els.c -+++ b/drivers/scsi/qedf/qedf_els.c -@@ -23,8 +23,6 @@ static int qedf_initiate_els(struct qedf_rport *fcport, unsigned int op, - int rc = 0; - uint32_t did, sid; - uint16_t xid; -- uint32_t start_time = jiffies / HZ; -- uint32_t current_time; - struct fcoe_wqe *sqe; - unsigned long flags; - u16 sqe_idx; -@@ -50,18 +48,12 @@ static int qedf_initiate_els(struct qedf_rport *fcport, unsigned int op, - goto els_err; - } - --retry_els: - els_req = qedf_alloc_cmd(fcport, QEDF_ELS); - if (!els_req) { -- current_time = jiffies / HZ; -- if ((current_time - start_time) > 10) { -- QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_ELS, -- "els: Failed els 0x%x\n", op); -- rc = -ENOMEM; -- goto els_err; -- } -- mdelay(20 * USEC_PER_MSEC); -- goto retry_els; -+ QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_ELS, -+ "Failed to alloc ELS request 0x%x\n", op); -+ rc = -ENOMEM; -+ goto els_err; - } - - QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_ELS, "initiate_els els_req = " -diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c -index ebca1a470e9b..7f2da56274bd 100644 ---- a/drivers/scsi/qla2xxx/qla_isr.c -+++ b/drivers/scsi/qla2xxx/qla_isr.c -@@ -1046,8 +1046,6 @@ global_port_update: - ql_dbg(ql_dbg_async, vha, 0x5011, - "Asynchronous PORT UPDATE ignored %04x/%04x/%04x.\n", - mb[1], mb[2], mb[3]); -- -- qlt_async_event(mb[0], vha, mb); - break; - } - -@@ -1065,8 +1063,6 @@ global_port_update: - set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags); - set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags); - set_bit(VP_CONFIG_OK, &vha->vp_flags); -- -- qlt_async_event(mb[0], vha, mb); - break; - - case MBA_RSCN_UPDATE: /* State Change Registration */ -diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c -index 6b33a1f24f56..7dceed021236 100644 ---- a/drivers/scsi/qla2xxx/qla_nvme.c -+++ b/drivers/scsi/qla2xxx/qla_nvme.c -@@ -578,6 +578,7 @@ static void qla_nvme_remoteport_delete(struct nvme_fc_remote_port *rport) - } - - static struct nvme_fc_port_template qla_nvme_fc_transport = { -+ .module = THIS_MODULE, - .localport_delete = qla_nvme_localport_delete, - .remoteport_delete = qla_nvme_remoteport_delete, - .create_queue = qla_nvme_alloc_queue, -diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c -index 69ed544d80ef..55227d20496a 100644 ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -1210,7 +1210,6 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess, - "Scheduling sess %p for deletion %8phC\n", - sess, sess->port_name); - -- INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn); - queue_work(sess->vha->hw->wq, &sess->del_work); - } - -diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c -index 4421f9bdfcf7..b0ad60565fe9 100644 ---- a/drivers/scsi/qla4xxx/ql4_os.c -+++ b/drivers/scsi/qla4xxx/ql4_os.c -@@ -4285,7 +4285,6 @@ static int qla4xxx_mem_alloc(struct scsi_qla_host *ha) - return QLA_SUCCESS; - - mem_alloc_error_exit: -- qla4xxx_mem_free(ha); - return QLA_ERROR; - } - -diff --git a/drivers/tty/hvc/hvc_vio.c b/drivers/tty/hvc/hvc_vio.c -index a1d272ac82bb..c33150fcd964 100644 ---- a/drivers/tty/hvc/hvc_vio.c -+++ b/drivers/tty/hvc/hvc_vio.c -@@ -120,6 +120,14 @@ static int hvterm_raw_get_chars(uint32_t vtermno, char *buf, int count) - return got; - } - -+/** -+ * hvterm_raw_put_chars: send characters to firmware for given vterm adapter -+ * @vtermno: The virtual terminal number. -+ * @buf: The characters to send. Because of the underlying hypercall in -+ * hvc_put_chars(), this buffer must be at least 16 bytes long, even if -+ * you are sending fewer chars. -+ * @count: number of chars to send. -+ */ - static int hvterm_raw_put_chars(uint32_t vtermno, const char *buf, int count) - { - struct hvterm_priv *pv = hvterm_privs[vtermno]; -@@ -232,6 +240,7 @@ static const struct hv_ops hvterm_hvsi_ops = { - static void udbg_hvc_putc(char c) - { - int count = -1; -+ unsigned char bounce_buffer[16]; - - if (!hvterm_privs[0]) - return; -@@ -242,7 +251,12 @@ static void udbg_hvc_putc(char c) - do { - switch(hvterm_privs[0]->proto) { - case HV_PROTOCOL_RAW: -- count = hvterm_raw_put_chars(0, &c, 1); -+ /* -+ * hvterm_raw_put_chars requires at least a 16-byte -+ * buffer, so go via the bounce buffer -+ */ -+ bounce_buffer[0] = c; -+ count = hvterm_raw_put_chars(0, bounce_buffer, 1); - break; - case HV_PROTOCOL_HVSI: - count = hvterm_hvsi_put_chars(0, &c, 1); -diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c -index e937fb189034..77a1f00fe843 100644 ---- a/drivers/tty/serial/msm_serial.c -+++ b/drivers/tty/serial/msm_serial.c -@@ -1588,6 +1588,7 @@ static void __msm_console_write(struct uart_port *port, const char *s, - int num_newlines = 0; - bool replaced = false; - void __iomem *tf; -+ int locked = 1; - - if (is_uartdm) - tf = port->membase + UARTDM_TF; -@@ -1600,7 +1601,13 @@ static void __msm_console_write(struct uart_port *port, const char *s, - num_newlines++; - count += num_newlines; - -- spin_lock(&port->lock); -+ if (port->sysrq) -+ locked = 0; -+ else if (oops_in_progress) -+ locked = spin_trylock(&port->lock); -+ else -+ spin_lock(&port->lock); -+ - if (is_uartdm) - msm_reset_dm_count(port, count); - -@@ -1636,7 +1643,9 @@ static void __msm_console_write(struct uart_port *port, const char *s, - iowrite32_rep(tf, buf, 1); - i += num_chars; - } -- spin_unlock(&port->lock); -+ -+ if (locked) -+ spin_unlock(&port->lock); - } - - static void msm_console_write(struct console *co, const char *s, -diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c -index 4c488d15b6f6..dc99ed94f03d 100644 ---- a/drivers/usb/gadget/function/f_ecm.c -+++ b/drivers/usb/gadget/function/f_ecm.c -@@ -625,8 +625,12 @@ static void ecm_disable(struct usb_function *f) - - DBG(cdev, "ecm deactivated\n"); - -- if (ecm->port.in_ep->enabled) -+ if (ecm->port.in_ep->enabled) { - gether_disconnect(&ecm->port); -+ } else { -+ ecm->port.in_ep->desc = NULL; -+ ecm->port.out_ep->desc = NULL; -+ } - - usb_ep_disable(ecm->notify); - ecm->notify->desc = NULL; -diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c -index c7c5b3ce1d98..2bde68f5d246 100644 ---- a/drivers/usb/gadget/function/f_rndis.c -+++ b/drivers/usb/gadget/function/f_rndis.c -@@ -622,6 +622,7 @@ static void rndis_disable(struct usb_function *f) - gether_disconnect(&rndis->port); - - usb_ep_disable(rndis->notify); -+ rndis->notify->desc = NULL; - } - - /*-------------------------------------------------------------------------*/ -diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c -index 71a6deeb4e71..3f9260af701f 100644 ---- a/drivers/xen/balloon.c -+++ b/drivers/xen/balloon.c -@@ -401,7 +401,8 @@ static struct notifier_block xen_memory_nb = { - #else - static enum bp_state reserve_additional_memory(void) - { -- balloon_stats.target_pages = balloon_stats.current_pages; -+ balloon_stats.target_pages = balloon_stats.current_pages + -+ balloon_stats.target_unpopulated; - return BP_ECANCELED; - } - #endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */ -diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c -index 033e8e6aabb7..f445bc9cdc94 100644 ---- a/fs/compat_ioctl.c -+++ b/fs/compat_ioctl.c -@@ -1577,9 +1577,10 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, - #endif - - case FICLONE: -+ goto do_ioctl; - case FICLONERANGE: - case FIDEDUPERANGE: -- goto do_ioctl; -+ goto found_handler; - - case FIBMAP: - case FIGETBSZ: -diff --git a/fs/locks.c b/fs/locks.c -index 665e3ce9ab47..1a40e277eb5e 100644 ---- a/fs/locks.c -+++ b/fs/locks.c -@@ -2691,7 +2691,7 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl, - } - if (inode) { - /* userspace relies on this representation of dev_t */ -- seq_printf(f, "%d %02x:%02x:%ld ", fl_pid, -+ seq_printf(f, "%d %02x:%02x:%lu ", fl_pid, - MAJOR(inode->i_sb->s_dev), - MINOR(inode->i_sb->s_dev), inode->i_ino); - } else { -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 87ee9cbf7dcb..fc13236d1be1 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -3058,12 +3058,17 @@ static bool replay_matches_cache(struct svc_rqst *rqstp, - (bool)seq->cachethis) - return false; - /* -- * If there's an error than the reply can have fewer ops than -- * the call. But if we cached a reply with *more* ops than the -- * call you're sending us now, then this new call is clearly not -- * really a replay of the old one: -+ * If there's an error then the reply can have fewer ops than -+ * the call. - */ -- if (slot->sl_opcnt < argp->opcnt) -+ if (slot->sl_opcnt < argp->opcnt && !slot->sl_status) -+ return false; -+ /* -+ * But if we cached a reply with *more* ops than the call you're -+ * sending us now, then this new call is clearly not really a -+ * replay of the old one: -+ */ -+ if (slot->sl_opcnt > argp->opcnt) - return false; - /* This is the only check explicitly called by spec: */ - if (!same_creds(&rqstp->rq_cred, &slot->sl_cred)) -diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c -index 1e675be10926..11c7a171c0a1 100644 ---- a/fs/pstore/ram.c -+++ b/fs/pstore/ram.c -@@ -433,6 +433,17 @@ static int notrace ramoops_pstore_write(struct pstore_record *record) - - prz = cxt->dprzs[cxt->dump_write_cnt]; - -+ /* -+ * Since this is a new crash dump, we need to reset the buffer in -+ * case it still has an old dump present. Without this, the new dump -+ * will get appended, which would seriously confuse anything trying -+ * to check dump file contents. Specifically, ramoops_read_kmsg_hdr() -+ * expects to find a dump header in the beginning of buffer data, so -+ * we must to reset the buffer values, in order to ensure that the -+ * header will be written to the beginning of the buffer. -+ */ -+ persistent_ram_zap(prz); -+ - /* Build header and append record contents. */ - hlen = ramoops_write_kmsg_hdr(prz, record); - size = record->size; -diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c -index 7b25a88569c9..84245d210182 100644 ---- a/fs/xfs/libxfs/xfs_bmap.c -+++ b/fs/xfs/libxfs/xfs_bmap.c -@@ -5556,7 +5556,7 @@ __xfs_bunmapi( - * Make sure we don't touch multiple AGF headers out of order - * in a single transaction, as that could cause AB-BA deadlocks. - */ -- if (!wasdel) { -+ if (!wasdel && !isrt) { - agno = XFS_FSB_TO_AGNO(mp, del.br_startblock); - if (prev_agno != NULLAGNUMBER && prev_agno > agno) - break; -diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c -index dc95a49d62e7..4e768e606998 100644 ---- a/fs/xfs/xfs_log.c -+++ b/fs/xfs/xfs_log.c -@@ -1539,6 +1539,8 @@ out_free_iclog: - if (iclog->ic_bp) - xfs_buf_free(iclog->ic_bp); - kmem_free(iclog); -+ if (prev_iclog == log->l_iclog) -+ break; - } - spinlock_destroy(&log->l_icloglock); - xfs_buf_free(log->l_xbuf); -diff --git a/include/linux/ahci_platform.h b/include/linux/ahci_platform.h -index 1b0a17b22cd3..d560580d9cda 100644 ---- a/include/linux/ahci_platform.h -+++ b/include/linux/ahci_platform.h -@@ -23,6 +23,8 @@ struct ahci_host_priv; - struct platform_device; - struct scsi_host_template; - -+int ahci_platform_enable_phys(struct ahci_host_priv *hpriv); -+void ahci_platform_disable_phys(struct ahci_host_priv *hpriv); - int ahci_platform_enable_clks(struct ahci_host_priv *hpriv); - void ahci_platform_disable_clks(struct ahci_host_priv *hpriv); - int ahci_platform_enable_regulators(struct ahci_host_priv *hpriv); -diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h -index 8319101170fc..087cbe776868 100644 ---- a/include/linux/dmaengine.h -+++ b/include/linux/dmaengine.h -@@ -1362,8 +1362,11 @@ static inline int dma_get_slave_caps(struct dma_chan *chan, - static inline int dmaengine_desc_set_reuse(struct dma_async_tx_descriptor *tx) - { - struct dma_slave_caps caps; -+ int ret; - -- dma_get_slave_caps(tx->chan, &caps); -+ ret = dma_get_slave_caps(tx->chan, &caps); -+ if (ret) -+ return ret; - - if (caps.descriptor_reuse) { - tx->flags |= DMA_CTRL_REUSE; -diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h -index a726f96010d5..e9c3b98df3e2 100644 ---- a/include/linux/nvme-fc-driver.h -+++ b/include/linux/nvme-fc-driver.h -@@ -279,6 +279,8 @@ struct nvme_fc_remote_port { - * - * Host/Initiator Transport Entrypoints/Parameters: - * -+ * @module: The LLDD module using the interface -+ * - * @localport_delete: The LLDD initiates deletion of a localport via - * nvme_fc_deregister_localport(). However, the teardown is - * asynchronous. This routine is called upon the completion of the -@@ -392,6 +394,8 @@ struct nvme_fc_remote_port { - * Value is Mandatory. Allowed to be zero. - */ - struct nvme_fc_port_template { -+ struct module *module; -+ - /* initiator-based functions */ - void (*localport_delete)(struct nvme_fc_local_port *); - void (*remoteport_delete)(struct nvme_fc_remote_port *); -diff --git a/include/linux/regulator/ab8500.h b/include/linux/regulator/ab8500.h -index d8ecefaf63ca..260c4aa1d976 100644 ---- a/include/linux/regulator/ab8500.h -+++ b/include/linux/regulator/ab8500.h -@@ -38,7 +38,6 @@ enum ab8505_regulator_id { - AB8505_LDO_AUX6, - AB8505_LDO_INTCORE, - AB8505_LDO_ADC, -- AB8505_LDO_USB, - AB8505_LDO_AUDIO, - AB8505_LDO_ANAMIC1, - AB8505_LDO_ANAMIC2, -diff --git a/include/net/neighbour.h b/include/net/neighbour.h -index 1d6b98119a1d..e89273f9a0bc 100644 ---- a/include/net/neighbour.h -+++ b/include/net/neighbour.h -@@ -458,7 +458,7 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb - - do { - seq = read_seqbegin(&hh->hh_lock); -- hh_len = hh->hh_len; -+ hh_len = READ_ONCE(hh->hh_len); - if (likely(hh_len <= HH_DATA_MOD)) { - hh_alen = HH_DATA_MOD; - -diff --git a/kernel/cred.c b/kernel/cred.c -index 5ab1f7ec946e..a9f0f8b21d8c 100644 ---- a/kernel/cred.c -+++ b/kernel/cred.c -@@ -220,7 +220,7 @@ struct cred *cred_alloc_blank(void) - new->magic = CRED_MAGIC; - #endif - -- if (security_cred_alloc_blank(new, GFP_KERNEL) < 0) -+ if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0) - goto error; - - return new; -@@ -279,7 +279,7 @@ struct cred *prepare_creds(void) - new->security = NULL; - #endif - -- if (security_prepare_creds(new, old, GFP_KERNEL) < 0) -+ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) - goto error; - validate_creds(new); - return new; -@@ -654,7 +654,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon) - #ifdef CONFIG_SECURITY - new->security = NULL; - #endif -- if (security_prepare_creds(new, old, GFP_KERNEL) < 0) -+ if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) - goto error; - - put_cred(old); -diff --git a/kernel/exit.c b/kernel/exit.c -index 57cb0eb1271c..d1baf9c96c3e 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -577,10 +577,6 @@ static struct task_struct *find_child_reaper(struct task_struct *father, - } - - write_unlock_irq(&tasklist_lock); -- if (unlikely(pid_ns == &init_pid_ns)) { -- panic("Attempted to kill init! exitcode=0x%08x\n", -- father->signal->group_exit_code ?: father->exit_code); -- } - - list_for_each_entry_safe(p, n, dead, ptrace_entry) { - list_del_init(&p->ptrace_entry); -@@ -823,6 +819,14 @@ void __noreturn do_exit(long code) - acct_update_integrals(tsk); - group_dead = atomic_dec_and_test(&tsk->signal->live); - if (group_dead) { -+ /* -+ * If the last thread of global init has exited, panic -+ * immediately to get a useable coredump. -+ */ -+ if (unlikely(is_global_init(tsk))) -+ panic("Attempted to kill init! exitcode=0x%08x\n", -+ tsk->signal->group_exit_code ?: (int)code); -+ - #ifdef CONFIG_POSIX_TIMERS - hrtimer_cancel(&tsk->signal->real_timer); - exit_itimers(tsk->signal); -diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c -index 0972a8e09d08..ff2aabb70de9 100644 ---- a/kernel/power/snapshot.c -+++ b/kernel/power/snapshot.c -@@ -734,8 +734,15 @@ zone_found: - * We have found the zone. Now walk the radix tree to find the leaf node - * for our PFN. - */ -+ -+ /* -+ * If the zone we wish to scan is the the current zone and the -+ * pfn falls into the current node then we do not need to walk -+ * the tree. -+ */ - node = bm->cur.node; -- if (((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn) -+ if (zone == bm->cur.zone && -+ ((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn) - goto node_found; - - node = zone->rtree; -diff --git a/kernel/taskstats.c b/kernel/taskstats.c -index 4559e914452b..390c76d4503c 100644 ---- a/kernel/taskstats.c -+++ b/kernel/taskstats.c -@@ -568,25 +568,33 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info) - static struct taskstats *taskstats_tgid_alloc(struct task_struct *tsk) - { - struct signal_struct *sig = tsk->signal; -- struct taskstats *stats; -+ struct taskstats *stats_new, *stats; - -- if (sig->stats || thread_group_empty(tsk)) -- goto ret; -+ /* Pairs with smp_store_release() below. */ -+ stats = smp_load_acquire(&sig->stats); -+ if (stats || thread_group_empty(tsk)) -+ return stats; - - /* No problem if kmem_cache_zalloc() fails */ -- stats = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL); -+ stats_new = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL); - - spin_lock_irq(&tsk->sighand->siglock); -- if (!sig->stats) { -- sig->stats = stats; -- stats = NULL; -+ stats = sig->stats; -+ if (!stats) { -+ /* -+ * Pairs with smp_store_release() above and order the -+ * kmem_cache_zalloc(). -+ */ -+ smp_store_release(&sig->stats, stats_new); -+ stats = stats_new; -+ stats_new = NULL; - } - spin_unlock_irq(&tsk->sighand->siglock); - -- if (stats) -- kmem_cache_free(taskstats_cache, stats); --ret: -- return sig->stats; -+ if (stats_new) -+ kmem_cache_free(taskstats_cache, stats_new); -+ -+ return stats; - } - - /* Send pid data out on exit */ -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 144d982905fc..3864d2341442 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -622,8 +622,7 @@ static int function_stat_show(struct seq_file *m, void *v) - } - - #ifdef CONFIG_FUNCTION_GRAPH_TRACER -- avg = rec->time; -- do_div(avg, rec->counter); -+ avg = div64_ul(rec->time, rec->counter); - if (tracing_thresh && (avg < tracing_thresh)) - goto out; - #endif -@@ -649,7 +648,8 @@ static int function_stat_show(struct seq_file *m, void *v) - * Divide only 1000 for ns^2 -> us^2 conversion. - * trace_print_graph_duration will divide 1000 again. - */ -- do_div(stddev, rec->counter * (rec->counter - 1) * 1000); -+ stddev = div64_ul(stddev, -+ rec->counter * (rec->counter - 1) * 1000); - } - - trace_seq_init(&s); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 286bbad7681b..c456c2b06277 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -4368,6 +4368,10 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set) - - int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled) - { -+ if ((mask == TRACE_ITER_RECORD_TGID) || -+ (mask == TRACE_ITER_RECORD_CMD)) -+ lockdep_assert_held(&event_mutex); -+ - /* do nothing if flag is already set */ - if (!!(tr->trace_flags & mask) == !!enabled) - return 0; -@@ -4433,6 +4437,7 @@ static int trace_set_options(struct trace_array *tr, char *option) - cmp += 2; - } - -+ mutex_lock(&event_mutex); - mutex_lock(&trace_types_lock); - - for (i = 0; trace_options[i]; i++) { -@@ -4447,6 +4452,7 @@ static int trace_set_options(struct trace_array *tr, char *option) - ret = set_tracer_option(tr, cmp, neg); - - mutex_unlock(&trace_types_lock); -+ mutex_unlock(&event_mutex); - - /* - * If the first trailing whitespace is replaced with '\0' by strstrip, -@@ -7373,9 +7379,11 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, - if (val != 0 && val != 1) - return -EINVAL; - -+ mutex_lock(&event_mutex); - mutex_lock(&trace_types_lock); - ret = set_tracer_flag(tr, 1 << index, val); - mutex_unlock(&trace_types_lock); -+ mutex_unlock(&event_mutex); - - if (ret < 0) - return ret; -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index 654a1587f6dd..2b0a01b2be2d 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -326,7 +326,8 @@ void trace_event_enable_cmd_record(bool enable) - struct trace_event_file *file; - struct trace_array *tr; - -- mutex_lock(&event_mutex); -+ lockdep_assert_held(&event_mutex); -+ - do_for_each_event_file(tr, file) { - - if (!(file->flags & EVENT_FILE_FL_ENABLED)) -@@ -340,7 +341,6 @@ void trace_event_enable_cmd_record(bool enable) - clear_bit(EVENT_FILE_FL_RECORDED_CMD_BIT, &file->flags); - } - } while_for_each_event_file(); -- mutex_unlock(&event_mutex); - } - - void trace_event_enable_tgid_record(bool enable) -@@ -348,7 +348,8 @@ void trace_event_enable_tgid_record(bool enable) - struct trace_event_file *file; - struct trace_array *tr; - -- mutex_lock(&event_mutex); -+ lockdep_assert_held(&event_mutex); -+ - do_for_each_event_file(tr, file) { - if (!(file->flags & EVENT_FILE_FL_ENABLED)) - continue; -@@ -362,7 +363,6 @@ void trace_event_enable_tgid_record(bool enable) - &file->flags); - } - } while_for_each_event_file(); -- mutex_unlock(&event_mutex); - } - - static int __ftrace_event_enable_disable(struct trace_event_file *file, -diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c -index 305039b122fa..35b2ba07f3c6 100644 ---- a/kernel/trace/tracing_map.c -+++ b/kernel/trace/tracing_map.c -@@ -90,8 +90,8 @@ static int tracing_map_cmp_atomic64(void *val_a, void *val_b) - #define DEFINE_TRACING_MAP_CMP_FN(type) \ - static int tracing_map_cmp_##type(void *val_a, void *val_b) \ - { \ -- type a = *(type *)val_a; \ -- type b = *(type *)val_b; \ -+ type a = (type)(*(u64 *)val_a); \ -+ type b = (type)(*(u64 *)val_b); \ - \ - return (a > b) ? 1 : ((a < b) ? -1 : 0); \ - } -diff --git a/mm/mmap.c b/mm/mmap.c -index 59fd53b41c9c..8c6ed06983f9 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -89,12 +89,6 @@ static void unmap_region(struct mm_struct *mm, - * MAP_PRIVATE r: (no) no r: (yes) yes r: (no) yes r: (no) yes - * w: (no) no w: (no) no w: (copy) copy w: (no) no - * x: (no) no x: (no) yes x: (no) yes x: (yes) yes -- * -- * On arm64, PROT_EXEC has the following behaviour for both MAP_SHARED and -- * MAP_PRIVATE: -- * r: (no) no -- * w: (no) no -- * x: (yes) yes - */ - pgprot_t protection_map[16] __ro_after_init = { - __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111, -diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c -index 3197de2a3896..c6df483b3751 100644 ---- a/mm/zsmalloc.c -+++ b/mm/zsmalloc.c -@@ -2088,6 +2088,11 @@ int zs_page_migrate(struct address_space *mapping, struct page *newpage, - zs_pool_dec_isolated(pool); - } - -+ if (page_zone(newpage) != page_zone(page)) { -+ dec_zone_page_state(page, NR_ZSPAGES); -+ inc_zone_page_state(newpage, NR_ZSPAGES); -+ } -+ - reset_page(page); - put_page(page); - page = newpage; -diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c -index bd41b78d131d..1d085eed72d0 100644 ---- a/net/bluetooth/hci_conn.c -+++ b/net/bluetooth/hci_conn.c -@@ -1054,8 +1054,10 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, - if (!conn) - return ERR_PTR(-ENOMEM); - -- if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) -+ if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) { -+ hci_conn_del(conn); - return ERR_PTR(-EBUSY); -+ } - - conn->state = BT_CONNECT; - set_bit(HCI_CONN_SCANNING, &conn->flags); -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index f63d9918b15a..ebdf1b0e576a 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -4918,10 +4918,8 @@ void __l2cap_physical_cfm(struct l2cap_chan *chan, int result) - BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d", - chan, result, local_amp_id, remote_amp_id); - -- if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) { -- l2cap_chan_unlock(chan); -+ if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) - return; -- } - - if (chan->state != BT_CONNECTED) { - l2cap_do_create(chan, result, local_amp_id, remote_amp_id); -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 2664ad58e5c0..16ac50b1b9a7 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -1094,7 +1094,7 @@ static void neigh_update_hhs(struct neighbour *neigh) - - if (update) { - hh = &neigh->hh; -- if (hh->hh_len) { -+ if (READ_ONCE(hh->hh_len)) { - write_seqlock_bh(&hh->hh_lock); - update(hh, neigh->dev, neigh->ha); - write_sequnlock_bh(&hh->hh_lock); -@@ -1355,7 +1355,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb) - struct net_device *dev = neigh->dev; - unsigned int seq; - -- if (dev->header_ops->cache && !neigh->hh.hh_len) -+ if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len)) - neigh_hh_init(neigh); - - do { -diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c -index eaeba9b99a73..7e0e5f2706ba 100644 ---- a/net/ethernet/eth.c -+++ b/net/ethernet/eth.c -@@ -239,7 +239,12 @@ int eth_header_cache(const struct neighbour *neigh, struct hh_cache *hh, __be16 - eth->h_proto = type; - memcpy(eth->h_source, dev->dev_addr, ETH_ALEN); - memcpy(eth->h_dest, neigh->ha, ETH_ALEN); -- hh->hh_len = ETH_HLEN; -+ -+ /* Pairs with READ_ONCE() in neigh_resolve_output(), -+ * neigh_hh_output() and neigh_update_hhs(). -+ */ -+ smp_store_release(&hh->hh_len, ETH_HLEN); -+ - return 0; - } - EXPORT_SYMBOL(eth_header_cache); -diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c -index 7f749505e699..7d73e8ce6660 100644 ---- a/net/rxrpc/peer_event.c -+++ b/net/rxrpc/peer_event.c -@@ -150,6 +150,9 @@ void rxrpc_error_report(struct sock *sk) - struct rxrpc_peer *peer; - struct sk_buff *skb; - -+ if (unlikely(!local)) -+ return; -+ - _enter("%p{%d}", sk, local->debug_id); - - skb = sock_dequeue_err_skb(sk); -diff --git a/net/socket.c b/net/socket.c -index aab65277314d..5b134a6b6216 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -891,7 +891,7 @@ static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to) - .msg_iocb = iocb}; - ssize_t res; - -- if (file->f_flags & O_NONBLOCK) -+ if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT)) - msg.msg_flags = MSG_DONTWAIT; - - if (iocb->ki_pos != 0) -@@ -916,7 +916,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from) - if (iocb->ki_pos != 0) - return -ESPIPE; - -- if (file->f_flags & O_NONBLOCK) -+ if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT)) - msg.msg_flags = MSG_DONTWAIT; - - if (sock->type == SOCK_SEQPACKET) -diff --git a/sound/firewire/motu/motu-proc.c b/sound/firewire/motu/motu-proc.c -index 4edc064999ed..706f1e982e36 100644 ---- a/sound/firewire/motu/motu-proc.c -+++ b/sound/firewire/motu/motu-proc.c -@@ -17,7 +17,7 @@ static const char *const clock_names[] = { - [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT] = "S/PDIF on optical interface", - [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_A] = "S/PDIF on optical interface A", - [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_B] = "S/PDIF on optical interface B", -- [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PCIF on coaxial interface", -+ [SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PDIF on coaxial interface", - [SND_MOTU_CLOCK_SOURCE_AESEBU_ON_XLR] = "AESEBU on XLR interface", - [SND_MOTU_CLOCK_SOURCE_WORD_ON_BNC] = "Word clock on BNC interface", - }; -diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c -index 70559e59d18f..7d4e18cb6351 100644 ---- a/sound/isa/cs423x/cs4236.c -+++ b/sound/isa/cs423x/cs4236.c -@@ -293,7 +293,8 @@ static int snd_cs423x_pnp_init_mpu(int dev, struct pnp_dev *pdev) - } else { - mpu_port[dev] = pnp_port_start(pdev, 0); - if (mpu_irq[dev] >= 0 && -- pnp_irq_valid(pdev, 0) && pnp_irq(pdev, 0) >= 0) { -+ pnp_irq_valid(pdev, 0) && -+ pnp_irq(pdev, 0) != (resource_size_t)-1) { - mpu_irq[dev] = pnp_irq(pdev, 0); - } else { - mpu_irq[dev] = -1; /* disable interrupt */ -diff --git a/sound/pci/ice1712/ice1724.c b/sound/pci/ice1712/ice1724.c -index 057c2f394ea7..41ea8e7b389a 100644 ---- a/sound/pci/ice1712/ice1724.c -+++ b/sound/pci/ice1712/ice1724.c -@@ -661,6 +661,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, - unsigned long flags; - unsigned char mclk_change; - unsigned int i, old_rate; -+ bool call_set_rate = false; - - if (rate > ice->hw_rates->list[ice->hw_rates->count - 1]) - return -EINVAL; -@@ -684,7 +685,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, - * setting clock rate for internal clock mode */ - old_rate = ice->get_rate(ice); - if (force || (old_rate != rate)) -- ice->set_rate(ice, rate); -+ call_set_rate = true; - else if (rate == ice->cur_rate) { - spin_unlock_irqrestore(&ice->reg_lock, flags); - return 0; -@@ -692,12 +693,14 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate, - } - - ice->cur_rate = rate; -+ spin_unlock_irqrestore(&ice->reg_lock, flags); -+ -+ if (call_set_rate) -+ ice->set_rate(ice, rate); - - /* setting master clock */ - mclk_change = ice->set_mclk(ice, rate); - -- spin_unlock_irqrestore(&ice->reg_lock, flags); -- - if (mclk_change && ice->gpio.i2s_mclk_changed) - ice->gpio.i2s_mclk_changed(ice); - if (ice->gpio.set_pro_rate) -diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh -index 891130daac7c..8a5066d98e72 100755 ---- a/tools/testing/selftests/net/rtnetlink.sh -+++ b/tools/testing/selftests/net/rtnetlink.sh -@@ -195,6 +195,26 @@ kci_test_route_get() - echo "PASS: route get" - } - -+kci_test_addrlft() -+{ -+ for i in $(seq 10 100) ;do -+ lft=$(((RANDOM%3) + 1)) -+ ip addr add 10.23.11.$i/32 dev "$devdummy" preferred_lft $lft valid_lft $((lft+1)) -+ check_err $? -+ done -+ -+ sleep 5 -+ -+ ip addr show dev "$devdummy" | grep "10.23.11." -+ if [ $? -eq 0 ]; then -+ echo "FAIL: preferred_lft addresses remaining" -+ check_err 1 -+ return -+ fi -+ -+ echo "PASS: preferred_lft addresses have expired" -+} -+ - kci_test_addrlabel() - { - ret=0 -@@ -245,6 +265,7 @@ kci_test_rtnl() - - kci_test_polrouting - kci_test_route_get -+ kci_test_addrlft - kci_test_tc - kci_test_gre - kci_test_bridge diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.163-164.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.163-164.patch deleted file mode 100644 index 8b56337b72..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.163-164.patch +++ /dev/null @@ -1,2533 +0,0 @@ -diff --git a/Makefile b/Makefile -index 35a71a78d1d2..f2aa55cea457 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 163 -+SUBLEVEL = 164 - EXTRAVERSION = - NAME = Petit Gorille - -diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts -index afb8eb0a0a16..051823b7e5a1 100644 ---- a/arch/arm/boot/dts/am437x-gp-evm.dts -+++ b/arch/arm/boot/dts/am437x-gp-evm.dts -@@ -83,7 +83,7 @@ - }; - - lcd0: display { -- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; -+ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; - label = "lcd"; - - panel-timing { -diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts -index 081fa68b6f98..c4279b0b9f12 100644 ---- a/arch/arm/boot/dts/am43x-epos-evm.dts -+++ b/arch/arm/boot/dts/am43x-epos-evm.dts -@@ -45,7 +45,7 @@ - }; - - lcd0: display { -- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; -+ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; - label = "lcd"; - - panel-timing { -diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi -index 8b2c65cd61a2..b822952c29f8 100644 ---- a/arch/arm/boot/dts/bcm-cygnus.dtsi -+++ b/arch/arm/boot/dts/bcm-cygnus.dtsi -@@ -165,8 +165,8 @@ - mdio: mdio@18002000 { - compatible = "brcm,iproc-mdio"; - reg = <0x18002000 0x8>; -- #size-cells = <1>; -- #address-cells = <0>; -+ #size-cells = <0>; -+ #address-cells = <1>; - status = "disabled"; - - gphy0: ethernet-phy@0 { -diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi -index 4745e3c7806b..fdb018e1278f 100644 ---- a/arch/arm/boot/dts/bcm283x.dtsi -+++ b/arch/arm/boot/dts/bcm283x.dtsi -@@ -38,7 +38,7 @@ - - trips { - cpu-crit { -- temperature = <80000>; -+ temperature = <90000>; - hysteresis = <0>; - type = "critical"; - }; -diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c -index fe488523694c..635b0d549487 100644 ---- a/arch/arm/mach-vexpress/spc.c -+++ b/arch/arm/mach-vexpress/spc.c -@@ -555,8 +555,9 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev) - - static int __init ve_spc_clk_init(void) - { -- int cpu; -+ int cpu, cluster; - struct clk *clk; -+ bool init_opp_table[MAX_CLUSTERS] = { false }; - - if (!info) - return 0; /* Continue only if SPC is initialised */ -@@ -582,8 +583,17 @@ static int __init ve_spc_clk_init(void) - continue; - } - -+ cluster = topology_physical_package_id(cpu_dev->id); -+ if (init_opp_table[cluster]) -+ continue; -+ - if (ve_init_opp_table(cpu_dev)) - pr_warn("failed to initialise cpu%d opp table\n", cpu); -+ else if (dev_pm_opp_set_sharing_cpus(cpu_dev, -+ topology_core_cpumask(cpu_dev->id))) -+ pr_warn("failed to mark OPPs shared for cpu%d\n", cpu); -+ else -+ init_opp_table[cluster] = true; - } - - platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0); -diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c -index 42faa95ce664..57a7a9d68475 100644 ---- a/arch/mips/net/ebpf_jit.c -+++ b/arch/mips/net/ebpf_jit.c -@@ -612,6 +612,7 @@ static void emit_const_to_reg(struct jit_ctx *ctx, int dst, u64 value) - static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx) - { - int off, b_off; -+ int tcc_reg; - - ctx->flags |= EBPF_SEEN_TC; - /* -@@ -624,14 +625,14 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx) - b_off = b_imm(this_idx + 1, ctx); - emit_instr(ctx, bne, MIPS_R_AT, MIPS_R_ZERO, b_off); - /* -- * if (--TCC < 0) -+ * if (TCC-- < 0) - * goto out; - */ - /* Delay slot */ -- emit_instr(ctx, daddiu, MIPS_R_T5, -- (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4, -1); -+ tcc_reg = (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4; -+ emit_instr(ctx, daddiu, MIPS_R_T5, tcc_reg, -1); - b_off = b_imm(this_idx + 1, ctx); -- emit_instr(ctx, bltz, MIPS_R_T5, b_off); -+ emit_instr(ctx, bltz, tcc_reg, b_off); - /* - * prog = array->ptrs[index]; - * if (prog == NULL) -diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h -index f627c37dad9c..ab5c215cf46c 100644 ---- a/arch/parisc/include/asm/cmpxchg.h -+++ b/arch/parisc/include/asm/cmpxchg.h -@@ -44,8 +44,14 @@ __xchg(unsigned long x, __volatile__ void *ptr, int size) - ** if (((unsigned long)p & 0xf) == 0) - ** return __ldcw(p); - */ --#define xchg(ptr, x) \ -- ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) -+#define xchg(ptr, x) \ -+({ \ -+ __typeof__(*(ptr)) __ret; \ -+ __typeof__(*(ptr)) _x_ = (x); \ -+ __ret = (__typeof__(*(ptr))) \ -+ __xchg((unsigned long)_x_, (ptr), sizeof(*(ptr))); \ -+ __ret; \ -+}) - - /* bug catcher for when unsupported size is used - won't link */ - extern void __cmpxchg_called_with_bad_pointer(void); -diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c -index 30bf13b72e5e..3c5abfbbe60e 100644 ---- a/arch/powerpc/mm/mem.c -+++ b/arch/powerpc/mm/mem.c -@@ -353,6 +353,14 @@ void __init mem_init(void) - BUILD_BUG_ON(MMU_PAGE_COUNT > 16); - - #ifdef CONFIG_SWIOTLB -+ /* -+ * Some platforms (e.g. 85xx) limit DMA-able memory way below -+ * 4G. We force memblock to bottom-up mode to ensure that the -+ * memory allocated in swiotlb_init() is DMA-able. -+ * As it's the last memblock allocation, no need to reset it -+ * back to to-down. -+ */ -+ memblock_set_bottom_up(true); - swiotlb_init(0); - #endif - -diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c -index 6ed99de2ddf5..c1f7b3cb84a9 100644 ---- a/arch/x86/events/core.c -+++ b/arch/x86/events/core.c -@@ -375,7 +375,7 @@ int x86_add_exclusive(unsigned int what) - * LBR and BTS are still mutually exclusive. - */ - if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt) -- return 0; -+ goto out; - - if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) { - mutex_lock(&pmc_reserve_mutex); -@@ -387,6 +387,7 @@ int x86_add_exclusive(unsigned int what) - mutex_unlock(&pmc_reserve_mutex); - } - -+out: - atomic_inc(&active_events); - return 0; - -@@ -397,11 +398,15 @@ fail_unlock: - - void x86_del_exclusive(unsigned int what) - { -+ atomic_dec(&active_events); -+ -+ /* -+ * See the comment in x86_add_exclusive(). -+ */ - if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt) - return; - - atomic_dec(&x86_pmu.lbr_exclusive[what]); -- atomic_dec(&active_events); - } - - int x86_setup_perfctr(struct perf_event *event) -diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c -index 5b513ccffde4..cadd7fd290fa 100644 ---- a/arch/x86/platform/efi/quirks.c -+++ b/arch/x86/platform/efi/quirks.c -@@ -257,10 +257,6 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size) - return; - } - -- /* No need to reserve regions that will never be freed. */ -- if (md.attribute & EFI_MEMORY_RUNTIME) -- return; -- - size += addr % EFI_PAGE_SIZE; - size = round_up(size, EFI_PAGE_SIZE); - addr = round_down(addr, EFI_PAGE_SIZE); -@@ -290,6 +286,8 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size) - early_memunmap(new, new_size); - - efi_memmap_install(new_phys, num_entries); -+ e820__range_update(addr, size, E820_TYPE_RAM, E820_TYPE_RESERVED); -+ e820__update_table(e820_table); - } - - /* -diff --git a/block/blk-map.c b/block/blk-map.c -index e31be14da8ea..f72a3af689b6 100644 ---- a/block/blk-map.c -+++ b/block/blk-map.c -@@ -152,7 +152,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq, - return 0; - - unmap_rq: -- __blk_rq_unmap_user(bio); -+ blk_rq_unmap_user(bio); - fail: - rq->bio = NULL; - return ret; -diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c -index 24c461dea7af..fd8053f9556e 100644 ---- a/drivers/firmware/efi/libstub/gop.c -+++ b/drivers/firmware/efi/libstub/gop.c -@@ -85,30 +85,6 @@ setup_pixel_info(struct screen_info *si, u32 pixels_per_scan_line, - } - } - --static efi_status_t --__gop_query32(efi_system_table_t *sys_table_arg, -- struct efi_graphics_output_protocol_32 *gop32, -- struct efi_graphics_output_mode_info **info, -- unsigned long *size, u64 *fb_base) --{ -- struct efi_graphics_output_protocol_mode_32 *mode; -- efi_graphics_output_protocol_query_mode query_mode; -- efi_status_t status; -- unsigned long m; -- -- m = gop32->mode; -- mode = (struct efi_graphics_output_protocol_mode_32 *)m; -- query_mode = (void *)(unsigned long)gop32->query_mode; -- -- status = __efi_call_early(query_mode, (void *)gop32, mode->mode, size, -- info); -- if (status != EFI_SUCCESS) -- return status; -- -- *fb_base = mode->frame_buffer_base; -- return status; --} -- - static efi_status_t - setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, - efi_guid_t *proto, unsigned long size, void **gop_handle) -@@ -121,7 +97,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, - u64 fb_base; - struct efi_pixel_bitmask pixel_info; - int pixel_format; -- efi_status_t status = EFI_NOT_FOUND; -+ efi_status_t status; - u32 *handles = (u32 *)(unsigned long)gop_handle; - int i; - -@@ -130,6 +106,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, - - nr_gops = size / sizeof(u32); - for (i = 0; i < nr_gops; i++) { -+ struct efi_graphics_output_protocol_mode_32 *mode; - struct efi_graphics_output_mode_info *info = NULL; - efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID; - bool conout_found = false; -@@ -147,9 +124,11 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, - if (status == EFI_SUCCESS) - conout_found = true; - -- status = __gop_query32(sys_table_arg, gop32, &info, &size, -- ¤t_fb_base); -- if (status == EFI_SUCCESS && (!first_gop || conout_found) && -+ mode = (void *)(unsigned long)gop32->mode; -+ info = (void *)(unsigned long)mode->info; -+ current_fb_base = mode->frame_buffer_base; -+ -+ if ((!first_gop || conout_found) && - info->pixel_format != PIXEL_BLT_ONLY) { - /* - * Systems that use the UEFI Console Splitter may -@@ -177,7 +156,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, - - /* Did we find any GOPs? */ - if (!first_gop) -- goto out; -+ return EFI_NOT_FOUND; - - /* EFI framebuffer */ - si->orig_video_isVGA = VIDEO_TYPE_EFI; -@@ -199,32 +178,8 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si, - si->lfb_size = si->lfb_linelength * si->lfb_height; - - si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS; --out: -- return status; --} -- --static efi_status_t --__gop_query64(efi_system_table_t *sys_table_arg, -- struct efi_graphics_output_protocol_64 *gop64, -- struct efi_graphics_output_mode_info **info, -- unsigned long *size, u64 *fb_base) --{ -- struct efi_graphics_output_protocol_mode_64 *mode; -- efi_graphics_output_protocol_query_mode query_mode; -- efi_status_t status; -- unsigned long m; -- -- m = gop64->mode; -- mode = (struct efi_graphics_output_protocol_mode_64 *)m; -- query_mode = (void *)(unsigned long)gop64->query_mode; -- -- status = __efi_call_early(query_mode, (void *)gop64, mode->mode, size, -- info); -- if (status != EFI_SUCCESS) -- return status; - -- *fb_base = mode->frame_buffer_base; -- return status; -+ return EFI_SUCCESS; - } - - static efi_status_t -@@ -239,7 +194,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, - u64 fb_base; - struct efi_pixel_bitmask pixel_info; - int pixel_format; -- efi_status_t status = EFI_NOT_FOUND; -+ efi_status_t status; - u64 *handles = (u64 *)(unsigned long)gop_handle; - int i; - -@@ -248,6 +203,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, - - nr_gops = size / sizeof(u64); - for (i = 0; i < nr_gops; i++) { -+ struct efi_graphics_output_protocol_mode_64 *mode; - struct efi_graphics_output_mode_info *info = NULL; - efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID; - bool conout_found = false; -@@ -265,9 +221,11 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, - if (status == EFI_SUCCESS) - conout_found = true; - -- status = __gop_query64(sys_table_arg, gop64, &info, &size, -- ¤t_fb_base); -- if (status == EFI_SUCCESS && (!first_gop || conout_found) && -+ mode = (void *)(unsigned long)gop64->mode; -+ info = (void *)(unsigned long)mode->info; -+ current_fb_base = mode->frame_buffer_base; -+ -+ if ((!first_gop || conout_found) && - info->pixel_format != PIXEL_BLT_ONLY) { - /* - * Systems that use the UEFI Console Splitter may -@@ -295,7 +253,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, - - /* Did we find any GOPs? */ - if (!first_gop) -- goto out; -+ return EFI_NOT_FOUND; - - /* EFI framebuffer */ - si->orig_video_isVGA = VIDEO_TYPE_EFI; -@@ -317,8 +275,8 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si, - si->lfb_size = si->lfb_linelength * si->lfb_height; - - si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS; --out: -- return status; -+ -+ return EFI_SUCCESS; - } - - /* -diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c -index ce6dd49fbb98..916b88ee2de4 100644 ---- a/drivers/mmc/core/block.c -+++ b/drivers/mmc/core/block.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -87,6 +88,7 @@ static int max_devices; - #define MAX_DEVICES 256 - - static DEFINE_IDA(mmc_blk_ida); -+static DEFINE_IDA(mmc_rpmb_ida); - - /* - * There is one mmc_blk_data per slot. -@@ -97,6 +99,7 @@ struct mmc_blk_data { - struct gendisk *disk; - struct mmc_queue queue; - struct list_head part; -+ struct list_head rpmbs; - - unsigned int flags; - #define MMC_BLK_CMD23 (1 << 0) /* Can do SET_BLOCK_COUNT for multiblock */ -@@ -126,6 +129,32 @@ struct mmc_blk_data { - struct dentry *ext_csd_dentry; - }; - -+/* Device type for RPMB character devices */ -+static dev_t mmc_rpmb_devt; -+ -+/* Bus type for RPMB character devices */ -+static struct bus_type mmc_rpmb_bus_type = { -+ .name = "mmc_rpmb", -+}; -+ -+/** -+ * struct mmc_rpmb_data - special RPMB device type for these areas -+ * @dev: the device for the RPMB area -+ * @chrdev: character device for the RPMB area -+ * @id: unique device ID number -+ * @part_index: partition index (0 on first) -+ * @md: parent MMC block device -+ * @node: list item, so we can put this device on a list -+ */ -+struct mmc_rpmb_data { -+ struct device dev; -+ struct cdev chrdev; -+ int id; -+ unsigned int part_index; -+ struct mmc_blk_data *md; -+ struct list_head node; -+}; -+ - static DEFINE_MUTEX(open_lock); - - module_param(perdev_minors, int, 0444); -@@ -309,6 +338,7 @@ struct mmc_blk_ioc_data { - struct mmc_ioc_cmd ic; - unsigned char *buf; - u64 buf_bytes; -+ struct mmc_rpmb_data *rpmb; - }; - - static struct mmc_blk_ioc_data *mmc_blk_ioctl_copy_from_user( -@@ -447,14 +477,25 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - struct mmc_request mrq = {}; - struct scatterlist sg; - int err; -- bool is_rpmb = false; -+ unsigned int target_part; - u32 status = 0; - - if (!card || !md || !idata) - return -EINVAL; - -- if (md->area_type & MMC_BLK_DATA_AREA_RPMB) -- is_rpmb = true; -+ /* -+ * The RPMB accesses comes in from the character device, so we -+ * need to target these explicitly. Else we just target the -+ * partition type for the block device the ioctl() was issued -+ * on. -+ */ -+ if (idata->rpmb) { -+ /* Support multiple RPMB partitions */ -+ target_part = idata->rpmb->part_index; -+ target_part |= EXT_CSD_PART_CONFIG_ACC_RPMB; -+ } else { -+ target_part = md->part_type; -+ } - - cmd.opcode = idata->ic.opcode; - cmd.arg = idata->ic.arg; -@@ -498,7 +539,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - - mrq.cmd = &cmd; - -- err = mmc_blk_part_switch(card, md->part_type); -+ err = mmc_blk_part_switch(card, target_part); - if (err) - return err; - -@@ -508,7 +549,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - return err; - } - -- if (is_rpmb) { -+ if (idata->rpmb) { - err = mmc_set_blockcount(card, data.blocks, - idata->ic.write_flag & (1 << 31)); - if (err) -@@ -566,7 +607,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - - memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp)); - -- if (is_rpmb) { -+ if (idata->rpmb) { - /* - * Ensure RPMB command has completed by polling CMD13 - * "Send Status". -@@ -582,7 +623,8 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - } - - static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md, -- struct mmc_ioc_cmd __user *ic_ptr) -+ struct mmc_ioc_cmd __user *ic_ptr, -+ struct mmc_rpmb_data *rpmb) - { - struct mmc_blk_ioc_data *idata; - struct mmc_blk_ioc_data *idatas[1]; -@@ -594,6 +636,8 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md, - idata = mmc_blk_ioctl_copy_from_user(ic_ptr); - if (IS_ERR(idata)) - return PTR_ERR(idata); -+ /* This will be NULL on non-RPMB ioctl():s */ -+ idata->rpmb = rpmb; - - card = md->queue.card; - if (IS_ERR(card)) { -@@ -613,7 +657,8 @@ static int mmc_blk_ioctl_cmd(struct mmc_blk_data *md, - goto cmd_done; - } - idatas[0] = idata; -- req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_IOCTL; -+ req_to_mmc_queue_req(req)->drv_op = -+ rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL; - req_to_mmc_queue_req(req)->drv_op_data = idatas; - req_to_mmc_queue_req(req)->ioc_count = 1; - blk_execute_rq(mq->queue, NULL, req, 0); -@@ -628,7 +673,8 @@ cmd_done: - } - - static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md, -- struct mmc_ioc_multi_cmd __user *user) -+ struct mmc_ioc_multi_cmd __user *user, -+ struct mmc_rpmb_data *rpmb) - { - struct mmc_blk_ioc_data **idata = NULL; - struct mmc_ioc_cmd __user *cmds = user->cmds; -@@ -659,6 +705,8 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md, - num_of_cmds = i; - goto cmd_err; - } -+ /* This will be NULL on non-RPMB ioctl():s */ -+ idata[i]->rpmb = rpmb; - } - - card = md->queue.card; -@@ -679,7 +727,8 @@ static int mmc_blk_ioctl_multi_cmd(struct mmc_blk_data *md, - err = PTR_ERR(req); - goto cmd_err; - } -- req_to_mmc_queue_req(req)->drv_op = MMC_DRV_OP_IOCTL; -+ req_to_mmc_queue_req(req)->drv_op = -+ rpmb ? MMC_DRV_OP_IOCTL_RPMB : MMC_DRV_OP_IOCTL; - req_to_mmc_queue_req(req)->drv_op_data = idata; - req_to_mmc_queue_req(req)->ioc_count = num_of_cmds; - blk_execute_rq(mq->queue, NULL, req, 0); -@@ -727,7 +776,8 @@ static int mmc_blk_ioctl(struct block_device *bdev, fmode_t mode, - if (!md) - return -EINVAL; - ret = mmc_blk_ioctl_cmd(md, -- (struct mmc_ioc_cmd __user *)arg); -+ (struct mmc_ioc_cmd __user *)arg, -+ NULL); - mmc_blk_put(md); - return ret; - case MMC_IOC_MULTI_CMD: -@@ -738,7 +788,8 @@ static int mmc_blk_ioctl(struct block_device *bdev, fmode_t mode, - if (!md) - return -EINVAL; - ret = mmc_blk_ioctl_multi_cmd(md, -- (struct mmc_ioc_multi_cmd __user *)arg); -+ (struct mmc_ioc_multi_cmd __user *)arg, -+ NULL); - mmc_blk_put(md); - return ret; - default: -@@ -1188,18 +1239,6 @@ static inline void mmc_blk_reset_success(struct mmc_blk_data *md, int type) - md->reset_done &= ~type; - } - --int mmc_access_rpmb(struct mmc_queue *mq) --{ -- struct mmc_blk_data *md = mq->blkdata; -- /* -- * If this is a RPMB partition access, return ture -- */ -- if (md && md->part_type == EXT_CSD_PART_CONFIG_ACC_RPMB) -- return true; -- -- return false; --} -- - /* - * The non-block commands come back from the block layer after it queued it and - * processed it with all other requests and then they get issued in this -@@ -1210,17 +1249,19 @@ static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req) - struct mmc_queue_req *mq_rq; - struct mmc_card *card = mq->card; - struct mmc_blk_data *md = mq->blkdata; -- struct mmc_blk_data *main_md = dev_get_drvdata(&card->dev); - struct mmc_blk_ioc_data **idata; -+ bool rpmb_ioctl; - u8 **ext_csd; - u32 status; - int ret; - int i; - - mq_rq = req_to_mmc_queue_req(req); -+ rpmb_ioctl = (mq_rq->drv_op == MMC_DRV_OP_IOCTL_RPMB); - - switch (mq_rq->drv_op) { - case MMC_DRV_OP_IOCTL: -+ case MMC_DRV_OP_IOCTL_RPMB: - idata = mq_rq->drv_op_data; - for (i = 0, ret = 0; i < mq_rq->ioc_count; i++) { - ret = __mmc_blk_ioctl_cmd(card, md, idata[i]); -@@ -1228,8 +1269,8 @@ static void mmc_blk_issue_drv_op(struct mmc_queue *mq, struct request *req) - break; - } - /* Always switch back to main area after RPMB access */ -- if (md->area_type & MMC_BLK_DATA_AREA_RPMB) -- mmc_blk_part_switch(card, main_md->part_type); -+ if (rpmb_ioctl) -+ mmc_blk_part_switch(card, 0); - break; - case MMC_DRV_OP_BOOT_WP: - ret = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, EXT_CSD_BOOT_WP, -@@ -2114,6 +2155,7 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card, - - spin_lock_init(&md->lock); - INIT_LIST_HEAD(&md->part); -+ INIT_LIST_HEAD(&md->rpmbs); - md->usage = 1; - - ret = mmc_init_queue(&md->queue, card, &md->lock, subname); -@@ -2232,6 +2274,158 @@ static int mmc_blk_alloc_part(struct mmc_card *card, - return 0; - } - -+/** -+ * mmc_rpmb_ioctl() - ioctl handler for the RPMB chardev -+ * @filp: the character device file -+ * @cmd: the ioctl() command -+ * @arg: the argument from userspace -+ * -+ * This will essentially just redirect the ioctl()s coming in over to -+ * the main block device spawning the RPMB character device. -+ */ -+static long mmc_rpmb_ioctl(struct file *filp, unsigned int cmd, -+ unsigned long arg) -+{ -+ struct mmc_rpmb_data *rpmb = filp->private_data; -+ int ret; -+ -+ switch (cmd) { -+ case MMC_IOC_CMD: -+ ret = mmc_blk_ioctl_cmd(rpmb->md, -+ (struct mmc_ioc_cmd __user *)arg, -+ rpmb); -+ break; -+ case MMC_IOC_MULTI_CMD: -+ ret = mmc_blk_ioctl_multi_cmd(rpmb->md, -+ (struct mmc_ioc_multi_cmd __user *)arg, -+ rpmb); -+ break; -+ default: -+ ret = -EINVAL; -+ break; -+ } -+ -+ return ret; -+} -+ -+#ifdef CONFIG_COMPAT -+static long mmc_rpmb_ioctl_compat(struct file *filp, unsigned int cmd, -+ unsigned long arg) -+{ -+ return mmc_rpmb_ioctl(filp, cmd, (unsigned long)compat_ptr(arg)); -+} -+#endif -+ -+static int mmc_rpmb_chrdev_open(struct inode *inode, struct file *filp) -+{ -+ struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev, -+ struct mmc_rpmb_data, chrdev); -+ -+ get_device(&rpmb->dev); -+ filp->private_data = rpmb; -+ mmc_blk_get(rpmb->md->disk); -+ -+ return nonseekable_open(inode, filp); -+} -+ -+static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp) -+{ -+ struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev, -+ struct mmc_rpmb_data, chrdev); -+ -+ put_device(&rpmb->dev); -+ mmc_blk_put(rpmb->md); -+ -+ return 0; -+} -+ -+static const struct file_operations mmc_rpmb_fileops = { -+ .release = mmc_rpmb_chrdev_release, -+ .open = mmc_rpmb_chrdev_open, -+ .owner = THIS_MODULE, -+ .llseek = no_llseek, -+ .unlocked_ioctl = mmc_rpmb_ioctl, -+#ifdef CONFIG_COMPAT -+ .compat_ioctl = mmc_rpmb_ioctl_compat, -+#endif -+}; -+ -+static void mmc_blk_rpmb_device_release(struct device *dev) -+{ -+ struct mmc_rpmb_data *rpmb = dev_get_drvdata(dev); -+ -+ ida_simple_remove(&mmc_rpmb_ida, rpmb->id); -+ kfree(rpmb); -+} -+ -+static int mmc_blk_alloc_rpmb_part(struct mmc_card *card, -+ struct mmc_blk_data *md, -+ unsigned int part_index, -+ sector_t size, -+ const char *subname) -+{ -+ int devidx, ret; -+ char rpmb_name[DISK_NAME_LEN]; -+ char cap_str[10]; -+ struct mmc_rpmb_data *rpmb; -+ -+ /* This creates the minor number for the RPMB char device */ -+ devidx = ida_simple_get(&mmc_rpmb_ida, 0, max_devices, GFP_KERNEL); -+ if (devidx < 0) -+ return devidx; -+ -+ rpmb = kzalloc(sizeof(*rpmb), GFP_KERNEL); -+ if (!rpmb) { -+ ida_simple_remove(&mmc_rpmb_ida, devidx); -+ return -ENOMEM; -+ } -+ -+ snprintf(rpmb_name, sizeof(rpmb_name), -+ "mmcblk%u%s", card->host->index, subname ? subname : ""); -+ -+ rpmb->id = devidx; -+ rpmb->part_index = part_index; -+ rpmb->dev.init_name = rpmb_name; -+ rpmb->dev.bus = &mmc_rpmb_bus_type; -+ rpmb->dev.devt = MKDEV(MAJOR(mmc_rpmb_devt), rpmb->id); -+ rpmb->dev.parent = &card->dev; -+ rpmb->dev.release = mmc_blk_rpmb_device_release; -+ device_initialize(&rpmb->dev); -+ dev_set_drvdata(&rpmb->dev, rpmb); -+ rpmb->md = md; -+ -+ cdev_init(&rpmb->chrdev, &mmc_rpmb_fileops); -+ rpmb->chrdev.owner = THIS_MODULE; -+ ret = cdev_device_add(&rpmb->chrdev, &rpmb->dev); -+ if (ret) { -+ pr_err("%s: could not add character device\n", rpmb_name); -+ goto out_put_device; -+ } -+ -+ list_add(&rpmb->node, &md->rpmbs); -+ -+ string_get_size((u64)size, 512, STRING_UNITS_2, -+ cap_str, sizeof(cap_str)); -+ -+ pr_info("%s: %s %s partition %u %s, chardev (%d:%d)\n", -+ rpmb_name, mmc_card_id(card), -+ mmc_card_name(card), EXT_CSD_PART_CONFIG_ACC_RPMB, cap_str, -+ MAJOR(mmc_rpmb_devt), rpmb->id); -+ -+ return 0; -+ -+out_put_device: -+ put_device(&rpmb->dev); -+ return ret; -+} -+ -+static void mmc_blk_remove_rpmb_part(struct mmc_rpmb_data *rpmb) -+ -+{ -+ cdev_device_del(&rpmb->chrdev, &rpmb->dev); -+ put_device(&rpmb->dev); -+} -+ - /* MMC Physical partitions consist of two boot partitions and - * up to four general purpose partitions. - * For each partition enabled in EXT_CSD a block device will be allocatedi -@@ -2240,13 +2434,26 @@ static int mmc_blk_alloc_part(struct mmc_card *card, - - static int mmc_blk_alloc_parts(struct mmc_card *card, struct mmc_blk_data *md) - { -- int idx, ret = 0; -+ int idx, ret; - - if (!mmc_card_mmc(card)) - return 0; - - for (idx = 0; idx < card->nr_parts; idx++) { -- if (card->part[idx].size) { -+ if (card->part[idx].area_type & MMC_BLK_DATA_AREA_RPMB) { -+ /* -+ * RPMB partitions does not provide block access, they -+ * are only accessed using ioctl():s. Thus create -+ * special RPMB block devices that do not have a -+ * backing block queue for these. -+ */ -+ ret = mmc_blk_alloc_rpmb_part(card, md, -+ card->part[idx].part_cfg, -+ card->part[idx].size >> 9, -+ card->part[idx].name); -+ if (ret) -+ return ret; -+ } else if (card->part[idx].size) { - ret = mmc_blk_alloc_part(card, md, - card->part[idx].part_cfg, - card->part[idx].size >> 9, -@@ -2258,7 +2465,7 @@ static int mmc_blk_alloc_parts(struct mmc_card *card, struct mmc_blk_data *md) - } - } - -- return ret; -+ return 0; - } - - static void mmc_blk_remove_req(struct mmc_blk_data *md) -@@ -2295,7 +2502,15 @@ static void mmc_blk_remove_parts(struct mmc_card *card, - { - struct list_head *pos, *q; - struct mmc_blk_data *part_md; -+ struct mmc_rpmb_data *rpmb; - -+ /* Remove RPMB partitions */ -+ list_for_each_safe(pos, q, &md->rpmbs) { -+ rpmb = list_entry(pos, struct mmc_rpmb_data, node); -+ list_del(pos); -+ mmc_blk_remove_rpmb_part(rpmb); -+ } -+ /* Remove block partitions */ - list_for_each_safe(pos, q, &md->part) { - part_md = list_entry(pos, struct mmc_blk_data, part); - list_del(pos); -@@ -2649,6 +2864,17 @@ static int __init mmc_blk_init(void) - { - int res; - -+ res = bus_register(&mmc_rpmb_bus_type); -+ if (res < 0) { -+ pr_err("mmcblk: could not register RPMB bus type\n"); -+ return res; -+ } -+ res = alloc_chrdev_region(&mmc_rpmb_devt, 0, MAX_DEVICES, "rpmb"); -+ if (res < 0) { -+ pr_err("mmcblk: failed to allocate rpmb chrdev region\n"); -+ goto out_bus_unreg; -+ } -+ - if (perdev_minors != CONFIG_MMC_BLOCK_MINORS) - pr_info("mmcblk: using %d minors per device\n", perdev_minors); - -@@ -2656,16 +2882,20 @@ static int __init mmc_blk_init(void) - - res = register_blkdev(MMC_BLOCK_MAJOR, "mmc"); - if (res) -- goto out; -+ goto out_chrdev_unreg; - - res = mmc_register_driver(&mmc_driver); - if (res) -- goto out2; -+ goto out_blkdev_unreg; - - return 0; -- out2: -+ -+out_blkdev_unreg: - unregister_blkdev(MMC_BLOCK_MAJOR, "mmc"); -- out: -+out_chrdev_unreg: -+ unregister_chrdev_region(mmc_rpmb_devt, MAX_DEVICES); -+out_bus_unreg: -+ bus_unregister(&mmc_rpmb_bus_type); - return res; - } - -@@ -2673,6 +2903,8 @@ static void __exit mmc_blk_exit(void) - { - mmc_unregister_driver(&mmc_driver); - unregister_blkdev(MMC_BLOCK_MAJOR, "mmc"); -+ unregister_chrdev_region(mmc_rpmb_devt, MAX_DEVICES); -+ bus_unregister(&mmc_rpmb_bus_type); - } - - module_init(mmc_blk_init); -diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c -index 0a4e77a5ba33..f74f9ef460cc 100644 ---- a/drivers/mmc/core/queue.c -+++ b/drivers/mmc/core/queue.c -@@ -30,7 +30,7 @@ static int mmc_prep_request(struct request_queue *q, struct request *req) - { - struct mmc_queue *mq = q->queuedata; - -- if (mq && (mmc_card_removed(mq->card) || mmc_access_rpmb(mq))) -+ if (mq && mmc_card_removed(mq->card)) - return BLKPREP_KILL; - - req->rq_flags |= RQF_DONTPREP; -diff --git a/drivers/mmc/core/queue.h b/drivers/mmc/core/queue.h -index 6bfba32ffa66..547b457c4251 100644 ---- a/drivers/mmc/core/queue.h -+++ b/drivers/mmc/core/queue.h -@@ -36,12 +36,14 @@ struct mmc_blk_request { - /** - * enum mmc_drv_op - enumerates the operations in the mmc_queue_req - * @MMC_DRV_OP_IOCTL: ioctl operation -+ * @MMC_DRV_OP_IOCTL_RPMB: RPMB-oriented ioctl operation - * @MMC_DRV_OP_BOOT_WP: write protect boot partitions - * @MMC_DRV_OP_GET_CARD_STATUS: get card status - * @MMC_DRV_OP_GET_EXT_CSD: get the EXT CSD from an eMMC card - */ - enum mmc_drv_op { - MMC_DRV_OP_IOCTL, -+ MMC_DRV_OP_IOCTL_RPMB, - MMC_DRV_OP_BOOT_WP, - MMC_DRV_OP_GET_CARD_STATUS, - MMC_DRV_OP_GET_EXT_CSD, -@@ -82,6 +84,4 @@ extern void mmc_queue_resume(struct mmc_queue *); - extern unsigned int mmc_queue_map_sg(struct mmc_queue *, - struct mmc_queue_req *); - --extern int mmc_access_rpmb(struct mmc_queue *); -- - #endif -diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c -index d76d7c7ea819..544b6a9cc01a 100644 ---- a/drivers/net/dsa/mv88e6xxx/global1.c -+++ b/drivers/net/dsa/mv88e6xxx/global1.c -@@ -313,6 +313,11 @@ int mv88e6390_g1_set_cpu_port(struct mv88e6xxx_chip *chip, int port) - { - u16 ptr = MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST; - -+ /* Use the default high priority for management frames sent to -+ * the CPU. -+ */ -+ port |= MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST_MGMTPRI; -+ - return mv88e6390_g1_monitor_write(chip, ptr, port); - } - -diff --git a/drivers/net/dsa/mv88e6xxx/global1.h b/drivers/net/dsa/mv88e6xxx/global1.h -index 950b914f9251..d82e8956cbd5 100644 ---- a/drivers/net/dsa/mv88e6xxx/global1.h -+++ b/drivers/net/dsa/mv88e6xxx/global1.h -@@ -189,6 +189,7 @@ - #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_INGRESS_DEST 0x2000 - #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_EGRESS_DEST 0x2100 - #define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST 0x3000 -+#define MV88E6390_G1_MONITOR_MGMT_CTL_PTR_CPU_DEST_MGMTPRI 0x00e0 - #define MV88E6390_G1_MONITOR_MGMT_CTL_DATA_MASK 0x00ff - - /* Offset 0x1C: Global Control 2 */ -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h -index 4e091a11daaf..52bce009d096 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h -@@ -1112,7 +1112,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp) - for (i = 0; i < E1H_FUNC_MAX / 2; i++) { - u32 func_config = - MF_CFG_RD(bp, -- func_mf_config[BP_PORT(bp) + 2 * i]. -+ func_mf_config[BP_PATH(bp) + 2 * i]. - config); - func_num += - ((func_config & FUNC_MF_CFG_FUNC_HIDE) ? 0 : 1); -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -index dbe8feec456c..b0ada7eac652 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -@@ -9995,10 +9995,18 @@ static void bnx2x_recovery_failed(struct bnx2x *bp) - */ - static void bnx2x_parity_recover(struct bnx2x *bp) - { -- bool global = false; - u32 error_recovered, error_unrecovered; -- bool is_parity; -+ bool is_parity, global = false; -+#ifdef CONFIG_BNX2X_SRIOV -+ int vf_idx; -+ -+ for (vf_idx = 0; vf_idx < bp->requested_nr_virtfn; vf_idx++) { -+ struct bnx2x_virtf *vf = BP_VF(bp, vf_idx); - -+ if (vf) -+ vf->state = VF_LOST; -+ } -+#endif - DP(NETIF_MSG_HW, "Handling parity\n"); - while (1) { - switch (bp->recovery_state) { -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h -index 53466f6cebab..a887bfa24c88 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h -@@ -139,6 +139,7 @@ struct bnx2x_virtf { - #define VF_ACQUIRED 1 /* VF acquired, but not initialized */ - #define VF_ENABLED 2 /* VF Enabled */ - #define VF_RESET 3 /* VF FLR'd, pending cleanup */ -+#define VF_LOST 4 /* Recovery while VFs are loaded */ - - bool flr_clnup_stage; /* true during flr cleanup */ - bool malicious; /* true if FW indicated so, until FLR */ -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c -index 76a4668c50fe..6d5b81a971e3 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c -@@ -2112,6 +2112,18 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf, - { - int i; - -+ if (vf->state == VF_LOST) { -+ /* Just ack the FW and return if VFs are lost -+ * in case of parity error. VFs are supposed to be timedout -+ * on waiting for PF response. -+ */ -+ DP(BNX2X_MSG_IOV, -+ "VF 0x%x lost, not handling the request\n", vf->abs_vfid); -+ -+ storm_memset_vf_mbx_ack(bp, vf->abs_vfid); -+ return; -+ } -+ - /* check if tlv type is known */ - if (bnx2x_tlv_supported(mbx->first_tlv.tl.type)) { - /* Lock the per vf op mutex and note the locker's identity. -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -index a62128a444a6..149fd0d5e069 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c -@@ -724,6 +724,9 @@ static int sun8i_dwmac_set_syscon(struct stmmac_priv *priv) - /* default */ - break; - case PHY_INTERFACE_MODE_RGMII: -+ case PHY_INTERFACE_MODE_RGMII_ID: -+ case PHY_INTERFACE_MODE_RGMII_RXID: -+ case PHY_INTERFACE_MODE_RGMII_TXID: - reg |= SYSCON_EPIT | SYSCON_ETCS_INT_GMII; - break; - case PHY_INTERFACE_MODE_RMII: -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c -index 62ccbd47c1db..fc1fa0f9f338 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c -@@ -53,7 +53,7 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) - * rate, which then uses the auto-reparenting feature of the - * clock driver, and enabling/disabling the clock. - */ -- if (gmac->interface == PHY_INTERFACE_MODE_RGMII) { -+ if (phy_interface_mode_is_rgmii(gmac->interface)) { - clk_set_rate(gmac->tx_clk, SUN7I_GMAC_GMII_RGMII_RATE); - clk_prepare_enable(gmac->tx_clk); - gmac->clk_enabled = 1; -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index e6d16c48ffef..e89466bd432d 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -51,7 +51,7 @@ - #include - #include "dwmac1000.h" - --#define STMMAC_ALIGN(x) __ALIGN_KERNEL(x, SMP_CACHE_BYTES) -+#define STMMAC_ALIGN(x) ALIGN(ALIGN(x, SMP_CACHE_BYTES), 16) - #define TSO_MAX_BUFF_SIZE (SZ_16K - 1) - - /* Module parameters */ -@@ -3597,12 +3597,24 @@ static void stmmac_set_rx_mode(struct net_device *dev) - static int stmmac_change_mtu(struct net_device *dev, int new_mtu) - { - struct stmmac_priv *priv = netdev_priv(dev); -+ int txfifosz = priv->plat->tx_fifo_size; -+ -+ if (txfifosz == 0) -+ txfifosz = priv->dma_cap.tx_fifo_size; -+ -+ txfifosz /= priv->plat->tx_queues_to_use; - - if (netif_running(dev)) { - netdev_err(priv->dev, "must be stopped to change its MTU\n"); - return -EBUSY; - } - -+ new_mtu = STMMAC_ALIGN(new_mtu); -+ -+ /* If condition true, FIFO is too small or MTU too large */ -+ if ((txfifosz < new_mtu) || (new_mtu > BUF_SIZE_16KiB)) -+ return -EINVAL; -+ - dev->mtu = new_mtu; - - netdev_update_features(dev); -diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c -index 35905e9ee9ec..25be27826a22 100644 ---- a/drivers/net/gtp.c -+++ b/drivers/net/gtp.c -@@ -816,7 +816,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, - lock_sock(sock->sk); - if (sock->sk->sk_user_data) { - sk = ERR_PTR(-EBUSY); -- goto out_sock; -+ goto out_rel_sock; - } - - sk = sock->sk; -@@ -829,8 +829,9 @@ static struct sock *gtp_encap_enable_socket(int fd, int type, - - setup_udp_tunnel_sock(sock_net(sock->sk), sock, &tuncfg); - --out_sock: -+out_rel_sock: - release_sock(sock->sk); -+out_sock: - sockfd_put(sock); - return sk; - } -diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h -index 0f07b5978fa1..fc794e69e6a1 100644 ---- a/drivers/net/hyperv/hyperv_net.h -+++ b/drivers/net/hyperv/hyperv_net.h -@@ -179,7 +179,6 @@ struct rndis_device { - - u8 hw_mac_adr[ETH_ALEN]; - u8 rss_key[NETVSC_HASH_KEYLEN]; -- u16 rx_table[ITAB_NUM]; - }; - - -@@ -741,6 +740,8 @@ struct net_device_context { - - u32 tx_table[VRSS_SEND_TAB_SIZE]; - -+ u16 rx_table[ITAB_NUM]; -+ - /* Ethtool settings */ - bool udp4_l4_hash; - bool udp6_l4_hash; -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index 5a44b9795266..a89de5752a8c 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -1528,7 +1528,7 @@ static int netvsc_get_rxfh(struct net_device *dev, u32 *indir, u8 *key, - rndis_dev = ndev->extension; - if (indir) { - for (i = 0; i < ITAB_NUM; i++) -- indir[i] = rndis_dev->rx_table[i]; -+ indir[i] = ndc->rx_table[i]; - } - - if (key) -@@ -1558,7 +1558,7 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir, - return -EINVAL; - - for (i = 0; i < ITAB_NUM; i++) -- rndis_dev->rx_table[i] = indir[i]; -+ ndc->rx_table[i] = indir[i]; - } - - if (!key) { -diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c -index fc1d5e14d83e..b19557c035f2 100644 ---- a/drivers/net/hyperv/rndis_filter.c -+++ b/drivers/net/hyperv/rndis_filter.c -@@ -715,6 +715,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev, - const u8 *rss_key, u16 flag) - { - struct net_device *ndev = rdev->ndev; -+ struct net_device_context *ndc = netdev_priv(ndev); - struct rndis_request *request; - struct rndis_set_request *set; - struct rndis_set_complete *set_complete; -@@ -754,7 +755,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev, - /* Set indirection table entries */ - itab = (u32 *)(rssp + 1); - for (i = 0; i < ITAB_NUM; i++) -- itab[i] = rdev->rx_table[i]; -+ itab[i] = ndc->rx_table[i]; - - /* Set hask key values */ - keyp = (u8 *)((unsigned long)rssp + rssp->kashkey_offset); -@@ -1204,6 +1205,7 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, - struct netvsc_device_info *device_info) - { - struct net_device *net = hv_get_drvdata(dev); -+ struct net_device_context *ndc = netdev_priv(net); - struct netvsc_device *net_device; - struct rndis_device *rndis_device; - struct ndis_recv_scale_cap rsscap; -@@ -1286,9 +1288,11 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, - /* We will use the given number of channels if available. */ - net_device->num_chn = min(net_device->max_chn, device_info->num_chn); - -- for (i = 0; i < ITAB_NUM; i++) -- rndis_device->rx_table[i] = ethtool_rxfh_indir_default( -+ if (!netif_is_rxfh_configured(net)) { -+ for (i = 0; i < ITAB_NUM; i++) -+ ndc->rx_table[i] = ethtool_rxfh_indir_default( - i, net_device->num_chn); -+ } - - atomic_set(&net_device->open_chn, 1); - vmbus_set_sc_create_callback(dev->channel, netvsc_sc_open); -diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c -index 8d5f88a538fc..2b977655834c 100644 ---- a/drivers/net/macvlan.c -+++ b/drivers/net/macvlan.c -@@ -263,7 +263,7 @@ static void macvlan_broadcast(struct sk_buff *skb, - struct net_device *src, - enum macvlan_mode mode) - { -- const struct ethhdr *eth = eth_hdr(skb); -+ const struct ethhdr *eth = skb_eth_hdr(skb); - const struct macvlan_dev *vlan; - struct sk_buff *nskb; - unsigned int i; -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 7d1d5b30ecc3..c23f35dba718 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -497,7 +497,7 @@ static int lan78xx_read_stats(struct lan78xx_net *dev, - } - } else { - netdev_warn(dev->net, -- "Failed to read stat ret = 0x%x", ret); -+ "Failed to read stat ret = %d", ret); - } - - kfree(stats); -@@ -2604,11 +2604,6 @@ static int lan78xx_stop(struct net_device *net) - return 0; - } - --static int lan78xx_linearize(struct sk_buff *skb) --{ -- return skb_linearize(skb); --} -- - static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, - struct sk_buff *skb, gfp_t flags) - { -@@ -2619,8 +2614,10 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, - return NULL; - } - -- if (lan78xx_linearize(skb) < 0) -+ if (skb_linearize(skb)) { -+ dev_kfree_skb_any(skb); - return NULL; -+ } - - tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN_MASK_) | TX_CMD_A_FCS_; - -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 153a81ece9fe..5aa7d5091f4d 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -2216,7 +2216,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, - skb_dst_update_pmtu(skb, mtu); - } - -- tos = ip_tunnel_ecn_encap(tos, old_iph, skb); -+ tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); - ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); - err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr), - vni, md, flags, udp_sum); -@@ -2257,7 +2257,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, - skb_dst_update_pmtu(skb, mtu); - } - -- tos = ip_tunnel_ecn_encap(tos, old_iph, skb); -+ tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); - ttl = ttl ? : ip6_dst_hoplimit(ndst); - skb_scrub_packet(skb, xnet); - err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr), -diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c -index e76af2866a19..b5340af9fa5e 100644 ---- a/drivers/net/wireless/marvell/mwifiex/tdls.c -+++ b/drivers/net/wireless/marvell/mwifiex/tdls.c -@@ -956,59 +956,117 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv, - - switch (*pos) { - case WLAN_EID_SUPP_RATES: -+ if (pos[1] > 32) -+ return; - sta_ptr->tdls_cap.rates_len = pos[1]; - for (i = 0; i < pos[1]; i++) - sta_ptr->tdls_cap.rates[i] = pos[i + 2]; - break; - - case WLAN_EID_EXT_SUPP_RATES: -+ if (pos[1] > 32) -+ return; - basic = sta_ptr->tdls_cap.rates_len; -+ if (pos[1] > 32 - basic) -+ return; - for (i = 0; i < pos[1]; i++) - sta_ptr->tdls_cap.rates[basic + i] = pos[i + 2]; - sta_ptr->tdls_cap.rates_len += pos[1]; - break; - case WLAN_EID_HT_CAPABILITY: -- memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos, -+ if (pos > end - sizeof(struct ieee80211_ht_cap) - 2) -+ return; -+ if (pos[1] != sizeof(struct ieee80211_ht_cap)) -+ return; -+ /* copy the ie's value into ht_capb*/ -+ memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos + 2, - sizeof(struct ieee80211_ht_cap)); - sta_ptr->is_11n_enabled = 1; - break; - case WLAN_EID_HT_OPERATION: -- memcpy(&sta_ptr->tdls_cap.ht_oper, pos, -+ if (pos > end - -+ sizeof(struct ieee80211_ht_operation) - 2) -+ return; -+ if (pos[1] != sizeof(struct ieee80211_ht_operation)) -+ return; -+ /* copy the ie's value into ht_oper*/ -+ memcpy(&sta_ptr->tdls_cap.ht_oper, pos + 2, - sizeof(struct ieee80211_ht_operation)); - break; - case WLAN_EID_BSS_COEX_2040: -+ if (pos > end - 3) -+ return; -+ if (pos[1] != 1) -+ return; - sta_ptr->tdls_cap.coex_2040 = pos[2]; - break; - case WLAN_EID_EXT_CAPABILITY: -+ if (pos > end - sizeof(struct ieee_types_header)) -+ return; -+ if (pos[1] < sizeof(struct ieee_types_header)) -+ return; -+ if (pos[1] > 8) -+ return; - memcpy((u8 *)&sta_ptr->tdls_cap.extcap, pos, - sizeof(struct ieee_types_header) + - min_t(u8, pos[1], 8)); - break; - case WLAN_EID_RSN: -+ if (pos > end - sizeof(struct ieee_types_header)) -+ return; -+ if (pos[1] < sizeof(struct ieee_types_header)) -+ return; -+ if (pos[1] > IEEE_MAX_IE_SIZE - -+ sizeof(struct ieee_types_header)) -+ return; - memcpy((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos, - sizeof(struct ieee_types_header) + - min_t(u8, pos[1], IEEE_MAX_IE_SIZE - - sizeof(struct ieee_types_header))); - break; - case WLAN_EID_QOS_CAPA: -+ if (pos > end - 3) -+ return; -+ if (pos[1] != 1) -+ return; - sta_ptr->tdls_cap.qos_info = pos[2]; - break; - case WLAN_EID_VHT_OPERATION: -- if (priv->adapter->is_hw_11ac_capable) -- memcpy(&sta_ptr->tdls_cap.vhtoper, pos, -+ if (priv->adapter->is_hw_11ac_capable) { -+ if (pos > end - -+ sizeof(struct ieee80211_vht_operation) - 2) -+ return; -+ if (pos[1] != -+ sizeof(struct ieee80211_vht_operation)) -+ return; -+ /* copy the ie's value into vhtoper*/ -+ memcpy(&sta_ptr->tdls_cap.vhtoper, pos + 2, - sizeof(struct ieee80211_vht_operation)); -+ } - break; - case WLAN_EID_VHT_CAPABILITY: - if (priv->adapter->is_hw_11ac_capable) { -- memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos, -+ if (pos > end - -+ sizeof(struct ieee80211_vht_cap) - 2) -+ return; -+ if (pos[1] != sizeof(struct ieee80211_vht_cap)) -+ return; -+ /* copy the ie's value into vhtcap*/ -+ memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos + 2, - sizeof(struct ieee80211_vht_cap)); - sta_ptr->is_11ac_enabled = 1; - } - break; - case WLAN_EID_AID: -- if (priv->adapter->is_hw_11ac_capable) -+ if (priv->adapter->is_hw_11ac_capable) { -+ if (pos > end - 4) -+ return; -+ if (pos[1] != 2) -+ return; - sta_ptr->tdls_cap.aid = - get_unaligned_le16((pos + 2)); -+ } -+ break; - default: - break; - } -diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c -index e3aefdafae89..0941555b84a5 100644 ---- a/drivers/pci/switch/switchtec.c -+++ b/drivers/pci/switch/switchtec.c -@@ -23,7 +23,7 @@ - #include - #include - #include -- -+#include - #include - - MODULE_DESCRIPTION("Microsemi Switchtec(tm) PCIe Management Driver"); -@@ -898,7 +898,7 @@ static int ioctl_event_summary(struct switchtec_dev *stdev, - u32 reg; - - s.global = ioread32(&stdev->mmio_sw_event->global_summary); -- s.part_bitmap = ioread32(&stdev->mmio_sw_event->part_event_bitmap); -+ s.part_bitmap = readq(&stdev->mmio_sw_event->part_event_bitmap); - s.local_part = ioread32(&stdev->mmio_part_cfg->part_event_summary); - - for (i = 0; i < stdev->partition_count; i++) { -diff --git a/drivers/regulator/rn5t618-regulator.c b/drivers/regulator/rn5t618-regulator.c -index 790a4a73ea2c..40b74648bd31 100644 ---- a/drivers/regulator/rn5t618-regulator.c -+++ b/drivers/regulator/rn5t618-regulator.c -@@ -154,6 +154,7 @@ static struct platform_driver rn5t618_regulator_driver = { - - module_platform_driver(rn5t618_regulator_driver); - -+MODULE_ALIAS("platform:rn5t618-regulator"); - MODULE_AUTHOR("Beniamino Galvani "); - MODULE_DESCRIPTION("RN5T618 regulator driver"); - MODULE_LICENSE("GPL v2"); -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index 0d5e2d92e05b..aa651403546f 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -1133,7 +1133,8 @@ static u32 get_fcx_max_data(struct dasd_device *device) - { - struct dasd_eckd_private *private = device->private; - int fcx_in_css, fcx_in_gneq, fcx_in_features; -- int tpm, mdc; -+ unsigned int mdc; -+ int tpm; - - if (dasd_nofcx) - return 0; -@@ -1147,7 +1148,7 @@ static u32 get_fcx_max_data(struct dasd_device *device) - return 0; - - mdc = ccw_device_get_mdc(device->cdev, 0); -- if (mdc < 0) { -+ if (mdc == 0) { - dev_warn(&device->cdev->dev, "Detecting the maximum supported data size for zHPF requests failed\n"); - return 0; - } else { -@@ -1158,12 +1159,12 @@ static u32 get_fcx_max_data(struct dasd_device *device) - static int verify_fcx_max_data(struct dasd_device *device, __u8 lpm) - { - struct dasd_eckd_private *private = device->private; -- int mdc; -+ unsigned int mdc; - u32 fcx_max_data; - - if (private->fcx_max_data) { - mdc = ccw_device_get_mdc(device->cdev, lpm); -- if ((mdc < 0)) { -+ if (mdc == 0) { - dev_warn(&device->cdev->dev, - "Detecting the maximum data size for zHPF " - "requests failed (rc=%d) for a new path %x\n", -@@ -1767,7 +1768,7 @@ out_err2: - dasd_free_block(device->block); - device->block = NULL; - out_err1: -- kfree(private->conf_data); -+ dasd_eckd_clear_conf_data(device); - kfree(device->private); - device->private = NULL; - return rc; -@@ -1776,7 +1777,6 @@ out_err1: - static void dasd_eckd_uncheck_device(struct dasd_device *device) - { - struct dasd_eckd_private *private = device->private; -- int i; - - if (!private) - return; -@@ -1786,21 +1786,7 @@ static void dasd_eckd_uncheck_device(struct dasd_device *device) - private->sneq = NULL; - private->vdsneq = NULL; - private->gneq = NULL; -- private->conf_len = 0; -- for (i = 0; i < 8; i++) { -- kfree(device->path[i].conf_data); -- if ((__u8 *)device->path[i].conf_data == -- private->conf_data) { -- private->conf_data = NULL; -- private->conf_len = 0; -- } -- device->path[i].conf_data = NULL; -- device->path[i].cssid = 0; -- device->path[i].ssid = 0; -- device->path[i].chpid = 0; -- } -- kfree(private->conf_data); -- private->conf_data = NULL; -+ dasd_eckd_clear_conf_data(device); - } - - static struct dasd_ccw_req * -diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c -index b22922ec32d1..474afec9ab87 100644 ---- a/drivers/s390/cio/device_ops.c -+++ b/drivers/s390/cio/device_ops.c -@@ -595,7 +595,7 @@ EXPORT_SYMBOL(ccw_device_tm_start_timeout); - * @mask: mask of paths to use - * - * Return the number of 64K-bytes blocks all paths at least support -- * for a transport command. Return values <= 0 indicate failures. -+ * for a transport command. Return value 0 indicates failure. - */ - int ccw_device_get_mdc(struct ccw_device *cdev, u8 mask) - { -diff --git a/drivers/spi/spi-cavium-thunderx.c b/drivers/spi/spi-cavium-thunderx.c -index 877937706240..828fbbebc3c4 100644 ---- a/drivers/spi/spi-cavium-thunderx.c -+++ b/drivers/spi/spi-cavium-thunderx.c -@@ -81,6 +81,7 @@ static int thunderx_spi_probe(struct pci_dev *pdev, - - error: - clk_disable_unprepare(p->clk); -+ pci_release_regions(pdev); - spi_master_put(master); - return ret; - } -@@ -95,6 +96,7 @@ static void thunderx_spi_remove(struct pci_dev *pdev) - return; - - clk_disable_unprepare(p->clk); -+ pci_release_regions(pdev); - /* Put everything in a known state. */ - writeq(0, p->register_base + OCTEON_SPI_CFG(p)); - } -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index cfb8f1126cf8..1f525d5f6d2d 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -203,9 +203,58 @@ static const unsigned short super_speed_maxpacket_maxes[4] = { - [USB_ENDPOINT_XFER_INT] = 1024, - }; - --static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, -- int asnum, struct usb_host_interface *ifp, int num_ep, -- unsigned char *buffer, int size) -+static bool endpoint_is_duplicate(struct usb_endpoint_descriptor *e1, -+ struct usb_endpoint_descriptor *e2) -+{ -+ if (e1->bEndpointAddress == e2->bEndpointAddress) -+ return true; -+ -+ if (usb_endpoint_xfer_control(e1) || usb_endpoint_xfer_control(e2)) { -+ if (usb_endpoint_num(e1) == usb_endpoint_num(e2)) -+ return true; -+ } -+ -+ return false; -+} -+ -+/* -+ * Check for duplicate endpoint addresses in other interfaces and in the -+ * altsetting currently being parsed. -+ */ -+static bool config_endpoint_is_duplicate(struct usb_host_config *config, -+ int inum, int asnum, struct usb_endpoint_descriptor *d) -+{ -+ struct usb_endpoint_descriptor *epd; -+ struct usb_interface_cache *intfc; -+ struct usb_host_interface *alt; -+ int i, j, k; -+ -+ for (i = 0; i < config->desc.bNumInterfaces; ++i) { -+ intfc = config->intf_cache[i]; -+ -+ for (j = 0; j < intfc->num_altsetting; ++j) { -+ alt = &intfc->altsetting[j]; -+ -+ if (alt->desc.bInterfaceNumber == inum && -+ alt->desc.bAlternateSetting != asnum) -+ continue; -+ -+ for (k = 0; k < alt->desc.bNumEndpoints; ++k) { -+ epd = &alt->endpoint[k].desc; -+ -+ if (endpoint_is_duplicate(epd, d)) -+ return true; -+ } -+ } -+ } -+ -+ return false; -+} -+ -+static int usb_parse_endpoint(struct device *ddev, int cfgno, -+ struct usb_host_config *config, int inum, int asnum, -+ struct usb_host_interface *ifp, int num_ep, -+ unsigned char *buffer, int size) - { - unsigned char *buffer0 = buffer; - struct usb_endpoint_descriptor *d; -@@ -242,13 +291,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, - goto skip_to_next_endpoint_or_interface_descriptor; - - /* Check for duplicate endpoint addresses */ -- for (i = 0; i < ifp->desc.bNumEndpoints; ++i) { -- if (ifp->endpoint[i].desc.bEndpointAddress == -- d->bEndpointAddress) { -- dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", -- cfgno, inum, asnum, d->bEndpointAddress); -- goto skip_to_next_endpoint_or_interface_descriptor; -- } -+ if (config_endpoint_is_duplicate(config, inum, asnum, d)) { -+ dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n", -+ cfgno, inum, asnum, d->bEndpointAddress); -+ goto skip_to_next_endpoint_or_interface_descriptor; - } - - endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints]; -@@ -522,8 +568,8 @@ static int usb_parse_interface(struct device *ddev, int cfgno, - if (((struct usb_descriptor_header *) buffer)->bDescriptorType - == USB_DT_INTERFACE) - break; -- retval = usb_parse_endpoint(ddev, cfgno, inum, asnum, alt, -- num_ep, buffer, size); -+ retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum, -+ alt, num_ep, buffer, size); - if (retval < 0) - return retval; - ++n; -diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c -index 7e90f786d923..a0c1d77a7e38 100644 ---- a/drivers/usb/gadget/udc/dummy_hcd.c -+++ b/drivers/usb/gadget/udc/dummy_hcd.c -@@ -1325,7 +1325,7 @@ static int dummy_perform_transfer(struct urb *urb, struct dummy_request *req, - u32 this_sg; - bool next_sg; - -- to_host = usb_pipein(urb->pipe); -+ to_host = usb_urb_dir_in(urb); - rbuf = req->req.buf + req->req.actual; - - if (!urb->num_sgs) { -@@ -1413,7 +1413,7 @@ top: - - /* FIXME update emulated data toggle too */ - -- to_host = usb_pipein(urb->pipe); -+ to_host = usb_urb_dir_in(urb); - if (unlikely(len == 0)) - is_short = 1; - else { -@@ -1837,7 +1837,7 @@ restart: - - /* find the gadget's ep for this request (if configured) */ - address = usb_pipeendpoint (urb->pipe); -- if (usb_pipein(urb->pipe)) -+ if (usb_urb_dir_in(urb)) - address |= USB_DIR_IN; - ep = find_endpoint(dum, address); - if (!ep) { -@@ -2390,7 +2390,7 @@ static inline ssize_t show_urb(char *buf, size_t size, struct urb *urb) - s = "?"; - break; - } s; }), -- ep, ep ? (usb_pipein(urb->pipe) ? "in" : "out") : "", -+ ep, ep ? (usb_urb_dir_in(urb) ? "in" : "out") : "", - ({ char *s; \ - switch (usb_pipetype(urb->pipe)) { \ - case PIPE_CONTROL: \ -@@ -2734,7 +2734,7 @@ static struct platform_driver dummy_hcd_driver = { - }; - - /*-------------------------------------------------------------------------*/ --#define MAX_NUM_UDC 2 -+#define MAX_NUM_UDC 32 - static struct platform_device *the_udc_pdev[MAX_NUM_UDC]; - static struct platform_device *the_hcd_pdev[MAX_NUM_UDC]; - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 8d349f2e5656..dc9a1139e7e1 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1175,6 +1175,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) | RSVD(3) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */ - .driver_info = NCTRL(0) }, -+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff), /* Telit ME910G1 */ -+ .driver_info = NCTRL(0) | RSVD(3) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), -diff --git a/fs/drop_caches.c b/fs/drop_caches.c -index d31b6c72b476..dc1a1d5d825b 100644 ---- a/fs/drop_caches.c -+++ b/fs/drop_caches.c -@@ -35,11 +35,11 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused) - spin_unlock(&inode->i_lock); - spin_unlock(&sb->s_inode_list_lock); - -- cond_resched(); - invalidate_mapping_pages(inode->i_mapping, 0, -1); - iput(toput_inode); - toput_inode = inode; - -+ cond_resched(); - spin_lock(&sb->s_inode_list_lock); - } - spin_unlock(&sb->s_inode_list_lock); -diff --git a/fs/inode.c b/fs/inode.c -index 76f7535fe754..d2a700c5efce 100644 ---- a/fs/inode.c -+++ b/fs/inode.c -@@ -656,6 +656,7 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty) - struct inode *inode, *next; - LIST_HEAD(dispose); - -+again: - spin_lock(&sb->s_inode_list_lock); - list_for_each_entry_safe(inode, next, &sb->s_inodes, i_sb_list) { - spin_lock(&inode->i_lock); -@@ -678,6 +679,12 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty) - inode_lru_list_del(inode); - spin_unlock(&inode->i_lock); - list_add(&inode->i_lru, &dispose); -+ if (need_resched()) { -+ spin_unlock(&sb->s_inode_list_lock); -+ cond_resched(); -+ dispose_list(&dispose); -+ goto again; -+ } - } - spin_unlock(&sb->s_inode_list_lock); - -diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c -index 506da82ff3f1..a308f7a7e577 100644 ---- a/fs/notify/fsnotify.c -+++ b/fs/notify/fsnotify.c -@@ -90,6 +90,7 @@ void fsnotify_unmount_inodes(struct super_block *sb) - - iput_inode = inode; - -+ cond_resched(); - spin_lock(&sb->s_inode_list_lock); - } - spin_unlock(&sb->s_inode_list_lock); -diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c -index 3fdbdd29702b..30f5da8f4aff 100644 ---- a/fs/quota/dquot.c -+++ b/fs/quota/dquot.c -@@ -976,6 +976,7 @@ static int add_dquot_ref(struct super_block *sb, int type) - * later. - */ - old_inode = inode; -+ cond_resched(); - spin_lock(&sb->s_inode_list_lock); - } - spin_unlock(&sb->s_inode_list_lock); -diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h -index 548fd535fd02..d433f5e292c9 100644 ---- a/include/linux/if_ether.h -+++ b/include/linux/if_ether.h -@@ -28,6 +28,14 @@ static inline struct ethhdr *eth_hdr(const struct sk_buff *skb) - return (struct ethhdr *)skb_mac_header(skb); - } - -+/* Prefer this version in TX path, instead of -+ * skb_reset_mac_header() + eth_hdr() -+ */ -+static inline struct ethhdr *skb_eth_hdr(const struct sk_buff *skb) -+{ -+ return (struct ethhdr *)skb->data; -+} -+ - static inline struct ethhdr *inner_eth_hdr(const struct sk_buff *skb) - { - return (struct ethhdr *)skb_inner_mac_header(skb); -diff --git a/include/uapi/linux/netfilter/xt_sctp.h b/include/uapi/linux/netfilter/xt_sctp.h -index 4bc6d1a08781..b4d804a9fccb 100644 ---- a/include/uapi/linux/netfilter/xt_sctp.h -+++ b/include/uapi/linux/netfilter/xt_sctp.h -@@ -41,19 +41,19 @@ struct xt_sctp_info { - #define SCTP_CHUNKMAP_SET(chunkmap, type) \ - do { \ - (chunkmap)[type / bytes(__u32)] |= \ -- 1 << (type % bytes(__u32)); \ -+ 1u << (type % bytes(__u32)); \ - } while (0) - - #define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \ - do { \ - (chunkmap)[type / bytes(__u32)] &= \ -- ~(1 << (type % bytes(__u32))); \ -+ ~(1u << (type % bytes(__u32))); \ - } while (0) - - #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \ - ({ \ - ((chunkmap)[type / bytes (__u32)] & \ -- (1 << (type % bytes (__u32)))) ? 1: 0; \ -+ (1u << (type % bytes (__u32)))) ? 1: 0; \ - }) - - #define SCTP_CHUNKMAP_RESET(chunkmap) \ -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index a4875ff0bab1..615a2e44d2a0 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -1251,6 +1251,30 @@ static int check_ptr_alignment(struct bpf_verifier_env *env, - return check_generic_ptr_alignment(reg, pointer_desc, off, size, strict); - } - -+static int check_ctx_reg(struct bpf_verifier_env *env, -+ const struct bpf_reg_state *reg, int regno) -+{ -+ /* Access to ctx or passing it to a helper is only allowed in -+ * its original, unmodified form. -+ */ -+ -+ if (reg->off) { -+ verbose("dereference of modified ctx ptr R%d off=%d disallowed\n", -+ regno, reg->off); -+ return -EACCES; -+ } -+ -+ if (!tnum_is_const(reg->var_off) || reg->var_off.value) { -+ char tn_buf[48]; -+ -+ tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off); -+ verbose("variable ctx access var_off=%s disallowed\n", tn_buf); -+ return -EACCES; -+ } -+ -+ return 0; -+} -+ - /* truncate register to smaller size (in bytes) - * must be called with size < BPF_REG_SIZE - */ -@@ -1320,22 +1344,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn - verbose("R%d leaks addr into ctx\n", value_regno); - return -EACCES; - } -- /* ctx accesses must be at a fixed offset, so that we can -- * determine what type of data were returned. -- */ -- if (reg->off) { -- verbose("dereference of modified ctx ptr R%d off=%d+%d, ctx+const is allowed, ctx+const+const is not\n", -- regno, reg->off, off - reg->off); -- return -EACCES; -- } -- if (!tnum_is_const(reg->var_off) || reg->var_off.value) { -- char tn_buf[48]; -+ err = check_ctx_reg(env, reg, regno); -+ if (err < 0) -+ return err; - -- tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off); -- verbose("variable ctx access var_off=%s off=%d size=%d", -- tn_buf, off, size); -- return -EACCES; -- } - err = check_ctx_access(env, insn_idx, off, size, t, ®_type); - if (!err && t == BPF_READ && value_regno >= 0) { - /* ctx access returns either a scalar, or a -@@ -1573,6 +1585,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, - expected_type = PTR_TO_CTX; - if (type != expected_type) - goto err_type; -+ err = check_ctx_reg(env, reg, regno); -+ if (err < 0) -+ return err; - } else if (arg_type == ARG_PTR_TO_MEM || - arg_type == ARG_PTR_TO_UNINIT_MEM) { - expected_type = PTR_TO_STACK; -@@ -3442,6 +3457,7 @@ static bool may_access_skb(enum bpf_prog_type type) - static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) - { - struct bpf_reg_state *regs = cur_regs(env); -+ static const int ctx_reg = BPF_REG_6; - u8 mode = BPF_MODE(insn->code); - int i, err; - -@@ -3458,11 +3474,11 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) - } - - /* check whether implicit source operand (register R6) is readable */ -- err = check_reg_arg(env, BPF_REG_6, SRC_OP); -+ err = check_reg_arg(env, ctx_reg, SRC_OP); - if (err) - return err; - -- if (regs[BPF_REG_6].type != PTR_TO_CTX) { -+ if (regs[ctx_reg].type != PTR_TO_CTX) { - verbose("at the time of BPF_LD_ABS|IND R6 != pointer to skb\n"); - return -EINVAL; - } -@@ -3474,6 +3490,10 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) - return err; - } - -+ err = check_ctx_reg(env, ®s[ctx_reg], ctx_reg); -+ if (err < 0) -+ return err; -+ - /* reset caller saved regs to unreadable */ - for (i = 0; i < CALLER_SAVED_REGS; i++) { - mark_reg_not_init(regs, caller_saved[i]); -diff --git a/kernel/locking/spinlock_debug.c b/kernel/locking/spinlock_debug.c -index 9aa0fccd5d43..03595c29c566 100644 ---- a/kernel/locking/spinlock_debug.c -+++ b/kernel/locking/spinlock_debug.c -@@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init); - - static void spin_dump(raw_spinlock_t *lock, const char *msg) - { -- struct task_struct *owner = NULL; -+ struct task_struct *owner = READ_ONCE(lock->owner); - -- if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT) -- owner = lock->owner; -+ if (owner == SPINLOCK_OWNER_INIT) -+ owner = NULL; - printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n", - msg, raw_smp_processor_id(), - current->comm, task_pid_nr(current)); - printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, " - ".owner_cpu: %d\n", -- lock, lock->magic, -+ lock, READ_ONCE(lock->magic), - owner ? owner->comm : "", - owner ? task_pid_nr(owner) : -1, -- lock->owner_cpu); -+ READ_ONCE(lock->owner_cpu)); - dump_stack(); - } - -@@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *lock, const char *msg) - static inline void - debug_spin_lock_before(raw_spinlock_t *lock) - { -- SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic"); -- SPIN_BUG_ON(lock->owner == current, lock, "recursion"); -- SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(), -+ SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic"); -+ SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion"); -+ SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(), - lock, "cpu recursion"); - } - - static inline void debug_spin_lock_after(raw_spinlock_t *lock) - { -- lock->owner_cpu = raw_smp_processor_id(); -- lock->owner = current; -+ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); -+ WRITE_ONCE(lock->owner, current); - } - - static inline void debug_spin_unlock(raw_spinlock_t *lock) -@@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw_spinlock_t *lock) - SPIN_BUG_ON(lock->owner != current, lock, "wrong owner"); - SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), - lock, "wrong CPU"); -- lock->owner = SPINLOCK_OWNER_INIT; -- lock->owner_cpu = -1; -+ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); -+ WRITE_ONCE(lock->owner_cpu, -1); - } - - /* -@@ -183,8 +183,8 @@ static inline void debug_write_lock_before(rwlock_t *lock) - - static inline void debug_write_lock_after(rwlock_t *lock) - { -- lock->owner_cpu = raw_smp_processor_id(); -- lock->owner = current; -+ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); -+ WRITE_ONCE(lock->owner, current); - } - - static inline void debug_write_unlock(rwlock_t *lock) -@@ -193,8 +193,8 @@ static inline void debug_write_unlock(rwlock_t *lock) - RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner"); - RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), - lock, "wrong CPU"); -- lock->owner = SPINLOCK_OWNER_INIT; -- lock->owner_cpu = -1; -+ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); -+ WRITE_ONCE(lock->owner_cpu, -1); - } - - void do_raw_write_lock(rwlock_t *lock) -diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h -index 0e7afdf86127..235bed825e3a 100644 ---- a/net/8021q/vlan.h -+++ b/net/8021q/vlan.h -@@ -110,6 +110,7 @@ int vlan_check_real_dev(struct net_device *real_dev, - void vlan_setup(struct net_device *dev); - int register_vlan_dev(struct net_device *dev); - void unregister_vlan_dev(struct net_device *dev, struct list_head *head); -+void vlan_dev_uninit(struct net_device *dev); - bool vlan_dev_inherit_address(struct net_device *dev, - struct net_device *real_dev); - -diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c -index ac4c93c999b0..ed3717dc2d20 100644 ---- a/net/8021q/vlan_dev.c -+++ b/net/8021q/vlan_dev.c -@@ -610,7 +610,8 @@ static int vlan_dev_init(struct net_device *dev) - return 0; - } - --static void vlan_dev_uninit(struct net_device *dev) -+/* Note: this function might be called multiple times for the same device. */ -+void vlan_dev_uninit(struct net_device *dev) - { - struct vlan_priority_tci_mapping *pm; - struct vlan_dev_priv *vlan = vlan_dev_priv(dev); -diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c -index 5e831de3103e..fdf39dd5e755 100644 ---- a/net/8021q/vlan_netlink.c -+++ b/net/8021q/vlan_netlink.c -@@ -95,11 +95,13 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[], - struct ifla_vlan_flags *flags; - struct ifla_vlan_qos_mapping *m; - struct nlattr *attr; -- int rem; -+ int rem, err; - - if (data[IFLA_VLAN_FLAGS]) { - flags = nla_data(data[IFLA_VLAN_FLAGS]); -- vlan_dev_change_flags(dev, flags->flags, flags->mask); -+ err = vlan_dev_change_flags(dev, flags->flags, flags->mask); -+ if (err) -+ return err; - } - if (data[IFLA_VLAN_INGRESS_QOS]) { - nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) { -@@ -110,7 +112,9 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[], - if (data[IFLA_VLAN_EGRESS_QOS]) { - nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) { - m = nla_data(attr); -- vlan_dev_set_egress_priority(dev, m->from, m->to); -+ err = vlan_dev_set_egress_priority(dev, m->from, m->to); -+ if (err) -+ return err; - } - } - return 0; -@@ -157,10 +161,11 @@ static int vlan_newlink(struct net *src_net, struct net_device *dev, - return -EINVAL; - - err = vlan_changelink(dev, tb, data, extack); -- if (err < 0) -- return err; -- -- return register_vlan_dev(dev); -+ if (!err) -+ err = register_vlan_dev(dev); -+ if (err) -+ vlan_dev_uninit(dev); -+ return err; - } - - static inline size_t vlan_qos_map_size(unsigned int n) -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 55253ba0681f..d2b1c39c4223 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -1750,8 +1750,11 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb, - } - - /* Ignore very old stuff early */ -- if (!after(sp[used_sacks].end_seq, prior_snd_una)) -+ if (!after(sp[used_sacks].end_seq, prior_snd_una)) { -+ if (i == 0) -+ first_sack_index = -1; - continue; -+ } - - used_sacks++; - } -diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c -index 204a8351efff..c29170e767a8 100644 ---- a/net/llc/llc_station.c -+++ b/net/llc/llc_station.c -@@ -32,7 +32,7 @@ static int llc_stat_ev_rx_null_dsap_xid_c(struct sk_buff *skb) - return LLC_PDU_IS_CMD(pdu) && /* command PDU */ - LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ - LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID && -- !pdu->dsap ? 0 : 1; /* NULL DSAP value */ -+ !pdu->dsap; /* NULL DSAP value */ - } - - static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) -@@ -42,7 +42,7 @@ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) - return LLC_PDU_IS_CMD(pdu) && /* command PDU */ - LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ - LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST && -- !pdu->dsap ? 0 : 1; /* NULL DSAP */ -+ !pdu->dsap; /* NULL DSAP */ - } - - static int llc_station_ac_send_xid_r(struct sk_buff *skb) -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index c781c9a1a697..39a32edaa92c 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -3422,6 +3422,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list) - - list_for_each_entry(net, net_exit_list, exit_list) - ctnetlink_net_exit(net); -+ -+ /* wait for other cpus until they are done with ctnl_notifiers */ -+ synchronize_rcu(); - } - - static struct pernet_operations ctnetlink_net_ops = { -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 7ef126489d4e..91490446ebb4 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -3917,14 +3917,20 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, - if (nla[NFTA_SET_ELEM_DATA] == NULL && - !(flags & NFT_SET_ELEM_INTERVAL_END)) - return -EINVAL; -- if (nla[NFTA_SET_ELEM_DATA] != NULL && -- flags & NFT_SET_ELEM_INTERVAL_END) -- return -EINVAL; - } else { - if (nla[NFTA_SET_ELEM_DATA] != NULL) - return -EINVAL; - } - -+ if ((flags & NFT_SET_ELEM_INTERVAL_END) && -+ (nla[NFTA_SET_ELEM_DATA] || -+ nla[NFTA_SET_ELEM_OBJREF] || -+ nla[NFTA_SET_ELEM_TIMEOUT] || -+ nla[NFTA_SET_ELEM_EXPIRATION] || -+ nla[NFTA_SET_ELEM_USERDATA] || -+ nla[NFTA_SET_ELEM_EXPR])) -+ return -EINVAL; -+ - timeout = 0; - if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) { - if (!(set->flags & NFT_SET_TIMEOUT)) -diff --git a/net/rfkill/core.c b/net/rfkill/core.c -index 99a2e55b01cf..e31b4288f32c 100644 ---- a/net/rfkill/core.c -+++ b/net/rfkill/core.c -@@ -998,10 +998,13 @@ static void rfkill_sync_work(struct work_struct *work) - int __must_check rfkill_register(struct rfkill *rfkill) - { - static unsigned long rfkill_no; -- struct device *dev = &rfkill->dev; -+ struct device *dev; - int error; - -- BUG_ON(!rfkill); -+ if (!rfkill) -+ return -EINVAL; -+ -+ dev = &rfkill->dev; - - mutex_lock(&rfkill_global_mutex); - -diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c -index f50eb87cfe79..7a944f508cae 100644 ---- a/net/sched/sch_fq.c -+++ b/net/sched/sch_fq.c -@@ -734,7 +734,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt) - if (tb[TCA_FQ_QUANTUM]) { - u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]); - -- if (quantum > 0) -+ if (quantum > 0 && quantum <= (1 << 20)) - q->quantum = quantum; - else - err = -EINVAL; -diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c -index c60777351de1..ff6bc7cf6cbd 100644 ---- a/net/sched/sch_prio.c -+++ b/net/sched/sch_prio.c -@@ -244,8 +244,14 @@ static int prio_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new, - struct prio_sched_data *q = qdisc_priv(sch); - unsigned long band = arg - 1; - -- if (new == NULL) -- new = &noop_qdisc; -+ if (!new) { -+ new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, -+ TC_H_MAKE(sch->handle, arg)); -+ if (!new) -+ new = &noop_qdisc; -+ else -+ qdisc_hash_add(new, true); -+ } - - *old = qdisc_replace(sch, new, &q->queues[band]); - return 0; -diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c -index bf0c61adb09c..482bb0a5d4d3 100644 ---- a/net/sctp/sm_sideeffect.c -+++ b/net/sctp/sm_sideeffect.c -@@ -1359,8 +1359,10 @@ static int sctp_cmd_interpreter(enum sctp_event event_type, - /* Generate an INIT ACK chunk. */ - new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC, - 0); -- if (!new_obj) -- goto nomem; -+ if (!new_obj) { -+ error = -ENOMEM; -+ break; -+ } - - sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, - SCTP_CHUNK(new_obj)); -@@ -1382,7 +1384,8 @@ static int sctp_cmd_interpreter(enum sctp_event event_type, - if (!new_obj) { - if (cmd->obj.chunk) - sctp_chunk_free(cmd->obj.chunk); -- goto nomem; -+ error = -ENOMEM; -+ break; - } - sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, - SCTP_CHUNK(new_obj)); -@@ -1429,8 +1432,10 @@ static int sctp_cmd_interpreter(enum sctp_event event_type, - - /* Generate a SHUTDOWN chunk. */ - new_obj = sctp_make_shutdown(asoc, chunk); -- if (!new_obj) -- goto nomem; -+ if (!new_obj) { -+ error = -ENOMEM; -+ break; -+ } - sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, - SCTP_CHUNK(new_obj)); - break; -@@ -1760,11 +1765,17 @@ static int sctp_cmd_interpreter(enum sctp_event event_type, - break; - } - -- if (error) -+ if (error) { -+ cmd = sctp_next_cmd(commands); -+ while (cmd) { -+ if (cmd->verb == SCTP_CMD_REPLY) -+ sctp_chunk_free(cmd->obj.chunk); -+ cmd = sctp_next_cmd(commands); -+ } - break; -+ } - } - --out: - /* If this is in response to a received chunk, wait until - * we are done with the packet to open the queue so that we don't - * send multiple packets in response to a single request. -@@ -1779,8 +1790,5 @@ out: - sp->data_ready_signalled = 0; - - return error; --nomem: -- error = -ENOMEM; -- goto out; - } - -diff --git a/samples/bpf/syscall_tp_kern.c b/samples/bpf/syscall_tp_kern.c -index 9149c524d279..8833aacb9c8c 100644 ---- a/samples/bpf/syscall_tp_kern.c -+++ b/samples/bpf/syscall_tp_kern.c -@@ -50,13 +50,27 @@ static __always_inline void count(void *map) - SEC("tracepoint/syscalls/sys_enter_open") - int trace_enter_open(struct syscalls_enter_open_args *ctx) - { -- count((void *)&enter_open_map); -+ count(&enter_open_map); -+ return 0; -+} -+ -+SEC("tracepoint/syscalls/sys_enter_openat") -+int trace_enter_open_at(struct syscalls_enter_open_args *ctx) -+{ -+ count(&enter_open_map); - return 0; - } - - SEC("tracepoint/syscalls/sys_exit_open") - int trace_enter_exit(struct syscalls_exit_open_args *ctx) - { -- count((void *)&exit_open_map); -+ count(&exit_open_map); -+ return 0; -+} -+ -+SEC("tracepoint/syscalls/sys_exit_openat") -+int trace_enter_exit_at(struct syscalls_exit_open_args *ctx) -+{ -+ count(&exit_open_map); - return 0; - } -diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c -index c7d525e5696e..8c7445874662 100644 ---- a/samples/bpf/trace_event_user.c -+++ b/samples/bpf/trace_event_user.c -@@ -34,9 +34,9 @@ static void print_ksym(__u64 addr) - return; - sym = ksym_search(addr); - printf("%s;", sym->name); -- if (!strcmp(sym->name, "sys_read")) -+ if (!strstr(sym->name, "sys_read")) - sys_read_seen = true; -- else if (!strcmp(sym->name, "sys_write")) -+ else if (!strstr(sym->name, "sys_write")) - sys_write_seen = true; - } - -diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c -index ed29bad1f03a..96420b620963 100644 ---- a/scripts/kconfig/expr.c -+++ b/scripts/kconfig/expr.c -@@ -201,6 +201,13 @@ static int expr_eq(struct expr *e1, struct expr *e2) - { - int res, old_count; - -+ /* -+ * A NULL expr is taken to be yes, but there's also a different way to -+ * represent yes. expr_is_yes() checks for either representation. -+ */ -+ if (!e1 || !e2) -+ return expr_is_yes(e1) && expr_is_yes(e2); -+ - if (e1->type != e2->type) - return 0; - switch (e1->type) { -diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c -index fd2731d171dd..0e8008d38161 100644 ---- a/sound/soc/codecs/wm8962.c -+++ b/sound/soc/codecs/wm8962.c -@@ -2791,7 +2791,7 @@ static int fll_factors(struct _fll_div *fll_div, unsigned int Fref, - - if (target % Fref == 0) { - fll_div->theta = 0; -- fll_div->lambda = 0; -+ fll_div->lambda = 1; - } else { - gcd_fll = gcd(target, fratio * Fref); - -@@ -2861,7 +2861,7 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source, - return -EINVAL; - } - -- if (fll_div.theta || fll_div.lambda) -+ if (fll_div.theta) - fll1 |= WM8962_FLL_FRAC; - - /* Stop the FLL while we reconfigure */ -diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c -index 2d5cf263515b..72301bcad3bd 100644 ---- a/sound/soc/soc-topology.c -+++ b/sound/soc/soc-topology.c -@@ -1921,6 +1921,7 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg, - int count = hdr->count; - int i; - bool abi_match; -+ int ret; - - if (tplg->pass != SOC_TPLG_PASS_PCM_DAI) - return 0; -@@ -1957,7 +1958,12 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg, - } - - /* create the FE DAIs and DAI links */ -- soc_tplg_pcm_create(tplg, _pcm); -+ ret = soc_tplg_pcm_create(tplg, _pcm); -+ if (ret < 0) { -+ if (!abi_match) -+ kfree(_pcm); -+ return ret; -+ } - - /* offset by version-specific struct size and - * real priv data size -diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile -index 8107f060fa84..a0ac01c647f5 100644 ---- a/tools/lib/traceevent/Makefile -+++ b/tools/lib/traceevent/Makefile -@@ -115,6 +115,7 @@ EVENT_PARSE_VERSION = $(EP_VERSION).$(EP_PATCHLEVEL).$(EP_EXTRAVERSION) - - LIB_TARGET = libtraceevent.a libtraceevent.so.$(EVENT_PARSE_VERSION) - LIB_INSTALL = libtraceevent.a libtraceevent.so* -+LIB_INSTALL := $(addprefix $(OUTPUT),$(LIB_INSTALL)) - - INCLUDES = -I. -I $(srctree)/tools/include $(CONFIG_INCLUDES) - -diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c -index 913539aea645..9babb3fef8e2 100644 ---- a/tools/testing/selftests/bpf/test_verifier.c -+++ b/tools/testing/selftests/bpf/test_verifier.c -@@ -7281,7 +7281,7 @@ static struct bpf_test tests[] = { - offsetof(struct __sk_buff, mark)), - BPF_EXIT_INSN(), - }, -- .errstr = "dereference of modified ctx ptr R1 off=68+8, ctx+const is allowed, ctx+const+const is not", -+ .errstr = "dereference of modified ctx ptr", - .result = REJECT, - .prog_type = BPF_PROG_TYPE_SCHED_CLS, - }, -@@ -7944,6 +7944,62 @@ static struct bpf_test tests[] = { - .errstr = "BPF_XADD stores into R2 packet", - .prog_type = BPF_PROG_TYPE_XDP, - }, -+ { -+ "pass unmodified ctx pointer to helper", -+ .insns = { -+ BPF_MOV64_IMM(BPF_REG_2, 0), -+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, -+ BPF_FUNC_csum_update), -+ BPF_MOV64_IMM(BPF_REG_0, 0), -+ BPF_EXIT_INSN(), -+ }, -+ .prog_type = BPF_PROG_TYPE_SCHED_CLS, -+ .result = ACCEPT, -+ }, -+ { -+ "pass modified ctx pointer to helper, 1", -+ .insns = { -+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612), -+ BPF_MOV64_IMM(BPF_REG_2, 0), -+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, -+ BPF_FUNC_csum_update), -+ BPF_MOV64_IMM(BPF_REG_0, 0), -+ BPF_EXIT_INSN(), -+ }, -+ .prog_type = BPF_PROG_TYPE_SCHED_CLS, -+ .result = REJECT, -+ .errstr = "dereference of modified ctx ptr", -+ }, -+ { -+ "pass modified ctx pointer to helper, 2", -+ .insns = { -+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612), -+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, -+ BPF_FUNC_get_socket_cookie), -+ BPF_MOV64_IMM(BPF_REG_0, 0), -+ BPF_EXIT_INSN(), -+ }, -+ .result_unpriv = REJECT, -+ .result = REJECT, -+ .errstr_unpriv = "dereference of modified ctx ptr", -+ .errstr = "dereference of modified ctx ptr", -+ }, -+ { -+ "pass modified ctx pointer to helper, 3", -+ .insns = { -+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0), -+ BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4), -+ BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3), -+ BPF_MOV64_IMM(BPF_REG_2, 0), -+ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, -+ BPF_FUNC_csum_update), -+ BPF_MOV64_IMM(BPF_REG_0, 0), -+ BPF_EXIT_INSN(), -+ }, -+ .prog_type = BPF_PROG_TYPE_SCHED_CLS, -+ .result = REJECT, -+ .errstr = "variable ctx access var_off=(0x0; 0x4)", -+ }, - }; - - static int probe_filter_length(const struct bpf_insn *fp) diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.164-165.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.164-165.patch deleted file mode 100644 index 600d8fc2e9..0000000000 --- a/patch/kernel/odroidxu4-legacy/patch-4.14.164-165.patch +++ /dev/null @@ -1,1239 +0,0 @@ -diff --git a/Makefile b/Makefile -index f2aa55cea457..166e18aa9ca9 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 4 - PATCHLEVEL = 14 --SUBLEVEL = 164 -+SUBLEVEL = 165 - EXTRAVERSION = - NAME = Petit Gorille - -diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c -index 15ce2c8b9ee2..60066315d669 100644 ---- a/arch/arm64/kernel/cpufeature.c -+++ b/arch/arm64/kernel/cpufeature.c -@@ -799,11 +799,6 @@ static bool has_no_hw_prefetch(const struct arm64_cpu_capabilities *entry, int _ - MIDR_CPU_VAR_REV(1, MIDR_REVISION_MASK)); - } - --static bool runs_at_el2(const struct arm64_cpu_capabilities *entry, int __unused) --{ -- return is_kernel_in_hyp_mode(); --} -- - static bool hyp_offset_low(const struct arm64_cpu_capabilities *entry, - int __unused) - { -@@ -937,6 +932,12 @@ static int __init parse_kpti(char *str) - } - early_param("kpti", parse_kpti); - -+#ifdef CONFIG_ARM64_VHE -+static bool runs_at_el2(const struct arm64_cpu_capabilities *entry, int __unused) -+{ -+ return is_kernel_in_hyp_mode(); -+} -+ - static void cpu_copy_el2regs(const struct arm64_cpu_capabilities *__unused) - { - /* -@@ -950,6 +951,7 @@ static void cpu_copy_el2regs(const struct arm64_cpu_capabilities *__unused) - if (!alternatives_applied) - write_sysreg(read_sysreg(tpidr_el1), tpidr_el2); - } -+#endif - - #ifdef CONFIG_ARM64_SSBD - static int ssbs_emulation_handler(struct pt_regs *regs, u32 instr) -diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c -index 3aa7fe6baf2a..c7b9125c8ec2 100644 ---- a/drivers/gpio/gpiolib-acpi.c -+++ b/drivers/gpio/gpiolib-acpi.c -@@ -24,11 +24,19 @@ - - #include "gpiolib.h" - -+#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l -+#define QUIRK_NO_WAKEUP 0x02l -+ - static int run_edge_events_on_boot = -1; - module_param(run_edge_events_on_boot, int, 0444); - MODULE_PARM_DESC(run_edge_events_on_boot, - "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto"); - -+static int honor_wakeup = -1; -+module_param(honor_wakeup, int, 0444); -+MODULE_PARM_DESC(honor_wakeup, -+ "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto"); -+ - /** - * struct acpi_gpio_event - ACPI GPIO event handler data - * -@@ -339,7 +347,7 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, - event->handle = evt_handle; - event->handler = handler; - event->irq = irq; -- event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE; -+ event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE; - event->pin = pin; - event->desc = desc; - -@@ -1312,7 +1320,7 @@ static int acpi_gpio_handle_deferred_request_irqs(void) - /* We must use _sync so that this runs after the first deferred_probe run */ - late_initcall_sync(acpi_gpio_handle_deferred_request_irqs); - --static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { -+static const struct dmi_system_id gpiolib_acpi_quirks[] = { - { - /* - * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for -@@ -1322,7 +1330,8 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "MINIX"), - DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), -- } -+ }, -+ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, - }, - { - /* -@@ -1334,20 +1343,52 @@ static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = { - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"), - DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"), -- } -+ }, -+ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT, -+ }, -+ { -+ /* -+ * Various HP X2 10 Cherry Trail models use an external -+ * embedded-controller connected via I2C + an ACPI GPIO -+ * event handler. The embedded controller generates various -+ * spurious wakeup events when suspended. So disable wakeup -+ * for its handler (it uses the only ACPI GPIO event handler). -+ * This breaks wakeup when opening the lid, the user needs -+ * to press the power-button to wakeup the system. The -+ * alternative is suspend simply not working, which is worse. -+ */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "HP"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"), -+ }, -+ .driver_data = (void *)QUIRK_NO_WAKEUP, - }, - {} /* Terminating entry */ - }; - - static int acpi_gpio_setup_params(void) - { -+ const struct dmi_system_id *id; -+ long quirks = 0; -+ -+ id = dmi_first_match(gpiolib_acpi_quirks); -+ if (id) -+ quirks = (long)id->driver_data; -+ - if (run_edge_events_on_boot < 0) { -- if (dmi_check_system(run_edge_events_on_boot_blacklist)) -+ if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT) - run_edge_events_on_boot = 0; - else - run_edge_events_on_boot = 1; - } - -+ if (honor_wakeup < 0) { -+ if (quirks & QUIRK_NO_WAKEUP) -+ honor_wakeup = 0; -+ else -+ honor_wakeup = 1; -+ } -+ - return 0; - } - -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index ef86721c06f3..c8c83f84aced 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -274,7 +274,7 @@ static void drm_dp_encode_sideband_req(struct drm_dp_sideband_msg_req_body *req, - memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes); - idx += req->u.i2c_read.transactions[i].num_bytes; - -- buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5; -+ buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4; - buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf); - idx++; - } -diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c -index f1259a0c2883..eb6bf881c465 100644 ---- a/drivers/gpu/drm/drm_fb_helper.c -+++ b/drivers/gpu/drm/drm_fb_helper.c -@@ -1590,7 +1590,7 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, - * Changes struct fb_var_screeninfo are currently not pushed back - * to KMS, hence fail if different settings are requested. - */ -- if (var->bits_per_pixel != fb->format->cpp[0] * 8 || -+ if (var->bits_per_pixel > fb->format->cpp[0] * 8 || - var->xres > fb->width || var->yres > fb->height || - var->xres_virtual > fb->width || var->yres_virtual > fb->height) { - DRM_DEBUG("fb requested width/height/bpp can't fit in current fb " -@@ -1615,6 +1615,11 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, - drm_fb_helper_fill_pixel_fmt(var, fb->format->depth); - } - -+ /* -+ * Likewise, bits_per_pixel should be rounded up to a supported value. -+ */ -+ var->bits_per_pixel = fb->format->cpp[0] * 8; -+ - /* - * drm fbdev emulation doesn't support changing the pixel format at all, - * so reject all pixel format changing requests. -diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c -index e0483c068d23..baff1f01bfc7 100644 ---- a/drivers/gpu/drm/i915/intel_lrc.c -+++ b/drivers/gpu/drm/i915/intel_lrc.c -@@ -1101,17 +1101,14 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch) - - *batch++ = MI_NOOP; - -- /* WaClearSlmSpaceAtContextSwitch:kbl */ -- /* Actual scratch location is at 128 bytes offset */ -- if (IS_KBL_REVID(engine->i915, 0, KBL_REVID_A0)) { -- batch = gen8_emit_pipe_control(batch, -- PIPE_CONTROL_FLUSH_L3 | -- PIPE_CONTROL_GLOBAL_GTT_IVB | -- PIPE_CONTROL_CS_STALL | -- PIPE_CONTROL_QW_WRITE, -- i915_ggtt_offset(engine->scratch) -- + 2 * CACHELINE_BYTES); -- } -+ /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */ -+ batch = gen8_emit_pipe_control(batch, -+ PIPE_CONTROL_FLUSH_L3 | -+ PIPE_CONTROL_GLOBAL_GTT_IVB | -+ PIPE_CONTROL_CS_STALL | -+ PIPE_CONTROL_QW_WRITE, -+ i915_ggtt_offset(engine->scratch) + -+ 2 * CACHELINE_BYTES); - - /* WaMediaPoolStateCmdInWABB:bxt,glk */ - if (HAS_POOLED_EU(engine->i915)) { -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 6a04b56d161b..2d089d3954e3 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -268,6 +268,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign - offset = report->size; - report->size += parser->global.report_size * parser->global.report_count; - -+ /* Total size check: Allow for possible report index byte */ -+ if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) { -+ hid_err(parser->device, "report is too long\n"); -+ return -1; -+ } -+ - if (!parser->local.usage_index) /* Ignore padding fields */ - return 0; - -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index 9d24fb0715ba..14e4003fde4d 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -1116,9 +1116,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - } - - mapped: -- if (device->driver->input_mapped && device->driver->input_mapped(device, -- hidinput, field, usage, &bit, &max) < 0) -- goto ignore; -+ if (device->driver->input_mapped && -+ device->driver->input_mapped(device, hidinput, field, usage, -+ &bit, &max) < 0) { -+ /* -+ * The driver indicated that no further generic handling -+ * of the usage is desired. -+ */ -+ return; -+ } - - set_bit(usage->type, input->evbit); - -@@ -1176,9 +1182,11 @@ mapped: - set_bit(MSC_SCAN, input->mscbit); - } - --ignore: - return; - -+ignore: -+ usage->type = 0; -+ usage->code = 0; - } - - void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value) -diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c -index 6f67d73b184e..e63b761f600a 100644 ---- a/drivers/hid/uhid.c -+++ b/drivers/hid/uhid.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - - #define UHID_NAME "uhid" - #define UHID_BUFSIZE 32 -@@ -774,7 +775,7 @@ static unsigned int uhid_char_poll(struct file *file, poll_table *wait) - if (uhid->head != uhid->tail) - return POLLIN | POLLRDNORM; - -- return 0; -+ return EPOLLOUT | EPOLLWRNORM; - } - - static const struct file_operations uhid_fops = { -diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c -index ce342fd0457e..bccd97cdc53f 100644 ---- a/drivers/hid/usbhid/hiddev.c -+++ b/drivers/hid/usbhid/hiddev.c -@@ -254,12 +254,51 @@ static int hiddev_release(struct inode * inode, struct file * file) - return 0; - } - -+static int __hiddev_open(struct hiddev *hiddev, struct file *file) -+{ -+ struct hiddev_list *list; -+ int error; -+ -+ lockdep_assert_held(&hiddev->existancelock); -+ -+ list = vzalloc(sizeof(*list)); -+ if (!list) -+ return -ENOMEM; -+ -+ mutex_init(&list->thread_lock); -+ list->hiddev = hiddev; -+ -+ if (!hiddev->open++) { -+ error = hid_hw_power(hiddev->hid, PM_HINT_FULLON); -+ if (error < 0) -+ goto err_drop_count; -+ -+ error = hid_hw_open(hiddev->hid); -+ if (error < 0) -+ goto err_normal_power; -+ } -+ -+ spin_lock_irq(&hiddev->list_lock); -+ list_add_tail(&list->node, &hiddev->list); -+ spin_unlock_irq(&hiddev->list_lock); -+ -+ file->private_data = list; -+ -+ return 0; -+ -+err_normal_power: -+ hid_hw_power(hiddev->hid, PM_HINT_NORMAL); -+err_drop_count: -+ hiddev->open--; -+ vfree(list); -+ return error; -+} -+ - /* - * open file op - */ - static int hiddev_open(struct inode *inode, struct file *file) - { -- struct hiddev_list *list; - struct usb_interface *intf; - struct hid_device *hid; - struct hiddev *hiddev; -@@ -268,66 +307,14 @@ static int hiddev_open(struct inode *inode, struct file *file) - intf = usbhid_find_interface(iminor(inode)); - if (!intf) - return -ENODEV; -+ - hid = usb_get_intfdata(intf); - hiddev = hid->hiddev; - -- if (!(list = vzalloc(sizeof(struct hiddev_list)))) -- return -ENOMEM; -- mutex_init(&list->thread_lock); -- list->hiddev = hiddev; -- file->private_data = list; -- -- /* -- * no need for locking because the USB major number -- * is shared which usbcore guards against disconnect -- */ -- if (list->hiddev->exist) { -- if (!list->hiddev->open++) { -- res = hid_hw_open(hiddev->hid); -- if (res < 0) -- goto bail; -- } -- } else { -- res = -ENODEV; -- goto bail; -- } -- -- spin_lock_irq(&list->hiddev->list_lock); -- list_add_tail(&list->node, &hiddev->list); -- spin_unlock_irq(&list->hiddev->list_lock); -- - mutex_lock(&hiddev->existancelock); -- /* -- * recheck exist with existance lock held to -- * avoid opening a disconnected device -- */ -- if (!list->hiddev->exist) { -- res = -ENODEV; -- goto bail_unlock; -- } -- if (!list->hiddev->open++) -- if (list->hiddev->exist) { -- struct hid_device *hid = hiddev->hid; -- res = hid_hw_power(hid, PM_HINT_FULLON); -- if (res < 0) -- goto bail_unlock; -- res = hid_hw_open(hid); -- if (res < 0) -- goto bail_normal_power; -- } -- mutex_unlock(&hiddev->existancelock); -- return 0; --bail_normal_power: -- hid_hw_power(hid, PM_HINT_NORMAL); --bail_unlock: -+ res = hiddev->exist ? __hiddev_open(hiddev, file) : -ENODEV; - mutex_unlock(&hiddev->existancelock); - -- spin_lock_irq(&list->hiddev->list_lock); -- list_del(&list->node); -- spin_unlock_irq(&list->hiddev->list_lock); --bail: -- file->private_data = NULL; -- vfree(list); - return res; - } - -diff --git a/drivers/input/input.c b/drivers/input/input.c -index 50d425fe6706..cadb368be8ef 100644 ---- a/drivers/input/input.c -+++ b/drivers/input/input.c -@@ -858,16 +858,18 @@ static int input_default_setkeycode(struct input_dev *dev, - } - } - -- __clear_bit(*old_keycode, dev->keybit); -- __set_bit(ke->keycode, dev->keybit); -- -- for (i = 0; i < dev->keycodemax; i++) { -- if (input_fetch_keycode(dev, i) == *old_keycode) { -- __set_bit(*old_keycode, dev->keybit); -- break; /* Setting the bit twice is useless, so break */ -+ if (*old_keycode <= KEY_MAX) { -+ __clear_bit(*old_keycode, dev->keybit); -+ for (i = 0; i < dev->keycodemax; i++) { -+ if (input_fetch_keycode(dev, i) == *old_keycode) { -+ __set_bit(*old_keycode, dev->keybit); -+ /* Setting the bit twice is useless, so break */ -+ break; -+ } - } - } - -+ __set_bit(ke->keycode, dev->keybit); - return 0; - } - -@@ -923,9 +925,13 @@ int input_set_keycode(struct input_dev *dev, - * Simulate keyup event if keycode is not present - * in the keymap anymore - */ -- if (test_bit(EV_KEY, dev->evbit) && -- !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && -- __test_and_clear_bit(old_keycode, dev->key)) { -+ if (old_keycode > KEY_MAX) { -+ dev_warn(dev->dev.parent ?: &dev->dev, -+ "%s: got too big old keycode %#x\n", -+ __func__, old_keycode); -+ } else if (test_bit(EV_KEY, dev->evbit) && -+ !is_event_supported(old_keycode, dev->keybit, KEY_MAX) && -+ __test_and_clear_bit(old_keycode, dev->key)) { - struct input_value vals[] = { - { EV_KEY, old_keycode, 0 }, - input_value_sync -diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c -index acb708fc1463..0a7d818a06f3 100644 ---- a/drivers/net/can/mscan/mscan.c -+++ b/drivers/net/can/mscan/mscan.c -@@ -392,13 +392,12 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) - struct net_device *dev = napi->dev; - struct mscan_regs __iomem *regs = priv->reg_base; - struct net_device_stats *stats = &dev->stats; -- int npackets = 0; -- int ret = 1; -+ int work_done = 0; - struct sk_buff *skb; - struct can_frame *frame; - u8 canrflg; - -- while (npackets < quota) { -+ while (work_done < quota) { - canrflg = in_8(®s->canrflg); - if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF))) - break; -@@ -419,18 +418,18 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota) - - stats->rx_packets++; - stats->rx_bytes += frame->can_dlc; -- npackets++; -+ work_done++; - netif_receive_skb(skb); - } - -- if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) { -- napi_complete(&priv->napi); -- clear_bit(F_RX_PROGRESS, &priv->flags); -- if (priv->can.state < CAN_STATE_BUS_OFF) -- out_8(®s->canrier, priv->shadow_canrier); -- ret = 0; -+ if (work_done < quota) { -+ if (likely(napi_complete_done(&priv->napi, work_done))) { -+ clear_bit(F_RX_PROGRESS, &priv->flags); -+ if (priv->can.state < CAN_STATE_BUS_OFF) -+ out_8(®s->canrier, priv->shadow_canrier); -+ } - } -- return ret; -+ return work_done; - } - - static irqreturn_t mscan_isr(int irq, void *dev_id) -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index bfbf80949600..aed8ab6d6c5b 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -926,7 +926,7 @@ static int gs_usb_probe(struct usb_interface *intf, - GS_USB_BREQ_HOST_FORMAT, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, - 1, -- intf->altsetting[0].desc.bInterfaceNumber, -+ intf->cur_altsetting->desc.bInterfaceNumber, - hconf, - sizeof(*hconf), - 1000); -@@ -949,7 +949,7 @@ static int gs_usb_probe(struct usb_interface *intf, - GS_USB_BREQ_DEVICE_CONFIG, - USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE, - 1, -- intf->altsetting[0].desc.bInterfaceNumber, -+ intf->cur_altsetting->desc.bInterfaceNumber, - dconf, - sizeof(*dconf), - 1000); -diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c -index f9c79e21ab22..c64a03f164c0 100644 ---- a/drivers/net/wireless/ath/ath10k/usb.c -+++ b/drivers/net/wireless/ath/ath10k/usb.c -@@ -454,6 +454,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id, - ath10k_dbg(ar, ATH10K_DBG_USB_BULK, - "usb bulk transmit failed: %d\n", ret); - usb_unanchor_urb(urb); -+ usb_free_urb(urb); - ret = -EINVAL; - goto err_free_urb_to_pipe; - } -diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c -index 9d0d790a1319..8ee9609ef974 100644 ---- a/drivers/net/wireless/marvell/mwifiex/pcie.c -+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c -@@ -1022,8 +1022,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) - } - skb_put(skb, MWIFIEX_UPLD_SIZE); - if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, -- PCI_DMA_FROMDEVICE)) -+ PCI_DMA_FROMDEVICE)) { -+ kfree_skb(skb); - return -1; -+ } - - card->cmdrsp_buf = skb; - -diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c -index a8043d76152a..f88a953b3cd5 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c -+++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c -@@ -271,6 +271,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv, - "11D: skip setting domain info in FW\n"); - return 0; - } -+ -+ if (country_ie_len > -+ (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) { -+ mwifiex_dbg(priv->adapter, ERROR, -+ "11D: country_ie_len overflow!, deauth AP\n"); -+ return -EINVAL; -+ } -+ - memcpy(priv->adapter->country_code, &country_ie[2], 2); - - domain_info->country_code[0] = country_ie[2]; -@@ -314,8 +322,9 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss, - priv->scan_block = false; - - if (bss) { -- if (adapter->region_code == 0x00) -- mwifiex_process_country_ie(priv, bss); -+ if (adapter->region_code == 0x00 && -+ mwifiex_process_country_ie(priv, bss)) -+ return -EINVAL; - - /* Allocate and fill new bss descriptor */ - bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor), -diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -index b58bf8e2cad2..73fc5952fd37 100644 ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c -@@ -5453,6 +5453,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) - ret = usb_submit_urb(urb, GFP_KERNEL); - if (ret) { - usb_unanchor_urb(urb); -+ usb_free_urb(urb); - goto error; - } - -diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c -index 6601ad0dfb3a..4ba3634009af 100644 ---- a/drivers/phy/motorola/phy-cpcap-usb.c -+++ b/drivers/phy/motorola/phy-cpcap-usb.c -@@ -207,6 +207,19 @@ static int cpcap_phy_get_ints_state(struct cpcap_phy_ddata *ddata, - static int cpcap_usb_set_uart_mode(struct cpcap_phy_ddata *ddata); - static int cpcap_usb_set_usb_mode(struct cpcap_phy_ddata *ddata); - -+static void cpcap_usb_try_musb_mailbox(struct cpcap_phy_ddata *ddata, -+ enum musb_vbus_id_status status) -+{ -+ int error; -+ -+ error = musb_mailbox(status); -+ if (!error) -+ return; -+ -+ dev_dbg(ddata->dev, "%s: musb_mailbox failed: %i\n", -+ __func__, error); -+} -+ - static void cpcap_usb_detect(struct work_struct *work) - { - struct cpcap_phy_ddata *ddata; -@@ -226,9 +239,7 @@ static void cpcap_usb_detect(struct work_struct *work) - if (error) - goto out_err; - -- error = musb_mailbox(MUSB_ID_GROUND); -- if (error) -- goto out_err; -+ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND); - - error = regmap_update_bits(ddata->reg, CPCAP_REG_USBC3, - CPCAP_BIT_VBUSSTBY_EN, -@@ -255,9 +266,7 @@ static void cpcap_usb_detect(struct work_struct *work) - error = cpcap_usb_set_usb_mode(ddata); - if (error) - goto out_err; -- error = musb_mailbox(MUSB_ID_GROUND); -- if (error) -- goto out_err; -+ cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND); - - return; - } -@@ -267,22 +276,18 @@ static void cpcap_usb_detect(struct work_struct *work) - error = cpcap_usb_set_usb_mode(ddata); - if (error) - goto out_err; -- error = musb_mailbox(MUSB_VBUS_VALID); -- if (error) -- goto out_err; -+ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_VALID); - - return; - } - -+ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); -+ - /* Default to debug UART mode */ - error = cpcap_usb_set_uart_mode(ddata); - if (error) - goto out_err; - -- error = musb_mailbox(MUSB_VBUS_OFF); -- if (error) -- goto out_err; -- - dev_dbg(ddata->dev, "set UART mode\n"); - - return; -@@ -647,9 +652,7 @@ static int cpcap_usb_phy_remove(struct platform_device *pdev) - if (error) - dev_err(ddata->dev, "could not set UART mode\n"); - -- error = musb_mailbox(MUSB_VBUS_OFF); -- if (error) -- dev_err(ddata->dev, "could not set mailbox\n"); -+ cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); - - usb_remove_phy(&ddata->phy); - cancel_delayed_work_sync(&ddata->detect_work); -diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c -index d0a504af5b4f..0a70d54a4df6 100644 ---- a/drivers/scsi/bfa/bfad_attr.c -+++ b/drivers/scsi/bfa/bfad_attr.c -@@ -283,8 +283,10 @@ bfad_im_get_stats(struct Scsi_Host *shost) - rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa), - fcstats, bfad_hcb_comp, &fcomp); - spin_unlock_irqrestore(&bfad->bfad_lock, flags); -- if (rc != BFA_STATUS_OK) -+ if (rc != BFA_STATUS_OK) { -+ kfree(fcstats); - return NULL; -+ } - - wait_for_completion(&fcomp.comp); - -diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c -index 2c1b6de30da8..385e14269870 100644 ---- a/drivers/staging/comedi/drivers/adv_pci1710.c -+++ b/drivers/staging/comedi/drivers/adv_pci1710.c -@@ -45,8 +45,8 @@ - #define PCI171X_RANGE_UNI BIT(4) - #define PCI171X_RANGE_GAIN(x) (((x) & 0x7) << 0) - #define PCI171X_MUX_REG 0x04 /* W: A/D multiplexor control */ --#define PCI171X_MUX_CHANH(x) (((x) & 0xf) << 8) --#define PCI171X_MUX_CHANL(x) (((x) & 0xf) << 0) -+#define PCI171X_MUX_CHANH(x) (((x) & 0xff) << 8) -+#define PCI171X_MUX_CHANL(x) (((x) & 0xff) << 0) - #define PCI171X_MUX_CHAN(x) (PCI171X_MUX_CHANH(x) | PCI171X_MUX_CHANL(x)) - #define PCI171X_STATUS_REG 0x06 /* R: status register */ - #define PCI171X_STATUS_IRQ BIT(11) /* 1=IRQ occurred */ -diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -index 3733b73863b6..536453358568 100644 ---- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c -+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -@@ -45,6 +45,7 @@ static const struct usb_device_id rtw_usb_id_tbl[] = { - {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ - {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ - {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ -+ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ - {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ - {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ - {} /* Terminating entry */ -diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h -index 74715c854856..705fffa59da9 100644 ---- a/drivers/staging/vt6656/device.h -+++ b/drivers/staging/vt6656/device.h -@@ -269,6 +269,7 @@ struct vnt_private { - u8 mac_hw; - /* netdev */ - struct usb_device *usb; -+ struct usb_interface *intf; - - u64 tsf_time; - u8 rx_rate; -diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c -index cc6d8778fe5b..645ea16b53d5 100644 ---- a/drivers/staging/vt6656/main_usb.c -+++ b/drivers/staging/vt6656/main_usb.c -@@ -954,6 +954,7 @@ vt6656_probe(struct usb_interface *intf, const struct usb_device_id *id) - priv = hw->priv; - priv->hw = hw; - priv->usb = udev; -+ priv->intf = intf; - - vnt_set_options(priv); - -diff --git a/drivers/staging/vt6656/wcmd.c b/drivers/staging/vt6656/wcmd.c -index b2fc17f1381b..3f6ccdeb6dec 100644 ---- a/drivers/staging/vt6656/wcmd.c -+++ b/drivers/staging/vt6656/wcmd.c -@@ -109,6 +109,7 @@ void vnt_run_command(struct work_struct *work) - if (vnt_init(priv)) { - /* If fail all ends TODO retry */ - dev_err(&priv->usb->dev, "failed to start\n"); -+ usb_set_intfdata(priv->intf, NULL); - ieee80211_free_hw(priv->hw); - return; - } -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index 38bb8f85e88d..0ff8de7725cf 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -2810,6 +2810,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport) - if (uport->cons && uport->dev) - of_console_check(uport->dev->of_node, uport->cons->name, uport->line); - -+ tty_port_link_device(port, drv->tty_driver, uport->line); - uart_configure_port(drv, state, uport); - - port->console = uart_console(uport); -diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c -index 18cb8e46262d..83683a5627f3 100644 ---- a/drivers/usb/chipidea/host.c -+++ b/drivers/usb/chipidea/host.c -@@ -37,6 +37,7 @@ static int (*orig_bus_suspend)(struct usb_hcd *hcd); - - struct ehci_ci_priv { - struct regulator *reg_vbus; -+ bool enabled; - }; - - static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) -@@ -48,7 +49,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) - int ret = 0; - int port = HCS_N_PORTS(ehci->hcs_params); - -- if (priv->reg_vbus) { -+ if (priv->reg_vbus && enable != priv->enabled) { - if (port > 1) { - dev_warn(dev, - "Not support multi-port regulator control\n"); -@@ -64,6 +65,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable) - enable ? "enable" : "disable", ret); - return ret; - } -+ priv->enabled = enable; - } - - if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) { -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 1f525d5f6d2d..7df7faa3eed5 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -392,12 +392,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, - endpoint->desc.wMaxPacketSize = cpu_to_le16(8); - } - -- /* Validate the wMaxPacketSize field */ -+ /* -+ * Validate the wMaxPacketSize field. -+ * Some devices have isochronous endpoints in altsetting 0; -+ * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0 -+ * (see the end of section 5.6.3), so don't warn about them. -+ */ - maxp = usb_endpoint_maxp(&endpoint->desc); -- if (maxp == 0) { -- dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n", -+ if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) { -+ dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n", - cfgno, inum, asnum, d->bEndpointAddress); -- goto skip_to_next_endpoint_or_interface_descriptor; - } - - /* Find the highest legal maxpacket size for this endpoint */ -diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c -index ff17e94ef465..dca39c9a13b0 100644 ---- a/drivers/usb/musb/musb_core.c -+++ b/drivers/usb/musb/musb_core.c -@@ -1838,6 +1838,9 @@ static const struct attribute_group musb_attr_group = { - #define MUSB_QUIRK_B_INVALID_VBUS_91 (MUSB_DEVCTL_BDEVICE | \ - (2 << MUSB_DEVCTL_VBUS_SHIFT) | \ - MUSB_DEVCTL_SESSION) -+#define MUSB_QUIRK_B_DISCONNECT_99 (MUSB_DEVCTL_BDEVICE | \ -+ (3 << MUSB_DEVCTL_VBUS_SHIFT) | \ -+ MUSB_DEVCTL_SESSION) - #define MUSB_QUIRK_A_DISCONNECT_19 ((3 << MUSB_DEVCTL_VBUS_SHIFT) | \ - MUSB_DEVCTL_SESSION) - -@@ -1860,6 +1863,11 @@ static void musb_pm_runtime_check_session(struct musb *musb) - s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV | - MUSB_DEVCTL_HR; - switch (devctl & ~s) { -+ case MUSB_QUIRK_B_DISCONNECT_99: -+ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); -+ schedule_delayed_work(&musb->irq_work, -+ msecs_to_jiffies(1000)); -+ break; - case MUSB_QUIRK_B_INVALID_VBUS_91: - if (musb->quirk_retries && !musb->flush_irq_work) { - musb_dbg(musb, -@@ -2320,6 +2328,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl) - musb_disable_interrupts(musb); - musb_writeb(musb->mregs, MUSB_DEVCTL, 0); - -+ /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */ -+ musb_writeb(musb->mregs, MUSB_POWER, 0); -+ - /* Init IRQ workqueue before request_irq */ - INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work); - INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset); -diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c -index 512108e22d2b..1dc35ab31275 100644 ---- a/drivers/usb/musb/musbhsdma.c -+++ b/drivers/usb/musb/musbhsdma.c -@@ -399,7 +399,7 @@ struct dma_controller *musbhs_dma_controller_create(struct musb *musb, - controller->controller.channel_abort = dma_channel_abort; - - if (request_irq(irq, dma_controller_irq, 0, -- dev_name(musb->controller), &controller->controller)) { -+ dev_name(musb->controller), controller)) { - dev_err(dev, "request_irq %d failed!\n", irq); - musb_dma_controller_destroy(&controller->controller); - -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index dc9a1139e7e1..e69e31539914 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -570,6 +570,9 @@ static void option_instat_callback(struct urb *urb); - /* Interface must have two endpoints */ - #define NUMEP2 BIT(16) - -+/* Device needs ZLP */ -+#define ZLP BIT(17) -+ - - static const struct usb_device_id option_ids[] = { - { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, -@@ -1201,6 +1204,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(0) | RSVD(1) }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ - .driver_info = NCTRL(0) }, -+ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ -+ .driver_info = NCTRL(0) | ZLP }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), - .driver_info = RSVD(1) }, -@@ -2109,6 +2114,9 @@ static int option_attach(struct usb_serial *serial) - if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) - data->use_send_setup = 1; - -+ if (device_flags & ZLP) -+ data->use_zlp = 1; -+ - spin_lock_init(&data->susp_lock); - - usb_set_serial_data(serial, data); -diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h -index d28dab4b9eff..9879773fb39e 100644 ---- a/drivers/usb/serial/usb-wwan.h -+++ b/drivers/usb/serial/usb-wwan.h -@@ -36,6 +36,7 @@ struct usb_wwan_intf_private { - spinlock_t susp_lock; - unsigned int suspended:1; - unsigned int use_send_setup:1; -+ unsigned int use_zlp:1; - int in_flight; - unsigned int open_ports; - void *private; -diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c -index 59bfcb3da116..95e9576c2fe6 100644 ---- a/drivers/usb/serial/usb_wwan.c -+++ b/drivers/usb/serial/usb_wwan.c -@@ -492,6 +492,7 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, - void (*callback) (struct urb *)) - { - struct usb_serial *serial = port->serial; -+ struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial); - struct urb *urb; - - urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */ -@@ -502,6 +503,9 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, - usb_sndbulkpipe(serial->dev, endpoint) | dir, - buf, len, callback, ctx); - -+ if (intfdata->use_zlp && dir == USB_DIR_OUT) -+ urb->transfer_flags |= URB_ZERO_PACKET; -+ - return urb; - } - -diff --git a/fs/char_dev.c b/fs/char_dev.c -index 20ce45c7c57c..715d76b00108 100644 ---- a/fs/char_dev.c -+++ b/fs/char_dev.c -@@ -361,7 +361,7 @@ static struct kobject *cdev_get(struct cdev *p) - - if (owner && !try_module_get(owner)) - return NULL; -- kobj = kobject_get(&p->kobj); -+ kobj = kobject_get_unless_zero(&p->kobj); - if (!kobj) - module_put(owner); - return kobj; -diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h -index c0c0b992210e..995903c7055b 100644 ---- a/include/linux/can/dev.h -+++ b/include/linux/can/dev.h -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - #include - - /* -@@ -90,6 +91,36 @@ struct can_priv { - #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC)) - #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC)) - -+/* Check for outgoing skbs that have not been created by the CAN subsystem */ -+static inline bool can_skb_headroom_valid(struct net_device *dev, -+ struct sk_buff *skb) -+{ -+ /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */ -+ if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv))) -+ return false; -+ -+ /* af_packet does not apply CAN skb specific settings */ -+ if (skb->ip_summed == CHECKSUM_NONE) { -+ /* init headroom */ -+ can_skb_prv(skb)->ifindex = dev->ifindex; -+ can_skb_prv(skb)->skbcnt = 0; -+ -+ skb->ip_summed = CHECKSUM_UNNECESSARY; -+ -+ /* preform proper loopback on capable devices */ -+ if (dev->flags & IFF_ECHO) -+ skb->pkt_type = PACKET_LOOPBACK; -+ else -+ skb->pkt_type = PACKET_HOST; -+ -+ skb_reset_mac_header(skb); -+ skb_reset_network_header(skb); -+ skb_reset_transport_header(skb); -+ } -+ -+ return true; -+} -+ - /* Drop a given socketbuffer if it does not contain a valid CAN frame. */ - static inline bool can_dropped_invalid_skb(struct net_device *dev, - struct sk_buff *skb) -@@ -107,6 +138,9 @@ static inline bool can_dropped_invalid_skb(struct net_device *dev, - } else - goto inval_skb; - -+ if (!can_skb_headroom_valid(dev, skb)) -+ goto inval_skb; -+ - return false; - - inval_skb: -diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c -index 0fa9dadf3f4f..a5a4b5663163 100644 ---- a/kernel/trace/trace_sched_wakeup.c -+++ b/kernel/trace/trace_sched_wakeup.c -@@ -640,7 +640,7 @@ static void start_wakeup_tracer(struct trace_array *tr) - if (ret) { - pr_info("wakeup trace: Couldn't activate tracepoint" - " probe to kernel_sched_migrate_task\n"); -- return; -+ goto fail_deprobe_sched_switch; - } - - wakeup_reset(tr); -@@ -658,6 +658,8 @@ static void start_wakeup_tracer(struct trace_array *tr) - printk(KERN_ERR "failed to start wakeup tracer\n"); - - return; -+fail_deprobe_sched_switch: -+ unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL); - fail_deprobe_wake_new: - unregister_trace_sched_wakeup_new(probe_wakeup, NULL); - fail_deprobe: -diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c -index 719a52a4064a..6f9091f874a9 100644 ---- a/kernel/trace/trace_stack.c -+++ b/kernel/trace/trace_stack.c -@@ -196,6 +196,11 @@ check_stack(unsigned long ip, unsigned long *stack) - local_irq_restore(flags); - } - -+/* Some archs may not define MCOUNT_INSN_SIZE */ -+#ifndef MCOUNT_INSN_SIZE -+# define MCOUNT_INSN_SIZE 0 -+#endif -+ - static void - stack_trace_call(unsigned long ip, unsigned long parent_ip, - struct ftrace_ops *op, struct pt_regs *pt_regs) -diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c -index 356ae7da4f16..e288489ae3d5 100644 ---- a/net/ipv4/netfilter/arp_tables.c -+++ b/net/ipv4/netfilter/arp_tables.c -@@ -394,10 +394,11 @@ next: ; - return 1; - } - --static inline int check_target(struct arpt_entry *e, const char *name) -+static int check_target(struct arpt_entry *e, struct net *net, const char *name) - { - struct xt_entry_target *t = arpt_get_target(e); - struct xt_tgchk_param par = { -+ .net = net, - .table = name, - .entryinfo = e, - .target = t->u.kernel.target, -@@ -409,8 +410,9 @@ static inline int check_target(struct arpt_entry *e, const char *name) - return xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false); - } - --static inline int --find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, -+static int -+find_check_entry(struct arpt_entry *e, struct net *net, const char *name, -+ unsigned int size, - struct xt_percpu_counter_alloc_state *alloc_state) - { - struct xt_entry_target *t; -@@ -429,7 +431,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size, - } - t->u.kernel.target = target; - -- ret = check_target(e, name); -+ ret = check_target(e, net, name); - if (ret) - goto err; - return 0; -@@ -522,7 +524,9 @@ static inline void cleanup_entry(struct arpt_entry *e) - /* Checks and translates the user-supplied table segment (held in - * newinfo). - */ --static int translate_table(struct xt_table_info *newinfo, void *entry0, -+static int translate_table(struct net *net, -+ struct xt_table_info *newinfo, -+ void *entry0, - const struct arpt_replace *repl) - { - struct xt_percpu_counter_alloc_state alloc_state = { 0 }; -@@ -586,7 +590,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, - /* Finally, each sanity check must pass */ - i = 0; - xt_entry_foreach(iter, entry0, newinfo->size) { -- ret = find_check_entry(iter, repl->name, repl->size, -+ ret = find_check_entry(iter, net, repl->name, repl->size, - &alloc_state); - if (ret != 0) - break; -@@ -974,7 +978,7 @@ static int do_replace(struct net *net, const void __user *user, - goto free_newinfo; - } - -- ret = translate_table(newinfo, loc_cpu_entry, &tmp); -+ ret = translate_table(net, newinfo, loc_cpu_entry, &tmp); - if (ret != 0) - goto free_newinfo; - -@@ -1149,7 +1153,8 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr, - } - } - --static int translate_compat_table(struct xt_table_info **pinfo, -+static int translate_compat_table(struct net *net, -+ struct xt_table_info **pinfo, - void **pentry0, - const struct compat_arpt_replace *compatr) - { -@@ -1217,7 +1222,7 @@ static int translate_compat_table(struct xt_table_info **pinfo, - repl.num_counters = 0; - repl.counters = NULL; - repl.size = newinfo->size; -- ret = translate_table(newinfo, entry1, &repl); -+ ret = translate_table(net, newinfo, entry1, &repl); - if (ret) - goto free_newinfo; - -@@ -1270,7 +1275,7 @@ static int compat_do_replace(struct net *net, void __user *user, - goto free_newinfo; - } - -- ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp); -+ ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp); - if (ret != 0) - goto free_newinfo; - -@@ -1546,7 +1551,7 @@ int arpt_register_table(struct net *net, - loc_cpu_entry = newinfo->entries; - memcpy(loc_cpu_entry, repl->entries, repl->size); - -- ret = translate_table(newinfo, loc_cpu_entry, repl); -+ ret = translate_table(net, newinfo, loc_cpu_entry, repl); - if (ret != 0) - goto out_free; - -diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c -index 94d74ec61f42..c2b21c9c1229 100644 ---- a/net/netfilter/ipset/ip_set_core.c -+++ b/net/netfilter/ipset/ip_set_core.c -@@ -1639,6 +1639,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, - struct ip_set *set; - struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {}; - int ret = 0; -+ u32 lineno; - - if (unlikely(protocol_failed(attr) || - !attr[IPSET_ATTR_SETNAME] || -@@ -1655,7 +1656,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, - return -IPSET_ERR_PROTOCOL; - - rcu_read_lock_bh(); -- ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0); -+ ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0); - rcu_read_unlock_bh(); - /* Userspace can't trigger element to be re-added */ - if (ret == -EAGAIN) -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 41e3c77d5fb7..5a7afbeb612d 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -378,6 +378,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) - case 0x10ec0672: - alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */ - break; -+ case 0x10ec0222: - case 0x10ec0623: - alc_update_coef_idx(codec, 0x19, 1<<13, 0); - break; -@@ -396,6 +397,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) - break; - case 0x10ec0899: - case 0x10ec0900: -+ case 0x10ec0b00: - case 0x10ec1168: - case 0x10ec1220: - alc_update_coef_idx(codec, 0x7, 1<<1, 0); -@@ -2389,6 +2391,7 @@ static int patch_alc882(struct hda_codec *codec) - case 0x10ec0882: - case 0x10ec0885: - case 0x10ec0900: -+ case 0x10ec0b00: - case 0x10ec1220: - break; - default: -@@ -8398,6 +8401,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { - HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662), - HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882), - HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882), -+ HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882), - HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882), - HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882), - {} /* terminator */ -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index ad14d6b78bdc..51ee7910e98c 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1143,6 +1143,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) - case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */ - case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ - case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ -+ case USB_ID(0x05a7, 0x1020): /* Bose Companion 5 */ - case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ - case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */ - case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */