From 7783a2fe6b08a623d8aa3a8e6bc8f062daf552da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Igor=20Pe=C4=8Dovnik?= Date: Thu, 9 Dec 2021 11:42:08 +0100 Subject: [PATCH] Odroid XU4 - remove deprecated patches that were breaking build process (#3332) --- .../odroidxu4-5.4/patch-5.4.156-157.patch | 1584 --- .../odroidxu4-5.4/patch-5.4.157-158.patch | 331 - .../odroidxu4-5.4/patch-5.4.158-159.patch | 680 - .../odroidxu4-5.4/patch-5.4.159-160.patch | 10905 ---------------- .../odroidxu4-5.4/patch-5.4.160-161.patch | 309 - .../odroidxu4-5.4/patch-5.4.161-162.patch | 3747 ------ .../odroidxu4-5.4/patch-5.4.162-163.patch | 4555 ------- 7 files changed, 22111 deletions(-) delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.156-157.patch delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.157-158.patch delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.158-159.patch delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.159-160.patch delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.160-161.patch delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.161-162.patch delete mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.162-163.patch diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.156-157.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.156-157.patch deleted file mode 100644 index d821b0a93d..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.156-157.patch +++ /dev/null @@ -1,1584 +0,0 @@ -diff --git a/Makefile b/Makefile -index ced1f0fd48dc6..49d639fe5a801 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 156 -+SUBLEVEL = 157 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c -index aa075d8372ea2..74255e8198314 100644 ---- a/arch/arm/boot/compressed/decompress.c -+++ b/arch/arm/boot/compressed/decompress.c -@@ -47,7 +47,10 @@ extern char * strchrnul(const char *, int); - #endif - - #ifdef CONFIG_KERNEL_XZ -+/* Prevent KASAN override of string helpers in decompressor */ -+#undef memmove - #define memmove memmove -+#undef memcpy - #define memcpy memcpy - #include "../../../../lib/decompress_unxz.c" - #endif -diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S -index 8c74037ade229..b1f366df620b0 100644 ---- a/arch/arm/kernel/vmlinux-xip.lds.S -+++ b/arch/arm/kernel/vmlinux-xip.lds.S -@@ -180,7 +180,7 @@ ASSERT(__hyp_idmap_text_end - (__hyp_idmap_text_start & PAGE_MASK) <= PAGE_SIZE, - ASSERT((_end - __bss_start) >= 12288, ".bss too small for CONFIG_XIP_DEFLATED_DATA") - #endif - --#ifdef CONFIG_ARM_MPU -+#if defined(CONFIG_ARM_MPU) && !defined(CONFIG_COMPILE_TEST) - /* - * Due to PMSAv7 restriction on base address and size we have to - * enforce minimal alignment restrictions. It was seen that weaker -diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S -index 60ac7c5999a98..86e54447dc916 100644 ---- a/arch/arm/mm/proc-macros.S -+++ b/arch/arm/mm/proc-macros.S -@@ -342,6 +342,7 @@ ENTRY(\name\()_cache_fns) - - .macro define_tlb_functions name:req, flags_up:req, flags_smp - .type \name\()_tlb_fns, #object -+ .align 2 - ENTRY(\name\()_tlb_fns) - .long \name\()_flush_user_tlb_range - .long \name\()_flush_kern_tlb_range -diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c -index 90b5bc723c83f..0a783bd4641c5 100644 ---- a/arch/arm/probes/kprobes/core.c -+++ b/arch/arm/probes/kprobes/core.c -@@ -534,7 +534,7 @@ static struct undef_hook kprobes_arm_break_hook = { - - #endif /* !CONFIG_THUMB2_KERNEL */ - --int __init arch_init_kprobes() -+int __init arch_init_kprobes(void) - { - arm_probes_decode_init(); - #ifdef CONFIG_THUMB2_KERNEL -diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts -index 57a6f45036c1f..d7177465b0968 100644 ---- a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts -+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts -@@ -114,7 +114,7 @@ - pinctrl-0 = <&emac_rgmii_pins>; - phy-supply = <®_gmac_3v3>; - phy-handle = <&ext_rgmii_phy>; -- phy-mode = "rgmii"; -+ phy-mode = "rgmii-id"; - status = "okay"; - }; - -diff --git a/arch/nios2/platform/Kconfig.platform b/arch/nios2/platform/Kconfig.platform -index 9e32fb7f3d4ce..e849daff6fd16 100644 ---- a/arch/nios2/platform/Kconfig.platform -+++ b/arch/nios2/platform/Kconfig.platform -@@ -37,6 +37,7 @@ config NIOS2_DTB_PHYS_ADDR - - config NIOS2_DTB_SOURCE_BOOL - bool "Compile and link device tree into kernel image" -+ depends on !COMPILE_TEST - help - This allows you to specify a dts (device tree source) file - which will be compiled and linked into the kernel image. -diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c -index 20bfd753bcba6..81e6279c9874f 100644 ---- a/arch/powerpc/net/bpf_jit_comp64.c -+++ b/arch/powerpc/net/bpf_jit_comp64.c -@@ -408,8 +408,14 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, - case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */ - if (imm == 0) - return -EINVAL; -- else if (imm == 1) -- goto bpf_alu32_trunc; -+ if (imm == 1) { -+ if (BPF_OP(code) == BPF_DIV) { -+ goto bpf_alu32_trunc; -+ } else { -+ PPC_LI(dst_reg, 0); -+ break; -+ } -+ } - - PPC_LI32(b2p[TMP_REG_1], imm); - switch (BPF_CLASS(code)) { -diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c -index fa9483aa4f575..fd73a8aa89d23 100644 ---- a/arch/s390/kvm/interrupt.c -+++ b/arch/s390/kvm/interrupt.c -@@ -2987,13 +2987,14 @@ static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask) - int vcpu_idx, online_vcpus = atomic_read(&kvm->online_vcpus); - struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int; - struct kvm_vcpu *vcpu; -+ u8 vcpu_isc_mask; - - for_each_set_bit(vcpu_idx, kvm->arch.idle_mask, online_vcpus) { - vcpu = kvm_get_vcpu(kvm, vcpu_idx); - if (psw_ioint_disabled(vcpu)) - continue; -- deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6] >> 24); -- if (deliverable_mask) { -+ vcpu_isc_mask = (u8)(vcpu->arch.sie_block->gcr[6] >> 24); -+ if (deliverable_mask & vcpu_isc_mask) { - /* lately kicked but not yet running */ - if (test_and_set_bit(vcpu_idx, gi->kicked_mask)) - return; -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index 9ed2fee612297..b286818d8d54d 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -3092,6 +3092,7 @@ out: - - int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) - { -+ clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.gisa_int.kicked_mask); - return kvm_s390_vcpu_has_irq(vcpu, 0); - } - -diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c -index d1ed9679c7177..3fca3e13ed6ae 100644 ---- a/drivers/ata/sata_mv.c -+++ b/drivers/ata/sata_mv.c -@@ -3892,8 +3892,8 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx) - break; - - default: -- dev_err(host->dev, "BUG: invalid board index %u\n", board_idx); -- return 1; -+ dev_alert(host->dev, "BUG: invalid board index %u\n", board_idx); -+ return -EINVAL; - } - - hpriv->hp_flags = hp_flags; -diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c -index cfa29dc89bbff..fabf87058d80b 100644 ---- a/drivers/base/regmap/regcache-rbtree.c -+++ b/drivers/base/regmap/regcache-rbtree.c -@@ -281,14 +281,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, - if (!blk) - return -ENOMEM; - -+ rbnode->block = blk; -+ - if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { - present = krealloc(rbnode->cache_present, - BITS_TO_LONGS(blklen) * sizeof(*present), - GFP_KERNEL); -- if (!present) { -- kfree(blk); -+ if (!present) - return -ENOMEM; -- } - - memset(present + BITS_TO_LONGS(rbnode->blklen), 0, - (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen)) -@@ -305,7 +305,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, - } - - /* update the rbnode block, its size and the base register */ -- rbnode->block = blk; - rbnode->blklen = blklen; - rbnode->base_reg = base_reg; - rbnode->cache_present = present; -diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c -index fe81c565e7ef8..a7b88ca8b97b3 100644 ---- a/drivers/gpu/drm/ttm/ttm_bo_util.c -+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c -@@ -463,6 +463,7 @@ static void ttm_transfered_destroy(struct ttm_buffer_object *bo) - struct ttm_transfer_obj *fbo; - - fbo = container_of(bo, struct ttm_transfer_obj, base); -+ dma_resv_fini(&fbo->base.base._resv); - ttm_bo_put(fbo->bo); - kfree(fbo); - } -diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c -index d2d70c89193ff..11ab6390eda4d 100644 ---- a/drivers/infiniband/core/sa_query.c -+++ b/drivers/infiniband/core/sa_query.c -@@ -760,8 +760,9 @@ static void ib_nl_set_path_rec_attrs(struct sk_buff *skb, - - /* Construct the family header first */ - header = skb_put(skb, NLMSG_ALIGN(sizeof(*header))); -- memcpy(header->device_name, dev_name(&query->port->agent->device->dev), -- LS_DEVICE_NAME_MAX); -+ strscpy_pad(header->device_name, -+ dev_name(&query->port->agent->device->dev), -+ LS_DEVICE_NAME_MAX); - header->port_num = query->port->port_num; - - if ((comp_mask & IB_SA_PATH_REC_REVERSIBLE) && -diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c -index 79126b2b14ab0..1a82ea73a0fc2 100644 ---- a/drivers/infiniband/hw/hfi1/pio.c -+++ b/drivers/infiniband/hw/hfi1/pio.c -@@ -920,6 +920,7 @@ void sc_disable(struct send_context *sc) - { - u64 reg; - struct pio_buf *pbuf; -+ LIST_HEAD(wake_list); - - if (!sc) - return; -@@ -954,19 +955,21 @@ void sc_disable(struct send_context *sc) - spin_unlock(&sc->release_lock); - - write_seqlock(&sc->waitlock); -- while (!list_empty(&sc->piowait)) { -+ if (!list_empty(&sc->piowait)) -+ list_move(&sc->piowait, &wake_list); -+ write_sequnlock(&sc->waitlock); -+ while (!list_empty(&wake_list)) { - struct iowait *wait; - struct rvt_qp *qp; - struct hfi1_qp_priv *priv; - -- wait = list_first_entry(&sc->piowait, struct iowait, list); -+ wait = list_first_entry(&wake_list, struct iowait, list); - qp = iowait_to_qp(wait); - priv = qp->priv; - list_del_init(&priv->s_iowait.list); - priv->s_iowait.lock = NULL; - hfi1_qp_wakeup(qp, RVT_S_WAIT_PIO | HFI1_S_WAIT_PIO_DRAIN); - } -- write_sequnlock(&sc->waitlock); - - spin_unlock_irq(&sc->alloc_lock); - } -diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c -index 4540835e05bda..634f29cb7395c 100644 ---- a/drivers/infiniband/hw/mlx5/qp.c -+++ b/drivers/infiniband/hw/mlx5/qp.c -@@ -3865,6 +3865,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr, - MLX5_SET(dctc, dctc, mtu, attr->path_mtu); - MLX5_SET(dctc, dctc, my_addr_index, attr->ah_attr.grh.sgid_index); - MLX5_SET(dctc, dctc, hop_limit, attr->ah_attr.grh.hop_limit); -+ if (attr->ah_attr.type == RDMA_AH_ATTR_TYPE_ROCE) -+ MLX5_SET(dctc, dctc, eth_prio, attr->ah_attr.sl & 0x7); - - err = mlx5_core_create_dct(dev->mdev, &qp->dct.mdct, qp->dct.in, - MLX5_ST_SZ_BYTES(create_dct_in), out, -diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c -index 05190edc2611e..5fd28574124fb 100644 ---- a/drivers/infiniband/hw/qib/qib_user_sdma.c -+++ b/drivers/infiniband/hw/qib/qib_user_sdma.c -@@ -602,7 +602,7 @@ done: - /* - * How many pages in this iovec element? - */ --static int qib_user_sdma_num_pages(const struct iovec *iov) -+static size_t qib_user_sdma_num_pages(const struct iovec *iov) - { - const unsigned long addr = (unsigned long) iov->iov_base; - const unsigned long len = iov->iov_len; -@@ -658,7 +658,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev, - static int qib_user_sdma_pin_pages(const struct qib_devdata *dd, - struct qib_user_sdma_queue *pq, - struct qib_user_sdma_pkt *pkt, -- unsigned long addr, int tlen, int npages) -+ unsigned long addr, int tlen, size_t npages) - { - struct page *pages[8]; - int i, j; -@@ -722,7 +722,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd, - unsigned long idx; - - for (idx = 0; idx < niov; idx++) { -- const int npages = qib_user_sdma_num_pages(iov + idx); -+ const size_t npages = qib_user_sdma_num_pages(iov + idx); - const unsigned long addr = (unsigned long) iov[idx].iov_base; - - ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr, -@@ -824,8 +824,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, - unsigned pktnw; - unsigned pktnwc; - int nfrags = 0; -- int npages = 0; -- int bytes_togo = 0; -+ size_t npages = 0; -+ size_t bytes_togo = 0; - int tiddma = 0; - int cfur; - -@@ -885,7 +885,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, - - npages += qib_user_sdma_num_pages(&iov[idx]); - -- bytes_togo += slen; -+ if (check_add_overflow(bytes_togo, slen, &bytes_togo) || -+ bytes_togo > type_max(typeof(pkt->bytes_togo))) { -+ ret = -EINVAL; -+ goto free_pbc; -+ } - pktnwc += slen >> 2; - idx++; - nfrags++; -@@ -904,8 +908,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, - } - - if (frag_size) { -- int tidsmsize, n; -- size_t pktsize; -+ size_t tidsmsize, n, pktsize, sz, addrlimit; - - n = npages*((2*PAGE_SIZE/frag_size)+1); - pktsize = struct_size(pkt, addr, n); -@@ -923,14 +926,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, - else - tidsmsize = 0; - -- pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL); -+ if (check_add_overflow(pktsize, tidsmsize, &sz)) { -+ ret = -EINVAL; -+ goto free_pbc; -+ } -+ pkt = kmalloc(sz, GFP_KERNEL); - if (!pkt) { - ret = -ENOMEM; - goto free_pbc; - } - pkt->largepkt = 1; - pkt->frag_size = frag_size; -- pkt->addrlimit = n + ARRAY_SIZE(pkt->addr); -+ if (check_add_overflow(n, ARRAY_SIZE(pkt->addr), -+ &addrlimit) || -+ addrlimit > type_max(typeof(pkt->addrlimit))) { -+ ret = -EINVAL; -+ goto free_pbc; -+ } -+ pkt->addrlimit = addrlimit; - - if (tiddma) { - char *tidsm = (char *)pkt + pktsize; -diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c -index 2d65b32d205a5..ec56464eaf23e 100644 ---- a/drivers/mmc/host/cqhci.c -+++ b/drivers/mmc/host/cqhci.c -@@ -273,6 +273,9 @@ static void __cqhci_enable(struct cqhci_host *cq_host) - - cqhci_writel(cq_host, cqcfg, CQHCI_CFG); - -+ if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT) -+ cqhci_writel(cq_host, 0, CQHCI_CTL); -+ - mmc->cqe_on = true; - - if (cq_host->ops->enable) -diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c -index 5e3d95b636769..ae2c74186e1d2 100644 ---- a/drivers/mmc/host/dw_mmc-exynos.c -+++ b/drivers/mmc/host/dw_mmc-exynos.c -@@ -462,6 +462,18 @@ static s8 dw_mci_exynos_get_best_clksmpl(u8 candiates) - } - } - -+ /* -+ * If there is no cadiates value, then it needs to return -EIO. -+ * If there are candiates values and don't find bset clk sample value, -+ * then use a first candiates clock sample value. -+ */ -+ for (i = 0; i < iter; i++) { -+ __c = ror8(candiates, i); -+ if ((__c & 0x1) == 0x1) { -+ loc = i; -+ goto out; -+ } -+ } - out: - return loc; - } -@@ -492,6 +504,8 @@ static int dw_mci_exynos_execute_tuning(struct dw_mci_slot *slot, u32 opcode) - priv->tuned_sample = found; - } else { - ret = -EIO; -+ dev_warn(&mmc->class_dev, -+ "There is no candiates value about clksmpl!\n"); - } - - return ret; -diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c -index 771676209005b..2c01e2ebef7aa 100644 ---- a/drivers/mmc/host/sdhci-esdhc-imx.c -+++ b/drivers/mmc/host/sdhci-esdhc-imx.c -@@ -24,6 +24,7 @@ - #include - #include - #include -+#include - #include "sdhci-pltfm.h" - #include "sdhci-esdhc.h" - #include "cqhci.h" -@@ -1022,6 +1023,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host) - struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); - struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host); - u32 ctrl; -+ int ret; - - /* Reset the tuning circuit */ - if (esdhc_is_usdhc(imx_data)) { -@@ -1034,7 +1036,22 @@ static void esdhc_reset_tuning(struct sdhci_host *host) - } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) { - ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS); - ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL; -+ ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE; - writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS); -+ /* Make sure ESDHC_MIX_CTRL_EXE_TUNE cleared */ -+ ret = readl_poll_timeout(host->ioaddr + SDHCI_AUTO_CMD_STATUS, -+ ctrl, !(ctrl & ESDHC_MIX_CTRL_EXE_TUNE), 1, 50); -+ if (ret == -ETIMEDOUT) -+ dev_warn(mmc_dev(host->mmc), -+ "Warning! clear execute tuning bit failed\n"); -+ /* -+ * SDHCI_INT_DATA_AVAIL is W1C bit, set this bit will clear the -+ * usdhc IP internal logic flag execute_tuning_with_clr_buf, which -+ * will finally make sure the normal data transfer logic correct. -+ */ -+ ctrl = readl(host->ioaddr + SDHCI_INT_STATUS); -+ ctrl |= SDHCI_INT_DATA_AVAIL; -+ writel(ctrl, host->ioaddr + SDHCI_INT_STATUS); - } - } - } -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 2ecd9acebb2f0..cb54fa2120d72 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -1741,6 +1741,12 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode, - break; - case MMC_VDD_32_33: - case MMC_VDD_33_34: -+ /* -+ * 3.4 ~ 3.6V are valid only for those platforms where it's -+ * known that the voltage range is supported by hardware. -+ */ -+ case MMC_VDD_34_35: -+ case MMC_VDD_35_36: - pwr = SDHCI_POWER_330; - break; - default: -diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c -index 156046e56a584..5e1d7025dbf78 100644 ---- a/drivers/mmc/host/vub300.c -+++ b/drivers/mmc/host/vub300.c -@@ -576,7 +576,7 @@ static void check_vub300_port_status(struct vub300_mmc_host *vub300) - GET_SYSTEM_PORT_STATUS, - USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x0000, 0x0000, &vub300->system_port_status, -- sizeof(vub300->system_port_status), HZ); -+ sizeof(vub300->system_port_status), 1000); - if (sizeof(vub300->system_port_status) == retval) - new_system_port_status(vub300); - } -@@ -1241,7 +1241,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300, - SET_INTERRUPT_PSEUDOCODE, - USB_DIR_OUT | USB_TYPE_VENDOR | - USB_RECIP_DEVICE, 0x0000, 0x0000, -- xfer_buffer, xfer_length, HZ); -+ xfer_buffer, xfer_length, 1000); - kfree(xfer_buffer); - if (retval < 0) - goto copy_error_message; -@@ -1284,7 +1284,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300, - SET_TRANSFER_PSEUDOCODE, - USB_DIR_OUT | USB_TYPE_VENDOR | - USB_RECIP_DEVICE, 0x0000, 0x0000, -- xfer_buffer, xfer_length, HZ); -+ xfer_buffer, xfer_length, 1000); - kfree(xfer_buffer); - if (retval < 0) - goto copy_error_message; -@@ -1991,7 +1991,7 @@ static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8], - usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), - SET_CLOCK_SPEED, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- 0x00, 0x00, buf, buf_array_size, HZ); -+ 0x00, 0x00, buf, buf_array_size, 1000); - if (retval != 8) { - dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED" - " %dkHz failed with retval=%d\n", kHzClock, retval); -@@ -2013,14 +2013,14 @@ static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) - usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), - SET_SD_POWER, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- 0x0000, 0x0000, NULL, 0, HZ); -+ 0x0000, 0x0000, NULL, 0, 1000); - /* must wait for the VUB300 u-proc to boot up */ - msleep(600); - } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) { - usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), - SET_SD_POWER, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- 0x0001, 0x0000, NULL, 0, HZ); -+ 0x0001, 0x0000, NULL, 0, 1000); - msleep(600); - vub300->card_powered = 1; - } else if (ios->power_mode == MMC_POWER_ON) { -@@ -2282,14 +2282,14 @@ static int vub300_probe(struct usb_interface *interface, - GET_HC_INF0, - USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x0000, 0x0000, &vub300->hc_info, -- sizeof(vub300->hc_info), HZ); -+ sizeof(vub300->hc_info), 1000); - if (retval < 0) - goto error5; - retval = - usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), - SET_ROM_WAIT_STATES, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- firmware_rom_wait_states, 0x0000, NULL, 0, HZ); -+ firmware_rom_wait_states, 0x0000, NULL, 0, 1000); - if (retval < 0) - goto error5; - dev_info(&vub300->udev->dev, -@@ -2304,7 +2304,7 @@ static int vub300_probe(struct usb_interface *interface, - GET_SYSTEM_PORT_STATUS, - USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x0000, 0x0000, &vub300->system_port_status, -- sizeof(vub300->system_port_status), HZ); -+ sizeof(vub300->system_port_status), 1000); - if (retval < 0) { - goto error4; - } else if (sizeof(vub300->system_port_status) == retval) { -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 1949f631e1bc5..a7eaf80f500c0 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1219,7 +1219,7 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb) - skb->dev = bond->dev; - - if (BOND_MODE(bond) == BOND_MODE_ALB && -- bond->dev->priv_flags & IFF_BRIDGE_PORT && -+ netif_is_bridge_port(bond->dev) && - skb->pkt_type == PACKET_HOST) { - - if (unlikely(skb_cow_head(skb, -diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c -index 7dc451fdaf35e..2431723bc2fb4 100644 ---- a/drivers/net/ethernet/micrel/ksz884x.c -+++ b/drivers/net/ethernet/micrel/ksz884x.c -@@ -5693,7 +5693,7 @@ static void dev_set_promiscuous(struct net_device *dev, struct dev_priv *priv, - * from the bridge. - */ - if ((hw->features & STP_SUPPORT) && !promiscuous && -- (dev->priv_flags & IFF_BRIDGE_PORT)) { -+ netif_is_bridge_port(dev)) { - struct ksz_switch *sw = hw->ksz_switch; - int port = priv->port.first_port; - -diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c -index dfa0ded169ee9..a109120da0e7c 100644 ---- a/drivers/net/ethernet/microchip/lan743x_main.c -+++ b/drivers/net/ethernet/microchip/lan743x_main.c -@@ -1706,6 +1706,16 @@ static int lan743x_tx_ring_init(struct lan743x_tx *tx) - ret = -EINVAL; - goto cleanup; - } -+ if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev, -+ DMA_BIT_MASK(64))) { -+ if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev, -+ DMA_BIT_MASK(32))) { -+ dev_warn(&tx->adapter->pdev->dev, -+ "lan743x_: No suitable DMA available\n"); -+ ret = -ENOMEM; -+ goto cleanup; -+ } -+ } - ring_allocation_size = ALIGN(tx->ring_size * - sizeof(struct lan743x_tx_descriptor), - PAGE_SIZE); -@@ -2256,6 +2266,16 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx) - ret = -EINVAL; - goto cleanup; - } -+ if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev, -+ DMA_BIT_MASK(64))) { -+ if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev, -+ DMA_BIT_MASK(32))) { -+ dev_warn(&rx->adapter->pdev->dev, -+ "lan743x_: No suitable DMA available\n"); -+ ret = -ENOMEM; -+ goto cleanup; -+ } -+ } - ring_allocation_size = ALIGN(rx->ring_size * - sizeof(struct lan743x_rx_descriptor), - PAGE_SIZE); -@@ -3001,6 +3021,8 @@ static int lan743x_pm_resume(struct device *dev) - if (ret) { - netif_err(adapter, probe, adapter->netdev, - "lan743x_hardware_init returned %d\n", ret); -+ lan743x_pci_cleanup(adapter); -+ return ret; - } - - /* open netdev when netdev is at running state while resume. -diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c -index 1d59ef367a85c..3b177421651f1 100644 ---- a/drivers/net/ethernet/nxp/lpc_eth.c -+++ b/drivers/net/ethernet/nxp/lpc_eth.c -@@ -1007,9 +1007,6 @@ static int lpc_eth_close(struct net_device *ndev) - napi_disable(&pldat->napi); - netif_stop_queue(ndev); - -- if (ndev->phydev) -- phy_stop(ndev->phydev); -- - spin_lock_irqsave(&pldat->lock, flags); - __lpc_eth_reset(pldat); - netif_carrier_off(ndev); -@@ -1017,6 +1014,8 @@ static int lpc_eth_close(struct net_device *ndev) - writel(0, LPC_ENET_MAC2(pldat->net_base)); - spin_unlock_irqrestore(&pldat->lock, flags); - -+ if (ndev->phydev) -+ phy_stop(ndev->phydev); - clk_disable_unprepare(pldat->clk); - - return 0; -diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c -index 8377ff229a303..bec73f0640d03 100644 ---- a/drivers/net/phy/mdio_bus.c -+++ b/drivers/net/phy/mdio_bus.c -@@ -395,7 +395,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) - err = device_register(&bus->dev); - if (err) { - pr_err("mii_bus %s failed to register\n", bus->id); -- put_device(&bus->dev); - return -EINVAL; - } - -diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c -index b0b8a3ce82b68..6c52ff8c0d2eb 100644 ---- a/drivers/net/phy/phy.c -+++ b/drivers/net/phy/phy.c -@@ -367,6 +367,7 @@ EXPORT_SYMBOL(phy_ethtool_ksettings_set); - void phy_ethtool_ksettings_get(struct phy_device *phydev, - struct ethtool_link_ksettings *cmd) - { -+ mutex_lock(&phydev->lock); - linkmode_copy(cmd->link_modes.supported, phydev->supported); - linkmode_copy(cmd->link_modes.advertising, phydev->advertising); - linkmode_copy(cmd->link_modes.lp_advertising, phydev->lp_advertising); -@@ -383,6 +384,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev, - cmd->base.autoneg = phydev->autoneg; - cmd->base.eth_tp_mdix_ctrl = phydev->mdix_ctrl; - cmd->base.eth_tp_mdix = phydev->mdix; -+ mutex_unlock(&phydev->lock); - } - EXPORT_SYMBOL(phy_ethtool_ksettings_get); - -@@ -553,7 +555,7 @@ static int phy_check_link_status(struct phy_device *phydev) - } - - /** -- * phy_start_aneg - start auto-negotiation for this PHY device -+ * _phy_start_aneg - start auto-negotiation for this PHY device - * @phydev: the phy_device struct - * - * Description: Sanitizes the settings (if we're not autonegotiating -@@ -561,25 +563,43 @@ static int phy_check_link_status(struct phy_device *phydev) - * If the PHYCONTROL Layer is operating, we change the state to - * reflect the beginning of Auto-negotiation or forcing. - */ --int phy_start_aneg(struct phy_device *phydev) -+static int _phy_start_aneg(struct phy_device *phydev) - { - int err; - -+ lockdep_assert_held(&phydev->lock); -+ - if (!phydev->drv) - return -EIO; - -- mutex_lock(&phydev->lock); -- - if (AUTONEG_DISABLE == phydev->autoneg) - phy_sanitize_settings(phydev); - - err = phy_config_aneg(phydev); - if (err < 0) -- goto out_unlock; -+ return err; - - if (phy_is_started(phydev)) - err = phy_check_link_status(phydev); --out_unlock: -+ -+ return err; -+} -+ -+/** -+ * phy_start_aneg - start auto-negotiation for this PHY device -+ * @phydev: the phy_device struct -+ * -+ * Description: Sanitizes the settings (if we're not autonegotiating -+ * them), and then calls the driver's config_aneg function. -+ * If the PHYCONTROL Layer is operating, we change the state to -+ * reflect the beginning of Auto-negotiation or forcing. -+ */ -+int phy_start_aneg(struct phy_device *phydev) -+{ -+ int err; -+ -+ mutex_lock(&phydev->lock); -+ err = _phy_start_aneg(phydev); - mutex_unlock(&phydev->lock); - - return err; -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 92d9d3407b79b..fe830b72c3b0f 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -3753,6 +3753,12 @@ static int lan78xx_probe(struct usb_interface *intf, - - dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1); - -+ /* Reject broken descriptors. */ -+ if (dev->maxpacket == 0) { -+ ret = -ENODEV; -+ goto out4; -+ } -+ - /* driver requires remote-wakeup capability during autosuspend. */ - intf->needs_remote_wakeup = 1; - -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index dde05e2fdc3e6..b8b9df82f51ef 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -1773,6 +1773,11 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) - if (!dev->rx_urb_size) - dev->rx_urb_size = dev->hard_mtu; - dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1); -+ if (dev->maxpacket == 0) { -+ /* that is a broken device */ -+ status = -ENODEV; -+ goto out4; -+ } - - /* let userspace know we have a random address */ - if (ether_addr_equal(net->dev_addr, node_id)) -diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c -index 8e4d355dc3aec..1caebefb25ff1 100644 ---- a/drivers/nfc/port100.c -+++ b/drivers/nfc/port100.c -@@ -1003,11 +1003,11 @@ static u64 port100_get_command_type_mask(struct port100 *dev) - - skb = port100_alloc_skb(dev, 0); - if (!skb) -- return -ENOMEM; -+ return 0; - - resp = port100_send_cmd_sync(dev, PORT100_CMD_GET_COMMAND_TYPE, skb); - if (IS_ERR(resp)) -- return PTR_ERR(resp); -+ return 0; - - if (resp->len < 8) - mask = 0; -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index 38bbbbbc6f47f..ff0d06e8ebb53 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -962,7 +962,7 @@ static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req) - int ret; - struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_EOR }; - struct kvec iov = { -- .iov_base = &req->ddgst + req->offset, -+ .iov_base = (u8 *)&req->ddgst + req->offset, - .iov_len = NVME_TCP_DIGEST_LENGTH - req->offset - }; - -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index 2ae846297d7ca..2f4e512bd449f 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -633,7 +633,7 @@ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd) - struct nvmet_tcp_queue *queue = cmd->queue; - struct msghdr msg = { .msg_flags = MSG_DONTWAIT }; - struct kvec iov = { -- .iov_base = &cmd->exp_ddgst + cmd->offset, -+ .iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset, - .iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset - }; - int ret; -diff --git a/drivers/pinctrl/bcm/pinctrl-ns.c b/drivers/pinctrl/bcm/pinctrl-ns.c -index e79690bd8b85f..d7f8175d2c1c8 100644 ---- a/drivers/pinctrl/bcm/pinctrl-ns.c -+++ b/drivers/pinctrl/bcm/pinctrl-ns.c -@@ -5,7 +5,6 @@ - - #include - #include --#include - #include - #include - #include -@@ -13,7 +12,6 @@ - #include - #include - #include --#include - #include - - #define FLAG_BCM4708 BIT(1) -@@ -24,8 +22,7 @@ struct ns_pinctrl { - struct device *dev; - unsigned int chipset_flag; - struct pinctrl_dev *pctldev; -- struct regmap *regmap; -- u32 offset; -+ void __iomem *base; - - struct pinctrl_desc pctldesc; - struct ns_pinctrl_group *groups; -@@ -232,9 +229,9 @@ static int ns_pinctrl_set_mux(struct pinctrl_dev *pctrl_dev, - unset |= BIT(pin_number); - } - -- regmap_read(ns_pinctrl->regmap, ns_pinctrl->offset, &tmp); -+ tmp = readl(ns_pinctrl->base); - tmp &= ~unset; -- regmap_write(ns_pinctrl->regmap, ns_pinctrl->offset, tmp); -+ writel(tmp, ns_pinctrl->base); - - return 0; - } -@@ -266,13 +263,13 @@ static const struct of_device_id ns_pinctrl_of_match_table[] = { - static int ns_pinctrl_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; -- struct device_node *np = dev->of_node; - const struct of_device_id *of_id; - struct ns_pinctrl *ns_pinctrl; - struct pinctrl_desc *pctldesc; - struct pinctrl_pin_desc *pin; - struct ns_pinctrl_group *group; - struct ns_pinctrl_function *function; -+ struct resource *res; - int i; - - ns_pinctrl = devm_kzalloc(dev, sizeof(*ns_pinctrl), GFP_KERNEL); -@@ -290,18 +287,12 @@ static int ns_pinctrl_probe(struct platform_device *pdev) - return -EINVAL; - ns_pinctrl->chipset_flag = (uintptr_t)of_id->data; - -- ns_pinctrl->regmap = syscon_node_to_regmap(of_get_parent(np)); -- if (IS_ERR(ns_pinctrl->regmap)) { -- int err = PTR_ERR(ns_pinctrl->regmap); -- -- dev_err(dev, "Failed to map pinctrl regs: %d\n", err); -- -- return err; -- } -- -- if (of_property_read_u32(np, "offset", &ns_pinctrl->offset)) { -- dev_err(dev, "Failed to get register offset\n"); -- return -ENOENT; -+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, -+ "cru_gpio_control"); -+ ns_pinctrl->base = devm_ioremap_resource(dev, res); -+ if (IS_ERR(ns_pinctrl->base)) { -+ dev_err(dev, "Failed to map pinctrl regs\n"); -+ return PTR_ERR(ns_pinctrl->base); - } - - memcpy(pctldesc, &ns_pinctrl_desc, sizeof(*pctldesc)); -diff --git a/include/net/tls.h b/include/net/tls.h -index 697df45c0bcee..7f220e03ebb2d 100644 ---- a/include/net/tls.h -+++ b/include/net/tls.h -@@ -360,6 +360,7 @@ int tls_sk_query(struct sock *sk, int optname, char __user *optval, - int __user *optlen); - int tls_sk_attach(struct sock *sk, int optname, char __user *optval, - unsigned int optlen); -+void tls_err_abort(struct sock *sk, int err); - - int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx); - void tls_sw_strparser_arm(struct sock *sk, struct tls_context *ctx); -@@ -465,12 +466,6 @@ static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk) - #endif - } - --static inline void tls_err_abort(struct sock *sk, int err) --{ -- sk->sk_err = err; -- sk->sk_error_report(sk); --} -- - static inline bool tls_bigint_increment(unsigned char *seq, int len) - { - int i; -@@ -499,7 +494,7 @@ static inline void tls_advance_record_sn(struct sock *sk, - struct cipher_context *ctx) - { - if (tls_bigint_increment(ctx->rec_seq, prot->rec_seq_size)) -- tls_err_abort(sk, EBADMSG); -+ tls_err_abort(sk, -EBADMSG); - - if (prot->version != TLS_1_3_VERSION) - tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, -diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c -index a6b26ca5c6973..2e818eca3e1c6 100644 ---- a/net/batman-adv/bridge_loop_avoidance.c -+++ b/net/batman-adv/bridge_loop_avoidance.c -@@ -1561,10 +1561,14 @@ int batadv_bla_init(struct batadv_priv *bat_priv) - return 0; - - bat_priv->bla.claim_hash = batadv_hash_new(128); -- bat_priv->bla.backbone_hash = batadv_hash_new(32); -+ if (!bat_priv->bla.claim_hash) -+ return -ENOMEM; - -- if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash) -+ bat_priv->bla.backbone_hash = batadv_hash_new(32); -+ if (!bat_priv->bla.backbone_hash) { -+ batadv_hash_destroy(bat_priv->bla.claim_hash); - return -ENOMEM; -+ } - - batadv_hash_set_lock_class(bat_priv->bla.claim_hash, - &batadv_claim_hash_lock_class_key); -diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c -index 4a89177def647..6a183c94cdeb4 100644 ---- a/net/batman-adv/main.c -+++ b/net/batman-adv/main.c -@@ -197,29 +197,41 @@ int batadv_mesh_init(struct net_device *soft_iface) - - bat_priv->gw.generation = 0; - -- ret = batadv_v_mesh_init(bat_priv); -- if (ret < 0) -- goto err; -- - ret = batadv_originator_init(bat_priv); -- if (ret < 0) -- goto err; -+ if (ret < 0) { -+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); -+ goto err_orig; -+ } - - ret = batadv_tt_init(bat_priv); -- if (ret < 0) -- goto err; -+ if (ret < 0) { -+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); -+ goto err_tt; -+ } -+ -+ ret = batadv_v_mesh_init(bat_priv); -+ if (ret < 0) { -+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); -+ goto err_v; -+ } - - ret = batadv_bla_init(bat_priv); -- if (ret < 0) -- goto err; -+ if (ret < 0) { -+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); -+ goto err_bla; -+ } - - ret = batadv_dat_init(bat_priv); -- if (ret < 0) -- goto err; -+ if (ret < 0) { -+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); -+ goto err_dat; -+ } - - ret = batadv_nc_mesh_init(bat_priv); -- if (ret < 0) -- goto err; -+ if (ret < 0) { -+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); -+ goto err_nc; -+ } - - batadv_gw_init(bat_priv); - batadv_mcast_init(bat_priv); -@@ -229,8 +241,20 @@ int batadv_mesh_init(struct net_device *soft_iface) - - return 0; - --err: -- batadv_mesh_free(soft_iface); -+err_nc: -+ batadv_dat_free(bat_priv); -+err_dat: -+ batadv_bla_free(bat_priv); -+err_bla: -+ batadv_v_mesh_free(bat_priv); -+err_v: -+ batadv_tt_free(bat_priv); -+err_tt: -+ batadv_originator_free(bat_priv); -+err_orig: -+ batadv_purge_outstanding_packets(bat_priv, NULL); -+ atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE); -+ - return ret; - } - -diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c -index 70e3b161c6635..850f927f33de2 100644 ---- a/net/batman-adv/network-coding.c -+++ b/net/batman-adv/network-coding.c -@@ -155,8 +155,10 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv) - &batadv_nc_coding_hash_lock_class_key); - - bat_priv->nc.decoding_hash = batadv_hash_new(128); -- if (!bat_priv->nc.decoding_hash) -+ if (!bat_priv->nc.decoding_hash) { -+ batadv_hash_destroy(bat_priv->nc.coding_hash); - goto err; -+ } - - batadv_hash_set_lock_class(bat_priv->nc.decoding_hash, - &batadv_nc_decoding_hash_lock_class_key); -diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c -index c5271ea4dc832..515205d7b650f 100644 ---- a/net/batman-adv/translation-table.c -+++ b/net/batman-adv/translation-table.c -@@ -4405,8 +4405,10 @@ int batadv_tt_init(struct batadv_priv *bat_priv) - return ret; - - ret = batadv_tt_global_init(bat_priv); -- if (ret < 0) -+ if (ret < 0) { -+ batadv_tt_local_table_free(bat_priv); - return ret; -+ } - - batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1, - batadv_tt_tvlv_unicast_handler_v1, -diff --git a/net/core/dev.c b/net/core/dev.c -index 3810eaf89b266..e4e492bf72af0 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2787,6 +2787,12 @@ static u16 skb_tx_hash(const struct net_device *dev, - - qoffset = sb_dev->tc_to_txq[tc].offset; - qcount = sb_dev->tc_to_txq[tc].count; -+ if (unlikely(!qcount)) { -+ net_warn_ratelimited("%s: invalid qcount, qoffset %u for tc %u\n", -+ sb_dev->name, qoffset, tc); -+ qoffset = 0; -+ qcount = dev->real_num_tx_queues; -+ } - } - - if (skb_rx_queue_recorded(skb)) { -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index a53b101ce41ae..55c0f32b9375b 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -3729,7 +3729,7 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, - - /* Support fdb on master device the net/bridge default case */ - if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) && -- (dev->priv_flags & IFF_BRIDGE_PORT)) { -+ netif_is_bridge_port(dev)) { - struct net_device *br_dev = netdev_master_upper_dev_get(dev); - const struct net_device_ops *ops = br_dev->netdev_ops; - -@@ -3840,7 +3840,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh, - - /* Support fdb on master device the net/bridge default case */ - if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) && -- (dev->priv_flags & IFF_BRIDGE_PORT)) { -+ netif_is_bridge_port(dev)) { - struct net_device *br_dev = netdev_master_upper_dev_get(dev); - const struct net_device_ops *ops = br_dev->netdev_ops; - -@@ -4066,13 +4066,13 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb) - continue; - - if (!br_idx) { /* user did not specify a specific bridge */ -- if (dev->priv_flags & IFF_BRIDGE_PORT) { -+ if (netif_is_bridge_port(dev)) { - br_dev = netdev_master_upper_dev_get(dev); - cops = br_dev->netdev_ops; - } - } else { - if (dev != br_dev && -- !(dev->priv_flags & IFF_BRIDGE_PORT)) -+ !netif_is_bridge_port(dev)) - continue; - - if (br_dev != netdev_master_upper_dev_get(dev) && -@@ -4084,7 +4084,7 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb) - if (idx < s_idx) - goto cont; - -- if (dev->priv_flags & IFF_BRIDGE_PORT) { -+ if (netif_is_bridge_port(dev)) { - if (cops && cops->ndo_fdb_dump) { - err = cops->ndo_fdb_dump(skb, cb, - br_dev, dev, -@@ -4234,7 +4234,7 @@ static int rtnl_fdb_get(struct sk_buff *in_skb, struct nlmsghdr *nlh, - - if (dev) { - if (!ndm_flags || (ndm_flags & NTF_MASTER)) { -- if (!(dev->priv_flags & IFF_BRIDGE_PORT)) { -+ if (!netif_is_bridge_port(dev)) { - NL_SET_ERR_MSG(extack, "Device is not a bridge port"); - return -EINVAL; - } -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 539492998864e..d1feec97fa062 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -631,14 +631,14 @@ static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash) - kfree_rcu(oldest, rcu); - } - --static inline u32 fnhe_hashfun(__be32 daddr) -+static u32 fnhe_hashfun(__be32 daddr) - { -- static u32 fnhe_hashrnd __read_mostly; -- u32 hval; -+ static siphash_key_t fnhe_hash_key __read_mostly; -+ u64 hval; - -- net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd)); -- hval = jhash_1word((__force u32) daddr, fnhe_hashrnd); -- return hash_32(hval, FNHE_HASH_SHIFT); -+ net_get_random_once(&fnhe_hash_key, sizeof(fnhe_hash_key)); -+ hval = siphash_1u32((__force u32)daddr, &fnhe_hash_key); -+ return hash_64(hval, FNHE_HASH_SHIFT); - } - - static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe) -diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c -index 6a0c4326d9cf2..7df7ec74807ac 100644 ---- a/net/ipv4/tcp_bpf.c -+++ b/net/ipv4/tcp_bpf.c -@@ -313,6 +313,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, - bool cork = false, enospc = sk_msg_full(msg); - struct sock *sk_redir; - u32 tosend, delta = 0; -+ u32 eval = __SK_NONE; - int ret; - - more_data: -@@ -356,13 +357,24 @@ more_data: - case __SK_REDIRECT: - sk_redir = psock->sk_redir; - sk_msg_apply_bytes(psock, tosend); -+ if (!psock->apply_bytes) { -+ /* Clean up before releasing the sock lock. */ -+ eval = psock->eval; -+ psock->eval = __SK_NONE; -+ psock->sk_redir = NULL; -+ } - if (psock->cork) { - cork = true; - psock->cork = NULL; - } - sk_msg_return(sk, msg, tosend); - release_sock(sk); -+ - ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags); -+ -+ if (eval == __SK_REDIRECT) -+ sock_put(sk_redir); -+ - lock_sock(sk); - if (unlikely(ret < 0)) { - int free = sk_msg_free_nocharge(sk, msg); -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 3fb259c20546e..daa876c6ae8db 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -41,6 +41,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1502,17 +1503,24 @@ static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket) - static u32 rt6_exception_hash(const struct in6_addr *dst, - const struct in6_addr *src) - { -- static u32 seed __read_mostly; -- u32 val; -+ static siphash_key_t rt6_exception_key __read_mostly; -+ struct { -+ struct in6_addr dst; -+ struct in6_addr src; -+ } __aligned(SIPHASH_ALIGNMENT) combined = { -+ .dst = *dst, -+ }; -+ u64 val; - -- net_get_random_once(&seed, sizeof(seed)); -- val = jhash(dst, sizeof(*dst), seed); -+ net_get_random_once(&rt6_exception_key, sizeof(rt6_exception_key)); - - #ifdef CONFIG_IPV6_SUBTREES - if (src) -- val = jhash(src, sizeof(*src), val); -+ combined.src = *src; - #endif -- return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT); -+ val = siphash(&combined, sizeof(combined), &rt6_exception_key); -+ -+ return hash_64(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT); - } - - /* Helper function to find the cached rt in the hash table -diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c -index 82a202d71a31e..7c6dcbc8e98ba 100644 ---- a/net/sctp/sm_statefuns.c -+++ b/net/sctp/sm_statefuns.c -@@ -697,6 +697,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, - struct sock *sk; - int error = 0; - -+ if (asoc && !sctp_vtag_verify(chunk, asoc)) -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -+ - /* If the packet is an OOTB packet which is temporarily on the - * control endpoint, respond with an ABORT. - */ -@@ -711,7 +714,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, - * in sctp_unpack_cookie(). - */ - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) -- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -+ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -+ commands); - - /* If the endpoint is not listening or if the number of associations - * on the TCP-style socket exceed the max backlog, respond with an -@@ -2141,9 +2145,11 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook( - * enough for the chunk header. Cookie length verification is - * done later. - */ -- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) -- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -- commands); -+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) { -+ if (!sctp_vtag_verify(chunk, asoc)) -+ asoc = NULL; -+ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands); -+ } - - /* "Decode" the chunk. We have no optional parameters so we - * are in good shape. -@@ -2280,7 +2286,7 @@ enum sctp_disposition sctp_sf_shutdown_pending_abort( - */ - if (SCTP_ADDR_DEL == - sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) -- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - - if (!sctp_err_chunk_valid(chunk)) - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -@@ -2326,7 +2332,7 @@ enum sctp_disposition sctp_sf_shutdown_sent_abort( - */ - if (SCTP_ADDR_DEL == - sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) -- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - - if (!sctp_err_chunk_valid(chunk)) - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -@@ -2596,7 +2602,7 @@ enum sctp_disposition sctp_sf_do_9_1_abort( - */ - if (SCTP_ADDR_DEL == - sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) -- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - - if (!sctp_err_chunk_valid(chunk)) - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -@@ -3562,6 +3568,9 @@ enum sctp_disposition sctp_sf_ootb(struct net *net, - - SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES); - -+ if (asoc && !sctp_vtag_verify(chunk, asoc)) -+ asoc = NULL; -+ - ch = (struct sctp_chunkhdr *)chunk->chunk_hdr; - do { - /* Report violation if the chunk is less then minimal */ -@@ -3677,12 +3686,6 @@ static enum sctp_disposition sctp_sf_shut_8_4_5( - - SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS); - -- /* If the chunk length is invalid, we don't want to process -- * the reset of the packet. -- */ -- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) -- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -- - /* We need to discard the rest of the packet to prevent - * potential bomming attacks from additional bundled chunks. - * This is documented in SCTP Threats ID. -@@ -3710,6 +3713,9 @@ enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net, - { - struct sctp_chunk *chunk = arg; - -+ if (!sctp_vtag_verify(chunk, asoc)) -+ asoc = NULL; -+ - /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */ - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -@@ -3745,6 +3751,11 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net, - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - } - -+ /* Make sure that the ASCONF ADDIP chunk has a valid length. */ -+ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk))) -+ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -+ commands); -+ - /* ADD-IP: Section 4.1.1 - * This chunk MUST be sent in an authenticated way by using - * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk -@@ -3753,13 +3764,7 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net, - */ - if (!asoc->peer.asconf_capable || - (!net->sctp.addip_noauth && !chunk->auth)) -- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, -- commands); -- -- /* Make sure that the ASCONF ADDIP chunk has a valid length. */ -- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk))) -- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -- commands); -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - - hdr = (struct sctp_addiphdr *)chunk->skb->data; - serial = ntohl(hdr->serial); -@@ -3888,6 +3893,12 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net, - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - } - -+ /* Make sure that the ADDIP chunk has a valid length. */ -+ if (!sctp_chunk_length_valid(asconf_ack, -+ sizeof(struct sctp_addip_chunk))) -+ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -+ commands); -+ - /* ADD-IP, Section 4.1.2: - * This chunk MUST be sent in an authenticated way by using - * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk -@@ -3896,14 +3907,7 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net, - */ - if (!asoc->peer.asconf_capable || - (!net->sctp.addip_noauth && !asconf_ack->auth)) -- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, -- commands); -- -- /* Make sure that the ADDIP chunk has a valid length. */ -- if (!sctp_chunk_length_valid(asconf_ack, -- sizeof(struct sctp_addip_chunk))) -- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -- commands); -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - - addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data; - rcvd_serial = ntohl(addip_hdr->serial); -@@ -4475,6 +4479,9 @@ enum sctp_disposition sctp_sf_discard_chunk(struct net *net, - { - struct sctp_chunk *chunk = arg; - -+ if (asoc && !sctp_vtag_verify(chunk, asoc)) -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -+ - /* Make sure that the chunk has a valid length. - * Since we don't know the chunk type, we use a general - * chunkhdr structure to make a comparison. -@@ -4542,6 +4549,9 @@ enum sctp_disposition sctp_sf_violation(struct net *net, - { - struct sctp_chunk *chunk = arg; - -+ if (!sctp_vtag_verify(chunk, asoc)) -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -+ - /* Make sure that the chunk has a valid length. */ - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, -@@ -6248,6 +6258,7 @@ static struct sctp_packet *sctp_ootb_pkt_new( - * yet. - */ - switch (chunk->chunk_hdr->type) { -+ case SCTP_CID_INIT: - case SCTP_CID_INIT_ACK: - { - struct sctp_initack_chunk *initack; -diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c -index 7fb5c067f4293..02821b9140546 100644 ---- a/net/tls/tls_sw.c -+++ b/net/tls/tls_sw.c -@@ -35,6 +35,7 @@ - * SOFTWARE. - */ - -+#include - #include - #include - #include -@@ -43,6 +44,14 @@ - #include - #include - -+noinline void tls_err_abort(struct sock *sk, int err) -+{ -+ WARN_ON_ONCE(err >= 0); -+ /* sk->sk_err should contain a positive error code. */ -+ sk->sk_err = -err; -+ sk->sk_error_report(sk); -+} -+ - static int __skb_nsg(struct sk_buff *skb, int offset, int len, - unsigned int recursion_level) - { -@@ -416,7 +425,7 @@ int tls_tx_records(struct sock *sk, int flags) - - tx_err: - if (rc < 0 && rc != -EAGAIN) -- tls_err_abort(sk, EBADMSG); -+ tls_err_abort(sk, -EBADMSG); - - return rc; - } -@@ -447,7 +456,7 @@ static void tls_encrypt_done(struct crypto_async_request *req, int err) - - /* If err is already set on socket, return the same code */ - if (sk->sk_err) { -- ctx->async_wait.err = sk->sk_err; -+ ctx->async_wait.err = -sk->sk_err; - } else { - ctx->async_wait.err = err; - tls_err_abort(sk, err); -@@ -761,7 +770,7 @@ static int tls_push_record(struct sock *sk, int flags, - msg_pl->sg.size + prot->tail_size, i); - if (rc < 0) { - if (rc != -EINPROGRESS) { -- tls_err_abort(sk, EBADMSG); -+ tls_err_abort(sk, -EBADMSG); - if (split) { - tls_ctx->pending_open_record_frags = true; - tls_merge_open_record(sk, rec, tmp, orig_end); -@@ -1822,7 +1831,7 @@ int tls_sw_recvmsg(struct sock *sk, - err = decrypt_skb_update(sk, skb, &msg->msg_iter, - &chunk, &zc, async_capable); - if (err < 0 && err != -EINPROGRESS) { -- tls_err_abort(sk, EBADMSG); -+ tls_err_abort(sk, -EBADMSG); - goto recv_end; - } - -@@ -2002,7 +2011,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos, - } - - if (err < 0) { -- tls_err_abort(sk, EBADMSG); -+ tls_err_abort(sk, -EBADMSG); - goto splice_read_end; - } - ctx->decrypted = true; -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 7b170ed6923e7..7633d6a74bc2b 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -3480,7 +3480,7 @@ static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, - enum nl80211_iftype iftype) - { - if (!use_4addr) { -- if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT)) -+ if (netdev && netif_is_bridge_port(netdev)) - return -EBUSY; - return 0; - } -diff --git a/net/wireless/scan.c b/net/wireless/scan.c -index 1580535d53f86..6cefaad3b7f84 100644 ---- a/net/wireless/scan.c -+++ b/net/wireless/scan.c -@@ -379,14 +379,17 @@ cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss, - } - ssid_len = ssid[1]; - ssid = ssid + 2; -- rcu_read_unlock(); - - /* check if nontrans_bss is in the list */ - list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) { -- if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) -+ if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) { -+ rcu_read_unlock(); - return 0; -+ } - } - -+ rcu_read_unlock(); -+ - /* add to the list */ - list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list); - return 0; -diff --git a/net/wireless/util.c b/net/wireless/util.c -index f0247eab5bc94..aaefaf3422a1a 100644 ---- a/net/wireless/util.c -+++ b/net/wireless/util.c -@@ -975,14 +975,14 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, - !(rdev->wiphy.interface_modes & (1 << ntype))) - return -EOPNOTSUPP; - -- /* if it's part of a bridge, reject changing type to station/ibss */ -- if ((dev->priv_flags & IFF_BRIDGE_PORT) && -- (ntype == NL80211_IFTYPE_ADHOC || -- ntype == NL80211_IFTYPE_STATION || -- ntype == NL80211_IFTYPE_P2P_CLIENT)) -- return -EBUSY; -- - if (ntype != otype) { -+ /* if it's part of a bridge, reject changing type to station/ibss */ -+ if (netif_is_bridge_port(dev) && -+ (ntype == NL80211_IFTYPE_ADHOC || -+ ntype == NL80211_IFTYPE_STATION || -+ ntype == NL80211_IFTYPE_P2P_CLIENT)) -+ return -EBUSY; -+ - dev->ieee80211_ptr->use_4addr = false; - dev->ieee80211_ptr->mesh_id_up_len = 0; - wdev_lock(dev->ieee80211_ptr); -diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c -index f3ff825d9dd33..3a169a026635d 100644 ---- a/tools/perf/builtin-script.c -+++ b/tools/perf/builtin-script.c -@@ -3779,11 +3779,15 @@ int cmd_script(int argc, const char **argv) - goto out_delete; - - uname(&uts); -- if (data.is_pipe || /* assume pipe_mode indicates native_arch */ -- !strcmp(uts.machine, session->header.env.arch) || -- (!strcmp(uts.machine, "x86_64") && -- !strcmp(session->header.env.arch, "i386"))) -+ if (data.is_pipe) { /* Assume pipe_mode indicates native_arch */ - native_arch = true; -+ } else if (session->header.env.arch) { -+ if (!strcmp(uts.machine, session->header.env.arch)) -+ native_arch = true; -+ else if (!strcmp(uts.machine, "x86_64") && -+ !strcmp(session->header.env.arch, "i386")) -+ native_arch = true; -+ } - - script.session = session; - script__setup_sample_type(&script); diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.157-158.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.157-158.patch deleted file mode 100644 index 452c5bd9e4..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.157-158.patch +++ /dev/null @@ -1,331 +0,0 @@ -diff --git a/Makefile b/Makefile -index 49d639fe5a801..cef1d2704c410 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 157 -+SUBLEVEL = 158 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c -index af58768a03937..702284bcd467c 100644 ---- a/drivers/amba/bus.c -+++ b/drivers/amba/bus.c -@@ -375,9 +375,6 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent) - void __iomem *tmp; - int i, ret; - -- WARN_ON(dev->irq[0] == (unsigned int)-1); -- WARN_ON(dev->irq[1] == (unsigned int)-1); -- - ret = request_resource(parent, &dev->res); - if (ret) - goto err_out; -diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c -index a7b88ca8b97b3..fe81c565e7ef8 100644 ---- a/drivers/gpu/drm/ttm/ttm_bo_util.c -+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c -@@ -463,7 +463,6 @@ static void ttm_transfered_destroy(struct ttm_buffer_object *bo) - struct ttm_transfer_obj *fbo; - - fbo = container_of(bo, struct ttm_transfer_obj, base); -- dma_resv_fini(&fbo->base.base._resv); - ttm_bo_put(fbo->bo); - kfree(fbo); - } -diff --git a/drivers/media/firewire/firedtv-avc.c b/drivers/media/firewire/firedtv-avc.c -index 2bf9467b917d1..71991f8638e6b 100644 ---- a/drivers/media/firewire/firedtv-avc.c -+++ b/drivers/media/firewire/firedtv-avc.c -@@ -1165,7 +1165,11 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length) - read_pos += program_info_length; - write_pos += program_info_length; - } -- while (read_pos < length) { -+ while (read_pos + 4 < length) { -+ if (write_pos + 4 >= sizeof(c->operand) - 4) { -+ ret = -EINVAL; -+ goto out; -+ } - c->operand[write_pos++] = msg[read_pos++]; - c->operand[write_pos++] = msg[read_pos++]; - c->operand[write_pos++] = msg[read_pos++]; -@@ -1177,13 +1181,17 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length) - c->operand[write_pos++] = es_info_length >> 8; - c->operand[write_pos++] = es_info_length & 0xff; - if (es_info_length > 0) { -+ if (read_pos >= length) { -+ ret = -EINVAL; -+ goto out; -+ } - pmt_cmd_id = msg[read_pos++]; - if (pmt_cmd_id != 1 && pmt_cmd_id != 4) - dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n", - pmt_cmd_id); - -- if (es_info_length > sizeof(c->operand) - 4 - -- write_pos) { -+ if (es_info_length > sizeof(c->operand) - 4 - write_pos || -+ es_info_length > length - read_pos) { - ret = -EINVAL; - goto out; - } -diff --git a/drivers/media/firewire/firedtv-ci.c b/drivers/media/firewire/firedtv-ci.c -index 9363d005e2b61..e0d57e09dab0c 100644 ---- a/drivers/media/firewire/firedtv-ci.c -+++ b/drivers/media/firewire/firedtv-ci.c -@@ -134,6 +134,8 @@ static int fdtv_ca_pmt(struct firedtv *fdtv, void *arg) - } else { - data_length = msg->msg[3]; - } -+ if (data_length > sizeof(msg->msg) - data_pos) -+ return -EINVAL; - - return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length); - } -diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c -index a109120da0e7c..22beeb5be9c41 100644 ---- a/drivers/net/ethernet/microchip/lan743x_main.c -+++ b/drivers/net/ethernet/microchip/lan743x_main.c -@@ -1898,13 +1898,13 @@ static int lan743x_rx_next_index(struct lan743x_rx *rx, int index) - return ((++index) % rx->ring_size); - } - --static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx) -+static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx, gfp_t gfp) - { - int length = 0; - - length = (LAN743X_MAX_FRAME_SIZE + ETH_HLEN + 4 + RX_HEAD_PADDING); - return __netdev_alloc_skb(rx->adapter->netdev, -- length, GFP_ATOMIC | GFP_DMA); -+ length, gfp); - } - - static void lan743x_rx_update_tail(struct lan743x_rx *rx, int index) -@@ -2077,7 +2077,8 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx) - struct sk_buff *new_skb = NULL; - int packet_length; - -- new_skb = lan743x_rx_allocate_skb(rx); -+ new_skb = lan743x_rx_allocate_skb(rx, -+ GFP_ATOMIC | GFP_DMA); - if (!new_skb) { - /* failed to allocate next skb. - * Memory is very low. -@@ -2314,7 +2315,8 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx) - - rx->last_head = 0; - for (index = 0; index < rx->ring_size; index++) { -- struct sk_buff *new_skb = lan743x_rx_allocate_skb(rx); -+ struct sk_buff *new_skb = lan743x_rx_allocate_skb(rx, -+ GFP_KERNEL); - - ret = lan743x_rx_init_ring_element(rx, index, new_skb); - if (ret) -diff --git a/drivers/net/ethernet/sfc/ethtool.c b/drivers/net/ethernet/sfc/ethtool.c -index 86b965875540d..d53e945dd08fc 100644 ---- a/drivers/net/ethernet/sfc/ethtool.c -+++ b/drivers/net/ethernet/sfc/ethtool.c -@@ -128,20 +128,14 @@ efx_ethtool_get_link_ksettings(struct net_device *net_dev, - { - struct efx_nic *efx = netdev_priv(net_dev); - struct efx_link_state *link_state = &efx->link_state; -- u32 supported; - - mutex_lock(&efx->mac_lock); - efx->phy_op->get_link_ksettings(efx, cmd); - mutex_unlock(&efx->mac_lock); - - /* Both MACs support pause frames (bidirectional and respond-only) */ -- ethtool_convert_link_mode_to_legacy_u32(&supported, -- cmd->link_modes.supported); -- -- supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause; -- -- ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.supported, -- supported); -+ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); -+ ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause); - - if (LOOPBACK_INTERNAL(efx)) { - cmd->base.speed = link_state->speed; -diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c -index 9b626c169554f..f08ed52d51f3f 100644 ---- a/drivers/net/vrf.c -+++ b/drivers/net/vrf.c -@@ -1036,8 +1036,6 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev, - bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr); - bool is_ndisc = ipv6_ndisc_frame(skb); - -- nf_reset_ct(skb); -- - /* loopback, multicast & non-ND link-local traffic; do not push through - * packet taps again. Reset pkt_type for upper layers to process skb. - * For strict packets with a source LLA, determine the dst using the -@@ -1094,8 +1092,6 @@ static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev, - skb->skb_iif = vrf_dev->ifindex; - IPCB(skb)->flags |= IPSKB_L3SLAVE; - -- nf_reset_ct(skb); -- - if (ipv4_is_multicast(ip_hdr(skb)->daddr)) - goto out; - -diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c -index 1f5b5c8a7f726..1ce3f90f782fd 100644 ---- a/drivers/scsi/scsi.c -+++ b/drivers/scsi/scsi.c -@@ -555,8 +555,10 @@ EXPORT_SYMBOL(scsi_device_get); - */ - void scsi_device_put(struct scsi_device *sdev) - { -- module_put(sdev->host->hostt->module); -+ struct module *mod = sdev->host->hostt->module; -+ - put_device(&sdev->sdev_gendev); -+ module_put(mod); - } - EXPORT_SYMBOL(scsi_device_put); - -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 6aeb79e744e0b..12064ce76777d 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -438,9 +438,12 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) - struct list_head *this, *tmp; - struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL; - unsigned long flags; -+ struct module *mod; - - sdev = container_of(work, struct scsi_device, ew.work); - -+ mod = sdev->host->hostt->module; -+ - scsi_dh_release_device(sdev); - - parent = sdev->sdev_gendev.parent; -@@ -481,11 +484,17 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work) - - if (parent) - put_device(parent); -+ module_put(mod); - } - - static void scsi_device_dev_release(struct device *dev) - { - struct scsi_device *sdp = to_scsi_device(dev); -+ -+ /* Set module pointer as NULL in case of module unloading */ -+ if (!try_module_get(sdp->host->hostt->module)) -+ sdp->host->hostt->module = NULL; -+ - execute_in_process_context(scsi_device_dev_release_usercontext, - &sdp->ew); - } -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index 48ff9c66ae46d..d0f45600b6698 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -2636,7 +2636,6 @@ int usb_add_hcd(struct usb_hcd *hcd, - { - int retval; - struct usb_device *rhdev; -- struct usb_hcd *shared_hcd; - - if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) { - hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev); -@@ -2793,26 +2792,13 @@ int usb_add_hcd(struct usb_hcd *hcd, - goto err_hcd_driver_start; - } - -- /* starting here, usbcore will pay attention to the shared HCD roothub */ -- shared_hcd = hcd->shared_hcd; -- if (!usb_hcd_is_primary_hcd(hcd) && shared_hcd && HCD_DEFER_RH_REGISTER(shared_hcd)) { -- retval = register_root_hub(shared_hcd); -- if (retval != 0) -- goto err_register_root_hub; -- -- if (shared_hcd->uses_new_polling && HCD_POLL_RH(shared_hcd)) -- usb_hcd_poll_rh_status(shared_hcd); -- } -- - /* starting here, usbcore will pay attention to this root hub */ -- if (!HCD_DEFER_RH_REGISTER(hcd)) { -- retval = register_root_hub(hcd); -- if (retval != 0) -- goto err_register_root_hub; -+ retval = register_root_hub(hcd); -+ if (retval != 0) -+ goto err_register_root_hub; - -- if (hcd->uses_new_polling && HCD_POLL_RH(hcd)) -- usb_hcd_poll_rh_status(hcd); -- } -+ if (hcd->uses_new_polling && HCD_POLL_RH(hcd)) -+ usb_hcd_poll_rh_status(hcd); - - return retval; - -@@ -2855,7 +2841,6 @@ EXPORT_SYMBOL_GPL(usb_add_hcd); - void usb_remove_hcd(struct usb_hcd *hcd) - { - struct usb_device *rhdev = hcd->self.root_hub; -- bool rh_registered; - - dev_info(hcd->self.controller, "remove, state %x\n", hcd->state); - -@@ -2866,7 +2851,6 @@ void usb_remove_hcd(struct usb_hcd *hcd) - - dev_dbg(hcd->self.controller, "roothub graceful disconnect\n"); - spin_lock_irq (&hcd_root_hub_lock); -- rh_registered = hcd->rh_registered; - hcd->rh_registered = 0; - spin_unlock_irq (&hcd_root_hub_lock); - -@@ -2876,8 +2860,7 @@ void usb_remove_hcd(struct usb_hcd *hcd) - cancel_work_sync(&hcd->died_work); - - mutex_lock(&usb_bus_idr_lock); -- if (rh_registered) -- usb_disconnect(&rhdev); /* Sets rhdev to NULL */ -+ usb_disconnect(&rhdev); /* Sets rhdev to NULL */ - mutex_unlock(&usb_bus_idr_lock); - - /* -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 4ef7484dff8b2..4bb850370bb6b 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -693,7 +693,6 @@ int xhci_run(struct usb_hcd *hcd) - if (ret) - xhci_free_command(xhci, command); - } -- set_bit(HCD_FLAG_DEFER_RH_REGISTER, &hcd->flags); - xhci_dbg_trace(xhci, trace_xhci_dbg_init, - "Finished xhci_run for USB2 roothub"); - -diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h -index c0eb85b2981e0..712b2a603645f 100644 ---- a/include/linux/usb/hcd.h -+++ b/include/linux/usb/hcd.h -@@ -124,7 +124,6 @@ struct usb_hcd { - #define HCD_FLAG_RH_RUNNING 5 /* root hub is running? */ - #define HCD_FLAG_DEAD 6 /* controller has died? */ - #define HCD_FLAG_INTF_AUTHORIZED 7 /* authorize interfaces? */ --#define HCD_FLAG_DEFER_RH_REGISTER 8 /* Defer roothub registration */ - - /* The flags can be tested using these macros; they are likely to - * be slightly faster than test_bit(). -@@ -135,7 +134,6 @@ struct usb_hcd { - #define HCD_WAKEUP_PENDING(hcd) ((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING)) - #define HCD_RH_RUNNING(hcd) ((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING)) - #define HCD_DEAD(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEAD)) --#define HCD_DEFER_RH_REGISTER(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEFER_RH_REGISTER)) - - /* - * Specifies if interfaces are authorized by default diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.158-159.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.158-159.patch deleted file mode 100644 index 821bded8bb..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.158-159.patch +++ /dev/null @@ -1,680 +0,0 @@ -diff --git a/Makefile b/Makefile -index cef1d2704c410..602b5167dacd7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 158 -+SUBLEVEL = 159 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c -index 642031b896f64..24a6905d60ee2 100644 ---- a/arch/x86/kvm/ioapic.c -+++ b/arch/x86/kvm/ioapic.c -@@ -91,7 +91,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic, - static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic) - { - ioapic->rtc_status.pending_eoi = 0; -- bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1); -+ bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID); - } - - static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic); -diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h -index 283f1f489bcac..ea1a4e0297dae 100644 ---- a/arch/x86/kvm/ioapic.h -+++ b/arch/x86/kvm/ioapic.h -@@ -43,13 +43,13 @@ struct kvm_vcpu; - - struct dest_map { - /* vcpu bitmap where IRQ has been sent */ -- DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1); -+ DECLARE_BITMAP(map, KVM_MAX_VCPU_ID); - - /* - * Vector sent to a given vcpu, only valid when - * the vcpu's bit in map is set - */ -- u8 vectors[KVM_MAX_VCPU_ID + 1]; -+ u8 vectors[KVM_MAX_VCPU_ID]; - }; - - -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 4eaef780844ea..2be6687c0148f 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -2257,7 +2257,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, - binder_dec_node(buffer->target_node, 1, 0); - - off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); -- off_end_offset = is_failure ? failed_at : -+ off_end_offset = is_failure && failed_at ? failed_at : - off_start_offset + buffer->offsets_size; - for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; - buffer_offset += sizeof(binder_size_t)) { -@@ -2343,9 +2343,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, - binder_size_t fd_buf_size; - binder_size_t num_valid; - -- if (proc->tsk != current->group_leader) { -+ if (is_failure) { - /* -- * Nothing to do if running in sender context - * The fd fixups have not been applied so no - * fds need to be closed. - */ -@@ -3548,6 +3547,7 @@ err_invalid_target_handle: - * binder_free_buf() - free the specified buffer - * @proc: binder proc that owns buffer - * @buffer: buffer to be freed -+ * @is_failure: failed to send transaction - * - * If buffer for an async transaction, enqueue the next async - * transaction from the node. -@@ -3557,7 +3557,7 @@ err_invalid_target_handle: - static void - binder_free_buf(struct binder_proc *proc, - struct binder_thread *thread, -- struct binder_buffer *buffer) -+ struct binder_buffer *buffer, bool is_failure) - { - binder_inner_proc_lock(proc); - if (buffer->transaction) { -@@ -3585,7 +3585,7 @@ binder_free_buf(struct binder_proc *proc, - binder_node_inner_unlock(buf_node); - } - trace_binder_transaction_buffer_release(buffer); -- binder_transaction_buffer_release(proc, thread, buffer, 0, false); -+ binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); - binder_alloc_free_buf(&proc->alloc, buffer); - } - -@@ -3786,7 +3786,7 @@ static int binder_thread_write(struct binder_proc *proc, - proc->pid, thread->pid, (u64)data_ptr, - buffer->debug_id, - buffer->transaction ? "active" : "finished"); -- binder_free_buf(proc, thread, buffer); -+ binder_free_buf(proc, thread, buffer, false); - break; - } - -@@ -4474,7 +4474,7 @@ retry: - buffer->transaction = NULL; - binder_cleanup_transaction(t, "fd fixups failed", - BR_FAILED_REPLY); -- binder_free_buf(proc, thread, buffer); -+ binder_free_buf(proc, thread, buffer, true); - binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, - "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n", - proc->pid, thread->pid, -diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c -index e8aa3d4bda885..1e5a2a0cc6700 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_usb.c -+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c -@@ -61,7 +61,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter, - (void *)seg, - (int)len, - &transfer, -- HZ * 5); -+ USB_CTRL_SET_TIMEOUT); - - if (status < 0) { - rsi_dbg(ERR_ZONE, -diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c -index 634f57730c1e0..704b04d2980d3 100644 ---- a/drivers/staging/comedi/drivers/dt9812.c -+++ b/drivers/staging/comedi/drivers/dt9812.c -@@ -32,6 +32,7 @@ - #include - #include - #include -+#include - #include - - #include "../comedi_usb.h" -@@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev, - { - struct usb_device *usb = comedi_to_usb_dev(dev); - struct dt9812_private *devpriv = dev->private; -- struct dt9812_usb_cmd cmd; -+ struct dt9812_usb_cmd *cmd; -+ size_t tbuf_size; - int count, ret; -+ void *tbuf; - -- cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA); -- cmd.u.flash_data_info.address = -+ tbuf_size = max(sizeof(*cmd), buf_size); -+ -+ tbuf = kzalloc(tbuf_size, GFP_KERNEL); -+ if (!tbuf) -+ return -ENOMEM; -+ -+ cmd = tbuf; -+ -+ cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA); -+ cmd->u.flash_data_info.address = - cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset); -- cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size); -+ cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size); - - /* DT9812 only responds to 32 byte writes!! */ - ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), -- &cmd, 32, &count, DT9812_USB_TIMEOUT); -+ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); - if (ret) -- return ret; -+ goto out; -+ -+ ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), -+ tbuf, buf_size, &count, DT9812_USB_TIMEOUT); -+ if (!ret) { -+ if (count == buf_size) -+ memcpy(buf, tbuf, buf_size); -+ else -+ ret = -EREMOTEIO; -+ } -+out: -+ kfree(tbuf); - -- return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), -- buf, buf_size, &count, DT9812_USB_TIMEOUT); -+ return ret; - } - - static int dt9812_read_multiple_registers(struct comedi_device *dev, -@@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev, - { - struct usb_device *usb = comedi_to_usb_dev(dev); - struct dt9812_private *devpriv = dev->private; -- struct dt9812_usb_cmd cmd; -+ struct dt9812_usb_cmd *cmd; - int i, count, ret; -+ size_t buf_size; -+ void *buf; - -- cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); -- cmd.u.read_multi_info.count = reg_count; -+ buf_size = max_t(size_t, sizeof(*cmd), reg_count); -+ -+ buf = kzalloc(buf_size, GFP_KERNEL); -+ if (!buf) -+ return -ENOMEM; -+ -+ cmd = buf; -+ -+ cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); -+ cmd->u.read_multi_info.count = reg_count; - for (i = 0; i < reg_count; i++) -- cmd.u.read_multi_info.address[i] = address[i]; -+ cmd->u.read_multi_info.address[i] = address[i]; - - /* DT9812 only responds to 32 byte writes!! */ - ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), -- &cmd, 32, &count, DT9812_USB_TIMEOUT); -+ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); - if (ret) -- return ret; -+ goto out; -+ -+ ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), -+ buf, reg_count, &count, DT9812_USB_TIMEOUT); -+ if (!ret) { -+ if (count == reg_count) -+ memcpy(value, buf, reg_count); -+ else -+ ret = -EREMOTEIO; -+ } -+out: -+ kfree(buf); - -- return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), -- value, reg_count, &count, DT9812_USB_TIMEOUT); -+ return ret; - } - - static int dt9812_write_multiple_registers(struct comedi_device *dev, -@@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev, - { - struct usb_device *usb = comedi_to_usb_dev(dev); - struct dt9812_private *devpriv = dev->private; -- struct dt9812_usb_cmd cmd; -+ struct dt9812_usb_cmd *cmd; - int i, count; -+ int ret; -+ -+ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); -+ if (!cmd) -+ return -ENOMEM; - -- cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); -- cmd.u.read_multi_info.count = reg_count; -+ cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); -+ cmd->u.read_multi_info.count = reg_count; - for (i = 0; i < reg_count; i++) { -- cmd.u.write_multi_info.write[i].address = address[i]; -- cmd.u.write_multi_info.write[i].value = value[i]; -+ cmd->u.write_multi_info.write[i].address = address[i]; -+ cmd->u.write_multi_info.write[i].value = value[i]; - } - - /* DT9812 only responds to 32 byte writes!! */ -- return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), -- &cmd, 32, &count, DT9812_USB_TIMEOUT); -+ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), -+ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); -+ kfree(cmd); -+ -+ return ret; - } - - static int dt9812_rmw_multiple_registers(struct comedi_device *dev, -@@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev, - { - struct usb_device *usb = comedi_to_usb_dev(dev); - struct dt9812_private *devpriv = dev->private; -- struct dt9812_usb_cmd cmd; -+ struct dt9812_usb_cmd *cmd; - int i, count; -+ int ret; -+ -+ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); -+ if (!cmd) -+ return -ENOMEM; - -- cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); -- cmd.u.rmw_multi_info.count = reg_count; -+ cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); -+ cmd->u.rmw_multi_info.count = reg_count; - for (i = 0; i < reg_count; i++) -- cmd.u.rmw_multi_info.rmw[i] = rmw[i]; -+ cmd->u.rmw_multi_info.rmw[i] = rmw[i]; - - /* DT9812 only responds to 32 byte writes!! */ -- return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), -- &cmd, 32, &count, DT9812_USB_TIMEOUT); -+ ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), -+ cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); -+ kfree(cmd); -+ -+ return ret; - } - - static int dt9812_digital_in(struct comedi_device *dev, u8 *bits) -diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c -index 360e86a19fe32..311632004f08a 100644 ---- a/drivers/staging/comedi/drivers/ni_usb6501.c -+++ b/drivers/staging/comedi/drivers/ni_usb6501.c -@@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, - 0x00, 0x00, 0x00, 0x02, - 0x00, 0x00, 0x00, 0x00}; - -+/* Largest supported packets */ -+static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); -+static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); -+ - enum commands { - READ_PORT, - WRITE_PORT, -@@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev) - if (!devpriv->ep_rx || !devpriv->ep_tx) - return -ENODEV; - -+ if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE) -+ return -ENODEV; -+ -+ if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE) -+ return -ENODEV; -+ - return 0; - } - -diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c -index 7956abcbae22b..7769eadfaf61d 100644 ---- a/drivers/staging/comedi/drivers/vmk80xx.c -+++ b/drivers/staging/comedi/drivers/vmk80xx.c -@@ -90,6 +90,9 @@ enum { - #define IC3_VERSION BIT(0) - #define IC6_VERSION BIT(1) - -+#define MIN_BUF_SIZE 64 -+#define PACKET_TIMEOUT 10000 /* ms */ -+ - enum vmk80xx_model { - VMK8055_MODEL, - VMK8061_MODEL -@@ -157,22 +160,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev) - __u8 rx_addr; - unsigned int tx_pipe; - unsigned int rx_pipe; -- size_t size; -+ size_t tx_size; -+ size_t rx_size; - - tx_addr = devpriv->ep_tx->bEndpointAddress; - rx_addr = devpriv->ep_rx->bEndpointAddress; - tx_pipe = usb_sndbulkpipe(usb, tx_addr); - rx_pipe = usb_rcvbulkpipe(usb, rx_addr); -+ tx_size = usb_endpoint_maxp(devpriv->ep_tx); -+ rx_size = usb_endpoint_maxp(devpriv->ep_rx); - -- /* -- * The max packet size attributes of the K8061 -- * input/output endpoints are identical -- */ -- size = usb_endpoint_maxp(devpriv->ep_tx); -+ usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL, -+ PACKET_TIMEOUT); - -- usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, -- size, NULL, devpriv->ep_tx->bInterval); -- usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10); -+ usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL, -+ PACKET_TIMEOUT); - } - - static int vmk80xx_read_packet(struct comedi_device *dev) -@@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev) - pipe = usb_rcvintpipe(usb, ep->bEndpointAddress); - return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf, - usb_endpoint_maxp(ep), NULL, -- HZ * 10); -+ PACKET_TIMEOUT); - } - - static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) -@@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) - pipe = usb_sndintpipe(usb, ep->bEndpointAddress); - return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf, - usb_endpoint_maxp(ep), NULL, -- HZ * 10); -+ PACKET_TIMEOUT); - } - - static int vmk80xx_reset_device(struct comedi_device *dev) -@@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev) - struct vmk80xx_private *devpriv = dev->private; - size_t size; - -- size = usb_endpoint_maxp(devpriv->ep_rx); -+ size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); - devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL); - if (!devpriv->usb_rx_buf) - return -ENOMEM; - -- size = usb_endpoint_maxp(devpriv->ep_tx); -+ size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); - devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); - if (!devpriv->usb_tx_buf) - return -ENOMEM; -diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.c b/drivers/staging/media/ipu3/ipu3-css-fw.c -index 45aff76198e2c..981693eed8155 100644 ---- a/drivers/staging/media/ipu3/ipu3-css-fw.c -+++ b/drivers/staging/media/ipu3/ipu3-css-fw.c -@@ -124,12 +124,11 @@ int imgu_css_fw_init(struct imgu_css *css) - /* Check and display fw header info */ - - css->fwp = (struct imgu_fw_header *)css->fw->data; -- if (css->fw->size < sizeof(struct imgu_fw_header *) || -+ if (css->fw->size < struct_size(css->fwp, binary_header, 1) || - css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h)) - goto bad_fw; -- if (sizeof(struct imgu_fw_bi_file_h) + -- css->fwp->file_header.binary_nr * sizeof(struct imgu_fw_info) > -- css->fw->size) -+ if (struct_size(css->fwp, binary_header, -+ css->fwp->file_header.binary_nr) > css->fw->size) - goto bad_fw; - - dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n", -diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.h b/drivers/staging/media/ipu3/ipu3-css-fw.h -index 79ffa70451390..650fd25fc79ee 100644 ---- a/drivers/staging/media/ipu3/ipu3-css-fw.h -+++ b/drivers/staging/media/ipu3/ipu3-css-fw.h -@@ -170,7 +170,7 @@ struct imgu_fw_bi_file_h { - - struct imgu_fw_header { - struct imgu_fw_bi_file_h file_header; -- struct imgu_fw_info binary_header[1]; /* binary_nr items */ -+ struct imgu_fw_info binary_header[]; /* binary_nr items */ - }; - - /******************* Firmware functions *******************/ -diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c -index e739d1979c877..6f65a9c9d6cf3 100644 ---- a/drivers/staging/rtl8192u/r8192U_core.c -+++ b/drivers/staging/rtl8192u/r8192U_core.c -@@ -236,7 +236,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data) - - status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), - RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, -- indx | 0xfe00, 0, usbdata, 1, HZ / 2); -+ indx | 0xfe00, 0, usbdata, 1, 500); - kfree(usbdata); - - if (status < 0) { -@@ -258,7 +258,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data) - - status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), - RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, -- indx | 0xfe00, 0, usbdata, 1, HZ / 2); -+ indx | 0xfe00, 0, usbdata, 1, 500); - *data = *usbdata; - kfree(usbdata); - -@@ -286,7 +286,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data) - status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), - RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, - (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, -- usbdata, 1, HZ / 2); -+ usbdata, 1, 500); - kfree(usbdata); - - if (status < 0) { -@@ -313,7 +313,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data) - status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), - RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, - (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, -- usbdata, 2, HZ / 2); -+ usbdata, 2, 500); - kfree(usbdata); - - if (status < 0) { -@@ -340,7 +340,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data) - status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), - RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, - (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, -- usbdata, 4, HZ / 2); -+ usbdata, 4, 500); - kfree(usbdata); - - -@@ -367,7 +367,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data) - status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), - RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, - (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, -- usbdata, 1, HZ / 2); -+ usbdata, 1, 500); - *data = *usbdata; - kfree(usbdata); - -@@ -394,7 +394,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data) - status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), - RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, - (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, -- usbdata, 2, HZ / 2); -+ usbdata, 2, 500); - *data = *usbdata; - kfree(usbdata); - -@@ -418,7 +418,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data) - - status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), - RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, -- indx | 0xfe00, 0, usbdata, 2, HZ / 2); -+ indx | 0xfe00, 0, usbdata, 2, 500); - *data = *usbdata; - kfree(usbdata); - -@@ -444,7 +444,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data) - status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), - RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, - (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, -- usbdata, 4, HZ / 2); -+ usbdata, 4, 500); - *data = *usbdata; - kfree(usbdata); - -diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c -index 9d290bc2fdb7f..2202a0caa252e 100644 ---- a/drivers/staging/rtl8712/usb_ops_linux.c -+++ b/drivers/staging/rtl8712/usb_ops_linux.c -@@ -493,7 +493,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, - memcpy(pIo_buf, pdata, len); - } - status = usb_control_msg(udev, pipe, request, reqtype, value, index, -- pIo_buf, len, HZ / 2); -+ pIo_buf, len, 500); - if (status > 0) { /* Success this control transfer. */ - if (requesttype == 0x01) { - /* For Control read transfer, we have to copy the read -diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig -index d354036ff6c86..f985bb4a42db2 100644 ---- a/drivers/usb/gadget/udc/Kconfig -+++ b/drivers/usb/gadget/udc/Kconfig -@@ -330,6 +330,7 @@ config USB_AMD5536UDC - config USB_FSL_QE - tristate "Freescale QE/CPM USB Device Controller" - depends on FSL_SOC && (QUICC_ENGINE || CPM) -+ depends on !64BIT || BROKEN - help - Some of Freescale PowerPC processors have a Full Speed - QE/CPM2 USB controller, which support device mode with 4 -diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c -index 5c6ce1ef3f4b0..c0e344c3a8487 100644 ---- a/drivers/usb/host/ehci-hcd.c -+++ b/drivers/usb/host/ehci-hcd.c -@@ -634,7 +634,16 @@ static int ehci_run (struct usb_hcd *hcd) - /* Wait until HC become operational */ - ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */ - msleep(5); -- rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000); -+ -+ /* For Aspeed, STS_HALT also depends on ASS/PSS status. -+ * Check CMD_RUN instead. -+ */ -+ if (ehci->is_aspeed) -+ rc = ehci_handshake(ehci, &ehci->regs->command, CMD_RUN, -+ 1, 100 * 1000); -+ else -+ rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, -+ 0, 100 * 1000); - - up_write(&ehci_cf_port_reset_rwsem); - -diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c -index e4fc3f66d43bf..accbcc989c503 100644 ---- a/drivers/usb/host/ehci-platform.c -+++ b/drivers/usb/host/ehci-platform.c -@@ -286,6 +286,12 @@ static int ehci_platform_probe(struct platform_device *dev) - "has-transaction-translator")) - hcd->has_tt = 1; - -+ if (of_device_is_compatible(dev->dev.of_node, -+ "aspeed,ast2500-ehci") || -+ of_device_is_compatible(dev->dev.of_node, -+ "aspeed,ast2600-ehci")) -+ ehci->is_aspeed = 1; -+ - if (soc_device_match(quirk_poll_match)) - priv->quirk_poll = true; - -diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h -index ac5e967907d14..356738462ce45 100644 ---- a/drivers/usb/host/ehci.h -+++ b/drivers/usb/host/ehci.h -@@ -218,6 +218,7 @@ struct ehci_hcd { /* one per controller */ - unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */ - unsigned need_oc_pp_cycle:1; /* MPC834X port power */ - unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ -+ unsigned is_aspeed:1; - - /* required for usb32 quirk */ - #define OHCI_CTRL_HCFS (3 << 6) -diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c -index ffe462a657b15..4622400ba4ddb 100644 ---- a/drivers/usb/musb/musb_gadget.c -+++ b/drivers/usb/musb/musb_gadget.c -@@ -1248,9 +1248,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req, - status = musb_queue_resume_work(musb, - musb_ep_restart_resume_work, - request); -- if (status < 0) -+ if (status < 0) { - dev_err(musb->controller, "%s resume work: %i\n", - __func__, status); -+ list_del(&request->list); -+ } - } - - unlock: -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 7442793fe0502..3ba4e060fd051 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -406,6 +406,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110, - "785EPX Storage", - USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN), - -+/* -+ * Reported by James Buren -+ * Virtual ISOs cannot be remounted if ejected while the device is locked -+ * Disable locking to mimic Windows behavior that bypasses the issue -+ */ -+UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001, -+ "iODD", -+ "2531/2541", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE), -+ - /* - * Not sure who reported this originally but - * Pavel Machek reported that the extra US_FL_SINGLE_LUN -diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c -index bf30f6ce8dd10..74e487d63c62c 100644 ---- a/fs/isofs/inode.c -+++ b/fs/isofs/inode.c -@@ -1328,6 +1328,8 @@ static int isofs_read_inode(struct inode *inode, int relocated) - - de = (struct iso_directory_record *) (bh->b_data + offset); - de_len = *(unsigned char *) de; -+ if (de_len < sizeof(struct iso_directory_record)) -+ goto fail; - - if (offset + de_len > bufsize) { - int frag1 = bufsize - offset; -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index 5569ef6bc1839..23e26a203a9e9 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -2193,8 +2193,15 @@ static int __init console_setup(char *str) - char *s, *options, *brl_options = NULL; - int idx; - -- if (str[0] == 0) -+ /* -+ * console="" or console=null have been suggested as a way to -+ * disable console output. Use ttynull that has been created -+ * for exacly this purpose. -+ */ -+ if (str[0] == 0 || strcmp(str, "null") == 0) { -+ __add_preferred_console("ttynull", 0, NULL, NULL); - return 1; -+ } - - if (_braille_console_setup(&str, &brl_options)) - return 1; diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.159-160.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.159-160.patch deleted file mode 100644 index 818e3b40c0..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.159-160.patch +++ /dev/null @@ -1,10905 +0,0 @@ -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index dbb68067ba4ea..b11e1fd95ee5f 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -5480,6 +5480,13 @@ - as generic guest with no PV drivers. Currently support - XEN HVM, KVM, HYPER_V and VMWARE guest. - -+ xen.balloon_boot_timeout= [XEN] -+ The time (in seconds) to wait before giving up to boot -+ in case initial ballooning fails to free enough memory. -+ Applies only when running as HVM or PVH guest and -+ started with less memory configured than allowed at -+ max. Default is 180. -+ - xen.event_eoi_delay= [XEN] - How long to delay EOI handling in case of event - storms (jiffies). Default is 10. -diff --git a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt -index 093edda0c8dfc..6cd83d920155f 100644 ---- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt -+++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt -@@ -13,6 +13,14 @@ common regulator binding documented in: - - - Required properties of the main device node (the parent!): -+ - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used -+ for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. -+ -+ [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional -+ property is specified, then all the eight voltage values for the -+ 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. -+ -+Optional properties of the main device node (the parent!): - - s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV) - units for buck2 when changing voltage using gpio dvs. Refer to [1] below - for additional information. -@@ -25,26 +33,13 @@ Required properties of the main device node (the parent!): - units for buck4 when changing voltage using gpio dvs. Refer to [1] below - for additional information. - -- - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used -- for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines. -- -- [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional -- property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage' -- property should specify atleast one voltage level (which would be a -- safe operating voltage). -- -- If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional -- property is specified, then all the eight voltage values for the -- 's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified. -- --Optional properties of the main device node (the parent!): - - s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs. - - s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs. - - s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs. - - Additional properties required if either of the optional properties are used: - -- - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from -+ - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from - the possible 8 options selectable by the dvs gpios. The value of this - property should be between 0 and 7. If not specified or if out of range, the - default value of this property is set to 0. -diff --git a/Makefile b/Makefile -index 602b5167dacd7..e938662dab289 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 159 -+SUBLEVEL = 160 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/Makefile b/arch/arm/Makefile -index 1fc32b611f8a4..4f098edfbf202 100644 ---- a/arch/arm/Makefile -+++ b/arch/arm/Makefile -@@ -66,15 +66,15 @@ KBUILD_CFLAGS += $(call cc-option,-fno-ipa-sra) - # Note that GCC does not numerically define an architecture version - # macro, but instead defines a whole series of macros which makes - # testing for a specific architecture or later rather impossible. --arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m -Wa,-march=armv7-m --arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 $(call cc-option,-march=armv7-a,-march=armv5t -Wa$(comma)-march=armv7-a) --arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6,-march=armv5t -Wa$(comma)-march=armv6) -+arch-$(CONFIG_CPU_32v7M) =-D__LINUX_ARM_ARCH__=7 -march=armv7-m -+arch-$(CONFIG_CPU_32v7) =-D__LINUX_ARM_ARCH__=7 -march=armv7-a -+arch-$(CONFIG_CPU_32v6) =-D__LINUX_ARM_ARCH__=6 -march=armv6 - # Only override the compiler option if ARMv6. The ARMv6K extensions are - # always available in ARMv7 - ifeq ($(CONFIG_CPU_32v6),y) --arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6k,-march=armv5t -Wa$(comma)-march=armv6k) -+arch-$(CONFIG_CPU_32v6K) =-D__LINUX_ARM_ARCH__=6 -march=armv6k - endif --arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 $(call cc-option,-march=armv5te,-march=armv4t) -+arch-$(CONFIG_CPU_32v5) =-D__LINUX_ARM_ARCH__=5 -march=armv5te - arch-$(CONFIG_CPU_32v4T) =-D__LINUX_ARM_ARCH__=4 -march=armv4t - arch-$(CONFIG_CPU_32v4) =-D__LINUX_ARM_ARCH__=4 -march=armv4 - arch-$(CONFIG_CPU_32v3) =-D__LINUX_ARM_ARCH__=3 -march=armv3m -@@ -88,7 +88,7 @@ tune-$(CONFIG_CPU_ARM720T) =-mtune=arm7tdmi - tune-$(CONFIG_CPU_ARM740T) =-mtune=arm7tdmi - tune-$(CONFIG_CPU_ARM9TDMI) =-mtune=arm9tdmi - tune-$(CONFIG_CPU_ARM940T) =-mtune=arm9tdmi --tune-$(CONFIG_CPU_ARM946E) =$(call cc-option,-mtune=arm9e,-mtune=arm9tdmi) -+tune-$(CONFIG_CPU_ARM946E) =-mtune=arm9e - tune-$(CONFIG_CPU_ARM920T) =-mtune=arm9tdmi - tune-$(CONFIG_CPU_ARM922T) =-mtune=arm9tdmi - tune-$(CONFIG_CPU_ARM925T) =-mtune=arm9tdmi -@@ -96,11 +96,11 @@ tune-$(CONFIG_CPU_ARM926T) =-mtune=arm9tdmi - tune-$(CONFIG_CPU_FA526) =-mtune=arm9tdmi - tune-$(CONFIG_CPU_SA110) =-mtune=strongarm110 - tune-$(CONFIG_CPU_SA1100) =-mtune=strongarm1100 --tune-$(CONFIG_CPU_XSCALE) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale --tune-$(CONFIG_CPU_XSC3) =$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale --tune-$(CONFIG_CPU_FEROCEON) =$(call cc-option,-mtune=marvell-f,-mtune=xscale) --tune-$(CONFIG_CPU_V6) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm) --tune-$(CONFIG_CPU_V6K) =$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm) -+tune-$(CONFIG_CPU_XSCALE) =-mtune=xscale -+tune-$(CONFIG_CPU_XSC3) =-mtune=xscale -+tune-$(CONFIG_CPU_FEROCEON) =-mtune=xscale -+tune-$(CONFIG_CPU_V6) =-mtune=arm1136j-s -+tune-$(CONFIG_CPU_V6K) =-mtune=arm1136j-s - - # Evaluate tune cc-option calls now - tune-y := $(tune-y) -diff --git a/arch/arm/boot/dts/at91-tse850-3.dts b/arch/arm/boot/dts/at91-tse850-3.dts -index 3ca97b47c69ce..7e5c598e7e68f 100644 ---- a/arch/arm/boot/dts/at91-tse850-3.dts -+++ b/arch/arm/boot/dts/at91-tse850-3.dts -@@ -262,7 +262,7 @@ - &macb1 { - status = "okay"; - -- phy-mode = "rgmii"; -+ phy-mode = "rmii"; - - #address-cells = <1>; - #size-cells = <0>; -diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi -index b6ef1a7ac8a4e..186b2af7743e3 100644 ---- a/arch/arm/boot/dts/omap3-gta04.dtsi -+++ b/arch/arm/boot/dts/omap3-gta04.dtsi -@@ -515,7 +515,7 @@ - compatible = "bosch,bma180"; - reg = <0x41>; - pinctrl-names = "default"; -- pintcrl-0 = <&bma180_pins>; -+ pinctrl-0 = <&bma180_pins>; - interrupt-parent = <&gpio4>; - interrupts = <19 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_115 */ - }; -diff --git a/arch/arm/boot/dts/qcom-msm8974.dtsi b/arch/arm/boot/dts/qcom-msm8974.dtsi -index 369e58f64145d..9de4f17955e31 100644 ---- a/arch/arm/boot/dts/qcom-msm8974.dtsi -+++ b/arch/arm/boot/dts/qcom-msm8974.dtsi -@@ -1213,8 +1213,8 @@ - #phy-cells = <0>; - qcom,dsi-phy-index = <0>; - -- clocks = <&mmcc MDSS_AHB_CLK>; -- clock-names = "iface"; -+ clocks = <&mmcc MDSS_AHB_CLK>, <&xo_board>; -+ clock-names = "iface", "ref"; - }; - }; - }; -diff --git a/arch/arm/boot/dts/stm32mp157c.dtsi b/arch/arm/boot/dts/stm32mp157c.dtsi -index eca469a64a977..a687c024daa92 100644 ---- a/arch/arm/boot/dts/stm32mp157c.dtsi -+++ b/arch/arm/boot/dts/stm32mp157c.dtsi -@@ -773,7 +773,7 @@ - #sound-dai-cells = <0>; - - compatible = "st,stm32-sai-sub-a"; -- reg = <0x4 0x1c>; -+ reg = <0x4 0x20>; - clocks = <&rcc SAI1_K>; - clock-names = "sai_ck"; - dmas = <&dmamux1 87 0x400 0x01>; -@@ -783,7 +783,7 @@ - sai1b: audio-controller@4400a024 { - #sound-dai-cells = <0>; - compatible = "st,stm32-sai-sub-b"; -- reg = <0x24 0x1c>; -+ reg = <0x24 0x20>; - clocks = <&rcc SAI1_K>; - clock-names = "sai_ck"; - dmas = <&dmamux1 88 0x400 0x01>; -@@ -804,7 +804,7 @@ - sai2a: audio-controller@4400b004 { - #sound-dai-cells = <0>; - compatible = "st,stm32-sai-sub-a"; -- reg = <0x4 0x1c>; -+ reg = <0x4 0x20>; - clocks = <&rcc SAI2_K>; - clock-names = "sai_ck"; - dmas = <&dmamux1 89 0x400 0x01>; -@@ -814,7 +814,7 @@ - sai2b: audio-controller@4400b024 { - #sound-dai-cells = <0>; - compatible = "st,stm32-sai-sub-b"; -- reg = <0x24 0x1c>; -+ reg = <0x24 0x20>; - clocks = <&rcc SAI2_K>; - clock-names = "sai_ck"; - dmas = <&dmamux1 90 0x400 0x01>; -@@ -835,7 +835,7 @@ - sai3a: audio-controller@4400c004 { - #sound-dai-cells = <0>; - compatible = "st,stm32-sai-sub-a"; -- reg = <0x04 0x1c>; -+ reg = <0x04 0x20>; - clocks = <&rcc SAI3_K>; - clock-names = "sai_ck"; - dmas = <&dmamux1 113 0x400 0x01>; -@@ -845,7 +845,7 @@ - sai3b: audio-controller@4400c024 { - #sound-dai-cells = <0>; - compatible = "st,stm32-sai-sub-b"; -- reg = <0x24 0x1c>; -+ reg = <0x24 0x20>; - clocks = <&rcc SAI3_K>; - clock-names = "sai_ck"; - dmas = <&dmamux1 114 0x400 0x01>; -@@ -1191,7 +1191,7 @@ - sai4a: audio-controller@50027004 { - #sound-dai-cells = <0>; - compatible = "st,stm32-sai-sub-a"; -- reg = <0x04 0x1c>; -+ reg = <0x04 0x20>; - clocks = <&rcc SAI4_K>; - clock-names = "sai_ck"; - dmas = <&dmamux1 99 0x400 0x01>; -@@ -1201,7 +1201,7 @@ - sai4b: audio-controller@50027024 { - #sound-dai-cells = <0>; - compatible = "st,stm32-sai-sub-b"; -- reg = <0x24 0x1c>; -+ reg = <0x24 0x20>; - clocks = <&rcc SAI4_K>; - clock-names = "sai_ck"; - dmas = <&dmamux1 100 0x400 0x01>; -diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts -index 9ba62774e89a1..488933b87ad5a 100644 ---- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts -+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts -@@ -112,7 +112,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&gmac_rgmii_pins>; - phy-handle = <&phy1>; -- phy-mode = "rgmii"; -+ phy-mode = "rgmii-id"; - status = "okay"; - }; - -diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c -index 76ea4178a55cb..db798eac74315 100644 ---- a/arch/arm/kernel/stacktrace.c -+++ b/arch/arm/kernel/stacktrace.c -@@ -54,8 +54,7 @@ int notrace unwind_frame(struct stackframe *frame) - - frame->sp = frame->fp; - frame->fp = *(unsigned long *)(fp); -- frame->pc = frame->lr; -- frame->lr = *(unsigned long *)(fp + 4); -+ frame->pc = *(unsigned long *)(fp + 4); - #else - /* check current frame pointer is within bounds */ - if (fp < low + 12 || fp > high - 4) -diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig -index 0ab3a86b1f523..fc388eb60e0b7 100644 ---- a/arch/arm/mm/Kconfig -+++ b/arch/arm/mm/Kconfig -@@ -752,7 +752,7 @@ config CPU_BIG_ENDIAN - config CPU_ENDIAN_BE8 - bool - depends on CPU_BIG_ENDIAN -- default CPU_V6 || CPU_V6K || CPU_V7 -+ default CPU_V6 || CPU_V6K || CPU_V7 || CPU_V7M - help - Support for the BE-8 (big-endian) mode on ARMv6 and ARMv7 processors. - -diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c -index ee943ac325560..538d5da741b09 100644 ---- a/arch/arm/mm/mmu.c -+++ b/arch/arm/mm/mmu.c -@@ -415,9 +415,9 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot) - FIXADDR_END); - BUG_ON(idx >= __end_of_fixed_addresses); - -- /* we only support device mappings until pgprot_kernel has been set */ -+ /* We support only device mappings before pgprot_kernel is set. */ - if (WARN_ON(pgprot_val(prot) != pgprot_val(FIXMAP_PAGE_IO) && -- pgprot_val(pgprot_kernel) == 0)) -+ pgprot_val(prot) && pgprot_val(pgprot_kernel) == 0)) - return; - - if (pgprot_val(prot)) -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts -index c9fa23a565624..b8d9e92197ac8 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts -@@ -139,7 +139,7 @@ - regulator-min-microvolt = <721000>; - regulator-max-microvolt = <1022000>; - -- vin-supply = <&dc_in>; -+ pwm-supply = <&dc_in>; - - pwms = <&pwm_AO_cd 1 1250 0>; - pwm-dutycycle-range = <100 0>; -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts -index 2a324f0136e3f..02ec6eda03b1c 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts -@@ -139,7 +139,7 @@ - regulator-min-microvolt = <721000>; - regulator-max-microvolt = <1022000>; - -- vin-supply = <&main_12v>; -+ pwm-supply = <&main_12v>; - - pwms = <&pwm_AO_cd 1 1250 0>; - pwm-dutycycle-range = <100 0>; -diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts -index c48125bf9d1e3..5209c44fda01a 100644 ---- a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts -+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts -@@ -139,7 +139,7 @@ - regulator-min-microvolt = <721000>; - regulator-max-microvolt = <1022000>; - -- vin-supply = <&dc_in>; -+ pwm-supply = <&dc_in>; - - pwms = <&pwm_AO_cd 1 1250 0>; - pwm-dutycycle-range = <100 0>; -diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi -index 44ad744c4710d..6ddb6b8c1fad5 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi -@@ -555,7 +555,7 @@ - - gpu: gpu@ff300000 { - compatible = "rockchip,rk3328-mali", "arm,mali-450"; -- reg = <0x0 0xff300000 0x0 0x40000>; -+ reg = <0x0 0xff300000 0x0 0x30000>; - interrupts = , - , - , -diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index a92a187ec8919..3a057d4279007 100644 ---- a/arch/arm64/include/asm/pgtable.h -+++ b/arch/arm64/include/asm/pgtable.h -@@ -54,9 +54,15 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; - * page table entry, taking care of 52-bit addresses. - */ - #ifdef CONFIG_ARM64_PA_BITS_52 --#define __pte_to_phys(pte) \ -- ((pte_val(pte) & PTE_ADDR_LOW) | ((pte_val(pte) & PTE_ADDR_HIGH) << 36)) --#define __phys_to_pte_val(phys) (((phys) | ((phys) >> 36)) & PTE_ADDR_MASK) -+static inline phys_addr_t __pte_to_phys(pte_t pte) -+{ -+ return (pte_val(pte) & PTE_ADDR_LOW) | -+ ((pte_val(pte) & PTE_ADDR_HIGH) << 36); -+} -+static inline pteval_t __phys_to_pte_val(phys_addr_t phys) -+{ -+ return (phys | (phys >> 36)) & PTE_ADDR_MASK; -+} - #else - #define __pte_to_phys(pte) (pte_val(pte) & PTE_ADDR_MASK) - #define __phys_to_pte_val(phys) (phys) -diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c -index afc7d41347f73..a343677837c77 100644 ---- a/arch/arm64/net/bpf_jit_comp.c -+++ b/arch/arm64/net/bpf_jit_comp.c -@@ -996,6 +996,11 @@ out: - return prog; - } - -+u64 bpf_jit_alloc_exec_limit(void) -+{ -+ return BPF_JIT_REGION_SIZE; -+} -+ - void *bpf_jit_alloc_exec(unsigned long size) - { - return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START, -diff --git a/arch/ia64/Kconfig.debug b/arch/ia64/Kconfig.debug -index 40ca23bd228d6..2ce008e2d1644 100644 ---- a/arch/ia64/Kconfig.debug -+++ b/arch/ia64/Kconfig.debug -@@ -39,7 +39,7 @@ config DISABLE_VHPT - - config IA64_DEBUG_CMPXCHG - bool "Turn on compare-and-exchange bug checking (slow!)" -- depends on DEBUG_KERNEL -+ depends on DEBUG_KERNEL && PRINTK - help - Selecting this option turns on bug checking for the IA-64 - compare-and-exchange instructions. This is slow! Itaniums -diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c -index b3dc39050c1ad..8a223d0e4918c 100644 ---- a/arch/ia64/kernel/kprobes.c -+++ b/arch/ia64/kernel/kprobes.c -@@ -398,7 +398,8 @@ static void kretprobe_trampoline(void) - - int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs) - { -- regs->cr_iip = __kretprobe_trampoline_handler(regs, kretprobe_trampoline, NULL); -+ regs->cr_iip = __kretprobe_trampoline_handler(regs, -+ dereference_function_descriptor(kretprobe_trampoline), NULL); - /* - * By returning a non-zero value, we are telling - * kprobe_handler() that we don't want the post_handler -@@ -414,7 +415,7 @@ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri, - ri->fp = NULL; - - /* Replace the return addr with trampoline addr */ -- regs->b0 = ((struct fnptr *)kretprobe_trampoline)->ip; -+ regs->b0 = (unsigned long)dereference_function_descriptor(kretprobe_trampoline); - } - - /* Check the instruction in the slot is break */ -@@ -918,14 +919,14 @@ static struct kprobe trampoline_p = { - int __init arch_init_kprobes(void) - { - trampoline_p.addr = -- (kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip; -+ dereference_function_descriptor(kretprobe_trampoline); - return register_kprobe(&trampoline_p); - } - - int __kprobes arch_trampoline_kprobe(struct kprobe *p) - { - if (p->addr == -- (kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip) -+ dereference_function_descriptor(kretprobe_trampoline)) - return 1; - - return 0; -diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine -index 1bbe0dd0c4fe5..b88a980f56f8a 100644 ---- a/arch/m68k/Kconfig.machine -+++ b/arch/m68k/Kconfig.machine -@@ -190,6 +190,7 @@ config INIT_LCD - config MEMORY_RESERVE - int "Memory reservation (MiB)" - depends on (UCSIMM || UCDIMM) -+ default 0 - help - Reserve certain memory regions on 68x328 based boards. - -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 2bfef67d52c63..041d34975ea2c 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -1393,6 +1393,7 @@ config CPU_LOONGSON3 - select WEAK_REORDERING_BEYOND_LLSC - select MIPS_PGD_C0_CONTEXT - select MIPS_L1_CACHE_SHIFT_6 -+ select MIPS_FP_SUPPORT - select GPIOLIB - select SWIOTLB - help -diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h -index aeae2effa123d..23c67c0871b17 100644 ---- a/arch/mips/include/asm/mips-cm.h -+++ b/arch/mips/include/asm/mips-cm.h -@@ -11,6 +11,7 @@ - #ifndef __MIPS_ASM_MIPS_CM_H__ - #define __MIPS_ASM_MIPS_CM_H__ - -+#include - #include - #include - -@@ -153,8 +154,8 @@ GCR_ACCESSOR_RO(32, 0x030, rev) - #define CM_GCR_REV_MINOR GENMASK(7, 0) - - #define CM_ENCODE_REV(major, minor) \ -- (((major) << __ffs(CM_GCR_REV_MAJOR)) | \ -- ((minor) << __ffs(CM_GCR_REV_MINOR))) -+ (FIELD_PREP(CM_GCR_REV_MAJOR, major) | \ -+ FIELD_PREP(CM_GCR_REV_MINOR, minor)) - - #define CM_REV_CM2 CM_ENCODE_REV(6, 0) - #define CM_REV_CM2_5 CM_ENCODE_REV(7, 0) -@@ -362,10 +363,10 @@ static inline int mips_cm_revision(void) - static inline unsigned int mips_cm_max_vp_width(void) - { - extern int smp_num_siblings; -- uint32_t cfg; - - if (mips_cm_revision() >= CM_REV_CM3) -- return read_gcr_sys_config2() & CM_GCR_SYS_CONFIG2_MAXVPW; -+ return FIELD_GET(CM_GCR_SYS_CONFIG2_MAXVPW, -+ read_gcr_sys_config2()); - - if (mips_cm_present()) { - /* -@@ -373,8 +374,7 @@ static inline unsigned int mips_cm_max_vp_width(void) - * number of VP(E)s, and if that ever changes then this will - * need revisiting. - */ -- cfg = read_gcr_cl_config() & CM_GCR_Cx_CONFIG_PVPE; -- return (cfg >> __ffs(CM_GCR_Cx_CONFIG_PVPE)) + 1; -+ return FIELD_GET(CM_GCR_Cx_CONFIG_PVPE, read_gcr_cl_config()) + 1; - } - - if (IS_ENABLED(CONFIG_SMP)) -diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c -index a9eab83d9148d..611ef512c0b81 100644 ---- a/arch/mips/kernel/mips-cm.c -+++ b/arch/mips/kernel/mips-cm.c -@@ -179,8 +179,7 @@ static void mips_cm_probe_l2sync(void) - phys_addr_t addr; - - /* L2-only sync was introduced with CM major revision 6 */ -- major_rev = (read_gcr_rev() & CM_GCR_REV_MAJOR) >> -- __ffs(CM_GCR_REV_MAJOR); -+ major_rev = FIELD_GET(CM_GCR_REV_MAJOR, read_gcr_rev()); - if (major_rev < 6) - return; - -@@ -263,13 +262,13 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core, - preempt_disable(); - - if (cm_rev >= CM_REV_CM3) { -- val = core << __ffs(CM3_GCR_Cx_OTHER_CORE); -- val |= vp << __ffs(CM3_GCR_Cx_OTHER_VP); -+ val = FIELD_PREP(CM3_GCR_Cx_OTHER_CORE, core) | -+ FIELD_PREP(CM3_GCR_Cx_OTHER_VP, vp); - - if (cm_rev >= CM_REV_CM3_5) { - val |= CM_GCR_Cx_OTHER_CLUSTER_EN; -- val |= cluster << __ffs(CM_GCR_Cx_OTHER_CLUSTER); -- val |= block << __ffs(CM_GCR_Cx_OTHER_BLOCK); -+ val |= FIELD_PREP(CM_GCR_Cx_OTHER_CLUSTER, cluster); -+ val |= FIELD_PREP(CM_GCR_Cx_OTHER_BLOCK, block); - } else { - WARN_ON(cluster != 0); - WARN_ON(block != CM_GCR_Cx_OTHER_BLOCK_LOCAL); -@@ -299,7 +298,7 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core, - spin_lock_irqsave(&per_cpu(cm_core_lock, curr_core), - per_cpu(cm_core_lock_flags, curr_core)); - -- val = core << __ffs(CM_GCR_Cx_OTHER_CORENUM); -+ val = FIELD_PREP(CM_GCR_Cx_OTHER_CORENUM, core); - } - - write_gcr_cl_other(val); -@@ -343,8 +342,8 @@ void mips_cm_error_report(void) - cm_other = read_gcr_error_mult(); - - if (revision < CM_REV_CM3) { /* CM2 */ -- cause = cm_error >> __ffs(CM_GCR_ERROR_CAUSE_ERRTYPE); -- ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND); -+ cause = FIELD_GET(CM_GCR_ERROR_CAUSE_ERRTYPE, cm_error); -+ ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other); - - if (!cause) - return; -@@ -386,8 +385,8 @@ void mips_cm_error_report(void) - ulong core_id_bits, vp_id_bits, cmd_bits, cmd_group_bits; - ulong cm3_cca_bits, mcp_bits, cm3_tr_bits, sched_bit; - -- cause = cm_error >> __ffs64(CM3_GCR_ERROR_CAUSE_ERRTYPE); -- ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND); -+ cause = FIELD_GET(CM3_GCR_ERROR_CAUSE_ERRTYPE, cm_error); -+ ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other); - - if (!cause) - return; -diff --git a/arch/mips/kernel/r2300_fpu.S b/arch/mips/kernel/r2300_fpu.S -index 12e58053544fc..cbf6db98cfb38 100644 ---- a/arch/mips/kernel/r2300_fpu.S -+++ b/arch/mips/kernel/r2300_fpu.S -@@ -29,8 +29,8 @@ - #define EX2(a,b) \ - 9: a,##b; \ - .section __ex_table,"a"; \ -- PTR 9b,bad_stack; \ -- PTR 9b+4,bad_stack; \ -+ PTR 9b,fault; \ -+ PTR 9b+4,fault; \ - .previous - - .set mips1 -diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c -index 3f16f38230310..9a28e79f2e66e 100644 ---- a/arch/mips/kernel/syscall.c -+++ b/arch/mips/kernel/syscall.c -@@ -239,12 +239,3 @@ SYSCALL_DEFINE3(cachectl, char *, addr, int, nbytes, int, op) - { - return -ENOSYS; - } -- --/* -- * If we ever come here the user sp is bad. Zap the process right away. -- * Due to the bad stack signaling wouldn't work. -- */ --asmlinkage void bad_stack(void) --{ -- do_exit(SIGSEGV); --} -diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c -index aeb1b989cd4ee..e45077aecf83a 100644 ---- a/arch/mips/lantiq/xway/dma.c -+++ b/arch/mips/lantiq/xway/dma.c -@@ -11,6 +11,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -29,6 +30,7 @@ - #define LTQ_DMA_PCTRL 0x44 - #define LTQ_DMA_IRNEN 0xf4 - -+#define DMA_ID_CHNR GENMASK(26, 20) /* channel number */ - #define DMA_DESCPT BIT(3) /* descriptor complete irq */ - #define DMA_TX BIT(8) /* TX channel direction */ - #define DMA_CHAN_ON BIT(0) /* channel on / off bit */ -@@ -39,7 +41,6 @@ - #define DMA_POLL BIT(31) /* turn on channel polling */ - #define DMA_CLK_DIV4 BIT(6) /* polling clock divider */ - #define DMA_2W_BURST BIT(1) /* 2 word burst length */ --#define DMA_MAX_CHANNEL 20 /* the soc has 20 channels */ - #define DMA_ETOP_ENDIANNESS (0xf << 8) /* endianness swap etop channels */ - #define DMA_WEIGHT (BIT(17) | BIT(16)) /* default channel wheight */ - -@@ -205,7 +206,7 @@ ltq_dma_init(struct platform_device *pdev) - { - struct clk *clk; - struct resource *res; -- unsigned id; -+ unsigned int id, nchannels; - int i; - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -@@ -221,21 +222,24 @@ ltq_dma_init(struct platform_device *pdev) - clk_enable(clk); - ltq_dma_w32_mask(0, DMA_RESET, LTQ_DMA_CTRL); - -+ usleep_range(1, 10); -+ - /* disable all interrupts */ - ltq_dma_w32(0, LTQ_DMA_IRNEN); - - /* reset/configure each channel */ -- for (i = 0; i < DMA_MAX_CHANNEL; i++) { -+ id = ltq_dma_r32(LTQ_DMA_ID); -+ nchannels = ((id & DMA_ID_CHNR) >> 20); -+ for (i = 0; i < nchannels; i++) { - ltq_dma_w32(i, LTQ_DMA_CS); - ltq_dma_w32(DMA_CHAN_RST, LTQ_DMA_CCTRL); - ltq_dma_w32(DMA_POLL | DMA_CLK_DIV4, LTQ_DMA_CPOLL); - ltq_dma_w32_mask(DMA_CHAN_ON, 0, LTQ_DMA_CCTRL); - } - -- id = ltq_dma_r32(LTQ_DMA_ID); - dev_info(&pdev->dev, - "Init done - hw rev: %X, ports: %d, channels: %d\n", -- id & 0x1f, (id >> 16) & 0xf, id >> 20); -+ id & 0x1f, (id >> 16) & 0xf, nchannels); - - return 0; - } -diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S -index 873bf3434da94..7d14e9ae18fb1 100644 ---- a/arch/parisc/kernel/entry.S -+++ b/arch/parisc/kernel/entry.S -@@ -1841,7 +1841,7 @@ syscall_restore: - LDREG TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 - - /* Are we being ptraced? */ -- ldw TASK_FLAGS(%r1),%r19 -+ LDREG TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19 - ldi _TIF_SYSCALL_TRACE_MASK,%r2 - and,COND(=) %r19,%r2,%r0 - b,n syscall_restore_rfi -diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c -index e202c37e56af3..9997465c11820 100644 ---- a/arch/parisc/kernel/smp.c -+++ b/arch/parisc/kernel/smp.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -71,7 +72,10 @@ enum ipi_message_type { - IPI_CALL_FUNC, - IPI_CPU_START, - IPI_CPU_STOP, -- IPI_CPU_TEST -+ IPI_CPU_TEST, -+#ifdef CONFIG_KGDB -+ IPI_ENTER_KGDB, -+#endif - }; - - -@@ -169,7 +173,12 @@ ipi_interrupt(int irq, void *dev_id) - case IPI_CPU_TEST: - smp_debug(100, KERN_DEBUG "CPU%d is alive!\n", this_cpu); - break; -- -+#ifdef CONFIG_KGDB -+ case IPI_ENTER_KGDB: -+ smp_debug(100, KERN_DEBUG "CPU%d ENTER_KGDB\n", this_cpu); -+ kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs()); -+ break; -+#endif - default: - printk(KERN_CRIT "Unknown IPI num on CPU%d: %lu\n", - this_cpu, which); -@@ -225,6 +234,12 @@ send_IPI_allbutself(enum ipi_message_type op) - } - } - -+#ifdef CONFIG_KGDB -+void kgdb_roundup_cpus(void) -+{ -+ send_IPI_allbutself(IPI_ENTER_KGDB); -+} -+#endif - - inline void - smp_send_stop(void) { send_IPI_allbutself(IPI_CPU_STOP); } -diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c -index 87ae476d1c4f5..86a57fb0e6fae 100644 ---- a/arch/parisc/kernel/unwind.c -+++ b/arch/parisc/kernel/unwind.c -@@ -21,6 +21,8 @@ - #include - - #include -+#include -+#include - - /* #define DEBUG 1 */ - #ifdef DEBUG -@@ -203,6 +205,11 @@ int __init unwind_init(void) - return 0; - } - -+static bool pc_is_kernel_fn(unsigned long pc, void *fn) -+{ -+ return (unsigned long)dereference_kernel_function_descriptor(fn) == pc; -+} -+ - static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int frame_size) - { - /* -@@ -221,7 +228,7 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int - extern void * const _call_on_stack; - #endif /* CONFIG_IRQSTACKS */ - -- if (pc == (unsigned long) &handle_interruption) { -+ if (pc_is_kernel_fn(pc, handle_interruption)) { - struct pt_regs *regs = (struct pt_regs *)(info->sp - frame_size - PT_SZ_ALGN); - dbg("Unwinding through handle_interruption()\n"); - info->prev_sp = regs->gr[30]; -@@ -229,13 +236,13 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int - return 1; - } - -- if (pc == (unsigned long) &ret_from_kernel_thread || -- pc == (unsigned long) &syscall_exit) { -+ if (pc_is_kernel_fn(pc, ret_from_kernel_thread) || -+ pc_is_kernel_fn(pc, syscall_exit)) { - info->prev_sp = info->prev_ip = 0; - return 1; - } - -- if (pc == (unsigned long) &intr_return) { -+ if (pc_is_kernel_fn(pc, intr_return)) { - struct pt_regs *regs; - - dbg("Found intr_return()\n"); -@@ -246,20 +253,20 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int - return 1; - } - -- if (pc == (unsigned long) &_switch_to_ret) { -+ if (pc_is_kernel_fn(pc, _switch_to) || -+ pc_is_kernel_fn(pc, _switch_to_ret)) { - info->prev_sp = info->sp - CALLEE_SAVE_FRAME_SIZE; - info->prev_ip = *(unsigned long *)(info->prev_sp - RP_OFFSET); - return 1; - } - - #ifdef CONFIG_IRQSTACKS -- if (pc == (unsigned long) &_call_on_stack) { -+ if (pc_is_kernel_fn(pc, _call_on_stack)) { - info->prev_sp = *(unsigned long *)(info->sp - FRAME_SIZE - REG_SZ); - info->prev_ip = *(unsigned long *)(info->sp - FRAME_SIZE - RP_OFFSET); - return 1; - } - #endif -- - return 0; - } - -diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S -index 99cd24f2ea01b..164483b37d854 100644 ---- a/arch/parisc/kernel/vmlinux.lds.S -+++ b/arch/parisc/kernel/vmlinux.lds.S -@@ -56,6 +56,8 @@ SECTIONS - { - . = KERNEL_BINARY_TEXT_START; - -+ _stext = .; /* start of kernel text, includes init code & data */ -+ - __init_begin = .; - HEAD_TEXT_SECTION - MLONGCALL_DISCARD(INIT_TEXT_SECTION(8)) -@@ -79,7 +81,6 @@ SECTIONS - /* freed after init ends here */ - - _text = .; /* Text and read-only data */ -- _stext = .; - MLONGCALL_KEEP(INIT_TEXT_SECTION(8)) - .text ALIGN(PAGE_SIZE) : { - TEXT_TEXT -diff --git a/arch/parisc/mm/fixmap.c b/arch/parisc/mm/fixmap.c -index 474cd241c1509..02e19a32e6c5f 100644 ---- a/arch/parisc/mm/fixmap.c -+++ b/arch/parisc/mm/fixmap.c -@@ -18,12 +18,9 @@ void notrace set_fixmap(enum fixed_addresses idx, phys_addr_t phys) - pte_t *pte; - - if (pmd_none(*pmd)) -- pmd = pmd_alloc(NULL, pgd, vaddr); -- -- pte = pte_offset_kernel(pmd, vaddr); -- if (pte_none(*pte)) - pte = pte_alloc_kernel(pmd, vaddr); - -+ pte = pte_offset_kernel(pmd, vaddr); - set_pte_at(&init_mm, vaddr, pte, __mk_pte(phys, PAGE_KERNEL_RWX)); - flush_tlb_kernel_range(vaddr, vaddr + PAGE_SIZE); - } -diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c -index 3e54484797f62..d769d61cde7ca 100644 ---- a/arch/parisc/mm/init.c -+++ b/arch/parisc/mm/init.c -@@ -892,9 +892,9 @@ void flush_tlb_all(void) - { - int do_recycle; - -- __inc_irq_stat(irq_tlb_count); - do_recycle = 0; - spin_lock(&sid_lock); -+ __inc_irq_stat(irq_tlb_count); - if (dirty_space_ids > RECYCLE_THRESHOLD) { - BUG_ON(recycle_inuse); /* FIXME: Use a semaphore/wait queue here */ - get_dirty_sids(&recycle_ndirty,recycle_dirty_array); -@@ -913,8 +913,8 @@ void flush_tlb_all(void) - #else - void flush_tlb_all(void) - { -- __inc_irq_stat(irq_tlb_count); - spin_lock(&sid_lock); -+ __inc_irq_stat(irq_tlb_count); - flush_tlb_all_local(NULL); - recycle_sids(); - spin_unlock(&sid_lock); -diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h -index be0f7257b13c8..96ef54bc7d968 100644 ---- a/arch/powerpc/include/asm/code-patching.h -+++ b/arch/powerpc/include/asm/code-patching.h -@@ -22,6 +22,7 @@ - #define BRANCH_ABSOLUTE 0x2 - - bool is_offset_in_branch_range(long offset); -+bool is_offset_in_cond_branch_range(long offset); - unsigned int create_branch(const unsigned int *addr, - unsigned long target, int flags); - unsigned int create_cond_branch(const unsigned int *addr, -diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h -index e9e3f85134e54..316a9c8d1929e 100644 ---- a/arch/powerpc/include/asm/security_features.h -+++ b/arch/powerpc/include/asm/security_features.h -@@ -39,6 +39,11 @@ static inline bool security_ftr_enabled(u64 feature) - return !!(powerpc_security_features & feature); - } - -+#ifdef CONFIG_PPC_BOOK3S_64 -+enum stf_barrier_type stf_barrier_type_get(void); -+#else -+static inline enum stf_barrier_type stf_barrier_type_get(void) { return STF_BARRIER_NONE; } -+#endif - - // Features indicating support for Spectre/Meltdown mitigations - -diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c -index 1740a66cea84d..ff022e7256934 100644 ---- a/arch/powerpc/kernel/security.c -+++ b/arch/powerpc/kernel/security.c -@@ -256,6 +256,11 @@ static int __init handle_no_stf_barrier(char *p) - - early_param("no_stf_barrier", handle_no_stf_barrier); - -+enum stf_barrier_type stf_barrier_type_get(void) -+{ -+ return stf_enabled_flush_types; -+} -+ - /* This is the generic flag used by other architectures */ - static int __init handle_ssbd(char *p) - { -diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c -index 3345f039a8769..a05f289e613ed 100644 ---- a/arch/powerpc/lib/code-patching.c -+++ b/arch/powerpc/lib/code-patching.c -@@ -221,6 +221,11 @@ bool is_offset_in_branch_range(long offset) - return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3)); - } - -+bool is_offset_in_cond_branch_range(long offset) -+{ -+ return offset >= -0x8000 && offset <= 0x7fff && !(offset & 0x3); -+} -+ - /* - * Helper to check if a given instruction is a conditional branch - * Derived from the conditional checks in analyse_instr() -@@ -274,7 +279,7 @@ unsigned int create_cond_branch(const unsigned int *addr, - offset = offset - (unsigned long)addr; - - /* Check we can represent the target in the instruction format */ -- if (offset < -0x8000 || offset > 0x7FFF || offset & 0x3) -+ if (!is_offset_in_cond_branch_range(offset)) - return 0; - - /* Mask out the flags and target, so they don't step on each other. */ -diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h -index 55d4377ccfae3..6d2a268528dfc 100644 ---- a/arch/powerpc/net/bpf_jit.h -+++ b/arch/powerpc/net/bpf_jit.h -@@ -11,6 +11,7 @@ - #ifndef __ASSEMBLY__ - - #include -+#include - - #ifdef PPC64_ELF_ABI_v1 - #define FUNCTION_DESCR_SIZE 24 -@@ -180,13 +181,26 @@ - #define PPC_NEG(d, a) EMIT(PPC_INST_NEG | ___PPC_RT(d) | ___PPC_RA(a)) - - /* Long jump; (unconditional 'branch') */ --#define PPC_JMP(dest) EMIT(PPC_INST_BRANCH | \ -- (((dest) - (ctx->idx * 4)) & 0x03fffffc)) -+#define PPC_JMP(dest) \ -+ do { \ -+ long offset = (long)(dest) - (ctx->idx * 4); \ -+ if (!is_offset_in_branch_range(offset)) { \ -+ pr_err_ratelimited("Branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \ -+ return -ERANGE; \ -+ } \ -+ EMIT(PPC_INST_BRANCH | (offset & 0x03fffffc)); \ -+ } while (0) - /* "cond" here covers BO:BI fields. */ --#define PPC_BCC_SHORT(cond, dest) EMIT(PPC_INST_BRANCH_COND | \ -- (((cond) & 0x3ff) << 16) | \ -- (((dest) - (ctx->idx * 4)) & \ -- 0xfffc)) -+#define PPC_BCC_SHORT(cond, dest) \ -+ do { \ -+ long offset = (long)(dest) - (ctx->idx * 4); \ -+ if (!is_offset_in_cond_branch_range(offset)) { \ -+ pr_err_ratelimited("Conditional branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \ -+ return -ERANGE; \ -+ } \ -+ EMIT(PPC_INST_BRANCH_COND | (((cond) & 0x3ff) << 16) | (offset & 0xfffc)); \ -+ } while (0) -+ - /* Sign-extended 32-bit immediate load */ - #define PPC_LI32(d, i) do { \ - if ((int)(uintptr_t)(i) >= -32768 && \ -@@ -225,11 +239,6 @@ - #define PPC_FUNC_ADDR(d,i) do { PPC_LI32(d, i); } while(0) - #endif - --static inline bool is_nearbranch(int offset) --{ -- return (offset < 32768) && (offset >= -32768); --} -- - /* - * The fly in the ointment of code size changing from pass to pass is - * avoided by padding the short branch case with a NOP. If code size differs -@@ -238,7 +247,7 @@ static inline bool is_nearbranch(int offset) - * state. - */ - #define PPC_BCC(cond, dest) do { \ -- if (is_nearbranch((dest) - (ctx->idx * 4))) { \ -+ if (is_offset_in_cond_branch_range((long)(dest) - (ctx->idx * 4))) { \ - PPC_BCC_SHORT(cond, dest); \ - PPC_NOP(); \ - } else { \ -diff --git a/arch/powerpc/net/bpf_jit64.h b/arch/powerpc/net/bpf_jit64.h -index cf3a7e337f025..68ddf3502ab03 100644 ---- a/arch/powerpc/net/bpf_jit64.h -+++ b/arch/powerpc/net/bpf_jit64.h -@@ -16,18 +16,18 @@ - * with our redzone usage. - * - * [ prev sp ] <------------- -- * [ nv gpr save area ] 6*8 | -+ * [ nv gpr save area ] 5*8 | - * [ tail_call_cnt ] 8 | -- * [ local_tmp_var ] 8 | -+ * [ local_tmp_var ] 16 | - * fp (r31) --> [ ebpf stack space ] upto 512 | - * [ frame header ] 32/112 | - * sp (r1) ---> [ stack pointer ] -------------- - */ - - /* for gpr non volatile registers BPG_REG_6 to 10 */ --#define BPF_PPC_STACK_SAVE (6*8) -+#define BPF_PPC_STACK_SAVE (5*8) - /* for bpf JIT code internal usage */ --#define BPF_PPC_STACK_LOCALS 16 -+#define BPF_PPC_STACK_LOCALS 24 - /* stack frame excluding BPF stack, ensure this is quadword aligned */ - #define BPF_PPC_STACKFRAME (STACK_FRAME_MIN_SIZE + \ - BPF_PPC_STACK_LOCALS + BPF_PPC_STACK_SAVE) -diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c -index 81e6279c9874f..687cd352648aa 100644 ---- a/arch/powerpc/net/bpf_jit_comp64.c -+++ b/arch/powerpc/net/bpf_jit_comp64.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - - #include "bpf_jit64.h" - -@@ -56,9 +57,9 @@ static inline bool bpf_has_stack_frame(struct codegen_context *ctx) - * [ prev sp ] <------------- - * [ ... ] | - * sp (r1) ---> [ stack pointer ] -------------- -- * [ nv gpr save area ] 6*8 -+ * [ nv gpr save area ] 5*8 - * [ tail_call_cnt ] 8 -- * [ local_tmp_var ] 8 -+ * [ local_tmp_var ] 16 - * [ unused red zone ] 208 bytes protected - */ - static int bpf_jit_stack_local(struct codegen_context *ctx) -@@ -66,12 +67,12 @@ static int bpf_jit_stack_local(struct codegen_context *ctx) - if (bpf_has_stack_frame(ctx)) - return STACK_FRAME_MIN_SIZE + ctx->stack_size; - else -- return -(BPF_PPC_STACK_SAVE + 16); -+ return -(BPF_PPC_STACK_SAVE + 24); - } - - static int bpf_jit_stack_tailcallcnt(struct codegen_context *ctx) - { -- return bpf_jit_stack_local(ctx) + 8; -+ return bpf_jit_stack_local(ctx) + 16; - } - - static int bpf_jit_stack_offsetof(struct codegen_context *ctx, int reg) -@@ -224,7 +225,7 @@ static void bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx, - PPC_BLRL(); - } - --static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out) -+static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out) - { - /* - * By now, the eBPF program has already setup parameters in r3, r4 and r5 -@@ -285,14 +286,39 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 - bpf_jit_emit_common_epilogue(image, ctx); - - PPC_BCTR(); -+ - /* out: */ -+ return 0; - } - -+/* -+ * We spill into the redzone always, even if the bpf program has its own stackframe. -+ * Offsets hardcoded based on BPF_PPC_STACK_SAVE -- see bpf_jit_stack_local() -+ */ -+void bpf_stf_barrier(void); -+ -+asm ( -+" .global bpf_stf_barrier ;" -+" bpf_stf_barrier: ;" -+" std 21,-64(1) ;" -+" std 22,-56(1) ;" -+" sync ;" -+" ld 21,-64(1) ;" -+" ld 22,-56(1) ;" -+" ori 31,31,0 ;" -+" .rept 14 ;" -+" b 1f ;" -+" 1: ;" -+" .endr ;" -+" blr ;" -+); -+ - /* Assemble the body code between the prologue & epilogue */ - static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, - struct codegen_context *ctx, - u32 *addrs, bool extra_pass) - { -+ enum stf_barrier_type stf_barrier = stf_barrier_type_get(); - const struct bpf_insn *insn = fp->insnsi; - int flen = fp->len; - int i, ret; -@@ -347,18 +373,25 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, - PPC_SUB(dst_reg, dst_reg, src_reg); - goto bpf_alu32_trunc; - case BPF_ALU | BPF_ADD | BPF_K: /* (u32) dst += (u32) imm */ -- case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */ - case BPF_ALU64 | BPF_ADD | BPF_K: /* dst += imm */ -+ if (!imm) { -+ goto bpf_alu32_trunc; -+ } else if (imm >= -32768 && imm < 32768) { -+ PPC_ADDI(dst_reg, dst_reg, IMM_L(imm)); -+ } else { -+ PPC_LI32(b2p[TMP_REG_1], imm); -+ PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]); -+ } -+ goto bpf_alu32_trunc; -+ case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */ - case BPF_ALU64 | BPF_SUB | BPF_K: /* dst -= imm */ -- if (BPF_OP(code) == BPF_SUB) -- imm = -imm; -- if (imm) { -- if (imm >= -32768 && imm < 32768) -- PPC_ADDI(dst_reg, dst_reg, IMM_L(imm)); -- else { -- PPC_LI32(b2p[TMP_REG_1], imm); -- PPC_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]); -- } -+ if (!imm) { -+ goto bpf_alu32_trunc; -+ } else if (imm > -32768 && imm <= 32768) { -+ PPC_ADDI(dst_reg, dst_reg, IMM_L(-imm)); -+ } else { -+ PPC_LI32(b2p[TMP_REG_1], imm); -+ PPC_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]); - } - goto bpf_alu32_trunc; - case BPF_ALU | BPF_MUL | BPF_X: /* (u32) dst *= (u32) src */ -@@ -654,6 +687,30 @@ emit_clear: - * BPF_ST NOSPEC (speculation barrier) - */ - case BPF_ST | BPF_NOSPEC: -+ if (!security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) || -+ (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) && -+ (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) || !cpu_has_feature(CPU_FTR_HVMODE)))) -+ break; -+ -+ switch (stf_barrier) { -+ case STF_BARRIER_EIEIO: -+ EMIT(0x7c0006ac | 0x02000000); -+ break; -+ case STF_BARRIER_SYNC_ORI: -+ EMIT(PPC_INST_SYNC); -+ PPC_LD(b2p[TMP_REG_1], 13, 0); -+ PPC_ORI(31, 31, 0); -+ break; -+ case STF_BARRIER_FALLBACK: -+ EMIT(PPC_INST_MFLR | ___PPC_RT(b2p[TMP_REG_1])); -+ PPC_LI64(12, dereference_kernel_function_descriptor(bpf_stf_barrier)); -+ PPC_MTCTR(12); -+ EMIT(PPC_INST_BCTR | 0x1); -+ PPC_MTLR(b2p[TMP_REG_1]); -+ break; -+ case STF_BARRIER_NONE: -+ break; -+ } - break; - - /* -@@ -1001,7 +1058,9 @@ cond_branch: - */ - case BPF_JMP | BPF_TAIL_CALL: - ctx->seen |= SEEN_TAILCALL; -- bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]); -+ ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]); -+ if (ret < 0) -+ return ret; - break; - - default: -diff --git a/arch/powerpc/platforms/44x/fsp2.c b/arch/powerpc/platforms/44x/fsp2.c -index b299e43f5ef94..823397c802def 100644 ---- a/arch/powerpc/platforms/44x/fsp2.c -+++ b/arch/powerpc/platforms/44x/fsp2.c -@@ -208,6 +208,7 @@ static void node_irq_request(const char *compat, irq_handler_t errirq_handler) - if (irq == NO_IRQ) { - pr_err("device tree node %pOFn is missing a interrupt", - np); -+ of_node_put(np); - return; - } - -@@ -215,6 +216,7 @@ static void node_irq_request(const char *compat, irq_handler_t errirq_handler) - if (rc) { - pr_err("fsp_of_probe: request_irq failed: np=%pOF rc=%d", - np, rc); -+ of_node_put(np); - return; - } - } -diff --git a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c -index 7c0133f558d02..ffa8a7a6a2db7 100644 ---- a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c -+++ b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c -@@ -94,9 +94,8 @@ int __init mpc85xx_setup_pmc(void) - pr_err("Could not map guts node address\n"); - return -ENOMEM; - } -+ qoriq_pm_ops = &mpc85xx_pm_ops; - } - -- qoriq_pm_ops = &mpc85xx_pm_ops; -- - return 0; - } -diff --git a/arch/powerpc/platforms/powernv/opal-prd.c b/arch/powerpc/platforms/powernv/opal-prd.c -index 45f4223a790f2..6ebc906e07b0a 100644 ---- a/arch/powerpc/platforms/powernv/opal-prd.c -+++ b/arch/powerpc/platforms/powernv/opal-prd.c -@@ -372,6 +372,12 @@ static struct notifier_block opal_prd_event_nb = { - .priority = 0, - }; - -+static struct notifier_block opal_prd_event_nb2 = { -+ .notifier_call = opal_prd_msg_notifier, -+ .next = NULL, -+ .priority = 0, -+}; -+ - static int opal_prd_probe(struct platform_device *pdev) - { - int rc; -@@ -393,9 +399,10 @@ static int opal_prd_probe(struct platform_device *pdev) - return rc; - } - -- rc = opal_message_notifier_register(OPAL_MSG_PRD2, &opal_prd_event_nb); -+ rc = opal_message_notifier_register(OPAL_MSG_PRD2, &opal_prd_event_nb2); - if (rc) { - pr_err("Couldn't register PRD2 event notifier\n"); -+ opal_message_notifier_unregister(OPAL_MSG_PRD, &opal_prd_event_nb); - return rc; - } - -@@ -404,6 +411,8 @@ static int opal_prd_probe(struct platform_device *pdev) - pr_err("failed to register miscdev\n"); - opal_message_notifier_unregister(OPAL_MSG_PRD, - &opal_prd_event_nb); -+ opal_message_notifier_unregister(OPAL_MSG_PRD2, -+ &opal_prd_event_nb2); - return rc; - } - -@@ -414,6 +423,7 @@ static int opal_prd_remove(struct platform_device *pdev) - { - misc_deregister(&opal_prd_dev); - opal_message_notifier_unregister(OPAL_MSG_PRD, &opal_prd_event_nb); -+ opal_message_notifier_unregister(OPAL_MSG_PRD2, &opal_prd_event_nb2); - return 0; - } - -diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c -index 560310e29e275..fa69610fe6b12 100644 ---- a/arch/s390/kvm/priv.c -+++ b/arch/s390/kvm/priv.c -@@ -398,6 +398,8 @@ static int handle_sske(struct kvm_vcpu *vcpu) - up_read(¤t->mm->mmap_sem); - if (rc == -EFAULT) - return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING); -+ if (rc == -EAGAIN) -+ continue; - if (rc < 0) - return rc; - start += PAGE_SIZE; -diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c -index 4fa7a562c6fc1..5e5a4e1f0e6cf 100644 ---- a/arch/s390/mm/gmap.c -+++ b/arch/s390/mm/gmap.c -@@ -684,9 +684,10 @@ void __gmap_zap(struct gmap *gmap, unsigned long gaddr) - vmaddr |= gaddr & ~PMD_MASK; - /* Get pointer to the page table entry */ - ptep = get_locked_pte(gmap->mm, vmaddr, &ptl); -- if (likely(ptep)) -+ if (likely(ptep)) { - ptep_zap_unused(gmap->mm, vmaddr, ptep, 0); -- pte_unmap_unlock(ptep, ptl); -+ pte_unmap_unlock(ptep, ptl); -+ } - } - } - EXPORT_SYMBOL_GPL(__gmap_zap); -diff --git a/arch/sh/kernel/cpu/fpu.c b/arch/sh/kernel/cpu/fpu.c -index ae354a2931e7e..fd6db0ab19288 100644 ---- a/arch/sh/kernel/cpu/fpu.c -+++ b/arch/sh/kernel/cpu/fpu.c -@@ -62,18 +62,20 @@ void fpu_state_restore(struct pt_regs *regs) - } - - if (!tsk_used_math(tsk)) { -- local_irq_enable(); -+ int ret; - /* - * does a slab alloc which can sleep - */ -- if (init_fpu(tsk)) { -+ local_irq_enable(); -+ ret = init_fpu(tsk); -+ local_irq_disable(); -+ if (ret) { - /* - * ran out of memory! - */ -- do_group_exit(SIGKILL); -+ force_sig(SIGKILL); - return; - } -- local_irq_disable(); - } - - grab_fpu(regs); -diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c -index 79583bac9ac4a..812db1ac8cb11 100644 ---- a/arch/x86/hyperv/hv_init.c -+++ b/arch/x86/hyperv/hv_init.c -@@ -155,7 +155,6 @@ void set_hv_tscchange_cb(void (*cb)(void)) - struct hv_reenlightenment_control re_ctrl = { - .vector = HYPERV_REENLIGHTENMENT_VECTOR, - .enabled = 1, -- .target_vp = hv_vp_index[smp_processor_id()] - }; - struct hv_tsc_emulation_control emu_ctrl = {.enabled = 1}; - -@@ -169,8 +168,12 @@ void set_hv_tscchange_cb(void (*cb)(void)) - /* Make sure callback is registered before we write to MSRs */ - wmb(); - -+ re_ctrl.target_vp = hv_vp_index[get_cpu()]; -+ - wrmsrl(HV_X64_MSR_REENLIGHTENMENT_CONTROL, *((u64 *)&re_ctrl)); - wrmsrl(HV_X64_MSR_TSC_EMULATION_CONTROL, *((u64 *)&emu_ctrl)); -+ -+ put_cpu(); - } - EXPORT_SYMBOL_GPL(set_hv_tscchange_cb); - -diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h -index 288b065955b72..9d0b479452720 100644 ---- a/arch/x86/include/asm/page_64_types.h -+++ b/arch/x86/include/asm/page_64_types.h -@@ -15,7 +15,7 @@ - #define THREAD_SIZE_ORDER (2 + KASAN_STACK_ORDER) - #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER) - --#define EXCEPTION_STACK_ORDER (0 + KASAN_STACK_ORDER) -+#define EXCEPTION_STACK_ORDER (1 + KASAN_STACK_ORDER) - #define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER) - - #define IRQ_STACK_ORDER (2 + KASAN_STACK_ORDER) -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index 753f3dfbc9c91..88cef978380bf 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -987,6 +987,8 @@ static void init_amd(struct cpuinfo_x86 *c) - if (cpu_has(c, X86_FEATURE_IRPERF) && - !cpu_has_amd_erratum(c, amd_erratum_1054)) - msr_set_bit(MSR_K7_HWCR, MSR_K7_HWCR_IRPERF_EN_BIT); -+ -+ check_null_seg_clears_base(c); - } - - #ifdef CONFIG_X86_32 -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index f961a56e9da3f..4c85ca112a2a9 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -1336,9 +1336,8 @@ void __init early_cpu_init(void) - early_identify_cpu(&boot_cpu_data); - } - --static void detect_null_seg_behavior(struct cpuinfo_x86 *c) -+static bool detect_null_seg_behavior(void) - { --#ifdef CONFIG_X86_64 - /* - * Empirically, writing zero to a segment selector on AMD does - * not clear the base, whereas writing zero to a segment -@@ -1359,10 +1358,43 @@ static void detect_null_seg_behavior(struct cpuinfo_x86 *c) - wrmsrl(MSR_FS_BASE, 1); - loadsegment(fs, 0); - rdmsrl(MSR_FS_BASE, tmp); -- if (tmp != 0) -- set_cpu_bug(c, X86_BUG_NULL_SEG); - wrmsrl(MSR_FS_BASE, old_base); --#endif -+ return tmp == 0; -+} -+ -+void check_null_seg_clears_base(struct cpuinfo_x86 *c) -+{ -+ /* BUG_NULL_SEG is only relevant with 64bit userspace */ -+ if (!IS_ENABLED(CONFIG_X86_64)) -+ return; -+ -+ /* Zen3 CPUs advertise Null Selector Clears Base in CPUID. */ -+ if (c->extended_cpuid_level >= 0x80000021 && -+ cpuid_eax(0x80000021) & BIT(6)) -+ return; -+ -+ /* -+ * CPUID bit above wasn't set. If this kernel is still running -+ * as a HV guest, then the HV has decided not to advertize -+ * that CPUID bit for whatever reason. For example, one -+ * member of the migration pool might be vulnerable. Which -+ * means, the bug is present: set the BUG flag and return. -+ */ -+ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) { -+ set_cpu_bug(c, X86_BUG_NULL_SEG); -+ return; -+ } -+ -+ /* -+ * Zen2 CPUs also have this behaviour, but no CPUID bit. -+ * 0x18 is the respective family for Hygon. -+ */ -+ if ((c->x86 == 0x17 || c->x86 == 0x18) && -+ detect_null_seg_behavior()) -+ return; -+ -+ /* All the remaining ones are affected */ -+ set_cpu_bug(c, X86_BUG_NULL_SEG); - } - - static void generic_identify(struct cpuinfo_x86 *c) -@@ -1398,8 +1430,6 @@ static void generic_identify(struct cpuinfo_x86 *c) - - get_model_name(c); /* Default name */ - -- detect_null_seg_behavior(c); -- - /* - * ESPFIX is a strange bug. All real CPUs have it. Paravirt - * systems that run Linux at CPL > 0 may or may not have the -diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h -index 9d033693519aa..4d04c127c4a79 100644 ---- a/arch/x86/kernel/cpu/cpu.h -+++ b/arch/x86/kernel/cpu/cpu.h -@@ -73,6 +73,7 @@ extern int detect_extended_topology_early(struct cpuinfo_x86 *c); - extern int detect_extended_topology(struct cpuinfo_x86 *c); - extern int detect_ht_early(struct cpuinfo_x86 *c); - extern void detect_ht(struct cpuinfo_x86 *c); -+extern void check_null_seg_clears_base(struct cpuinfo_x86 *c); - - unsigned int aperfmperf_get_khz(int cpu); - -diff --git a/arch/x86/kernel/cpu/hygon.c b/arch/x86/kernel/cpu/hygon.c -index 62e9a982adaf9..b232bd0be78d6 100644 ---- a/arch/x86/kernel/cpu/hygon.c -+++ b/arch/x86/kernel/cpu/hygon.c -@@ -350,6 +350,8 @@ static void init_hygon(struct cpuinfo_x86 *c) - /* Hygon CPUs don't reset SS attributes on SYSRET, Xen does. */ - if (!cpu_has(c, X86_FEATURE_XENPV)) - set_cpu_bug(c, X86_BUG_SYSRET_SS_ATTRS); -+ -+ check_null_seg_clears_base(c); - } - - static void cpu_detect_tlb_hygon(struct cpuinfo_x86 *c) -diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c -index 21efee32e2b12..7dfd0185767cc 100644 ---- a/arch/x86/kernel/irq.c -+++ b/arch/x86/kernel/irq.c -@@ -295,8 +295,10 @@ void kvm_set_posted_intr_wakeup_handler(void (*handler)(void)) - { - if (handler) - kvm_posted_intr_wakeup_handler = handler; -- else -+ else { - kvm_posted_intr_wakeup_handler = dummy_handler; -+ synchronize_rcu(); -+ } - } - EXPORT_SYMBOL_GPL(kvm_set_posted_intr_wakeup_handler); - -diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c -index e177848a36313..0f7c051984062 100644 ---- a/arch/x86/kvm/vmx/vmx.c -+++ b/arch/x86/kvm/vmx/vmx.c -@@ -785,15 +785,15 @@ void update_exception_bitmap(struct kvm_vcpu *vcpu) - /* - * Check if MSR is intercepted for currently loaded MSR bitmap. - */ --static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr) -+static bool msr_write_intercepted(struct vcpu_vmx *vmx, u32 msr) - { - unsigned long *msr_bitmap; - int f = sizeof(unsigned long); - -- if (!cpu_has_vmx_msr_bitmap()) -+ if (!(exec_controls_get(vmx) & CPU_BASED_USE_MSR_BITMAPS)) - return true; - -- msr_bitmap = to_vmx(vcpu)->loaded_vmcs->msr_bitmap; -+ msr_bitmap = vmx->loaded_vmcs->msr_bitmap; - - if (msr <= 0x1fff) { - return !!test_bit(msr, msr_bitmap + 0x800 / f); -@@ -6579,7 +6579,7 @@ static void vmx_vcpu_run(struct kvm_vcpu *vcpu) - * If the L02 MSR bitmap does not intercept the MSR, then we need to - * save it. - */ -- if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) -+ if (unlikely(!msr_write_intercepted(vmx, MSR_IA32_SPEC_CTRL))) - vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); - - x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0); -diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c -index 84cda5dc03870..ebc8e3af1c675 100644 ---- a/arch/x86/mm/mem_encrypt_identity.c -+++ b/arch/x86/mm/mem_encrypt_identity.c -@@ -27,6 +27,15 @@ - #undef CONFIG_PARAVIRT_XXL - #undef CONFIG_PARAVIRT_SPINLOCKS - -+/* -+ * This code runs before CPU feature bits are set. By default, the -+ * pgtable_l5_enabled() function uses bit X86_FEATURE_LA57 to determine if -+ * 5-level paging is active, so that won't work here. USE_EARLY_PGTABLE_L5 -+ * is provided to handle this situation and, instead, use a variable that -+ * has been set by the early boot code. -+ */ -+#define USE_EARLY_PGTABLE_L5 -+ - #include - #include - #include -diff --git a/block/blk-mq.c b/block/blk-mq.c -index 0674f53c60528..84798d09ca464 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -733,7 +733,6 @@ void blk_mq_requeue_request(struct request *rq, bool kick_requeue_list) - /* this request will be re-inserted to io scheduler queue */ - blk_mq_sched_requeue_request(rq); - -- BUG_ON(!list_empty(&rq->queuelist)); - blk_mq_add_to_requeue_list(rq, true, kick_requeue_list); - } - EXPORT_SYMBOL(blk_mq_requeue_request); -diff --git a/crypto/Kconfig b/crypto/Kconfig -index b2cc0ad3792ad..ce60ec30e78df 100644 ---- a/crypto/Kconfig -+++ b/crypto/Kconfig -@@ -242,12 +242,12 @@ config CRYPTO_DH - - config CRYPTO_ECC - tristate -+ select CRYPTO_RNG_DEFAULT - - config CRYPTO_ECDH - tristate "ECDH algorithm" - select CRYPTO_ECC - select CRYPTO_KPP -- select CRYPTO_RNG_DEFAULT - help - Generic implementation of the ECDH algorithm - -diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c -index a4f3b3f342c8d..276d2fd9e911c 100644 ---- a/crypto/pcrypt.c -+++ b/crypto/pcrypt.c -@@ -79,12 +79,14 @@ static void pcrypt_aead_enc(struct padata_priv *padata) - { - struct pcrypt_request *preq = pcrypt_padata_request(padata); - struct aead_request *req = pcrypt_request_ctx(preq); -+ int ret; - -- padata->info = crypto_aead_encrypt(req); -+ ret = crypto_aead_encrypt(req); - -- if (padata->info == -EINPROGRESS) -+ if (ret == -EINPROGRESS) - return; - -+ padata->info = ret; - padata_do_serial(padata); - } - -@@ -124,12 +126,14 @@ static void pcrypt_aead_dec(struct padata_priv *padata) - { - struct pcrypt_request *preq = pcrypt_padata_request(padata); - struct aead_request *req = pcrypt_request_ctx(preq); -+ int ret; - -- padata->info = crypto_aead_decrypt(req); -+ ret = crypto_aead_decrypt(req); - -- if (padata->info == -EINPROGRESS) -+ if (ret == -EINPROGRESS) - return; - -+ padata->info = ret; - padata_do_serial(padata); - } - -diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h -index fd3beea934213..42c4bfd796f42 100644 ---- a/drivers/acpi/acpica/acglobal.h -+++ b/drivers/acpi/acpica/acglobal.h -@@ -220,6 +220,8 @@ extern struct acpi_bit_register_info - acpi_gbl_bit_register_info[ACPI_NUM_BITREG]; - ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a); - ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b); -+ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a_s0); -+ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b_s0); - - /***************************************************************************** - * -diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c -index dee3affaca491..aa502ae3b6b31 100644 ---- a/drivers/acpi/acpica/hwesleep.c -+++ b/drivers/acpi/acpica/hwesleep.c -@@ -147,17 +147,13 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state) - - acpi_status acpi_hw_extended_wake_prep(u8 sleep_state) - { -- acpi_status status; - u8 sleep_type_value; - - ACPI_FUNCTION_TRACE(hw_extended_wake_prep); - -- status = acpi_get_sleep_type_data(ACPI_STATE_S0, -- &acpi_gbl_sleep_type_a, -- &acpi_gbl_sleep_type_b); -- if (ACPI_SUCCESS(status)) { -+ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) { - sleep_type_value = -- ((acpi_gbl_sleep_type_a << ACPI_X_SLEEP_TYPE_POSITION) & -+ ((acpi_gbl_sleep_type_a_s0 << ACPI_X_SLEEP_TYPE_POSITION) & - ACPI_X_SLEEP_TYPE_MASK); - - (void)acpi_write((u64)(sleep_type_value | ACPI_X_SLEEP_ENABLE), -diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c -index b62db8ec446fa..5f7d63badbe9d 100644 ---- a/drivers/acpi/acpica/hwsleep.c -+++ b/drivers/acpi/acpica/hwsleep.c -@@ -179,7 +179,7 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state) - - acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state) - { -- acpi_status status; -+ acpi_status status = AE_OK; - struct acpi_bit_register_info *sleep_type_reg_info; - struct acpi_bit_register_info *sleep_enable_reg_info; - u32 pm1a_control; -@@ -192,10 +192,7 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state) - * This is unclear from the ACPI Spec, but it is required - * by some machines. - */ -- status = acpi_get_sleep_type_data(ACPI_STATE_S0, -- &acpi_gbl_sleep_type_a, -- &acpi_gbl_sleep_type_b); -- if (ACPI_SUCCESS(status)) { -+ if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) { - sleep_type_reg_info = - acpi_hw_get_bit_register_info(ACPI_BITREG_SLEEP_TYPE); - sleep_enable_reg_info = -@@ -216,9 +213,9 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state) - - /* Insert the SLP_TYP bits */ - -- pm1a_control |= (acpi_gbl_sleep_type_a << -+ pm1a_control |= (acpi_gbl_sleep_type_a_s0 << - sleep_type_reg_info->bit_position); -- pm1b_control |= (acpi_gbl_sleep_type_b << -+ pm1b_control |= (acpi_gbl_sleep_type_b_s0 << - sleep_type_reg_info->bit_position); - - /* Write the control registers and ignore any errors */ -diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c -index abbf9702aa7f2..79731efbe8fe2 100644 ---- a/drivers/acpi/acpica/hwxfsleep.c -+++ b/drivers/acpi/acpica/hwxfsleep.c -@@ -214,6 +214,13 @@ acpi_status acpi_enter_sleep_state_prep(u8 sleep_state) - return_ACPI_STATUS(status); - } - -+ status = acpi_get_sleep_type_data(ACPI_STATE_S0, -+ &acpi_gbl_sleep_type_a_s0, -+ &acpi_gbl_sleep_type_b_s0); -+ if (ACPI_FAILURE(status)) { -+ acpi_gbl_sleep_type_a_s0 = ACPI_SLEEP_TYPE_INVALID; -+ } -+ - /* Execute the _PTS method (Prepare To Sleep) */ - - arg_list.count = 1; -diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c -index 254a7d98b9d4c..6e96ed68b3379 100644 ---- a/drivers/acpi/battery.c -+++ b/drivers/acpi/battery.c -@@ -185,7 +185,7 @@ static int acpi_battery_is_charged(struct acpi_battery *battery) - return 1; - - /* fallback to using design values for broken batteries */ -- if (battery->design_capacity == battery->capacity_now) -+ if (battery->design_capacity <= battery->capacity_now) - return 1; - - /* we don't do any sort of metric based on percentages */ -diff --git a/drivers/acpi/pmic/intel_pmic.c b/drivers/acpi/pmic/intel_pmic.c -index 452041398b347..36d5a5d50b2ff 100644 ---- a/drivers/acpi/pmic/intel_pmic.c -+++ b/drivers/acpi/pmic/intel_pmic.c -@@ -211,31 +211,36 @@ static acpi_status intel_pmic_regs_handler(u32 function, - void *handler_context, void *region_context) - { - struct intel_pmic_opregion *opregion = region_context; -- int result = 0; -+ int result = -EINVAL; -+ -+ if (function == ACPI_WRITE) { -+ switch (address) { -+ case 0: -+ return AE_OK; -+ case 1: -+ opregion->ctx.addr |= (*value64 & 0xff) << 8; -+ return AE_OK; -+ case 2: -+ opregion->ctx.addr |= *value64 & 0xff; -+ return AE_OK; -+ case 3: -+ opregion->ctx.val = *value64 & 0xff; -+ return AE_OK; -+ case 4: -+ if (*value64) { -+ result = regmap_write(opregion->regmap, opregion->ctx.addr, -+ opregion->ctx.val); -+ } else { -+ result = regmap_read(opregion->regmap, opregion->ctx.addr, -+ &opregion->ctx.val); -+ } -+ opregion->ctx.addr = 0; -+ } -+ } - -- switch (address) { -- case 0: -- return AE_OK; -- case 1: -- opregion->ctx.addr |= (*value64 & 0xff) << 8; -- return AE_OK; -- case 2: -- opregion->ctx.addr |= *value64 & 0xff; -+ if (function == ACPI_READ && address == 3) { -+ *value64 = opregion->ctx.val; - return AE_OK; -- case 3: -- opregion->ctx.val = *value64 & 0xff; -- return AE_OK; -- case 4: -- if (*value64) { -- result = regmap_write(opregion->regmap, opregion->ctx.addr, -- opregion->ctx.val); -- } else { -- result = regmap_read(opregion->regmap, opregion->ctx.addr, -- &opregion->ctx.val); -- if (result == 0) -- *value64 = opregion->ctx.val; -- } -- memset(&opregion->ctx, 0x00, sizeof(opregion->ctx)); - } - - if (result < 0) { -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 2be6687c0148f..47f839bc0234f 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -424,6 +424,9 @@ enum binder_deferred_state { - * (invariant after initialized) - * @tsk task_struct for group_leader of process - * (invariant after initialized) -+ * @cred struct cred associated with the `struct file` -+ * in binder_open() -+ * (invariant after initialized) - * @deferred_work_node: element for binder_deferred_list - * (protected by binder_deferred_lock) - * @deferred_work: bitmap of deferred work to perform -@@ -469,6 +472,7 @@ struct binder_proc { - struct list_head waiting_threads; - int pid; - struct task_struct *tsk; -+ const struct cred *cred; - struct hlist_node deferred_work_node; - int deferred_work; - bool is_dead; -@@ -2442,7 +2446,7 @@ static int binder_translate_binder(struct flat_binder_object *fp, - ret = -EINVAL; - goto done; - } -- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) { -+ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { - ret = -EPERM; - goto done; - } -@@ -2488,7 +2492,7 @@ static int binder_translate_handle(struct flat_binder_object *fp, - proc->pid, thread->pid, fp->handle); - return -EINVAL; - } -- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) { -+ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { - ret = -EPERM; - goto done; - } -@@ -2576,7 +2580,7 @@ static int binder_translate_fd(u32 fd, binder_size_t fd_offset, - ret = -EBADF; - goto err_fget; - } -- ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file); -+ ret = security_binder_transfer_file(proc->cred, target_proc->cred, file); - if (ret < 0) { - ret = -EPERM; - goto err_security; -@@ -2975,8 +2979,8 @@ static void binder_transaction(struct binder_proc *proc, - return_error_line = __LINE__; - goto err_invalid_target_handle; - } -- if (security_binder_transaction(proc->tsk, -- target_proc->tsk) < 0) { -+ if (security_binder_transaction(proc->cred, -+ target_proc->cred) < 0) { - return_error = BR_FAILED_REPLY; - return_error_param = -EPERM; - return_error_line = __LINE__; -@@ -3091,7 +3095,7 @@ static void binder_transaction(struct binder_proc *proc, - t->from = thread; - else - t->from = NULL; -- t->sender_euid = task_euid(proc->tsk); -+ t->sender_euid = proc->cred->euid; - t->to_proc = target_proc; - t->to_thread = target_thread; - t->code = tr->code; -@@ -3102,7 +3106,7 @@ static void binder_transaction(struct binder_proc *proc, - u32 secid; - size_t added_size; - -- security_task_getsecid(proc->tsk, &secid); -+ security_cred_getsecid(proc->cred, &secid); - ret = security_secid_to_secctx(secid, &secctx, &secctx_sz); - if (ret) { - return_error = BR_FAILED_REPLY; -@@ -4707,6 +4711,7 @@ static void binder_free_proc(struct binder_proc *proc) - } - binder_alloc_deferred_release(&proc->alloc); - put_task_struct(proc->tsk); -+ put_cred(proc->cred); - binder_stats_deleted(BINDER_STAT_PROC); - kfree(proc); - } -@@ -4917,7 +4922,7 @@ static int binder_ioctl_set_ctx_mgr(struct file *filp, - ret = -EBUSY; - goto out; - } -- ret = security_binder_set_context_mgr(proc->tsk); -+ ret = security_binder_set_context_mgr(proc->cred); - if (ret < 0) - goto out; - if (uid_valid(context->binder_context_mgr_uid)) { -@@ -5234,6 +5239,7 @@ static int binder_open(struct inode *nodp, struct file *filp) - spin_lock_init(&proc->outer_lock); - get_task_struct(current->group_leader); - proc->tsk = current->group_leader; -+ proc->cred = get_cred(filp->f_cred); - INIT_LIST_HEAD(&proc->todo); - proc->default_priority = task_nice(current); - /* binderfs stashes devices in i_private */ -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 7c6c05fd5dfc3..bed433fd9c700 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -2057,7 +2057,7 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log, - - retry: - ata_tf_init(dev, &tf); -- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) && -+ if (ata_dma_enabled(dev) && ata_id_has_read_log_dma_ext(dev->id) && - !(dev->horkage & ATA_HORKAGE_NO_DMA_LOG)) { - tf.command = ATA_CMD_READ_LOG_DMA_EXT; - tf.protocol = ATA_PROT_DMA; -diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c -index 3bfd9da584734..c6a21a784ec65 100644 ---- a/drivers/ata/libata-eh.c -+++ b/drivers/ata/libata-eh.c -@@ -97,6 +97,12 @@ static const unsigned long ata_eh_identify_timeouts[] = { - ULONG_MAX, - }; - -+static const unsigned long ata_eh_revalidate_timeouts[] = { -+ 15000, /* Some drives are slow to read log pages when waking-up */ -+ 15000, /* combined time till here is enough even for media access */ -+ ULONG_MAX, -+}; -+ - static const unsigned long ata_eh_flush_timeouts[] = { - 15000, /* be generous with flush */ - 15000, /* ditto */ -@@ -133,6 +139,8 @@ static const struct ata_eh_cmd_timeout_ent - ata_eh_cmd_timeout_table[ATA_EH_CMD_TIMEOUT_TABLE_SIZE] = { - { .commands = CMDS(ATA_CMD_ID_ATA, ATA_CMD_ID_ATAPI), - .timeouts = ata_eh_identify_timeouts, }, -+ { .commands = CMDS(ATA_CMD_READ_LOG_EXT, ATA_CMD_READ_LOG_DMA_EXT), -+ .timeouts = ata_eh_revalidate_timeouts, }, - { .commands = CMDS(ATA_CMD_READ_NATIVE_MAX, ATA_CMD_READ_NATIVE_MAX_EXT), - .timeouts = ata_eh_other_timeouts, }, - { .commands = CMDS(ATA_CMD_SET_MAX, ATA_CMD_SET_MAX_EXT), -diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c -index 33b887b389061..59109b410c67f 100644 ---- a/drivers/auxdisplay/ht16k33.c -+++ b/drivers/auxdisplay/ht16k33.c -@@ -219,6 +219,15 @@ static const struct backlight_ops ht16k33_bl_ops = { - .check_fb = ht16k33_bl_check_fb, - }; - -+/* -+ * Blank events will be passed to the actual device handling the backlight when -+ * we return zero here. -+ */ -+static int ht16k33_blank(int blank, struct fb_info *info) -+{ -+ return 0; -+} -+ - static int ht16k33_mmap(struct fb_info *info, struct vm_area_struct *vma) - { - struct ht16k33_priv *priv = info->par; -@@ -231,6 +240,7 @@ static struct fb_ops ht16k33_fb_ops = { - .owner = THIS_MODULE, - .fb_read = fb_sys_read, - .fb_write = fb_sys_write, -+ .fb_blank = ht16k33_blank, - .fb_fillrect = sys_fillrect, - .fb_copyarea = sys_copyarea, - .fb_imageblit = sys_imageblit, -@@ -418,6 +428,33 @@ static int ht16k33_probe(struct i2c_client *client, - if (err) - return err; - -+ /* Backlight */ -+ memset(&bl_props, 0, sizeof(struct backlight_properties)); -+ bl_props.type = BACKLIGHT_RAW; -+ bl_props.max_brightness = MAX_BRIGHTNESS; -+ -+ bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl", -+ &client->dev, priv, -+ &ht16k33_bl_ops, &bl_props); -+ if (IS_ERR(bl)) { -+ dev_err(&client->dev, "failed to register backlight\n"); -+ return PTR_ERR(bl); -+ } -+ -+ err = of_property_read_u32(node, "default-brightness-level", -+ &dft_brightness); -+ if (err) { -+ dft_brightness = MAX_BRIGHTNESS; -+ } else if (dft_brightness > MAX_BRIGHTNESS) { -+ dev_warn(&client->dev, -+ "invalid default brightness level: %u, using %u\n", -+ dft_brightness, MAX_BRIGHTNESS); -+ dft_brightness = MAX_BRIGHTNESS; -+ } -+ -+ bl->props.brightness = dft_brightness; -+ ht16k33_bl_update_status(bl); -+ - /* Framebuffer (2 bytes per column) */ - BUILD_BUG_ON(PAGE_SIZE < HT16K33_FB_SIZE); - fbdev->buffer = (unsigned char *) get_zeroed_page(GFP_KERNEL); -@@ -450,6 +487,7 @@ static int ht16k33_probe(struct i2c_client *client, - fbdev->info->screen_size = HT16K33_FB_SIZE; - fbdev->info->fix = ht16k33_fb_fix; - fbdev->info->var = ht16k33_fb_var; -+ fbdev->info->bl_dev = bl; - fbdev->info->pseudo_palette = NULL; - fbdev->info->flags = FBINFO_FLAG_DEFAULT; - fbdev->info->par = priv; -@@ -462,34 +500,6 @@ static int ht16k33_probe(struct i2c_client *client, - if (err) - goto err_fbdev_unregister; - -- /* Backlight */ -- memset(&bl_props, 0, sizeof(struct backlight_properties)); -- bl_props.type = BACKLIGHT_RAW; -- bl_props.max_brightness = MAX_BRIGHTNESS; -- -- bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl", -- &client->dev, priv, -- &ht16k33_bl_ops, &bl_props); -- if (IS_ERR(bl)) { -- dev_err(&client->dev, "failed to register backlight\n"); -- err = PTR_ERR(bl); -- goto err_fbdev_unregister; -- } -- -- err = of_property_read_u32(node, "default-brightness-level", -- &dft_brightness); -- if (err) { -- dft_brightness = MAX_BRIGHTNESS; -- } else if (dft_brightness > MAX_BRIGHTNESS) { -- dev_warn(&client->dev, -- "invalid default brightness level: %u, using %u\n", -- dft_brightness, MAX_BRIGHTNESS); -- dft_brightness = MAX_BRIGHTNESS; -- } -- -- bl->props.brightness = dft_brightness; -- ht16k33_bl_update_status(bl); -- - ht16k33_fb_queue(priv); - return 0; - -diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c -index efb928e25aef3..9556d6827f005 100644 ---- a/drivers/auxdisplay/img-ascii-lcd.c -+++ b/drivers/auxdisplay/img-ascii-lcd.c -@@ -280,6 +280,16 @@ static int img_ascii_lcd_display(struct img_ascii_lcd_ctx *ctx, - if (msg[count - 1] == '\n') - count--; - -+ if (!count) { -+ /* clear the LCD */ -+ devm_kfree(&ctx->pdev->dev, ctx->message); -+ ctx->message = NULL; -+ ctx->message_len = 0; -+ memset(ctx->curr, ' ', ctx->cfg->num_chars); -+ ctx->cfg->update(ctx); -+ return 0; -+ } -+ - new_msg = devm_kmalloc(&ctx->pdev->dev, count + 1, GFP_KERNEL); - if (!new_msg) - return -ENOMEM; -diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c -index bd7d3bb8b890b..ad4cf10749100 100644 ---- a/drivers/block/ataflop.c -+++ b/drivers/block/ataflop.c -@@ -653,9 +653,6 @@ static inline void copy_buffer(void *from, void *to) - *p2++ = *p1++; - } - -- -- -- - /* General Interrupt Handling */ - - static void (*FloppyIRQHandler)( int status ) = NULL; -@@ -1225,6 +1222,7 @@ static void fd_rwsec_done1(int status) - } - else { - /* all sectors finished */ -+ finish_fdc(); - fd_end_request_cur(BLK_STS_OK); - } - return; -@@ -1472,15 +1470,6 @@ static void setup_req_params( int drive ) - ReqTrack, ReqSector, (unsigned long)ReqData )); - } - --static void ataflop_commit_rqs(struct blk_mq_hw_ctx *hctx) --{ -- spin_lock_irq(&ataflop_lock); -- atari_disable_irq(IRQ_MFP_FDC); -- finish_fdc(); -- atari_enable_irq(IRQ_MFP_FDC); -- spin_unlock_irq(&ataflop_lock); --} -- - static blk_status_t ataflop_queue_rq(struct blk_mq_hw_ctx *hctx, - const struct blk_mq_queue_data *bd) - { -@@ -1488,6 +1477,8 @@ static blk_status_t ataflop_queue_rq(struct blk_mq_hw_ctx *hctx, - int drive = floppy - unit; - int type = floppy->type; - -+ DPRINT(("Queue request: drive %d type %d last %d\n", drive, type, bd->last)); -+ - spin_lock_irq(&ataflop_lock); - if (fd_request) { - spin_unlock_irq(&ataflop_lock); -@@ -1547,8 +1538,6 @@ static blk_status_t ataflop_queue_rq(struct blk_mq_hw_ctx *hctx, - setup_req_params( drive ); - do_fd_action( drive ); - -- if (bd->last) -- finish_fdc(); - atari_enable_irq( IRQ_MFP_FDC ); - - out: -@@ -1958,7 +1947,6 @@ static const struct block_device_operations floppy_fops = { - - static const struct blk_mq_ops ataflop_mq_ops = { - .queue_rq = ataflop_queue_rq, -- .commit_rqs = ataflop_commit_rqs, - }; - - static struct kobject *floppy_find(dev_t dev, int *part, void *data) -diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c -index 719c6b7741afa..1cc9b67e9bcaa 100644 ---- a/drivers/block/zram/zram_drv.c -+++ b/drivers/block/zram/zram_drv.c -@@ -901,7 +901,7 @@ static ssize_t read_block_state(struct file *file, char __user *buf, - zram_test_flag(zram, index, ZRAM_HUGE) ? 'h' : '.', - zram_test_flag(zram, index, ZRAM_IDLE) ? 'i' : '.'); - -- if (count < copied) { -+ if (count <= copied) { - zram_slot_unlock(zram, index); - break; - } -diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c -index 8a81fbca5c9d8..2beb2321825e3 100644 ---- a/drivers/bluetooth/btmtkuart.c -+++ b/drivers/bluetooth/btmtkuart.c -@@ -158,8 +158,10 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, - int err; - - hlen = sizeof(*hdr) + wmt_params->dlen; -- if (hlen > 255) -- return -EINVAL; -+ if (hlen > 255) { -+ err = -EINVAL; -+ goto err_free_skb; -+ } - - hdr = (struct mtk_wmt_hdr *)&wc; - hdr->dir = 1; -@@ -173,7 +175,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, - err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc); - if (err < 0) { - clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); -- return err; -+ goto err_free_skb; - } - - /* The vendor specific WMT commands are all answered by a vendor -@@ -190,13 +192,14 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, - if (err == -EINTR) { - bt_dev_err(hdev, "Execution of wmt command interrupted"); - clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); -- return err; -+ goto err_free_skb; - } - - if (err) { - bt_dev_err(hdev, "Execution of wmt command timed out"); - clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); -- return -ETIMEDOUT; -+ err = -ETIMEDOUT; -+ goto err_free_skb; - } - - /* Parse and handle the return WMT event */ -diff --git a/drivers/char/hw_random/mtk-rng.c b/drivers/char/hw_random/mtk-rng.c -index e649be5a5f132..6670516fa194d 100644 ---- a/drivers/char/hw_random/mtk-rng.c -+++ b/drivers/char/hw_random/mtk-rng.c -@@ -173,8 +173,13 @@ static int mtk_rng_runtime_resume(struct device *dev) - return mtk_rng_init(&priv->rng); - } - --static UNIVERSAL_DEV_PM_OPS(mtk_rng_pm_ops, mtk_rng_runtime_suspend, -- mtk_rng_runtime_resume, NULL); -+static const struct dev_pm_ops mtk_rng_pm_ops = { -+ SET_RUNTIME_PM_OPS(mtk_rng_runtime_suspend, -+ mtk_rng_runtime_resume, NULL) -+ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, -+ pm_runtime_force_resume) -+}; -+ - #define MTK_RNG_PM_OPS (&mtk_rng_pm_ops) - #else /* CONFIG_PM */ - #define MTK_RNG_PM_OPS NULL -diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c -index ac656a6d5daf1..bd3c9fb029fa5 100644 ---- a/drivers/char/ipmi/ipmi_msghandler.c -+++ b/drivers/char/ipmi/ipmi_msghandler.c -@@ -4797,7 +4797,9 @@ static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0); - static void free_smi_msg(struct ipmi_smi_msg *msg) - { - atomic_dec(&smi_msg_inuse_count); -- kfree(msg); -+ /* Try to keep as much stuff out of the panic path as possible. */ -+ if (!oops_in_progress) -+ kfree(msg); - } - - struct ipmi_smi_msg *ipmi_alloc_smi_msg(void) -@@ -4816,7 +4818,9 @@ EXPORT_SYMBOL(ipmi_alloc_smi_msg); - static void free_recv_msg(struct ipmi_recv_msg *msg) - { - atomic_dec(&recv_msg_inuse_count); -- kfree(msg); -+ /* Try to keep as much stuff out of the panic path as possible. */ -+ if (!oops_in_progress) -+ kfree(msg); - } - - static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void) -@@ -4834,7 +4838,7 @@ static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void) - - void ipmi_free_recv_msg(struct ipmi_recv_msg *msg) - { -- if (msg->user) -+ if (msg->user && !oops_in_progress) - kref_put(&msg->user->refcount, free_user); - msg->done(msg); - } -diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c -index ae06e5402e9d5..72ad7fff64a7a 100644 ---- a/drivers/char/ipmi/ipmi_watchdog.c -+++ b/drivers/char/ipmi/ipmi_watchdog.c -@@ -337,13 +337,17 @@ static atomic_t msg_tofree = ATOMIC_INIT(0); - static DECLARE_COMPLETION(msg_wait); - static void msg_free_smi(struct ipmi_smi_msg *msg) - { -- if (atomic_dec_and_test(&msg_tofree)) -- complete(&msg_wait); -+ if (atomic_dec_and_test(&msg_tofree)) { -+ if (!oops_in_progress) -+ complete(&msg_wait); -+ } - } - static void msg_free_recv(struct ipmi_recv_msg *msg) - { -- if (atomic_dec_and_test(&msg_tofree)) -- complete(&msg_wait); -+ if (atomic_dec_and_test(&msg_tofree)) { -+ if (!oops_in_progress) -+ complete(&msg_wait); -+ } - } - static struct ipmi_smi_msg smi_msg = { - .done = msg_free_smi -@@ -429,8 +433,10 @@ static int _ipmi_set_timeout(int do_heartbeat) - rv = __ipmi_set_timeout(&smi_msg, - &recv_msg, - &send_heartbeat_now); -- if (rv) -+ if (rv) { -+ atomic_set(&msg_tofree, 0); - return rv; -+ } - - wait_for_completion(&msg_wait); - -@@ -575,6 +581,7 @@ restart: - &recv_msg, - 1); - if (rv) { -+ atomic_set(&msg_tofree, 0); - pr_warn("heartbeat send failure: %d\n", rv); - return rv; - } -diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c -index 784b8b3cb903f..97e916856cf3e 100644 ---- a/drivers/char/tpm/tpm2-space.c -+++ b/drivers/char/tpm/tpm2-space.c -@@ -455,6 +455,9 @@ static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp, - if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES) - return 0; - -+ if (be32_to_cpu(data->count) > (UINT_MAX - TPM_HEADER_SIZE - 9) / 4) -+ return -EFAULT; -+ - if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count)) - return -EFAULT; - -diff --git a/drivers/clk/at91/pmc.c b/drivers/clk/at91/pmc.c -index b71515acdec1f..976ca41e9157e 100644 ---- a/drivers/clk/at91/pmc.c -+++ b/drivers/clk/at91/pmc.c -@@ -275,6 +275,11 @@ static int __init pmc_register_ops(void) - - np = of_find_matching_node(NULL, sama5d2_pmc_dt_ids); - -+ if (!of_device_is_available(np)) { -+ of_node_put(np); -+ return -ENODEV; -+ } -+ - pmcreg = device_node_to_regmap(np); - if (IS_ERR(pmcreg)) - return PTR_ERR(pmcreg); -diff --git a/drivers/clk/mvebu/ap-cpu-clk.c b/drivers/clk/mvebu/ap-cpu-clk.c -index af5e5acad3706..bde4a7d6a1d33 100644 ---- a/drivers/clk/mvebu/ap-cpu-clk.c -+++ b/drivers/clk/mvebu/ap-cpu-clk.c -@@ -256,12 +256,15 @@ static int ap_cpu_clock_probe(struct platform_device *pdev) - int cpu, err; - - err = of_property_read_u32(dn, "reg", &cpu); -- if (WARN_ON(err)) -+ if (WARN_ON(err)) { -+ of_node_put(dn); - return err; -+ } - - /* If cpu2 or cpu3 is enabled */ - if (cpu & APN806_CLUSTER_NUM_MASK) { - nclusters = 2; -+ of_node_put(dn); - break; - } - } -@@ -288,8 +291,10 @@ static int ap_cpu_clock_probe(struct platform_device *pdev) - int cpu, err; - - err = of_property_read_u32(dn, "reg", &cpu); -- if (WARN_ON(err)) -+ if (WARN_ON(err)) { -+ of_node_put(dn); - return err; -+ } - - cluster_index = cpu & APN806_CLUSTER_NUM_MASK; - cluster_index >>= APN806_CLUSTER_NUM_OFFSET; -@@ -301,6 +306,7 @@ static int ap_cpu_clock_probe(struct platform_device *pdev) - parent = of_clk_get(np, cluster_index); - if (IS_ERR(parent)) { - dev_err(dev, "Could not get the clock parent\n"); -+ of_node_put(dn); - return -EINVAL; - } - parent_name = __clk_get_name(parent); -@@ -319,8 +325,10 @@ static int ap_cpu_clock_probe(struct platform_device *pdev) - init.parent_names = &parent_name; - - ret = devm_clk_hw_register(dev, &ap_cpu_clk[cluster_index].hw); -- if (ret) -+ if (ret) { -+ of_node_put(dn); - return ret; -+ } - ap_cpu_data->hws[cluster_index] = &ap_cpu_clk[cluster_index].hw; - } - -diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig -index 3bb5625504e2f..9bfe4c5af87e3 100644 ---- a/drivers/clocksource/Kconfig -+++ b/drivers/clocksource/Kconfig -@@ -24,6 +24,7 @@ config I8253_LOCK - - config OMAP_DM_TIMER - bool -+ select TIMER_OF - - config CLKBLD_I8253 - def_bool y if CLKSRC_I8253 || CLKEVT_I8253 || I8253_LOCK -diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c -index f8747322b3c70..e591f56f98c03 100644 ---- a/drivers/cpuidle/sysfs.c -+++ b/drivers/cpuidle/sysfs.c -@@ -481,6 +481,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device) - &kdev->kobj, "state%d", i); - if (ret) { - kobject_put(&kobj->kobj); -+ kfree(kobj); - goto error_state; - } - cpuidle_add_s2idle_attr_group(kobj); -@@ -612,6 +613,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev) - &kdev->kobj, "driver"); - if (ret) { - kobject_put(&kdrv->kobj); -+ kfree(kdrv); - return ret; - } - -@@ -698,7 +700,6 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev) - if (!kdev) - return -ENOMEM; - kdev->dev = dev; -- dev->kobj_dev = kdev; - - init_completion(&kdev->kobj_unregister); - -@@ -706,9 +707,11 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev) - "cpuidle"); - if (error) { - kobject_put(&kdev->kobj); -+ kfree(kdev); - return error; - } - -+ dev->kobj_dev = kdev; - kobject_uevent(&kdev->kobj, KOBJ_ADD); - - return 0; -diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c -index 83f96d4f86e03..30e3f41ed8721 100644 ---- a/drivers/crypto/caam/caampkc.c -+++ b/drivers/crypto/caam/caampkc.c -@@ -1087,16 +1087,27 @@ static struct caam_akcipher_alg caam_rsa = { - int caam_pkc_init(struct device *ctrldev) - { - struct caam_drv_private *priv = dev_get_drvdata(ctrldev); -- u32 pk_inst; -+ u32 pk_inst, pkha; - int err; - init_done = false; - - /* Determine public key hardware accelerator presence. */ -- if (priv->era < 10) -+ if (priv->era < 10) { - pk_inst = (rd_reg32(&priv->ctrl->perfmon.cha_num_ls) & - CHA_ID_LS_PK_MASK) >> CHA_ID_LS_PK_SHIFT; -- else -- pk_inst = rd_reg32(&priv->ctrl->vreg.pkha) & CHA_VER_NUM_MASK; -+ } else { -+ pkha = rd_reg32(&priv->ctrl->vreg.pkha); -+ pk_inst = pkha & CHA_VER_NUM_MASK; -+ -+ /* -+ * Newer CAAMs support partially disabled functionality. If this is the -+ * case, the number is non-zero, but this bit is set to indicate that -+ * no encryption or decryption is supported. Only signing and verifying -+ * is supported. -+ */ -+ if (pkha & CHA_VER_MISC_PKHA_NO_CRYPT) -+ pk_inst = 0; -+ } - - /* Do not register algorithms if PKHA is not present. */ - if (!pk_inst) -diff --git a/drivers/crypto/caam/regs.h b/drivers/crypto/caam/regs.h -index 05127b70527d7..43975f01465d2 100644 ---- a/drivers/crypto/caam/regs.h -+++ b/drivers/crypto/caam/regs.h -@@ -317,6 +317,9 @@ struct version_regs { - /* CHA Miscellaneous Information - AESA_MISC specific */ - #define CHA_VER_MISC_AES_GCM BIT(1 + CHA_VER_MISC_SHIFT) - -+/* CHA Miscellaneous Information - PKHA_MISC specific */ -+#define CHA_VER_MISC_PKHA_NO_CRYPT BIT(7 + CHA_VER_MISC_SHIFT) -+ - /* - * caam_perfmon - Performance Monitor/Secure Memory Status/ - * CAAM Global Status/Component Version IDs -diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c -index c64481160b711..180016e157771 100644 ---- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c -+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c -@@ -195,6 +195,13 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr) - val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset); - } while ((val & int_bit) && (count++ < ADF_IOV_MSG_ACK_MAX_RETRY)); - -+ if (val != msg) { -+ dev_dbg(&GET_DEV(accel_dev), -+ "Collision - PFVF CSR overwritten by remote function\n"); -+ ret = -EIO; -+ goto out; -+ } -+ - if (val & int_bit) { - dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n"); - val &= ~int_bit; -@@ -243,6 +250,11 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info) - - /* Read message from the VF */ - msg = ADF_CSR_RD(pmisc_addr, hw_data->get_pf2vf_offset(vf_nr)); -+ if (!(msg & ADF_VF2PF_INT)) { -+ dev_info(&GET_DEV(accel_dev), -+ "Spurious VF2PF interrupt, msg %X. Ignored\n", msg); -+ goto out; -+ } - - /* To ACK, clear the VF2PFINT bit */ - msg &= ~ADF_VF2PF_INT; -@@ -326,6 +338,7 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info) - if (resp && adf_iov_putmsg(accel_dev, resp, vf_nr)) - dev_err(&GET_DEV(accel_dev), "Failed to send response to VF\n"); - -+out: - /* re-enable interrupt on PF from this VF */ - adf_enable_vf2pf_interrupts(accel_dev, (1 << vf_nr)); - return; -diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c -index ef90902c8200d..86274e3c6781d 100644 ---- a/drivers/crypto/qat/qat_common/adf_vf_isr.c -+++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c -@@ -123,6 +123,11 @@ static void adf_pf2vf_bh_handler(void *data) - - /* Read the message from PF */ - msg = ADF_CSR_RD(pmisc_bar_addr, hw_data->get_pf2vf_offset(0)); -+ if (!(msg & ADF_PF2VF_INT)) { -+ dev_info(&GET_DEV(accel_dev), -+ "Spurious PF2VF interrupt, msg %X. Ignored\n", msg); -+ goto out; -+ } - - if (!(msg & ADF_PF2VF_MSGORIGIN_SYSTEM)) - /* Ignore legacy non-system (non-kernel) PF2VF messages */ -@@ -171,6 +176,7 @@ static void adf_pf2vf_bh_handler(void *data) - msg &= ~ADF_PF2VF_INT; - ADF_CSR_WR(pmisc_bar_addr, hw_data->get_pf2vf_offset(0), msg); - -+out: - /* Re-enable PF2VF interrupts */ - adf_enable_pf2vf_interrupts(accel_dev); - return; -diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c -index 010f1bb20dada..86a13b738c2de 100644 ---- a/drivers/crypto/s5p-sss.c -+++ b/drivers/crypto/s5p-sss.c -@@ -2208,6 +2208,8 @@ static int s5p_aes_probe(struct platform_device *pdev) - - variant = find_s5p_sss_version(pdev); - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ if (!res) -+ return -EINVAL; - - /* - * Note: HASH and PRNG uses the same registers in secss, avoid -diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c -index 758de0e9b2ddc..16bbc9bc9e6d1 100644 ---- a/drivers/dma-buf/dma-buf.c -+++ b/drivers/dma-buf/dma-buf.c -@@ -79,6 +79,7 @@ static void dma_buf_release(struct dentry *dentry) - if (dmabuf->resv == (struct dma_resv *)&dmabuf[1]) - dma_resv_fini(dmabuf->resv); - -+ WARN_ON(!list_empty(&dmabuf->attachments)); - module_put(dmabuf->owner); - kfree(dmabuf->name); - kfree(dmabuf); -diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c -index b58ac720d9a12..6f1e97ba3e786 100644 ---- a/drivers/dma/at_xdmac.c -+++ b/drivers/dma/at_xdmac.c -@@ -145,7 +145,7 @@ - #define AT_XDMAC_CC_WRIP (0x1 << 23) /* Write in Progress (read only) */ - #define AT_XDMAC_CC_WRIP_DONE (0x0 << 23) - #define AT_XDMAC_CC_WRIP_IN_PROGRESS (0x1 << 23) --#define AT_XDMAC_CC_PERID(i) (0x7f & (i) << 24) /* Channel Peripheral Identifier */ -+#define AT_XDMAC_CC_PERID(i) ((0x7f & (i)) << 24) /* Channel Peripheral Identifier */ - #define AT_XDMAC_CDS_MSP 0x2C /* Channel Data Stride Memory Set Pattern */ - #define AT_XDMAC_CSUS 0x30 /* Channel Source Microblock Stride */ - #define AT_XDMAC_CDUS 0x34 /* Channel Destination Microblock Stride */ -diff --git a/drivers/dma/dmaengine.h b/drivers/dma/dmaengine.h -index 501c0b063f852..302f13efd35d9 100644 ---- a/drivers/dma/dmaengine.h -+++ b/drivers/dma/dmaengine.h -@@ -168,7 +168,7 @@ dmaengine_desc_get_callback_invoke(struct dma_async_tx_descriptor *tx, - static inline bool - dmaengine_desc_callback_valid(struct dmaengine_desc_callback *cb) - { -- return (cb->callback) ? true : false; -+ return cb->callback || cb->callback_result; - } - - #endif -diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c -index aed0f26c9af5d..ac4a5015c146b 100644 ---- a/drivers/edac/amd64_edac.c -+++ b/drivers/edac/amd64_edac.c -@@ -797,12 +797,14 @@ static void debug_dump_dramcfg_low(struct amd64_pvt *pvt, u32 dclr, int chan) - #define CS_ODD_PRIMARY BIT(1) - #define CS_EVEN_SECONDARY BIT(2) - #define CS_ODD_SECONDARY BIT(3) -+#define CS_3R_INTERLEAVE BIT(4) - - #define CS_EVEN (CS_EVEN_PRIMARY | CS_EVEN_SECONDARY) - #define CS_ODD (CS_ODD_PRIMARY | CS_ODD_SECONDARY) - - static int f17_get_cs_mode(int dimm, u8 ctrl, struct amd64_pvt *pvt) - { -+ u8 base, count = 0; - int cs_mode = 0; - - if (csrow_enabled(2 * dimm, ctrl, pvt)) -@@ -815,6 +817,20 @@ static int f17_get_cs_mode(int dimm, u8 ctrl, struct amd64_pvt *pvt) - if (csrow_sec_enabled(2 * dimm + 1, ctrl, pvt)) - cs_mode |= CS_ODD_SECONDARY; - -+ /* -+ * 3 Rank inteleaving support. -+ * There should be only three bases enabled and their two masks should -+ * be equal. -+ */ -+ for_each_chip_select(base, ctrl, pvt) -+ count += csrow_enabled(base, ctrl, pvt); -+ -+ if (count == 3 && -+ pvt->csels[ctrl].csmasks[0] == pvt->csels[ctrl].csmasks[1]) { -+ edac_dbg(1, "3R interleaving in use.\n"); -+ cs_mode |= CS_3R_INTERLEAVE; -+ } -+ - return cs_mode; - } - -@@ -1623,10 +1639,14 @@ static int f17_addr_mask_to_cs_size(struct amd64_pvt *pvt, u8 umc, - * - * The MSB is the number of bits in the full mask because BIT[0] is - * always 0. -+ * -+ * In the special 3 Rank interleaving case, a single bit is flipped -+ * without swapping with the most significant bit. This can be handled -+ * by keeping the MSB where it is and ignoring the single zero bit. - */ - msb = fls(addr_mask_orig) - 1; - weight = hweight_long(addr_mask_orig); -- num_zero_bits = msb - weight; -+ num_zero_bits = msb - weight - !!(cs_mode & CS_3R_INTERLEAVE); - - /* Take the number of zero bits off from the top of the mask. */ - addr_mask_deinterleaved = GENMASK_ULL(msb - num_zero_bits, 1); -diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c -index d39f5bfb8bd92..b0b280eef1d00 100644 ---- a/drivers/edac/sb_edac.c -+++ b/drivers/edac/sb_edac.c -@@ -1055,7 +1055,7 @@ static u64 haswell_get_tohm(struct sbridge_pvt *pvt) - pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOHM_1, ®); - rc = ((reg << 6) | rc) << 26; - -- return rc | 0x1ffffff; -+ return rc | 0x3ffffff; - } - - static u64 knl_get_tolm(struct sbridge_pvt *pvt) -diff --git a/drivers/firmware/psci/psci_checker.c b/drivers/firmware/psci/psci_checker.c -index 03eb798ad3ed9..250b7232f9816 100644 ---- a/drivers/firmware/psci/psci_checker.c -+++ b/drivers/firmware/psci/psci_checker.c -@@ -155,7 +155,7 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups) - if (!alloc_cpumask_var(&tmp, GFP_KERNEL)) - return -ENOMEM; - -- cpu_groups = kcalloc(nb_available_cpus, sizeof(cpu_groups), -+ cpu_groups = kcalloc(nb_available_cpus, sizeof(*cpu_groups), - GFP_KERNEL); - if (!cpu_groups) { - free_cpumask_var(tmp); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c -index 85b0515c0fdcf..e0d2f79571ef5 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c -@@ -61,7 +61,7 @@ static void amdgpu_bo_list_free(struct kref *ref) - - int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp, - struct drm_amdgpu_bo_list_entry *info, -- unsigned num_entries, struct amdgpu_bo_list **result) -+ size_t num_entries, struct amdgpu_bo_list **result) - { - unsigned last_entry = 0, first_userptr = num_entries; - struct amdgpu_bo_list_entry *array; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h -index a130e766cbdbe..529d52a204cf4 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h -@@ -60,7 +60,7 @@ int amdgpu_bo_create_list_entry_array(struct drm_amdgpu_bo_list_in *in, - int amdgpu_bo_list_create(struct amdgpu_device *adev, - struct drm_file *filp, - struct drm_amdgpu_bo_list_entry *info, -- unsigned num_entries, -+ size_t num_entries, - struct amdgpu_bo_list **list); - - static inline struct amdgpu_bo_list_entry * -diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c -index 9fb1765e92d15..e9f5de35f7953 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c -@@ -863,12 +863,12 @@ static int gmc_v6_0_sw_init(void *handle) - - adev->gmc.mc_mask = 0xffffffffffULL; - -- r = dma_set_mask_and_coherent(adev->dev, DMA_BIT_MASK(44)); -+ r = dma_set_mask_and_coherent(adev->dev, DMA_BIT_MASK(40)); - if (r) { - dev_warn(adev->dev, "amdgpu: No suitable DMA available.\n"); - return r; - } -- adev->need_swiotlb = drm_need_swiotlb(44); -+ adev->need_swiotlb = drm_need_swiotlb(40); - - r = gmc_v6_0_init_microcode(adev); - if (r) { -diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c -index f6bdec7fa9253..a950d5db211c5 100644 ---- a/drivers/gpu/drm/drm_panel_orientation_quirks.c -+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c -@@ -109,6 +109,12 @@ static const struct drm_dmi_panel_orientation_data lcd1200x1920_rightside_up = { - .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, - }; - -+static const struct drm_dmi_panel_orientation_data lcd1280x1920_rightside_up = { -+ .width = 1280, -+ .height = 1920, -+ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, -+}; -+ - static const struct dmi_system_id orientation_data[] = { - { /* Acer One 10 (S1003) */ - .matches = { -@@ -134,6 +140,12 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), - }, - .driver_data = (void *)&lcd800x1280_rightside_up, -+ }, { /* AYA NEO 2021 */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYA NEO 2021"), -+ }, -+ .driver_data = (void *)&lcd800x1280_rightside_up, - }, { /* GPD MicroPC (generic strings, also match on bios date) */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), -@@ -185,6 +197,12 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), - }, - .driver_data = (void *)&gpd_win2, -+ }, { /* GPD Win 3 */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1618-03") -+ }, -+ .driver_data = (void *)&lcd720x1280_rightside_up, - }, { /* I.T.Works TW891 */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."), -@@ -193,6 +211,13 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_BOARD_NAME, "TW891"), - }, - .driver_data = (void *)&itworks_tw891, -+ }, { /* KD Kurio Smart C15200 2-in-1 */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "KD Interactive"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Kurio Smart"), -+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "KDM960BCP"), -+ }, -+ .driver_data = (void *)&lcd800x1280_rightside_up, - }, { /* - * Lenovo Ideapad Miix 310 laptop, only some production batches - * have a portrait screen, the resolution checks makes the quirk -@@ -211,10 +236,15 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 320-10ICR"), - }, - .driver_data = (void *)&lcd800x1280_rightside_up, -- }, { /* Lenovo Ideapad D330 */ -+ }, { /* Lenovo Ideapad D330-10IGM (HD) */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), -+ }, -+ .driver_data = (void *)&lcd800x1280_rightside_up, -+ }, { /* Lenovo Ideapad D330-10IGM (FHD) */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), -- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81H3"), - DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), - }, - .driver_data = (void *)&lcd1200x1920_rightside_up, -@@ -225,6 +255,19 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Default string"), - }, - .driver_data = (void *)&onegx1_pro, -+ }, { /* Samsung GalaxyBook 10.6 */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Galaxy Book 10.6"), -+ }, -+ .driver_data = (void *)&lcd1280x1920_rightside_up, -+ }, { /* Valve Steam Deck */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Valve"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Jupiter"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "1"), -+ }, -+ .driver_data = (void *)&lcd800x1280_rightside_up, - }, { /* VIOS LTH17 */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VIOS"), -diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c -index 3aae7ea522f23..c3f2292dc93d5 100644 ---- a/drivers/gpu/drm/drm_plane_helper.c -+++ b/drivers/gpu/drm/drm_plane_helper.c -@@ -123,7 +123,6 @@ static int drm_plane_helper_check_update(struct drm_plane *plane, - .crtc_w = drm_rect_width(dst), - .crtc_h = drm_rect_height(dst), - .rotation = rotation, -- .visible = *visible, - }; - struct drm_crtc_state crtc_state = { - .crtc = crtc, -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c -index 4f8b813aab810..8256f06218d0f 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c -@@ -137,11 +137,13 @@ static int _sspp_subblk_offset(struct dpu_hw_pipe *ctx, - u32 *idx) - { - int rc = 0; -- const struct dpu_sspp_sub_blks *sblk = ctx->cap->sblk; -+ const struct dpu_sspp_sub_blks *sblk; - -- if (!ctx) -+ if (!ctx || !ctx->cap || !ctx->cap->sblk) - return -EINVAL; - -+ sblk = ctx->cap->sblk; -+ - switch (s_id) { - case DPU_SSPP_SRC: - *idx = sblk->src_blk.base; -@@ -404,7 +406,7 @@ static void _dpu_hw_sspp_setup_scaler3(struct dpu_hw_pipe *ctx, - - (void)pe; - if (_sspp_subblk_offset(ctx, DPU_SSPP_SCALER_QSEED3, &idx) || !sspp -- || !scaler3_cfg || !ctx || !ctx->cap || !ctx->cap->sblk) -+ || !scaler3_cfg) - return; - - dpu_hw_setup_scaler3(&ctx->hw, scaler3_cfg, idx, -diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c -index d92a0ffe2a767..8e6a4d5f3a405 100644 ---- a/drivers/gpu/drm/msm/msm_gem.c -+++ b/drivers/gpu/drm/msm/msm_gem.c -@@ -1036,7 +1036,7 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev, - - ret = msm_gem_new_impl(dev, size, flags, &obj); - if (ret) -- goto fail; -+ return ERR_PTR(ret); - - msm_obj = to_msm_bo(obj); - -@@ -1124,7 +1124,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev, - - ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj); - if (ret) -- goto fail; -+ return ERR_PTR(ret); - - drm_gem_private_object_init(dev, obj, size); - -diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c -index 19c092d75266b..1609a85429cef 100644 ---- a/drivers/gpu/drm/v3d/v3d_gem.c -+++ b/drivers/gpu/drm/v3d/v3d_gem.c -@@ -195,8 +195,8 @@ v3d_clean_caches(struct v3d_dev *v3d) - - V3D_CORE_WRITE(core, V3D_CTL_L2TCACTL, V3D_L2TCACTL_TMUWCF); - if (wait_for(!(V3D_CORE_READ(core, V3D_CTL_L2TCACTL) & -- V3D_L2TCACTL_L2TFLS), 100)) { -- DRM_ERROR("Timeout waiting for L1T write combiner flush\n"); -+ V3D_L2TCACTL_TMUWCF), 100)) { -+ DRM_ERROR("Timeout waiting for TMU write combiner flush\n"); - } - - mutex_lock(&v3d->cache_clean_lock); -diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c -index bb46e7a0f1b5d..0ca996e6fd5cb 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_vq.c -+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c -@@ -80,9 +80,7 @@ virtio_gpu_get_vbuf(struct virtio_gpu_device *vgdev, - { - struct virtio_gpu_vbuffer *vbuf; - -- vbuf = kmem_cache_zalloc(vgdev->vbufs, GFP_KERNEL); -- if (!vbuf) -- return ERR_PTR(-ENOMEM); -+ vbuf = kmem_cache_zalloc(vgdev->vbufs, GFP_KERNEL | __GFP_NOFAIL); - - BUG_ON(size > MAX_INLINE_CMD_SIZE); - vbuf->buf = (void *)vbuf + sizeof(*vbuf); -@@ -142,10 +140,6 @@ static void *virtio_gpu_alloc_cmd_resp(struct virtio_gpu_device *vgdev, - - vbuf = virtio_gpu_get_vbuf(vgdev, cmd_size, - resp_size, resp_buf, cb); -- if (IS_ERR(vbuf)) { -- *vbuffer_p = NULL; -- return ERR_CAST(vbuf); -- } - *vbuffer_p = vbuf; - return (struct virtio_gpu_command *)vbuf->buf; - } -diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c -index d70cd3d7f583b..67ae2b18e33ac 100644 ---- a/drivers/hid/hid-u2fzero.c -+++ b/drivers/hid/hid-u2fzero.c -@@ -132,7 +132,7 @@ static int u2fzero_recv(struct u2fzero_device *dev, - - ret = (wait_for_completion_timeout( - &ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT))); -- if (ret < 0) { -+ if (ret == 0) { - usb_kill_urb(dev->urb); - hid_err(hdev, "urb submission timed out"); - } else { -@@ -191,6 +191,8 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data, - struct u2f_hid_msg resp; - int ret; - size_t actual_length; -+ /* valid packets must have a correct header */ -+ int min_length = offsetof(struct u2f_hid_msg, init.data); - - if (!dev->present) { - hid_dbg(dev->hdev, "device not present"); -@@ -200,12 +202,12 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data, - ret = u2fzero_recv(dev, &req, &resp); - - /* ignore errors or packets without data */ -- if (ret < offsetof(struct u2f_hid_msg, init.data)) -+ if (ret < min_length) - return 0; - - /* only take the minimum amount of data it is safe to take */ -- actual_length = min3((size_t)ret - offsetof(struct u2f_hid_msg, -- init.data), U2F_HID_MSG_LEN(resp), max); -+ actual_length = min3((size_t)ret - min_length, -+ U2F_HID_MSG_LEN(resp), max); - - memcpy(data, resp.init.data, actual_length); - -diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h -index cabcb66e7c5ef..356382a340b2c 100644 ---- a/drivers/hv/hyperv_vmbus.h -+++ b/drivers/hv/hyperv_vmbus.h -@@ -13,6 +13,7 @@ - #define _HYPERV_VMBUS_H - - #include -+#include - #include - #include - #include -diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c -index d018b20089ecd..a2175394cd253 100644 ---- a/drivers/hwmon/hwmon.c -+++ b/drivers/hwmon/hwmon.c -@@ -645,8 +645,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, - dev_set_drvdata(hdev, drvdata); - dev_set_name(hdev, HWMON_ID_FORMAT, id); - err = device_register(hdev); -- if (err) -- goto free_hwmon; -+ if (err) { -+ put_device(hdev); -+ goto ida_remove; -+ } - - if (dev && dev->of_node && chip && chip->ops->read && - chip->info[0]->type == hwmon_chip && -diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c -index 05fce86f1f817..41c4bbb9c0572 100644 ---- a/drivers/hwmon/pmbus/lm25066.c -+++ b/drivers/hwmon/pmbus/lm25066.c -@@ -51,26 +51,31 @@ struct __coeff { - #define PSC_CURRENT_IN_L (PSC_NUM_CLASSES) - #define PSC_POWER_L (PSC_NUM_CLASSES + 1) - --static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { -+static struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = { - [lm25056] = { - [PSC_VOLTAGE_IN] = { - .m = 16296, -+ .b = 1343, - .R = -2, - }, - [PSC_CURRENT_IN] = { - .m = 13797, -+ .b = -1833, - .R = -2, - }, - [PSC_CURRENT_IN_L] = { - .m = 6726, -+ .b = -537, - .R = -2, - }, - [PSC_POWER] = { - .m = 5501, -+ .b = -2908, - .R = -3, - }, - [PSC_POWER_L] = { - .m = 26882, -+ .b = -5646, - .R = -4, - }, - [PSC_TEMPERATURE] = { -@@ -82,26 +87,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { - [lm25066] = { - [PSC_VOLTAGE_IN] = { - .m = 22070, -+ .b = -1800, - .R = -2, - }, - [PSC_VOLTAGE_OUT] = { - .m = 22070, -+ .b = -1800, - .R = -2, - }, - [PSC_CURRENT_IN] = { - .m = 13661, -+ .b = -5200, - .R = -2, - }, - [PSC_CURRENT_IN_L] = { - .m = 6852, -+ .b = -3100, - .R = -2, - }, - [PSC_POWER] = { - .m = 736, -+ .b = -3300, - .R = -2, - }, - [PSC_POWER_L] = { - .m = 369, -+ .b = -1900, - .R = -2, - }, - [PSC_TEMPERATURE] = { -@@ -111,26 +122,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { - [lm5064] = { - [PSC_VOLTAGE_IN] = { - .m = 4611, -+ .b = -642, - .R = -2, - }, - [PSC_VOLTAGE_OUT] = { - .m = 4621, -+ .b = 423, - .R = -2, - }, - [PSC_CURRENT_IN] = { - .m = 10742, -+ .b = 1552, - .R = -2, - }, - [PSC_CURRENT_IN_L] = { - .m = 5456, -+ .b = 2118, - .R = -2, - }, - [PSC_POWER] = { - .m = 1204, -+ .b = 8524, - .R = -3, - }, - [PSC_POWER_L] = { - .m = 612, -+ .b = 11202, - .R = -3, - }, - [PSC_TEMPERATURE] = { -@@ -140,26 +157,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = { - [lm5066] = { - [PSC_VOLTAGE_IN] = { - .m = 4587, -+ .b = -1200, - .R = -2, - }, - [PSC_VOLTAGE_OUT] = { - .m = 4587, -+ .b = -2400, - .R = -2, - }, - [PSC_CURRENT_IN] = { - .m = 10753, -+ .b = -1200, - .R = -2, - }, - [PSC_CURRENT_IN_L] = { - .m = 5405, -+ .b = -600, - .R = -2, - }, - [PSC_POWER] = { - .m = 1204, -+ .b = -6000, - .R = -3, - }, - [PSC_POWER_L] = { - .m = 605, -+ .b = -8000, - .R = -3, - }, - [PSC_TEMPERATURE] = { -diff --git a/drivers/i2c/busses/i2c-xlr.c b/drivers/i2c/busses/i2c-xlr.c -index 34cd4b3085402..dda6cb848405b 100644 ---- a/drivers/i2c/busses/i2c-xlr.c -+++ b/drivers/i2c/busses/i2c-xlr.c -@@ -433,11 +433,15 @@ static int xlr_i2c_probe(struct platform_device *pdev) - i2c_set_adapdata(&priv->adap, priv); - ret = i2c_add_numbered_adapter(&priv->adap); - if (ret < 0) -- return ret; -+ goto err_unprepare_clk; - - platform_set_drvdata(pdev, priv); - dev_info(&priv->adap.dev, "Added I2C Bus.\n"); - return 0; -+ -+err_unprepare_clk: -+ clk_unprepare(clk); -+ return ret; - } - - static int xlr_i2c_remove(struct platform_device *pdev) -diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c -index 61c670f7fc5f1..1f55cd8abb558 100644 ---- a/drivers/iio/dac/ad5446.c -+++ b/drivers/iio/dac/ad5446.c -@@ -527,8 +527,15 @@ static int ad5622_write(struct ad5446_state *st, unsigned val) - { - struct i2c_client *client = to_i2c_client(st->dev); - __be16 data = cpu_to_be16(val); -+ int ret; -+ -+ ret = i2c_master_send(client, (char *)&data, sizeof(data)); -+ if (ret < 0) -+ return ret; -+ if (ret != sizeof(data)) -+ return -EIO; - -- return i2c_master_send(client, (char *)&data, sizeof(data)); -+ return 0; - } - - /** -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index 4d07d22bfa7b1..5fc5ab7813c0f 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -642,12 +642,13 @@ int bnxt_qplib_query_srq(struct bnxt_qplib_res *res, - int rc = 0; - - RCFW_CMD_PREP(req, QUERY_SRQ, cmd_flags); -- req.srq_cid = cpu_to_le32(srq->id); - - /* Configure the request */ - sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb)); - if (!sbuf) - return -ENOMEM; -+ req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS; -+ req.srq_cid = cpu_to_le32(srq->id); - sb = sbuf->sb; - rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp, - (void *)sbuf, 0); -diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c -index 17ce928e41bde..bca5358f3ef29 100644 ---- a/drivers/infiniband/hw/mlx4/qp.c -+++ b/drivers/infiniband/hw/mlx4/qp.c -@@ -1149,8 +1149,10 @@ static int create_qp_common(struct ib_pd *pd, struct ib_qp_init_attr *init_attr, - if (dev->steering_support == - MLX4_STEERING_MODE_DEVICE_MANAGED) - qp->flags |= MLX4_IB_QP_NETIF; -- else -+ else { -+ err = -EINVAL; - goto err; -+ } - } - - err = set_kernel_sq_size(dev, &init_attr->cap, qp_type, qp); -diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c -index 4408d33646647..717f174647647 100644 ---- a/drivers/infiniband/hw/qedr/verbs.c -+++ b/drivers/infiniband/hw/qedr/verbs.c -@@ -2383,15 +2383,18 @@ int qedr_query_qp(struct ib_qp *ibqp, - int rc = 0; - - memset(¶ms, 0, sizeof(params)); -- -- rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms); -- if (rc) -- goto err; -- - memset(qp_attr, 0, sizeof(*qp_attr)); - memset(qp_init_attr, 0, sizeof(*qp_init_attr)); - -- qp_attr->qp_state = qedr_get_ibqp_state(params.state); -+ if (qp->qp_type != IB_QPT_GSI) { -+ rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms); -+ if (rc) -+ goto err; -+ qp_attr->qp_state = qedr_get_ibqp_state(params.state); -+ } else { -+ qp_attr->qp_state = qedr_get_ibqp_state(QED_ROCE_QP_STATE_RTS); -+ } -+ - qp_attr->cur_qp_state = qedr_get_ibqp_state(params.state); - qp_attr->path_mtu = ib_mtu_int_to_enum(params.mtu); - qp_attr->path_mig_state = IB_MIG_MIGRATED; -diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h -index fe52073867006..8d3f6d93dfb8d 100644 ---- a/drivers/infiniband/sw/rxe/rxe_param.h -+++ b/drivers/infiniband/sw/rxe/rxe_param.h -@@ -140,7 +140,7 @@ enum rxe_device_param { - /* default/initial rxe port parameters */ - enum rxe_port_param { - RXE_PORT_GID_TBL_LEN = 1024, -- RXE_PORT_PORT_CAP_FLAGS = RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP, -+ RXE_PORT_PORT_CAP_FLAGS = IB_PORT_CM_SUP, - RXE_PORT_MAX_MSG_SZ = 0x800000, - RXE_PORT_BAD_PKEY_CNTR = 0, - RXE_PORT_QKEY_VIOL_CNTR = 0, -diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c -index 6c554c11a7ac3..ea58805c480fa 100644 ---- a/drivers/input/joystick/iforce/iforce-usb.c -+++ b/drivers/input/joystick/iforce/iforce-usb.c -@@ -92,7 +92,7 @@ static int iforce_usb_get_id(struct iforce *iforce, u8 id, - id, - USB_TYPE_VENDOR | USB_DIR_IN | - USB_RECIP_INTERFACE, -- 0, 0, buf, IFORCE_MAX_LENGTH, HZ); -+ 0, 0, buf, IFORCE_MAX_LENGTH, 1000); - if (status < 0) { - dev_err(&iforce_usb->intf->dev, - "usb_submit_urb failed: %d\n", status); -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 053fe2da1e08f..0b5ed963cb0e1 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -517,6 +517,19 @@ static void elantech_report_trackpoint(struct psmouse *psmouse, - case 0x16008020U: - case 0x26800010U: - case 0x36808000U: -+ -+ /* -+ * This firmware misreport coordinates for trackpoint -+ * occasionally. Discard packets outside of [-127, 127] range -+ * to prevent cursor jumps. -+ */ -+ if (packet[4] == 0x80 || packet[5] == 0x80 || -+ packet[1] >> 7 == packet[4] >> 7 || -+ packet[2] >> 7 == packet[5] >> 7) { -+ elantech_debug("discarding packet [%6ph]\n", packet); -+ break; -+ -+ } - x = packet[4] - (int)((packet[1]^0x80) << 1); - y = (int)((packet[2]^0x80) << 1) - packet[5]; - -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index 23442a144b834..202e43a6ffae2 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -272,6 +272,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"), - }, - }, -+ { -+ /* Fujitsu Lifebook T725 laptop */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"), -+ }, -+ }, - { - /* Fujitsu Lifebook U745 */ - .matches = { -@@ -840,6 +847,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"), - }, - }, -+ { -+ /* Fujitsu Lifebook T725 laptop */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"), -+ }, -+ }, - { - /* Fujitsu U574 laptop */ - /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ -diff --git a/drivers/irqchip/irq-bcm6345-l1.c b/drivers/irqchip/irq-bcm6345-l1.c -index e3483789f4df3..1bd0621c4ce2a 100644 ---- a/drivers/irqchip/irq-bcm6345-l1.c -+++ b/drivers/irqchip/irq-bcm6345-l1.c -@@ -140,7 +140,7 @@ static void bcm6345_l1_irq_handle(struct irq_desc *desc) - for_each_set_bit(hwirq, &pending, IRQS_PER_WORD) { - irq = irq_linear_revmap(intc->domain, base + hwirq); - if (irq) -- do_IRQ(irq); -+ generic_handle_irq(irq); - else - spurious_interrupt(); - } -diff --git a/drivers/irqchip/irq-s3c24xx.c b/drivers/irqchip/irq-s3c24xx.c -index d2031fecc3861..5e97ae54782d6 100644 ---- a/drivers/irqchip/irq-s3c24xx.c -+++ b/drivers/irqchip/irq-s3c24xx.c -@@ -359,11 +359,25 @@ static inline int s3c24xx_handle_intc(struct s3c_irq_intc *intc, - asmlinkage void __exception_irq_entry s3c24xx_handle_irq(struct pt_regs *regs) - { - do { -- if (likely(s3c_intc[0])) -- if (s3c24xx_handle_intc(s3c_intc[0], regs, 0)) -- continue; -+ /* -+ * For platform based machines, neither ERR nor NULL can happen here. -+ * The s3c24xx_handle_irq() will be set as IRQ handler iff this succeeds: -+ * -+ * s3c_intc[0] = s3c24xx_init_intc() -+ * -+ * If this fails, the next calls to s3c24xx_init_intc() won't be executed. -+ * -+ * For DT machine, s3c_init_intc_of() could set the IRQ handler without -+ * setting s3c_intc[0] only if it was called with num_ctrl=0. There is no -+ * such code path, so again the s3c_intc[0] will have a valid pointer if -+ * set_handle_irq() is called. -+ * -+ * Therefore in s3c24xx_handle_irq(), the s3c_intc[0] is always something. -+ */ -+ if (s3c24xx_handle_intc(s3c_intc[0], regs, 0)) -+ continue; - -- if (s3c_intc[2]) -+ if (!IS_ERR_OR_NULL(s3c_intc[2])) - if (s3c24xx_handle_intc(s3c_intc[2], regs, 64)) - continue; - -diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c -index 7d0a12fe2714a..7cd7b140dfe97 100644 ---- a/drivers/irqchip/irq-sifive-plic.c -+++ b/drivers/irqchip/irq-sifive-plic.c -@@ -138,7 +138,13 @@ static void plic_irq_eoi(struct irq_data *d) - { - struct plic_handler *handler = this_cpu_ptr(&plic_handlers); - -- writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM); -+ if (irqd_irq_masked(d)) { -+ plic_irq_unmask(d); -+ writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM); -+ plic_irq_mask(d); -+ } else { -+ writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM); -+ } - } - - static struct irq_chip plic_chip = { -diff --git a/drivers/media/dvb-frontends/mn88443x.c b/drivers/media/dvb-frontends/mn88443x.c -index e4528784f8477..fff212c0bf3b5 100644 ---- a/drivers/media/dvb-frontends/mn88443x.c -+++ b/drivers/media/dvb-frontends/mn88443x.c -@@ -204,11 +204,18 @@ struct mn88443x_priv { - struct regmap *regmap_t; - }; - --static void mn88443x_cmn_power_on(struct mn88443x_priv *chip) -+static int mn88443x_cmn_power_on(struct mn88443x_priv *chip) - { -+ struct device *dev = &chip->client_s->dev; - struct regmap *r_t = chip->regmap_t; -+ int ret; - -- clk_prepare_enable(chip->mclk); -+ ret = clk_prepare_enable(chip->mclk); -+ if (ret) { -+ dev_err(dev, "Failed to prepare and enable mclk: %d\n", -+ ret); -+ return ret; -+ } - - gpiod_set_value_cansleep(chip->reset_gpio, 1); - usleep_range(100, 1000); -@@ -222,6 +229,8 @@ static void mn88443x_cmn_power_on(struct mn88443x_priv *chip) - } else { - regmap_write(r_t, HIZSET3, 0x8f); - } -+ -+ return 0; - } - - static void mn88443x_cmn_power_off(struct mn88443x_priv *chip) -@@ -738,7 +747,10 @@ static int mn88443x_probe(struct i2c_client *client, - chip->fe.demodulator_priv = chip; - i2c_set_clientdata(client, chip); - -- mn88443x_cmn_power_on(chip); -+ ret = mn88443x_cmn_power_on(chip); -+ if (ret) -+ goto err_i2c_t; -+ - mn88443x_s_sleep(chip); - mn88443x_t_sleep(chip); - -diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c -index 92376592455ee..56674173524fd 100644 ---- a/drivers/media/i2c/ir-kbd-i2c.c -+++ b/drivers/media/i2c/ir-kbd-i2c.c -@@ -791,6 +791,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id) - rc_proto = RC_PROTO_BIT_RC5 | RC_PROTO_BIT_RC6_MCE | - RC_PROTO_BIT_RC6_6A_32; - ir_codes = RC_MAP_HAUPPAUGE; -+ ir->polling_interval = 125; - probe_tx = true; - break; - } -diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c -index dc23b9ed510a4..18440c5104ad9 100644 ---- a/drivers/media/i2c/mt9p031.c -+++ b/drivers/media/i2c/mt9p031.c -@@ -78,7 +78,9 @@ - #define MT9P031_PIXEL_CLOCK_INVERT (1 << 15) - #define MT9P031_PIXEL_CLOCK_SHIFT(n) ((n) << 8) - #define MT9P031_PIXEL_CLOCK_DIVIDE(n) ((n) << 0) --#define MT9P031_FRAME_RESTART 0x0b -+#define MT9P031_RESTART 0x0b -+#define MT9P031_FRAME_PAUSE_RESTART (1 << 1) -+#define MT9P031_FRAME_RESTART (1 << 0) - #define MT9P031_SHUTTER_DELAY 0x0c - #define MT9P031_RST 0x0d - #define MT9P031_RST_ENABLE 1 -@@ -445,9 +447,23 @@ static int mt9p031_set_params(struct mt9p031 *mt9p031) - static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable) - { - struct mt9p031 *mt9p031 = to_mt9p031(subdev); -+ struct i2c_client *client = v4l2_get_subdevdata(subdev); -+ int val; - int ret; - - if (!enable) { -+ /* enable pause restart */ -+ val = MT9P031_FRAME_PAUSE_RESTART; -+ ret = mt9p031_write(client, MT9P031_RESTART, val); -+ if (ret < 0) -+ return ret; -+ -+ /* enable restart + keep pause restart set */ -+ val |= MT9P031_FRAME_RESTART; -+ ret = mt9p031_write(client, MT9P031_RESTART, val); -+ if (ret < 0) -+ return ret; -+ - /* Stop sensor readout */ - ret = mt9p031_set_output_control(mt9p031, - MT9P031_OUTPUT_CONTROL_CEN, 0); -@@ -467,6 +483,16 @@ static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable) - if (ret < 0) - return ret; - -+ /* -+ * - clear pause restart -+ * - don't clear restart as clearing restart manually can cause -+ * undefined behavior -+ */ -+ val = MT9P031_FRAME_RESTART; -+ ret = mt9p031_write(client, MT9P031_RESTART, val); -+ if (ret < 0) -+ return ret; -+ - return mt9p031_pll_enable(mt9p031); - } - -diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c -index 18a2027ba1450..5faffedb0feba 100644 ---- a/drivers/media/i2c/tda1997x.c -+++ b/drivers/media/i2c/tda1997x.c -@@ -1247,13 +1247,13 @@ tda1997x_parse_infoframe(struct tda1997x_state *state, u16 addr) - { - struct v4l2_subdev *sd = &state->sd; - union hdmi_infoframe frame; -- u8 buffer[40]; -+ u8 buffer[40] = { 0 }; - u8 reg; - int len, err; - - /* read data */ - len = io_readn(sd, addr, sizeof(buffer), buffer); -- err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)); -+ err = hdmi_infoframe_unpack(&frame, buffer, len); - if (err) { - v4l_err(state->client, - "failed parsing %d byte infoframe: 0x%04x/0x%02x\n", -@@ -1927,13 +1927,13 @@ static int tda1997x_log_infoframe(struct v4l2_subdev *sd, int addr) - { - struct tda1997x_state *state = to_state(sd); - union hdmi_infoframe frame; -- u8 buffer[40]; -+ u8 buffer[40] = { 0 }; - int len, err; - - /* read data */ - len = io_readn(sd, addr, sizeof(buffer), buffer); - v4l2_dbg(1, debug, sd, "infoframe: addr=%d len=%d\n", addr, len); -- err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)); -+ err = hdmi_infoframe_unpack(&frame, buffer, len); - if (err) { - v4l_err(state->client, - "failed parsing %d byte infoframe: 0x%04x/0x%02x\n", -diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c -index a8e980c6dacb9..50772c2611cad 100644 ---- a/drivers/media/pci/cx23885/cx23885-alsa.c -+++ b/drivers/media/pci/cx23885/cx23885-alsa.c -@@ -550,7 +550,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev) - SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1, - THIS_MODULE, sizeof(struct cx23885_audio_dev), &card); - if (err < 0) -- goto error; -+ goto error_msg; - - chip = (struct cx23885_audio_dev *) card->private_data; - chip->dev = dev; -@@ -576,6 +576,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev) - - error: - snd_card_free(card); -+error_msg: - pr_err("%s(): Failed to register analog audio adapter\n", - __func__); - -diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c -index 80a7c41baa901..eb5621c9ebf85 100644 ---- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c -+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c -@@ -258,19 +258,24 @@ static irqreturn_t netup_unidvb_isr(int irq, void *dev_id) - if ((reg40 & AVL_IRQ_ASSERTED) != 0) { - /* IRQ is being signaled */ - reg_isr = readw(ndev->bmmio0 + REG_ISR); -- if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) { -- iret = netup_i2c_interrupt(&ndev->i2c[0]); -- } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) { -- iret = netup_i2c_interrupt(&ndev->i2c[1]); -- } else if (reg_isr & NETUP_UNIDVB_IRQ_SPI) { -+ if (reg_isr & NETUP_UNIDVB_IRQ_SPI) - iret = netup_spi_interrupt(ndev->spi); -- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) { -- iret = netup_dma_interrupt(&ndev->dma[0]); -- } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) { -- iret = netup_dma_interrupt(&ndev->dma[1]); -- } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) { -- iret = netup_ci_interrupt(ndev); -+ else if (!ndev->old_fw) { -+ if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) { -+ iret = netup_i2c_interrupt(&ndev->i2c[0]); -+ } else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) { -+ iret = netup_i2c_interrupt(&ndev->i2c[1]); -+ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) { -+ iret = netup_dma_interrupt(&ndev->dma[0]); -+ } else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) { -+ iret = netup_dma_interrupt(&ndev->dma[1]); -+ } else if (reg_isr & NETUP_UNIDVB_IRQ_CI) { -+ iret = netup_ci_interrupt(ndev); -+ } else { -+ goto err; -+ } - } else { -+err: - dev_err(&pci_dev->dev, - "%s(): unknown interrupt 0x%x\n", - __func__, reg_isr); -diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c -index cc2ff40d060d1..acf64723f9381 100644 ---- a/drivers/media/platform/mtk-vpu/mtk_vpu.c -+++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c -@@ -809,7 +809,8 @@ static int mtk_vpu_probe(struct platform_device *pdev) - vpu->wdt.wq = create_singlethread_workqueue("vpu_wdt"); - if (!vpu->wdt.wq) { - dev_err(dev, "initialize wdt workqueue failed\n"); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto clk_unprepare; - } - INIT_WORK(&vpu->wdt.ws, vpu_wdt_reset_func); - mutex_init(&vpu->vpu_mutex); -@@ -908,6 +909,8 @@ disable_vpu_clk: - vpu_clock_disable(vpu); - workqueue_destroy: - destroy_workqueue(vpu->wdt.wq); -+clk_unprepare: -+ clk_unprepare(vpu->clk); - - return ret; - } -diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c -index d27eccfa57cae..e01f22bf826d4 100644 ---- a/drivers/media/platform/rcar-vin/rcar-csi2.c -+++ b/drivers/media/platform/rcar-vin/rcar-csi2.c -@@ -488,6 +488,8 @@ static int rcsi2_start_receiver(struct rcar_csi2 *priv) - - /* Code is validated in set_fmt. */ - format = rcsi2_code_to_fmt(priv->mf.code); -+ if (!format) -+ return -EINVAL; - - /* - * Enable all supported CSI-2 channels with virtual channel and -diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c -index b776f83e395e0..9faecd049002f 100644 ---- a/drivers/media/platform/s5p-mfc/s5p_mfc.c -+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c -@@ -1279,11 +1279,15 @@ static int s5p_mfc_probe(struct platform_device *pdev) - spin_lock_init(&dev->condlock); - dev->plat_dev = pdev; - if (!dev->plat_dev) { -- dev_err(&pdev->dev, "No platform data specified\n"); -+ mfc_err("No platform data specified\n"); - return -ENODEV; - } - - dev->variant = of_device_get_match_data(&pdev->dev); -+ if (!dev->variant) { -+ dev_err(&pdev->dev, "Failed to get device MFC hardware variant information\n"); -+ return -ENOENT; -+ } - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - dev->regs_base = devm_ioremap_resource(&pdev->dev, res); -diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c -index d41475f56ab54..72798aae7a628 100644 ---- a/drivers/media/platform/stm32/stm32-dcmi.c -+++ b/drivers/media/platform/stm32/stm32-dcmi.c -@@ -135,6 +135,7 @@ struct stm32_dcmi { - int sequence; - struct list_head buffers; - struct dcmi_buf *active; -+ int irq; - - struct v4l2_device v4l2_dev; - struct video_device *vdev; -@@ -1720,6 +1721,14 @@ static int dcmi_graph_notify_complete(struct v4l2_async_notifier *notifier) - return ret; - } - -+ ret = devm_request_threaded_irq(dcmi->dev, dcmi->irq, dcmi_irq_callback, -+ dcmi_irq_thread, IRQF_ONESHOT, -+ dev_name(dcmi->dev), dcmi); -+ if (ret) { -+ dev_err(dcmi->dev, "Unable to request irq %d\n", dcmi->irq); -+ return ret; -+ } -+ - return 0; - } - -@@ -1881,6 +1890,8 @@ static int dcmi_probe(struct platform_device *pdev) - if (irq <= 0) - return irq ? irq : -ENXIO; - -+ dcmi->irq = irq; -+ - dcmi->res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!dcmi->res) { - dev_err(&pdev->dev, "Could not get resource\n"); -@@ -1893,14 +1904,6 @@ static int dcmi_probe(struct platform_device *pdev) - return PTR_ERR(dcmi->regs); - } - -- ret = devm_request_threaded_irq(&pdev->dev, irq, dcmi_irq_callback, -- dcmi_irq_thread, IRQF_ONESHOT, -- dev_name(&pdev->dev), dcmi); -- if (ret) { -- dev_err(&pdev->dev, "Unable to request irq %d\n", irq); -- return ret; -- } -- - mclk = devm_clk_get(&pdev->dev, "mclk"); - if (IS_ERR(mclk)) { - if (PTR_ERR(mclk) != -EPROBE_DEFER) -diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c -index 1123768731676..484046471c03f 100644 ---- a/drivers/media/radio/radio-wl1273.c -+++ b/drivers/media/radio/radio-wl1273.c -@@ -1279,7 +1279,7 @@ static int wl1273_fm_vidioc_querycap(struct file *file, void *priv, - - strscpy(capability->driver, WL1273_FM_DRIVER_NAME, - sizeof(capability->driver)); -- strscpy(capability->card, "Texas Instruments Wl1273 FM Radio", -+ strscpy(capability->card, "TI Wl1273 FM Radio", - sizeof(capability->card)); - strscpy(capability->bus_info, radio->bus_type, - sizeof(capability->bus_info)); -diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c -index f491420d7b538..a972c0705ac79 100644 ---- a/drivers/media/radio/si470x/radio-si470x-i2c.c -+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c -@@ -11,7 +11,7 @@ - - /* driver definitions */ - #define DRIVER_AUTHOR "Joonyoung Shim "; --#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" -+#define DRIVER_CARD "Silicon Labs Si470x FM Radio" - #define DRIVER_DESC "I2C radio driver for Si470x FM Radio Receivers" - #define DRIVER_VERSION "1.0.2" - -diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c -index fedff68d8c496..3f8634a465730 100644 ---- a/drivers/media/radio/si470x/radio-si470x-usb.c -+++ b/drivers/media/radio/si470x/radio-si470x-usb.c -@@ -16,7 +16,7 @@ - - /* driver definitions */ - #define DRIVER_AUTHOR "Tobias Lorenz " --#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver" -+#define DRIVER_CARD "Silicon Labs Si470x FM Radio" - #define DRIVER_DESC "USB radio driver for Si470x FM Radio Receivers" - #define DRIVER_VERSION "1.0.10" - -diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c -index 4b8aee390518d..742b7f41b75f8 100644 ---- a/drivers/media/rc/ite-cir.c -+++ b/drivers/media/rc/ite-cir.c -@@ -283,7 +283,7 @@ static irqreturn_t ite_cir_isr(int irq, void *data) - } - - /* check for the receive interrupt */ -- if (iflags & ITE_IRQ_RX_FIFO) { -+ if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) { - /* read the FIFO bytes */ - rx_bytes = - dev->params.get_rx_bytes(dev, rx_buf, -diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c -index c68e52c17ae13..31e56f4f34791 100644 ---- a/drivers/media/rc/mceusb.c -+++ b/drivers/media/rc/mceusb.c -@@ -1386,6 +1386,7 @@ static void mceusb_dev_recv(struct urb *urb) - case -ECONNRESET: - case -ENOENT: - case -EILSEQ: -+ case -EPROTO: - case -ESHUTDOWN: - usb_unlink_urb(urb); - return; -diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c -index 93194f03764d2..11273be702b6e 100644 ---- a/drivers/media/spi/cxd2880-spi.c -+++ b/drivers/media/spi/cxd2880-spi.c -@@ -618,7 +618,7 @@ fail_frontend: - fail_attach: - dvb_unregister_adapter(&dvb_spi->adapter); - fail_adapter: -- if (!dvb_spi->vcc_supply) -+ if (dvb_spi->vcc_supply) - regulator_disable(dvb_spi->vcc_supply); - fail_regulator: - kfree(dvb_spi); -diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c -index 8de18da0c4bd1..5aa9c501ed9c9 100644 ---- a/drivers/media/usb/dvb-usb/az6027.c -+++ b/drivers/media/usb/dvb-usb/az6027.c -@@ -391,6 +391,7 @@ static struct rc_map_table rc_map_az6027_table[] = { - /* remote control stuff (does not work with my box) */ - static int az6027_rc_query(struct dvb_usb_device *d, u32 *event, int *state) - { -+ *state = REMOTE_NO_KEY_PRESSED; - return 0; - } - -diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c -index 59ce2dec11e98..9c1ebea68b544 100644 ---- a/drivers/media/usb/dvb-usb/dibusb-common.c -+++ b/drivers/media/usb/dvb-usb/dibusb-common.c -@@ -223,7 +223,7 @@ int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val) - u8 *buf; - int rc; - -- buf = kmalloc(2, GFP_KERNEL); -+ buf = kzalloc(2, GFP_KERNEL); - if (!buf) - return -ENOMEM; - -diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c -index 5983e72a0622c..3e96b4b711d75 100644 ---- a/drivers/media/usb/em28xx/em28xx-cards.c -+++ b/drivers/media/usb/em28xx/em28xx-cards.c -@@ -4029,8 +4029,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) - - em28xx_close_extension(dev); - -- if (dev->dev_next) -+ if (dev->dev_next) { -+ em28xx_close_extension(dev->dev_next); - em28xx_release_resources(dev->dev_next); -+ } -+ - em28xx_release_resources(dev); - - if (dev->dev_next) { -diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c -index 3daa64bb1e1d9..af9216278024f 100644 ---- a/drivers/media/usb/em28xx/em28xx-core.c -+++ b/drivers/media/usb/em28xx/em28xx-core.c -@@ -1152,8 +1152,9 @@ int em28xx_suspend_extension(struct em28xx *dev) - dev_info(&dev->intf->dev, "Suspending extensions\n"); - mutex_lock(&em28xx_devlist_mutex); - list_for_each_entry(ops, &em28xx_extension_devlist, next) { -- if (ops->suspend) -- ops->suspend(dev); -+ if (!ops->suspend) -+ continue; -+ ops->suspend(dev); - if (dev->dev_next) - ops->suspend(dev->dev_next); - } -diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c -index c46cbcfafab3f..8874b0b922eee 100644 ---- a/drivers/media/usb/tm6000/tm6000-video.c -+++ b/drivers/media/usb/tm6000/tm6000-video.c -@@ -854,8 +854,7 @@ static int vidioc_querycap(struct file *file, void *priv, - struct tm6000_core *dev = ((struct tm6000_fh *)priv)->dev; - - strscpy(cap->driver, "tm6000", sizeof(cap->driver)); -- strscpy(cap->card, "Trident TVMaster TM5600/6000/6010", -- sizeof(cap->card)); -+ strscpy(cap->card, "Trident TM5600/6000/6010", sizeof(cap->card)); - usb_make_path(dev->udev, cap->bus_info, sizeof(cap->bus_info)); - cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_READWRITE | - V4L2_CAP_DEVICE_CAPS; -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 40ca1d4e03483..378cfc46fc195 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -1972,6 +1972,7 @@ int uvc_register_video_device(struct uvc_device *dev, - const struct v4l2_file_operations *fops, - const struct v4l2_ioctl_ops *ioctl_ops) - { -+ const char *name; - int ret; - - /* Initialize the video buffers queue. */ -@@ -2000,16 +2001,20 @@ int uvc_register_video_device(struct uvc_device *dev, - case V4L2_BUF_TYPE_VIDEO_CAPTURE: - default: - vdev->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING; -+ name = "Video Capture"; - break; - case V4L2_BUF_TYPE_VIDEO_OUTPUT: - vdev->device_caps = V4L2_CAP_VIDEO_OUTPUT | V4L2_CAP_STREAMING; -+ name = "Video Output"; - break; - case V4L2_BUF_TYPE_META_CAPTURE: - vdev->device_caps = V4L2_CAP_META_CAPTURE | V4L2_CAP_STREAMING; -+ name = "Metadata"; - break; - } - -- strscpy(vdev->name, dev->name, sizeof(vdev->name)); -+ snprintf(vdev->name, sizeof(vdev->name), "%s %u", name, -+ stream->header.bTerminalLink); - - /* - * Set the driver data before calling video_register_device, otherwise -diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c -index db7f8f8ee2f9f..3126ee9e965c9 100644 ---- a/drivers/media/usb/uvc/uvc_v4l2.c -+++ b/drivers/media/usb/uvc/uvc_v4l2.c -@@ -467,10 +467,13 @@ static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream, - uvc_simplify_fraction(&timeperframe.numerator, - &timeperframe.denominator, 8, 333); - -- if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) -+ if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) { - parm->parm.capture.timeperframe = timeperframe; -- else -+ parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME; -+ } else { - parm->parm.output.timeperframe = timeperframe; -+ parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME; -+ } - - return 0; - } -diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c -index 5d095b2a03464..96b85d66e7a87 100644 ---- a/drivers/media/usb/uvc/uvc_video.c -+++ b/drivers/media/usb/uvc/uvc_video.c -@@ -112,6 +112,11 @@ int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit, - case 5: /* Invalid unit */ - case 6: /* Invalid control */ - case 7: /* Invalid Request */ -+ /* -+ * The firmware has not properly implemented -+ * the control or there has been a HW error. -+ */ -+ return -EIO; - case 8: /* Invalid value within range */ - return -EINVAL; - default: /* reserved or unknown */ -diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c -index 24db33f803c06..98633fa5d46fd 100644 ---- a/drivers/media/v4l2-core/v4l2-ioctl.c -+++ b/drivers/media/v4l2-core/v4l2-ioctl.c -@@ -902,7 +902,7 @@ static void v4l_print_default(const void *arg, bool write_only) - pr_cont("driver-specific ioctl\n"); - } - --static int check_ext_ctrls(struct v4l2_ext_controls *c, int allow_priv) -+static bool check_ext_ctrls(struct v4l2_ext_controls *c, unsigned long ioctl) - { - __u32 i; - -@@ -911,23 +911,41 @@ static int check_ext_ctrls(struct v4l2_ext_controls *c, int allow_priv) - for (i = 0; i < c->count; i++) - c->controls[i].reserved2[0] = 0; - -- /* V4L2_CID_PRIVATE_BASE cannot be used as control class -- when using extended controls. -- Only when passed in through VIDIOC_G_CTRL and VIDIOC_S_CTRL -- is it allowed for backwards compatibility. -- */ -- if (!allow_priv && c->which == V4L2_CID_PRIVATE_BASE) -- return 0; -- if (!c->which) -- return 1; -+ switch (c->which) { -+ case V4L2_CID_PRIVATE_BASE: -+ /* -+ * V4L2_CID_PRIVATE_BASE cannot be used as control class -+ * when using extended controls. -+ * Only when passed in through VIDIOC_G_CTRL and VIDIOC_S_CTRL -+ * is it allowed for backwards compatibility. -+ */ -+ if (ioctl == VIDIOC_G_CTRL || ioctl == VIDIOC_S_CTRL) -+ return false; -+ break; -+ case V4L2_CTRL_WHICH_DEF_VAL: -+ /* Default value cannot be changed */ -+ if (ioctl == VIDIOC_S_EXT_CTRLS || -+ ioctl == VIDIOC_TRY_EXT_CTRLS) { -+ c->error_idx = c->count; -+ return false; -+ } -+ return true; -+ case V4L2_CTRL_WHICH_CUR_VAL: -+ return true; -+ case V4L2_CTRL_WHICH_REQUEST_VAL: -+ c->error_idx = c->count; -+ return false; -+ } -+ - /* Check that all controls are from the same control class. */ - for (i = 0; i < c->count; i++) { - if (V4L2_CTRL_ID2WHICH(c->controls[i].id) != c->which) { -- c->error_idx = i; -- return 0; -+ c->error_idx = ioctl == VIDIOC_TRY_EXT_CTRLS ? i : -+ c->count; -+ return false; - } - } -- return 1; -+ return true; - } - - static int check_fmt(struct file *file, enum v4l2_buf_type type) -@@ -2145,7 +2163,7 @@ static int v4l_g_ctrl(const struct v4l2_ioctl_ops *ops, - ctrls.controls = &ctrl; - ctrl.id = p->id; - ctrl.value = p->value; -- if (check_ext_ctrls(&ctrls, 1)) { -+ if (check_ext_ctrls(&ctrls, VIDIOC_G_CTRL)) { - int ret = ops->vidioc_g_ext_ctrls(file, fh, &ctrls); - - if (ret == 0) -@@ -2179,7 +2197,7 @@ static int v4l_s_ctrl(const struct v4l2_ioctl_ops *ops, - ctrls.controls = &ctrl; - ctrl.id = p->id; - ctrl.value = p->value; -- if (check_ext_ctrls(&ctrls, 1)) -+ if (check_ext_ctrls(&ctrls, VIDIOC_S_CTRL)) - return ops->vidioc_s_ext_ctrls(file, fh, &ctrls); - return -EINVAL; - } -@@ -2201,8 +2219,8 @@ static int v4l_g_ext_ctrls(const struct v4l2_ioctl_ops *ops, - vfd, vfd->v4l2_dev->mdev, p); - if (ops->vidioc_g_ext_ctrls == NULL) - return -ENOTTY; -- return check_ext_ctrls(p, 0) ? ops->vidioc_g_ext_ctrls(file, fh, p) : -- -EINVAL; -+ return check_ext_ctrls(p, VIDIOC_G_EXT_CTRLS) ? -+ ops->vidioc_g_ext_ctrls(file, fh, p) : -EINVAL; - } - - static int v4l_s_ext_ctrls(const struct v4l2_ioctl_ops *ops, -@@ -2222,8 +2240,8 @@ static int v4l_s_ext_ctrls(const struct v4l2_ioctl_ops *ops, - vfd, vfd->v4l2_dev->mdev, p); - if (ops->vidioc_s_ext_ctrls == NULL) - return -ENOTTY; -- return check_ext_ctrls(p, 0) ? ops->vidioc_s_ext_ctrls(file, fh, p) : -- -EINVAL; -+ return check_ext_ctrls(p, VIDIOC_S_EXT_CTRLS) ? -+ ops->vidioc_s_ext_ctrls(file, fh, p) : -EINVAL; - } - - static int v4l_try_ext_ctrls(const struct v4l2_ioctl_ops *ops, -@@ -2243,8 +2261,8 @@ static int v4l_try_ext_ctrls(const struct v4l2_ioctl_ops *ops, - vfd, vfd->v4l2_dev->mdev, p); - if (ops->vidioc_try_ext_ctrls == NULL) - return -ENOTTY; -- return check_ext_ctrls(p, 0) ? ops->vidioc_try_ext_ctrls(file, fh, p) : -- -EINVAL; -+ return check_ext_ctrls(p, VIDIOC_TRY_EXT_CTRLS) ? -+ ops->vidioc_try_ext_ctrls(file, fh, p) : -EINVAL; - } - - /* -diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c -index 2790258346070..84fa32f288c80 100644 ---- a/drivers/memory/fsl_ifc.c -+++ b/drivers/memory/fsl_ifc.c -@@ -263,7 +263,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) - - ret = fsl_ifc_ctrl_init(fsl_ifc_ctrl_dev); - if (ret < 0) -- goto err; -+ goto err_unmap_nandirq; - - init_waitqueue_head(&fsl_ifc_ctrl_dev->nand_wait); - -@@ -272,7 +272,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) - if (ret != 0) { - dev_err(&dev->dev, "failed to install irq (%d)\n", - fsl_ifc_ctrl_dev->irq); -- goto err_irq; -+ goto err_unmap_nandirq; - } - - if (fsl_ifc_ctrl_dev->nand_irq) { -@@ -281,17 +281,16 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) - if (ret != 0) { - dev_err(&dev->dev, "failed to install irq (%d)\n", - fsl_ifc_ctrl_dev->nand_irq); -- goto err_nandirq; -+ goto err_free_irq; - } - } - - return 0; - --err_nandirq: -- free_irq(fsl_ifc_ctrl_dev->nand_irq, fsl_ifc_ctrl_dev); -- irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq); --err_irq: -+err_free_irq: - free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev); -+err_unmap_nandirq: -+ irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq); - irq_dispose_mapping(fsl_ifc_ctrl_dev->irq); - err: - iounmap(fsl_ifc_ctrl_dev->gregs); -diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c -index d9ee8e3dc72da..55907e4c36b18 100644 ---- a/drivers/memstick/core/ms_block.c -+++ b/drivers/memstick/core/ms_block.c -@@ -1727,7 +1727,7 @@ static int msb_init_card(struct memstick_dev *card) - msb->pages_in_block = boot_block->attr.block_size * 2; - msb->block_size = msb->page_size * msb->pages_in_block; - -- if (msb->page_size > PAGE_SIZE) { -+ if ((size_t)msb->page_size > PAGE_SIZE) { - /* this isn't supported by linux at all, anyway*/ - dbg("device page %d size isn't supported", msb->page_size); - return -EINVAL; -diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c -index 64fff6abe60e8..74d6686b35f77 100644 ---- a/drivers/memstick/host/jmb38x_ms.c -+++ b/drivers/memstick/host/jmb38x_ms.c -@@ -899,7 +899,7 @@ static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt) - - iounmap(host->addr); - err_out_free: -- kfree(msh); -+ memstick_free_host(msh); - return NULL; - } - -diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c -index d2ef46337191c..eaa2a94d18be4 100644 ---- a/drivers/memstick/host/r592.c -+++ b/drivers/memstick/host/r592.c -@@ -837,15 +837,15 @@ static void r592_remove(struct pci_dev *pdev) - } - memstick_remove_host(dev->host); - -+ if (dev->dummy_dma_page) -+ dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page, -+ dev->dummy_dma_page_physical_address); -+ - free_irq(dev->irq, dev); - iounmap(dev->mmio); - pci_release_regions(pdev); - pci_disable_device(pdev); - memstick_free_host(dev->host); -- -- if (dev->dummy_dma_page) -- dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page, -- dev->dummy_dma_page_physical_address); - } - - #ifdef CONFIG_PM_SLEEP -diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig -index 49ea02c467bf1..1b4a40d910cfb 100644 ---- a/drivers/mmc/host/Kconfig -+++ b/drivers/mmc/host/Kconfig -@@ -449,7 +449,7 @@ config MMC_OMAP_HS - - config MMC_WBSD - tristate "Winbond W83L51xD SD/MMC Card Interface support" -- depends on ISA_DMA_API -+ depends on ISA_DMA_API && !M68K - help - This selects the Winbond(R) W83L51xD Secure digital and - Multimedia card Interface. -diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c -index 7b280cb363271..ba37be8e423c2 100644 ---- a/drivers/mmc/host/dw_mmc.c -+++ b/drivers/mmc/host/dw_mmc.c -@@ -2013,7 +2013,8 @@ static void dw_mci_tasklet_func(unsigned long priv) - * delayed. Allowing the transfer to take place - * avoids races and keeps things simple. - */ -- if (err != -ETIMEDOUT) { -+ if (err != -ETIMEDOUT && -+ host->dir_status == DW_MCI_RECV_STATUS) { - state = STATE_SENDING_DATA; - continue; - } -diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c -index 52054931c3507..3a90037254a4d 100644 ---- a/drivers/mmc/host/mxs-mmc.c -+++ b/drivers/mmc/host/mxs-mmc.c -@@ -565,6 +565,11 @@ static const struct of_device_id mxs_mmc_dt_ids[] = { - }; - MODULE_DEVICE_TABLE(of, mxs_mmc_dt_ids); - -+static void mxs_mmc_regulator_disable(void *regulator) -+{ -+ regulator_disable(regulator); -+} -+ - static int mxs_mmc_probe(struct platform_device *pdev) - { - const struct of_device_id *of_id = -@@ -606,6 +611,11 @@ static int mxs_mmc_probe(struct platform_device *pdev) - "Failed to enable vmmc regulator: %d\n", ret); - goto out_mmc_free; - } -+ -+ ret = devm_add_action_or_reset(&pdev->dev, mxs_mmc_regulator_disable, -+ reg_vmmc); -+ if (ret) -+ goto out_mmc_free; - } - - ssp->clk = devm_clk_get(&pdev->dev, NULL); -diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c -index d3135249b2e40..346ca41b28f8b 100644 ---- a/drivers/mmc/host/sdhci-omap.c -+++ b/drivers/mmc/host/sdhci-omap.c -@@ -675,7 +675,8 @@ static void sdhci_omap_set_power(struct sdhci_host *host, unsigned char mode, - { - struct mmc_host *mmc = host->mmc; - -- mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); -+ if (!IS_ERR(mmc->supply.vmmc)) -+ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); - } - - static int sdhci_omap_enable_dma(struct sdhci_host *host) -diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c -index 32a76b8feaa5d..ac5d3b6db9b84 100644 ---- a/drivers/mtd/mtdcore.c -+++ b/drivers/mtd/mtdcore.c -@@ -727,8 +727,6 @@ int del_mtd_device(struct mtd_info *mtd) - - mutex_lock(&mtd_table_mutex); - -- debugfs_remove_recursive(mtd->dbg.dfs_dir); -- - if (idr_find(&mtd_idr, mtd->index) != mtd) { - ret = -ENODEV; - goto out_error; -@@ -744,6 +742,8 @@ int del_mtd_device(struct mtd_info *mtd) - mtd->index, mtd->name, mtd->usecount); - ret = -EBUSY; - } else { -+ debugfs_remove_recursive(mtd->dbg.dfs_dir); -+ - /* Try to remove the NVMEM provider */ - if (mtd->nvmem) - nvmem_unregister(mtd->nvmem); -diff --git a/drivers/mtd/spi-nor/hisi-sfc.c b/drivers/mtd/spi-nor/hisi-sfc.c -index 8fcc48056a8bc..569cfd473c87b 100644 ---- a/drivers/mtd/spi-nor/hisi-sfc.c -+++ b/drivers/mtd/spi-nor/hisi-sfc.c -@@ -474,7 +474,6 @@ static int hisi_spi_nor_remove(struct platform_device *pdev) - - hisi_spi_nor_unregister_all(host); - mutex_destroy(&host->lock); -- clk_disable_unprepare(host->clk); - return 0; - } - -diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c -index fd07561da0348..6a6cdd0bb2585 100644 ---- a/drivers/net/bonding/bond_sysfs_slave.c -+++ b/drivers/net/bonding/bond_sysfs_slave.c -@@ -108,15 +108,15 @@ static ssize_t ad_partner_oper_port_state_show(struct slave *slave, char *buf) - } - static SLAVE_ATTR_RO(ad_partner_oper_port_state); - --static const struct slave_attribute *slave_attrs[] = { -- &slave_attr_state, -- &slave_attr_mii_status, -- &slave_attr_link_failure_count, -- &slave_attr_perm_hwaddr, -- &slave_attr_queue_id, -- &slave_attr_ad_aggregator_id, -- &slave_attr_ad_actor_oper_port_state, -- &slave_attr_ad_partner_oper_port_state, -+static const struct attribute *slave_attrs[] = { -+ &slave_attr_state.attr, -+ &slave_attr_mii_status.attr, -+ &slave_attr_link_failure_count.attr, -+ &slave_attr_perm_hwaddr.attr, -+ &slave_attr_queue_id.attr, -+ &slave_attr_ad_aggregator_id.attr, -+ &slave_attr_ad_actor_oper_port_state.attr, -+ &slave_attr_ad_partner_oper_port_state.attr, - NULL - }; - -@@ -137,24 +137,10 @@ const struct sysfs_ops slave_sysfs_ops = { - - int bond_sysfs_slave_add(struct slave *slave) - { -- const struct slave_attribute **a; -- int err; -- -- for (a = slave_attrs; *a; ++a) { -- err = sysfs_create_file(&slave->kobj, &((*a)->attr)); -- if (err) { -- kobject_put(&slave->kobj); -- return err; -- } -- } -- -- return 0; -+ return sysfs_create_files(&slave->kobj, slave_attrs); - } - - void bond_sysfs_slave_del(struct slave *slave) - { -- const struct slave_attribute **a; -- -- for (a = slave_attrs; *a; ++a) -- sysfs_remove_file(&slave->kobj, &((*a)->attr)); -+ sysfs_remove_files(&slave->kobj, slave_attrs); - } -diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c -index 7f731bf369980..d047004360615 100644 ---- a/drivers/net/dsa/rtl8366rb.c -+++ b/drivers/net/dsa/rtl8366rb.c -@@ -1264,7 +1264,7 @@ static int rtl8366rb_set_mc_index(struct realtek_smi *smi, int port, int index) - - static bool rtl8366rb_is_vlan_valid(struct realtek_smi *smi, unsigned int vlan) - { -- unsigned int max = RTL8366RB_NUM_VLANS; -+ unsigned int max = RTL8366RB_NUM_VLANS - 1; - - if (smi->vlan4k_enabled) - max = RTL8366RB_NUM_VIDS - 1; -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h -index b2cd3bdba9f89..533b8519ec352 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h -@@ -1331,6 +1331,10 @@ - #define MDIO_VEND2_PMA_CDR_CONTROL 0x8056 - #endif - -+#ifndef MDIO_VEND2_PMA_MISC_CTRL0 -+#define MDIO_VEND2_PMA_MISC_CTRL0 0x8090 -+#endif -+ - #ifndef MDIO_CTRL1_SPEED1G - #define MDIO_CTRL1_SPEED1G (MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100) - #endif -@@ -1389,6 +1393,10 @@ - #define XGBE_PMA_RX_RST_0_RESET_ON 0x10 - #define XGBE_PMA_RX_RST_0_RESET_OFF 0x00 - -+#define XGBE_PMA_PLL_CTRL_MASK BIT(15) -+#define XGBE_PMA_PLL_CTRL_ENABLE BIT(15) -+#define XGBE_PMA_PLL_CTRL_DISABLE 0x0000 -+ - /* Bit setting and getting macros - * The get macro will extract the current bit field value from within - * the variable -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c -index d6f6afb67bcc6..0b325ae875b52 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c -@@ -1972,12 +1972,26 @@ static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata) - } - } - -+static void xgbe_phy_pll_ctrl(struct xgbe_prv_data *pdata, bool enable) -+{ -+ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_MISC_CTRL0, -+ XGBE_PMA_PLL_CTRL_MASK, -+ enable ? XGBE_PMA_PLL_CTRL_ENABLE -+ : XGBE_PMA_PLL_CTRL_DISABLE); -+ -+ /* Wait for command to complete */ -+ usleep_range(100, 200); -+} -+ - static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, - unsigned int cmd, unsigned int sub_cmd) - { - unsigned int s0 = 0; - unsigned int wait; - -+ /* Disable PLL re-initialization during FW command processing */ -+ xgbe_phy_pll_ctrl(pdata, false); -+ - /* Log if a previous command did not complete */ - if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) { - netif_dbg(pdata, link, pdata->netdev, -@@ -1998,7 +2012,7 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, - wait = XGBE_RATECHANGE_COUNT; - while (wait--) { - if (!XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) -- return; -+ goto reenable_pll; - - usleep_range(1000, 2000); - } -@@ -2008,6 +2022,10 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata, - - /* Reset on error */ - xgbe_phy_rx_reset(pdata); -+ -+reenable_pll: -+ /* Enable PLL re-initialization */ -+ xgbe_phy_pll_ctrl(pdata, true); - } - - static void xgbe_phy_rrc(struct xgbe_prv_data *pdata) -diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c -index 9361f964bb9b2..816453a4f8d6c 100644 ---- a/drivers/net/ethernet/cavium/thunder/nic_main.c -+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c -@@ -1193,7 +1193,7 @@ static int nic_register_interrupts(struct nicpf *nic) - dev_err(&nic->pdev->dev, - "Request for #%d msix vectors failed, returned %d\n", - nic->num_vec, ret); -- return 1; -+ return ret; - } - - /* Register mailbox interrupt handler */ -diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c -index 5c45c0c6dd234..27ea528ef4484 100644 ---- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c -+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c -@@ -1226,7 +1226,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic) - if (ret < 0) { - netdev_err(nic->netdev, - "Req for #%d msix vectors failed\n", nic->num_vec); -- return 1; -+ return ret; - } - - sprintf(nic->irq_name[irq], "%s Mbox", "NICVF"); -@@ -1245,7 +1245,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic) - if (!nicvf_check_pf_ready(nic)) { - nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0); - nicvf_unregister_interrupts(nic); -- return 1; -+ return -EIO; - } - - return 0; -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c -index f537be9cb3155..5ba30b8eb1e11 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c -@@ -1466,12 +1466,15 @@ static int cxgb4_get_module_info(struct net_device *dev, - if (ret) - return ret; - -- if (!sff8472_comp || (sff_diag_type & 4)) { -+ if (!sff8472_comp || (sff_diag_type & SFP_DIAG_ADDRMODE)) { - modinfo->type = ETH_MODULE_SFF_8079; - modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN; - } else { - modinfo->type = ETH_MODULE_SFF_8472; -- modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN; -+ if (sff_diag_type & SFP_DIAG_IMPLEMENTED) -+ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN; -+ else -+ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN / 2; - } - break; - -diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h -index 002fc62ea7262..63bc956d20376 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h -+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h -@@ -293,6 +293,8 @@ enum { - #define I2C_PAGE_SIZE 0x100 - #define SFP_DIAG_TYPE_ADDR 0x5c - #define SFP_DIAG_TYPE_LEN 0x1 -+#define SFP_DIAG_ADDRMODE BIT(2) -+#define SFP_DIAG_IMPLEMENTED BIT(6) - #define SFF_8472_COMP_ADDR 0x5e - #define SFF_8472_COMP_LEN 0x1 - #define SFF_REV_ADDR 0x1 -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c -index 9076605403a74..bb22d91f6e53e 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c -@@ -124,7 +124,7 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets, - if (ret) - return ret; - -- for (i = 0; i < hdev->tc_max; i++) { -+ for (i = 0; i < HNAE3_MAX_TC; i++) { - switch (ets->tc_tsa[i]) { - case IEEE_8021QAZ_TSA_STRICT: - if (hdev->tm_info.tc_info[i].tc_sch_mode != -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c -index d98f0e2ec7aa3..8448607742a6b 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c -@@ -974,7 +974,6 @@ static int hclge_tm_pri_tc_base_dwrr_cfg(struct hclge_dev *hdev) - - static int hclge_tm_ets_tc_dwrr_cfg(struct hclge_dev *hdev) - { --#define DEFAULT_TC_WEIGHT 1 - #define DEFAULT_TC_OFFSET 14 - - struct hclge_ets_tc_weight_cmd *ets_weight; -@@ -987,13 +986,7 @@ static int hclge_tm_ets_tc_dwrr_cfg(struct hclge_dev *hdev) - for (i = 0; i < HNAE3_MAX_TC; i++) { - struct hclge_pg_info *pg_info; - -- ets_weight->tc_weight[i] = DEFAULT_TC_WEIGHT; -- -- if (!(hdev->hw_tc_map & BIT(i))) -- continue; -- -- pg_info = -- &hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid]; -+ pg_info = &hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid]; - ets_weight->tc_weight[i] = pg_info->tc_dwrr[i]; - } - -diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c -index cfe7229593ead..9adfc0a7ab823 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.c -+++ b/drivers/net/ethernet/ibm/ibmvnic.c -@@ -1462,8 +1462,6 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) - netdev_tx_t ret = NETDEV_TX_OK; - - if (test_bit(0, &adapter->resetting)) { -- if (!netif_subqueue_stopped(netdev, skb)) -- netif_stop_subqueue(netdev, queue_num); - dev_kfree_skb_any(skb); - - tx_send_failed++; -@@ -4936,6 +4934,9 @@ static int init_crq_queue(struct ibmvnic_adapter *adapter) - crq->cur = 0; - spin_lock_init(&crq->lock); - -+ /* process any CRQs that were queued before we enabled interrupts */ -+ tasklet_schedule(&adapter->tasklet); -+ - return retrc; - - req_irq_failed: -diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c -index 8f732771d3fad..bd2966eb6b7d3 100644 ---- a/drivers/net/ethernet/netronome/nfp/bpf/main.c -+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c -@@ -182,15 +182,21 @@ static int - nfp_bpf_check_mtu(struct nfp_app *app, struct net_device *netdev, int new_mtu) - { - struct nfp_net *nn = netdev_priv(netdev); -- unsigned int max_mtu; -+ struct nfp_bpf_vnic *bv; -+ struct bpf_prog *prog; - - if (~nn->dp.ctrl & NFP_NET_CFG_CTRL_BPF) - return 0; - -- max_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; -- if (new_mtu > max_mtu) { -- nn_info(nn, "BPF offload active, MTU over %u not supported\n", -- max_mtu); -+ if (nn->xdp_hw.prog) { -+ prog = nn->xdp_hw.prog; -+ } else { -+ bv = nn->app_priv; -+ prog = bv->tc_prog; -+ } -+ -+ if (nfp_bpf_offload_check_mtu(nn, prog, new_mtu)) { -+ nn_info(nn, "BPF offload active, potential packet access beyond hardware packet boundary"); - return -EBUSY; - } - return 0; -diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h -index fac9c6f9e197b..c74620fcc539c 100644 ---- a/drivers/net/ethernet/netronome/nfp/bpf/main.h -+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h -@@ -560,6 +560,8 @@ bool nfp_is_subprog_start(struct nfp_insn_meta *meta); - void nfp_bpf_jit_prepare(struct nfp_prog *nfp_prog); - int nfp_bpf_jit(struct nfp_prog *prog); - bool nfp_bpf_supported_opcode(u8 code); -+bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog, -+ unsigned int mtu); - - int nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx, - int prev_insn_idx); -diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c -index 88fab6a82acff..7ff388ecc7e3a 100644 ---- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c -+++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c -@@ -477,19 +477,28 @@ int nfp_bpf_event_output(struct nfp_app_bpf *bpf, const void *data, - return 0; - } - -+bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog, -+ unsigned int mtu) -+{ -+ unsigned int fw_mtu, pkt_off; -+ -+ fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; -+ pkt_off = min(prog->aux->max_pkt_offset, mtu); -+ -+ return fw_mtu < pkt_off; -+} -+ - static int - nfp_net_bpf_load(struct nfp_net *nn, struct bpf_prog *prog, - struct netlink_ext_ack *extack) - { - struct nfp_prog *nfp_prog = prog->aux->offload->dev_priv; -- unsigned int fw_mtu, pkt_off, max_stack, max_prog_len; -+ unsigned int max_stack, max_prog_len; - dma_addr_t dma_addr; - void *img; - int err; - -- fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32; -- pkt_off = min(prog->aux->max_pkt_offset, nn->dp.netdev->mtu); -- if (fw_mtu < pkt_off) { -+ if (nfp_bpf_offload_check_mtu(nn, prog, nn->dp.netdev->mtu)) { - NL_SET_ERR_MSG_MOD(extack, "BPF offload not supported with potential packet access beyond HW packet split boundary"); - return -EOPNOTSUPP; - } -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index 623d86e5e970f..8d2b184ff5758 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -212,6 +212,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = { - { PCI_VDEVICE(REALTEK, 0x8129) }, - { PCI_VDEVICE(REALTEK, 0x8136), RTL_CFG_NO_GBIT }, - { PCI_VDEVICE(REALTEK, 0x8161) }, -+ { PCI_VDEVICE(REALTEK, 0x8162) }, - { PCI_VDEVICE(REALTEK, 0x8167) }, - { PCI_VDEVICE(REALTEK, 0x8168) }, - { PCI_VDEVICE(NCUBE, 0x8168) }, -diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c -index 59b4f16896a81..1fa1b71dbfa11 100644 ---- a/drivers/net/ethernet/sfc/ptp.c -+++ b/drivers/net/ethernet/sfc/ptp.c -@@ -648,7 +648,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx) - } else if (rc == -EINVAL) { - fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS; - } else if (rc == -EPERM) { -- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); -+ pci_info(efx->pci_dev, "no PTP support\n"); - return rc; - } else { - efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf), -@@ -824,7 +824,7 @@ static int efx_ptp_disable(struct efx_nic *efx) - * should only have been called during probe. - */ - if (rc == -ENOSYS || rc == -EPERM) -- netif_info(efx, probe, efx->net_dev, "no PTP support\n"); -+ pci_info(efx->pci_dev, "no PTP support\n"); - else if (rc) - efx_mcdi_display_error(efx, MC_CMD_PTP, - MC_CMD_PTP_IN_DISABLE_LEN, -diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c -index dfbdf05dcf794..68f092881d137 100644 ---- a/drivers/net/ethernet/sfc/siena_sriov.c -+++ b/drivers/net/ethernet/sfc/siena_sriov.c -@@ -1056,7 +1056,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx) - return; - - if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) { -- netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n"); -+ pci_info(efx->pci_dev, "no SR-IOV VFs probed\n"); - return; - } - if (count > 0 && count > max_vfs) -diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c -index 6869c5c74b9f7..fac59032bf83a 100644 ---- a/drivers/net/ethernet/ti/davinci_emac.c -+++ b/drivers/net/ethernet/ti/davinci_emac.c -@@ -412,8 +412,20 @@ static int emac_set_coalesce(struct net_device *ndev, - u32 int_ctrl, num_interrupts = 0; - u32 prescale = 0, addnl_dvdr = 1, coal_intvl = 0; - -- if (!coal->rx_coalesce_usecs) -- return -EINVAL; -+ if (!coal->rx_coalesce_usecs) { -+ priv->coal_intvl = 0; -+ -+ switch (priv->version) { -+ case EMAC_VERSION_2: -+ emac_ctrl_write(EMAC_DM646X_CMINTCTRL, 0); -+ break; -+ default: -+ emac_ctrl_write(EMAC_CTRL_EWINTTCNT, 0); -+ break; -+ } -+ -+ return 0; -+ } - - coal_intvl = coal->rx_coalesce_usecs; - -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index f95bd1b0fb965..0b61d80ea3f8c 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -1040,8 +1040,9 @@ static struct phy_driver ksphy_driver[] = { - .get_sset_count = kszphy_get_sset_count, - .get_strings = kszphy_get_strings, - .get_stats = kszphy_get_stats, -- .suspend = genphy_suspend, -- .resume = genphy_resume, -+ /* No suspend/resume callbacks because of errata DS80000700A, -+ * receiver error following software power down. -+ */ - }, { - .phy_id = PHY_ID_KSZ8041RNLI, - .phy_id_mask = MICREL_PHY_ID_MASK, -diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c -index bf5bbb565cf5e..7be43a1eaefda 100644 ---- a/drivers/net/phy/phylink.c -+++ b/drivers/net/phy/phylink.c -@@ -1331,7 +1331,7 @@ int phylink_ethtool_set_pauseparam(struct phylink *pl, - return -EOPNOTSUPP; - - if (!phylink_test(pl->supported, Asym_Pause) && -- !pause->autoneg && pause->rx_pause != pause->tx_pause) -+ pause->rx_pause != pause->tx_pause) - return -EINVAL; - - config->pause &= ~(MLO_PAUSE_AN | MLO_PAUSE_TXRX_MASK); -diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c -index a06e6ab453f50..cf090f88dac03 100644 ---- a/drivers/net/vmxnet3/vmxnet3_drv.c -+++ b/drivers/net/vmxnet3/vmxnet3_drv.c -@@ -3634,7 +3634,6 @@ vmxnet3_suspend(struct device *device) - vmxnet3_free_intr_resources(adapter); - - netif_device_detach(netdev); -- netif_tx_stop_all_queues(netdev); - - /* Create wake-up filters. */ - pmConf = adapter->pm_conf; -diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c -index f08ed52d51f3f..f436b8c130611 100644 ---- a/drivers/net/vrf.c -+++ b/drivers/net/vrf.c -@@ -33,6 +33,7 @@ - #include - #include - #include -+#include - - #define DRV_NAME "vrf" - #define DRV_VERSION "1.0" -@@ -147,12 +148,26 @@ static int vrf_local_xmit(struct sk_buff *skb, struct net_device *dev, - return NETDEV_TX_OK; - } - -+static void vrf_nf_set_untracked(struct sk_buff *skb) -+{ -+ if (skb_get_nfct(skb) == 0) -+ nf_ct_set(skb, NULL, IP_CT_UNTRACKED); -+} -+ -+static void vrf_nf_reset_ct(struct sk_buff *skb) -+{ -+ if (skb_get_nfct(skb) == IP_CT_UNTRACKED) -+ nf_reset_ct(skb); -+} -+ - #if IS_ENABLED(CONFIG_IPV6) - static int vrf_ip6_local_out(struct net *net, struct sock *sk, - struct sk_buff *skb) - { - int err; - -+ vrf_nf_reset_ct(skb); -+ - err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, - sk, skb, NULL, skb_dst(skb)->dev, dst_output); - -@@ -232,6 +247,8 @@ static int vrf_ip_local_out(struct net *net, struct sock *sk, - { - int err; - -+ vrf_nf_reset_ct(skb); -+ - err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk, - skb, NULL, skb_dst(skb)->dev, dst_output); - if (likely(err == 1)) -@@ -351,8 +368,7 @@ static void vrf_finish_direct(struct sk_buff *skb) - skb_pull(skb, ETH_HLEN); - } - -- /* reset skb device */ -- nf_reset_ct(skb); -+ vrf_nf_reset_ct(skb); - } - - #if IS_ENABLED(CONFIG_IPV6) -@@ -366,7 +382,7 @@ static int vrf_finish_output6(struct net *net, struct sock *sk, - struct neighbour *neigh; - int ret; - -- nf_reset_ct(skb); -+ vrf_nf_reset_ct(skb); - - skb->protocol = htons(ETH_P_IPV6); - skb->dev = dev; -@@ -477,6 +493,8 @@ static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev, - - skb->dev = vrf_dev; - -+ vrf_nf_set_untracked(skb); -+ - err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk, - skb, NULL, vrf_dev, vrf_ip6_out_direct_finish); - -@@ -584,7 +602,7 @@ static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *s - bool is_v6gw = false; - int ret = -EINVAL; - -- nf_reset_ct(skb); -+ vrf_nf_reset_ct(skb); - - /* Be paranoid, rather than too clever. */ - if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) { -@@ -712,6 +730,8 @@ static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev, - - skb->dev = vrf_dev; - -+ vrf_nf_set_untracked(skb); -+ - err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk, - skb, NULL, vrf_dev, vrf_ip_out_direct_finish); - -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 20e248fd43642..3026eb54a7f23 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -985,8 +985,12 @@ static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif) - ath10k_mac_vif_beacon_free(arvif); - - if (arvif->beacon_buf) { -- dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN, -- arvif->beacon_buf, arvif->beacon_paddr); -+ if (ar->bus_param.dev_type == ATH10K_DEV_TYPE_HL) -+ kfree(arvif->beacon_buf); -+ else -+ dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN, -+ arvif->beacon_buf, -+ arvif->beacon_paddr); - arvif->beacon_buf = NULL; - } - } -@@ -1040,7 +1044,7 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id) - arg.channel.min_power = 0; - arg.channel.max_power = channel->max_power * 2; - arg.channel.max_reg_power = channel->max_reg_power * 2; -- arg.channel.max_antenna_gain = channel->max_antenna_gain * 2; -+ arg.channel.max_antenna_gain = channel->max_antenna_gain; - - reinit_completion(&ar->vdev_setup_done); - reinit_completion(&ar->vdev_delete_done); -@@ -1486,7 +1490,7 @@ static int ath10k_vdev_start_restart(struct ath10k_vif *arvif, - arg.channel.min_power = 0; - arg.channel.max_power = chandef->chan->max_power * 2; - arg.channel.max_reg_power = chandef->chan->max_reg_power * 2; -- arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2; -+ arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain; - - if (arvif->vdev_type == WMI_VDEV_TYPE_AP) { - arg.ssid = arvif->u.ap.ssid; -@@ -3145,7 +3149,7 @@ static int ath10k_update_channel_list(struct ath10k *ar) - ch->min_power = 0; - ch->max_power = channel->max_power * 2; - ch->max_reg_power = channel->max_reg_power * 2; -- ch->max_antenna_gain = channel->max_antenna_gain * 2; -+ ch->max_antenna_gain = channel->max_antenna_gain; - ch->reg_class_id = 0; /* FIXME */ - - /* FIXME: why use only legacy modes, why not any -@@ -5251,10 +5255,25 @@ static int ath10k_add_interface(struct ieee80211_hw *hw, - if (vif->type == NL80211_IFTYPE_ADHOC || - vif->type == NL80211_IFTYPE_MESH_POINT || - vif->type == NL80211_IFTYPE_AP) { -- arvif->beacon_buf = dma_alloc_coherent(ar->dev, -- IEEE80211_MAX_FRAME_LEN, -- &arvif->beacon_paddr, -- GFP_ATOMIC); -+ if (ar->bus_param.dev_type == ATH10K_DEV_TYPE_HL) { -+ arvif->beacon_buf = kmalloc(IEEE80211_MAX_FRAME_LEN, -+ GFP_KERNEL); -+ -+ /* Using a kernel pointer in place of a dma_addr_t -+ * token can lead to undefined behavior if that -+ * makes it into cache management functions. Use a -+ * known-invalid address token instead, which -+ * avoids the warning and makes it easier to catch -+ * bugs if it does end up getting used. -+ */ -+ arvif->beacon_paddr = DMA_MAPPING_ERROR; -+ } else { -+ arvif->beacon_buf = -+ dma_alloc_coherent(ar->dev, -+ IEEE80211_MAX_FRAME_LEN, -+ &arvif->beacon_paddr, -+ GFP_ATOMIC); -+ } - if (!arvif->beacon_buf) { - ret = -ENOMEM; - ath10k_warn(ar, "failed to allocate beacon buffer: %d\n", -@@ -5469,8 +5488,12 @@ err_vdev_delete: - - err: - if (arvif->beacon_buf) { -- dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN, -- arvif->beacon_buf, arvif->beacon_paddr); -+ if (ar->bus_param.dev_type == ATH10K_DEV_TYPE_HL) -+ kfree(arvif->beacon_buf); -+ else -+ dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN, -+ arvif->beacon_buf, -+ arvif->beacon_paddr); - arvif->beacon_buf = NULL; - } - -diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c -index 05c0d5e92475e..326e1dc4c6734 100644 ---- a/drivers/net/wireless/ath/ath10k/usb.c -+++ b/drivers/net/wireless/ath/ath10k/usb.c -@@ -525,7 +525,7 @@ static int ath10k_usb_submit_ctrl_in(struct ath10k *ar, - req, - USB_DIR_IN | USB_TYPE_VENDOR | - USB_RECIP_DEVICE, value, index, buf, -- size, 2 * HZ); -+ size, 2000); - - if (ret < 0) { - ath10k_warn(ar, "Failed to read usb control message: %d\n", -@@ -865,6 +865,11 @@ static int ath10k_usb_setup_pipe_resources(struct ath10k *ar, - le16_to_cpu(endpoint->wMaxPacketSize), - endpoint->bInterval); - } -+ -+ /* Ignore broken descriptors. */ -+ if (usb_endpoint_maxp(endpoint) == 0) -+ continue; -+ - urbcount = 0; - - pipe_num = -diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c -index 91604a14a8f46..796bd93c599b1 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.c -+++ b/drivers/net/wireless/ath/ath10k/wmi.c -@@ -2541,6 +2541,10 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb) - if (ieee80211_is_beacon(hdr->frame_control)) - ath10k_mac_handle_beacon(ar, skb); - -+ if (ieee80211_is_beacon(hdr->frame_control) || -+ ieee80211_is_probe_resp(hdr->frame_control)) -+ status->boottime_ns = ktime_get_boottime_ns(); -+ - ath10k_dbg(ar, ATH10K_DBG_MGMT, - "event mgmt rx skb %pK len %d ftype %02x stype %02x\n", - skb, skb->len, -diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h -index 761bc4a7064df..de22396d085ce 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi.h -+++ b/drivers/net/wireless/ath/ath10k/wmi.h -@@ -2045,7 +2045,9 @@ struct wmi_channel { - union { - __le32 reginfo1; - struct { -+ /* note: power unit is 1 dBm */ - u8 antenna_max; -+ /* note: power unit is 0.5 dBm */ - u8 max_tx_power; - } __packed; - } __packed; -@@ -2065,6 +2067,7 @@ struct wmi_channel_arg { - u32 min_power; - u32 max_power; - u32 max_reg_power; -+ /* note: power unit is 1 dBm */ - u32 max_antenna_gain; - u32 reg_class_id; - enum wmi_phy_mode mode; -diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c -index 53b66e9434c99..8b24964304b1f 100644 ---- a/drivers/net/wireless/ath/ath6kl/usb.c -+++ b/drivers/net/wireless/ath/ath6kl/usb.c -@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb) - le16_to_cpu(endpoint->wMaxPacketSize), - endpoint->bInterval); - } -+ -+ /* Ignore broken descriptors. */ -+ if (usb_endpoint_maxp(endpoint) == 0) -+ continue; -+ - urbcount = 0; - - pipe_num = -@@ -907,7 +912,7 @@ static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb, - req, - USB_DIR_IN | USB_TYPE_VENDOR | - USB_RECIP_DEVICE, value, index, buf, -- size, 2 * HZ); -+ size, 2000); - - if (ret < 0) { - ath6kl_warn("Failed to read usb control message: %d\n", ret); -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index 28ccdcb197de2..ec13bd8d5487d 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -530,8 +530,10 @@ irqreturn_t ath_isr(int irq, void *dev) - ath9k_debug_sync_cause(sc, sync_cause); - status &= ah->imask; /* discard unasked-for bits */ - -- if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) -+ if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) { -+ ath9k_hw_kill_interrupts(sc->sc_ah); - return IRQ_HANDLED; -+ } - - /* - * If there are no status bits set, then this interrupt was not -diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c -index a274eb0d19688..a0ad6e48a35b4 100644 ---- a/drivers/net/wireless/ath/dfs_pattern_detector.c -+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c -@@ -182,10 +182,12 @@ static void channel_detector_exit(struct dfs_pattern_detector *dpd, - if (cd == NULL) - return; - list_del(&cd->head); -- for (i = 0; i < dpd->num_radar_types; i++) { -- struct pri_detector *de = cd->detectors[i]; -- if (de != NULL) -- de->exit(de); -+ if (cd->detectors) { -+ for (i = 0; i < dpd->num_radar_types; i++) { -+ struct pri_detector *de = cd->detectors[i]; -+ if (de != NULL) -+ de->exit(de); -+ } - } - kfree(cd->detectors); - kfree(cd); -diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c -index bab30f7a443ce..4da25e84793b7 100644 ---- a/drivers/net/wireless/ath/wcn36xx/dxe.c -+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c -@@ -563,6 +563,10 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn, - dxe = ctl->desc; - - while (!(READ_ONCE(dxe->ctrl) & WCN36xx_DXE_CTRL_VLD)) { -+ /* do not read until we own DMA descriptor */ -+ dma_rmb(); -+ -+ /* read/modify DMA descriptor */ - skb = ctl->skb; - dma_addr = dxe->dst_addr_l; - ret = wcn36xx_dxe_fill_skb(wcn->dev, ctl, GFP_ATOMIC); -@@ -573,9 +577,15 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn, - dma_unmap_single(wcn->dev, dma_addr, WCN36XX_PKT_SIZE, - DMA_FROM_DEVICE); - wcn36xx_rx_skb(wcn, skb); -- } /* else keep old skb not submitted and use it for rx DMA */ -+ } -+ /* else keep old skb not submitted and reuse it for rx DMA -+ * (dropping the packet that it contained) -+ */ - -+ /* flush descriptor changes before re-marking as valid */ -+ dma_wmb(); - dxe->ctrl = ctrl; -+ - ctl = ctl->next; - dxe = ctl->desc; - } -diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c -index 556ba3c6c5d8e..eb5d08bf25032 100644 ---- a/drivers/net/wireless/ath/wcn36xx/main.c -+++ b/drivers/net/wireless/ath/wcn36xx/main.c -@@ -134,7 +134,9 @@ static struct ieee80211_supported_band wcn_band_2ghz = { - .cap = IEEE80211_HT_CAP_GRN_FLD | - IEEE80211_HT_CAP_SGI_20 | - IEEE80211_HT_CAP_DSSSCCK40 | -- IEEE80211_HT_CAP_LSIG_TXOP_PROT, -+ IEEE80211_HT_CAP_LSIG_TXOP_PROT | -+ IEEE80211_HT_CAP_SGI_40 | -+ IEEE80211_HT_CAP_SUP_WIDTH_20_40, - .ht_supported = true, - .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, - .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, -diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c -index 523550f94a3f0..a7532028bf9db 100644 ---- a/drivers/net/wireless/ath/wcn36xx/smd.c -+++ b/drivers/net/wireless/ath/wcn36xx/smd.c -@@ -2340,30 +2340,52 @@ static int wcn36xx_smd_delete_sta_context_ind(struct wcn36xx *wcn, - size_t len) - { - struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf; -- struct wcn36xx_vif *tmp; -+ struct wcn36xx_vif *vif_priv; -+ struct ieee80211_vif *vif; -+ struct ieee80211_bss_conf *bss_conf; - struct ieee80211_sta *sta; -+ bool found = false; - - if (len != sizeof(*rsp)) { - wcn36xx_warn("Corrupted delete sta indication\n"); - return -EIO; - } - -- wcn36xx_dbg(WCN36XX_DBG_HAL, "delete station indication %pM index %d\n", -- rsp->addr2, rsp->sta_id); -+ wcn36xx_dbg(WCN36XX_DBG_HAL, -+ "delete station indication %pM index %d reason %d\n", -+ rsp->addr2, rsp->sta_id, rsp->reason_code); - -- list_for_each_entry(tmp, &wcn->vif_list, list) { -+ list_for_each_entry(vif_priv, &wcn->vif_list, list) { - rcu_read_lock(); -- sta = ieee80211_find_sta(wcn36xx_priv_to_vif(tmp), rsp->addr2); -- if (sta) -- ieee80211_report_low_ack(sta, 0); -+ vif = wcn36xx_priv_to_vif(vif_priv); -+ -+ if (vif->type == NL80211_IFTYPE_STATION) { -+ /* We could call ieee80211_find_sta too, but checking -+ * bss_conf is clearer. -+ */ -+ bss_conf = &vif->bss_conf; -+ if (vif_priv->sta_assoc && -+ !memcmp(bss_conf->bssid, rsp->addr2, ETH_ALEN)) { -+ found = true; -+ wcn36xx_dbg(WCN36XX_DBG_HAL, -+ "connection loss bss_index %d\n", -+ vif_priv->bss_index); -+ ieee80211_connection_loss(vif); -+ } -+ } else { -+ sta = ieee80211_find_sta(vif, rsp->addr2); -+ if (sta) { -+ found = true; -+ ieee80211_report_low_ack(sta, 0); -+ } -+ } -+ - rcu_read_unlock(); -- if (sta) -+ if (found) - return 0; - } - -- wcn36xx_warn("STA with addr %pM and index %d not found\n", -- rsp->addr2, -- rsp->sta_id); -+ wcn36xx_warn("BSS or STA with addr %pM not found\n", rsp->addr2); - return -ENOENT; - } - -diff --git a/drivers/net/wireless/broadcom/b43/phy_g.c b/drivers/net/wireless/broadcom/b43/phy_g.c -index 1e022ec733a37..8b8fdb4965bde 100644 ---- a/drivers/net/wireless/broadcom/b43/phy_g.c -+++ b/drivers/net/wireless/broadcom/b43/phy_g.c -@@ -2297,7 +2297,7 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev) - b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF); - b43_set_all_gains(dev, 3, 8, 1); - -- start = (channel - 5 > 0) ? channel - 5 : 1; -+ start = (channel > 5) ? channel - 5 : 1; - end = (channel + 5 < 14) ? channel + 5 : 13; - - for (i = start; i <= end; i++) { -diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c -index da40d1ca8723d..e4dce76a4481d 100644 ---- a/drivers/net/wireless/broadcom/b43legacy/radio.c -+++ b/drivers/net/wireless/broadcom/b43legacy/radio.c -@@ -283,7 +283,7 @@ u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev) - & 0x7FFF); - b43legacy_set_all_gains(dev, 3, 8, 1); - -- start = (channel - 5 > 0) ? channel - 5 : 1; -+ start = (channel > 5) ? channel - 5 : 1; - end = (channel + 5 < 14) ? channel + 5 : 13; - - for (i = start; i <= end; i++) { -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c -index 6d5188b78f2de..0af452dca7664 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c -@@ -75,6 +75,16 @@ static const struct dmi_system_id dmi_platform_data[] = { - }, - .driver_data = (void *)&acepc_t8_data, - }, -+ { -+ /* Cyberbook T116 rugged tablet */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), -+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "20170531"), -+ }, -+ /* The factory image nvram file is identical to the ACEPC T8 one */ -+ .driver_data = (void *)&acepc_t8_data, -+ }, - { - /* Match for the GPDwin which unfortunately uses somewhat - * generic dmi strings, which is why we test for 4 strings. -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c -index 8686107da1168..a637d7fb4b261 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c -@@ -758,6 +758,9 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm) - - lockdep_assert_held(&mvm->mutex); - -+ if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM) -+ return false; -+ - if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1) - return false; - -diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c -index 20436a289d5cd..5d6dc1dd050d4 100644 ---- a/drivers/net/wireless/marvell/libertas/if_usb.c -+++ b/drivers/net/wireless/marvell/libertas/if_usb.c -@@ -292,6 +292,7 @@ err_add_card: - if_usb_reset_device(cardp); - dealloc: - if_usb_free(cardp); -+ kfree(cardp); - - error: - return r; -@@ -316,6 +317,7 @@ static void if_usb_disconnect(struct usb_interface *intf) - - /* Unlink and free urb */ - if_usb_free(cardp); -+ kfree(cardp); - - usb_set_intfdata(intf, NULL); - usb_put_dev(interface_to_usbdev(intf)); -diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c -index bedc092150884..b30bcb28503ae 100644 ---- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c -+++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c -@@ -230,6 +230,7 @@ static int if_usb_probe(struct usb_interface *intf, - - dealloc: - if_usb_free(cardp); -+ kfree(cardp); - error: - lbtf_deb_leave(LBTF_DEB_MAIN); - return -ENOMEM; -@@ -254,6 +255,7 @@ static void if_usb_disconnect(struct usb_interface *intf) - - /* Unlink and free urb */ - if_usb_free(cardp); -+ kfree(cardp); - - usb_set_intfdata(intf, NULL); - usb_put_dev(interface_to_usbdev(intf)); -diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c -index e435f801bc912..acbef9f1a83b6 100644 ---- a/drivers/net/wireless/marvell/mwifiex/11n.c -+++ b/drivers/net/wireless/marvell/mwifiex/11n.c -@@ -657,14 +657,15 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac, - uint16_t del_ba_param_set; - - memset(&delba, 0, sizeof(delba)); -- delba.del_ba_param_set = cpu_to_le16(tid << DELBA_TID_POS); - -- del_ba_param_set = le16_to_cpu(delba.del_ba_param_set); -+ del_ba_param_set = tid << DELBA_TID_POS; -+ - if (initiator) - del_ba_param_set |= IEEE80211_DELBA_PARAM_INITIATOR_MASK; - else - del_ba_param_set &= ~IEEE80211_DELBA_PARAM_INITIATOR_MASK; - -+ delba.del_ba_param_set = cpu_to_le16(del_ba_param_set); - memcpy(&delba.peer_mac_addr, peer_mac, ETH_ALEN); - - /* We don't wait for the response of this command */ -diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -index 9e6dc289ec3e8..1599ae74b066b 100644 ---- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c -+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c -@@ -912,16 +912,20 @@ mwifiex_init_new_priv_params(struct mwifiex_private *priv, - switch (type) { - case NL80211_IFTYPE_STATION: - case NL80211_IFTYPE_ADHOC: -- priv->bss_role = MWIFIEX_BSS_ROLE_STA; -+ priv->bss_role = MWIFIEX_BSS_ROLE_STA; -+ priv->bss_type = MWIFIEX_BSS_TYPE_STA; - break; - case NL80211_IFTYPE_P2P_CLIENT: -- priv->bss_role = MWIFIEX_BSS_ROLE_STA; -+ priv->bss_role = MWIFIEX_BSS_ROLE_STA; -+ priv->bss_type = MWIFIEX_BSS_TYPE_P2P; - break; - case NL80211_IFTYPE_P2P_GO: -- priv->bss_role = MWIFIEX_BSS_ROLE_UAP; -+ priv->bss_role = MWIFIEX_BSS_ROLE_UAP; -+ priv->bss_type = MWIFIEX_BSS_TYPE_P2P; - break; - case NL80211_IFTYPE_AP: - priv->bss_role = MWIFIEX_BSS_ROLE_UAP; -+ priv->bss_type = MWIFIEX_BSS_TYPE_UAP; - break; - default: - mwifiex_dbg(adapter, ERROR, -@@ -1233,29 +1237,15 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy, - break; - case NL80211_IFTYPE_P2P_CLIENT: - case NL80211_IFTYPE_P2P_GO: -+ if (mwifiex_cfg80211_deinit_p2p(priv)) -+ return -EFAULT; -+ - switch (type) { -- case NL80211_IFTYPE_STATION: -- if (mwifiex_cfg80211_deinit_p2p(priv)) -- return -EFAULT; -- priv->adapter->curr_iface_comb.p2p_intf--; -- priv->adapter->curr_iface_comb.sta_intf++; -- dev->ieee80211_ptr->iftype = type; -- if (mwifiex_deinit_priv_params(priv)) -- return -1; -- if (mwifiex_init_new_priv_params(priv, dev, type)) -- return -1; -- if (mwifiex_sta_init_cmd(priv, false, false)) -- return -1; -- break; - case NL80211_IFTYPE_ADHOC: -- if (mwifiex_cfg80211_deinit_p2p(priv)) -- return -EFAULT; -+ case NL80211_IFTYPE_STATION: - return mwifiex_change_vif_to_sta_adhoc(dev, curr_iftype, - type, params); -- break; - case NL80211_IFTYPE_AP: -- if (mwifiex_cfg80211_deinit_p2p(priv)) -- return -EFAULT; - return mwifiex_change_vif_to_ap(dev, curr_iftype, type, - params); - case NL80211_IFTYPE_UNSPECIFIED: -diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c -index bc46a0aa06eb7..b316e34917958 100644 ---- a/drivers/net/wireless/marvell/mwifiex/pcie.c -+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c -@@ -1326,6 +1326,14 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb, - ret = -1; - goto done_unmap; - } -+ -+ /* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card -+ * seems to crash randomly after setting the TX ring write pointer when -+ * ASPM powersaving is enabled. A workaround seems to be keeping the bus -+ * busy by reading a random register afterwards. -+ */ -+ mwifiex_read_reg(adapter, PCI_VENDOR_ID, &rx_val); -+ - if ((mwifiex_pcie_txbd_not_full(card)) && - tx_param->next_pkt_len) { - /* have more packets and TxBD still can hold more */ -diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c -index 528107d70c1cb..cb8a9ad40cfe9 100644 ---- a/drivers/net/wireless/marvell/mwifiex/usb.c -+++ b/drivers/net/wireless/marvell/mwifiex/usb.c -@@ -505,6 +505,22 @@ static int mwifiex_usb_probe(struct usb_interface *intf, - } - } - -+ switch (card->usb_boot_state) { -+ case USB8XXX_FW_DNLD: -+ /* Reject broken descriptors. */ -+ if (!card->rx_cmd_ep || !card->tx_cmd_ep) -+ return -ENODEV; -+ if (card->bulk_out_maxpktsize == 0) -+ return -ENODEV; -+ break; -+ case USB8XXX_FW_READY: -+ /* Assume the driver can handle missing endpoints for now. */ -+ break; -+ default: -+ WARN_ON(1); -+ return -ENODEV; -+ } -+ - usb_set_intfdata(intf, card); - - ret = mwifiex_add_card(card, &card->fw_done, &usb_ops, -diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c -index 1b76b24191866..14ac2384218df 100644 ---- a/drivers/net/wireless/marvell/mwl8k.c -+++ b/drivers/net/wireless/marvell/mwl8k.c -@@ -5796,8 +5796,8 @@ static void mwl8k_fw_state_machine(const struct firmware *fw, void *context) - fail: - priv->fw_state = FW_STATE_ERROR; - complete(&priv->firmware_loading_complete); -- device_release_driver(&priv->pdev->dev); - mwl8k_release_firmware(priv); -+ device_release_driver(&priv->pdev->dev); - } - - #define MAX_RESTART_ATTEMPTS 1 -diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c -index abacb4ea7179d..5c12cd7fce940 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c -+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c -@@ -154,7 +154,7 @@ void mt76x02_mac_wcid_set_drop(struct mt76x02_dev *dev, u8 idx, bool drop) - mt76_wr(dev, MT_WCID_DROP(idx), (val & ~bit) | (bit * drop)); - } - --static __le16 -+static u16 - mt76x02_mac_tx_rate_val(struct mt76x02_dev *dev, - const struct ieee80211_tx_rate *rate, u8 *nss_val) - { -@@ -200,14 +200,14 @@ mt76x02_mac_tx_rate_val(struct mt76x02_dev *dev, - rateval |= MT_RXWI_RATE_SGI; - - *nss_val = nss; -- return cpu_to_le16(rateval); -+ return rateval; - } - - void mt76x02_mac_wcid_set_rate(struct mt76x02_dev *dev, struct mt76_wcid *wcid, - const struct ieee80211_tx_rate *rate) - { - s8 max_txpwr_adj = mt76x02_tx_get_max_txpwr_adj(dev, rate); -- __le16 rateval; -+ u16 rateval; - u32 tx_info; - s8 nss; - -@@ -320,7 +320,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi, - struct ieee80211_key_conf *key = info->control.hw_key; - u32 wcid_tx_info; - u16 rate_ht_mask = FIELD_PREP(MT_RXWI_RATE_PHY, BIT(1) | BIT(2)); -- u16 txwi_flags = 0; -+ u16 txwi_flags = 0, rateval; - u8 nss; - s8 txpwr_adj, max_txpwr_adj; - u8 ccmp_pn[8], nstreams = dev->mt76.chainmask & 0xf; -@@ -356,14 +356,15 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi, - - if (wcid && (rate->idx < 0 || !rate->count)) { - wcid_tx_info = wcid->tx_info; -- txwi->rate = FIELD_GET(MT_WCID_TX_INFO_RATE, wcid_tx_info); -+ rateval = FIELD_GET(MT_WCID_TX_INFO_RATE, wcid_tx_info); - max_txpwr_adj = FIELD_GET(MT_WCID_TX_INFO_TXPWR_ADJ, - wcid_tx_info); - nss = FIELD_GET(MT_WCID_TX_INFO_NSS, wcid_tx_info); - } else { -- txwi->rate = mt76x02_mac_tx_rate_val(dev, rate, &nss); -+ rateval = mt76x02_mac_tx_rate_val(dev, rate, &nss); - max_txpwr_adj = mt76x02_tx_get_max_txpwr_adj(dev, rate); - } -+ txwi->rate = cpu_to_le16(rateval); - - txpwr_adj = mt76x02_tx_get_txpwr_adj(dev, dev->mt76.txpower_conf, - max_txpwr_adj); -diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c -index b2616d61b66d8..843e3f41a2bc3 100644 ---- a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c -+++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c -@@ -28,7 +28,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv, - usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), - RTL8187_REQ_GET_REG, RTL8187_REQT_READ, - (unsigned long)addr, idx & 0x03, -- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); -+ &priv->io_dmabuf->bits8, sizeof(val), 500); - - val = priv->io_dmabuf->bits8; - mutex_unlock(&priv->io_mutex); -@@ -45,7 +45,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv, - usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), - RTL8187_REQ_GET_REG, RTL8187_REQT_READ, - (unsigned long)addr, idx & 0x03, -- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); -+ &priv->io_dmabuf->bits16, sizeof(val), 500); - - val = priv->io_dmabuf->bits16; - mutex_unlock(&priv->io_mutex); -@@ -62,7 +62,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv, - usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0), - RTL8187_REQ_GET_REG, RTL8187_REQT_READ, - (unsigned long)addr, idx & 0x03, -- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); -+ &priv->io_dmabuf->bits32, sizeof(val), 500); - - val = priv->io_dmabuf->bits32; - mutex_unlock(&priv->io_mutex); -@@ -79,7 +79,7 @@ void rtl818x_iowrite8_idx(struct rtl8187_priv *priv, - usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), - RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, - (unsigned long)addr, idx & 0x03, -- &priv->io_dmabuf->bits8, sizeof(val), HZ / 2); -+ &priv->io_dmabuf->bits8, sizeof(val), 500); - - mutex_unlock(&priv->io_mutex); - } -@@ -93,7 +93,7 @@ void rtl818x_iowrite16_idx(struct rtl8187_priv *priv, - usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), - RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, - (unsigned long)addr, idx & 0x03, -- &priv->io_dmabuf->bits16, sizeof(val), HZ / 2); -+ &priv->io_dmabuf->bits16, sizeof(val), 500); - - mutex_unlock(&priv->io_mutex); - } -@@ -107,7 +107,7 @@ void rtl818x_iowrite32_idx(struct rtl8187_priv *priv, - usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), - RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, - (unsigned long)addr, idx & 0x03, -- &priv->io_dmabuf->bits32, sizeof(val), HZ / 2); -+ &priv->io_dmabuf->bits32, sizeof(val), 500); - - mutex_unlock(&priv->io_mutex); - } -@@ -183,7 +183,7 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data) - usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0), - RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE, - addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data), -- HZ / 2); -+ 500); - - mutex_unlock(&priv->io_mutex); - -diff --git a/drivers/net/wireless/rsi/rsi_91x_core.c b/drivers/net/wireless/rsi/rsi_91x_core.c -index 3644d7d994638..c6c29034b2ead 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_core.c -+++ b/drivers/net/wireless/rsi/rsi_91x_core.c -@@ -400,6 +400,8 @@ void rsi_core_xmit(struct rsi_common *common, struct sk_buff *skb) - - info = IEEE80211_SKB_CB(skb); - tx_params = (struct skb_info *)info->driver_data; -+ /* info->driver_data and info->control part of union so make copy */ -+ tx_params->have_key = !!info->control.hw_key; - wh = (struct ieee80211_hdr *)&skb->data[0]; - tx_params->sta_id = 0; - -diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c -index 5e6c5d13319d5..7d0b44fd56901 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_hal.c -+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c -@@ -203,7 +203,7 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb) - wh->frame_control |= cpu_to_le16(RSI_SET_PS_ENABLE); - - if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) && -- info->control.hw_key) { -+ tx_params->have_key) { - if (rsi_is_cipher_wep(common)) - ieee80211_size += 4; - else -@@ -214,15 +214,17 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb) - RSI_WIFI_DATA_Q); - data_desc->header_len = ieee80211_size; - -- if (common->min_rate != RSI_RATE_AUTO) { -+ if (common->rate_config[common->band].fixed_enabled) { - /* Send fixed rate */ -+ u16 fixed_rate = common->rate_config[common->band].fixed_hw_rate; -+ - data_desc->frame_info = cpu_to_le16(RATE_INFO_ENABLE); -- data_desc->rate_info = cpu_to_le16(common->min_rate); -+ data_desc->rate_info = cpu_to_le16(fixed_rate); - - if (conf_is_ht40(&common->priv->hw->conf)) - data_desc->bbp_info = cpu_to_le16(FULL40M_ENABLE); - -- if ((common->vif_info[0].sgi) && (common->min_rate & 0x100)) { -+ if (common->vif_info[0].sgi && (fixed_rate & 0x100)) { - /* Only MCS rates */ - data_desc->rate_info |= - cpu_to_le16(ENABLE_SHORTGI_RATE); -diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c -index ca1e609f637e4..1279339a4b59b 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c -+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c -@@ -510,7 +510,6 @@ static int rsi_mac80211_add_interface(struct ieee80211_hw *hw, - if ((vif->type == NL80211_IFTYPE_AP) || - (vif->type == NL80211_IFTYPE_P2P_GO)) { - rsi_send_rx_filter_frame(common, DISALLOW_BEACONS); -- common->min_rate = RSI_RATE_AUTO; - for (i = 0; i < common->max_stations; i++) - common->stations[i].sta = NULL; - } -@@ -1211,20 +1210,32 @@ static int rsi_mac80211_set_rate_mask(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, - const struct cfg80211_bitrate_mask *mask) - { -+ const unsigned int mcs_offset = ARRAY_SIZE(rsi_rates); - struct rsi_hw *adapter = hw->priv; - struct rsi_common *common = adapter->priv; -- enum nl80211_band band = hw->conf.chandef.chan->band; -+ int i; - - mutex_lock(&common->mutex); -- common->fixedrate_mask[band] = 0; - -- if (mask->control[band].legacy == 0xfff) { -- common->fixedrate_mask[band] = -- (mask->control[band].ht_mcs[0] << 12); -- } else { -- common->fixedrate_mask[band] = -- mask->control[band].legacy; -+ for (i = 0; i < ARRAY_SIZE(common->rate_config); i++) { -+ struct rsi_rate_config *cfg = &common->rate_config[i]; -+ u32 bm; -+ -+ bm = mask->control[i].legacy | (mask->control[i].ht_mcs[0] << mcs_offset); -+ if (hweight32(bm) == 1) { /* single rate */ -+ int rate_index = ffs(bm) - 1; -+ -+ if (rate_index < mcs_offset) -+ cfg->fixed_hw_rate = rsi_rates[rate_index].hw_value; -+ else -+ cfg->fixed_hw_rate = rsi_mcsrates[rate_index - mcs_offset]; -+ cfg->fixed_enabled = true; -+ } else { -+ cfg->configured_mask = bm; -+ cfg->fixed_enabled = false; -+ } - } -+ - mutex_unlock(&common->mutex); - - return 0; -@@ -1360,46 +1371,6 @@ void rsi_indicate_pkt_to_os(struct rsi_common *common, - ieee80211_rx_irqsafe(hw, skb); - } - --static void rsi_set_min_rate(struct ieee80211_hw *hw, -- struct ieee80211_sta *sta, -- struct rsi_common *common) --{ -- u8 band = hw->conf.chandef.chan->band; -- u8 ii; -- u32 rate_bitmap; -- bool matched = false; -- -- common->bitrate_mask[band] = sta->supp_rates[band]; -- -- rate_bitmap = (common->fixedrate_mask[band] & sta->supp_rates[band]); -- -- if (rate_bitmap & 0xfff) { -- /* Find out the min rate */ -- for (ii = 0; ii < ARRAY_SIZE(rsi_rates); ii++) { -- if (rate_bitmap & BIT(ii)) { -- common->min_rate = rsi_rates[ii].hw_value; -- matched = true; -- break; -- } -- } -- } -- -- common->vif_info[0].is_ht = sta->ht_cap.ht_supported; -- -- if ((common->vif_info[0].is_ht) && (rate_bitmap >> 12)) { -- for (ii = 0; ii < ARRAY_SIZE(rsi_mcsrates); ii++) { -- if ((rate_bitmap >> 12) & BIT(ii)) { -- common->min_rate = rsi_mcsrates[ii]; -- matched = true; -- break; -- } -- } -- } -- -- if (!matched) -- common->min_rate = 0xffff; --} -- - /** - * rsi_mac80211_sta_add() - This function notifies driver about a peer getting - * connected. -@@ -1498,9 +1469,9 @@ static int rsi_mac80211_sta_add(struct ieee80211_hw *hw, - - if ((vif->type == NL80211_IFTYPE_STATION) || - (vif->type == NL80211_IFTYPE_P2P_CLIENT)) { -- rsi_set_min_rate(hw, sta, common); -+ common->bitrate_mask[common->band] = sta->supp_rates[common->band]; -+ common->vif_info[0].is_ht = sta->ht_cap.ht_supported; - if (sta->ht_cap.ht_supported) { -- common->vif_info[0].is_ht = true; - common->bitrate_mask[NL80211_BAND_2GHZ] = - sta->supp_rates[NL80211_BAND_2GHZ]; - if ((sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) || -@@ -1574,7 +1545,6 @@ static int rsi_mac80211_sta_remove(struct ieee80211_hw *hw, - bss->qos = sta->wme; - common->bitrate_mask[NL80211_BAND_2GHZ] = 0; - common->bitrate_mask[NL80211_BAND_5GHZ] = 0; -- common->min_rate = 0xffff; - common->vif_info[0].is_ht = false; - common->vif_info[0].sgi = false; - common->vif_info[0].seq_start = 0; -diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c -index 29d83049c5f56..441fda71f6289 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_main.c -+++ b/drivers/net/wireless/rsi/rsi_91x_main.c -@@ -210,9 +210,10 @@ int rsi_read_pkt(struct rsi_common *common, u8 *rx_pkt, s32 rcv_pkt_len) - bt_pkt_type = frame_desc[offset + BT_RX_PKT_TYPE_OFST]; - if (bt_pkt_type == BT_CARD_READY_IND) { - rsi_dbg(INFO_ZONE, "BT Card ready recvd\n"); -- if (rsi_bt_ops.attach(common, &g_proto_ops)) -- rsi_dbg(ERR_ZONE, -- "Failed to attach BT module\n"); -+ if (common->fsm_state == FSM_MAC_INIT_DONE) -+ rsi_attach_bt(common); -+ else -+ common->bt_defer_attach = true; - } else { - if (common->bt_adapter) - rsi_bt_ops.recv_pkt(common->bt_adapter, -@@ -277,6 +278,15 @@ void rsi_set_bt_context(void *priv, void *bt_context) - } - #endif - -+void rsi_attach_bt(struct rsi_common *common) -+{ -+#ifdef CONFIG_RSI_COEX -+ if (rsi_bt_ops.attach(common, &g_proto_ops)) -+ rsi_dbg(ERR_ZONE, -+ "Failed to attach BT module\n"); -+#endif -+} -+ - /** - * rsi_91x_init() - This function initializes os interface operations. - * @void: Void. -@@ -358,6 +368,7 @@ struct rsi_hw *rsi_91x_init(u16 oper_mode) - if (common->coex_mode > 1) { - if (rsi_coex_attach(common)) { - rsi_dbg(ERR_ZONE, "Failed to init coex module\n"); -+ rsi_kill_thread(&common->tx_thread); - goto err; - } - } -diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c -index ed67f65986775..0c0e4c08be8aa 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c -+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c -@@ -276,7 +276,7 @@ static void rsi_set_default_parameters(struct rsi_common *common) - common->channel_width = BW_20MHZ; - common->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD; - common->channel = 1; -- common->min_rate = 0xffff; -+ memset(&common->rate_config, 0, sizeof(common->rate_config)); - common->fsm_state = FSM_CARD_NOT_READY; - common->iface_down = true; - common->endpoint = EP_2GHZ_20MHZ; -@@ -1304,7 +1304,7 @@ static int rsi_send_auto_rate_request(struct rsi_common *common, - u8 band = hw->conf.chandef.chan->band; - u8 num_supported_rates = 0; - u8 rate_table_offset, rate_offset = 0; -- u32 rate_bitmap; -+ u32 rate_bitmap, configured_rates; - u16 *selected_rates, min_rate; - bool is_ht = false, is_sgi = false; - u16 frame_len = sizeof(struct rsi_auto_rate); -@@ -1354,6 +1354,10 @@ static int rsi_send_auto_rate_request(struct rsi_common *common, - is_sgi = true; - } - -+ /* Limit to any rates administratively configured by cfg80211 */ -+ configured_rates = common->rate_config[band].configured_mask ?: 0xffffffff; -+ rate_bitmap &= configured_rates; -+ - if (band == NL80211_BAND_2GHZ) { - if ((rate_bitmap == 0) && (is_ht)) - min_rate = RSI_RATE_MCS0; -@@ -1379,10 +1383,13 @@ static int rsi_send_auto_rate_request(struct rsi_common *common, - num_supported_rates = jj; - - if (is_ht) { -- for (ii = 0; ii < ARRAY_SIZE(mcs); ii++) -- selected_rates[jj++] = mcs[ii]; -- num_supported_rates += ARRAY_SIZE(mcs); -- rate_offset += ARRAY_SIZE(mcs); -+ for (ii = 0; ii < ARRAY_SIZE(mcs); ii++) { -+ if (configured_rates & BIT(ii + ARRAY_SIZE(rsi_rates))) { -+ selected_rates[jj++] = mcs[ii]; -+ num_supported_rates++; -+ rate_offset++; -+ } -+ } - } - - sort(selected_rates, jj, sizeof(u16), &rsi_compare, NULL); -@@ -1467,7 +1474,7 @@ void rsi_inform_bss_status(struct rsi_common *common, - qos_enable, - aid, sta_id, - vif); -- if (common->min_rate == 0xffff) -+ if (!common->rate_config[common->band].fixed_enabled) - rsi_send_auto_rate_request(common, sta, sta_id, vif); - if (opmode == RSI_OPMODE_STA && - !(assoc_cap & WLAN_CAPABILITY_PRIVACY) && -@@ -2056,6 +2063,9 @@ static int rsi_handle_ta_confirm_type(struct rsi_common *common, - if (common->reinit_hw) { - complete(&common->wlan_init_completion); - } else { -+ if (common->bt_defer_attach) -+ rsi_attach_bt(common); -+ - return rsi_mac80211_attach(common); - } - } -diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c -index d51ec7104fb7c..4fe837090cdae 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_sdio.c -+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c -@@ -24,10 +24,7 @@ - /* Default operating mode is wlan STA + BT */ - static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL; - module_param(dev_oper_mode, ushort, 0444); --MODULE_PARM_DESC(dev_oper_mode, -- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n" -- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n" -- "6[AP + BT classic], 14[AP + BT classic + BT LE]"); -+MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC); - - /** - * rsi_sdio_set_cmd52_arg() - This function prepares cmd 52 read/write arg. -diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c -index 1e5a2a0cc6700..68ce3d2bc5357 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_usb.c -+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c -@@ -25,10 +25,7 @@ - /* Default operating mode is wlan STA + BT */ - static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL; - module_param(dev_oper_mode, ushort, 0444); --MODULE_PARM_DESC(dev_oper_mode, -- "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n" -- "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n" -- "6[AP + BT classic], 14[AP + BT classic + BT LE]"); -+MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC); - - static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t flags); - -diff --git a/drivers/net/wireless/rsi/rsi_hal.h b/drivers/net/wireless/rsi/rsi_hal.h -index 46e36df9e8e3c..a2fbec1cec4c3 100644 ---- a/drivers/net/wireless/rsi/rsi_hal.h -+++ b/drivers/net/wireless/rsi/rsi_hal.h -@@ -28,6 +28,17 @@ - #define DEV_OPMODE_AP_BT 6 - #define DEV_OPMODE_AP_BT_DUAL 14 - -+#define DEV_OPMODE_PARAM_DESC \ -+ __stringify(DEV_OPMODE_WIFI_ALONE) "[Wi-Fi alone], " \ -+ __stringify(DEV_OPMODE_BT_ALONE) "[BT classic alone], " \ -+ __stringify(DEV_OPMODE_BT_LE_ALONE) "[BT LE alone], " \ -+ __stringify(DEV_OPMODE_BT_DUAL) "[BT classic + BT LE alone], " \ -+ __stringify(DEV_OPMODE_STA_BT) "[Wi-Fi STA + BT classic], " \ -+ __stringify(DEV_OPMODE_STA_BT_LE) "[Wi-Fi STA + BT LE], " \ -+ __stringify(DEV_OPMODE_STA_BT_DUAL) "[Wi-Fi STA + BT classic + BT LE], " \ -+ __stringify(DEV_OPMODE_AP_BT) "[Wi-Fi AP + BT classic], " \ -+ __stringify(DEV_OPMODE_AP_BT_DUAL) "[Wi-Fi AP + BT classic + BT LE]" -+ - #define FLASH_WRITE_CHUNK_SIZE (4 * 1024) - #define FLASH_SECTOR_SIZE (4 * 1024) - -diff --git a/drivers/net/wireless/rsi/rsi_main.h b/drivers/net/wireless/rsi/rsi_main.h -index b3e25bc28682c..de595025c0197 100644 ---- a/drivers/net/wireless/rsi/rsi_main.h -+++ b/drivers/net/wireless/rsi/rsi_main.h -@@ -61,6 +61,7 @@ enum RSI_FSM_STATES { - extern u32 rsi_zone_enabled; - extern __printf(2, 3) void rsi_dbg(u32 zone, const char *fmt, ...); - -+#define RSI_MAX_BANDS 2 - #define RSI_MAX_VIFS 3 - #define NUM_EDCA_QUEUES 4 - #define IEEE80211_ADDR_LEN 6 -@@ -139,6 +140,7 @@ struct skb_info { - u8 internal_hdr_size; - struct ieee80211_vif *vif; - u8 vap_id; -+ bool have_key; - }; - - enum edca_queue { -@@ -229,6 +231,12 @@ struct rsi_9116_features { - u32 ps_options; - }; - -+struct rsi_rate_config { -+ u32 configured_mask; /* configured by mac80211 bits 0-11=legacy 12+ mcs */ -+ u16 fixed_hw_rate; -+ bool fixed_enabled; -+}; -+ - struct rsi_common { - struct rsi_hw *priv; - struct vif_priv vif_info[RSI_MAX_VIFS]; -@@ -254,8 +262,8 @@ struct rsi_common { - u8 channel_width; - - u16 rts_threshold; -- u16 bitrate_mask[2]; -- u32 fixedrate_mask[2]; -+ u32 bitrate_mask[RSI_MAX_BANDS]; -+ struct rsi_rate_config rate_config[RSI_MAX_BANDS]; - - u8 rf_reset; - struct transmit_q_stats tx_stats; -@@ -276,7 +284,6 @@ struct rsi_common { - u8 mac_id; - u8 radio_id; - u16 rate_pwr[20]; -- u16 min_rate; - - /* WMM algo related */ - u8 selected_qnum; -@@ -320,6 +327,7 @@ struct rsi_common { - struct ieee80211_vif *roc_vif; - - bool eapol4_confirm; -+ bool bt_defer_attach; - void *bt_adapter; - - struct cfg80211_scan_request *hwscan; -@@ -401,5 +409,6 @@ struct rsi_host_intf_ops { - - enum rsi_host_intf rsi_get_host_intf(void *priv); - void rsi_set_bt_context(void *priv, void *bt_context); -+void rsi_attach_bt(struct rsi_common *common); - - #endif -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 88280057e0321..7d389c2cc9026 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -1439,6 +1439,10 @@ static int netfront_resume(struct xenbus_device *dev) - - dev_dbg(&dev->dev, "%s\n", dev->nodename); - -+ netif_tx_lock_bh(info->netdev); -+ netif_device_detach(info->netdev); -+ netif_tx_unlock_bh(info->netdev); -+ - xennet_disconnect_backend(info); - return 0; - } -@@ -1987,6 +1991,10 @@ static int xennet_connect(struct net_device *dev) - * domain a kick because we've probably just requeued some - * packets. - */ -+ netif_tx_lock_bh(np->netdev); -+ netif_device_attach(np->netdev); -+ netif_tx_unlock_bh(np->netdev); -+ - netif_carrier_on(np->netdev); - for (j = 0; j < num_queues; ++j) { - queue = &np->queues[j]; -diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c -index 3ea38ce86cc9f..807b7b37d9dce 100644 ---- a/drivers/nfc/pn533/pn533.c -+++ b/drivers/nfc/pn533/pn533.c -@@ -2072,7 +2072,7 @@ static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb) - frag = pn533_alloc_skb(dev, frag_size); - if (!frag) { - skb_queue_purge(&dev->fragment_skb); -- break; -+ return -ENOMEM; - } - - if (!dev->tgt_mode) { -@@ -2143,7 +2143,7 @@ static int pn533_transceive(struct nfc_dev *nfc_dev, - /* jumbo frame ? */ - if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) { - rc = pn533_fill_fragment_skbs(dev, skb); -- if (rc <= 0) -+ if (rc < 0) - goto error; - - skb = skb_dequeue(&dev->fragment_skb); -@@ -2215,7 +2215,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb) - /* let's split in multiple chunks if size's too big */ - if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) { - rc = pn533_fill_fragment_skbs(dev, skb); -- if (rc <= 0) -+ if (rc < 0) - goto error; - - /* get the first skb */ -diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c -index 016a67fd41989..9f01af2f03e68 100644 ---- a/drivers/nvme/host/multipath.c -+++ b/drivers/nvme/host/multipath.c -@@ -156,13 +156,12 @@ void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl) - { - struct nvme_ns *ns; - -- mutex_lock(&ctrl->scan_lock); - down_read(&ctrl->namespaces_rwsem); -- list_for_each_entry(ns, &ctrl->namespaces, list) -- if (nvme_mpath_clear_current_path(ns)) -- kblockd_schedule_work(&ns->head->requeue_work); -+ list_for_each_entry(ns, &ctrl->namespaces, list) { -+ nvme_mpath_clear_current_path(ns); -+ kblockd_schedule_work(&ns->head->requeue_work); -+ } - up_read(&ctrl->namespaces_rwsem); -- mutex_unlock(&ctrl->scan_lock); - } - - static bool nvme_path_is_disabled(struct nvme_ns *ns) -diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c -index dcc3d2393605e..08a23bb4b8b57 100644 ---- a/drivers/nvme/host/rdma.c -+++ b/drivers/nvme/host/rdma.c -@@ -1019,11 +1019,13 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) - return ret; - - if (ctrl->ctrl.icdoff) { -+ ret = -EOPNOTSUPP; - dev_err(ctrl->ctrl.device, "icdoff is not supported!\n"); - goto destroy_admin; - } - - if (!(ctrl->ctrl.sgls & (1 << 2))) { -+ ret = -EOPNOTSUPP; - dev_err(ctrl->ctrl.device, - "Mandatory keyed sgls are not supported!\n"); - goto destroy_admin; -diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c -index 98613a45bd3b4..baf8a3e4ed12a 100644 ---- a/drivers/nvme/target/configfs.c -+++ b/drivers/nvme/target/configfs.c -@@ -1148,6 +1148,8 @@ static void nvmet_port_release(struct config_item *item) - { - struct nvmet_port *port = to_nvmet_port(item); - -+ /* Let inflight controllers teardown complete */ -+ flush_scheduled_work(); - list_del(&port->global_entry); - - kfree(port->ana_state); -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index 2f4e512bd449f..fac1985870765 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -1020,7 +1020,7 @@ recv: - } - - if (queue->hdr_digest && -- nvmet_tcp_verify_hdgst(queue, &queue->pdu, queue->offset)) { -+ nvmet_tcp_verify_hdgst(queue, &queue->pdu, hdr->hlen)) { - nvmet_tcp_fatal_error(queue); /* fatal */ - return -EPROTO; - } -@@ -1343,6 +1343,7 @@ static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue) - - static void nvmet_tcp_release_queue_work(struct work_struct *w) - { -+ struct page *page; - struct nvmet_tcp_queue *queue = - container_of(w, struct nvmet_tcp_queue, release_work); - -@@ -1362,6 +1363,8 @@ static void nvmet_tcp_release_queue_work(struct work_struct *w) - nvmet_tcp_free_crypto(queue); - ida_simple_remove(&nvmet_tcp_queue_ida, queue->idx); - -+ page = virt_to_head_page(queue->pf_cache.va); -+ __page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias); - kfree(queue); - } - -@@ -1664,6 +1667,17 @@ err_port: - return ret; - } - -+static void nvmet_tcp_destroy_port_queues(struct nvmet_tcp_port *port) -+{ -+ struct nvmet_tcp_queue *queue; -+ -+ mutex_lock(&nvmet_tcp_queue_mutex); -+ list_for_each_entry(queue, &nvmet_tcp_queue_list, queue_list) -+ if (queue->port == port) -+ kernel_sock_shutdown(queue->sock, SHUT_RDWR); -+ mutex_unlock(&nvmet_tcp_queue_mutex); -+} -+ - static void nvmet_tcp_remove_port(struct nvmet_port *nport) - { - struct nvmet_tcp_port *port = nport->priv; -@@ -1673,6 +1687,11 @@ static void nvmet_tcp_remove_port(struct nvmet_port *nport) - port->sock->sk->sk_user_data = NULL; - write_unlock_bh(&port->sock->sk->sk_callback_lock); - cancel_work_sync(&port->accept_work); -+ /* -+ * Destroy the remaining queues, which are not belong to any -+ * controller yet. -+ */ -+ nvmet_tcp_destroy_port_queues(port); - - sock_release(port->sock); - kfree(port); -diff --git a/drivers/opp/of.c b/drivers/opp/of.c -index 30cc407c8f93f..ba30694508153 100644 ---- a/drivers/opp/of.c -+++ b/drivers/opp/of.c -@@ -639,7 +639,7 @@ free_required_opps: - free_opp: - _opp_free(new_opp); - -- return ERR_PTR(ret); -+ return ret ? ERR_PTR(ret) : NULL; - } - - /* Initializes OPP tables based on new bindings */ -diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c -index 18753fd218a31..45794ba643d40 100644 ---- a/drivers/pci/controller/pci-aardvark.c -+++ b/drivers/pci/controller/pci-aardvark.c -@@ -108,26 +108,69 @@ - #define PCIE_ISR0_MSI_INT_PENDING BIT(24) - #define PCIE_ISR0_INTX_ASSERT(val) BIT(16 + (val)) - #define PCIE_ISR0_INTX_DEASSERT(val) BIT(20 + (val)) --#define PCIE_ISR0_ALL_MASK GENMASK(26, 0) -+#define PCIE_ISR0_ALL_MASK GENMASK(31, 0) - #define PCIE_ISR1_REG (CONTROL_BASE_ADDR + 0x48) - #define PCIE_ISR1_MASK_REG (CONTROL_BASE_ADDR + 0x4C) - #define PCIE_ISR1_POWER_STATE_CHANGE BIT(4) - #define PCIE_ISR1_FLUSH BIT(5) - #define PCIE_ISR1_INTX_ASSERT(val) BIT(8 + (val)) --#define PCIE_ISR1_ALL_MASK GENMASK(11, 4) -+#define PCIE_ISR1_ALL_MASK GENMASK(31, 0) - #define PCIE_MSI_ADDR_LOW_REG (CONTROL_BASE_ADDR + 0x50) - #define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54) - #define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58) - #define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C) - #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C) -+#define PCIE_MSI_DATA_MASK GENMASK(15, 0) - - /* LMI registers base address and register offsets */ - #define LMI_BASE_ADDR 0x6000 - #define CFG_REG (LMI_BASE_ADDR + 0x0) - #define LTSSM_SHIFT 24 - #define LTSSM_MASK 0x3f --#define LTSSM_L0 0x10 - #define RC_BAR_CONFIG 0x300 -+ -+/* LTSSM values in CFG_REG */ -+enum { -+ LTSSM_DETECT_QUIET = 0x0, -+ LTSSM_DETECT_ACTIVE = 0x1, -+ LTSSM_POLLING_ACTIVE = 0x2, -+ LTSSM_POLLING_COMPLIANCE = 0x3, -+ LTSSM_POLLING_CONFIGURATION = 0x4, -+ LTSSM_CONFIG_LINKWIDTH_START = 0x5, -+ LTSSM_CONFIG_LINKWIDTH_ACCEPT = 0x6, -+ LTSSM_CONFIG_LANENUM_ACCEPT = 0x7, -+ LTSSM_CONFIG_LANENUM_WAIT = 0x8, -+ LTSSM_CONFIG_COMPLETE = 0x9, -+ LTSSM_CONFIG_IDLE = 0xa, -+ LTSSM_RECOVERY_RCVR_LOCK = 0xb, -+ LTSSM_RECOVERY_SPEED = 0xc, -+ LTSSM_RECOVERY_RCVR_CFG = 0xd, -+ LTSSM_RECOVERY_IDLE = 0xe, -+ LTSSM_L0 = 0x10, -+ LTSSM_RX_L0S_ENTRY = 0x11, -+ LTSSM_RX_L0S_IDLE = 0x12, -+ LTSSM_RX_L0S_FTS = 0x13, -+ LTSSM_TX_L0S_ENTRY = 0x14, -+ LTSSM_TX_L0S_IDLE = 0x15, -+ LTSSM_TX_L0S_FTS = 0x16, -+ LTSSM_L1_ENTRY = 0x17, -+ LTSSM_L1_IDLE = 0x18, -+ LTSSM_L2_IDLE = 0x19, -+ LTSSM_L2_TRANSMIT_WAKE = 0x1a, -+ LTSSM_DISABLED = 0x20, -+ LTSSM_LOOPBACK_ENTRY_MASTER = 0x21, -+ LTSSM_LOOPBACK_ACTIVE_MASTER = 0x22, -+ LTSSM_LOOPBACK_EXIT_MASTER = 0x23, -+ LTSSM_LOOPBACK_ENTRY_SLAVE = 0x24, -+ LTSSM_LOOPBACK_ACTIVE_SLAVE = 0x25, -+ LTSSM_LOOPBACK_EXIT_SLAVE = 0x26, -+ LTSSM_HOT_RESET = 0x27, -+ LTSSM_RECOVERY_EQUALIZATION_PHASE0 = 0x28, -+ LTSSM_RECOVERY_EQUALIZATION_PHASE1 = 0x29, -+ LTSSM_RECOVERY_EQUALIZATION_PHASE2 = 0x2a, -+ LTSSM_RECOVERY_EQUALIZATION_PHASE3 = 0x2b, -+}; -+ - #define VENDOR_ID_REG (LMI_BASE_ADDR + 0x44) - - /* PCIe core controller registers */ -@@ -160,7 +203,7 @@ - #define PCIE_IRQ_MSI_INT2_DET BIT(21) - #define PCIE_IRQ_RC_DBELL_DET BIT(22) - #define PCIE_IRQ_EP_STATUS BIT(23) --#define PCIE_IRQ_ALL_MASK 0xfff0fb -+#define PCIE_IRQ_ALL_MASK GENMASK(31, 0) - #define PCIE_IRQ_ENABLE_INTS_MASK PCIE_IRQ_CORE_INT - - /* Transaction types */ -@@ -219,13 +262,49 @@ static inline u32 advk_readl(struct advk_pcie *pcie, u64 reg) - return readl(pcie->base + reg); - } - --static int advk_pcie_link_up(struct advk_pcie *pcie) -+static u8 advk_pcie_ltssm_state(struct advk_pcie *pcie) - { -- u32 val, ltssm_state; -+ u32 val; -+ u8 ltssm_state; - - val = advk_readl(pcie, CFG_REG); - ltssm_state = (val >> LTSSM_SHIFT) & LTSSM_MASK; -- return ltssm_state >= LTSSM_L0; -+ return ltssm_state; -+} -+ -+static inline bool advk_pcie_link_up(struct advk_pcie *pcie) -+{ -+ /* check if LTSSM is in normal operation - some L* state */ -+ u8 ltssm_state = advk_pcie_ltssm_state(pcie); -+ return ltssm_state >= LTSSM_L0 && ltssm_state < LTSSM_DISABLED; -+} -+ -+static inline bool advk_pcie_link_active(struct advk_pcie *pcie) -+{ -+ /* -+ * According to PCIe Base specification 3.0, Table 4-14: Link -+ * Status Mapped to the LTSSM, and 4.2.6.3.6 Configuration.Idle -+ * is Link Up mapped to LTSSM Configuration.Idle, Recovery, L0, -+ * L0s, L1 and L2 states. And according to 3.2.1. Data Link -+ * Control and Management State Machine Rules is DL Up status -+ * reported in DL Active state. -+ */ -+ u8 ltssm_state = advk_pcie_ltssm_state(pcie); -+ return ltssm_state >= LTSSM_CONFIG_IDLE && ltssm_state < LTSSM_DISABLED; -+} -+ -+static inline bool advk_pcie_link_training(struct advk_pcie *pcie) -+{ -+ /* -+ * According to PCIe Base specification 3.0, Table 4-14: Link -+ * Status Mapped to the LTSSM is Link Training mapped to LTSSM -+ * Configuration and Recovery states. -+ */ -+ u8 ltssm_state = advk_pcie_ltssm_state(pcie); -+ return ((ltssm_state >= LTSSM_CONFIG_LINKWIDTH_START && -+ ltssm_state < LTSSM_L0) || -+ (ltssm_state >= LTSSM_RECOVERY_EQUALIZATION_PHASE0 && -+ ltssm_state <= LTSSM_RECOVERY_EQUALIZATION_PHASE3)); - } - - static int advk_pcie_wait_for_link(struct advk_pcie *pcie) -@@ -252,7 +331,7 @@ static void advk_pcie_wait_for_retrain(struct advk_pcie *pcie) - size_t retries; - - for (retries = 0; retries < RETRAIN_WAIT_MAX_RETRIES; ++retries) { -- if (!advk_pcie_link_up(pcie)) -+ if (advk_pcie_link_training(pcie)) - break; - udelay(RETRAIN_WAIT_USLEEP_US); - } -@@ -460,7 +539,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u3 - else - str_posted = "Posted"; - -- dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n", -+ dev_dbg(dev, "%s PIO Response Status: %s, %#x @ %#x\n", - str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS)); - - return -EFAULT; -@@ -501,6 +580,7 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, - case PCI_EXP_RTCTL: { - u32 val = advk_readl(pcie, PCIE_ISR0_MASK_REG); - *value = (val & PCIE_MSG_PM_PME_MASK) ? 0 : PCI_EXP_RTCTL_PMEIE; -+ *value |= le16_to_cpu(bridge->pcie_conf.rootctl) & PCI_EXP_RTCTL_CRSSVE; - *value |= PCI_EXP_RTCAP_CRSVIS << 16; - return PCI_BRIDGE_EMUL_HANDLED; - } -@@ -512,12 +592,26 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, - return PCI_BRIDGE_EMUL_HANDLED; - } - -+ case PCI_EXP_LNKCAP: { -+ u32 val = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg); -+ /* -+ * PCI_EXP_LNKCAP_DLLLARC bit is hardwired in aardvark HW to 0. -+ * But support for PCI_EXP_LNKSTA_DLLLA is emulated via ltssm -+ * state so explicitly enable PCI_EXP_LNKCAP_DLLLARC flag. -+ */ -+ val |= PCI_EXP_LNKCAP_DLLLARC; -+ *value = val; -+ return PCI_BRIDGE_EMUL_HANDLED; -+ } -+ - case PCI_EXP_LNKCTL: { - /* u32 contains both PCI_EXP_LNKCTL and PCI_EXP_LNKSTA */ - u32 val = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg) & - ~(PCI_EXP_LNKSTA_LT << 16); -- if (!advk_pcie_link_up(pcie)) -+ if (advk_pcie_link_training(pcie)) - val |= (PCI_EXP_LNKSTA_LT << 16); -+ if (advk_pcie_link_active(pcie)) -+ val |= (PCI_EXP_LNKSTA_DLLLA << 16); - *value = val; - return PCI_BRIDGE_EMUL_HANDLED; - } -@@ -525,7 +619,6 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, - case PCI_CAP_LIST_ID: - case PCI_EXP_DEVCAP: - case PCI_EXP_DEVCTL: -- case PCI_EXP_LNKCAP: - *value = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg); - return PCI_BRIDGE_EMUL_HANDLED; - default: -@@ -851,7 +944,7 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain, - domain->host_data, handle_simple_irq, - NULL, NULL); - -- return hwirq; -+ return 0; - } - - static void advk_msi_irq_domain_free(struct irq_domain *domain, -@@ -1032,8 +1125,12 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie) - if (!(BIT(msi_idx) & msi_status)) - continue; - -+ /* -+ * msi_idx contains bits [4:0] of the msi_data and msi_data -+ * contains 16bit MSI interrupt number -+ */ - advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG); -- msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & 0xFF; -+ msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK; - generic_handle_irq(msi_data); - } - -@@ -1055,12 +1152,6 @@ static void advk_pcie_handle_int(struct advk_pcie *pcie) - isr1_mask = advk_readl(pcie, PCIE_ISR1_MASK_REG); - isr1_status = isr1_val & ((~isr1_mask) & PCIE_ISR1_ALL_MASK); - -- if (!isr0_status && !isr1_status) { -- advk_writel(pcie, isr0_val, PCIE_ISR0_REG); -- advk_writel(pcie, isr1_val, PCIE_ISR1_REG); -- return; -- } -- - /* Process MSI interrupts */ - if (isr0_status & PCIE_ISR0_MSI_INT_PENDING) - advk_pcie_handle_msi(pcie); -diff --git a/drivers/pci/pci-bridge-emul.c b/drivers/pci/pci-bridge-emul.c -index 06c800595e036..b3d63e319bb39 100644 ---- a/drivers/pci/pci-bridge-emul.c -+++ b/drivers/pci/pci-bridge-emul.c -@@ -432,8 +432,21 @@ int pci_bridge_emul_conf_write(struct pci_bridge_emul *bridge, int where, - /* Clear the W1C bits */ - new &= ~((value << shift) & (behavior[reg / 4].w1c & mask)); - -+ /* Save the new value with the cleared W1C bits into the cfgspace */ - cfgspace[reg / 4] = cpu_to_le32(new); - -+ /* -+ * Clear the W1C bits not specified by the write mask, so that the -+ * write_op() does not clear them. -+ */ -+ new &= ~(behavior[reg / 4].w1c & ~mask); -+ -+ /* -+ * Set the W1C bits specified by the write mask, so that write_op() -+ * knows about that they are to be cleared. -+ */ -+ new |= (value << shift) & (behavior[reg / 4].w1c & mask); -+ - if (write_op) - write_op(bridge, reg, old, new, mask); - -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 686298c0f6cda..fb7c5518447da 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -3584,6 +3584,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset); - DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset); -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003e, quirk_no_bus_reset); - - /* - * Root port on some Cavium CN8xxx chips do not successfully complete a bus -diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c -index bf94a52d30871..946e9b05f0ae6 100644 ---- a/drivers/phy/qualcomm/phy-qcom-qusb2.c -+++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c -@@ -432,7 +432,7 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy) - { - struct device *dev = &qphy->phy->dev; - const struct qusb2_phy_cfg *cfg = qphy->cfg; -- u8 *val; -+ u8 *val, hstx_trim; - - /* efuse register is optional */ - if (!qphy->cell) -@@ -446,7 +446,13 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy) - * set while configuring the phy. - */ - val = nvmem_cell_read(qphy->cell, NULL); -- if (IS_ERR(val) || !val[0]) { -+ if (IS_ERR(val)) { -+ dev_dbg(dev, "failed to read a valid hs-tx trim value\n"); -+ return; -+ } -+ hstx_trim = val[0]; -+ kfree(val); -+ if (!hstx_trim) { - dev_dbg(dev, "failed to read a valid hs-tx trim value\n"); - return; - } -@@ -454,12 +460,10 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy) - /* Fused TUNE1/2 value is the higher nibble only */ - if (cfg->update_tune1_with_efuse) - qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1], -- val[0] << HSTX_TRIM_SHIFT, -- HSTX_TRIM_MASK); -+ hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK); - else - qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2], -- val[0] << HSTX_TRIM_SHIFT, -- HSTX_TRIM_MASK); -+ hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK); - } - - static int qusb2_phy_set_mode(struct phy *phy, -diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c -index 6381745e3bb18..9ebeef2ac7b18 100644 ---- a/drivers/pinctrl/core.c -+++ b/drivers/pinctrl/core.c -@@ -2055,6 +2055,8 @@ int pinctrl_enable(struct pinctrl_dev *pctldev) - if (error) { - dev_err(pctldev->dev, "could not claim hogs: %i\n", - error); -+ pinctrl_free_pindescs(pctldev, pctldev->desc->pins, -+ pctldev->desc->npins); - mutex_destroy(&pctldev->mutex); - kfree(pctldev); - -diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c -index f027609fdab6d..3028d9f1ac59c 100644 ---- a/drivers/platform/x86/thinkpad_acpi.c -+++ b/drivers/platform/x86/thinkpad_acpi.c -@@ -9086,7 +9086,7 @@ static int fan_write_cmd_level(const char *cmd, int *rc) - - if (strlencmp(cmd, "level auto") == 0) - level = TP_EC_FAN_AUTO; -- else if ((strlencmp(cmd, "level disengaged") == 0) | -+ else if ((strlencmp(cmd, "level disengaged") == 0) || - (strlencmp(cmd, "level full-speed") == 0)) - level = TP_EC_FAN_FULLSPEED; - else if (sscanf(cmd, "level %d", &level) != 1) -diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c -index 59e9aa0f96436..cb029126a68c6 100644 ---- a/drivers/platform/x86/wmi.c -+++ b/drivers/platform/x86/wmi.c -@@ -353,7 +353,14 @@ static acpi_status __query_block(struct wmi_block *wblock, u8 instance, - * the WQxx method failed - we should disable collection anyway. - */ - if ((block->flags & ACPI_WMI_EXPENSIVE) && ACPI_SUCCESS(wc_status)) { -- status = acpi_execute_simple_method(handle, wc_method, 0); -+ /* -+ * Ignore whether this WCxx call succeeds or not since -+ * the previously executed WQxx method call might have -+ * succeeded, and returning the failing status code -+ * of this call would throw away the result of the WQxx -+ * call, potentially leaking memory. -+ */ -+ acpi_execute_simple_method(handle, wc_method, 0); - } - - return status; -diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c -index 2677c38a8a424..34229c1f43e31 100644 ---- a/drivers/power/supply/bq27xxx_battery_i2c.c -+++ b/drivers/power/supply/bq27xxx_battery_i2c.c -@@ -195,7 +195,8 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client, - dev_err(&client->dev, - "Unable to register IRQ %d error %d\n", - client->irq, ret); -- return ret; -+ bq27xxx_battery_teardown(di); -+ goto err_failed; - } - } - -diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c -index f8f8207a1895e..170639a1e734a 100644 ---- a/drivers/power/supply/max17042_battery.c -+++ b/drivers/power/supply/max17042_battery.c -@@ -312,7 +312,10 @@ static int max17042_get_property(struct power_supply *psy, - val->intval = data * 625 / 8; - break; - case POWER_SUPPLY_PROP_CAPACITY: -- ret = regmap_read(map, MAX17042_RepSOC, &data); -+ if (chip->pdata->enable_current_sense) -+ ret = regmap_read(map, MAX17042_RepSOC, &data); -+ else -+ ret = regmap_read(map, MAX17042_VFSOC, &data); - if (ret < 0) - return ret; - -@@ -834,7 +837,8 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off) - regmap_read(map, MAX17042_RepSOC, &soc); - soc >>= 8; - soc_tr = (soc + off) << 8; -- soc_tr |= (soc - off); -+ if (off < soc) -+ soc_tr |= soc - off; - regmap_write(map, MAX17042_SALRT_Th, soc_tr); - } - -diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c -index 6609f8cb8ca01..ef53891b88bbc 100644 ---- a/drivers/power/supply/rt5033_battery.c -+++ b/drivers/power/supply/rt5033_battery.c -@@ -60,7 +60,7 @@ static int rt5033_battery_get_watt_prop(struct i2c_client *client, - regmap_read(battery->regmap, regh, &msb); - regmap_read(battery->regmap, regl, &lsb); - -- ret = ((msb << 4) + (lsb >> 4)) * 1250 / 1000; -+ ret = ((msb << 4) + (lsb >> 4)) * 1250; - - return ret; - } -diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c -index 5276f8442f3c6..1e9f03a2ea1cc 100644 ---- a/drivers/regulator/s5m8767.c -+++ b/drivers/regulator/s5m8767.c -@@ -851,18 +851,15 @@ static int s5m8767_pmic_probe(struct platform_device *pdev) - /* DS4 GPIO */ - gpio_direction_output(pdata->buck_ds[2], 0x0); - -- if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs || -- pdata->buck4_gpiodvs) { -- regmap_update_bits(s5m8767->iodev->regmap_pmic, -- S5M8767_REG_BUCK2CTRL, 1 << 1, -- (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); -- regmap_update_bits(s5m8767->iodev->regmap_pmic, -- S5M8767_REG_BUCK3CTRL, 1 << 1, -- (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); -- regmap_update_bits(s5m8767->iodev->regmap_pmic, -- S5M8767_REG_BUCK4CTRL, 1 << 1, -- (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); -- } -+ regmap_update_bits(s5m8767->iodev->regmap_pmic, -+ S5M8767_REG_BUCK2CTRL, 1 << 1, -+ (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1)); -+ regmap_update_bits(s5m8767->iodev->regmap_pmic, -+ S5M8767_REG_BUCK3CTRL, 1 << 1, -+ (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1)); -+ regmap_update_bits(s5m8767->iodev->regmap_pmic, -+ S5M8767_REG_BUCK4CTRL, 1 << 1, -+ (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1)); - - /* Initialize GPIO DVS registers */ - for (i = 0; i < 8; i++) { -diff --git a/drivers/reset/reset-socfpga.c b/drivers/reset/reset-socfpga.c -index 96953992c2bb5..1c5236a69dc49 100644 ---- a/drivers/reset/reset-socfpga.c -+++ b/drivers/reset/reset-socfpga.c -@@ -86,3 +86,29 @@ void __init socfpga_reset_init(void) - for_each_matching_node(np, socfpga_early_reset_dt_ids) - a10_reset_init(np); - } -+ -+/* -+ * The early driver is problematic, because it doesn't register -+ * itself as a driver. This causes certain device links to prevent -+ * consumer devices from probing. The hacky solution is to register -+ * an empty driver, whose only job is to attach itself to the reset -+ * manager and call probe. -+ */ -+static const struct of_device_id socfpga_reset_dt_ids[] = { -+ { .compatible = "altr,rst-mgr", }, -+ { /* sentinel */ }, -+}; -+ -+static int reset_simple_probe(struct platform_device *pdev) -+{ -+ return 0; -+} -+ -+static struct platform_driver reset_socfpga_driver = { -+ .probe = reset_simple_probe, -+ .driver = { -+ .name = "socfpga-reset", -+ .of_match_table = socfpga_reset_dt_ids, -+ }, -+}; -+builtin_platform_driver(reset_socfpga_driver); -diff --git a/drivers/s390/char/tape_std.c b/drivers/s390/char/tape_std.c -index 1f5fab617b679..f7e75d9fedf61 100644 ---- a/drivers/s390/char/tape_std.c -+++ b/drivers/s390/char/tape_std.c -@@ -53,7 +53,6 @@ int - tape_std_assign(struct tape_device *device) - { - int rc; -- struct timer_list timeout; - struct tape_request *request; - - request = tape_alloc_request(2, 11); -@@ -70,7 +69,7 @@ tape_std_assign(struct tape_device *device) - * So we set up a timeout for this call. - */ - timer_setup(&request->timer, tape_std_assign_timeout, 0); -- mod_timer(&timeout, jiffies + 2 * HZ); -+ mod_timer(&request->timer, jiffies + msecs_to_jiffies(2000)); - - rc = tape_do_io_interruptible(device, request); - -diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c -index 7950ac59b1744..ad447437a27c5 100644 ---- a/drivers/s390/cio/css.c -+++ b/drivers/s390/cio/css.c -@@ -433,8 +433,8 @@ static ssize_t dev_busid_show(struct device *dev, - struct subchannel *sch = to_subchannel(dev); - struct pmcw *pmcw = &sch->schib.pmcw; - -- if ((pmcw->st == SUBCHANNEL_TYPE_IO || -- pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv) -+ if ((pmcw->st == SUBCHANNEL_TYPE_IO && pmcw->dnv) || -+ (pmcw->st == SUBCHANNEL_TYPE_MSG && pmcw->w)) - return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid, - pmcw->dev); - else -diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c -index ccecf6b9504e8..5a411595347b5 100644 ---- a/drivers/s390/cio/device_ops.c -+++ b/drivers/s390/cio/device_ops.c -@@ -717,13 +717,23 @@ EXPORT_SYMBOL_GPL(ccw_device_get_schid); - */ - void *ccw_device_dma_zalloc(struct ccw_device *cdev, size_t size) - { -- return cio_gp_dma_zalloc(cdev->private->dma_pool, &cdev->dev, size); -+ void *addr; -+ -+ if (!get_device(&cdev->dev)) -+ return NULL; -+ addr = cio_gp_dma_zalloc(cdev->private->dma_pool, &cdev->dev, size); -+ if (IS_ERR_OR_NULL(addr)) -+ put_device(&cdev->dev); -+ return addr; - } - EXPORT_SYMBOL(ccw_device_dma_zalloc); - - void ccw_device_dma_free(struct ccw_device *cdev, void *cpu_addr, size_t size) - { -+ if (!cpu_addr) -+ return; - cio_gp_dma_free(cdev->private->dma_pool, cpu_addr, size); -+ put_device(&cdev->dev); - } - EXPORT_SYMBOL(ccw_device_dma_free); - -diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c -index 23cbe4cda760e..c3bf590f5d685 100644 ---- a/drivers/scsi/csiostor/csio_lnode.c -+++ b/drivers/scsi/csiostor/csio_lnode.c -@@ -619,7 +619,7 @@ csio_ln_vnp_read_cbfn(struct csio_hw *hw, struct csio_mb *mbp) - struct fc_els_csp *csp; - struct fc_els_cssp *clsp; - enum fw_retval retval; -- __be32 nport_id; -+ __be32 nport_id = 0; - - retval = FW_CMD_RETVAL_G(ntohl(rsp->alloc_to_len16)); - if (retval != FW_SUCCESS) { -diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c -index 13fbb2eab842e..5fb06930912a0 100644 ---- a/drivers/scsi/dc395x.c -+++ b/drivers/scsi/dc395x.c -@@ -4698,6 +4698,7 @@ static int dc395x_init_one(struct pci_dev *dev, const struct pci_device_id *id) - /* initialise the adapter and everything we need */ - if (adapter_init(acb, io_port_base, io_port_len, irq)) { - dprintkl(KERN_INFO, "adapter init failed\n"); -+ acb = NULL; - goto fail; - } - -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index 580d30cd5c35c..8f85ca0112961 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -1759,6 +1759,18 @@ qla2x00_port_speed_store(struct device *dev, struct device_attribute *attr, - return strlen(buf); - } - -+static const struct { -+ u16 rate; -+ char *str; -+} port_speed_str[] = { -+ { PORT_SPEED_4GB, "4" }, -+ { PORT_SPEED_8GB, "8" }, -+ { PORT_SPEED_16GB, "16" }, -+ { PORT_SPEED_32GB, "32" }, -+ { PORT_SPEED_64GB, "64" }, -+ { PORT_SPEED_10GB, "10" }, -+}; -+ - static ssize_t - qla2x00_port_speed_show(struct device *dev, struct device_attribute *attr, - char *buf) -@@ -1766,7 +1778,8 @@ qla2x00_port_speed_show(struct device *dev, struct device_attribute *attr, - struct scsi_qla_host *vha = shost_priv(dev_to_shost(dev)); - struct qla_hw_data *ha = vha->hw; - ssize_t rval; -- char *spd[7] = {"0", "0", "0", "4", "8", "16", "32"}; -+ u16 i; -+ char *speed = "Unknown"; - - rval = qla2x00_get_data_rate(vha); - if (rval != QLA_SUCCESS) { -@@ -1775,7 +1788,14 @@ qla2x00_port_speed_show(struct device *dev, struct device_attribute *attr, - return -EINVAL; - } - -- return scnprintf(buf, PAGE_SIZE, "%s\n", spd[ha->link_data_rate]); -+ for (i = 0; i < ARRAY_SIZE(port_speed_str); i++) { -+ if (port_speed_str[i].rate != ha->link_data_rate) -+ continue; -+ speed = port_speed_str[i].str; -+ break; -+ } -+ -+ return scnprintf(buf, PAGE_SIZE, "%s\n", speed); - } - - /* ----- */ -diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h -index 7aa233771ec86..1a98e37c9be22 100644 ---- a/drivers/scsi/qla2xxx/qla_gbl.h -+++ b/drivers/scsi/qla2xxx/qla_gbl.h -@@ -156,7 +156,6 @@ extern int ql2xasynctmfenable; - extern int ql2xgffidenable; - extern int ql2xenabledif; - extern int ql2xenablehba_err_chk; --extern int ql2xtargetreset; - extern int ql2xdontresethba; - extern uint64_t ql2xmaxlun; - extern int ql2xmdcapmask; -@@ -770,7 +769,6 @@ extern void qlafx00_abort_iocb(srb_t *, struct abort_iocb_entry_fx00 *); - extern void qlafx00_fxdisc_iocb(srb_t *, struct fxdisc_entry_fx00 *); - extern void qlafx00_timer_routine(scsi_qla_host_t *); - extern int qlafx00_rescan_isp(scsi_qla_host_t *); --extern int qlafx00_loop_reset(scsi_qla_host_t *vha); - - /* qla82xx related functions */ - -diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c -index 5dae7ac0d3efe..37c1f27a76cf6 100644 ---- a/drivers/scsi/qla2xxx/qla_init.c -+++ b/drivers/scsi/qla2xxx/qla_init.c -@@ -978,8 +978,6 @@ static void qla24xx_async_gnl_sp_done(srb_t *sp, int res) - sp->name, res, sp->u.iocb_cmd.u.mbx.in_mb[1], - sp->u.iocb_cmd.u.mbx.in_mb[2]); - -- if (res == QLA_FUNCTION_TIMEOUT) -- return; - - sp->fcport->flags &= ~(FCF_ASYNC_SENT|FCF_ASYNC_ACTIVE); - memset(&ea, 0, sizeof(ea)); -@@ -1017,8 +1015,8 @@ static void qla24xx_async_gnl_sp_done(srb_t *sp, int res) - spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); - - list_for_each_entry_safe(fcport, tf, &h, gnl_entry) { -- list_del_init(&fcport->gnl_entry); - spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags); -+ list_del_init(&fcport->gnl_entry); - fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE); - spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); - ea.fcport = fcport; -diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c -index 605b59c76c901..badd09c5dd429 100644 ---- a/drivers/scsi/qla2xxx/qla_mr.c -+++ b/drivers/scsi/qla2xxx/qla_mr.c -@@ -740,29 +740,6 @@ qlafx00_lun_reset(fc_port_t *fcport, uint64_t l, int tag) - return qla2x00_async_tm_cmd(fcport, TCF_LUN_RESET, l, tag); - } - --int --qlafx00_loop_reset(scsi_qla_host_t *vha) --{ -- int ret; -- struct fc_port *fcport; -- struct qla_hw_data *ha = vha->hw; -- -- if (ql2xtargetreset) { -- list_for_each_entry(fcport, &vha->vp_fcports, list) { -- if (fcport->port_type != FCT_TARGET) -- continue; -- -- ret = ha->isp_ops->target_reset(fcport, 0, 0); -- if (ret != QLA_SUCCESS) { -- ql_dbg(ql_dbg_taskm, vha, 0x803d, -- "Bus Reset failed: Reset=%d " -- "d_id=%x.\n", ret, fcport->d_id.b24); -- } -- } -- } -- return QLA_SUCCESS; --} -- - int - qlafx00_iospace_config(struct qla_hw_data *ha) - { -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index 28cbefe715e59..c1d4c964b0dd4 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -191,12 +191,6 @@ MODULE_PARM_DESC(ql2xdbwr, - " 0 -- Regular doorbell.\n" - " 1 -- CAMRAM doorbell (faster).\n"); - --int ql2xtargetreset = 1; --module_param(ql2xtargetreset, int, S_IRUGO); --MODULE_PARM_DESC(ql2xtargetreset, -- "Enable target reset." -- "Default is 1 - use hw defaults."); -- - int ql2xgffidenable; - module_param(ql2xgffidenable, int, S_IRUGO); - MODULE_PARM_DESC(ql2xgffidenable, -@@ -1229,6 +1223,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd) - uint32_t ratov_j; - struct qla_qpair *qpair; - unsigned long flags; -+ int fast_fail_status = SUCCESS; - - if (qla2x00_isp_reg_stat(ha)) { - ql_log(ql_log_info, vha, 0x8042, -@@ -1236,15 +1231,16 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd) - return FAILED; - } - -+ /* Save any FAST_IO_FAIL value to return later if abort succeeds */ - ret = fc_block_scsi_eh(cmd); - if (ret != 0) -- return ret; -+ fast_fail_status = ret; - - sp = scsi_cmd_priv(cmd); - qpair = sp->qpair; - - if ((sp->fcport && sp->fcport->deleted) || !qpair) -- return SUCCESS; -+ return fast_fail_status != SUCCESS ? fast_fail_status : FAILED; - - spin_lock_irqsave(qpair->qp_lock_ptr, flags); - if (sp->completed) { -@@ -1290,7 +1286,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd) - __func__, ha->r_a_tov/10); - ret = FAILED; - } else { -- ret = SUCCESS; -+ ret = fast_fail_status; - } - break; - default: -@@ -1636,27 +1632,10 @@ int - qla2x00_loop_reset(scsi_qla_host_t *vha) - { - int ret; -- struct fc_port *fcport; - struct qla_hw_data *ha = vha->hw; - -- if (IS_QLAFX00(ha)) { -- return qlafx00_loop_reset(vha); -- } -- -- if (ql2xtargetreset == 1 && ha->flags.enable_target_reset) { -- list_for_each_entry(fcport, &vha->vp_fcports, list) { -- if (fcport->port_type != FCT_TARGET) -- continue; -- -- ret = ha->isp_ops->target_reset(fcport, 0, 0); -- if (ret != QLA_SUCCESS) { -- ql_dbg(ql_dbg_taskm, vha, 0x802c, -- "Bus Reset failed: Reset=%d " -- "d_id=%x.\n", ret, fcport->d_id.b24); -- } -- } -- } -- -+ if (IS_QLAFX00(ha)) -+ return QLA_SUCCESS; - - if (ha->flags.enable_lip_full_login && !IS_CNA_CAPABLE(ha)) { - atomic_set(&vha->loop_state, LOOP_DOWN); -@@ -4064,7 +4043,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, - ql_dbg_pci(ql_dbg_init, ha->pdev, - 0xe0ee, "%s: failed alloc dsd\n", - __func__); -- return 1; -+ return -ENOMEM; - } - ha->dif_bundle_kallocs++; - -diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c -index 57068e2faef54..0111c543f0e64 100644 ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -3251,8 +3251,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, - "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n", - vha->flags.online, qla2x00_reset_active(vha), - cmd->reset_count, qpair->chip_reset); -- spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); -- return 0; -+ goto out_unmap_unlock; - } - - /* Does F/W have an IOCBs for this request */ -@@ -3375,10 +3374,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) - prm.sg = NULL; - prm.req_cnt = 1; - -- /* Calculate number of entries and segments required */ -- if (qlt_pci_map_calc_cnt(&prm) != 0) -- return -EAGAIN; -- - if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) || - (cmd->sess && cmd->sess->deleted)) { - /* -@@ -3396,6 +3391,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd) - return 0; - } - -+ /* Calculate number of entries and segments required */ -+ if (qlt_pci_map_calc_cnt(&prm) != 0) -+ return -EAGAIN; -+ - spin_lock_irqsave(qpair->qp_lock_ptr, flags); - /* Does F/W have an IOCBs for this request */ - res = qlt_check_reserve_free_req(qpair, prm.req_cnt); -@@ -3800,9 +3799,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd) - - BUG_ON(cmd->cmd_in_wq); - -- if (cmd->sg_mapped) -- qlt_unmap_sg(cmd->vha, cmd); -- - if (!cmd->q_full) - qlt_decr_num_pend_cmds(cmd->vha); - -diff --git a/drivers/soc/fsl/dpaa2-console.c b/drivers/soc/fsl/dpaa2-console.c -index 27243f706f376..53917410f2bdb 100644 ---- a/drivers/soc/fsl/dpaa2-console.c -+++ b/drivers/soc/fsl/dpaa2-console.c -@@ -231,6 +231,7 @@ static ssize_t dpaa2_console_read(struct file *fp, char __user *buf, - cd->cur_ptr += bytes; - written += bytes; - -+ kfree(kbuf); - return written; - - err_free_buf: -diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c -index 0447afa970f5e..ab75f41e9c0c9 100644 ---- a/drivers/soc/tegra/pmc.c -+++ b/drivers/soc/tegra/pmc.c -@@ -591,7 +591,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg, - - err = reset_control_deassert(pg->reset); - if (err) -- goto powergate_off; -+ goto disable_clks; - - usleep_range(10, 20); - -diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c -index 8a4be34bccfd2..8a1176efa4c85 100644 ---- a/drivers/spi/spi-bcm-qspi.c -+++ b/drivers/spi/spi-bcm-qspi.c -@@ -1300,7 +1300,7 @@ int bcm_qspi_probe(struct platform_device *pdev, - &qspi->dev_ids[val]); - if (ret < 0) { - dev_err(&pdev->dev, "IRQ %s not found\n", name); -- goto qspi_probe_err; -+ goto qspi_unprepare_err; - } - - qspi->dev_ids[val].dev = qspi; -@@ -1315,7 +1315,7 @@ int bcm_qspi_probe(struct platform_device *pdev, - if (!num_ints) { - dev_err(&pdev->dev, "no IRQs registered, cannot init driver\n"); - ret = -EINVAL; -- goto qspi_probe_err; -+ goto qspi_unprepare_err; - } - - /* -@@ -1359,6 +1359,7 @@ int bcm_qspi_probe(struct platform_device *pdev, - - qspi_reg_err: - bcm_qspi_hw_uninit(qspi); -+qspi_unprepare_err: - clk_disable_unprepare(qspi->clk); - qspi_probe_err: - kfree(qspi->dev_ids); -diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c -index 7fedea67159c5..8523bb4f6a62e 100644 ---- a/drivers/spi/spi-pl022.c -+++ b/drivers/spi/spi-pl022.c -@@ -1720,12 +1720,13 @@ static int verify_controller_parameters(struct pl022 *pl022, - return -EINVAL; - } - } else { -- if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) -+ if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) { - dev_err(&pl022->adev->dev, - "Microwire half duplex mode requested," - " but this is only available in the" - " ST version of PL022\n"); -- return -EINVAL; -+ return -EINVAL; -+ } - } - } - return 0; -diff --git a/drivers/staging/ks7010/Kconfig b/drivers/staging/ks7010/Kconfig -index 0987fdc2f70db..8ea6c09286798 100644 ---- a/drivers/staging/ks7010/Kconfig -+++ b/drivers/staging/ks7010/Kconfig -@@ -5,6 +5,9 @@ config KS7010 - select WIRELESS_EXT - select WEXT_PRIV - select FW_LOADER -+ select CRYPTO -+ select CRYPTO_HASH -+ select CRYPTO_MICHAEL_MIC - help - This is a driver for KeyStream KS7010 based SDIO WIFI cards. It is - found on at least later Spectec SDW-821 (FCC-ID "S2Y-WLAN-11G-K" only, -diff --git a/drivers/staging/media/imx/imx-media-dev-common.c b/drivers/staging/media/imx/imx-media-dev-common.c -index 66b505f7e8dff..137e414cda186 100644 ---- a/drivers/staging/media/imx/imx-media-dev-common.c -+++ b/drivers/staging/media/imx/imx-media-dev-common.c -@@ -373,6 +373,8 @@ struct imx_media_dev *imx_media_dev_init(struct device *dev, - imxmd->v4l2_dev.notify = imx_media_notify; - strscpy(imxmd->v4l2_dev.name, "imx-media", - sizeof(imxmd->v4l2_dev.name)); -+ snprintf(imxmd->md.bus_info, sizeof(imxmd->md.bus_info), -+ "platform:%s", dev_name(imxmd->md.dev)); - - media_device_init(&imxmd->md); - -diff --git a/drivers/staging/media/ipu3/ipu3-v4l2.c b/drivers/staging/media/ipu3/ipu3-v4l2.c -index 908ae74aa970d..53239ea67fe48 100644 ---- a/drivers/staging/media/ipu3/ipu3-v4l2.c -+++ b/drivers/staging/media/ipu3/ipu3-v4l2.c -@@ -594,11 +594,12 @@ static const struct imgu_fmt *find_format(struct v4l2_format *f, u32 type) - static int imgu_vidioc_querycap(struct file *file, void *fh, - struct v4l2_capability *cap) - { -- struct imgu_video_device *node = file_to_intel_imgu_node(file); -+ struct imgu_device *imgu = video_drvdata(file); - - strscpy(cap->driver, IMGU_NAME, sizeof(cap->driver)); - strscpy(cap->card, IMGU_NAME, sizeof(cap->card)); -- snprintf(cap->bus_info, sizeof(cap->bus_info), "PCI:%s", node->name); -+ snprintf(cap->bus_info, sizeof(cap->bus_info), "PCI:%s", -+ pci_name(imgu->pci_dev)); - - return 0; - } -@@ -695,7 +696,7 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node, - - /* CSS expects some format on OUT queue */ - if (i != IPU3_CSS_QUEUE_OUT && -- !imgu_pipe->nodes[inode].enabled) { -+ !imgu_pipe->nodes[inode].enabled && !try) { - fmts[i] = NULL; - continue; - } -diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c -index c3cd6f389a989..2a369fdaf0cbb 100644 ---- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c -+++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c -@@ -97,8 +97,7 @@ static void cfg_scan_result(enum scan_event scan_event, - info->frame_len, - (s32)info->rssi * 100, - GFP_KERNEL); -- if (!bss) -- cfg80211_put_bss(wiphy, bss); -+ cfg80211_put_bss(wiphy, bss); - } else if (scan_event == SCAN_EVENT_DONE) { - mutex_lock(&priv->scan_req_lock); - -diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c -index 51a7d3b19b394..381c5117aec1b 100644 ---- a/drivers/tty/serial/8250/8250_dw.c -+++ b/drivers/tty/serial/8250/8250_dw.c -@@ -660,7 +660,7 @@ static struct platform_driver dw8250_platform_driver = { - .name = "dw-apb-uart", - .pm = &dw8250_pm_ops, - .of_match_table = dw8250_of_match, -- .acpi_match_table = ACPI_PTR(dw8250_acpi_match), -+ .acpi_match_table = dw8250_acpi_match, - }, - .probe = dw8250_probe, - .remove = dw8250_remove, -diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c -index fa3bd8a97b244..38ee13bbcab81 100644 ---- a/drivers/tty/serial/serial_core.c -+++ b/drivers/tty/serial/serial_core.c -@@ -220,7 +220,11 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state, - if (retval == 0) { - if (uart_console(uport) && uport->cons->cflag) { - tty->termios.c_cflag = uport->cons->cflag; -+ tty->termios.c_ispeed = uport->cons->ispeed; -+ tty->termios.c_ospeed = uport->cons->ospeed; - uport->cons->cflag = 0; -+ uport->cons->ispeed = 0; -+ uport->cons->ospeed = 0; - } - /* - * Initialise the hardware port settings. -@@ -288,8 +292,11 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state) - /* - * Turn off DTR and RTS early. - */ -- if (uport && uart_console(uport) && tty) -+ if (uport && uart_console(uport) && tty) { - uport->cons->cflag = tty->termios.c_cflag; -+ uport->cons->ispeed = tty->termios.c_ispeed; -+ uport->cons->ospeed = tty->termios.c_ospeed; -+ } - - if (!tty || C_HUPCL(tty)) - uart_port_dtr_rts(uport, 0); -@@ -2110,8 +2117,11 @@ uart_set_options(struct uart_port *port, struct console *co, - * Allow the setting of the UART parameters with a NULL console - * too: - */ -- if (co) -+ if (co) { - co->cflag = termios.c_cflag; -+ co->ispeed = termios.c_ispeed; -+ co->ospeed = termios.c_ospeed; -+ } - - return 0; - } -@@ -2245,6 +2255,8 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport) - */ - memset(&termios, 0, sizeof(struct ktermios)); - termios.c_cflag = uport->cons->cflag; -+ termios.c_ispeed = uport->cons->ispeed; -+ termios.c_ospeed = uport->cons->ospeed; - - /* - * If that's unset, use the tty termios setting. -diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c -index 9359c80fbb9f5..a1409251fbcc3 100644 ---- a/drivers/tty/serial/xilinx_uartps.c -+++ b/drivers/tty/serial/xilinx_uartps.c -@@ -595,9 +595,10 @@ static void cdns_uart_start_tx(struct uart_port *port) - if (uart_circ_empty(&port->state->xmit)) - return; - -+ writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR); -+ - cdns_uart_handle_tx(port); - -- writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR); - /* Enable the TX Empty interrupt */ - writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_IER); - } -diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index b7da2a273c451..74cdc7ef476ae 100644 ---- a/drivers/usb/chipidea/core.c -+++ b/drivers/usb/chipidea/core.c -@@ -534,7 +534,7 @@ int hw_device_reset(struct ci_hdrc *ci) - return 0; - } - --static irqreturn_t ci_irq(int irq, void *data) -+static irqreturn_t ci_irq_handler(int irq, void *data) - { - struct ci_hdrc *ci = data; - irqreturn_t ret = IRQ_NONE; -@@ -587,6 +587,15 @@ static irqreturn_t ci_irq(int irq, void *data) - return ret; - } - -+static void ci_irq(struct ci_hdrc *ci) -+{ -+ unsigned long flags; -+ -+ local_irq_save(flags); -+ ci_irq_handler(ci->irq, ci); -+ local_irq_restore(flags); -+} -+ - static int ci_cable_notifier(struct notifier_block *nb, unsigned long event, - void *ptr) - { -@@ -596,7 +605,7 @@ static int ci_cable_notifier(struct notifier_block *nb, unsigned long event, - cbl->connected = event; - cbl->changed = true; - -- ci_irq(ci->irq, ci); -+ ci_irq(ci); - return NOTIFY_DONE; - } - -@@ -634,7 +643,7 @@ static int ci_usb_role_switch_set(struct device *dev, enum usb_role role) - if (cable) { - cable->changed = true; - cable->connected = false; -- ci_irq(ci->irq, ci); -+ ci_irq(ci); - spin_unlock_irqrestore(&ci->lock, flags); - if (ci->wq && role != USB_ROLE_NONE) - flush_workqueue(ci->wq); -@@ -652,7 +661,7 @@ static int ci_usb_role_switch_set(struct device *dev, enum usb_role role) - if (cable) { - cable->changed = true; - cable->connected = true; -- ci_irq(ci->irq, ci); -+ ci_irq(ci); - } - spin_unlock_irqrestore(&ci->lock, flags); - pm_runtime_put_sync(ci->dev); -@@ -1156,7 +1165,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) - } - } - -- ret = devm_request_irq(dev, ci->irq, ci_irq, IRQF_SHARED, -+ ret = devm_request_irq(dev, ci->irq, ci_irq_handler, IRQF_SHARED, - ci->platdata->name, ci); - if (ret) - goto stop; -@@ -1277,11 +1286,11 @@ static void ci_extcon_wakeup_int(struct ci_hdrc *ci) - - if (!IS_ERR(cable_id->edev) && ci->is_otg && - (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) -- ci_irq(ci->irq, ci); -+ ci_irq(ci); - - if (!IS_ERR(cable_vbus->edev) && ci->is_otg && - (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) -- ci_irq(ci->irq, ci); -+ ci_irq(ci); - } - - static int ci_controller_resume(struct device *dev) -diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c -index 5b27d289443fe..3912cc805f3af 100644 ---- a/drivers/usb/gadget/legacy/hid.c -+++ b/drivers/usb/gadget/legacy/hid.c -@@ -99,8 +99,10 @@ static int do_config(struct usb_configuration *c) - - list_for_each_entry(e, &hidg_func_list, node) { - e->f = usb_get_function(e->fi); -- if (IS_ERR(e->f)) -+ if (IS_ERR(e->f)) { -+ status = PTR_ERR(e->f); - goto put; -+ } - status = usb_add_function(c, e->f); - if (status < 0) { - usb_put_function(e->f); -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 6358d4e0653ed..9a4260927ce31 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -171,7 +171,6 @@ static void xhci_common_hub_descriptor(struct xhci_hcd *xhci, - { - u16 temp; - -- desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.9 says 20ms max */ - desc->bHubContrCurrent = 0; - - desc->bNbrPorts = ports; -@@ -206,6 +205,7 @@ static void xhci_usb2_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci, - desc->bDescriptorType = USB_DT_HUB; - temp = 1 + (ports / 8); - desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * temp; -+ desc->bPwrOn2PwrGood = 10; /* xhci section 5.4.8 says 20ms */ - - /* The Device Removable bits are reported on a byte granularity. - * If the port doesn't exist within that byte, the bit is set to 0. -@@ -258,6 +258,7 @@ static void xhci_usb3_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci, - xhci_common_hub_descriptor(xhci, desc, ports); - desc->bDescriptorType = USB_DT_SS_HUB; - desc->bDescLength = USB_DT_SS_HUB_SIZE; -+ desc->bPwrOn2PwrGood = 50; /* usb 3.1 may fail if less than 100ms */ - - /* header decode latency should be zero for roothubs, - * see section 4.23.5.2. -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index ae8fa4ff05ee3..beee3543950fe 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -59,6 +59,13 @@ - #define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba - #define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb - #define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc -+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_1 0x161a -+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_2 0x161b -+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_3 0x161d -+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_4 0x161e -+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_5 0x15d6 -+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6 0x15d7 -+ - #define PCI_DEVICE_ID_ASMEDIA_1042_XHCI 0x1042 - #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 - #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI 0x1242 -@@ -290,6 +297,15 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4)) - xhci->quirks |= XHCI_NO_SOFT_RETRY; - -+ if (pdev->vendor == PCI_VENDOR_ID_AMD && -+ (pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_1 || -+ pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_2 || -+ pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_3 || -+ pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_4 || -+ pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_5 || -+ pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6)) -+ xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; -+ - if (xhci->quirks & XHCI_RESET_ON_RESUME) - xhci_dbg_trace(xhci, trace_xhci_dbg_quirks, - "QUIRK: Resetting on resume"); -diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c -index 103c69c692bad..888defdea546f 100644 ---- a/drivers/usb/misc/iowarrior.c -+++ b/drivers/usb/misc/iowarrior.c -@@ -99,10 +99,6 @@ struct iowarrior { - /* globals */ - /*--------------*/ - --/* -- * USB spec identifies 5 second timeouts. -- */ --#define GET_TIMEOUT 5 - #define USB_REQ_GET_REPORT 0x01 - //#if 0 - static int usb_get_report(struct usb_device *dev, -@@ -114,7 +110,7 @@ static int usb_get_report(struct usb_device *dev, - USB_DIR_IN | USB_TYPE_CLASS | - USB_RECIP_INTERFACE, (type << 8) + id, - inter->desc.bInterfaceNumber, buf, size, -- GET_TIMEOUT*HZ); -+ USB_CTRL_GET_TIMEOUT); - } - //#endif - -@@ -129,7 +125,7 @@ static int usb_set_report(struct usb_interface *intf, unsigned char type, - USB_TYPE_CLASS | USB_RECIP_INTERFACE, - (type << 8) + id, - intf->cur_altsetting->desc.bInterfaceNumber, buf, -- size, HZ); -+ size, 1000); - } - - /*---------------------*/ -diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c -index aa3dbce22cfbe..451759f38b573 100644 ---- a/drivers/usb/serial/keyspan.c -+++ b/drivers/usb/serial/keyspan.c -@@ -2910,22 +2910,22 @@ static int keyspan_port_probe(struct usb_serial_port *port) - for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) { - p_priv->in_buffer[i] = kzalloc(IN_BUFLEN, GFP_KERNEL); - if (!p_priv->in_buffer[i]) -- goto err_in_buffer; -+ goto err_free_in_buffer; - } - - for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) { - p_priv->out_buffer[i] = kzalloc(OUT_BUFLEN, GFP_KERNEL); - if (!p_priv->out_buffer[i]) -- goto err_out_buffer; -+ goto err_free_out_buffer; - } - - p_priv->inack_buffer = kzalloc(INACK_BUFLEN, GFP_KERNEL); - if (!p_priv->inack_buffer) -- goto err_inack_buffer; -+ goto err_free_out_buffer; - - p_priv->outcont_buffer = kzalloc(OUTCONT_BUFLEN, GFP_KERNEL); - if (!p_priv->outcont_buffer) -- goto err_outcont_buffer; -+ goto err_free_inack_buffer; - - p_priv->device_details = d_details; - -@@ -2971,15 +2971,14 @@ static int keyspan_port_probe(struct usb_serial_port *port) - - return 0; - --err_outcont_buffer: -+err_free_inack_buffer: - kfree(p_priv->inack_buffer); --err_inack_buffer: -+err_free_out_buffer: - for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) - kfree(p_priv->out_buffer[i]); --err_out_buffer: -+err_free_in_buffer: - for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) - kfree(p_priv->in_buffer[i]); --err_in_buffer: - kfree(p_priv); - - return -ENOMEM; -diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c -index cac3e35d76308..813a264a1b119 100644 ---- a/drivers/video/backlight/backlight.c -+++ b/drivers/video/backlight/backlight.c -@@ -630,12 +630,6 @@ struct backlight_device *of_find_backlight(struct device *dev) - of_node_put(np); - if (!bd) - return ERR_PTR(-EPROBE_DEFER); -- /* -- * Note: gpio_backlight uses brightness as -- * power state during probe -- */ -- if (!bd->props.brightness) -- bd->props.brightness = bd->props.max_brightness; - } - } - -diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c -index f4dc320dcafe2..80fdd3ee0565f 100644 ---- a/drivers/video/fbdev/chipsfb.c -+++ b/drivers/video/fbdev/chipsfb.c -@@ -331,7 +331,7 @@ static const struct fb_var_screeninfo chipsfb_var = { - - static void init_chips(struct fb_info *p, unsigned long addr) - { -- memset(p->screen_base, 0, 0x100000); -+ fb_memset(p->screen_base, 0, 0x100000); - - p->fix = chipsfb_fix; - p->fix.smem_start = addr; -diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig -index 1aa42e879e633..3fabd4177b0ee 100644 ---- a/drivers/watchdog/Kconfig -+++ b/drivers/watchdog/Kconfig -@@ -1682,7 +1682,7 @@ config SIBYTE_WDOG - - config AR7_WDT - tristate "TI AR7 Watchdog Timer" -- depends on AR7 || (MIPS && COMPILE_TEST) -+ depends on AR7 || (MIPS && 32BIT && COMPILE_TEST) - help - Hardware driver for the TI AR7 Watchdog Timer. - -diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c -index 893cef70c1599..aa57498009c34 100644 ---- a/drivers/watchdog/f71808e_wdt.c -+++ b/drivers/watchdog/f71808e_wdt.c -@@ -228,15 +228,17 @@ static int watchdog_set_timeout(int timeout) - - mutex_lock(&watchdog.lock); - -- watchdog.timeout = timeout; - if (timeout > 0xff) { - watchdog.timer_val = DIV_ROUND_UP(timeout, 60); - watchdog.minutes_mode = true; -+ timeout = watchdog.timer_val * 60; - } else { - watchdog.timer_val = timeout; - watchdog.minutes_mode = false; - } - -+ watchdog.timeout = timeout; -+ - mutex_unlock(&watchdog.lock); - - return 0; -diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c -index 9b91882fe3c41..6d7ccbc0b666c 100644 ---- a/drivers/watchdog/omap_wdt.c -+++ b/drivers/watchdog/omap_wdt.c -@@ -268,8 +268,12 @@ static int omap_wdt_probe(struct platform_device *pdev) - wdev->wdog.bootstatus = WDIOF_CARDRESET; - } - -- if (!early_enable) -+ if (early_enable) { -+ omap_wdt_start(&wdev->wdog); -+ set_bit(WDOG_HW_RUNNING, &wdev->wdog.status); -+ } else { - omap_wdt_disable(wdev); -+ } - - ret = watchdog_register_device(&wdev->wdog); - if (ret) { -diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c -index 07f362c63ae90..39bbb127852f9 100644 ---- a/drivers/xen/balloon.c -+++ b/drivers/xen/balloon.c -@@ -58,6 +58,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -75,6 +76,12 @@ - #include - #include - -+#undef MODULE_PARAM_PREFIX -+#define MODULE_PARAM_PREFIX "xen." -+ -+static uint __read_mostly balloon_boot_timeout = 180; -+module_param(balloon_boot_timeout, uint, 0444); -+ - static int xen_hotplug_unpopulated; - - #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG -@@ -127,12 +134,12 @@ static struct ctl_table xen_root[] = { - * BP_ECANCELED: error, balloon operation canceled. - */ - --enum bp_state { -+static enum bp_state { - BP_DONE, - BP_WAIT, - BP_EAGAIN, - BP_ECANCELED --}; -+} balloon_state = BP_DONE; - - /* Main waiting point for xen-balloon thread. */ - static DECLARE_WAIT_QUEUE_HEAD(balloon_thread_wq); -@@ -201,18 +208,15 @@ static struct page *balloon_next_page(struct page *page) - return list_entry(next, struct page, lru); - } - --static enum bp_state update_schedule(enum bp_state state) -+static void update_schedule(void) - { -- if (state == BP_WAIT) -- return BP_WAIT; -- -- if (state == BP_ECANCELED) -- return BP_ECANCELED; -+ if (balloon_state == BP_WAIT || balloon_state == BP_ECANCELED) -+ return; - -- if (state == BP_DONE) { -+ if (balloon_state == BP_DONE) { - balloon_stats.schedule_delay = 1; - balloon_stats.retry_count = 1; -- return BP_DONE; -+ return; - } - - ++balloon_stats.retry_count; -@@ -221,7 +225,8 @@ static enum bp_state update_schedule(enum bp_state state) - balloon_stats.retry_count > balloon_stats.max_retry_count) { - balloon_stats.schedule_delay = 1; - balloon_stats.retry_count = 1; -- return BP_ECANCELED; -+ balloon_state = BP_ECANCELED; -+ return; - } - - balloon_stats.schedule_delay <<= 1; -@@ -229,7 +234,7 @@ static enum bp_state update_schedule(enum bp_state state) - if (balloon_stats.schedule_delay > balloon_stats.max_schedule_delay) - balloon_stats.schedule_delay = balloon_stats.max_schedule_delay; - -- return BP_EAGAIN; -+ balloon_state = BP_EAGAIN; - } - - #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG -@@ -511,9 +516,9 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp) - * Stop waiting if either state is BP_DONE and ballooning action is - * needed, or if the credit has changed while state is not BP_DONE. - */ --static bool balloon_thread_cond(enum bp_state state, long credit) -+static bool balloon_thread_cond(long credit) - { -- if (state == BP_DONE) -+ if (balloon_state == BP_DONE) - credit = 0; - - return current_credit() != credit || kthread_should_stop(); -@@ -527,13 +532,12 @@ static bool balloon_thread_cond(enum bp_state state, long credit) - */ - static int balloon_thread(void *unused) - { -- enum bp_state state = BP_DONE; - long credit; - unsigned long timeout; - - set_freezable(); - for (;;) { -- switch (state) { -+ switch (balloon_state) { - case BP_DONE: - case BP_ECANCELED: - timeout = 3600 * HZ; -@@ -549,7 +553,7 @@ static int balloon_thread(void *unused) - credit = current_credit(); - - wait_event_freezable_timeout(balloon_thread_wq, -- balloon_thread_cond(state, credit), timeout); -+ balloon_thread_cond(credit), timeout); - - if (kthread_should_stop()) - return 0; -@@ -560,22 +564,23 @@ static int balloon_thread(void *unused) - - if (credit > 0) { - if (balloon_is_inflated()) -- state = increase_reservation(credit); -+ balloon_state = increase_reservation(credit); - else -- state = reserve_additional_memory(); -+ balloon_state = reserve_additional_memory(); - } - - if (credit < 0) { - long n_pages; - - n_pages = min(-credit, si_mem_available()); -- state = decrease_reservation(n_pages, GFP_BALLOON); -- if (state == BP_DONE && n_pages != -credit && -+ balloon_state = decrease_reservation(n_pages, -+ GFP_BALLOON); -+ if (balloon_state == BP_DONE && n_pages != -credit && - n_pages < totalreserve_pages) -- state = BP_EAGAIN; -+ balloon_state = BP_EAGAIN; - } - -- state = update_schedule(state); -+ update_schedule(); - - mutex_unlock(&balloon_mutex); - -@@ -782,3 +787,38 @@ static int __init balloon_init(void) - return 0; - } - subsys_initcall(balloon_init); -+ -+static int __init balloon_wait_finish(void) -+{ -+ long credit, last_credit = 0; -+ unsigned long last_changed = 0; -+ -+ if (!xen_domain()) -+ return -ENODEV; -+ -+ /* PV guests don't need to wait. */ -+ if (xen_pv_domain() || !current_credit()) -+ return 0; -+ -+ pr_notice("Waiting for initial ballooning down having finished.\n"); -+ -+ while ((credit = current_credit()) < 0) { -+ if (credit != last_credit) { -+ last_changed = jiffies; -+ last_credit = credit; -+ } -+ if (balloon_state == BP_ECANCELED) { -+ pr_warn_once("Initial ballooning failed, %ld pages need to be freed.\n", -+ -credit); -+ if (jiffies - last_changed >= HZ * balloon_boot_timeout) -+ panic("Initial ballooning failed!\n"); -+ } -+ -+ schedule_timeout_interruptible(HZ / 10); -+ } -+ -+ pr_notice("Initial ballooning down finished.\n"); -+ -+ return 0; -+} -+late_initcall_sync(balloon_wait_finish); -diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c -index e5694133ebe57..42f0f64fcba47 100644 ---- a/drivers/xen/xen-pciback/conf_space_capability.c -+++ b/drivers/xen/xen-pciback/conf_space_capability.c -@@ -160,7 +160,7 @@ static void *pm_ctrl_init(struct pci_dev *dev, int offset) - } - - out: -- return ERR_PTR(err); -+ return err ? ERR_PTR(err) : NULL; - } - - static const struct config_field caplist_pm[] = { -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 946ae198b3449..1499531bc1511 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -3145,7 +3145,8 @@ retry_root_backup: - goto fail_sysfs; - } - -- if (!sb_rdonly(sb) && !btrfs_check_rw_degradable(fs_info, NULL)) { -+ if (!sb_rdonly(sb) && fs_info->fs_devices->missing_devices && -+ !btrfs_check_rw_degradable(fs_info, NULL)) { - btrfs_warn(fs_info, - "writable mount is not allowed due to too many missing devices"); - goto fail_sysfs; -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index f342055699870..7bc4477d7ee7d 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -2490,7 +2490,9 @@ again: - else { - ret = find_dir_range(log, path, dirid, key_type, - &range_start, &range_end); -- if (ret != 0) -+ if (ret < 0) -+ goto out; -+ else if (ret > 0) - break; - } - -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index f302bbb93f32c..344d18de1f08c 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -1315,8 +1315,10 @@ static void btrfs_close_one_device(struct btrfs_device *device) - if (device->devid == BTRFS_DEV_REPLACE_DEVID) - clear_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state); - -- if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) -+ if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) { -+ clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state); - fs_devices->missing_devices--; -+ } - - btrfs_close_bdev(device); - -@@ -2160,8 +2162,11 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path, - u64 num_devices; - int ret = 0; - -- mutex_lock(&uuid_mutex); -- -+ /* -+ * The device list in fs_devices is accessed without locks (neither -+ * uuid_mutex nor device_list_mutex) as it won't change on a mounted -+ * filesystem and another device rm cannot run. -+ */ - num_devices = btrfs_num_devices(fs_info); - - ret = btrfs_check_raid_min_devices(fs_info, num_devices - 1); -@@ -2205,11 +2210,9 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path, - mutex_unlock(&fs_info->chunk_mutex); - } - -- mutex_unlock(&uuid_mutex); - ret = btrfs_shrink_device(device, 0); - if (!ret) - btrfs_reada_remove_dev(device); -- mutex_lock(&uuid_mutex); - if (ret) - goto error_undo; - -@@ -2291,7 +2294,6 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path, - } - - out: -- mutex_unlock(&uuid_mutex); - return ret; - - error_undo: -diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c -index 502bd491336a8..2383d52b1f424 100644 ---- a/fs/f2fs/inode.c -+++ b/fs/f2fs/inode.c -@@ -455,7 +455,7 @@ make_now: - inode->i_op = &f2fs_dir_inode_operations; - inode->i_fop = &f2fs_dir_operations; - inode->i_mapping->a_ops = &f2fs_dblock_aops; -- inode_nohighmem(inode); -+ mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS); - } else if (S_ISLNK(inode->i_mode)) { - if (file_is_encrypt(inode)) - inode->i_op = &f2fs_encrypted_symlink_inode_operations; -diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c -index 81a18ba18e301..ed95c27e93026 100644 ---- a/fs/f2fs/namei.c -+++ b/fs/f2fs/namei.c -@@ -679,7 +679,7 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) - inode->i_op = &f2fs_dir_inode_operations; - inode->i_fop = &f2fs_dir_operations; - inode->i_mapping->a_ops = &f2fs_dblock_aops; -- inode_nohighmem(inode); -+ mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS); - - set_inode_flag(inode, FI_INC_LINK); - f2fs_lock_op(sbi); -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index 7205a89fbb5f3..fa4d2aba5a701 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -839,6 +839,12 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) - goto out_put_old; - } - -+ /* -+ * Release while we have extra ref on stolen page. Otherwise -+ * anon_pipe_buf_release() might think the page can be reused. -+ */ -+ pipe_buf_release(cs->pipe, buf); -+ - get_page(newpage); - - if (!(buf->flags & PIPE_BUF_FLAG_LRU)) -@@ -2027,8 +2033,12 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe, - - pipe_lock(pipe); - out_free: -- for (idx = 0; idx < nbuf; idx++) -- pipe_buf_release(pipe, &bufs[idx]); -+ for (idx = 0; idx < nbuf; idx++) { -+ struct pipe_buffer *buf = &bufs[idx]; -+ -+ if (buf->ops) -+ pipe_buf_release(pipe, buf); -+ } - pipe_unlock(pipe); - - kvfree(bufs); -diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c -index 616de103dccc5..d41733540df91 100644 ---- a/fs/jfs/jfs_mount.c -+++ b/fs/jfs/jfs_mount.c -@@ -80,14 +80,14 @@ int jfs_mount(struct super_block *sb) - * (initialize mount inode from the superblock) - */ - if ((rc = chkSuper(sb))) { -- goto errout20; -+ goto out; - } - - ipaimap = diReadSpecial(sb, AGGREGATE_I, 0); - if (ipaimap == NULL) { - jfs_err("jfs_mount: Failed to read AGGREGATE_I"); - rc = -EIO; -- goto errout20; -+ goto out; - } - sbi->ipaimap = ipaimap; - -@@ -98,7 +98,7 @@ int jfs_mount(struct super_block *sb) - */ - if ((rc = diMount(ipaimap))) { - jfs_err("jfs_mount: diMount(ipaimap) failed w/rc = %d", rc); -- goto errout21; -+ goto err_ipaimap; - } - - /* -@@ -107,7 +107,7 @@ int jfs_mount(struct super_block *sb) - ipbmap = diReadSpecial(sb, BMAP_I, 0); - if (ipbmap == NULL) { - rc = -EIO; -- goto errout22; -+ goto err_umount_ipaimap; - } - - jfs_info("jfs_mount: ipbmap:0x%p", ipbmap); -@@ -119,7 +119,7 @@ int jfs_mount(struct super_block *sb) - */ - if ((rc = dbMount(ipbmap))) { - jfs_err("jfs_mount: dbMount failed w/rc = %d", rc); -- goto errout22; -+ goto err_ipbmap; - } - - /* -@@ -138,7 +138,7 @@ int jfs_mount(struct super_block *sb) - if (!ipaimap2) { - jfs_err("jfs_mount: Failed to read AGGREGATE_I"); - rc = -EIO; -- goto errout35; -+ goto err_umount_ipbmap; - } - sbi->ipaimap2 = ipaimap2; - -@@ -150,7 +150,7 @@ int jfs_mount(struct super_block *sb) - if ((rc = diMount(ipaimap2))) { - jfs_err("jfs_mount: diMount(ipaimap2) failed, rc = %d", - rc); -- goto errout35; -+ goto err_ipaimap2; - } - } else - /* Secondary aggregate inode table is not valid */ -@@ -167,7 +167,7 @@ int jfs_mount(struct super_block *sb) - jfs_err("jfs_mount: Failed to read FILESYSTEM_I"); - /* open fileset secondary inode allocation map */ - rc = -EIO; -- goto errout40; -+ goto err_umount_ipaimap2; - } - jfs_info("jfs_mount: ipimap:0x%p", ipimap); - -@@ -177,41 +177,34 @@ int jfs_mount(struct super_block *sb) - /* initialize fileset inode allocation map */ - if ((rc = diMount(ipimap))) { - jfs_err("jfs_mount: diMount failed w/rc = %d", rc); -- goto errout41; -+ goto err_ipimap; - } - -- goto out; -+ return rc; - - /* - * unwind on error - */ -- errout41: /* close fileset inode allocation map inode */ -+err_ipimap: -+ /* close fileset inode allocation map inode */ - diFreeSpecial(ipimap); -- -- errout40: /* fileset closed */ -- -+err_umount_ipaimap2: - /* close secondary aggregate inode allocation map */ -- if (ipaimap2) { -+ if (ipaimap2) - diUnmount(ipaimap2, 1); -+err_ipaimap2: -+ /* close aggregate inodes */ -+ if (ipaimap2) - diFreeSpecial(ipaimap2); -- } -- -- errout35: -- -- /* close aggregate block allocation map */ -+err_umount_ipbmap: /* close aggregate block allocation map */ - dbUnmount(ipbmap, 1); -+err_ipbmap: /* close aggregate inodes */ - diFreeSpecial(ipbmap); -- -- errout22: /* close aggregate inode allocation map */ -- -+err_umount_ipaimap: /* close aggregate inode allocation map */ - diUnmount(ipaimap, 1); -- -- errout21: /* close aggregate inodes */ -+err_ipaimap: /* close aggregate inodes */ - diFreeSpecial(ipaimap); -- errout20: /* aggregate closed */ -- -- out: -- -+out: - if (rc) - jfs_err("Mount JFS Failure: %d", rc); - -diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c -index 3eda40a320a53..1f12297109b41 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c -+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c -@@ -378,10 +378,10 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, - goto noconnect; - - ds = mirror->mirror_ds->ds; -+ if (READ_ONCE(ds->ds_clp)) -+ goto out; - /* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */ - smp_rmb(); -- if (ds->ds_clp) -- goto out; - - /* FIXME: For now we assume the server sent only one version of NFS - * to use for the DS. -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 5ecaf7b6b0fa1..fb3d1532f11dd 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -1549,15 +1549,16 @@ static bool nfs_stateid_is_sequential(struct nfs4_state *state, - { - if (test_bit(NFS_OPEN_STATE, &state->flags)) { - /* The common case - we're updating to a new sequence number */ -- if (nfs4_stateid_match_other(stateid, &state->open_stateid) && -- nfs4_stateid_is_next(&state->open_stateid, stateid)) { -- return true; -+ if (nfs4_stateid_match_other(stateid, &state->open_stateid)) { -+ if (nfs4_stateid_is_next(&state->open_stateid, stateid)) -+ return true; -+ return false; - } -- } else { -- /* This is the first OPEN in this generation */ -- if (stateid->seqid == cpu_to_be32(1)) -- return true; -+ /* The server returned a new stateid */ - } -+ /* This is the first OPEN in this generation */ -+ if (stateid->seqid == cpu_to_be32(1)) -+ return true; - return false; - } - -diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c -index 249cf9037dbd7..aff44a7b98f86 100644 ---- a/fs/nfs/pnfs_nfs.c -+++ b/fs/nfs/pnfs_nfs.c -@@ -641,7 +641,7 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv, - } - - smp_wmb(); -- ds->ds_clp = clp; -+ WRITE_ONCE(ds->ds_clp, clp); - dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr); - out: - return status; -@@ -714,7 +714,7 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv, - } - - smp_wmb(); -- ds->ds_clp = clp; -+ WRITE_ONCE(ds->ds_clp, clp); - dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr); - out: - return status; -diff --git a/fs/nfs/write.c b/fs/nfs/write.c -index 613c3ef23e07b..30d8e7bc1cef3 100644 ---- a/fs/nfs/write.c -+++ b/fs/nfs/write.c -@@ -1050,25 +1050,11 @@ nfs_scan_commit_list(struct list_head *src, struct list_head *dst, - struct nfs_page *req, *tmp; - int ret = 0; - --restart: - list_for_each_entry_safe(req, tmp, src, wb_list) { - kref_get(&req->wb_kref); - if (!nfs_lock_request(req)) { -- int status; -- -- /* Prevent deadlock with nfs_lock_and_join_requests */ -- if (!list_empty(dst)) { -- nfs_release_request(req); -- continue; -- } -- /* Ensure we make progress to prevent livelock */ -- mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex); -- status = nfs_wait_on_request(req); - nfs_release_request(req); -- mutex_lock(&NFS_I(cinfo->inode)->commit_mutex); -- if (status < 0) -- break; -- goto restart; -+ continue; - } - nfs_request_remove_commit_list(req, cinfo); - clear_bit(PG_COMMIT_TO_DS, &req->wb_flags); -@@ -1935,6 +1921,7 @@ static int __nfs_commit_inode(struct inode *inode, int how, - int may_wait = how & FLUSH_SYNC; - int ret, nscan; - -+ how &= ~FLUSH_SYNC; - nfs_init_cinfo_from_inode(&cinfo, inode); - nfs_commit_begin(cinfo.mds); - for (;;) { -diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c -index 58d4546a208e6..c30747bdfb127 100644 ---- a/fs/ocfs2/file.c -+++ b/fs/ocfs2/file.c -@@ -478,10 +478,11 @@ int ocfs2_truncate_file(struct inode *inode, - * greater than page size, so we have to truncate them - * anyway. - */ -- unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1); -- truncate_inode_pages(inode->i_mapping, new_i_size); - - if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) { -+ unmap_mapping_range(inode->i_mapping, -+ new_i_size + PAGE_SIZE - 1, 0, 1); -+ truncate_inode_pages(inode->i_mapping, new_i_size); - status = ocfs2_truncate_inline(inode, di_bh, new_i_size, - i_size_read(inode), 1); - if (status) -@@ -500,6 +501,9 @@ int ocfs2_truncate_file(struct inode *inode, - goto bail_unlock_sem; - } - -+ unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1); -+ truncate_inode_pages(inode->i_mapping, new_i_size); -+ - status = ocfs2_commit_truncate(osb, inode, di_bh); - if (status < 0) { - mlog_errno(status); -diff --git a/fs/orangefs/dcache.c b/fs/orangefs/dcache.c -index fe484cf93e5cd..8bbe9486e3a62 100644 ---- a/fs/orangefs/dcache.c -+++ b/fs/orangefs/dcache.c -@@ -26,8 +26,10 @@ static int orangefs_revalidate_lookup(struct dentry *dentry) - gossip_debug(GOSSIP_DCACHE_DEBUG, "%s: attempting lookup.\n", __func__); - - new_op = op_alloc(ORANGEFS_VFS_OP_LOOKUP); -- if (!new_op) -+ if (!new_op) { -+ ret = -ENOMEM; - goto out_put_parent; -+ } - - new_op->upcall.req.lookup.sym_follow = ORANGEFS_LOOKUP_LINK_NO_FOLLOW; - new_op->upcall.req.lookup.parent_refn = parent->refn; -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 81c9eab8529b6..6bf5fb12395ac 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -296,6 +296,51 @@ out_unlock: - return ret; - } - -+/* -+ * Calling iter_file_splice_write() directly from overlay's f_op may deadlock -+ * due to lock order inversion between pipe->mutex in iter_file_splice_write() -+ * and file_start_write(real.file) in ovl_write_iter(). -+ * -+ * So do everything ovl_write_iter() does and call iter_file_splice_write() on -+ * the real file. -+ */ -+static ssize_t ovl_splice_write(struct pipe_inode_info *pipe, struct file *out, -+ loff_t *ppos, size_t len, unsigned int flags) -+{ -+ struct fd real; -+ const struct cred *old_cred; -+ struct inode *inode = file_inode(out); -+ struct inode *realinode = ovl_inode_real(inode); -+ ssize_t ret; -+ -+ inode_lock(inode); -+ /* Update mode */ -+ ovl_copyattr(realinode, inode); -+ ret = file_remove_privs(out); -+ if (ret) -+ goto out_unlock; -+ -+ ret = ovl_real_fdget(out, &real); -+ if (ret) -+ goto out_unlock; -+ -+ old_cred = ovl_override_creds(inode->i_sb); -+ file_start_write(real.file); -+ -+ ret = iter_file_splice_write(pipe, real.file, ppos, len, flags); -+ -+ file_end_write(real.file); -+ /* Update size */ -+ ovl_copyattr(realinode, inode); -+ revert_creds(old_cred); -+ fdput(real); -+ -+out_unlock: -+ inode_unlock(inode); -+ -+ return ret; -+} -+ - static int ovl_fsync(struct file *file, loff_t start, loff_t end, int datasync) - { - struct fd real; -@@ -653,7 +698,7 @@ const struct file_operations ovl_file_operations = { - .unlocked_ioctl = ovl_ioctl, - .compat_ioctl = ovl_compat_ioctl, - .splice_read = generic_file_splice_read, -- .splice_write = iter_file_splice_write, -+ .splice_write = ovl_splice_write, - - .copy_file_range = ovl_copy_file_range, - .remap_file_range = ovl_remap_file_range, -diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c -index c5562c871c8be..1a188fbdf34e5 100644 ---- a/fs/quota/quota_tree.c -+++ b/fs/quota/quota_tree.c -@@ -423,6 +423,7 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot, - quota_error(dquot->dq_sb, "Quota structure has offset to " - "other block (%u) than it should (%u)", blk, - (uint)(dquot->dq_off >> info->dqi_blocksize_bits)); -+ ret = -EIO; - goto out_buf; - } - ret = read_blk(info, blk, buf); -@@ -488,6 +489,13 @@ static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot, - goto out_buf; - } - newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); -+ if (newblk < QT_TREEOFF || newblk >= info->dqi_blocks) { -+ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)", -+ newblk, info->dqi_blocks); -+ ret = -EUCLEAN; -+ goto out_buf; -+ } -+ - if (depth == info->dqi_qtree_depth - 1) { - ret = free_dqentry(info, dquot, newblk); - newblk = 0; -@@ -587,6 +595,13 @@ static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info, - blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); - if (!blk) /* No reference? */ - goto out_buf; -+ if (blk < QT_TREEOFF || blk >= info->dqi_blocks) { -+ quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)", -+ blk, info->dqi_blocks); -+ ret = -EUCLEAN; -+ goto out_buf; -+ } -+ - if (depth < info->dqi_qtree_depth - 1) - ret = find_tree_dqentry(info, dquot, blk, depth+1); - else -diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c -index 0caa151cae4ee..efe078fe5d4a9 100644 ---- a/fs/tracefs/inode.c -+++ b/fs/tracefs/inode.c -@@ -427,7 +427,8 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent, - if (unlikely(!inode)) - return failed_creating(dentry); - -- inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO; -+ /* Do not set bits for OTH */ -+ inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP; - inode->i_op = ops; - inode->i_fop = &simple_dir_operations; - -diff --git a/include/linux/console.h b/include/linux/console.h -index d09951d5a94e4..d1d03c9c7a512 100644 ---- a/include/linux/console.h -+++ b/include/linux/console.h -@@ -153,6 +153,8 @@ struct console { - short flags; - short index; - int cflag; -+ uint ispeed; -+ uint ospeed; - void *data; - struct console *next; - }; -diff --git a/include/linux/filter.h b/include/linux/filter.h -index c4f89340f4986..440014875acf4 100644 ---- a/include/linux/filter.h -+++ b/include/linux/filter.h -@@ -952,6 +952,7 @@ extern int bpf_jit_enable; - extern int bpf_jit_harden; - extern int bpf_jit_kallsyms; - extern long bpf_jit_limit; -+extern long bpf_jit_limit_max; - - typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); - -diff --git a/include/linux/libata.h b/include/linux/libata.h -index 3d5adbaf8214f..2e448d65a04c7 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -391,7 +391,7 @@ enum { - /* This should match the actual table size of - * ata_eh_cmd_timeout_table in libata-eh.c. - */ -- ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 6, -+ ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 7, - - /* Horkage types. May be set by libata or controller on drives - (some horkage may be drive/controller pair dependent */ -diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h -index a3763247547c3..a21dc5413653e 100644 ---- a/include/linux/lsm_hooks.h -+++ b/include/linux/lsm_hooks.h -@@ -1241,22 +1241,22 @@ - * - * @binder_set_context_mgr: - * Check whether @mgr is allowed to be the binder context manager. -- * @mgr contains the task_struct for the task being registered. -+ * @mgr contains the struct cred for the current binder process. - * Return 0 if permission is granted. - * @binder_transaction: - * Check whether @from is allowed to invoke a binder transaction call - * to @to. -- * @from contains the task_struct for the sending task. -- * @to contains the task_struct for the receiving task. -+ * @from contains the struct cred for the sending process. -+ * @to contains the struct cred for the receiving process. - * @binder_transfer_binder: - * Check whether @from is allowed to transfer a binder reference to @to. -- * @from contains the task_struct for the sending task. -- * @to contains the task_struct for the receiving task. -+ * @from contains the struct cred for the sending process. -+ * @to contains the struct cred for the receiving process. - * @binder_transfer_file: - * Check whether @from is allowed to transfer @file to @to. -- * @from contains the task_struct for the sending task. -+ * @from contains the struct cred for the sending process. - * @file contains the struct file being transferred. -- * @to contains the task_struct for the receiving task. -+ * @to contains the struct cred for the receiving process. - * - * @ptrace_access_check: - * Check permission before allowing the current process to trace the -@@ -1456,13 +1456,13 @@ - * @what: kernel feature being accessed - */ - union security_list_options { -- int (*binder_set_context_mgr)(struct task_struct *mgr); -- int (*binder_transaction)(struct task_struct *from, -- struct task_struct *to); -- int (*binder_transfer_binder)(struct task_struct *from, -- struct task_struct *to); -- int (*binder_transfer_file)(struct task_struct *from, -- struct task_struct *to, -+ int (*binder_set_context_mgr)(const struct cred *mgr); -+ int (*binder_transaction)(const struct cred *from, -+ const struct cred *to); -+ int (*binder_transfer_binder)(const struct cred *from, -+ const struct cred *to); -+ int (*binder_transfer_file)(const struct cred *from, -+ const struct cred *to, - struct file *file); - - int (*ptrace_access_check)(struct task_struct *child, -diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h -index 9fe156d1c018e..a68972b097b72 100644 ---- a/include/linux/rpmsg.h -+++ b/include/linux/rpmsg.h -@@ -177,7 +177,7 @@ static inline struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev - /* This shouldn't be possible */ - WARN_ON(1); - -- return ERR_PTR(-ENXIO); -+ return NULL; - } - - static inline int rpmsg_send(struct rpmsg_endpoint *ept, void *data, int len) -diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h -index 2413427e439c7..d10150587d819 100644 ---- a/include/linux/sched/task_stack.h -+++ b/include/linux/sched/task_stack.h -@@ -25,7 +25,11 @@ static inline void *task_stack_page(const struct task_struct *task) - - static inline unsigned long *end_of_stack(const struct task_struct *task) - { -+#ifdef CONFIG_STACK_GROWSUP -+ return (unsigned long *)((unsigned long)task->stack + THREAD_SIZE) - 1; -+#else - return task->stack; -+#endif - } - - #elif !defined(__HAVE_THREAD_FUNCTIONS) -diff --git a/include/linux/security.h b/include/linux/security.h -index df90399a8af98..3f6b8195ae9eb 100644 ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -249,13 +249,13 @@ extern int security_init(void); - extern int early_security_init(void); - - /* Security operations */ --int security_binder_set_context_mgr(struct task_struct *mgr); --int security_binder_transaction(struct task_struct *from, -- struct task_struct *to); --int security_binder_transfer_binder(struct task_struct *from, -- struct task_struct *to); --int security_binder_transfer_file(struct task_struct *from, -- struct task_struct *to, struct file *file); -+int security_binder_set_context_mgr(const struct cred *mgr); -+int security_binder_transaction(const struct cred *from, -+ const struct cred *to); -+int security_binder_transfer_binder(const struct cred *from, -+ const struct cred *to); -+int security_binder_transfer_file(const struct cred *from, -+ const struct cred *to, struct file *file); - int security_ptrace_access_check(struct task_struct *child, unsigned int mode); - int security_ptrace_traceme(struct task_struct *parent); - int security_capget(struct task_struct *target, -@@ -481,25 +481,25 @@ static inline int early_security_init(void) - return 0; - } - --static inline int security_binder_set_context_mgr(struct task_struct *mgr) -+static inline int security_binder_set_context_mgr(const struct cred *mgr) - { - return 0; - } - --static inline int security_binder_transaction(struct task_struct *from, -- struct task_struct *to) -+static inline int security_binder_transaction(const struct cred *from, -+ const struct cred *to) - { - return 0; - } - --static inline int security_binder_transfer_binder(struct task_struct *from, -- struct task_struct *to) -+static inline int security_binder_transfer_binder(const struct cred *from, -+ const struct cred *to) - { - return 0; - } - --static inline int security_binder_transfer_file(struct task_struct *from, -- struct task_struct *to, -+static inline int security_binder_transfer_file(const struct cred *from, -+ const struct cred *to, - struct file *file) - { - return 0; -@@ -985,6 +985,11 @@ static inline void security_transfer_creds(struct cred *new, - { - } - -+static inline void security_cred_getsecid(const struct cred *c, u32 *secid) -+{ -+ *secid = 0; -+} -+ - static inline int security_kernel_act_as(struct cred *cred, u32 secid) - { - return 0; -diff --git a/include/net/llc.h b/include/net/llc.h -index df282d9b40170..9c10b121b49b0 100644 ---- a/include/net/llc.h -+++ b/include/net/llc.h -@@ -72,7 +72,9 @@ struct llc_sap { - static inline - struct hlist_head *llc_sk_dev_hash(struct llc_sap *sap, int ifindex) - { -- return &sap->sk_dev_hash[ifindex % LLC_SK_DEV_HASH_ENTRIES]; -+ u32 bucket = hash_32(ifindex, LLC_SK_DEV_HASH_BITS); -+ -+ return &sap->sk_dev_hash[bucket]; - } - - static inline -diff --git a/include/net/neighbour.h b/include/net/neighbour.h -index 2be8d6b0dfb69..b6494e87c897c 100644 ---- a/include/net/neighbour.h -+++ b/include/net/neighbour.h -@@ -253,6 +253,7 @@ static inline void *neighbour_priv(const struct neighbour *n) - #define NEIGH_UPDATE_F_OVERRIDE 0x00000001 - #define NEIGH_UPDATE_F_WEAK_OVERRIDE 0x00000002 - #define NEIGH_UPDATE_F_OVERRIDE_ISROUTER 0x00000004 -+#define NEIGH_UPDATE_F_USE 0x10000000 - #define NEIGH_UPDATE_F_EXT_LEARNED 0x20000000 - #define NEIGH_UPDATE_F_ISROUTER 0x40000000 - #define NEIGH_UPDATE_F_ADMIN 0x80000000 -@@ -505,10 +506,15 @@ static inline int neigh_output(struct neighbour *n, struct sk_buff *skb, - { - const struct hh_cache *hh = &n->hh; - -- if ((n->nud_state & NUD_CONNECTED) && hh->hh_len && !skip_cache) -+ /* n->nud_state and hh->hh_len could be changed under us. -+ * neigh_hh_output() is taking care of the race later. -+ */ -+ if (!skip_cache && -+ (READ_ONCE(n->nud_state) & NUD_CONNECTED) && -+ READ_ONCE(hh->hh_len)) - return neigh_hh_output(hh, skb); -- else -- return n->output(n, skb); -+ -+ return n->output(n, skb); - } - - static inline struct neighbour * -diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h -index 0cb0a4bcb5447..939fda8f97215 100644 ---- a/include/net/sch_generic.h -+++ b/include/net/sch_generic.h -@@ -299,6 +299,8 @@ struct Qdisc_ops { - struct netlink_ext_ack *extack); - void (*attach)(struct Qdisc *sch); - int (*change_tx_queue_len)(struct Qdisc *, unsigned int); -+ void (*change_real_num_tx)(struct Qdisc *sch, -+ unsigned int new_real_tx); - - int (*dump)(struct Qdisc *, struct sk_buff *); - int (*dump_stats)(struct Qdisc *, struct gnet_dump *); -@@ -675,6 +677,8 @@ void qdisc_class_hash_grow(struct Qdisc *, struct Qdisc_class_hash *); - void qdisc_class_hash_destroy(struct Qdisc_class_hash *); - - int dev_qdisc_change_tx_queue_len(struct net_device *dev); -+void dev_qdisc_change_real_num_tx(struct net_device *dev, -+ unsigned int new_real_tx); - void dev_init_scheduler(struct net_device *dev); - void dev_shutdown(struct net_device *dev); - void dev_activate(struct net_device *dev); -diff --git a/include/net/strparser.h b/include/net/strparser.h -index 1d20b98493a10..bec1439bd3be6 100644 ---- a/include/net/strparser.h -+++ b/include/net/strparser.h -@@ -54,10 +54,24 @@ struct strp_msg { - int offset; - }; - -+struct _strp_msg { -+ /* Internal cb structure. struct strp_msg must be first for passing -+ * to upper layer. -+ */ -+ struct strp_msg strp; -+ int accum_len; -+}; -+ -+struct sk_skb_cb { -+#define SK_SKB_CB_PRIV_LEN 20 -+ unsigned char data[SK_SKB_CB_PRIV_LEN]; -+ struct _strp_msg strp; -+}; -+ - static inline struct strp_msg *strp_msg(struct sk_buff *skb) - { - return (struct strp_msg *)((void *)skb->cb + -- offsetof(struct qdisc_skb_cb, data)); -+ offsetof(struct sk_skb_cb, strp)); - } - - /* Structure for an attached lower socket */ -diff --git a/include/net/udp.h b/include/net/udp.h -index fabf507bce5d1..d9d39cc20a847 100644 ---- a/include/net/udp.h -+++ b/include/net/udp.h -@@ -480,8 +480,9 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk, - * CHECKSUM_NONE in __udp_gso_segment. UDP GRO indeed builds partial - * packets in udp_gro_complete_segment. As does UDP GSO, verified by - * udp_send_skb. But when those packets are looped in dev_loopback_xmit -- * their ip_summed is set to CHECKSUM_UNNECESSARY. Reset in this -- * specific case, where PARTIAL is both correct and required. -+ * their ip_summed CHECKSUM_NONE is changed to CHECKSUM_UNNECESSARY. -+ * Reset in this specific case, where PARTIAL is both correct and -+ * required. - */ - if (skb->pkt_type == PACKET_LOOPBACK) - skb->ip_summed = CHECKSUM_PARTIAL; -diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h -index 29d6e93fd15e3..b485d8b0d5a79 100644 ---- a/include/uapi/linux/pci_regs.h -+++ b/include/uapi/linux/pci_regs.h -@@ -502,6 +502,12 @@ - #define PCI_EXP_DEVCTL_URRE 0x0008 /* Unsupported Request Reporting En. */ - #define PCI_EXP_DEVCTL_RELAX_EN 0x0010 /* Enable relaxed ordering */ - #define PCI_EXP_DEVCTL_PAYLOAD 0x00e0 /* Max_Payload_Size */ -+#define PCI_EXP_DEVCTL_PAYLOAD_128B 0x0000 /* 128 Bytes */ -+#define PCI_EXP_DEVCTL_PAYLOAD_256B 0x0020 /* 256 Bytes */ -+#define PCI_EXP_DEVCTL_PAYLOAD_512B 0x0040 /* 512 Bytes */ -+#define PCI_EXP_DEVCTL_PAYLOAD_1024B 0x0060 /* 1024 Bytes */ -+#define PCI_EXP_DEVCTL_PAYLOAD_2048B 0x0080 /* 2048 Bytes */ -+#define PCI_EXP_DEVCTL_PAYLOAD_4096B 0x00a0 /* 4096 Bytes */ - #define PCI_EXP_DEVCTL_EXT_TAG 0x0100 /* Extended Tag Field Enable */ - #define PCI_EXP_DEVCTL_PHANTOM 0x0200 /* Phantom Functions Enable */ - #define PCI_EXP_DEVCTL_AUX_PME 0x0400 /* Auxiliary Power PM Enable */ -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index d9a3d995bd966..1238ef9c569df 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -523,6 +523,7 @@ int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON); - int bpf_jit_harden __read_mostly; - int bpf_jit_kallsyms __read_mostly; - long bpf_jit_limit __read_mostly; -+long bpf_jit_limit_max __read_mostly; - - static __always_inline void - bpf_get_prog_addr_region(const struct bpf_prog *prog, -@@ -759,7 +760,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void) - static int __init bpf_jit_charge_init(void) - { - /* Only used as heuristic here to derive limit. */ -- bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2, -+ bpf_jit_limit_max = bpf_jit_alloc_exec_limit(); -+ bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2, - PAGE_SIZE), LONG_MAX); - return 0; - } -diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c -index ede370ec245d9..1904ffcee0f1e 100644 ---- a/kernel/cgroup/cgroup.c -+++ b/kernel/cgroup/cgroup.c -@@ -1721,6 +1721,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) - struct cgroup *dcgrp = &dst_root->cgrp; - struct cgroup_subsys *ss; - int ssid, i, ret; -+ u16 dfl_disable_ss_mask = 0; - - lockdep_assert_held(&cgroup_mutex); - -@@ -1737,8 +1738,28 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) - /* can't move between two non-dummy roots either */ - if (ss->root != &cgrp_dfl_root && dst_root != &cgrp_dfl_root) - return -EBUSY; -+ -+ /* -+ * Collect ssid's that need to be disabled from default -+ * hierarchy. -+ */ -+ if (ss->root == &cgrp_dfl_root) -+ dfl_disable_ss_mask |= 1 << ssid; -+ - } while_each_subsys_mask(); - -+ if (dfl_disable_ss_mask) { -+ struct cgroup *scgrp = &cgrp_dfl_root.cgrp; -+ -+ /* -+ * Controllers from default hierarchy that need to be rebound -+ * are all disabled together in one go. -+ */ -+ cgrp_dfl_root.subsys_mask &= ~dfl_disable_ss_mask; -+ WARN_ON(cgroup_apply_control(scgrp)); -+ cgroup_finalize_control(scgrp, 0); -+ } -+ - do_each_subsys_mask(ss, ssid, ss_mask) { - struct cgroup_root *src_root = ss->root; - struct cgroup *scgrp = &src_root->cgrp; -@@ -1747,10 +1768,12 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) - - WARN_ON(!css || cgroup_css(dcgrp, ss)); - -- /* disable from the source */ -- src_root->subsys_mask &= ~(1 << ssid); -- WARN_ON(cgroup_apply_control(scgrp)); -- cgroup_finalize_control(scgrp, 0); -+ if (src_root != &cgrp_dfl_root) { -+ /* disable from the source */ -+ src_root->subsys_mask &= ~(1 << ssid); -+ WARN_ON(cgroup_apply_control(scgrp)); -+ cgroup_finalize_control(scgrp, 0); -+ } - - /* rebind */ - RCU_INIT_POINTER(scgrp->subsys[ssid], NULL); -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index a7812c115e487..1668439b269d3 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -2712,14 +2712,13 @@ static const struct file_operations fops_kp = { - static int __init debugfs_kprobe_init(void) - { - struct dentry *dir; -- unsigned int value = 1; - - dir = debugfs_create_dir("kprobes", NULL); - - debugfs_create_file("list", 0400, dir, NULL, - &debugfs_kprobes_operations); - -- debugfs_create_file("enabled", 0600, dir, &value, &fops_kp); -+ debugfs_create_file("enabled", 0600, dir, NULL, &fops_kp); - - debugfs_create_file("blacklist", 0400, dir, NULL, - &debugfs_kprobe_blacklist_ops); -diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c -index 3ec8fd2e80e53..db109d38f301e 100644 ---- a/kernel/locking/lockdep.c -+++ b/kernel/locking/lockdep.c -@@ -830,7 +830,7 @@ look_up_lock_class(const struct lockdep_map *lock, unsigned int subclass) - if (DEBUG_LOCKS_WARN_ON(!irqs_disabled())) - return NULL; - -- hlist_for_each_entry_rcu(class, hash_head, hash_entry) { -+ hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) { - if (class->key == key) { - /* - * Huh! same key, different name? Did someone trample -diff --git a/kernel/power/swap.c b/kernel/power/swap.c -index 0516c422206d8..bcc9769e8a3b5 100644 ---- a/kernel/power/swap.c -+++ b/kernel/power/swap.c -@@ -292,7 +292,7 @@ static int hib_submit_io(int op, int op_flags, pgoff_t page_off, void *addr, - return error; - } - --static blk_status_t hib_wait_io(struct hib_bio_batch *hb) -+static int hib_wait_io(struct hib_bio_batch *hb) - { - wait_event(hb->wait, atomic_read(&hb->count) == 0); - return blk_status_to_errno(hb->error); -@@ -1509,9 +1509,10 @@ end: - int swsusp_check(void) - { - int error; -+ void *holder; - - hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device, -- FMODE_READ, NULL); -+ FMODE_READ | FMODE_EXCL, &holder); - if (!IS_ERR(hib_resume_bdev)) { - set_blocksize(hib_resume_bdev, PAGE_SIZE); - clear_page(swsusp_header); -@@ -1533,7 +1534,7 @@ int swsusp_check(void) - - put: - if (error) -- blkdev_put(hib_resume_bdev, FMODE_READ); -+ blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL); - else - pr_debug("Image signature found, resuming\n"); - } else { -diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h -index df90d4d7ad2e2..4c4d7683a4e5b 100644 ---- a/kernel/rcu/tree_exp.h -+++ b/kernel/rcu/tree_exp.h -@@ -738,7 +738,7 @@ static void sync_sched_exp_online_cleanup(int cpu) - my_cpu = get_cpu(); - /* Quiescent state either not needed or already requested, leave. */ - if (!(READ_ONCE(rnp->expmask) & rdp->grpmask) || -- __this_cpu_read(rcu_data.cpu_no_qs.b.exp)) { -+ rdp->cpu_no_qs.b.exp) { - put_cpu(); - return; - } -diff --git a/kernel/signal.c b/kernel/signal.c -index 8c97fc72d78bd..3f61367fd1685 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -2101,15 +2101,6 @@ static inline bool may_ptrace_stop(void) - return true; - } - --/* -- * Return non-zero if there is a SIGKILL that should be waking us up. -- * Called with the siglock held. -- */ --static bool sigkill_pending(struct task_struct *tsk) --{ -- return sigismember(&tsk->pending.signal, SIGKILL) || -- sigismember(&tsk->signal->shared_pending.signal, SIGKILL); --} - - /* - * This must be called with current->sighand->siglock held. -@@ -2136,17 +2127,16 @@ static void ptrace_stop(int exit_code, int why, int clear_code, kernel_siginfo_t - * calling arch_ptrace_stop, so we must release it now. - * To preserve proper semantics, we must do this before - * any signal bookkeeping like checking group_stop_count. -- * Meanwhile, a SIGKILL could come in before we retake the -- * siglock. That must prevent us from sleeping in TASK_TRACED. -- * So after regaining the lock, we must check for SIGKILL. - */ - spin_unlock_irq(¤t->sighand->siglock); - arch_ptrace_stop(exit_code, info); - spin_lock_irq(¤t->sighand->siglock); -- if (sigkill_pending(current)) -- return; - } - -+ /* -+ * schedule() will not sleep if there is a pending signal that -+ * can awaken the task. -+ */ - set_special_state(TASK_TRACED); - - /* -diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c -index 9e31bfc818ff8..10657b8dc2c2d 100644 ---- a/kernel/trace/tracing_map.c -+++ b/kernel/trace/tracing_map.c -@@ -834,29 +834,35 @@ int tracing_map_init(struct tracing_map *map) - return err; - } - --static int cmp_entries_dup(const struct tracing_map_sort_entry **a, -- const struct tracing_map_sort_entry **b) -+static int cmp_entries_dup(const void *A, const void *B) - { -+ const struct tracing_map_sort_entry *a, *b; - int ret = 0; - -- if (memcmp((*a)->key, (*b)->key, (*a)->elt->map->key_size)) -+ a = *(const struct tracing_map_sort_entry **)A; -+ b = *(const struct tracing_map_sort_entry **)B; -+ -+ if (memcmp(a->key, b->key, a->elt->map->key_size)) - ret = 1; - - return ret; - } - --static int cmp_entries_sum(const struct tracing_map_sort_entry **a, -- const struct tracing_map_sort_entry **b) -+static int cmp_entries_sum(const void *A, const void *B) - { - const struct tracing_map_elt *elt_a, *elt_b; -+ const struct tracing_map_sort_entry *a, *b; - struct tracing_map_sort_key *sort_key; - struct tracing_map_field *field; - tracing_map_cmp_fn_t cmp_fn; - void *val_a, *val_b; - int ret = 0; - -- elt_a = (*a)->elt; -- elt_b = (*b)->elt; -+ a = *(const struct tracing_map_sort_entry **)A; -+ b = *(const struct tracing_map_sort_entry **)B; -+ -+ elt_a = a->elt; -+ elt_b = b->elt; - - sort_key = &elt_a->map->sort_key; - -@@ -873,18 +879,21 @@ static int cmp_entries_sum(const struct tracing_map_sort_entry **a, - return ret; - } - --static int cmp_entries_key(const struct tracing_map_sort_entry **a, -- const struct tracing_map_sort_entry **b) -+static int cmp_entries_key(const void *A, const void *B) - { - const struct tracing_map_elt *elt_a, *elt_b; -+ const struct tracing_map_sort_entry *a, *b; - struct tracing_map_sort_key *sort_key; - struct tracing_map_field *field; - tracing_map_cmp_fn_t cmp_fn; - void *val_a, *val_b; - int ret = 0; - -- elt_a = (*a)->elt; -- elt_b = (*b)->elt; -+ a = *(const struct tracing_map_sort_entry **)A; -+ b = *(const struct tracing_map_sort_entry **)B; -+ -+ elt_a = a->elt; -+ elt_b = b->elt; - - sort_key = &elt_a->map->sort_key; - -@@ -989,10 +998,8 @@ static void sort_secondary(struct tracing_map *map, - struct tracing_map_sort_key *primary_key, - struct tracing_map_sort_key *secondary_key) - { -- int (*primary_fn)(const struct tracing_map_sort_entry **, -- const struct tracing_map_sort_entry **); -- int (*secondary_fn)(const struct tracing_map_sort_entry **, -- const struct tracing_map_sort_entry **); -+ int (*primary_fn)(const void *, const void *); -+ int (*secondary_fn)(const void *, const void *); - unsigned i, start = 0, n_sub = 1; - - if (is_key(map, primary_key->field_idx)) -@@ -1061,8 +1068,7 @@ int tracing_map_sort_entries(struct tracing_map *map, - unsigned int n_sort_keys, - struct tracing_map_sort_entry ***sort_entries) - { -- int (*cmp_entries_fn)(const struct tracing_map_sort_entry **, -- const struct tracing_map_sort_entry **); -+ int (*cmp_entries_fn)(const void *, const void *); - struct tracing_map_sort_entry *sort_entry, **entries; - int i, n_entries, ret; - -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 885d4792abdfc..77e6964ae1a99 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -5302,9 +5302,6 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask) - int ret = -EINVAL; - cpumask_var_t saved_cpumask; - -- if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL)) -- return -ENOMEM; -- - /* - * Not excluding isolated cpus on purpose. - * If the user wishes to include them, we allow that. -@@ -5312,6 +5309,15 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask) - cpumask_and(cpumask, cpumask, cpu_possible_mask); - if (!cpumask_empty(cpumask)) { - apply_wqattrs_lock(); -+ if (cpumask_equal(cpumask, wq_unbound_cpumask)) { -+ ret = 0; -+ goto out_unlock; -+ } -+ -+ if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL)) { -+ ret = -ENOMEM; -+ goto out_unlock; -+ } - - /* save the old wq_unbound_cpumask. */ - cpumask_copy(saved_cpumask, wq_unbound_cpumask); -@@ -5324,10 +5330,11 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask) - if (ret < 0) - cpumask_copy(wq_unbound_cpumask, saved_cpumask); - -+ free_cpumask_var(saved_cpumask); -+out_unlock: - apply_wqattrs_unlock(); - } - -- free_cpumask_var(saved_cpumask); - return ret; - } - -diff --git a/lib/decompress_unxz.c b/lib/decompress_unxz.c -index 25d59a95bd668..abea25310ac73 100644 ---- a/lib/decompress_unxz.c -+++ b/lib/decompress_unxz.c -@@ -167,7 +167,7 @@ - * memeq and memzero are not used much and any remotely sane implementation - * is fast enough. memcpy/memmove speed matters in multi-call mode, but - * the kernel image is decompressed in single-call mode, in which only -- * memcpy speed can matter and only if there is a lot of uncompressible data -+ * memmove speed can matter and only if there is a lot of uncompressible data - * (LZMA2 stores uncompressible chunks in uncompressed form). Thus, the - * functions below should just be kept small; it's probably not worth - * optimizing for speed. -diff --git a/lib/iov_iter.c b/lib/iov_iter.c -index 41b06af195368..957e3e58df652 100644 ---- a/lib/iov_iter.c -+++ b/lib/iov_iter.c -@@ -1302,7 +1302,7 @@ ssize_t iov_iter_get_pages(struct iov_iter *i, - res = get_user_pages_fast(addr, n, - iov_iter_rw(i) != WRITE ? FOLL_WRITE : 0, - pages); -- if (unlikely(res < 0)) -+ if (unlikely(res <= 0)) - return res; - return (res == n ? len : res * PAGE_SIZE) - *start; - 0;}),({ -@@ -1384,8 +1384,9 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i, - return -ENOMEM; - res = get_user_pages_fast(addr, n, - iov_iter_rw(i) != WRITE ? FOLL_WRITE : 0, p); -- if (unlikely(res < 0)) { -+ if (unlikely(res <= 0)) { - kvfree(p); -+ *pages = NULL; - return res; - } - *pages = p; -diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c -index 156f26fdc4c91..dd80989ca5a6b 100644 ---- a/lib/xz/xz_dec_lzma2.c -+++ b/lib/xz/xz_dec_lzma2.c -@@ -387,7 +387,14 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b, - - *left -= copy_size; - -- memcpy(dict->buf + dict->pos, b->in + b->in_pos, copy_size); -+ /* -+ * If doing in-place decompression in single-call mode and the -+ * uncompressed size of the file is larger than the caller -+ * thought (i.e. it is invalid input!), the buffers below may -+ * overlap and cause undefined behavior with memcpy(). -+ * With valid inputs memcpy() would be fine here. -+ */ -+ memmove(dict->buf + dict->pos, b->in + b->in_pos, copy_size); - dict->pos += copy_size; - - if (dict->full < dict->pos) -@@ -397,7 +404,11 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b, - if (dict->pos == dict->end) - dict->pos = 0; - -- memcpy(b->out + b->out_pos, b->in + b->in_pos, -+ /* -+ * Like above but for multi-call mode: use memmove() -+ * to avoid undefined behavior with invalid input. -+ */ -+ memmove(b->out + b->out_pos, b->in + b->in_pos, - copy_size); - } - -@@ -421,6 +432,12 @@ static uint32_t dict_flush(struct dictionary *dict, struct xz_buf *b) - if (dict->pos == dict->end) - dict->pos = 0; - -+ /* -+ * These buffers cannot overlap even if doing in-place -+ * decompression because in multi-call mode dict->buf -+ * has been allocated by us in this file; it's not -+ * provided by the caller like in single-call mode. -+ */ - memcpy(b->out + b->out_pos, dict->buf + dict->start, - copy_size); - } -diff --git a/lib/xz/xz_dec_stream.c b/lib/xz/xz_dec_stream.c -index bd1d182419d7e..0b161f90d8d80 100644 ---- a/lib/xz/xz_dec_stream.c -+++ b/lib/xz/xz_dec_stream.c -@@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s) - * we will accept other check types too, but then the check won't - * be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given. - */ -+ if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX) -+ return XZ_OPTIONS_ERROR; -+ - s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1]; - - #ifdef XZ_DEC_ANY_CHECK -- if (s->check_type > XZ_CHECK_MAX) -- return XZ_OPTIONS_ERROR; -- - if (s->check_type > XZ_CHECK_CRC32) - return XZ_UNSUPPORTED_CHECK; - #else -diff --git a/mm/oom_kill.c b/mm/oom_kill.c -index f1b810ddf2327..dcbb9a28706fc 100644 ---- a/mm/oom_kill.c -+++ b/mm/oom_kill.c -@@ -1114,25 +1114,22 @@ bool out_of_memory(struct oom_control *oc) - } - - /* -- * The pagefault handler calls here because it is out of memory, so kill a -- * memory-hogging task. If oom_lock is held by somebody else, a parallel oom -- * killing is already in progress so do nothing. -+ * The pagefault handler calls here because some allocation has failed. We have -+ * to take care of the memcg OOM here because this is the only safe context without -+ * any locks held but let the oom killer triggered from the allocation context care -+ * about the global OOM. - */ - void pagefault_out_of_memory(void) - { -- struct oom_control oc = { -- .zonelist = NULL, -- .nodemask = NULL, -- .memcg = NULL, -- .gfp_mask = 0, -- .order = 0, -- }; -+ static DEFINE_RATELIMIT_STATE(pfoom_rs, DEFAULT_RATELIMIT_INTERVAL, -+ DEFAULT_RATELIMIT_BURST); - - if (mem_cgroup_oom_synchronize(true)) - return; - -- if (!mutex_trylock(&oom_lock)) -+ if (fatal_signal_pending(current)) - return; -- out_of_memory(&oc); -- mutex_unlock(&oom_lock); -+ -+ if (__ratelimit(&pfoom_rs)) -+ pr_warn("Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF\n"); - } -diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c -index 443b3b1c95818..490e5f3ae614a 100644 ---- a/mm/zsmalloc.c -+++ b/mm/zsmalloc.c -@@ -1835,10 +1835,11 @@ static inline void zs_pool_dec_isolated(struct zs_pool *pool) - VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0); - atomic_long_dec(&pool->isolated_pages); - /* -- * There's no possibility of racing, since wait_for_isolated_drain() -- * checks the isolated count under &class->lock after enqueuing -- * on migration_wait. -+ * Checking pool->destroying must happen after atomic_long_dec() -+ * for pool->isolated_pages above. Paired with the smp_mb() in -+ * zs_unregister_migration(). - */ -+ smp_mb__after_atomic(); - if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying) - wake_up_all(&pool->migration_wait); - } -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index 3f47abf9ef4a6..cd7c0429cddf8 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -116,9 +116,6 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head) - } - - vlan_vid_del(real_dev, vlan->vlan_proto, vlan_id); -- -- /* Get rid of the vlan's reference to real_dev */ -- dev_put(real_dev); - } - - int vlan_check_real_dev(struct net_device *real_dev, -diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c -index 2a78da4072de9..415a29d42cdf0 100644 ---- a/net/8021q/vlan_dev.c -+++ b/net/8021q/vlan_dev.c -@@ -790,6 +790,9 @@ static void vlan_dev_free(struct net_device *dev) - - free_percpu(vlan->vlan_pcpu_stats); - vlan->vlan_pcpu_stats = NULL; -+ -+ /* Get rid of the vlan's reference to real_dev */ -+ dev_put(vlan->real_dev); - } - - void vlan_setup(struct net_device *dev) -diff --git a/net/9p/client.c b/net/9p/client.c -index 1d48afc7033ca..b03fce66eb8de 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -538,6 +538,8 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req) - kfree(ename); - } else { - err = p9pdu_readf(&req->rc, c->proto_version, "d", &ecode); -+ if (err) -+ goto out_err; - err = -ecode; - - p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode); -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index 82e76ff01267a..08e9f332adad3 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -1347,6 +1347,9 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan) - { - struct sock *sk = chan->data; - -+ if (!sk) -+ return; -+ - l2cap_sock_kill(sk); - } - -@@ -1355,6 +1358,9 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) - struct sock *sk = chan->data; - struct sock *parent; - -+ if (!sk) -+ return; -+ - BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); - - /* This callback can be called both for server (BT_LISTEN) -@@ -1538,8 +1544,10 @@ static void l2cap_sock_destruct(struct sock *sk) - { - BT_DBG("sk %p", sk); - -- if (l2cap_pi(sk)->chan) -+ if (l2cap_pi(sk)->chan) { -+ l2cap_pi(sk)->chan->data = NULL; - l2cap_chan_put(l2cap_pi(sk)->chan); -+ } - - if (l2cap_pi(sk)->rx_busy_skb) { - kfree_skb(l2cap_pi(sk)->rx_busy_skb); -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index 1915943bb646a..2c616c1c62958 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -133,6 +133,7 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) - return NULL; - - spin_lock_init(&conn->lock); -+ INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout); - - hcon->sco_data = conn; - conn->hcon = hcon; -@@ -196,11 +197,11 @@ static void sco_conn_del(struct hci_conn *hcon, int err) - sco_chan_del(sk, err); - bh_unlock_sock(sk); - sock_put(sk); -- -- /* Ensure no more work items will run before freeing conn. */ -- cancel_delayed_work_sync(&conn->timeout_work); - } - -+ /* Ensure no more work items will run before freeing conn. */ -+ cancel_delayed_work_sync(&conn->timeout_work); -+ - hcon->sco_data = NULL; - kfree(conn); - } -@@ -213,8 +214,6 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, - sco_pi(sk)->conn = conn; - conn->sk = sk; - -- INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout); -- - if (parent) - bt_accept_enqueue(parent, sk, true); - } -@@ -280,7 +279,8 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk) - return err; - } - --static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len) -+static int sco_send_frame(struct sock *sk, void *buf, int len, -+ unsigned int msg_flags) - { - struct sco_conn *conn = sco_pi(sk)->conn; - struct sk_buff *skb; -@@ -292,15 +292,11 @@ static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len) - - BT_DBG("sk %p len %d", sk, len); - -- skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err); -+ skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err); - if (!skb) - return err; - -- if (memcpy_from_msg(skb_put(skb, len), msg, len)) { -- kfree_skb(skb); -- return -EFAULT; -- } -- -+ memcpy(skb_put(skb, len), buf, len); - hci_send_sco(conn->hcon, skb); - - return len; -@@ -714,6 +710,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, - size_t len) - { - struct sock *sk = sock->sk; -+ void *buf; - int err; - - BT_DBG("sock %p, sk %p", sock, sk); -@@ -725,14 +722,24 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, - if (msg->msg_flags & MSG_OOB) - return -EOPNOTSUPP; - -+ buf = kmalloc(len, GFP_KERNEL); -+ if (!buf) -+ return -ENOMEM; -+ -+ if (memcpy_from_msg(buf, msg, len)) { -+ kfree(buf); -+ return -EFAULT; -+ } -+ - lock_sock(sk); - - if (sk->sk_state == BT_CONNECTED) -- err = sco_send_frame(sk, msg, len); -+ err = sco_send_frame(sk, buf, len, msg->msg_flags); - else - err = -ENOTCONN; - - release_sock(sk); -+ kfree(buf); - return err; - } - -diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c -index 266c189f1e809..ca75d1b8f415c 100644 ---- a/net/can/j1939/main.c -+++ b/net/can/j1939/main.c -@@ -75,6 +75,13 @@ static void j1939_can_recv(struct sk_buff *iskb, void *data) - skcb->addr.pgn = (cf->can_id >> 8) & J1939_PGN_MAX; - /* set default message type */ - skcb->addr.type = J1939_TP; -+ -+ if (!j1939_address_is_valid(skcb->addr.sa)) { -+ netdev_err_once(priv->ndev, "%s: sa is broadcast address, ignoring!\n", -+ __func__); -+ goto done; -+ } -+ - if (j1939_pgn_is_pdu1(skcb->addr.pgn)) { - /* Type 1: with destination address */ - skcb->addr.da = skcb->addr.pgn; -diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c -index 7a54170da09df..811682e06951b 100644 ---- a/net/can/j1939/transport.c -+++ b/net/can/j1939/transport.c -@@ -2065,6 +2065,12 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb) - break; - - case J1939_ETP_CMD_ABORT: /* && J1939_TP_CMD_ABORT */ -+ if (j1939_cb_is_broadcast(skcb)) { -+ netdev_err_once(priv->ndev, "%s: abort to broadcast (%02x), ignoring!\n", -+ __func__, skcb->addr.sa); -+ return; -+ } -+ - if (j1939_tp_im_transmitter(skcb)) - j1939_xtp_rx_abort(priv, skb, true); - -diff --git a/net/core/dev.c b/net/core/dev.c -index e4e492bf72af0..ff336417c9b90 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2589,6 +2589,8 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq) - if (dev->num_tc) - netif_setup_tc(dev, txq); - -+ dev_qdisc_change_real_num_tx(dev, txq); -+ - dev->real_num_tx_queues = txq; - - if (disabling) { -@@ -3487,7 +3489,8 @@ int dev_loopback_xmit(struct net *net, struct sock *sk, struct sk_buff *skb) - skb_reset_mac_header(skb); - __skb_pull(skb, skb_network_offset(skb)); - skb->pkt_type = PACKET_LOOPBACK; -- skb->ip_summed = CHECKSUM_UNNECESSARY; -+ if (skb->ip_summed == CHECKSUM_NONE) -+ skb->ip_summed = CHECKSUM_UNNECESSARY; - WARN_ON(!skb_dst(skb)); - skb_dst_force(skb); - netif_rx_ni(skb); -diff --git a/net/core/filter.c b/net/core/filter.c -index 0e161a6dff7e5..5ebc973ed4c50 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -8356,6 +8356,27 @@ static u32 sk_skb_convert_ctx_access(enum bpf_access_type type, - *insn++ = BPF_LDX_MEM(BPF_SIZEOF(void *), si->dst_reg, - si->src_reg, off); - break; -+ case offsetof(struct __sk_buff, cb[0]) ... -+ offsetofend(struct __sk_buff, cb[4]) - 1: -+ BUILD_BUG_ON(sizeof_field(struct sk_skb_cb, data) < 20); -+ BUILD_BUG_ON((offsetof(struct sk_buff, cb) + -+ offsetof(struct sk_skb_cb, data)) % -+ sizeof(__u64)); -+ -+ prog->cb_access = 1; -+ off = si->off; -+ off -= offsetof(struct __sk_buff, cb[0]); -+ off += offsetof(struct sk_buff, cb); -+ off += offsetof(struct sk_skb_cb, data); -+ if (type == BPF_WRITE) -+ *insn++ = BPF_STX_MEM(BPF_SIZE(si->code), si->dst_reg, -+ si->src_reg, off); -+ else -+ *insn++ = BPF_LDX_MEM(BPF_SIZE(si->code), si->dst_reg, -+ si->src_reg, off); -+ break; -+ -+ - default: - return bpf_convert_ctx_access(type, si, insn_buf, prog, - target_size); -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index f94d405358a21..02e55041a8813 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -380,7 +380,7 @@ EXPORT_SYMBOL(neigh_ifdown); - - static struct neighbour *neigh_alloc(struct neigh_table *tbl, - struct net_device *dev, -- bool exempt_from_gc) -+ u8 flags, bool exempt_from_gc) - { - struct neighbour *n = NULL; - unsigned long now = jiffies; -@@ -413,6 +413,7 @@ do_alloc: - n->updated = n->used = now; - n->nud_state = NUD_NONE; - n->output = neigh_blackhole; -+ n->flags = flags; - seqlock_init(&n->hh.hh_lock); - n->parms = neigh_parms_clone(&tbl->parms); - timer_setup(&n->timer, neigh_timer_handler, 0); -@@ -576,19 +577,18 @@ struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net, - } - EXPORT_SYMBOL(neigh_lookup_nodev); - --static struct neighbour *___neigh_create(struct neigh_table *tbl, -- const void *pkey, -- struct net_device *dev, -- bool exempt_from_gc, bool want_ref) -+static struct neighbour * -+___neigh_create(struct neigh_table *tbl, const void *pkey, -+ struct net_device *dev, u8 flags, -+ bool exempt_from_gc, bool want_ref) - { -- struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev, exempt_from_gc); -- u32 hash_val; -- unsigned int key_len = tbl->key_len; -- int error; -+ u32 hash_val, key_len = tbl->key_len; -+ struct neighbour *n1, *rc, *n; - struct neigh_hash_table *nht; -+ int error; - -+ n = neigh_alloc(tbl, dev, flags, exempt_from_gc); - trace_neigh_create(tbl, dev, pkey, n, exempt_from_gc); -- - if (!n) { - rc = ERR_PTR(-ENOBUFS); - goto out; -@@ -675,7 +675,7 @@ out_neigh_release: - struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey, - struct net_device *dev, bool want_ref) - { -- return ___neigh_create(tbl, pkey, dev, false, want_ref); -+ return ___neigh_create(tbl, pkey, dev, 0, false, want_ref); - } - EXPORT_SYMBOL(__neigh_create); - -@@ -1221,7 +1221,7 @@ static void neigh_update_hhs(struct neighbour *neigh) - lladdr instead of overriding it - if it is different. - NEIGH_UPDATE_F_ADMIN means that the change is administrative. -- -+ NEIGH_UPDATE_F_USE means that the entry is user triggered. - NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing - NTF_ROUTER flag. - NEIGH_UPDATE_F_ISROUTER indicates if the neighbour is known as -@@ -1259,6 +1259,12 @@ static int __neigh_update(struct neighbour *neigh, const u8 *lladdr, - goto out; - - ext_learn_change = neigh_update_ext_learned(neigh, flags, ¬ify); -+ if (flags & NEIGH_UPDATE_F_USE) { -+ new = old & ~NUD_PERMANENT; -+ neigh->nud_state = new; -+ err = 0; -+ goto out; -+ } - - if (!(new & NUD_VALID)) { - neigh_del_timer(neigh); -@@ -1945,7 +1951,9 @@ static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh, - - exempt_from_gc = ndm->ndm_state & NUD_PERMANENT || - ndm->ndm_flags & NTF_EXT_LEARNED; -- neigh = ___neigh_create(tbl, dst, dev, exempt_from_gc, true); -+ neigh = ___neigh_create(tbl, dst, dev, -+ ndm->ndm_flags & NTF_EXT_LEARNED, -+ exempt_from_gc, true); - if (IS_ERR(neigh)) { - err = PTR_ERR(neigh); - goto out; -@@ -1964,22 +1972,20 @@ static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh, - - if (protocol) - neigh->protocol = protocol; -- - if (ndm->ndm_flags & NTF_EXT_LEARNED) - flags |= NEIGH_UPDATE_F_EXT_LEARNED; -- - if (ndm->ndm_flags & NTF_ROUTER) - flags |= NEIGH_UPDATE_F_ISROUTER; -+ if (ndm->ndm_flags & NTF_USE) -+ flags |= NEIGH_UPDATE_F_USE; - -- if (ndm->ndm_flags & NTF_USE) { -+ err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags, -+ NETLINK_CB(skb).portid, extack); -+ if (!err && ndm->ndm_flags & NTF_USE) { - neigh_event_send(neigh, NULL); - err = 0; -- } else -- err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags, -- NETLINK_CB(skb).portid, extack); -- -+ } - neigh_release(neigh); -- - out: - return err; - } -diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c -index 98474d85fb51f..05b0c60bfba2b 100644 ---- a/net/core/net-sysfs.c -+++ b/net/core/net-sysfs.c -@@ -174,6 +174,14 @@ static int change_carrier(struct net_device *dev, unsigned long new_carrier) - static ssize_t carrier_store(struct device *dev, struct device_attribute *attr, - const char *buf, size_t len) - { -+ struct net_device *netdev = to_net_dev(dev); -+ -+ /* The check is also done in change_carrier; this helps returning early -+ * without hitting the trylock/restart in netdev_store. -+ */ -+ if (!netdev->netdev_ops->ndo_change_carrier) -+ return -EOPNOTSUPP; -+ - return netdev_store(dev, attr, buf, len, change_carrier); - } - -@@ -195,6 +203,12 @@ static ssize_t speed_show(struct device *dev, - struct net_device *netdev = to_net_dev(dev); - int ret = -EINVAL; - -+ /* The check is also done in __ethtool_get_link_ksettings; this helps -+ * returning early without hitting the trylock/restart below. -+ */ -+ if (!netdev->ethtool_ops->get_link_ksettings) -+ return ret; -+ - if (!rtnl_trylock()) - return restart_syscall(); - -@@ -215,6 +229,12 @@ static ssize_t duplex_show(struct device *dev, - struct net_device *netdev = to_net_dev(dev); - int ret = -EINVAL; - -+ /* The check is also done in __ethtool_get_link_ksettings; this helps -+ * returning early without hitting the trylock/restart below. -+ */ -+ if (!netdev->ethtool_ops->get_link_ksettings) -+ return ret; -+ - if (!rtnl_trylock()) - return restart_syscall(); - -@@ -438,6 +458,14 @@ static ssize_t proto_down_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t len) - { -+ struct net_device *netdev = to_net_dev(dev); -+ -+ /* The check is also done in change_proto_down; this helps returning -+ * early without hitting the trylock/restart in netdev_store. -+ */ -+ if (!netdev->netdev_ops->ndo_change_proto_down) -+ return -EOPNOTSUPP; -+ - return netdev_store(dev, attr, buf, len, change_proto_down); - } - NETDEVICE_SHOW_RW(proto_down, fmt_dec); -@@ -448,6 +476,12 @@ static ssize_t phys_port_id_show(struct device *dev, - struct net_device *netdev = to_net_dev(dev); - ssize_t ret = -EINVAL; - -+ /* The check is also done in dev_get_phys_port_id; this helps returning -+ * early without hitting the trylock/restart below. -+ */ -+ if (!netdev->netdev_ops->ndo_get_phys_port_id) -+ return -EOPNOTSUPP; -+ - if (!rtnl_trylock()) - return restart_syscall(); - -@@ -470,6 +504,13 @@ static ssize_t phys_port_name_show(struct device *dev, - struct net_device *netdev = to_net_dev(dev); - ssize_t ret = -EINVAL; - -+ /* The checks are also done in dev_get_phys_port_name; this helps -+ * returning early without hitting the trylock/restart below. -+ */ -+ if (!netdev->netdev_ops->ndo_get_phys_port_name && -+ !netdev->netdev_ops->ndo_get_devlink_port) -+ return -EOPNOTSUPP; -+ - if (!rtnl_trylock()) - return restart_syscall(); - -@@ -492,6 +533,14 @@ static ssize_t phys_switch_id_show(struct device *dev, - struct net_device *netdev = to_net_dev(dev); - ssize_t ret = -EINVAL; - -+ /* The checks are also done in dev_get_phys_port_name; this helps -+ * returning early without hitting the trylock/restart below. This works -+ * because recurse is false when calling dev_get_port_parent_id. -+ */ -+ if (!netdev->netdev_ops->ndo_get_port_parent_id && -+ !netdev->netdev_ops->ndo_get_devlink_port) -+ return -EOPNOTSUPP; -+ - if (!rtnl_trylock()) - return restart_syscall(); - -@@ -1097,6 +1146,12 @@ static ssize_t tx_maxrate_store(struct netdev_queue *queue, - if (!capable(CAP_NET_ADMIN)) - return -EPERM; - -+ /* The check is also done later; this helps returning early without -+ * hitting the trylock/restart below. -+ */ -+ if (!dev->netdev_ops->ndo_set_tx_maxrate) -+ return -EOPNOTSUPP; -+ - err = kstrtou32(buf, 10, &rate); - if (err < 0) - return err; -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index 9bf15512601bf..cd1d40195e461 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -480,7 +480,9 @@ struct net *copy_net_ns(unsigned long flags, - - if (rv < 0) { - put_userns: -+#ifdef CONFIG_KEYS - key_remove_domain(net->key_domain); -+#endif - put_user_ns(user_ns); - net_drop_ns(net); - dec_ucounts: -@@ -612,7 +614,9 @@ static void cleanup_net(struct work_struct *work) - list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) { - list_del_init(&net->exit_list); - dec_net_namespaces(net->ucounts); -+#ifdef CONFIG_KEYS - key_remove_domain(net->key_domain); -+#endif - put_user_ns(net->user_ns); - net_drop_ns(net); - } -diff --git a/net/core/stream.c b/net/core/stream.c -index 4f1d4aa5fb38d..a166a32b411fa 100644 ---- a/net/core/stream.c -+++ b/net/core/stream.c -@@ -195,9 +195,6 @@ void sk_stream_kill_queues(struct sock *sk) - /* First the read buffer. */ - __skb_queue_purge(&sk->sk_receive_queue); - -- /* Next, the error queue. */ -- __skb_queue_purge(&sk->sk_error_queue); -- - /* Next, the write queue. */ - WARN_ON(!skb_queue_empty(&sk->sk_write_queue)); - -diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c -index 669cbe1609d9e..48041f50ecfb4 100644 ---- a/net/core/sysctl_net_core.c -+++ b/net/core/sysctl_net_core.c -@@ -424,7 +424,7 @@ static struct ctl_table net_core_table[] = { - .mode = 0600, - .proc_handler = proc_dolongvec_minmax_bpf_restricted, - .extra1 = &long_one, -- .extra2 = &long_max, -+ .extra2 = &bpf_jit_limit_max, - }, - #endif - { -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 5c8d0fb498256..9f53d25e047e3 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -955,7 +955,7 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags) - */ - static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb) - { -- if (skb && !skb->len) { -+ if (skb && TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) { - tcp_unlink_write_queue(skb, sk); - if (tcp_write_queue_empty(sk)) - tcp_chrono_stop(sk, TCP_CHRONO_BUSY); -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 366c3792b8604..d1f29a3eb70be 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3111,6 +3111,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev) - memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4); - - if (idev->dev->flags&IFF_POINTOPOINT) { -+ if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE) -+ return; -+ - addr.s6_addr32[0] = htonl(0xfe800000); - scope = IFA_LINK; - plen = 64; -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 0f57c682afdd8..818fc99756256 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -1363,7 +1363,6 @@ do_udp_sendmsg: - if (!fl6.flowi6_oif) - fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex; - -- fl6.flowi6_mark = ipc6.sockc.mark; - fl6.flowi6_uid = sk->sk_uid; - - if (msg->msg_controllen) { -@@ -1399,6 +1398,7 @@ do_udp_sendmsg: - ipc6.opt = opt; - - fl6.flowi6_proto = sk->sk_protocol; -+ fl6.flowi6_mark = ipc6.sockc.mark; - fl6.daddr = *daddr; - if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr)) - fl6.saddr = np->saddr; -diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c -index 7365b43f8f980..e3a2d018f4ec5 100644 ---- a/net/netfilter/nf_conntrack_proto_udp.c -+++ b/net/netfilter/nf_conntrack_proto_udp.c -@@ -105,15 +105,18 @@ int nf_conntrack_udp_packet(struct nf_conn *ct, - */ - if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) { - unsigned long extra = timeouts[UDP_CT_UNREPLIED]; -+ bool stream = false; - - /* Still active after two seconds? Extend timeout. */ -- if (time_after(jiffies, ct->proto.udp.stream_ts)) -+ if (time_after(jiffies, ct->proto.udp.stream_ts)) { - extra = timeouts[UDP_CT_REPLIED]; -+ stream = true; -+ } - - nf_ct_refresh_acct(ct, ctinfo, skb, extra); - - /* Also, more likely to be important, and not a probe */ -- if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status)) -+ if (stream && !test_and_set_bit(IPS_ASSURED_BIT, &ct->status)) - nf_conntrack_event_cache(IPCT_ASSURED, ct); - } else { - nf_ct_refresh_acct(ct, ctinfo, skb, -diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c -index 6f0a2bad8ad5e..a8cb562da3fea 100644 ---- a/net/netfilter/nfnetlink_queue.c -+++ b/net/netfilter/nfnetlink_queue.c -@@ -562,7 +562,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, - goto nla_put_failure; - - if (indev && entskb->dev && -- entskb->mac_header != entskb->network_header) { -+ skb_mac_header_was_set(entskb)) { - struct nfqnl_msg_packet_hw phw; - int len; - -diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c -index 95415d2b81c93..6fdea0e57db8a 100644 ---- a/net/netfilter/nft_dynset.c -+++ b/net/netfilter/nft_dynset.c -@@ -164,17 +164,8 @@ static int nft_dynset_init(const struct nft_ctx *ctx, - return -EBUSY; - - priv->op = ntohl(nla_get_be32(tb[NFTA_DYNSET_OP])); -- switch (priv->op) { -- case NFT_DYNSET_OP_ADD: -- case NFT_DYNSET_OP_DELETE: -- break; -- case NFT_DYNSET_OP_UPDATE: -- if (!(set->flags & NFT_SET_TIMEOUT)) -- return -EOPNOTSUPP; -- break; -- default: -+ if (priv->op > NFT_DYNSET_OP_DELETE) - return -EOPNOTSUPP; -- } - - timeout = 0; - if (tb[NFTA_DYNSET_TIMEOUT] != NULL) { -diff --git a/net/rxrpc/rtt.c b/net/rxrpc/rtt.c -index 928d8b34a3eee..f3f87c9f0209d 100644 ---- a/net/rxrpc/rtt.c -+++ b/net/rxrpc/rtt.c -@@ -23,7 +23,7 @@ static u32 rxrpc_rto_min_us(struct rxrpc_peer *peer) - - static u32 __rxrpc_set_rto(const struct rxrpc_peer *peer) - { -- return _usecs_to_jiffies((peer->srtt_us >> 3) + peer->rttvar_us); -+ return usecs_to_jiffies((peer->srtt_us >> 3) + peer->rttvar_us); - } - - static u32 rxrpc_bound_rto(u32 rto) -diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c -index 9bc5cbe9809b8..d973f8a15e117 100644 ---- a/net/sched/sch_generic.c -+++ b/net/sched/sch_generic.c -@@ -1313,6 +1313,15 @@ static int qdisc_change_tx_queue_len(struct net_device *dev, - return 0; - } - -+void dev_qdisc_change_real_num_tx(struct net_device *dev, -+ unsigned int new_real_tx) -+{ -+ struct Qdisc *qdisc = dev->qdisc; -+ -+ if (qdisc->ops->change_real_num_tx) -+ qdisc->ops->change_real_num_tx(qdisc, new_real_tx); -+} -+ - int dev_qdisc_change_tx_queue_len(struct net_device *dev) - { - bool up = dev->flags & IFF_UP; -diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c -index e79f1afe0cfd6..db18d8a860f9c 100644 ---- a/net/sched/sch_mq.c -+++ b/net/sched/sch_mq.c -@@ -125,6 +125,29 @@ static void mq_attach(struct Qdisc *sch) - priv->qdiscs = NULL; - } - -+static void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx) -+{ -+#ifdef CONFIG_NET_SCHED -+ struct net_device *dev = qdisc_dev(sch); -+ struct Qdisc *qdisc; -+ unsigned int i; -+ -+ for (i = new_real_tx; i < dev->real_num_tx_queues; i++) { -+ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping; -+ /* Only update the default qdiscs we created, -+ * qdiscs with handles are always hashed. -+ */ -+ if (qdisc != &noop_qdisc && !qdisc->handle) -+ qdisc_hash_del(qdisc); -+ } -+ for (i = dev->real_num_tx_queues; i < new_real_tx; i++) { -+ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping; -+ if (qdisc != &noop_qdisc && !qdisc->handle) -+ qdisc_hash_add(qdisc, false); -+ } -+#endif -+} -+ - static int mq_dump(struct Qdisc *sch, struct sk_buff *skb) - { - struct net_device *dev = qdisc_dev(sch); -@@ -288,6 +311,7 @@ struct Qdisc_ops mq_qdisc_ops __read_mostly = { - .init = mq_init, - .destroy = mq_destroy, - .attach = mq_attach, -+ .change_real_num_tx = mq_change_real_num_tx, - .dump = mq_dump, - .owner = THIS_MODULE, - }; -diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c -index 5eb3b1b7ae5e7..50e15add6068f 100644 ---- a/net/sched/sch_mqprio.c -+++ b/net/sched/sch_mqprio.c -@@ -306,6 +306,28 @@ static void mqprio_attach(struct Qdisc *sch) - priv->qdiscs = NULL; - } - -+static void mqprio_change_real_num_tx(struct Qdisc *sch, -+ unsigned int new_real_tx) -+{ -+ struct net_device *dev = qdisc_dev(sch); -+ struct Qdisc *qdisc; -+ unsigned int i; -+ -+ for (i = new_real_tx; i < dev->real_num_tx_queues; i++) { -+ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping; -+ /* Only update the default qdiscs we created, -+ * qdiscs with handles are always hashed. -+ */ -+ if (qdisc != &noop_qdisc && !qdisc->handle) -+ qdisc_hash_del(qdisc); -+ } -+ for (i = dev->real_num_tx_queues; i < new_real_tx; i++) { -+ qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping; -+ if (qdisc != &noop_qdisc && !qdisc->handle) -+ qdisc_hash_add(qdisc, false); -+ } -+} -+ - static struct netdev_queue *mqprio_queue_get(struct Qdisc *sch, - unsigned long cl) - { -@@ -629,6 +651,7 @@ static struct Qdisc_ops mqprio_qdisc_ops __read_mostly = { - .init = mqprio_init, - .destroy = mqprio_destroy, - .attach = mqprio_attach, -+ .change_real_num_tx = mqprio_change_real_num_tx, - .dump = mqprio_dump, - .owner = THIS_MODULE, - }; -diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c -index e14a66ce4884d..b268e61304515 100644 ---- a/net/sched/sch_taprio.c -+++ b/net/sched/sch_taprio.c -@@ -94,18 +94,22 @@ static ktime_t sched_base_time(const struct sched_gate_list *sched) - return ns_to_ktime(sched->base_time); - } - --static ktime_t taprio_get_time(struct taprio_sched *q) -+static ktime_t taprio_mono_to_any(const struct taprio_sched *q, ktime_t mono) - { -- ktime_t mono = ktime_get(); -+ /* This pairs with WRITE_ONCE() in taprio_parse_clockid() */ -+ enum tk_offsets tk_offset = READ_ONCE(q->tk_offset); - -- switch (q->tk_offset) { -+ switch (tk_offset) { - case TK_OFFS_MAX: - return mono; - default: -- return ktime_mono_to_any(mono, q->tk_offset); -+ return ktime_mono_to_any(mono, tk_offset); - } -+} - -- return KTIME_MAX; -+static ktime_t taprio_get_time(const struct taprio_sched *q) -+{ -+ return taprio_mono_to_any(q, ktime_get()); - } - - static void taprio_free_sched_cb(struct rcu_head *head) -@@ -321,7 +325,7 @@ static ktime_t get_tcp_tstamp(struct taprio_sched *q, struct sk_buff *skb) - return 0; - } - -- return ktime_mono_to_any(skb->skb_mstamp_ns, q->tk_offset); -+ return taprio_mono_to_any(q, skb->skb_mstamp_ns); - } - - /* There are a few scenarios where we will have to modify the txtime from -@@ -1342,6 +1346,7 @@ static int taprio_parse_clockid(struct Qdisc *sch, struct nlattr **tb, - } - } else if (tb[TCA_TAPRIO_ATTR_SCHED_CLOCKID]) { - int clockid = nla_get_s32(tb[TCA_TAPRIO_ATTR_SCHED_CLOCKID]); -+ enum tk_offsets tk_offset; - - /* We only support static clockids and we don't allow - * for it to be modified after the first init. -@@ -1356,22 +1361,24 @@ static int taprio_parse_clockid(struct Qdisc *sch, struct nlattr **tb, - - switch (clockid) { - case CLOCK_REALTIME: -- q->tk_offset = TK_OFFS_REAL; -+ tk_offset = TK_OFFS_REAL; - break; - case CLOCK_MONOTONIC: -- q->tk_offset = TK_OFFS_MAX; -+ tk_offset = TK_OFFS_MAX; - break; - case CLOCK_BOOTTIME: -- q->tk_offset = TK_OFFS_BOOT; -+ tk_offset = TK_OFFS_BOOT; - break; - case CLOCK_TAI: -- q->tk_offset = TK_OFFS_TAI; -+ tk_offset = TK_OFFS_TAI; - break; - default: - NL_SET_ERR_MSG(extack, "Invalid 'clockid'"); - err = -EINVAL; - goto out; - } -+ /* This pairs with READ_ONCE() in taprio_mono_to_any */ -+ WRITE_ONCE(q->tk_offset, tk_offset); - - q->clockid = clockid; - } else { -diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c -index 51986f7ead819..6b0f09c5b195f 100644 ---- a/net/smc/af_smc.c -+++ b/net/smc/af_smc.c -@@ -139,14 +139,18 @@ static int __smc_release(struct smc_sock *smc) - sock_set_flag(sk, SOCK_DEAD); - sk->sk_shutdown |= SHUTDOWN_MASK; - } else { -- if (sk->sk_state != SMC_LISTEN && sk->sk_state != SMC_INIT) -- sock_put(sk); /* passive closing */ -- if (sk->sk_state == SMC_LISTEN) { -- /* wake up clcsock accept */ -- rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR); -+ if (sk->sk_state != SMC_CLOSED) { -+ if (sk->sk_state != SMC_LISTEN && -+ sk->sk_state != SMC_INIT) -+ sock_put(sk); /* passive closing */ -+ if (sk->sk_state == SMC_LISTEN) { -+ /* wake up clcsock accept */ -+ rc = kernel_sock_shutdown(smc->clcsock, -+ SHUT_RDWR); -+ } -+ sk->sk_state = SMC_CLOSED; -+ sk->sk_state_change(sk); - } -- sk->sk_state = SMC_CLOSED; -- sk->sk_state_change(sk); - smc_restore_fallback_changes(smc); - } - -@@ -783,7 +787,7 @@ static void smc_connect_work(struct work_struct *work) - if (smc->clcsock->sk->sk_err) { - smc->sk.sk_err = smc->clcsock->sk->sk_err; - } else if ((1 << smc->clcsock->sk->sk_state) & -- (TCPF_SYN_SENT | TCP_SYN_RECV)) { -+ (TCPF_SYN_SENT | TCPF_SYN_RECV)) { - rc = sk_stream_wait_connect(smc->clcsock->sk, &timeo); - if ((rc == -EPIPE) && - ((1 << smc->clcsock->sk->sk_state) & -diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c -index b3815c1e8f2ea..cd9954c4ad808 100644 ---- a/net/strparser/strparser.c -+++ b/net/strparser/strparser.c -@@ -27,18 +27,10 @@ - - static struct workqueue_struct *strp_wq; - --struct _strp_msg { -- /* Internal cb structure. struct strp_msg must be first for passing -- * to upper layer. -- */ -- struct strp_msg strp; -- int accum_len; --}; -- - static inline struct _strp_msg *_strp_msg(struct sk_buff *skb) - { - return (struct _strp_msg *)((void *)skb->cb + -- offsetof(struct qdisc_skb_cb, data)); -+ offsetof(struct sk_skb_cb, strp)); - } - - /* Lower lock held */ -diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c -index 3653898f465ff..93b6afd28405e 100644 ---- a/net/sunrpc/xprt.c -+++ b/net/sunrpc/xprt.c -@@ -1538,15 +1538,14 @@ xprt_transmit(struct rpc_task *task) - { - struct rpc_rqst *next, *req = task->tk_rqstp; - struct rpc_xprt *xprt = req->rq_xprt; -- int counter, status; -+ int status; - - spin_lock(&xprt->queue_lock); -- counter = 0; -- while (!list_empty(&xprt->xmit_queue)) { -- if (++counter == 20) -+ for (;;) { -+ next = list_first_entry_or_null(&xprt->xmit_queue, -+ struct rpc_rqst, rq_xmit); -+ if (!next) - break; -- next = list_first_entry(&xprt->xmit_queue, -- struct rpc_rqst, rq_xmit); - xprt_pin_rqst(next); - spin_unlock(&xprt->queue_lock); - status = xprt_request_transmit(next, task); -@@ -1554,13 +1553,16 @@ xprt_transmit(struct rpc_task *task) - status = 0; - spin_lock(&xprt->queue_lock); - xprt_unpin_rqst(next); -- if (status == 0) { -- if (!xprt_request_data_received(task) || -- test_bit(RPC_TASK_NEED_XMIT, &task->tk_runstate)) -- continue; -- } else if (test_bit(RPC_TASK_NEED_XMIT, &task->tk_runstate)) -- task->tk_status = status; -- break; -+ if (status < 0) { -+ if (test_bit(RPC_TASK_NEED_XMIT, &task->tk_runstate)) -+ task->tk_status = status; -+ break; -+ } -+ /* Was @task transmitted, and has it received a reply? */ -+ if (xprt_request_data_received(task) && -+ !test_bit(RPC_TASK_NEED_XMIT, &task->tk_runstate)) -+ break; -+ cond_resched_lock(&xprt->queue_lock); - } - spin_unlock(&xprt->queue_lock); - } -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index d4104144bab1b..bc8055f4571bc 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -1151,6 +1151,8 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, - * non-blocking call. - */ - err = -EALREADY; -+ if (flags & O_NONBLOCK) -+ goto out; - break; - default: - if ((sk->sk_state == TCP_LISTEN) || -diff --git a/samples/kprobes/kretprobe_example.c b/samples/kprobes/kretprobe_example.c -index 186315ca88b3f..2701549ee7b3a 100644 ---- a/samples/kprobes/kretprobe_example.c -+++ b/samples/kprobes/kretprobe_example.c -@@ -84,7 +84,7 @@ static int __init kretprobe_init(void) - ret = register_kretprobe(&my_kretprobe); - if (ret < 0) { - pr_err("register_kretprobe failed, returned %d\n", ret); -- return -1; -+ return ret; - } - pr_info("Planted return probe at %s: %p\n", - my_kretprobe.kp.symbol_name, my_kretprobe.kp.addr); -diff --git a/scripts/leaking_addresses.pl b/scripts/leaking_addresses.pl -index b2d8b8aa2d99e..8f636a23bc3f2 100755 ---- a/scripts/leaking_addresses.pl -+++ b/scripts/leaking_addresses.pl -@@ -455,8 +455,9 @@ sub parse_file - - open my $fh, "<", $file or return; - while ( <$fh> ) { -+ chomp; - if (may_leak_address($_)) { -- print $file . ': ' . $_; -+ printf("$file: $_\n"); - } - } - close $fh; -diff --git a/security/apparmor/label.c b/security/apparmor/label.c -index 5f324d63ceaa3..747a734a08246 100644 ---- a/security/apparmor/label.c -+++ b/security/apparmor/label.c -@@ -1459,7 +1459,7 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp) - if (label->hname || labels_ns(label) != ns) - return res; - -- if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1) -+ if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0) - return res; - - ls = labels_set(label); -@@ -1709,7 +1709,7 @@ int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label, - - /** - * aa_label_acntsxprint - allocate a __counted string buffer and print label -- * @strp: buffer to write to. (MAY BE NULL if @size == 0) -+ * @strp: buffer to write to. - * @ns: namespace profile is being viewed from - * @label: label to view (NOT NULL) - * @flags: flags controlling what label info is printed -diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c -index 81e3245aec86c..b82291d10e730 100644 ---- a/security/integrity/evm/evm_main.c -+++ b/security/integrity/evm/evm_main.c -@@ -56,7 +56,7 @@ static struct xattr_list evm_config_default_xattrnames[] = { - - LIST_HEAD(evm_config_xattrnames); - --static int evm_fixmode; -+static int evm_fixmode __ro_after_init; - static int __init evm_set_fixmode(char *str) - { - if (strncmp(str, "fix", 3) == 0) -diff --git a/security/security.c b/security/security.c -index 1bc000f834e2d..c34ec4c7d98cc 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -670,25 +670,25 @@ static void __init lsm_early_task(struct task_struct *task) - - /* Security operations */ - --int security_binder_set_context_mgr(struct task_struct *mgr) -+int security_binder_set_context_mgr(const struct cred *mgr) - { - return call_int_hook(binder_set_context_mgr, 0, mgr); - } - --int security_binder_transaction(struct task_struct *from, -- struct task_struct *to) -+int security_binder_transaction(const struct cred *from, -+ const struct cred *to) - { - return call_int_hook(binder_transaction, 0, from, to); - } - --int security_binder_transfer_binder(struct task_struct *from, -- struct task_struct *to) -+int security_binder_transfer_binder(const struct cred *from, -+ const struct cred *to) - { - return call_int_hook(binder_transfer_binder, 0, from, to); - } - --int security_binder_transfer_file(struct task_struct *from, -- struct task_struct *to, struct file *file) -+int security_binder_transfer_file(const struct cred *from, -+ const struct cred *to, struct file *file) - { - return call_int_hook(binder_transfer_file, 0, from, to, file); - } -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 717a398ef4d05..8b9cbe1e8ee22 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -2050,22 +2050,19 @@ static inline u32 open_file_to_av(struct file *file) - - /* Hook functions begin here. */ - --static int selinux_binder_set_context_mgr(struct task_struct *mgr) -+static int selinux_binder_set_context_mgr(const struct cred *mgr) - { -- u32 mysid = current_sid(); -- u32 mgrsid = task_sid(mgr); -- - return avc_has_perm(&selinux_state, -- mysid, mgrsid, SECCLASS_BINDER, -+ current_sid(), cred_sid(mgr), SECCLASS_BINDER, - BINDER__SET_CONTEXT_MGR, NULL); - } - --static int selinux_binder_transaction(struct task_struct *from, -- struct task_struct *to) -+static int selinux_binder_transaction(const struct cred *from, -+ const struct cred *to) - { - u32 mysid = current_sid(); -- u32 fromsid = task_sid(from); -- u32 tosid = task_sid(to); -+ u32 fromsid = cred_sid(from); -+ u32 tosid = cred_sid(to); - int rc; - - if (mysid != fromsid) { -@@ -2076,27 +2073,24 @@ static int selinux_binder_transaction(struct task_struct *from, - return rc; - } - -- return avc_has_perm(&selinux_state, -- fromsid, tosid, SECCLASS_BINDER, BINDER__CALL, -- NULL); -+ return avc_has_perm(&selinux_state, fromsid, tosid, -+ SECCLASS_BINDER, BINDER__CALL, NULL); - } - --static int selinux_binder_transfer_binder(struct task_struct *from, -- struct task_struct *to) -+static int selinux_binder_transfer_binder(const struct cred *from, -+ const struct cred *to) - { -- u32 fromsid = task_sid(from); -- u32 tosid = task_sid(to); -- - return avc_has_perm(&selinux_state, -- fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, -+ cred_sid(from), cred_sid(to), -+ SECCLASS_BINDER, BINDER__TRANSFER, - NULL); - } - --static int selinux_binder_transfer_file(struct task_struct *from, -- struct task_struct *to, -+static int selinux_binder_transfer_file(const struct cred *from, -+ const struct cred *to, - struct file *file) - { -- u32 sid = task_sid(to); -+ u32 sid = cred_sid(to); - struct file_security_struct *fsec = selinux_file(file); - struct dentry *dentry = file->f_path.dentry; - struct inode_security_struct *isec; -diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c -index 3823ab2c4e4be..6b6fec04c412b 100644 ---- a/security/smack/smackfs.c -+++ b/security/smack/smackfs.c -@@ -693,9 +693,7 @@ static void smk_cipso_doi(void) - printk(KERN_WARNING "%s:%d remove rc = %d\n", - __func__, __LINE__, rc); - -- doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL); -- if (doip == NULL) -- panic("smack: Failed to initialize cipso DOI.\n"); -+ doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL | __GFP_NOFAIL); - doip->map.std = NULL; - doip->doi = smk_cipso_doi_value; - doip->type = CIPSO_V4_MAP_PASS; -@@ -714,7 +712,7 @@ static void smk_cipso_doi(void) - if (rc != 0) { - printk(KERN_WARNING "%s:%d map add rc = %d\n", - __func__, __LINE__, rc); -- kfree(doip); -+ netlbl_cfg_cipsov4_del(doip->doi, &nai); - return; - } - } -@@ -831,6 +829,7 @@ static int smk_open_cipso(struct inode *inode, struct file *file) - static ssize_t smk_set_cipso(struct file *file, const char __user *buf, - size_t count, loff_t *ppos, int format) - { -+ struct netlbl_lsm_catmap *old_cat; - struct smack_known *skp; - struct netlbl_lsm_secattr ncats; - char mapcatset[SMK_CIPSOLEN]; -@@ -920,9 +919,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, - - rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN); - if (rc >= 0) { -- netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat); -+ old_cat = skp->smk_netlabel.attr.mls.cat; - skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat; - skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl; -+ synchronize_rcu(); -+ netlbl_catmap_free(old_cat); - rc = count; - } - -diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c -index 7eb54df5556df..50ec8b8ff68c9 100644 ---- a/sound/core/oss/mixer_oss.c -+++ b/sound/core/oss/mixer_oss.c -@@ -130,11 +130,13 @@ static int snd_mixer_oss_devmask(struct snd_mixer_oss_file *fmixer) - - if (mixer == NULL) - return -EIO; -+ mutex_lock(&mixer->reg_mutex); - for (chn = 0; chn < 31; chn++) { - pslot = &mixer->slots[chn]; - if (pslot->put_volume || pslot->put_recsrc) - result |= 1 << chn; - } -+ mutex_unlock(&mixer->reg_mutex); - return result; - } - -@@ -146,11 +148,13 @@ static int snd_mixer_oss_stereodevs(struct snd_mixer_oss_file *fmixer) - - if (mixer == NULL) - return -EIO; -+ mutex_lock(&mixer->reg_mutex); - for (chn = 0; chn < 31; chn++) { - pslot = &mixer->slots[chn]; - if (pslot->put_volume && pslot->stereo) - result |= 1 << chn; - } -+ mutex_unlock(&mixer->reg_mutex); - return result; - } - -@@ -161,6 +165,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer) - - if (mixer == NULL) - return -EIO; -+ mutex_lock(&mixer->reg_mutex); - if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */ - result = mixer->mask_recsrc; - } else { -@@ -172,6 +177,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer) - result |= 1 << chn; - } - } -+ mutex_unlock(&mixer->reg_mutex); - return result; - } - -@@ -182,11 +188,12 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer) - - if (mixer == NULL) - return -EIO; -+ mutex_lock(&mixer->reg_mutex); - if (mixer->put_recsrc && mixer->get_recsrc) { /* exclusive */ -- int err; - unsigned int index; -- if ((err = mixer->get_recsrc(fmixer, &index)) < 0) -- return err; -+ result = mixer->get_recsrc(fmixer, &index); -+ if (result < 0) -+ goto unlock; - result = 1 << index; - } else { - struct snd_mixer_oss_slot *pslot; -@@ -201,7 +208,10 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer) - } - } - } -- return mixer->oss_recsrc = result; -+ mixer->oss_recsrc = result; -+ unlock: -+ mutex_unlock(&mixer->reg_mutex); -+ return result; - } - - static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsrc) -@@ -214,6 +224,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr - - if (mixer == NULL) - return -EIO; -+ mutex_lock(&mixer->reg_mutex); - if (mixer->get_recsrc && mixer->put_recsrc) { /* exclusive input */ - if (recsrc & ~mixer->oss_recsrc) - recsrc &= ~mixer->oss_recsrc; -@@ -239,6 +250,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr - } - } - } -+ mutex_unlock(&mixer->reg_mutex); - return result; - } - -@@ -250,6 +262,7 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot) - - if (mixer == NULL || slot > 30) - return -EIO; -+ mutex_lock(&mixer->reg_mutex); - pslot = &mixer->slots[slot]; - left = pslot->volume[0]; - right = pslot->volume[1]; -@@ -257,15 +270,21 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot) - result = pslot->get_volume(fmixer, pslot, &left, &right); - if (!pslot->stereo) - right = left; -- if (snd_BUG_ON(left < 0 || left > 100)) -- return -EIO; -- if (snd_BUG_ON(right < 0 || right > 100)) -- return -EIO; -+ if (snd_BUG_ON(left < 0 || left > 100)) { -+ result = -EIO; -+ goto unlock; -+ } -+ if (snd_BUG_ON(right < 0 || right > 100)) { -+ result = -EIO; -+ goto unlock; -+ } - if (result >= 0) { - pslot->volume[0] = left; - pslot->volume[1] = right; - result = (left & 0xff) | ((right & 0xff) << 8); - } -+ unlock: -+ mutex_unlock(&mixer->reg_mutex); - return result; - } - -@@ -278,6 +297,7 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer, - - if (mixer == NULL || slot > 30) - return -EIO; -+ mutex_lock(&mixer->reg_mutex); - pslot = &mixer->slots[slot]; - if (left > 100) - left = 100; -@@ -288,10 +308,13 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer, - if (pslot->put_volume) - result = pslot->put_volume(fmixer, pslot, left, right); - if (result < 0) -- return result; -+ goto unlock; - pslot->volume[0] = left; - pslot->volume[1] = right; -- return (left & 0xff) | ((right & 0xff) << 8); -+ result = (left & 0xff) | ((right & 0xff) << 8); -+ unlock: -+ mutex_unlock(&mixer->reg_mutex); -+ return result; - } - - static int snd_mixer_oss_ioctl1(struct snd_mixer_oss_file *fmixer, unsigned int cmd, unsigned long arg) -diff --git a/sound/core/timer.c b/sound/core/timer.c -index b5a0ba79bf746..d684aa4150aad 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -595,13 +595,13 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) - if (!timer) - return -EINVAL; - spin_lock_irqsave(&timer->lock, flags); -+ list_del_init(&timeri->ack_list); -+ list_del_init(&timeri->active_list); - if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING | - SNDRV_TIMER_IFLG_START))) { - result = -EBUSY; - goto unlock; - } -- list_del_init(&timeri->ack_list); -- list_del_init(&timeri->active_list); - if (timer->card && timer->card->shutdown) - goto unlock; - if (stop) { -@@ -636,23 +636,22 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) - static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop) - { - unsigned long flags; -+ bool running; - - spin_lock_irqsave(&slave_active_lock, flags); -- if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) { -- spin_unlock_irqrestore(&slave_active_lock, flags); -- return -EBUSY; -- } -+ running = timeri->flags & SNDRV_TIMER_IFLG_RUNNING; - timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING; - if (timeri->timer) { - spin_lock(&timeri->timer->lock); - list_del_init(&timeri->ack_list); - list_del_init(&timeri->active_list); -- snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : -- SNDRV_TIMER_EVENT_PAUSE); -+ if (running) -+ snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : -+ SNDRV_TIMER_EVENT_PAUSE); - spin_unlock(&timeri->timer->lock); - } - spin_unlock_irqrestore(&slave_active_lock, flags); -- return 0; -+ return running ? 0 : -EBUSY; - } - - /* -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index ebb1ee69dd0c3..95d472d433e70 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -671,13 +671,17 @@ static int azx_position_check(struct azx *chip, struct azx_dev *azx_dev) - * the update-IRQ timing. The IRQ is issued before actually the - * data is processed. So, we need to process it afterwords in a - * workqueue. -+ * -+ * Returns 1 if OK to proceed, 0 for delay handling, -1 for skipping update - */ - static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev) - { - struct snd_pcm_substream *substream = azx_dev->core.substream; -+ struct snd_pcm_runtime *runtime = substream->runtime; - int stream = substream->stream; - u32 wallclk; - unsigned int pos; -+ snd_pcm_uframes_t hwptr, target; - - wallclk = azx_readl(chip, WALLCLK) - azx_dev->core.start_wallclk; - if (wallclk < (azx_dev->core.period_wallclk * 2) / 3) -@@ -714,6 +718,24 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev) - /* NG - it's below the first next period boundary */ - return chip->bdl_pos_adj ? 0 : -1; - azx_dev->core.start_wallclk += wallclk; -+ -+ if (azx_dev->core.no_period_wakeup) -+ return 1; /* OK, no need to check period boundary */ -+ -+ if (runtime->hw_ptr_base != runtime->hw_ptr_interrupt) -+ return 1; /* OK, already in hwptr updating process */ -+ -+ /* check whether the period gets really elapsed */ -+ pos = bytes_to_frames(runtime, pos); -+ hwptr = runtime->hw_ptr_base + pos; -+ if (hwptr < runtime->status->hw_ptr) -+ hwptr += runtime->buffer_size; -+ target = runtime->hw_ptr_interrupt + runtime->period_size; -+ if (hwptr < target) { -+ /* too early wakeup, process it later */ -+ return chip->bdl_pos_adj ? 0 : -1; -+ } -+ - return 1; /* OK, it's fine */ - } - -@@ -907,11 +929,7 @@ static unsigned int azx_get_pos_skl(struct azx *chip, struct azx_dev *azx_dev) - if (azx_dev->core.substream->stream == SNDRV_PCM_STREAM_PLAYBACK) - return azx_skl_get_dpib_pos(chip, azx_dev); - -- /* For capture, we need to read posbuf, but it requires a delay -- * for the possible boundary overlap; the read of DPIB fetches the -- * actual posbuf -- */ -- udelay(20); -+ /* read of DPIB fetches the actual posbuf */ - azx_skl_get_dpib_pos(chip, azx_dev); - return azx_get_pos_posbuf(chip, azx_dev); - } -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 49aefb7875e72..94fc17b28e9c7 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -2541,6 +2541,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), -+ SND_PCI_QUIRK(0x1558, 0x67f1, "Clevo PC70H[PRS]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS), - SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED), -@@ -7976,6 +7977,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), - SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), - SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), -+ SND_PCI_QUIRK(0x1025, 0x141f, "Acer Spin SP513-54N", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), -@@ -8102,6 +8104,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED), - SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED), -+ SND_PCI_QUIRK(0x103c, 0x8728, "HP EliteBook 840 G7", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED), - SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT), - SND_PCI_QUIRK(0x103c, 0x8760, "HP", ALC285_FIXUP_HP_MUTE_LED), -@@ -8132,6 +8135,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC), - SND_PCI_QUIRK(0x1043, 0x194e, "ASUS UX563FD", ALC294_FIXUP_ASUS_HPE), -+ SND_PCI_QUIRK(0x1043, 0x1970, "ASUS UX550VE", ALC289_FIXUP_ASUS_GA401), - SND_PCI_QUIRK(0x1043, 0x1982, "ASUS B1400CEPE", ALC256_FIXUP_ASUS_HPE), - SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE), - SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE), -diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c -index 6825e874785f2..ebee58eca4d51 100644 ---- a/sound/soc/codecs/cs42l42.c -+++ b/sound/soc/codecs/cs42l42.c -@@ -91,7 +91,7 @@ static const struct reg_default cs42l42_reg_defaults[] = { - { CS42L42_ASP_RX_INT_MASK, 0x1F }, - { CS42L42_ASP_TX_INT_MASK, 0x0F }, - { CS42L42_CODEC_INT_MASK, 0x03 }, -- { CS42L42_SRCPL_INT_MASK, 0xFF }, -+ { CS42L42_SRCPL_INT_MASK, 0x7F }, - { CS42L42_VPMON_INT_MASK, 0x01 }, - { CS42L42_PLL_LOCK_INT_MASK, 0x01 }, - { CS42L42_TSRS_PLUG_INT_MASK, 0x0F }, -@@ -128,7 +128,7 @@ static const struct reg_default cs42l42_reg_defaults[] = { - { CS42L42_MIXER_CHA_VOL, 0x3F }, - { CS42L42_MIXER_ADC_VOL, 0x3F }, - { CS42L42_MIXER_CHB_VOL, 0x3F }, -- { CS42L42_EQ_COEF_IN0, 0x22 }, -+ { CS42L42_EQ_COEF_IN0, 0x00 }, - { CS42L42_EQ_COEF_IN1, 0x00 }, - { CS42L42_EQ_COEF_IN2, 0x00 }, - { CS42L42_EQ_COEF_IN3, 0x00 }, -@@ -1798,8 +1798,9 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client, - NULL, cs42l42_irq_thread, - IRQF_ONESHOT | IRQF_TRIGGER_LOW, - "cs42l42", cs42l42); -- -- if (ret != 0) -+ if (ret == -EPROBE_DEFER) -+ goto err_disable; -+ else if (ret != 0) - dev_err(&i2c_client->dev, - "Failed to request IRQ: %d\n", ret); - -diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c -index f65e6c7b139f5..6695530bba9b3 100644 ---- a/sound/synth/emux/emux.c -+++ b/sound/synth/emux/emux.c -@@ -88,7 +88,7 @@ int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, ch - emu->name = kstrdup(name, GFP_KERNEL); - emu->voices = kcalloc(emu->max_voices, sizeof(struct snd_emux_voice), - GFP_KERNEL); -- if (emu->voices == NULL) -+ if (emu->name == NULL || emu->voices == NULL) - return -ENOMEM; - - /* create soundfont list */ -diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c -index 43a2a62d66f7e..49629d4bb327a 100644 ---- a/sound/usb/6fire/comm.c -+++ b/sound/usb/6fire/comm.c -@@ -95,7 +95,7 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev) - int actual_len; - - ret = usb_interrupt_msg(dev, usb_sndintpipe(dev, COMM_EP), -- buffer, buffer[1] + 2, &actual_len, HZ); -+ buffer, buffer[1] + 2, &actual_len, 1000); - if (ret < 0) - return ret; - else if (actual_len != buffer[1] + 2) -diff --git a/sound/usb/6fire/firmware.c b/sound/usb/6fire/firmware.c -index 69137c14d0dcf..2333e8ff3411a 100644 ---- a/sound/usb/6fire/firmware.c -+++ b/sound/usb/6fire/firmware.c -@@ -162,7 +162,7 @@ static int usb6fire_fw_ezusb_write(struct usb_device *device, - - ret = usb_control_msg(device, usb_sndctrlpipe(device, 0), type, - USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, -- value, 0, data, len, HZ); -+ value, 0, data, len, 1000); - if (ret < 0) - return ret; - else if (ret != len) -@@ -175,7 +175,7 @@ static int usb6fire_fw_ezusb_read(struct usb_device *device, - { - int ret = usb_control_msg(device, usb_rcvctrlpipe(device, 0), type, - USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, value, -- 0, data, len, HZ); -+ 0, data, len, 1000); - if (ret < 0) - return ret; - else if (ret != len) -@@ -190,7 +190,7 @@ static int usb6fire_fw_fpga_write(struct usb_device *device, - int ret; - - ret = usb_bulk_msg(device, usb_sndbulkpipe(device, FPGA_EP), data, len, -- &actual_len, HZ); -+ &actual_len, 1000); - if (ret < 0) - return ret; - else if (actual_len != len) -diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c -index 1e38cdda2af69..8ca56ba600cf4 100644 ---- a/sound/usb/line6/driver.c -+++ b/sound/usb/line6/driver.c -@@ -113,12 +113,12 @@ static int line6_send_raw_message(struct usb_line6 *line6, const char *buffer, - retval = usb_interrupt_msg(line6->usbdev, - usb_sndintpipe(line6->usbdev, properties->ep_ctrl_w), - (char *)frag_buf, frag_size, -- &partial, LINE6_TIMEOUT * HZ); -+ &partial, LINE6_TIMEOUT); - } else { - retval = usb_bulk_msg(line6->usbdev, - usb_sndbulkpipe(line6->usbdev, properties->ep_ctrl_w), - (char *)frag_buf, frag_size, -- &partial, LINE6_TIMEOUT * HZ); -+ &partial, LINE6_TIMEOUT); - } - - if (retval) { -@@ -350,7 +350,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, - ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - (datalen << 8) | 0x21, address, -- NULL, 0, LINE6_TIMEOUT * HZ); -+ NULL, 0, LINE6_TIMEOUT); - - if (ret < 0) { - dev_err(line6->ifcdev, "read request failed (error %d)\n", ret); -@@ -365,7 +365,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | - USB_DIR_IN, - 0x0012, 0x0000, len, 1, -- LINE6_TIMEOUT * HZ); -+ LINE6_TIMEOUT); - if (ret < 0) { - dev_err(line6->ifcdev, - "receive length failed (error %d)\n", ret); -@@ -393,7 +393,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data, - ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - 0x0013, 0x0000, data, datalen, -- LINE6_TIMEOUT * HZ); -+ LINE6_TIMEOUT); - - if (ret < 0) - dev_err(line6->ifcdev, "read failed (error %d)\n", ret); -@@ -425,7 +425,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, - ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - 0x0022, address, data, datalen, -- LINE6_TIMEOUT * HZ); -+ LINE6_TIMEOUT); - - if (ret < 0) { - dev_err(line6->ifcdev, -@@ -441,7 +441,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | - USB_DIR_IN, - 0x0012, 0x0000, -- status, 1, LINE6_TIMEOUT * HZ); -+ status, 1, LINE6_TIMEOUT); - - if (ret < 0) { - dev_err(line6->ifcdev, -diff --git a/sound/usb/line6/driver.h b/sound/usb/line6/driver.h -index e5e572ed5f304..890c239e3fc01 100644 ---- a/sound/usb/line6/driver.h -+++ b/sound/usb/line6/driver.h -@@ -27,7 +27,7 @@ - #define LINE6_FALLBACK_INTERVAL 10 - #define LINE6_FALLBACK_MAXPACKETSIZE 16 - --#define LINE6_TIMEOUT 1 -+#define LINE6_TIMEOUT 1000 - #define LINE6_BUFSIZE_LISTEN 64 - #define LINE6_MIDI_MESSAGE_MAXLEN 256 - -diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c -index 5d9954a2d05e6..8b1610bdb8d5c 100644 ---- a/sound/usb/line6/podhd.c -+++ b/sound/usb/line6/podhd.c -@@ -190,7 +190,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) - ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), - 0x67, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - 0x11, 0, -- NULL, 0, LINE6_TIMEOUT * HZ); -+ NULL, 0, LINE6_TIMEOUT); - if (ret < 0) { - dev_err(pod->line6.ifcdev, "read request failed (error %d)\n", ret); - goto exit; -@@ -200,7 +200,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) - ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), 0x67, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - 0x11, 0x0, -- init_bytes, 3, LINE6_TIMEOUT * HZ); -+ init_bytes, 3, LINE6_TIMEOUT); - if (ret < 0) { - dev_err(pod->line6.ifcdev, - "receive length failed (error %d)\n", ret); -@@ -220,7 +220,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod) - USB_REQ_SET_FEATURE, - USB_TYPE_STANDARD | USB_RECIP_DEVICE | USB_DIR_OUT, - 1, 0, -- NULL, 0, LINE6_TIMEOUT * HZ); -+ NULL, 0, LINE6_TIMEOUT); - exit: - kfree(init_bytes); - return ret; -diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c -index d0a555dbe324f..21f86c71dad7f 100644 ---- a/sound/usb/line6/toneport.c -+++ b/sound/usb/line6/toneport.c -@@ -128,7 +128,7 @@ static int toneport_send_cmd(struct usb_device *usbdev, int cmd1, int cmd2) - - ret = usb_control_msg(usbdev, usb_sndctrlpipe(usbdev, 0), 0x67, - USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, -- cmd1, cmd2, NULL, 0, LINE6_TIMEOUT * HZ); -+ cmd1, cmd2, NULL, 0, LINE6_TIMEOUT); - - if (ret < 0) { - dev_err(&usbdev->dev, "send failed (error %d)\n", ret); -diff --git a/sound/usb/misc/ua101.c b/sound/usb/misc/ua101.c -index 307b72d5fffa9..77304a29a61d2 100644 ---- a/sound/usb/misc/ua101.c -+++ b/sound/usb/misc/ua101.c -@@ -1020,7 +1020,7 @@ static int detect_usb_format(struct ua101 *ua) - fmt_playback->bSubframeSize * ua->playback.channels; - - epd = &ua->intf[INTF_CAPTURE]->altsetting[1].endpoint[0].desc; -- if (!usb_endpoint_is_isoc_in(epd)) { -+ if (!usb_endpoint_is_isoc_in(epd) || usb_endpoint_maxp(epd) == 0) { - dev_err(&ua->dev->dev, "invalid capture endpoint\n"); - return -ENXIO; - } -@@ -1028,7 +1028,7 @@ static int detect_usb_format(struct ua101 *ua) - ua->capture.max_packet_bytes = usb_endpoint_maxp(epd); - - epd = &ua->intf[INTF_PLAYBACK]->altsetting[1].endpoint[0].desc; -- if (!usb_endpoint_is_isoc_out(epd)) { -+ if (!usb_endpoint_is_isoc_out(epd) || usb_endpoint_maxp(epd) == 0) { - dev_err(&ua->dev->dev, "invalid playback endpoint\n"); - return -ENXIO; - } -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index d5d828817c5e8..72223545abfd8 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1842,6 +1842,7 @@ static const struct registration_quirk registration_quirks[] = { - REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ - REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ - REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */ -+ REG_QUIRK_ENTRY(0x0ecb, 0x1f4c, 2), /* JBL Quantum 400 */ - REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ - REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ - REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ -diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c -index d606a358480da..41daf0fa95b9f 100644 ---- a/tools/lib/bpf/btf.c -+++ b/tools/lib/bpf/btf.c -@@ -100,22 +100,18 @@ static int btf_parse_hdr(struct btf *btf) - return -EINVAL; - } - -- if (meta_left < hdr->type_off) { -- pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off); -+ if (meta_left < hdr->str_off + hdr->str_len) { -+ pr_debug("Invalid BTF total size:%u\n", btf->data_size); - return -EINVAL; - } - -- if (meta_left < hdr->str_off) { -- pr_debug("Invalid BTF string section offset:%u\n", hdr->str_off); -+ if (hdr->type_off + hdr->type_len > hdr->str_off) { -+ pr_debug("Invalid BTF data sections layout: type data at %u + %u, strings data at %u + %u\n", -+ hdr->type_off, hdr->type_len, hdr->str_off, hdr->str_len); - return -EINVAL; - } - -- if (hdr->type_off >= hdr->str_off) { -- pr_debug("BTF type section offset >= string section offset. No type?\n"); -- return -EINVAL; -- } -- -- if (hdr->type_off & 0x02) { -+ if (hdr->type_off % 4) { - pr_debug("BTF type section is not aligned to 4 bytes\n"); - return -EINVAL; - } -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index f7ed5d122e229..c766813d56be0 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -467,7 +467,7 @@ void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info, - synthesize_bpf_prog_name(name, KSYM_NAME_LEN, info, btf, 0); - fprintf(fp, "# bpf_prog_info %u: %s addr 0x%llx size %u\n", - info->id, name, prog_addrs[0], prog_lens[0]); -- return; -+ goto out; - } - - fprintf(fp, "# bpf_prog_info %u:\n", info->id); -@@ -477,4 +477,6 @@ void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info, - fprintf(fp, "# \tsub_prog %u: %s addr 0x%llx size %u\n", - i, name, prog_addrs[i], prog_lens[i]); - } -+out: -+ btf__free(btf); - } -diff --git a/tools/testing/selftests/bpf/progs/strobemeta.h b/tools/testing/selftests/bpf/progs/strobemeta.h -index 067eb625d01c5..5ba8d39c4d544 100644 ---- a/tools/testing/selftests/bpf/progs/strobemeta.h -+++ b/tools/testing/selftests/bpf/progs/strobemeta.h -@@ -349,7 +349,7 @@ static __always_inline uint64_t read_str_var(struct strobemeta_cfg *cfg, - void *payload) - { - void *location; -- uint32_t len; -+ uint64_t len; - - data->str_lens[idx] = 0; - location = calc_location(&cfg->str_locs[idx], tls_base); -@@ -381,7 +381,7 @@ static __always_inline void *read_map_var(struct strobemeta_cfg *cfg, - struct strobe_map_descr* descr = &data->map_descrs[idx]; - struct strobe_map_raw map; - void *location; -- uint32_t len; -+ uint64_t len; - int i; - - descr->tag_len = 0; /* presume no tag is set */ -diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c -index 48bbe8e0ce48d..4369bc46bf9c2 100644 ---- a/tools/testing/selftests/bpf/test_progs.c -+++ b/tools/testing/selftests/bpf/test_progs.c -@@ -289,7 +289,7 @@ int extract_build_id(char *build_id, size_t size) - - if (getline(&line, &len, fp) == -1) - goto err; -- fclose(fp); -+ pclose(fp); - - if (len > size) - len = size; -@@ -298,7 +298,7 @@ int extract_build_id(char *build_id, size_t size) - free(line); - return 0; - err: -- fclose(fp); -+ pclose(fp); - return -1; - } - -diff --git a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c -index 2cbc09aad7f64..92419b66b0578 100644 ---- a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c -+++ b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c -@@ -84,7 +84,7 @@ int get_warnings_count(void) - f = popen("dmesg | grep \"WARNING:\" | wc -l", "r"); - if (fscanf(f, "%d", &warnings) < 1) - warnings = 0; -- fclose(f); -+ pclose(f); - - return warnings; - } -diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c -index 76a24052f4b47..6a193425c367f 100644 ---- a/tools/testing/selftests/net/udpgso_bench_rx.c -+++ b/tools/testing/selftests/net/udpgso_bench_rx.c -@@ -293,19 +293,17 @@ static void usage(const char *filepath) - - static void parse_opts(int argc, char **argv) - { -+ const char *bind_addr = NULL; - int c; - -- /* bind to any by default */ -- setup_sockaddr(PF_INET6, "::", &cfg_bind_addr); - while ((c = getopt(argc, argv, "4b:C:Gl:n:p:rR:S:tv")) != -1) { - switch (c) { - case '4': - cfg_family = PF_INET; - cfg_alen = sizeof(struct sockaddr_in); -- setup_sockaddr(PF_INET, "0.0.0.0", &cfg_bind_addr); - break; - case 'b': -- setup_sockaddr(cfg_family, optarg, &cfg_bind_addr); -+ bind_addr = optarg; - break; - case 'C': - cfg_connect_timeout_ms = strtoul(optarg, NULL, 0); -@@ -341,6 +339,11 @@ static void parse_opts(int argc, char **argv) - } - } - -+ if (!bind_addr) -+ bind_addr = cfg_family == PF_INET6 ? "::" : "0.0.0.0"; -+ -+ setup_sockaddr(cfg_family, bind_addr, &cfg_bind_addr); -+ - if (optind != argc) - usage(argv[0]); - diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.160-161.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.160-161.patch deleted file mode 100644 index 9c2004cce2..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.160-161.patch +++ /dev/null @@ -1,309 +0,0 @@ -diff --git a/Makefile b/Makefile -index e938662dab289..f552556966f1d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 160 -+SUBLEVEL = 161 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h -index f6136871561dc..9182ce828f540 100644 ---- a/arch/mips/include/asm/cmpxchg.h -+++ b/arch/mips/include/asm/cmpxchg.h -@@ -239,6 +239,7 @@ static inline unsigned long __cmpxchg64(volatile void *ptr, - " .set " MIPS_ISA_ARCH_LEVEL " \n" - /* Load 64 bits from ptr */ - "1: lld %L0, %3 # __cmpxchg64 \n" -+ " .set pop \n" - /* - * Split the 64 bit value we loaded into the 2 registers that hold the - * ret variable. -@@ -266,6 +267,8 @@ static inline unsigned long __cmpxchg64(volatile void *ptr, - " or %L1, %L1, $at \n" - " .set at \n" - # endif -+ " .set push \n" -+ " .set " MIPS_ISA_ARCH_LEVEL " \n" - /* Attempt to store new at ptr */ - " scd %L1, %2 \n" - /* If we failed, loop! */ -diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S -index 7d14e9ae18fb1..2f64f112934b6 100644 ---- a/arch/parisc/kernel/entry.S -+++ b/arch/parisc/kernel/entry.S -@@ -1842,7 +1842,7 @@ syscall_restore: - - /* Are we being ptraced? */ - LDREG TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19 -- ldi _TIF_SYSCALL_TRACE_MASK,%r2 -+ ldi _TIF_SINGLESTEP|_TIF_BLOCKSTEP,%r2 - and,COND(=) %r19,%r2,%r0 - b,n syscall_restore_rfi - -diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c -index c8bd243717b7b..d0cc6c0d74d6b 100644 ---- a/drivers/pci/msi.c -+++ b/drivers/pci/msi.c -@@ -395,18 +395,6 @@ static void free_msi_irqs(struct pci_dev *dev) - for (i = 0; i < entry->nvec_used; i++) - BUG_ON(irq_has_action(entry->irq + i)); - -- pci_msi_teardown_msi_irqs(dev); -- -- list_for_each_entry_safe(entry, tmp, msi_list, list) { -- if (entry->msi_attrib.is_msix) { -- if (list_is_last(&entry->list, msi_list)) -- iounmap(entry->mask_base); -- } -- -- list_del(&entry->list); -- free_msi_entry(entry); -- } -- - if (dev->msi_irq_groups) { - sysfs_remove_groups(&dev->dev.kobj, dev->msi_irq_groups); - msi_attrs = dev->msi_irq_groups[0]->attrs; -@@ -422,6 +410,18 @@ static void free_msi_irqs(struct pci_dev *dev) - kfree(dev->msi_irq_groups); - dev->msi_irq_groups = NULL; - } -+ -+ pci_msi_teardown_msi_irqs(dev); -+ -+ list_for_each_entry_safe(entry, tmp, msi_list, list) { -+ if (entry->msi_attrib.is_msix) { -+ if (list_is_last(&entry->list, msi_list)) -+ iounmap(entry->mask_base); -+ } -+ -+ list_del(&entry->list); -+ free_msi_entry(entry); -+ } - } - - static void pci_intx_for_msi(struct pci_dev *dev, int enable) -@@ -591,6 +591,9 @@ msi_setup_entry(struct pci_dev *dev, int nvec, struct irq_affinity *affd) - goto out; - - pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &control); -+ /* Lies, damned lies, and MSIs */ -+ if (dev->dev_flags & PCI_DEV_FLAGS_HAS_MSI_MASKING) -+ control |= PCI_MSI_FLAGS_MASKBIT; - - entry->msi_attrib.is_msix = 0; - entry->msi_attrib.is_64 = !!(control & PCI_MSI_FLAGS_64BIT); -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index fb7c5518447da..cf3986d4413f7 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -5777,3 +5777,9 @@ static void apex_pci_fixup_class(struct pci_dev *pdev) - } - DECLARE_PCI_FIXUP_CLASS_HEADER(0x1ac1, 0x089a, - PCI_CLASS_NOT_DEFINED, 8, apex_pci_fixup_class); -+ -+static void nvidia_ion_ahci_fixup(struct pci_dev *pdev) -+{ -+ pdev->dev_flags |= PCI_DEV_FLAGS_HAS_MSI_MASKING; -+} -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0ab8, nvidia_ion_ahci_fixup); -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index 24396f4d5f2d3..29c7a76d2c658 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -4748,7 +4748,8 @@ ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp) - break; - } /* end of switch */ - -- if ((host_byte(result) != DID_OK) && !hba->silence_err_logs) -+ if ((host_byte(result) != DID_OK) && -+ (host_byte(result) != DID_REQUEUE) && !hba->silence_err_logs) - ufshcd_print_trs(hba, 1 << lrbp->task_tag, true); - return result; - } -@@ -5661,9 +5662,12 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) - intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS); - } - -- if (retval == IRQ_NONE) { -- dev_err(hba->dev, "%s: Unhandled interrupt 0x%08x\n", -- __func__, intr_status); -+ if (enabled_intr_status && retval == IRQ_NONE && -+ !ufshcd_eh_in_progress(hba)) { -+ dev_err(hba->dev, "%s: Unhandled interrupt 0x%08x (-, 0x%08x)\n", -+ __func__, -+ intr_status, -+ enabled_intr_status); - ufshcd_dump_regs(hba, 0, UFSHCI_REG_SPACE_SIZE, "host_regs: "); - } - -@@ -5705,7 +5709,10 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba, - /* - * blk_get_request() is used here only to get a free tag. - */ -- req = blk_get_request(q, REQ_OP_DRV_OUT, BLK_MQ_REQ_RESERVED); -+ req = blk_get_request(q, REQ_OP_DRV_OUT, 0); -+ if (IS_ERR(req)) -+ return PTR_ERR(req); -+ - req->end_io_data = &wait; - ufshcd_hold(hba, false); - -diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c -index ab75f41e9c0c9..d11320a4dfcf9 100644 ---- a/drivers/soc/tegra/pmc.c -+++ b/drivers/soc/tegra/pmc.c -@@ -579,7 +579,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg, - - err = tegra_powergate_enable_clocks(pg); - if (err) -- goto disable_clks; -+ goto powergate_off; - - usleep_range(10, 20); - -diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c -index fad80c97d2476..fdd18c2508115 100644 ---- a/fs/erofs/zdata.c -+++ b/fs/erofs/zdata.c -@@ -288,11 +288,10 @@ static inline bool z_erofs_try_inplace_io(struct z_erofs_collector *clt, - - /* callers must be with collection lock held */ - static int z_erofs_attach_page(struct z_erofs_collector *clt, -- struct page *page, -- enum z_erofs_page_type type) -+ struct page *page, enum z_erofs_page_type type, -+ bool pvec_safereuse) - { - int ret; -- bool occupied; - - /* give priority for inplaceio */ - if (clt->mode >= COLLECT_PRIMARY && -@@ -300,10 +299,9 @@ static int z_erofs_attach_page(struct z_erofs_collector *clt, - z_erofs_try_inplace_io(clt, page)) - return 0; - -- ret = z_erofs_pagevec_enqueue(&clt->vector, -- page, type, &occupied); -+ ret = z_erofs_pagevec_enqueue(&clt->vector, page, type, -+ pvec_safereuse); - clt->cl->vcnt += (unsigned int)ret; -- - return ret ? 0 : -EAGAIN; - } - -@@ -654,14 +652,15 @@ hitted: - tight &= (clt->mode >= COLLECT_PRIMARY_FOLLOWED); - - retry: -- err = z_erofs_attach_page(clt, page, page_type); -+ err = z_erofs_attach_page(clt, page, page_type, -+ clt->mode >= COLLECT_PRIMARY_FOLLOWED); - /* should allocate an additional staging page for pagevec */ - if (err == -EAGAIN) { - struct page *const newpage = - __stagingpage_alloc(pagepool, GFP_NOFS); - - err = z_erofs_attach_page(clt, newpage, -- Z_EROFS_PAGE_TYPE_EXCLUSIVE); -+ Z_EROFS_PAGE_TYPE_EXCLUSIVE, true); - if (!err) - goto retry; - } -diff --git a/fs/erofs/zpvec.h b/fs/erofs/zpvec.h -index 58556903aa945..6a20b2c3a24cd 100644 ---- a/fs/erofs/zpvec.h -+++ b/fs/erofs/zpvec.h -@@ -108,12 +108,17 @@ static inline void z_erofs_pagevec_ctor_init(struct z_erofs_pagevec_ctor *ctor, - static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor, - struct page *page, - enum z_erofs_page_type type, -- bool *occupied) -+ bool pvec_safereuse) - { -- *occupied = false; -- if (!ctor->next && type) -- if (ctor->index + 1 == ctor->nr) -+ if (!ctor->next) { -+ /* some pages cannot be reused as pvec safely without I/O */ -+ if (type == Z_EROFS_PAGE_TYPE_EXCLUSIVE && !pvec_safereuse) -+ type = Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED; -+ -+ if (type != Z_EROFS_PAGE_TYPE_EXCLUSIVE && -+ ctor->index + 1 == ctor->nr) - return false; -+ } - - if (ctor->index >= ctor->nr) - z_erofs_pagevec_ctor_pagedown(ctor, false); -@@ -125,7 +130,6 @@ static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor, - /* should remind that collector->next never equal to 1, 2 */ - if (type == (uintptr_t)ctor->next) { - ctor->next = page; -- *occupied = true; - } - ctor->pages[ctor->index++] = tagptr_fold(erofs_vtptr_t, page, type); - return true; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 1211ae203face..f68dfef5939f4 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3071,8 +3071,8 @@ static int ext4_run_li_request(struct ext4_li_request *elr) - struct ext4_group_desc *gdp = NULL; - ext4_group_t group, ngroups; - struct super_block *sb; -- unsigned long timeout = 0; - int ret = 0; -+ u64 start_time; - - sb = elr->lr_super; - ngroups = EXT4_SB(sb)->s_groups_count; -@@ -3092,13 +3092,12 @@ static int ext4_run_li_request(struct ext4_li_request *elr) - ret = 1; - - if (!ret) { -- timeout = jiffies; -+ start_time = ktime_get_real_ns(); - ret = ext4_init_inode_table(sb, group, - elr->lr_timeout ? 0 : 1); - if (elr->lr_timeout == 0) { -- timeout = (jiffies - timeout) * -- elr->lr_sbi->s_li_wait_mult; -- elr->lr_timeout = timeout; -+ elr->lr_timeout = nsecs_to_jiffies((ktime_get_real_ns() - start_time) * -+ elr->lr_sbi->s_li_wait_mult); - } - elr->lr_next_sched = jiffies + elr->lr_timeout; - elr->lr_next_group = group + 1; -diff --git a/include/linux/pci.h b/include/linux/pci.h -index 9a937f8b27838..bc35b15efadd0 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -208,6 +208,8 @@ enum pci_dev_flags { - PCI_DEV_FLAGS_NO_FLR_RESET = (__force pci_dev_flags_t) (1 << 10), - /* Don't use Relaxed Ordering for TLPs directed at this device */ - PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 11), -+ /* Device does honor MSI masking despite saying otherwise */ -+ PCI_DEV_FLAGS_HAS_MSI_MASKING = (__force pci_dev_flags_t) (1 << 12), - }; - - enum pci_irq_reroute_variant { -diff --git a/security/Kconfig b/security/Kconfig -index 2a1a2d3962281..52e5109f2c1b6 100644 ---- a/security/Kconfig -+++ b/security/Kconfig -@@ -191,6 +191,9 @@ config HARDENED_USERCOPY_PAGESPAN - config FORTIFY_SOURCE - bool "Harden common str/mem functions against buffer overflows" - depends on ARCH_HAS_FORTIFY_SOURCE -+ # https://bugs.llvm.org/show_bug.cgi?id=50322 -+ # https://bugs.llvm.org/show_bug.cgi?id=41459 -+ depends on !CC_IS_CLANG - help - Detect overflows of buffers in common string and memory functions - where the compiler can determine and validate the buffer sizes. diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.161-162.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.161-162.patch deleted file mode 100644 index fb59fb9210..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.161-162.patch +++ /dev/null @@ -1,3747 +0,0 @@ -diff --git a/Makefile b/Makefile -index f552556966f1d..e8b05f7d3b238 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 161 -+SUBLEVEL = 162 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi -index 43ff85d31dc12..5a1352fd90d16 100644 ---- a/arch/arm/boot/dts/bcm-nsp.dtsi -+++ b/arch/arm/boot/dts/bcm-nsp.dtsi -@@ -77,7 +77,7 @@ - interrupt-affinity = <&cpu0>, <&cpu1>; - }; - -- mpcore@19000000 { -+ mpcore-bus@19000000 { - compatible = "simple-bus"; - ranges = <0x00000000 0x19000000 0x00023000>; - #address-cells = <1>; -@@ -217,7 +217,7 @@ - #dma-cells = <1>; - }; - -- sdio: sdhci@21000 { -+ sdio: mmc@21000 { - compatible = "brcm,sdhci-iproc-cygnus"; - reg = <0x21000 0x100>; - interrupts = ; -diff --git a/arch/arm/boot/dts/ls1021a-tsn.dts b/arch/arm/boot/dts/ls1021a-tsn.dts -index 5b7689094b70e..7235ce2a32936 100644 ---- a/arch/arm/boot/dts/ls1021a-tsn.dts -+++ b/arch/arm/boot/dts/ls1021a-tsn.dts -@@ -247,7 +247,7 @@ - - flash@0 { - /* Rev. A uses 64MB flash, Rev. B & C use 32MB flash */ -- compatible = "jedec,spi-nor", "s25fl256s1", "s25fl512s"; -+ compatible = "jedec,spi-nor"; - spi-max-frequency = <20000000>; - #address-cells = <1>; - #size-cells = <1>; -diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi -index c62fcca7b4263..aeb8a40b6b601 100644 ---- a/arch/arm/boot/dts/ls1021a.dtsi -+++ b/arch/arm/boot/dts/ls1021a.dtsi -@@ -311,39 +311,6 @@ - #thermal-sensor-cells = <1>; - }; - -- thermal-zones { -- cpu_thermal: cpu-thermal { -- polling-delay-passive = <1000>; -- polling-delay = <5000>; -- -- thermal-sensors = <&tmu 0>; -- -- trips { -- cpu_alert: cpu-alert { -- temperature = <85000>; -- hysteresis = <2000>; -- type = "passive"; -- }; -- cpu_crit: cpu-crit { -- temperature = <95000>; -- hysteresis = <2000>; -- type = "critical"; -- }; -- }; -- -- cooling-maps { -- map0 { -- trip = <&cpu_alert>; -- cooling-device = -- <&cpu0 THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>, -- <&cpu1 THERMAL_NO_LIMIT -- THERMAL_NO_LIMIT>; -- }; -- }; -- }; -- }; -- - dspi0: spi@2100000 { - compatible = "fsl,ls1021a-v1.0-dspi"; - #address-cells = <1>; -@@ -984,4 +951,37 @@ - }; - - }; -+ -+ thermal-zones { -+ cpu_thermal: cpu-thermal { -+ polling-delay-passive = <1000>; -+ polling-delay = <5000>; -+ -+ thermal-sensors = <&tmu 0>; -+ -+ trips { -+ cpu_alert: cpu-alert { -+ temperature = <85000>; -+ hysteresis = <2000>; -+ type = "passive"; -+ }; -+ cpu_crit: cpu-crit { -+ temperature = <95000>; -+ hysteresis = <2000>; -+ type = "critical"; -+ }; -+ }; -+ -+ cooling-maps { -+ map0 { -+ trip = <&cpu_alert>; -+ cooling-device = -+ <&cpu0 THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>, -+ <&cpu1 THERMAL_NO_LIMIT -+ THERMAL_NO_LIMIT>; -+ }; -+ }; -+ }; -+ }; - }; -diff --git a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi -index 7f6aefd134514..e7534fe9c53cf 100644 ---- a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi -+++ b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi -@@ -29,7 +29,7 @@ - compatible = "smsc,lan9221","smsc,lan9115"; - bank-width = <2>; - -- gpmc,mux-add-data; -+ gpmc,mux-add-data = <0>; - gpmc,cs-on-ns = <0>; - gpmc,cs-rd-off-ns = <42>; - gpmc,cs-wr-off-ns = <36>; -diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi -index e5da3bc6f1050..218a10c0d8159 100644 ---- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi -+++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi -@@ -22,7 +22,7 @@ - compatible = "smsc,lan9221","smsc,lan9115"; - bank-width = <2>; - -- gpmc,mux-add-data; -+ gpmc,mux-add-data = <0>; - gpmc,cs-on-ns = <0>; - gpmc,cs-rd-off-ns = <42>; - gpmc,cs-wr-off-ns = <36>; -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi -index 407ebdb35cd2e..6b1b728de9e9c 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi -@@ -637,56 +637,56 @@ - }; - - cluster1_core0_watchdog: wdt@c000000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc000000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster1_core1_watchdog: wdt@c010000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc010000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster1_core2_watchdog: wdt@c020000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc020000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster1_core3_watchdog: wdt@c030000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc030000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster2_core0_watchdog: wdt@c100000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc100000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster2_core1_watchdog: wdt@c110000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc110000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster2_core2_watchdog: wdt@c120000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc120000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster2_core3_watchdog: wdt@c130000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc130000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi -index 82f0fe6acbfb7..4bf4a22faa61a 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi -+++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi -@@ -227,56 +227,56 @@ - }; - - cluster1_core0_watchdog: wdt@c000000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc000000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster1_core1_watchdog: wdt@c010000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc010000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster2_core0_watchdog: wdt@c100000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc100000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster2_core1_watchdog: wdt@c110000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc110000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster3_core0_watchdog: wdt@c200000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc200000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster3_core1_watchdog: wdt@c210000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc210000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster4_core0_watchdog: wdt@c300000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc300000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; - }; - - cluster4_core1_watchdog: wdt@c310000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xc310000 0x0 0x1000>; - clocks = <&clockgen 4 3>, <&clockgen 4 3>; - clock-names = "wdog_clk", "apb_pclk"; -diff --git a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi -index 253cc345f143a..0c88b72094774 100644 ---- a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi -+++ b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi -@@ -1086,7 +1086,7 @@ - }; - - watchdog0: watchdog@e8a06000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xe8a06000 0x0 0x1000>; - interrupts = ; - clocks = <&crg_ctrl HI3660_OSC32K>; -@@ -1094,7 +1094,7 @@ - }; - - watchdog1: watchdog@e8a07000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xe8a07000 0x0 0x1000>; - interrupts = ; - clocks = <&crg_ctrl HI3660_OSC32K>; -diff --git a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi -index 108e2a4227f66..568faaba7ace9 100644 ---- a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi -+++ b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi -@@ -839,7 +839,7 @@ - }; - - watchdog0: watchdog@f8005000 { -- compatible = "arm,sp805-wdt", "arm,primecell"; -+ compatible = "arm,sp805", "arm,primecell"; - reg = <0x0 0xf8005000 0x0 0x1000>; - interrupts = ; - clocks = <&ao_ctrl HI6220_WDT0_PCLK>; -diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi -index ccd535edbf4e1..dcb79003ca0e6 100644 ---- a/arch/arm64/boot/dts/qcom/msm8998.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi -@@ -246,38 +246,42 @@ - LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 { - compatible = "arm,idle-state"; - idle-state-name = "little-retention"; -+ /* CPU Retention (C2D), L2 Active */ - arm,psci-suspend-param = <0x00000002>; - entry-latency-us = <81>; - exit-latency-us = <86>; -- min-residency-us = <200>; -+ min-residency-us = <504>; - }; - - LITTLE_CPU_SLEEP_1: cpu-sleep-0-1 { - compatible = "arm,idle-state"; - idle-state-name = "little-power-collapse"; -+ /* CPU + L2 Power Collapse (C3, D4) */ - arm,psci-suspend-param = <0x40000003>; -- entry-latency-us = <273>; -- exit-latency-us = <612>; -- min-residency-us = <1000>; -+ entry-latency-us = <814>; -+ exit-latency-us = <4562>; -+ min-residency-us = <9183>; - local-timer-stop; - }; - - BIG_CPU_SLEEP_0: cpu-sleep-1-0 { - compatible = "arm,idle-state"; - idle-state-name = "big-retention"; -+ /* CPU Retention (C2D), L2 Active */ - arm,psci-suspend-param = <0x00000002>; - entry-latency-us = <79>; - exit-latency-us = <82>; -- min-residency-us = <200>; -+ min-residency-us = <1302>; - }; - - BIG_CPU_SLEEP_1: cpu-sleep-1-1 { - compatible = "arm,idle-state"; - idle-state-name = "big-power-collapse"; -+ /* CPU + L2 Power Collapse (C3, D4) */ - arm,psci-suspend-param = <0x40000003>; -- entry-latency-us = <336>; -- exit-latency-us = <525>; -- min-residency-us = <1000>; -+ entry-latency-us = <724>; -+ exit-latency-us = <2027>; -+ min-residency-us = <9419>; - local-timer-stop; - }; - }; -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts -index 2421ec71a201c..41a66787247b6 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts -+++ b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts -@@ -131,7 +131,7 @@ - reg = <0>; - - partition@0 { -- label = "data"; -+ label = "spi0-data"; - reg = <0x0 0x100000>; - }; - }; -@@ -149,7 +149,7 @@ - reg = <0>; - - partition@0 { -- label = "data"; -+ label = "spi1-data"; - reg = <0x0 0x84000>; - }; - }; -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi -index a2645262f8623..b92549fb32400 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi -+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi -@@ -582,7 +582,7 @@ - }; - - uart0: serial@ff000000 { -- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; -+ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; - status = "disabled"; - interrupt-parent = <&gic>; - interrupts = <0 21 4>; -@@ -591,7 +591,7 @@ - }; - - uart1: serial@ff010000 { -- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; -+ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; - status = "disabled"; - interrupt-parent = <&gic>; - interrupts = <0 22 4>; -diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile -index 40dffe60b8454..894791f03596d 100644 ---- a/arch/arm64/kernel/vdso32/Makefile -+++ b/arch/arm64/kernel/vdso32/Makefile -@@ -32,7 +32,8 @@ cc32-as-instr = $(call try-run,\ - # As a result we set our own flags here. - - # KBUILD_CPPFLAGS and NOSTDINC_FLAGS from top-level Makefile --VDSO_CPPFLAGS := -D__KERNEL__ -nostdinc -isystem $(shell $(CC_COMPAT) -print-file-name=include) -+VDSO_CPPFLAGS := -D__KERNEL__ -nostdinc -+VDSO_CPPFLAGS += -isystem $(shell $(CC_COMPAT) -print-file-name=include 2>/dev/null) - VDSO_CPPFLAGS += $(LINUXINCLUDE) - - # Common C and assembly flags -diff --git a/arch/hexagon/lib/io.c b/arch/hexagon/lib/io.c -index d35d69d6588c4..55f75392857b0 100644 ---- a/arch/hexagon/lib/io.c -+++ b/arch/hexagon/lib/io.c -@@ -27,6 +27,7 @@ void __raw_readsw(const void __iomem *addr, void *data, int len) - *dst++ = *src; - - } -+EXPORT_SYMBOL(__raw_readsw); - - /* - * __raw_writesw - read words a short at a time -@@ -47,6 +48,7 @@ void __raw_writesw(void __iomem *addr, const void *data, int len) - - - } -+EXPORT_SYMBOL(__raw_writesw); - - /* Pretty sure len is pre-adjusted for the length of the access already */ - void __raw_readsl(const void __iomem *addr, void *data, int len) -@@ -62,6 +64,7 @@ void __raw_readsl(const void __iomem *addr, void *data, int len) - - - } -+EXPORT_SYMBOL(__raw_readsl); - - void __raw_writesl(void __iomem *addr, const void *data, int len) - { -@@ -76,3 +79,4 @@ void __raw_writesl(void __iomem *addr, const void *data, int len) - - - } -+EXPORT_SYMBOL(__raw_writesl); -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 041d34975ea2c..9749818eed6d6 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -294,6 +294,9 @@ config BCM63XX - select SYS_SUPPORTS_32BIT_KERNEL - select SYS_SUPPORTS_BIG_ENDIAN - select SYS_HAS_EARLY_PRINTK -+ select SYS_HAS_CPU_BMIPS32_3300 -+ select SYS_HAS_CPU_BMIPS4350 -+ select SYS_HAS_CPU_BMIPS4380 - select SWAP_IO_SPACE - select GPIOLIB - select HAVE_CLK -diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c -index 164115944a7fd..aba6e2d6a736c 100644 ---- a/arch/mips/bcm63xx/clk.c -+++ b/arch/mips/bcm63xx/clk.c -@@ -381,6 +381,12 @@ void clk_disable(struct clk *clk) - - EXPORT_SYMBOL(clk_disable); - -+struct clk *clk_get_parent(struct clk *clk) -+{ -+ return NULL; -+} -+EXPORT_SYMBOL(clk_get_parent); -+ - unsigned long clk_get_rate(struct clk *clk) - { - if (!clk) -diff --git a/arch/mips/generic/yamon-dt.c b/arch/mips/generic/yamon-dt.c -index a3aa22c77cadc..a07a5edbcda78 100644 ---- a/arch/mips/generic/yamon-dt.c -+++ b/arch/mips/generic/yamon-dt.c -@@ -75,7 +75,7 @@ static unsigned int __init gen_fdt_mem_array( - __init int yamon_dt_append_memory(void *fdt, - const struct yamon_mem_region *regions) - { -- unsigned long phys_memsize, memsize; -+ unsigned long phys_memsize = 0, memsize; - __be32 mem_array[2 * MAX_MEM_ARRAY_ENTRIES]; - unsigned int mem_entries; - int i, err, mem_off; -diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c -index dd819e31fcbbf..4916cccf378fd 100644 ---- a/arch/mips/lantiq/clk.c -+++ b/arch/mips/lantiq/clk.c -@@ -158,6 +158,12 @@ void clk_deactivate(struct clk *clk) - } - EXPORT_SYMBOL(clk_deactivate); - -+struct clk *clk_get_parent(struct clk *clk) -+{ -+ return NULL; -+} -+EXPORT_SYMBOL(clk_get_parent); -+ - static inline u32 get_counter_resolution(void) - { - u32 res; -diff --git a/arch/mips/sni/time.c b/arch/mips/sni/time.c -index dbace1f3e1a97..745ceb945fc50 100644 ---- a/arch/mips/sni/time.c -+++ b/arch/mips/sni/time.c -@@ -18,14 +18,14 @@ static int a20r_set_periodic(struct clock_event_device *evt) - { - *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0x34; - wmb(); -- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV; -+ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV & 0xff; - wmb(); - *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV >> 8; - wmb(); - - *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0xb4; - wmb(); -- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV; -+ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV & 0xff; - wmb(); - *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV >> 8; - wmb(); -diff --git a/arch/powerpc/boot/dts/charon.dts b/arch/powerpc/boot/dts/charon.dts -index 408b486b13dff..cd589539f313f 100644 ---- a/arch/powerpc/boot/dts/charon.dts -+++ b/arch/powerpc/boot/dts/charon.dts -@@ -35,7 +35,7 @@ - }; - }; - -- memory { -+ memory@0 { - device_type = "memory"; - reg = <0x00000000 0x08000000>; // 128MB - }; -diff --git a/arch/powerpc/boot/dts/digsy_mtc.dts b/arch/powerpc/boot/dts/digsy_mtc.dts -index 0e5e9d3acf79f..19a14e62e65f4 100644 ---- a/arch/powerpc/boot/dts/digsy_mtc.dts -+++ b/arch/powerpc/boot/dts/digsy_mtc.dts -@@ -16,7 +16,7 @@ - model = "intercontrol,digsy-mtc"; - compatible = "intercontrol,digsy-mtc"; - -- memory { -+ memory@0 { - reg = <0x00000000 0x02000000>; // 32MB - }; - -diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts -index cb2782dd6132c..e7b194775d783 100644 ---- a/arch/powerpc/boot/dts/lite5200.dts -+++ b/arch/powerpc/boot/dts/lite5200.dts -@@ -32,7 +32,7 @@ - }; - }; - -- memory { -+ memory@0 { - device_type = "memory"; - reg = <0x00000000 0x04000000>; // 64MB - }; -diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts -index 2b86c81f90485..547cbe726ff23 100644 ---- a/arch/powerpc/boot/dts/lite5200b.dts -+++ b/arch/powerpc/boot/dts/lite5200b.dts -@@ -31,7 +31,7 @@ - led4 { gpios = <&gpio_simple 2 1>; }; - }; - -- memory { -+ memory@0 { - reg = <0x00000000 0x10000000>; // 256MB - }; - -diff --git a/arch/powerpc/boot/dts/media5200.dts b/arch/powerpc/boot/dts/media5200.dts -index 61cae9dcddef4..f3188018faceb 100644 ---- a/arch/powerpc/boot/dts/media5200.dts -+++ b/arch/powerpc/boot/dts/media5200.dts -@@ -32,7 +32,7 @@ - }; - }; - -- memory { -+ memory@0 { - reg = <0x00000000 0x08000000>; // 128MB RAM - }; - -diff --git a/arch/powerpc/boot/dts/mpc5200b.dtsi b/arch/powerpc/boot/dts/mpc5200b.dtsi -index 648fe31795f49..8b796f3b11da7 100644 ---- a/arch/powerpc/boot/dts/mpc5200b.dtsi -+++ b/arch/powerpc/boot/dts/mpc5200b.dtsi -@@ -33,7 +33,7 @@ - }; - }; - -- memory: memory { -+ memory: memory@0 { - device_type = "memory"; - reg = <0x00000000 0x04000000>; // 64MB - }; -diff --git a/arch/powerpc/boot/dts/o2d.dts b/arch/powerpc/boot/dts/o2d.dts -index 24a46f65e5299..e0a8d3034417f 100644 ---- a/arch/powerpc/boot/dts/o2d.dts -+++ b/arch/powerpc/boot/dts/o2d.dts -@@ -12,7 +12,7 @@ - model = "ifm,o2d"; - compatible = "ifm,o2d"; - -- memory { -+ memory@0 { - reg = <0x00000000 0x08000000>; // 128MB - }; - -diff --git a/arch/powerpc/boot/dts/o2d.dtsi b/arch/powerpc/boot/dts/o2d.dtsi -index 6661955a2be47..b55a9e5bd828c 100644 ---- a/arch/powerpc/boot/dts/o2d.dtsi -+++ b/arch/powerpc/boot/dts/o2d.dtsi -@@ -19,7 +19,7 @@ - model = "ifm,o2d"; - compatible = "ifm,o2d"; - -- memory { -+ memory@0 { - reg = <0x00000000 0x04000000>; // 64MB - }; - -diff --git a/arch/powerpc/boot/dts/o2dnt2.dts b/arch/powerpc/boot/dts/o2dnt2.dts -index eeba7f5507d5d..c2eedbd1f5fcb 100644 ---- a/arch/powerpc/boot/dts/o2dnt2.dts -+++ b/arch/powerpc/boot/dts/o2dnt2.dts -@@ -12,7 +12,7 @@ - model = "ifm,o2dnt2"; - compatible = "ifm,o2d"; - -- memory { -+ memory@0 { - reg = <0x00000000 0x08000000>; // 128MB - }; - -diff --git a/arch/powerpc/boot/dts/o3dnt.dts b/arch/powerpc/boot/dts/o3dnt.dts -index fd00396b0593e..e4c1bdd412716 100644 ---- a/arch/powerpc/boot/dts/o3dnt.dts -+++ b/arch/powerpc/boot/dts/o3dnt.dts -@@ -12,7 +12,7 @@ - model = "ifm,o3dnt"; - compatible = "ifm,o2d"; - -- memory { -+ memory@0 { - reg = <0x00000000 0x04000000>; // 64MB - }; - -diff --git a/arch/powerpc/boot/dts/pcm032.dts b/arch/powerpc/boot/dts/pcm032.dts -index c259c6b3ac5ab..5674f978b9830 100644 ---- a/arch/powerpc/boot/dts/pcm032.dts -+++ b/arch/powerpc/boot/dts/pcm032.dts -@@ -22,7 +22,7 @@ - model = "phytec,pcm032"; - compatible = "phytec,pcm032"; - -- memory { -+ memory@0 { - reg = <0x00000000 0x08000000>; // 128MB - }; - -diff --git a/arch/powerpc/boot/dts/tqm5200.dts b/arch/powerpc/boot/dts/tqm5200.dts -index 9ed0bc78967e1..5bb25a9e40a01 100644 ---- a/arch/powerpc/boot/dts/tqm5200.dts -+++ b/arch/powerpc/boot/dts/tqm5200.dts -@@ -32,7 +32,7 @@ - }; - }; - -- memory { -+ memory@0 { - device_type = "memory"; - reg = <0x00000000 0x04000000>; // 64MB - }; -diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -index f9c7326672b95..c9c6619564ffa 100644 ---- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S -+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -@@ -2535,7 +2535,7 @@ hcall_real_table: - .globl hcall_real_table_end - hcall_real_table_end: - --_GLOBAL(kvmppc_h_set_xdabr) -+_GLOBAL_TOC(kvmppc_h_set_xdabr) - EXPORT_SYMBOL_GPL(kvmppc_h_set_xdabr) - andi. r0, r5, DABRX_USER | DABRX_KERNEL - beq 6f -@@ -2545,7 +2545,7 @@ EXPORT_SYMBOL_GPL(kvmppc_h_set_xdabr) - 6: li r3, H_PARAMETER - blr - --_GLOBAL(kvmppc_h_set_dabr) -+_GLOBAL_TOC(kvmppc_h_set_dabr) - EXPORT_SYMBOL_GPL(kvmppc_h_set_dabr) - li r5, DABRX_USER | DABRX_KERNEL - 3: -diff --git a/arch/powerpc/sysdev/dcr-low.S b/arch/powerpc/sysdev/dcr-low.S -index efeeb1b885a17..329b9c4ae5429 100644 ---- a/arch/powerpc/sysdev/dcr-low.S -+++ b/arch/powerpc/sysdev/dcr-low.S -@@ -11,7 +11,7 @@ - #include - - #define DCR_ACCESS_PROLOG(table) \ -- cmpli cr0,r3,1024; \ -+ cmplwi cr0,r3,1024; \ - rlwinm r3,r3,4,18,27; \ - lis r5,table@h; \ - ori r5,r5,table@l; \ -diff --git a/arch/s390/include/asm/kexec.h b/arch/s390/include/asm/kexec.h -index ea398a05f6432..7f3c9ac34bd8d 100644 ---- a/arch/s390/include/asm/kexec.h -+++ b/arch/s390/include/asm/kexec.h -@@ -74,6 +74,12 @@ void *kexec_file_add_components(struct kimage *image, - int arch_kexec_do_relocs(int r_type, void *loc, unsigned long val, - unsigned long addr); - -+#define ARCH_HAS_KIMAGE_ARCH -+ -+struct kimage_arch { -+ void *ipl_buf; -+}; -+ - extern const struct kexec_file_ops s390_kexec_image_ops; - extern const struct kexec_file_ops s390_kexec_elf_ops; - -diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c -index 6837affc19e81..7795cdee6427d 100644 ---- a/arch/s390/kernel/ipl.c -+++ b/arch/s390/kernel/ipl.c -@@ -1783,7 +1783,7 @@ void *ipl_report_finish(struct ipl_report *report) - - buf = vzalloc(report->size); - if (!buf) -- return ERR_PTR(-ENOMEM); -+ goto out; - ptr = buf; - - memcpy(ptr, report->ipib, report->ipib->hdr.len); -@@ -1822,6 +1822,7 @@ void *ipl_report_finish(struct ipl_report *report) - } - - BUG_ON(ptr > buf + report->size); -+out: - return buf; - } - -diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c -index f9e4baa64b675..e7435f3a3d2d2 100644 ---- a/arch/s390/kernel/machine_kexec_file.c -+++ b/arch/s390/kernel/machine_kexec_file.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -170,6 +171,7 @@ static int kexec_file_add_ipl_report(struct kimage *image, - struct kexec_buf buf; - unsigned long addr; - void *ptr, *end; -+ int ret; - - buf.image = image; - -@@ -199,9 +201,13 @@ static int kexec_file_add_ipl_report(struct kimage *image, - ptr += len; - } - -+ ret = -ENOMEM; - buf.buffer = ipl_report_finish(data->report); -+ if (!buf.buffer) -+ goto out; - buf.bufsz = data->report->size; - buf.memsz = buf.bufsz; -+ image->arch.ipl_buf = buf.buffer; - - data->memsz += buf.memsz; - -@@ -209,7 +215,9 @@ static int kexec_file_add_ipl_report(struct kimage *image, - data->kernel_buf + offsetof(struct lowcore, ipl_parmblock_ptr); - *lc_ipl_parmblock_ptr = (__u32)buf.mem; - -- return kexec_add_buffer(&buf); -+ ret = kexec_add_buffer(&buf); -+out: -+ return ret; - } - - void *kexec_file_add_components(struct kimage *image, -@@ -321,3 +329,11 @@ int arch_kexec_kernel_image_probe(struct kimage *image, void *buf, - - return kexec_image_probe_default(image, buf, buf_len); - } -+ -+int arch_kimage_file_post_load_cleanup(struct kimage *image) -+{ -+ vfree(image->arch.ipl_buf); -+ image->arch.ipl_buf = NULL; -+ -+ return kexec_image_post_load_cleanup_default(image); -+} -diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug -index 010b6c33bbba2..71acd3d9b9e83 100644 ---- a/arch/sh/Kconfig.debug -+++ b/arch/sh/Kconfig.debug -@@ -58,6 +58,7 @@ config DUMP_CODE - - config DWARF_UNWINDER - bool "Enable the DWARF unwinder for stacktraces" -+ depends on DEBUG_KERNEL - select FRAME_POINTER - depends on SUPERH32 - default n -diff --git a/arch/sh/include/asm/sfp-machine.h b/arch/sh/include/asm/sfp-machine.h -index cbc7cf8c97ce6..2d2423478b71d 100644 ---- a/arch/sh/include/asm/sfp-machine.h -+++ b/arch/sh/include/asm/sfp-machine.h -@@ -13,6 +13,14 @@ - #ifndef _SFP_MACHINE_H - #define _SFP_MACHINE_H - -+#ifdef __BIG_ENDIAN__ -+#define __BYTE_ORDER __BIG_ENDIAN -+#define __LITTLE_ENDIAN 0 -+#else -+#define __BYTE_ORDER __LITTLE_ENDIAN -+#define __BIG_ENDIAN 0 -+#endif -+ - #define _FP_W_TYPE_SIZE 32 - #define _FP_W_TYPE unsigned long - #define _FP_WS_TYPE signed long -diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c -index f8a2bec0f260b..1261dc7b84e8b 100644 ---- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c -+++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c -@@ -73,8 +73,9 @@ static void shx3_prepare_cpus(unsigned int max_cpus) - BUILD_BUG_ON(SMP_MSG_NR >= 8); - - for (i = 0; i < SMP_MSG_NR; i++) -- request_irq(104 + i, ipi_interrupt_handler, -- IRQF_PERCPU, "IPI", (void *)(long)i); -+ if (request_irq(104 + i, ipi_interrupt_handler, -+ IRQF_PERCPU, "IPI", (void *)(long)i)) -+ pr_err("Failed to request irq %d\n", i); - - for (i = 0; i < max_cpus; i++) - set_cpu_present(i, true); -diff --git a/arch/sh/math-emu/math.c b/arch/sh/math-emu/math.c -index e8be0eca0444a..615ba932c398e 100644 ---- a/arch/sh/math-emu/math.c -+++ b/arch/sh/math-emu/math.c -@@ -467,109 +467,6 @@ static int fpu_emulate(u16 code, struct sh_fpu_soft_struct *fregs, struct pt_reg - return id_sys(fregs, regs, code); - } - --/** -- * denormal_to_double - Given denormalized float number, -- * store double float -- * -- * @fpu: Pointer to sh_fpu_soft structure -- * @n: Index to FP register -- */ --static void denormal_to_double(struct sh_fpu_soft_struct *fpu, int n) --{ -- unsigned long du, dl; -- unsigned long x = fpu->fpul; -- int exp = 1023 - 126; -- -- if (x != 0 && (x & 0x7f800000) == 0) { -- du = (x & 0x80000000); -- while ((x & 0x00800000) == 0) { -- x <<= 1; -- exp--; -- } -- x &= 0x007fffff; -- du |= (exp << 20) | (x >> 3); -- dl = x << 29; -- -- fpu->fp_regs[n] = du; -- fpu->fp_regs[n+1] = dl; -- } --} -- --/** -- * ieee_fpe_handler - Handle denormalized number exception -- * -- * @regs: Pointer to register structure -- * -- * Returns 1 when it's handled (should not cause exception). -- */ --static int ieee_fpe_handler(struct pt_regs *regs) --{ -- unsigned short insn = *(unsigned short *)regs->pc; -- unsigned short finsn; -- unsigned long nextpc; -- int nib[4] = { -- (insn >> 12) & 0xf, -- (insn >> 8) & 0xf, -- (insn >> 4) & 0xf, -- insn & 0xf}; -- -- if (nib[0] == 0xb || -- (nib[0] == 0x4 && nib[2] == 0x0 && nib[3] == 0xb)) /* bsr & jsr */ -- regs->pr = regs->pc + 4; -- -- if (nib[0] == 0xa || nib[0] == 0xb) { /* bra & bsr */ -- nextpc = regs->pc + 4 + ((short) ((insn & 0xfff) << 4) >> 3); -- finsn = *(unsigned short *) (regs->pc + 2); -- } else if (nib[0] == 0x8 && nib[1] == 0xd) { /* bt/s */ -- if (regs->sr & 1) -- nextpc = regs->pc + 4 + ((char) (insn & 0xff) << 1); -- else -- nextpc = regs->pc + 4; -- finsn = *(unsigned short *) (regs->pc + 2); -- } else if (nib[0] == 0x8 && nib[1] == 0xf) { /* bf/s */ -- if (regs->sr & 1) -- nextpc = regs->pc + 4; -- else -- nextpc = regs->pc + 4 + ((char) (insn & 0xff) << 1); -- finsn = *(unsigned short *) (regs->pc + 2); -- } else if (nib[0] == 0x4 && nib[3] == 0xb && -- (nib[2] == 0x0 || nib[2] == 0x2)) { /* jmp & jsr */ -- nextpc = regs->regs[nib[1]]; -- finsn = *(unsigned short *) (regs->pc + 2); -- } else if (nib[0] == 0x0 && nib[3] == 0x3 && -- (nib[2] == 0x0 || nib[2] == 0x2)) { /* braf & bsrf */ -- nextpc = regs->pc + 4 + regs->regs[nib[1]]; -- finsn = *(unsigned short *) (regs->pc + 2); -- } else if (insn == 0x000b) { /* rts */ -- nextpc = regs->pr; -- finsn = *(unsigned short *) (regs->pc + 2); -- } else { -- nextpc = regs->pc + 2; -- finsn = insn; -- } -- -- if ((finsn & 0xf1ff) == 0xf0ad) { /* fcnvsd */ -- struct task_struct *tsk = current; -- -- if ((tsk->thread.xstate->softfpu.fpscr & (1 << 17))) { -- /* FPU error */ -- denormal_to_double (&tsk->thread.xstate->softfpu, -- (finsn >> 8) & 0xf); -- tsk->thread.xstate->softfpu.fpscr &= -- ~(FPSCR_CAUSE_MASK | FPSCR_FLAG_MASK); -- task_thread_info(tsk)->status |= TS_USEDFPU; -- } else { -- force_sig_fault(SIGFPE, FPE_FLTINV, -- (void __user *)regs->pc); -- } -- -- regs->pc = nextpc; -- return 1; -- } -- -- return 0; --} -- - /** - * fpu_init - Initialize FPU registers - * @fpu: Pointer to software emulated FPU registers. -diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c -index 9096a1693942d..0f61f46e6086f 100644 ---- a/arch/x86/events/intel/uncore_snbep.c -+++ b/arch/x86/events/intel/uncore_snbep.c -@@ -3479,6 +3479,9 @@ static int skx_cha_hw_config(struct intel_uncore_box *box, struct perf_event *ev - struct hw_perf_event_extra *reg1 = &event->hw.extra_reg; - struct extra_reg *er; - int idx = 0; -+ /* Any of the CHA events may be filtered by Thread/Core-ID.*/ -+ if (event->hw.config & SNBEP_CBO_PMON_CTL_TID_EN) -+ idx = SKX_CHA_MSR_PMON_BOX_FILTER_TID; - - for (er = skx_uncore_cha_extra_regs; er->msr; er++) { - if (er->event != (event->hw.config & er->config_mask)) -@@ -3546,6 +3549,7 @@ static struct event_constraint skx_uncore_iio_constraints[] = { - UNCORE_EVENT_CONSTRAINT(0xc0, 0xc), - UNCORE_EVENT_CONSTRAINT(0xc5, 0xc), - UNCORE_EVENT_CONSTRAINT(0xd4, 0xc), -+ UNCORE_EVENT_CONSTRAINT(0xd5, 0xc), - EVENT_CONSTRAINT_END - }; - -diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c -index 812db1ac8cb11..df4a4a9dc1e84 100644 ---- a/arch/x86/hyperv/hv_init.c -+++ b/arch/x86/hyperv/hv_init.c -@@ -163,6 +163,9 @@ void set_hv_tscchange_cb(void (*cb)(void)) - return; - } - -+ if (!hv_vp_index) -+ return; -+ - hv_reenlightenment_cb = cb; - - /* Make sure callback is registered before we write to MSRs */ -diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c -index 249349f64bfe9..4f6b76bd957ef 100644 ---- a/drivers/base/firmware_loader/main.c -+++ b/drivers/base/firmware_loader/main.c -@@ -98,12 +98,15 @@ static struct firmware_cache fw_cache; - extern struct builtin_fw __start_builtin_fw[]; - extern struct builtin_fw __end_builtin_fw[]; - --static void fw_copy_to_prealloc_buf(struct firmware *fw, -+static bool fw_copy_to_prealloc_buf(struct firmware *fw, - void *buf, size_t size) - { -- if (!buf || size < fw->size) -- return; -+ if (!buf) -+ return true; -+ if (size < fw->size) -+ return false; - memcpy(buf, fw->data, fw->size); -+ return true; - } - - static bool fw_get_builtin_firmware(struct firmware *fw, const char *name, -@@ -115,9 +118,7 @@ static bool fw_get_builtin_firmware(struct firmware *fw, const char *name, - if (strcmp(name, b_fw->name) == 0) { - fw->size = b_fw->size; - fw->data = b_fw->data; -- fw_copy_to_prealloc_buf(fw, buf, size); -- -- return true; -+ return fw_copy_to_prealloc_buf(fw, buf, size); - } - } - -diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c -index af957179b135e..48122f574cb65 100644 ---- a/drivers/clk/clk-ast2600.c -+++ b/drivers/clk/clk-ast2600.c -@@ -48,6 +48,8 @@ static DEFINE_SPINLOCK(aspeed_g6_clk_lock); - static struct clk_hw_onecell_data *aspeed_g6_clk_data; - - static void __iomem *scu_g6_base; -+/* AST2600 revision: A0, A1, A2, etc */ -+static u8 soc_rev; - - /* - * Clocks marked with CLK_IS_CRITICAL: -@@ -190,9 +192,8 @@ static struct clk_hw *ast2600_calc_pll(const char *name, u32 val) - static struct clk_hw *ast2600_calc_apll(const char *name, u32 val) - { - unsigned int mult, div; -- u32 chip_id = readl(scu_g6_base + ASPEED_G6_SILICON_REV); - -- if (((chip_id & CHIP_REVISION_ID) >> 16) >= 2) { -+ if (soc_rev >= 2) { - if (val & BIT(24)) { - /* Pass through mode */ - mult = div = 1; -@@ -664,7 +665,7 @@ static const u32 ast2600_a1_axi_ahb200_tbl[] = { - static void __init aspeed_g6_cc(struct regmap *map) - { - struct clk_hw *hw; -- u32 val, div, divbits, chip_id, axi_div, ahb_div; -+ u32 val, div, divbits, axi_div, ahb_div; - - clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, 25000000); - -@@ -695,8 +696,7 @@ static void __init aspeed_g6_cc(struct regmap *map) - axi_div = 2; - - divbits = (val >> 11) & 0x3; -- regmap_read(map, ASPEED_G6_SILICON_REV, &chip_id); -- if (chip_id & BIT(16)) { -+ if (soc_rev >= 1) { - if (!divbits) { - ahb_div = ast2600_a1_axi_ahb200_tbl[(val >> 8) & 0x3]; - if (val & BIT(16)) -@@ -741,6 +741,8 @@ static void __init aspeed_g6_cc_init(struct device_node *np) - if (!scu_g6_base) - return; - -+ soc_rev = (readl(scu_g6_base + ASPEED_G6_SILICON_REV) & CHIP_REVISION_ID) >> 16; -+ - aspeed_g6_clk_data = kzalloc(struct_size(aspeed_g6_clk_data, hws, - ASPEED_G6_NUM_CLKS), GFP_KERNEL); - if (!aspeed_g6_clk_data) -diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c -index bc931988fe7b2..f3ac5a524f4ed 100644 ---- a/drivers/clk/imx/clk-imx6ul.c -+++ b/drivers/clk/imx/clk-imx6ul.c -@@ -161,7 +161,6 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) - hws[IMX6UL_PLL5_BYPASS] = imx_clk_hw_mux_flags("pll5_bypass", base + 0xa0, 16, 1, pll5_bypass_sels, ARRAY_SIZE(pll5_bypass_sels), CLK_SET_RATE_PARENT); - hws[IMX6UL_PLL6_BYPASS] = imx_clk_hw_mux_flags("pll6_bypass", base + 0xe0, 16, 1, pll6_bypass_sels, ARRAY_SIZE(pll6_bypass_sels), CLK_SET_RATE_PARENT); - hws[IMX6UL_PLL7_BYPASS] = imx_clk_hw_mux_flags("pll7_bypass", base + 0x20, 16, 1, pll7_bypass_sels, ARRAY_SIZE(pll7_bypass_sels), CLK_SET_RATE_PARENT); -- hws[IMX6UL_CLK_CSI_SEL] = imx_clk_hw_mux_flags("csi_sel", base + 0x3c, 9, 2, csi_sels, ARRAY_SIZE(csi_sels), CLK_SET_RATE_PARENT); - - /* Do not bypass PLLs initially */ - clk_set_parent(hws[IMX6UL_PLL1_BYPASS]->clk, hws[IMX6UL_CLK_PLL1]->clk); -@@ -270,6 +269,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) - hws[IMX6UL_CLK_ECSPI_SEL] = imx_clk_hw_mux("ecspi_sel", base + 0x38, 18, 1, ecspi_sels, ARRAY_SIZE(ecspi_sels)); - hws[IMX6UL_CLK_LCDIF_PRE_SEL] = imx_clk_hw_mux_flags("lcdif_pre_sel", base + 0x38, 15, 3, lcdif_pre_sels, ARRAY_SIZE(lcdif_pre_sels), CLK_SET_RATE_PARENT); - hws[IMX6UL_CLK_LCDIF_SEL] = imx_clk_hw_mux("lcdif_sel", base + 0x38, 9, 3, lcdif_sels, ARRAY_SIZE(lcdif_sels)); -+ hws[IMX6UL_CLK_CSI_SEL] = imx_clk_hw_mux("csi_sel", base + 0x3c, 9, 2, csi_sels, ARRAY_SIZE(csi_sels)); - - hws[IMX6UL_CLK_LDB_DI0_DIV_SEL] = imx_clk_hw_mux("ldb_di0", base + 0x20, 10, 1, ldb_di0_div_sels, ARRAY_SIZE(ldb_di0_div_sels)); - hws[IMX6UL_CLK_LDB_DI1_DIV_SEL] = imx_clk_hw_mux("ldb_di1", base + 0x20, 11, 1, ldb_di1_div_sels, ARRAY_SIZE(ldb_di1_div_sels)); -diff --git a/drivers/clk/ingenic/cgu.c b/drivers/clk/ingenic/cgu.c -index 7490d4f4d9366..dff759c0f6193 100644 ---- a/drivers/clk/ingenic/cgu.c -+++ b/drivers/clk/ingenic/cgu.c -@@ -426,15 +426,15 @@ ingenic_clk_calc_div(const struct ingenic_cgu_clk_info *clk_info, - } - - /* Impose hardware constraints */ -- div = min_t(unsigned, div, 1 << clk_info->div.bits); -- div = max_t(unsigned, div, 1); -+ div = clamp_t(unsigned int, div, clk_info->div.div, -+ clk_info->div.div << clk_info->div.bits); - - /* - * If the divider value itself must be divided before being written to - * the divider register, we must ensure we don't have any bits set that - * would be lost as a result of doing so. - */ -- div /= clk_info->div.div; -+ div = DIV_ROUND_UP(div, clk_info->div.div); - div *= clk_info->div.div; - - return div; -diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c -index d004cdaa0e39a..c1e1148f0261d 100644 ---- a/drivers/clk/qcom/gcc-msm8996.c -+++ b/drivers/clk/qcom/gcc-msm8996.c -@@ -2937,20 +2937,6 @@ static struct clk_branch gcc_smmu_aggre0_ahb_clk = { - }, - }; - --static struct clk_branch gcc_aggre1_pnoc_ahb_clk = { -- .halt_reg = 0x82014, -- .clkr = { -- .enable_reg = 0x82014, -- .enable_mask = BIT(0), -- .hw.init = &(struct clk_init_data){ -- .name = "gcc_aggre1_pnoc_ahb_clk", -- .parent_names = (const char *[]){ "periph_noc_clk_src" }, -- .num_parents = 1, -- .ops = &clk_branch2_ops, -- }, -- }, --}; -- - static struct clk_branch gcc_aggre2_ufs_axi_clk = { - .halt_reg = 0x83014, - .clkr = { -@@ -3453,7 +3439,6 @@ static struct clk_regmap *gcc_msm8996_clocks[] = { - [GCC_AGGRE0_CNOC_AHB_CLK] = &gcc_aggre0_cnoc_ahb_clk.clkr, - [GCC_SMMU_AGGRE0_AXI_CLK] = &gcc_smmu_aggre0_axi_clk.clkr, - [GCC_SMMU_AGGRE0_AHB_CLK] = &gcc_smmu_aggre0_ahb_clk.clkr, -- [GCC_AGGRE1_PNOC_AHB_CLK] = &gcc_aggre1_pnoc_ahb_clk.clkr, - [GCC_AGGRE2_UFS_AXI_CLK] = &gcc_aggre2_ufs_axi_clk.clkr, - [GCC_AGGRE2_USB3_AXI_CLK] = &gcc_aggre2_usb3_axi_clk.clkr, - [GCC_QSPI_AHB_CLK] = &gcc_qspi_ahb_clk.clkr, -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -index cda0a76a733d3..0d39e386f6e9c 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -@@ -829,6 +829,7 @@ static int amdgpu_connector_vga_get_modes(struct drm_connector *connector) - - amdgpu_connector_get_edid(connector); - ret = amdgpu_connector_ddc_get_modes(connector); -+ amdgpu_get_native_mode(connector); - - return ret; - } -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index abc8c42b8b0c1..85583f9146305 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -166,6 +166,12 @@ static void vlv_steal_power_sequencer(struct drm_i915_private *dev_priv, - enum pipe pipe); - static void intel_dp_unset_edid(struct intel_dp *intel_dp); - -+static void intel_dp_set_default_sink_rates(struct intel_dp *intel_dp) -+{ -+ intel_dp->sink_rates[0] = 162000; -+ intel_dp->num_sink_rates = 1; -+} -+ - /* update sink rates from dpcd */ - static void intel_dp_set_sink_rates(struct intel_dp *intel_dp) - { -@@ -4261,6 +4267,9 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp) - */ - intel_psr_init_dpcd(intel_dp); - -+ /* Clear the default sink rates */ -+ intel_dp->num_sink_rates = 0; -+ - /* Read the eDP 1.4+ supported link rates. */ - if (intel_dp->edp_dpcd[0] >= DP_EDP_14) { - __le16 sink_rates[DP_MAX_SUPPORTED_RATES]; -@@ -7167,6 +7176,8 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port, - return false; - - intel_dp_set_source_rates(intel_dp); -+ intel_dp_set_default_sink_rates(intel_dp); -+ intel_dp_set_common_rates(intel_dp); - - intel_dp->reset_link_params = true; - intel_dp->pps_pipe = INVALID_PIPE; -diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c -index 5347e5bdee8cc..e18938972a895 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_drm.c -+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c -@@ -779,7 +779,7 @@ nouveau_drm_device_remove(struct drm_device *dev) - struct nvkm_client *client; - struct nvkm_device *device; - -- drm_dev_unregister(dev); -+ drm_dev_unplug(dev); - - dev->irq_enabled = false; - client = nvxx_client(&drm->client.base); -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c -index 6e3c450eaacef..3ff49344abc77 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c -@@ -62,7 +62,6 @@ gv100_hdmi_ctrl(struct nvkm_ior *ior, int head, bool enable, u8 max_ac_packet, - nvkm_wr32(device, 0x6f0108 + hdmi, vendor_infoframe.header); - nvkm_wr32(device, 0x6f010c + hdmi, vendor_infoframe.subpack0_low); - nvkm_wr32(device, 0x6f0110 + hdmi, vendor_infoframe.subpack0_high); -- nvkm_wr32(device, 0x6f0110 + hdmi, 0x00000000); - nvkm_wr32(device, 0x6f0114 + hdmi, 0x00000000); - nvkm_wr32(device, 0x6f0118 + hdmi, 0x00000000); - nvkm_wr32(device, 0x6f011c + hdmi, 0x00000000); -diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c -index ddb61a60c6104..ef69773b5bed5 100644 ---- a/drivers/gpu/drm/udl/udl_connector.c -+++ b/drivers/gpu/drm/udl/udl_connector.c -@@ -29,7 +29,7 @@ static int udl_get_edid_block(void *data, u8 *buf, unsigned int block, - ret = usb_control_msg(udl->udev, - usb_rcvctrlpipe(udl->udev, 0), - (0x02), (0x80 | (0x02 << 5)), bval, -- 0xA1, read_buff, 2, HZ); -+ 0xA1, read_buff, 2, 1000); - if (ret < 1) { - DRM_ERROR("Read EDID byte %d failed err %x\n", i, ret); - kfree(read_buff); -diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c -index 057a4b0100106..8850da8e25d69 100644 ---- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c -+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c -@@ -1015,6 +1015,8 @@ static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 req_odr) - int err; - - switch (sensor->id) { -+ case ST_LSM6DSX_ID_GYRO: -+ break; - case ST_LSM6DSX_ID_EXT0: - case ST_LSM6DSX_ID_EXT1: - case ST_LSM6DSX_ID_EXT2: -@@ -1040,8 +1042,8 @@ static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 req_odr) - } - break; - } -- default: -- break; -+ default: /* should never occur */ -+ return -EINVAL; - } - - if (req_odr > 0) { -diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -index a96f9142fe08e..dd006b177b544 100644 ---- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c -+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -@@ -3081,8 +3081,11 @@ static void bnxt_re_process_res_ud_wc(struct bnxt_re_qp *qp, - struct ib_wc *wc, - struct bnxt_qplib_cqe *cqe) - { -+ struct bnxt_re_dev *rdev; -+ u16 vlan_id = 0; - u8 nw_type; - -+ rdev = qp->rdev; - wc->opcode = IB_WC_RECV; - wc->status = __rc_to_ib_wc_status(cqe->status); - -@@ -3094,9 +3097,12 @@ static void bnxt_re_process_res_ud_wc(struct bnxt_re_qp *qp, - memcpy(wc->smac, cqe->smac, ETH_ALEN); - wc->wc_flags |= IB_WC_WITH_SMAC; - if (cqe->flags & CQ_RES_UD_FLAGS_META_FORMAT_VLAN) { -- wc->vlan_id = (cqe->cfa_meta & 0xFFF); -- if (wc->vlan_id < 0x1000) -- wc->wc_flags |= IB_WC_WITH_VLAN; -+ vlan_id = (cqe->cfa_meta & 0xFFF); -+ } -+ /* Mark only if vlan_id is non zero */ -+ if (vlan_id && bnxt_re_check_if_vlan_valid(rdev, vlan_id)) { -+ wc->vlan_id = vlan_id; -+ wc->wc_flags |= IB_WC_WITH_VLAN; - } - nw_type = (cqe->flags & CQ_RES_UD_FLAGS_ROCE_IP_VER_MASK) >> - CQ_RES_UD_FLAGS_ROCE_IP_VER_SFT; -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h -index 1835d2e451c01..fc7fce642666c 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h -@@ -635,11 +635,13 @@ static int bnx2x_ilt_client_mem_op(struct bnx2x *bp, int cli_num, - { - int i, rc; - struct bnx2x_ilt *ilt = BP_ILT(bp); -- struct ilt_client_info *ilt_cli = &ilt->clients[cli_num]; -+ struct ilt_client_info *ilt_cli; - - if (!ilt || !ilt->lines) - return -1; - -+ ilt_cli = &ilt->clients[cli_num]; -+ - if (ilt_cli->flags & (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM)) - return 0; - -diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -index 7af7cc7c8669a..34540e604f748 100644 ---- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c -@@ -3616,10 +3616,10 @@ static int dpaa2_eth_remove(struct fsl_mc_device *ls_dev) - - fsl_mc_portal_free(priv->mc_io); - -- free_netdev(net_dev); -- - dev_dbg(net_dev->dev.parent, "Removed interface %s\n", net_dev->name); - -+ free_netdev(net_dev); -+ - return 0; - } - -diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h -index e571c6116c4b7..f8422dbfd54e6 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e.h -+++ b/drivers/net/ethernet/intel/i40e/i40e.h -@@ -169,6 +169,7 @@ enum i40e_vsi_state_t { - __I40E_VSI_OVERFLOW_PROMISC, - __I40E_VSI_REINIT_REQUESTED, - __I40E_VSI_DOWN_REQUESTED, -+ __I40E_VSI_RELEASING, - /* This must be last as it determines the size of the BITMAP */ - __I40E_VSI_STATE_SIZE__, - }; -@@ -1146,6 +1147,7 @@ void i40e_ptp_save_hw_time(struct i40e_pf *pf); - void i40e_ptp_restore_hw_time(struct i40e_pf *pf); - void i40e_ptp_init(struct i40e_pf *pf); - void i40e_ptp_stop(struct i40e_pf *pf); -+int i40e_update_adq_vsi_queues(struct i40e_vsi *vsi, int vsi_offset); - int i40e_is_vsi_uplink_mode_veb(struct i40e_vsi *vsi); - i40e_status i40e_get_partition_bw_setting(struct i40e_pf *pf); - i40e_status i40e_set_partition_bw_setting(struct i40e_pf *pf); -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 917be10a5cf5c..ce237da003ddb 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -1776,6 +1776,7 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, - bool is_add) - { - struct i40e_pf *pf = vsi->back; -+ u16 num_tc_qps = 0; - u16 sections = 0; - u8 netdev_tc = 0; - u16 numtc = 1; -@@ -1783,13 +1784,33 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, - u8 offset; - u16 qmap; - int i; -- u16 num_tc_qps = 0; - - sections = I40E_AQ_VSI_PROP_QUEUE_MAP_VALID; - offset = 0; -+ /* zero out queue mapping, it will get updated on the end of the function */ -+ memset(ctxt->info.queue_mapping, 0, sizeof(ctxt->info.queue_mapping)); -+ -+ if (vsi->type == I40E_VSI_MAIN) { -+ /* This code helps add more queue to the VSI if we have -+ * more cores than RSS can support, the higher cores will -+ * be served by ATR or other filters. Furthermore, the -+ * non-zero req_queue_pairs says that user requested a new -+ * queue count via ethtool's set_channels, so use this -+ * value for queues distribution across traffic classes -+ */ -+ if (vsi->req_queue_pairs > 0) -+ vsi->num_queue_pairs = vsi->req_queue_pairs; -+ else if (pf->flags & I40E_FLAG_MSIX_ENABLED) -+ vsi->num_queue_pairs = pf->num_lan_msix; -+ } - - /* Number of queues per enabled TC */ -- num_tc_qps = vsi->alloc_queue_pairs; -+ if (vsi->type == I40E_VSI_MAIN || -+ (vsi->type == I40E_VSI_SRIOV && vsi->num_queue_pairs != 0)) -+ num_tc_qps = vsi->num_queue_pairs; -+ else -+ num_tc_qps = vsi->alloc_queue_pairs; -+ - if (enabled_tc && (vsi->back->flags & I40E_FLAG_DCB_ENABLED)) { - /* Find numtc from enabled TC bitmap */ - for (i = 0, numtc = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) { -@@ -1867,15 +1888,11 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, - } - ctxt->info.tc_mapping[i] = cpu_to_le16(qmap); - } -- -- /* Set actual Tx/Rx queue pairs */ -- vsi->num_queue_pairs = offset; -- if ((vsi->type == I40E_VSI_MAIN) && (numtc == 1)) { -- if (vsi->req_queue_pairs > 0) -- vsi->num_queue_pairs = vsi->req_queue_pairs; -- else if (pf->flags & I40E_FLAG_MSIX_ENABLED) -- vsi->num_queue_pairs = pf->num_lan_msix; -- } -+ /* Do not change previously set num_queue_pairs for PFs and VFs*/ -+ if ((vsi->type == I40E_VSI_MAIN && numtc != 1) || -+ (vsi->type == I40E_VSI_SRIOV && vsi->num_queue_pairs == 0) || -+ (vsi->type != I40E_VSI_MAIN && vsi->type != I40E_VSI_SRIOV)) -+ vsi->num_queue_pairs = offset; - - /* Scheduler section valid can only be set for ADD VSI */ - if (is_add) { -@@ -2609,7 +2626,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) - - for (v = 0; v < pf->num_alloc_vsi; v++) { - if (pf->vsi[v] && -- (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) { -+ (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) && -+ !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) { - int ret = i40e_sync_vsi_filters(pf->vsi[v]); - - if (ret) { -@@ -5371,6 +5389,58 @@ static void i40e_vsi_update_queue_map(struct i40e_vsi *vsi, - sizeof(vsi->info.tc_mapping)); - } - -+/** -+ * i40e_update_adq_vsi_queues - update queue mapping for ADq VSI -+ * @vsi: the VSI being reconfigured -+ * @vsi_offset: offset from main VF VSI -+ */ -+int i40e_update_adq_vsi_queues(struct i40e_vsi *vsi, int vsi_offset) -+{ -+ struct i40e_vsi_context ctxt = {}; -+ struct i40e_pf *pf; -+ struct i40e_hw *hw; -+ int ret; -+ -+ if (!vsi) -+ return I40E_ERR_PARAM; -+ pf = vsi->back; -+ hw = &pf->hw; -+ -+ ctxt.seid = vsi->seid; -+ ctxt.pf_num = hw->pf_id; -+ ctxt.vf_num = vsi->vf_id + hw->func_caps.vf_base_id + vsi_offset; -+ ctxt.uplink_seid = vsi->uplink_seid; -+ ctxt.connection_type = I40E_AQ_VSI_CONN_TYPE_NORMAL; -+ ctxt.flags = I40E_AQ_VSI_TYPE_VF; -+ ctxt.info = vsi->info; -+ -+ i40e_vsi_setup_queue_map(vsi, &ctxt, vsi->tc_config.enabled_tc, -+ false); -+ if (vsi->reconfig_rss) { -+ vsi->rss_size = min_t(int, pf->alloc_rss_size, -+ vsi->num_queue_pairs); -+ ret = i40e_vsi_config_rss(vsi); -+ if (ret) { -+ dev_info(&pf->pdev->dev, "Failed to reconfig rss for num_queues\n"); -+ return ret; -+ } -+ vsi->reconfig_rss = false; -+ } -+ -+ ret = i40e_aq_update_vsi_params(hw, &ctxt, NULL); -+ if (ret) { -+ dev_info(&pf->pdev->dev, "Update vsi config failed, err %s aq_err %s\n", -+ i40e_stat_str(hw, ret), -+ i40e_aq_str(hw, hw->aq.asq_last_status)); -+ return ret; -+ } -+ /* update the local VSI info with updated queue map */ -+ i40e_vsi_update_queue_map(vsi, &ctxt); -+ vsi->info.valid_sections = 0; -+ -+ return ret; -+} -+ - /** - * i40e_vsi_config_tc - Configure VSI Tx Scheduler for given TC map - * @vsi: VSI to be configured -@@ -5661,24 +5731,6 @@ static void i40e_remove_queue_channels(struct i40e_vsi *vsi) - INIT_LIST_HEAD(&vsi->ch_list); - } - --/** -- * i40e_is_any_channel - channel exist or not -- * @vsi: ptr to VSI to which channels are associated with -- * -- * Returns true or false if channel(s) exist for associated VSI or not -- **/ --static bool i40e_is_any_channel(struct i40e_vsi *vsi) --{ -- struct i40e_channel *ch, *ch_tmp; -- -- list_for_each_entry_safe(ch, ch_tmp, &vsi->ch_list, list) { -- if (ch->initialized) -- return true; -- } -- -- return false; --} -- - /** - * i40e_get_max_queues_for_channel - * @vsi: ptr to VSI to which channels are associated with -@@ -6186,26 +6238,15 @@ int i40e_create_queue_channel(struct i40e_vsi *vsi, - /* By default we are in VEPA mode, if this is the first VF/VMDq - * VSI to be added switch to VEB mode. - */ -- if ((!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) || -- (!i40e_is_any_channel(vsi))) { -- if (!is_power_of_2(vsi->tc_config.tc_info[0].qcount)) { -- dev_dbg(&pf->pdev->dev, -- "Failed to create channel. Override queues (%u) not power of 2\n", -- vsi->tc_config.tc_info[0].qcount); -- return -EINVAL; -- } - -- if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) { -- pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; -+ if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) { -+ pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; - -- if (vsi->type == I40E_VSI_MAIN) { -- if (pf->flags & I40E_FLAG_TC_MQPRIO) -- i40e_do_reset(pf, I40E_PF_RESET_FLAG, -- true); -- else -- i40e_do_reset_safe(pf, -- I40E_PF_RESET_FLAG); -- } -+ if (vsi->type == I40E_VSI_MAIN) { -+ if (pf->flags & I40E_FLAG_TC_MQPRIO) -+ i40e_do_reset(pf, I40E_PF_RESET_FLAG, true); -+ else -+ i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG); - } - /* now onwards for main VSI, number of queues will be value - * of TC0's queue count -@@ -7497,12 +7538,20 @@ config_tc: - vsi->seid); - need_reset = true; - goto exit; -- } else { -- dev_info(&vsi->back->pdev->dev, -- "Setup channel (id:%u) utilizing num_queues %d\n", -- vsi->seid, vsi->tc_config.tc_info[0].qcount); -+ } else if (enabled_tc && -+ (!is_power_of_2(vsi->tc_config.tc_info[0].qcount))) { -+ netdev_info(netdev, -+ "Failed to create channel. Override queues (%u) not power of 2\n", -+ vsi->tc_config.tc_info[0].qcount); -+ ret = -EINVAL; -+ need_reset = true; -+ goto exit; - } - -+ dev_info(&vsi->back->pdev->dev, -+ "Setup channel (id:%u) utilizing num_queues %d\n", -+ vsi->seid, vsi->tc_config.tc_info[0].qcount); -+ - if (pf->flags & I40E_FLAG_TC_MQPRIO) { - if (vsi->mqprio_qopt.max_rate[0]) { - u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0]; -@@ -8067,9 +8116,8 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi, - err = i40e_add_del_cloud_filter(vsi, filter, true); - - if (err) { -- dev_err(&pf->pdev->dev, -- "Failed to add cloud filter, err %s\n", -- i40e_stat_str(&pf->hw, err)); -+ dev_err(&pf->pdev->dev, "Failed to add cloud filter, err %d\n", -+ err); - goto err; - } - -@@ -13388,7 +13436,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi) - dev_info(&pf->pdev->dev, "Can't remove PF VSI\n"); - return -ENODEV; - } -- -+ set_bit(__I40E_VSI_RELEASING, vsi->state); - uplink_seid = vsi->uplink_seid; - if (vsi->type != I40E_VSI_SRIOV) { - if (vsi->netdev_registered) { -diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -index e561073054865..6e61aea42a0dd 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c -@@ -621,14 +621,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, - u16 vsi_queue_id, - struct virtchnl_rxq_info *info) - { -+ u16 pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id); - struct i40e_pf *pf = vf->pf; -+ struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx]; - struct i40e_hw *hw = &pf->hw; - struct i40e_hmc_obj_rxq rx_ctx; -- u16 pf_queue_id; - int ret = 0; - -- pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id); -- - /* clear the context structure first */ - memset(&rx_ctx, 0, sizeof(struct i40e_hmc_obj_rxq)); - -@@ -666,6 +665,10 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, - } - rx_ctx.rxmax = info->max_pkt_size; - -+ /* if port VLAN is configured increase the max packet size */ -+ if (vsi->info.pvid) -+ rx_ctx.rxmax += VLAN_HLEN; -+ - /* enable 32bytes desc always */ - rx_ctx.dsize = 1; - -@@ -2097,11 +2100,12 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) - struct virtchnl_vsi_queue_config_info *qci = - (struct virtchnl_vsi_queue_config_info *)msg; - struct virtchnl_queue_pair_info *qpi; -- struct i40e_pf *pf = vf->pf; - u16 vsi_id, vsi_queue_id = 0; -- u16 num_qps_all = 0; -+ struct i40e_pf *pf = vf->pf; - i40e_status aq_ret = 0; - int i, j = 0, idx = 0; -+ struct i40e_vsi *vsi; -+ u16 num_qps_all = 0; - - if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { - aq_ret = I40E_ERR_PARAM; -@@ -2190,9 +2194,15 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) - pf->vsi[vf->lan_vsi_idx]->num_queue_pairs = - qci->num_queue_pairs; - } else { -- for (i = 0; i < vf->num_tc; i++) -- pf->vsi[vf->ch[i].vsi_idx]->num_queue_pairs = -- vf->ch[i].num_qps; -+ for (i = 0; i < vf->num_tc; i++) { -+ vsi = pf->vsi[vf->ch[i].vsi_idx]; -+ vsi->num_queue_pairs = vf->ch[i].num_qps; -+ -+ if (i40e_update_adq_vsi_queues(vsi, i)) { -+ aq_ret = I40E_ERR_CONFIG; -+ goto error_param; -+ } -+ } - } - - error_param: -@@ -4050,34 +4060,6 @@ error_param: - return ret; - } - --/** -- * i40e_vsi_has_vlans - True if VSI has configured VLANs -- * @vsi: pointer to the vsi -- * -- * Check if a VSI has configured any VLANs. False if we have a port VLAN or if -- * we have no configured VLANs. Do not call while holding the -- * mac_filter_hash_lock. -- */ --static bool i40e_vsi_has_vlans(struct i40e_vsi *vsi) --{ -- bool have_vlans; -- -- /* If we have a port VLAN, then the VSI cannot have any VLANs -- * configured, as all MAC/VLAN filters will be assigned to the PVID. -- */ -- if (vsi->info.pvid) -- return false; -- -- /* Since we don't have a PVID, we know that if the device is in VLAN -- * mode it must be because of a VLAN filter configured on this VSI. -- */ -- spin_lock_bh(&vsi->mac_filter_hash_lock); -- have_vlans = i40e_is_vsi_in_vlan(vsi); -- spin_unlock_bh(&vsi->mac_filter_hash_lock); -- -- return have_vlans; --} -- - /** - * i40e_ndo_set_vf_port_vlan - * @netdev: network interface device structure -@@ -4134,19 +4116,9 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id, - /* duplicate request, so just return success */ - goto error_pvid; - -- if (i40e_vsi_has_vlans(vsi)) { -- dev_err(&pf->pdev->dev, -- "VF %d has already configured VLAN filters and the administrator is requesting a port VLAN override.\nPlease unload and reload the VF driver for this change to take effect.\n", -- vf_id); -- /* Administrator Error - knock the VF offline until he does -- * the right thing by reconfiguring his network correctly -- * and then reloading the VF driver. -- */ -- i40e_vc_disable_vf(vf); -- /* During reset the VF got a new VSI, so refresh the pointer. */ -- vsi = pf->vsi[vf->lan_vsi_idx]; -- } -- -+ i40e_vc_disable_vf(vf); -+ /* During reset the VF got a new VSI, so refresh a pointer. */ -+ vsi = pf->vsi[vf->lan_vsi_idx]; - /* Locked once because multiple functions below iterate list */ - spin_lock_bh(&vsi->mac_filter_hash_lock); - -diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -index 758bef02a2a86..ad1e796e5544a 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -@@ -962,14 +962,13 @@ static int iavf_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key, - - if (hfunc) - *hfunc = ETH_RSS_HASH_TOP; -- if (!indir) -- return 0; -- -- memcpy(key, adapter->rss_key, adapter->rss_key_size); -+ if (key) -+ memcpy(key, adapter->rss_key, adapter->rss_key_size); - -- /* Each 32 bits pointed by 'indir' is stored with a lut entry */ -- for (i = 0; i < adapter->rss_lut_size; i++) -- indir[i] = (u32)adapter->rss_lut[i]; -+ if (indir) -+ /* Each 32 bits pointed by 'indir' is stored with a lut entry */ -+ for (i = 0; i < adapter->rss_lut_size; i++) -+ indir[i] = (u32)adapter->rss_lut[i]; - - return 0; - } -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index bc46c262b42d8..484c2a6f1625d 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -1626,8 +1626,7 @@ static int iavf_process_aq_command(struct iavf_adapter *adapter) - iavf_set_promiscuous(adapter, FLAG_VF_MULTICAST_PROMISC); - return 0; - } -- -- if ((adapter->aq_required & IAVF_FLAG_AQ_RELEASE_PROMISC) && -+ if ((adapter->aq_required & IAVF_FLAG_AQ_RELEASE_PROMISC) || - (adapter->aq_required & IAVF_FLAG_AQ_RELEASE_ALLMULTI)) { - iavf_set_promiscuous(adapter, 0); - return 0; -@@ -2057,8 +2056,8 @@ static void iavf_disable_vf(struct iavf_adapter *adapter) - - iavf_free_misc_irq(adapter); - iavf_reset_interrupt_capability(adapter); -- iavf_free_queues(adapter); - iavf_free_q_vectors(adapter); -+ iavf_free_queues(adapter); - memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE); - iavf_shutdown_adminq(&adapter->hw); - adapter->netdev->flags &= ~IFF_UP; -@@ -2342,7 +2341,7 @@ static void iavf_adminq_task(struct work_struct *work) - - /* check for error indications */ - val = rd32(hw, hw->aq.arq.len); -- if (val == 0xdeadbeef) /* indicates device in reset */ -+ if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */ - goto freedom; - oldval = val; - if (val & IAVF_VF_ARQLEN1_ARQVFE_MASK) { -@@ -3034,11 +3033,11 @@ static int iavf_configure_clsflower(struct iavf_adapter *adapter, - /* start out with flow type and eth type IPv4 to begin with */ - filter->f.flow_type = VIRTCHNL_TCP_V4_FLOW; - err = iavf_parse_cls_flower(adapter, cls_flower, filter); -- if (err < 0) -+ if (err) - goto err; - - err = iavf_handle_tclass(adapter, tc, filter); -- if (err < 0) -+ if (err) - goto err; - - /* add filter to the list */ -@@ -3425,7 +3424,8 @@ static netdev_features_t iavf_fix_features(struct net_device *netdev, - { - struct iavf_adapter *adapter = netdev_priv(netdev); - -- if (!(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)) -+ if (adapter->vf_res && -+ !(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)) - features &= ~(NETIF_F_HW_VLAN_CTAG_TX | - NETIF_F_HW_VLAN_CTAG_RX | - NETIF_F_HW_VLAN_CTAG_FILTER); -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index d0ccb7ad447b1..6370e96ebfacc 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -3005,9 +3005,6 @@ static void ice_remove(struct pci_dev *pdev) - struct ice_pf *pf = pci_get_drvdata(pdev); - int i; - -- if (!pf) -- return; -- - for (i = 0; i < ICE_MAX_RESET_WAIT; i++) { - if (!ice_is_reset_in_progress(pf->state)) - break; -diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -index dac0e51e6aafd..16a390c77d198 100644 ---- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c -@@ -4545,7 +4545,7 @@ static int mvpp2_port_init(struct mvpp2_port *port) - struct mvpp2 *priv = port->priv; - struct mvpp2_txq_pcpu *txq_pcpu; - unsigned int thread; -- int queue, err, val; -+ int queue, err; - - /* Checks for hardware constraints */ - if (port->first_rxq + port->nrxqs > -@@ -4559,18 +4559,6 @@ static int mvpp2_port_init(struct mvpp2_port *port) - mvpp2_egress_disable(port); - mvpp2_port_disable(port); - -- if (mvpp2_is_xlg(port->phy_interface)) { -- val = readl(port->base + MVPP22_XLG_CTRL0_REG); -- val &= ~MVPP22_XLG_CTRL0_FORCE_LINK_PASS; -- val |= MVPP22_XLG_CTRL0_FORCE_LINK_DOWN; -- writel(val, port->base + MVPP22_XLG_CTRL0_REG); -- } else { -- val = readl(port->base + MVPP2_GMAC_AUTONEG_CONFIG); -- val &= ~MVPP2_GMAC_FORCE_LINK_PASS; -- val |= MVPP2_GMAC_FORCE_LINK_DOWN; -- writel(val, port->base + MVPP2_GMAC_AUTONEG_CONFIG); -- } -- - port->tx_time_coal = MVPP2_TXDONE_COAL_USEC; - - port->txqs = devm_kcalloc(dev, port->ntxqs, sizeof(*port->txqs), -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 7c40ae058e6d1..10211ea605140 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1071,6 +1071,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct tun_struct *tun = netdev_priv(dev); - int txq = skb->queue_mapping; -+ struct netdev_queue *queue; - struct tun_file *tfile; - int len = skb->len; - -@@ -1117,6 +1118,10 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) - if (ptr_ring_produce(&tfile->tx_ring, skb)) - goto drop; - -+ /* NETIF_F_LLTX requires to do our own update of trans_start */ -+ queue = netdev_get_tx_queue(dev, txq); -+ queue->trans_start = jiffies; -+ - /* Notify and wake up reader process */ - if (tfile->flags & TUN_FASYNC) - kill_fasync(&tfile->fasync, SIGIO, POLL_IN); -diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c -index 8c0867bda8280..0dfaa1a43b674 100644 ---- a/drivers/platform/x86/hp_accel.c -+++ b/drivers/platform/x86/hp_accel.c -@@ -372,9 +372,11 @@ static int lis3lv02d_add(struct acpi_device *device) - INIT_WORK(&hpled_led.work, delayed_set_status_worker); - ret = led_classdev_register(NULL, &hpled_led.led_classdev); - if (ret) { -+ i8042_remove_filter(hp_accel_i8042_filter); - lis3lv02d_joystick_disable(&lis3_dev); - lis3lv02d_poweroff(&lis3_dev); - flush_work(&hpled_led.work); -+ lis3lv02d_remove_fs(&lis3_dev); - return ret; - } - -diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c -index a242a62caaa16..7b3e52ff5f516 100644 ---- a/drivers/scsi/advansys.c -+++ b/drivers/scsi/advansys.c -@@ -3366,8 +3366,8 @@ static void asc_prt_adv_board_info(struct seq_file *m, struct Scsi_Host *shost) - shost->host_no); - - seq_printf(m, -- " iop_base 0x%lx, cable_detect: %X, err_code %u\n", -- (unsigned long)v->iop_base, -+ " iop_base 0x%p, cable_detect: %X, err_code %u\n", -+ v->iop_base, - AdvReadWordRegister(iop_base,IOPW_SCSI_CFG1) & CABLE_DETECT, - v->err_code); - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 4a7ceaa34341c..51bab0979527b 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -19692,6 +19692,7 @@ lpfc_drain_txq(struct lpfc_hba *phba) - fail_msg, - piocbq->iotag, piocbq->sli4_xritag); - list_add_tail(&piocbq->list, &completions); -+ fail_msg = NULL; - } - spin_unlock_irqrestore(&pring->ring_lock, iflags); - } -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 12064ce76777d..16432d42a50aa 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -776,6 +776,7 @@ store_state_field(struct device *dev, struct device_attribute *attr, - int i, ret; - struct scsi_device *sdev = to_scsi_device(dev); - enum scsi_device_state state = 0; -+ bool rescan_dev = false; - - for (i = 0; i < ARRAY_SIZE(sdev_states); i++) { - const int len = strlen(sdev_states[i].name); -@@ -794,20 +795,27 @@ store_state_field(struct device *dev, struct device_attribute *attr, - } - - mutex_lock(&sdev->state_mutex); -- ret = scsi_device_set_state(sdev, state); -- /* -- * If the device state changes to SDEV_RUNNING, we need to -- * run the queue to avoid I/O hang, and rescan the device -- * to revalidate it. Running the queue first is necessary -- * because another thread may be waiting inside -- * blk_mq_freeze_queue_wait() and because that call may be -- * waiting for pending I/O to finish. -- */ -- if (ret == 0 && state == SDEV_RUNNING) { -+ if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) { -+ ret = count; -+ } else { -+ ret = scsi_device_set_state(sdev, state); -+ if (ret == 0 && state == SDEV_RUNNING) -+ rescan_dev = true; -+ } -+ mutex_unlock(&sdev->state_mutex); -+ -+ if (rescan_dev) { -+ /* -+ * If the device state changes to SDEV_RUNNING, we need to -+ * run the queue to avoid I/O hang, and rescan the device -+ * to revalidate it. Running the queue first is necessary -+ * because another thread may be waiting inside -+ * blk_mq_freeze_queue_wait() and because that call may be -+ * waiting for pending I/O to finish. -+ */ - blk_mq_run_hw_queues(sdev->request_queue, true); - scsi_rescan_device(dev); - } -- mutex_unlock(&sdev->state_mutex); - - return ret == 0 ? count : -EINVAL; - } -diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c -index e5d7fb81ad665..44a931d41a132 100644 ---- a/drivers/sh/maple/maple.c -+++ b/drivers/sh/maple/maple.c -@@ -835,8 +835,10 @@ static int __init maple_bus_init(void) - - maple_queue_cache = KMEM_CACHE(maple_buffer, SLAB_HWCACHE_ALIGN); - -- if (!maple_queue_cache) -+ if (!maple_queue_cache) { -+ retval = -ENOMEM; - goto cleanup_bothirqs; -+ } - - INIT_LIST_HEAD(&maple_waitq); - INIT_LIST_HEAD(&maple_sentq); -@@ -849,6 +851,7 @@ static int __init maple_bus_init(void) - if (!mdev[i]) { - while (i-- > 0) - maple_free_dev(mdev[i]); -+ retval = -ENOMEM; - goto cleanup_cache; - } - baseunits[i] = mdev[i]; -diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c -index 385e4cf9cfa63..0fc3135d3e4f6 100644 ---- a/drivers/target/target_core_alua.c -+++ b/drivers/target/target_core_alua.c -@@ -1702,7 +1702,6 @@ int core_alua_set_tg_pt_gp_id( - pr_err("Maximum ALUA alua_tg_pt_gps_count:" - " 0x0000ffff reached\n"); - spin_unlock(&dev->t10_alua.tg_pt_gps_lock); -- kmem_cache_free(t10_alua_tg_pt_gp_cache, tg_pt_gp); - return -ENOSPC; - } - again: -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index 2d19f0e332b01..20fe287039857 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -758,6 +758,8 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) - INIT_LIST_HEAD(&dev->t10_alua.lba_map_list); - spin_lock_init(&dev->t10_alua.lba_map_lock); - -+ INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work); -+ - dev->t10_wwn.t10_dev = dev; - dev->t10_alua.t10_dev = dev; - -diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h -index e7b3c6e5d5744..e4f072a680d41 100644 ---- a/drivers/target/target_core_internal.h -+++ b/drivers/target/target_core_internal.h -@@ -150,6 +150,7 @@ int transport_dump_vpd_ident(struct t10_vpd *, unsigned char *, int); - void transport_clear_lun_ref(struct se_lun *); - sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size); - void target_qf_do_work(struct work_struct *work); -+void target_do_delayed_work(struct work_struct *work); - bool target_check_wce(struct se_device *dev); - bool target_check_fua(struct se_device *dev); - void __target_execute_cmd(struct se_cmd *, bool); -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 5cf9e7677926f..f52fe40002259 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -2021,32 +2021,35 @@ static bool target_handle_task_attr(struct se_cmd *cmd) - */ - switch (cmd->sam_task_attr) { - case TCM_HEAD_TAG: -+ atomic_inc_mb(&dev->non_ordered); - pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x\n", - cmd->t_task_cdb[0]); - return false; - case TCM_ORDERED_TAG: -- atomic_inc_mb(&dev->dev_ordered_sync); -+ atomic_inc_mb(&dev->delayed_cmd_count); - - pr_debug("Added ORDERED for CDB: 0x%02x to ordered list\n", - cmd->t_task_cdb[0]); -- -- /* -- * Execute an ORDERED command if no other older commands -- * exist that need to be completed first. -- */ -- if (!atomic_read(&dev->simple_cmds)) -- return false; - break; - default: - /* - * For SIMPLE and UNTAGGED Task Attribute commands - */ -- atomic_inc_mb(&dev->simple_cmds); -+ atomic_inc_mb(&dev->non_ordered); -+ -+ if (atomic_read(&dev->delayed_cmd_count) == 0) -+ return false; - break; - } - -- if (atomic_read(&dev->dev_ordered_sync) == 0) -- return false; -+ if (cmd->sam_task_attr != TCM_ORDERED_TAG) { -+ atomic_inc_mb(&dev->delayed_cmd_count); -+ /* -+ * We will account for this when we dequeue from the delayed -+ * list. -+ */ -+ atomic_dec_mb(&dev->non_ordered); -+ } - - spin_lock(&dev->delayed_cmd_lock); - list_add_tail(&cmd->se_delayed_node, &dev->delayed_cmd_list); -@@ -2054,6 +2057,12 @@ static bool target_handle_task_attr(struct se_cmd *cmd) - - pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to delayed CMD listn", - cmd->t_task_cdb[0], cmd->sam_task_attr); -+ /* -+ * We may have no non ordered cmds when this function started or we -+ * could have raced with the last simple/head cmd completing, so kick -+ * the delayed handler here. -+ */ -+ schedule_work(&dev->delayed_cmd_work); - return true; - } - -@@ -2091,29 +2100,48 @@ EXPORT_SYMBOL(target_execute_cmd); - * Process all commands up to the last received ORDERED task attribute which - * requires another blocking boundary - */ --static void target_restart_delayed_cmds(struct se_device *dev) -+void target_do_delayed_work(struct work_struct *work) - { -- for (;;) { -+ struct se_device *dev = container_of(work, struct se_device, -+ delayed_cmd_work); -+ -+ spin_lock(&dev->delayed_cmd_lock); -+ while (!dev->ordered_sync_in_progress) { - struct se_cmd *cmd; - -- spin_lock(&dev->delayed_cmd_lock); -- if (list_empty(&dev->delayed_cmd_list)) { -- spin_unlock(&dev->delayed_cmd_lock); -+ if (list_empty(&dev->delayed_cmd_list)) - break; -- } - - cmd = list_entry(dev->delayed_cmd_list.next, - struct se_cmd, se_delayed_node); -+ -+ if (cmd->sam_task_attr == TCM_ORDERED_TAG) { -+ /* -+ * Check if we started with: -+ * [ordered] [simple] [ordered] -+ * and we are now at the last ordered so we have to wait -+ * for the simple cmd. -+ */ -+ if (atomic_read(&dev->non_ordered) > 0) -+ break; -+ -+ dev->ordered_sync_in_progress = true; -+ } -+ - list_del(&cmd->se_delayed_node); -+ atomic_dec_mb(&dev->delayed_cmd_count); - spin_unlock(&dev->delayed_cmd_lock); - -+ if (cmd->sam_task_attr != TCM_ORDERED_TAG) -+ atomic_inc_mb(&dev->non_ordered); -+ - cmd->transport_state |= CMD_T_SENT; - - __target_execute_cmd(cmd, true); - -- if (cmd->sam_task_attr == TCM_ORDERED_TAG) -- break; -+ spin_lock(&dev->delayed_cmd_lock); - } -+ spin_unlock(&dev->delayed_cmd_lock); - } - - /* -@@ -2131,14 +2159,17 @@ static void transport_complete_task_attr(struct se_cmd *cmd) - goto restart; - - if (cmd->sam_task_attr == TCM_SIMPLE_TAG) { -- atomic_dec_mb(&dev->simple_cmds); -+ atomic_dec_mb(&dev->non_ordered); - dev->dev_cur_ordered_id++; - } else if (cmd->sam_task_attr == TCM_HEAD_TAG) { -+ atomic_dec_mb(&dev->non_ordered); - dev->dev_cur_ordered_id++; - pr_debug("Incremented dev_cur_ordered_id: %u for HEAD_OF_QUEUE\n", - dev->dev_cur_ordered_id); - } else if (cmd->sam_task_attr == TCM_ORDERED_TAG) { -- atomic_dec_mb(&dev->dev_ordered_sync); -+ spin_lock(&dev->delayed_cmd_lock); -+ dev->ordered_sync_in_progress = false; -+ spin_unlock(&dev->delayed_cmd_lock); - - dev->dev_cur_ordered_id++; - pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n", -@@ -2147,7 +2178,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd) - cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET; - - restart: -- target_restart_delayed_cmds(dev); -+ if (atomic_read(&dev->delayed_cmd_count) > 0) -+ schedule_work(&dev->delayed_cmd_work); - } - - static void transport_complete_qf(struct se_cmd *cmd) -diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c -index ec145a59f1993..bb148dbfbb88f 100644 ---- a/drivers/tty/tty_buffer.c -+++ b/drivers/tty/tty_buffer.c -@@ -534,6 +534,9 @@ static void flush_to_ldisc(struct work_struct *work) - if (!count) - break; - head->read += count; -+ -+ if (need_resched()) -+ cond_resched(); - } - - mutex_unlock(&buf->lock); -diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c -index 5ef0747225f6b..e0b25dd869094 100644 ---- a/drivers/usb/host/max3421-hcd.c -+++ b/drivers/usb/host/max3421-hcd.c -@@ -125,8 +125,6 @@ struct max3421_hcd { - - struct task_struct *spi_thread; - -- struct max3421_hcd *next; -- - enum max3421_rh_state rh_state; - /* lower 16 bits contain port status, upper 16 bits the change mask: */ - u32 port_status; -@@ -174,8 +172,6 @@ struct max3421_ep { - u8 retransmit; /* packet needs retransmission */ - }; - --static struct max3421_hcd *max3421_hcd_list; -- - #define MAX3421_FIFO_SIZE 64 - - #define MAX3421_SPI_DIR_RD 0 /* read register from MAX3421 */ -@@ -1882,9 +1878,8 @@ max3421_probe(struct spi_device *spi) - } - set_bit(HCD_FLAG_POLL_RH, &hcd->flags); - max3421_hcd = hcd_to_max3421(hcd); -- max3421_hcd->next = max3421_hcd_list; -- max3421_hcd_list = max3421_hcd; - INIT_LIST_HEAD(&max3421_hcd->ep_list); -+ spi_set_drvdata(spi, max3421_hcd); - - max3421_hcd->tx = kmalloc(sizeof(*max3421_hcd->tx), GFP_KERNEL); - if (!max3421_hcd->tx) -@@ -1934,28 +1929,18 @@ error: - static int - max3421_remove(struct spi_device *spi) - { -- struct max3421_hcd *max3421_hcd = NULL, **prev; -- struct usb_hcd *hcd = NULL; -+ struct max3421_hcd *max3421_hcd; -+ struct usb_hcd *hcd; - unsigned long flags; - -- for (prev = &max3421_hcd_list; *prev; prev = &(*prev)->next) { -- max3421_hcd = *prev; -- hcd = max3421_to_hcd(max3421_hcd); -- if (hcd->self.controller == &spi->dev) -- break; -- } -- if (!max3421_hcd) { -- dev_err(&spi->dev, "no MAX3421 HCD found for SPI device %p\n", -- spi); -- return -ENODEV; -- } -+ max3421_hcd = spi_get_drvdata(spi); -+ hcd = max3421_to_hcd(max3421_hcd); - - usb_remove_hcd(hcd); - - spin_lock_irqsave(&max3421_hcd->lock, flags); - - kthread_stop(max3421_hcd->spi_thread); -- *prev = max3421_hcd->next; - - spin_unlock_irqrestore(&max3421_hcd->lock, flags); - -diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c -index fed43c6dd85cc..b611c8b09a89f 100644 ---- a/drivers/usb/host/ohci-tmio.c -+++ b/drivers/usb/host/ohci-tmio.c -@@ -199,7 +199,7 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev) - if (usb_disabled()) - return -ENODEV; - -- if (!cell) -+ if (!cell || !regs || !config || !sram) - return -EINVAL; - - if (irq < 0) -diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c -index 4ecfbf6bb1fa8..902507da8aa85 100644 ---- a/drivers/usb/musb/tusb6010.c -+++ b/drivers/usb/musb/tusb6010.c -@@ -1103,6 +1103,11 @@ static int tusb_musb_init(struct musb *musb) - - /* dma address for async dma */ - mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ if (!mem) { -+ pr_debug("no async dma resource?\n"); -+ ret = -ENODEV; -+ goto done; -+ } - musb->async = mem->start; - - /* dma address for sync dma */ -diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c -index a38d1409f15b7..67bebee693301 100644 ---- a/drivers/usb/typec/tps6598x.c -+++ b/drivers/usb/typec/tps6598x.c -@@ -109,7 +109,7 @@ tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len) - u8 data[TPS_MAX_LEN + 1]; - int ret; - -- if (WARN_ON(len + 1 > sizeof(data))) -+ if (len + 1 > sizeof(data)) - return -EINVAL; - - if (!tps->i2c_protocol) -diff --git a/drivers/video/console/sticon.c b/drivers/video/console/sticon.c -index 79c9bd8d30254..559a7305cadaa 100644 ---- a/drivers/video/console/sticon.c -+++ b/drivers/video/console/sticon.c -@@ -291,13 +291,13 @@ static unsigned long sticon_getxy(struct vc_data *conp, unsigned long pos, - static u8 sticon_build_attr(struct vc_data *conp, u8 color, u8 intens, - u8 blink, u8 underline, u8 reverse, u8 italic) - { -- u8 attr = ((color & 0x70) >> 1) | ((color & 7)); -+ u8 fg = color & 7; -+ u8 bg = (color & 0x70) >> 4; - -- if (reverse) { -- color = ((color >> 3) & 0x7) | ((color & 0x7) << 3); -- } -- -- return attr; -+ if (reverse) -+ return (fg << 3) | bg; -+ else -+ return (bg << 3) | fg; - } - - static void sticon_invert_region(struct vc_data *conp, u16 *p, int count) -diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c -index 11be02459b876..eb592b92aa9cd 100644 ---- a/fs/btrfs/async-thread.c -+++ b/fs/btrfs/async-thread.c -@@ -237,6 +237,13 @@ static void run_ordered_work(struct __btrfs_workqueue *wq, - ordered_list); - if (!test_bit(WORK_DONE_BIT, &work->flags)) - break; -+ /* -+ * Orders all subsequent loads after reading WORK_DONE_BIT, -+ * paired with the smp_mb__before_atomic in btrfs_work_helper -+ * this guarantees that the ordered function will see all -+ * updates from ordinary work function. -+ */ -+ smp_rmb(); - - /* - * we are going to call the ordered done function, but -@@ -325,6 +332,13 @@ static void btrfs_work_helper(struct work_struct *normal_work) - thresh_exec_hook(wq); - work->func(work); - if (need_order) { -+ /* -+ * Ensures all memory accesses done in the work function are -+ * ordered before setting the WORK_DONE_BIT. Ensuring the thread -+ * which is going to executed the ordered work sees them. -+ * Pairs with the smp_rmb in run_ordered_work. -+ */ -+ smp_mb__before_atomic(); - set_bit(WORK_DONE_BIT, &work->flags); - run_ordered_work(wq, work); - } -diff --git a/fs/udf/dir.c b/fs/udf/dir.c -index c19dba45aa209..d0f92a52e3bab 100644 ---- a/fs/udf/dir.c -+++ b/fs/udf/dir.c -@@ -31,6 +31,7 @@ - #include - #include - #include -+#include - - #include "udf_i.h" - #include "udf_sb.h" -@@ -44,7 +45,7 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) - struct fileIdentDesc *fi = NULL; - struct fileIdentDesc cfi; - udf_pblk_t block, iblock; -- loff_t nf_pos; -+ loff_t nf_pos, emit_pos = 0; - int flen; - unsigned char *fname = NULL, *copy_name = NULL; - unsigned char *nameptr; -@@ -58,6 +59,7 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) - int i, num, ret = 0; - struct extent_position epos = { NULL, 0, {0, 0} }; - struct super_block *sb = dir->i_sb; -+ bool pos_valid = false; - - if (ctx->pos == 0) { - if (!dir_emit_dot(file, ctx)) -@@ -68,6 +70,21 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) - if (nf_pos >= size) - goto out; - -+ /* -+ * Something changed since last readdir (either lseek was called or dir -+ * changed)? We need to verify the position correctly points at the -+ * beginning of some dir entry so that the directory parsing code does -+ * not get confused. Since UDF does not have any reliable way of -+ * identifying beginning of dir entry (names are under user control), -+ * we need to scan the directory from the beginning. -+ */ -+ if (!inode_eq_iversion(dir, file->f_version)) { -+ emit_pos = nf_pos; -+ nf_pos = 0; -+ } else { -+ pos_valid = true; -+ } -+ - fname = kmalloc(UDF_NAME_LEN, GFP_NOFS); - if (!fname) { - ret = -ENOMEM; -@@ -123,13 +140,21 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) - - while (nf_pos < size) { - struct kernel_lb_addr tloc; -+ loff_t cur_pos = nf_pos; - -- ctx->pos = (nf_pos >> 2) + 1; -+ /* Update file position only if we got past the current one */ -+ if (nf_pos >= emit_pos) { -+ ctx->pos = (nf_pos >> 2) + 1; -+ pos_valid = true; -+ } - - fi = udf_fileident_read(dir, &nf_pos, &fibh, &cfi, &epos, &eloc, - &elen, &offset); - if (!fi) - goto out; -+ /* Still not at offset where user asked us to read from? */ -+ if (cur_pos < emit_pos) -+ continue; - - liu = le16_to_cpu(cfi.lengthOfImpUse); - lfi = cfi.lengthFileIdent; -@@ -187,8 +212,11 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) - } /* end while */ - - ctx->pos = (nf_pos >> 2) + 1; -+ pos_valid = true; - - out: -+ if (pos_valid) -+ file->f_version = inode_query_iversion(dir); - if (fibh.sbh != fibh.ebh) - brelse(fibh.ebh); - brelse(fibh.sbh); -diff --git a/fs/udf/namei.c b/fs/udf/namei.c -index 3c3d3b20889c8..3c009562375d3 100644 ---- a/fs/udf/namei.c -+++ b/fs/udf/namei.c -@@ -30,6 +30,7 @@ - #include - #include - #include -+#include - - static inline int udf_match(int len1, const unsigned char *name1, int len2, - const unsigned char *name2) -@@ -135,6 +136,8 @@ int udf_write_fi(struct inode *inode, struct fileIdentDesc *cfi, - mark_buffer_dirty_inode(fibh->ebh, inode); - mark_buffer_dirty_inode(fibh->sbh, inode); - } -+ inode_inc_iversion(inode); -+ - return 0; - } - -diff --git a/fs/udf/super.c b/fs/udf/super.c -index 5663bae95700c..5193b94c06834 100644 ---- a/fs/udf/super.c -+++ b/fs/udf/super.c -@@ -57,6 +57,7 @@ - #include - #include - #include -+#include - - #include "udf_sb.h" - #include "udf_i.h" -@@ -149,6 +150,7 @@ static struct inode *udf_alloc_inode(struct super_block *sb) - init_rwsem(&ei->i_data_sem); - ei->cached_extent.lstart = -1; - spin_lock_init(&ei->i_extent_cache_lock); -+ inode_set_iversion(&ei->vfs_inode, 1); - - return &ei->vfs_inode; - } -diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h -index c716ea81e6531..46294ef620ff9 100644 ---- a/include/asm-generic/tlb.h -+++ b/include/asm-generic/tlb.h -@@ -495,6 +495,38 @@ static inline void tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vm - } - #endif - -+/* -+ * tlb_flush_{pte|pmd|pud|p4d}_range() adjust the tlb->start and tlb->end, -+ * and set corresponding cleared_*. -+ */ -+static inline void tlb_flush_pte_range(struct mmu_gather *tlb, -+ unsigned long address, unsigned long size) -+{ -+ __tlb_adjust_range(tlb, address, size); -+ tlb->cleared_ptes = 1; -+} -+ -+static inline void tlb_flush_pmd_range(struct mmu_gather *tlb, -+ unsigned long address, unsigned long size) -+{ -+ __tlb_adjust_range(tlb, address, size); -+ tlb->cleared_pmds = 1; -+} -+ -+static inline void tlb_flush_pud_range(struct mmu_gather *tlb, -+ unsigned long address, unsigned long size) -+{ -+ __tlb_adjust_range(tlb, address, size); -+ tlb->cleared_puds = 1; -+} -+ -+static inline void tlb_flush_p4d_range(struct mmu_gather *tlb, -+ unsigned long address, unsigned long size) -+{ -+ __tlb_adjust_range(tlb, address, size); -+ tlb->cleared_p4ds = 1; -+} -+ - #ifndef __tlb_remove_tlb_entry - #define __tlb_remove_tlb_entry(tlb, ptep, address) do { } while (0) - #endif -@@ -508,19 +540,17 @@ static inline void tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vm - */ - #define tlb_remove_tlb_entry(tlb, ptep, address) \ - do { \ -- __tlb_adjust_range(tlb, address, PAGE_SIZE); \ -- tlb->cleared_ptes = 1; \ -+ tlb_flush_pte_range(tlb, address, PAGE_SIZE); \ - __tlb_remove_tlb_entry(tlb, ptep, address); \ - } while (0) - - #define tlb_remove_huge_tlb_entry(h, tlb, ptep, address) \ - do { \ - unsigned long _sz = huge_page_size(h); \ -- __tlb_adjust_range(tlb, address, _sz); \ - if (_sz == PMD_SIZE) \ -- tlb->cleared_pmds = 1; \ -+ tlb_flush_pmd_range(tlb, address, _sz); \ - else if (_sz == PUD_SIZE) \ -- tlb->cleared_puds = 1; \ -+ tlb_flush_pud_range(tlb, address, _sz); \ - __tlb_remove_tlb_entry(tlb, ptep, address); \ - } while (0) - -@@ -534,8 +564,7 @@ static inline void tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vm - - #define tlb_remove_pmd_tlb_entry(tlb, pmdp, address) \ - do { \ -- __tlb_adjust_range(tlb, address, HPAGE_PMD_SIZE); \ -- tlb->cleared_pmds = 1; \ -+ tlb_flush_pmd_range(tlb, address, HPAGE_PMD_SIZE); \ - __tlb_remove_pmd_tlb_entry(tlb, pmdp, address); \ - } while (0) - -@@ -549,8 +578,7 @@ static inline void tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vm - - #define tlb_remove_pud_tlb_entry(tlb, pudp, address) \ - do { \ -- __tlb_adjust_range(tlb, address, HPAGE_PUD_SIZE); \ -- tlb->cleared_puds = 1; \ -+ tlb_flush_pud_range(tlb, address, HPAGE_PUD_SIZE); \ - __tlb_remove_pud_tlb_entry(tlb, pudp, address); \ - } while (0) - -@@ -575,9 +603,8 @@ static inline void tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vm - #ifndef pte_free_tlb - #define pte_free_tlb(tlb, ptep, address) \ - do { \ -- __tlb_adjust_range(tlb, address, PAGE_SIZE); \ -+ tlb_flush_pmd_range(tlb, address, PAGE_SIZE); \ - tlb->freed_tables = 1; \ -- tlb->cleared_pmds = 1; \ - __pte_free_tlb(tlb, ptep, address); \ - } while (0) - #endif -@@ -585,9 +612,8 @@ static inline void tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vm - #ifndef pmd_free_tlb - #define pmd_free_tlb(tlb, pmdp, address) \ - do { \ -- __tlb_adjust_range(tlb, address, PAGE_SIZE); \ -+ tlb_flush_pud_range(tlb, address, PAGE_SIZE); \ - tlb->freed_tables = 1; \ -- tlb->cleared_puds = 1; \ - __pmd_free_tlb(tlb, pmdp, address); \ - } while (0) - #endif -@@ -596,9 +622,8 @@ static inline void tlb_end_vma(struct mmu_gather *tlb, struct vm_area_struct *vm - #ifndef pud_free_tlb - #define pud_free_tlb(tlb, pudp, address) \ - do { \ -- __tlb_adjust_range(tlb, address, PAGE_SIZE); \ -+ tlb_flush_p4d_range(tlb, address, PAGE_SIZE); \ - tlb->freed_tables = 1; \ -- tlb->cleared_p4ds = 1; \ - __pud_free_tlb(tlb, pudp, address); \ - } while (0) - #endif -diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h -index b465f8f3e554f..04e87f4b9417c 100644 ---- a/include/linux/virtio_net.h -+++ b/include/linux/virtio_net.h -@@ -120,10 +120,15 @@ retry: - - if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { - u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); -+ unsigned int nh_off = p_off; - struct skb_shared_info *shinfo = skb_shinfo(skb); - -+ /* UFO may not include transport header in gso_size. */ -+ if (gso_type & SKB_GSO_UDP) -+ nh_off -= thlen; -+ - /* Too small packets are not really GSO ones. */ -- if (skb->len - p_off > gso_size) { -+ if (skb->len - nh_off > gso_size) { - shinfo->gso_size = gso_size; - shinfo->gso_type = gso_type; - -diff --git a/include/rdma/rdma_netlink.h b/include/rdma/rdma_netlink.h -index ab22759de7ea0..7b3ef7a3d8d04 100644 ---- a/include/rdma/rdma_netlink.h -+++ b/include/rdma/rdma_netlink.h -@@ -30,7 +30,7 @@ enum rdma_nl_flags { - * constant as well and the compiler checks they are the same. - */ - #define MODULE_ALIAS_RDMA_NETLINK(_index, _val) \ -- static inline void __chk_##_index(void) \ -+ static inline void __maybe_unused __chk_##_index(void) \ - { \ - BUILD_BUG_ON(_index != _val); \ - } \ -diff --git a/include/sound/hdaudio_ext.h b/include/sound/hdaudio_ext.h -index ef88b20c7b0a5..23dc8deac344d 100644 ---- a/include/sound/hdaudio_ext.h -+++ b/include/sound/hdaudio_ext.h -@@ -88,6 +88,8 @@ struct hdac_ext_stream *snd_hdac_ext_stream_assign(struct hdac_bus *bus, - struct snd_pcm_substream *substream, - int type); - void snd_hdac_ext_stream_release(struct hdac_ext_stream *azx_dev, int type); -+void snd_hdac_ext_stream_decouple_locked(struct hdac_bus *bus, -+ struct hdac_ext_stream *azx_dev, bool decouple); - void snd_hdac_ext_stream_decouple(struct hdac_bus *bus, - struct hdac_ext_stream *azx_dev, bool decouple); - void snd_hdac_ext_stop_streams(struct hdac_bus *bus); -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 7c9716fe731e2..59d7ebb8bbaf4 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -781,8 +781,9 @@ struct se_device { - atomic_long_t read_bytes; - atomic_long_t write_bytes; - /* Active commands on this virtual SE device */ -- atomic_t simple_cmds; -- atomic_t dev_ordered_sync; -+ atomic_t non_ordered; -+ bool ordered_sync_in_progress; -+ atomic_t delayed_cmd_count; - atomic_t dev_qf_count; - u32 export_count; - spinlock_t delayed_cmd_lock; -@@ -804,6 +805,7 @@ struct se_device { - struct list_head dev_sep_list; - struct list_head dev_tmr_list; - struct work_struct qf_work_queue; -+ struct work_struct delayed_cmd_work; - struct list_head delayed_cmd_list; - struct list_head state_list; - struct list_head qf_cmd_list; -diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h -index 1796ff99c3e9c..a7613efc271ab 100644 ---- a/include/trace/events/f2fs.h -+++ b/include/trace/events/f2fs.h -@@ -793,20 +793,20 @@ TRACE_EVENT(f2fs_lookup_start, - TP_STRUCT__entry( - __field(dev_t, dev) - __field(ino_t, ino) -- __field(const char *, name) -+ __string(name, dentry->d_name.name) - __field(unsigned int, flags) - ), - - TP_fast_assign( - __entry->dev = dir->i_sb->s_dev; - __entry->ino = dir->i_ino; -- __entry->name = dentry->d_name.name; -+ __assign_str(name, dentry->d_name.name); - __entry->flags = flags; - ), - - TP_printk("dev = (%d,%d), pino = %lu, name:%s, flags:%u", - show_dev_ino(__entry), -- __entry->name, -+ __get_str(name), - __entry->flags) - ); - -@@ -820,7 +820,7 @@ TRACE_EVENT(f2fs_lookup_end, - TP_STRUCT__entry( - __field(dev_t, dev) - __field(ino_t, ino) -- __field(const char *, name) -+ __string(name, dentry->d_name.name) - __field(nid_t, cino) - __field(int, err) - ), -@@ -828,14 +828,14 @@ TRACE_EVENT(f2fs_lookup_end, - TP_fast_assign( - __entry->dev = dir->i_sb->s_dev; - __entry->ino = dir->i_ino; -- __entry->name = dentry->d_name.name; -+ __assign_str(name, dentry->d_name.name); - __entry->cino = ino; - __entry->err = err; - ), - - TP_printk("dev = (%d,%d), pino = %lu, name:%s, ino:%u, err:%d", - show_dev_ino(__entry), -- __entry->name, -+ __get_str(name), - __entry->cino, - __entry->err) - ); -diff --git a/ipc/util.c b/ipc/util.c -index 1821b6386d3b4..09c3bd9f8e768 100644 ---- a/ipc/util.c -+++ b/ipc/util.c -@@ -446,8 +446,8 @@ static int ipcget_public(struct ipc_namespace *ns, struct ipc_ids *ids, - static void ipc_kht_remove(struct ipc_ids *ids, struct kern_ipc_perm *ipcp) - { - if (ipcp->key != IPC_PRIVATE) -- rhashtable_remove_fast(&ids->key_ht, &ipcp->khtnode, -- ipc_kht_params); -+ WARN_ON_ONCE(rhashtable_remove_fast(&ids->key_ht, &ipcp->khtnode, -+ ipc_kht_params)); - } - - /** -@@ -462,7 +462,7 @@ void ipc_rmid(struct ipc_ids *ids, struct kern_ipc_perm *ipcp) - { - int idx = ipcid_to_idx(ipcp->id); - -- idr_remove(&ids->ipcs_idr, idx); -+ WARN_ON_ONCE(idr_remove(&ids->ipcs_idr, idx) != ipcp); - ipc_kht_remove(ids, ipcp); - ids->in_use--; - ipcp->deleted = true; -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 1993a741d2dc5..6ffe3d3e7b06d 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -6536,7 +6536,6 @@ void perf_output_sample(struct perf_output_handle *handle, - static u64 perf_virt_to_phys(u64 virt) - { - u64 phys_addr = 0; -- struct page *p = NULL; - - if (!virt) - return 0; -@@ -6555,14 +6554,15 @@ static u64 perf_virt_to_phys(u64 virt) - * If failed, leave phys_addr as 0. - */ - if (current->mm != NULL) { -+ struct page *p; -+ - pagefault_disable(); -- if (__get_user_pages_fast(virt, 1, 0, &p) == 1) -+ if (__get_user_pages_fast(virt, 1, 0, &p) == 1) { - phys_addr = page_to_phys(p) + virt % PAGE_SIZE; -+ put_page(p); -+ } - pagefault_enable(); - } -- -- if (p) -- put_page(p); - } - - return phys_addr; -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 5dc43d37e6a2b..f8ca0738d729e 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -2482,6 +2482,9 @@ out: - - bool cpus_share_cache(int this_cpu, int that_cpu) - { -+ if (this_cpu == that_cpu) -+ return true; -+ - return per_cpu(sd_llc_id, this_cpu) == per_cpu(sd_llc_id, that_cpu); - } - #endif /* CONFIG_SMP */ -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index f63766366e238..8b33a3c872750 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -149,6 +149,8 @@ struct hist_field { - */ - unsigned int var_ref_idx; - bool read_once; -+ -+ unsigned int var_str_idx; - }; - - static u64 hist_field_none(struct hist_field *field, -@@ -351,6 +353,7 @@ struct hist_trigger_data { - unsigned int n_keys; - unsigned int n_fields; - unsigned int n_vars; -+ unsigned int n_var_str; - unsigned int key_size; - struct tracing_map_sort_key sort_keys[TRACING_MAP_SORT_KEYS_MAX]; - unsigned int n_sort_keys; -@@ -2305,7 +2308,12 @@ static int hist_trigger_elt_data_alloc(struct tracing_map_elt *elt) - } - } - -- n_str = hist_data->n_field_var_str + hist_data->n_save_var_str; -+ n_str = hist_data->n_field_var_str + hist_data->n_save_var_str + -+ hist_data->n_var_str; -+ if (n_str > SYNTH_FIELDS_MAX) { -+ hist_elt_data_free(elt_data); -+ return -EINVAL; -+ } - - size = STR_VAR_LEN_MAX; - -@@ -2582,9 +2590,10 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data, - if (!hist_field->type) - goto free; - -- if (field->filter_type == FILTER_STATIC_STRING) -+ if (field->filter_type == FILTER_STATIC_STRING) { - hist_field->fn = hist_field_string; -- else if (field->filter_type == FILTER_DYN_STRING) -+ hist_field->size = field->size; -+ } else if (field->filter_type == FILTER_DYN_STRING) - hist_field->fn = hist_field_dynstring; - else - hist_field->fn = hist_field_pstring; -@@ -3522,7 +3531,7 @@ static inline void __update_field_vars(struct tracing_map_elt *elt, - char *str = elt_data->field_var_str[j++]; - char *val_str = (char *)(uintptr_t)var_val; - -- strscpy(str, val_str, STR_VAR_LEN_MAX); -+ strscpy(str, val_str, val->size); - var_val = (u64)(uintptr_t)str; - } - tracing_map_set_var(elt, var_idx, var_val); -@@ -4599,6 +4608,7 @@ static int create_var_field(struct hist_trigger_data *hist_data, - { - struct trace_array *tr = hist_data->event_file->tr; - unsigned long flags = 0; -+ int ret; - - if (WARN_ON(val_idx >= TRACING_MAP_VALS_MAX + TRACING_MAP_VARS_MAX)) - return -EINVAL; -@@ -4613,7 +4623,12 @@ static int create_var_field(struct hist_trigger_data *hist_data, - if (WARN_ON(hist_data->n_vars > TRACING_MAP_VARS_MAX)) - return -EINVAL; - -- return __create_val_field(hist_data, val_idx, file, var_name, expr_str, flags); -+ ret = __create_val_field(hist_data, val_idx, file, var_name, expr_str, flags); -+ -+ if (hist_data->fields[val_idx]->flags & HIST_FIELD_FL_STRING) -+ hist_data->fields[val_idx]->var_str_idx = hist_data->n_var_str++; -+ -+ return ret; - } - - static int create_val_fields(struct hist_trigger_data *hist_data, -@@ -5333,6 +5348,22 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, - hist_val = hist_field->fn(hist_field, elt, rbe, rec); - if (hist_field->flags & HIST_FIELD_FL_VAR) { - var_idx = hist_field->var.idx; -+ -+ if (hist_field->flags & HIST_FIELD_FL_STRING) { -+ unsigned int str_start, var_str_idx, idx; -+ char *str, *val_str; -+ -+ str_start = hist_data->n_field_var_str + -+ hist_data->n_save_var_str; -+ var_str_idx = hist_field->var_str_idx; -+ idx = str_start + var_str_idx; -+ -+ str = elt_data->field_var_str[idx]; -+ val_str = (char *)(uintptr_t)hist_val; -+ strscpy(str, val_str, hist_field->size); -+ -+ hist_val = (u64)(uintptr_t)str; -+ } - tracing_map_set_var(elt, var_idx, hist_val); - continue; - } -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 95a32749af4da..20da6ede77041 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -3589,6 +3589,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, - struct hstate *h = hstate_vma(vma); - unsigned long sz = huge_page_size(h); - struct mmu_notifier_range range; -+ bool force_flush = false; - - WARN_ON(!is_vm_hugetlb_page(vma)); - BUG_ON(start & ~huge_page_mask(h)); -@@ -3617,10 +3618,8 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, - ptl = huge_pte_lock(h, mm, ptep); - if (huge_pmd_unshare(mm, &address, ptep)) { - spin_unlock(ptl); -- /* -- * We just unmapped a page of PMDs by clearing a PUD. -- * The caller's TLB flush range should cover this area. -- */ -+ tlb_flush_pmd_range(tlb, address & PUD_MASK, PUD_SIZE); -+ force_flush = true; - continue; - } - -@@ -3677,6 +3676,22 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma, - } - mmu_notifier_invalidate_range_end(&range); - tlb_end_vma(tlb, vma); -+ -+ /* -+ * If we unshared PMDs, the TLB flush was not recorded in mmu_gather. We -+ * could defer the flush until now, since by holding i_mmap_rwsem we -+ * guaranteed that the last refernece would not be dropped. But we must -+ * do the flushing before we return, as otherwise i_mmap_rwsem will be -+ * dropped and the last reference to the shared PMDs page might be -+ * dropped as well. -+ * -+ * In theory we could defer the freeing of the PMD pages as well, but -+ * huge_pmd_unshare() relies on the exact page_count for the PMD page to -+ * detect sharing, so we cannot defer the release of the page either. -+ * Instead, do flush now. -+ */ -+ if (force_flush) -+ tlb_flush_mmu_tlbonly(tlb); - } - - void __unmap_hugepage_range_final(struct mmu_gather *tlb, -diff --git a/mm/slab.h b/mm/slab.h -index b2b01694dc43f..61feda3d7e008 100644 ---- a/mm/slab.h -+++ b/mm/slab.h -@@ -211,7 +211,7 @@ static inline slab_flags_t kmem_cache_flags(unsigned int object_size, - #define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE | SLAB_RECLAIM_ACCOUNT | \ - SLAB_TEMPORARY | SLAB_ACCOUNT) - #else --#define SLAB_CACHE_FLAGS (0) -+#define SLAB_CACHE_FLAGS (SLAB_NOLEAKTRACE) - #endif - - /* Common flags available with current configuration */ -diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c -index 385fccdcf69d0..0da90e73c79bf 100644 ---- a/net/batman-adv/fragmentation.c -+++ b/net/batman-adv/fragmentation.c -@@ -391,6 +391,7 @@ out: - - /** - * batadv_frag_create() - create a fragment from skb -+ * @net_dev: outgoing device for fragment - * @skb: skb to create fragment from - * @frag_head: header to use in new fragment - * @fragment_size: size of new fragment -@@ -401,22 +402,25 @@ out: - * - * Return: the new fragment, NULL on error. - */ --static struct sk_buff *batadv_frag_create(struct sk_buff *skb, -+static struct sk_buff *batadv_frag_create(struct net_device *net_dev, -+ struct sk_buff *skb, - struct batadv_frag_packet *frag_head, - unsigned int fragment_size) - { -+ unsigned int ll_reserved = LL_RESERVED_SPACE(net_dev); -+ unsigned int tailroom = net_dev->needed_tailroom; - struct sk_buff *skb_fragment; - unsigned int header_size = sizeof(*frag_head); - unsigned int mtu = fragment_size + header_size; - -- skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN); -+ skb_fragment = dev_alloc_skb(ll_reserved + mtu + tailroom); - if (!skb_fragment) - goto err; - - skb_fragment->priority = skb->priority; - - /* Eat the last mtu-bytes of the skb */ -- skb_reserve(skb_fragment, header_size + ETH_HLEN); -+ skb_reserve(skb_fragment, ll_reserved + header_size); - skb_split(skb, skb_fragment, skb->len - fragment_size); - - /* Add the header */ -@@ -439,11 +443,12 @@ int batadv_frag_send_packet(struct sk_buff *skb, - struct batadv_orig_node *orig_node, - struct batadv_neigh_node *neigh_node) - { -+ struct net_device *net_dev = neigh_node->if_incoming->net_dev; - struct batadv_priv *bat_priv; - struct batadv_hard_iface *primary_if = NULL; - struct batadv_frag_packet frag_header; - struct sk_buff *skb_fragment; -- unsigned int mtu = neigh_node->if_incoming->net_dev->mtu; -+ unsigned int mtu = net_dev->mtu; - unsigned int header_size = sizeof(frag_header); - unsigned int max_fragment_size, num_fragments; - int ret; -@@ -503,7 +508,7 @@ int batadv_frag_send_packet(struct sk_buff *skb, - goto put_primary_if; - } - -- skb_fragment = batadv_frag_create(skb, &frag_header, -+ skb_fragment = batadv_frag_create(net_dev, skb, &frag_header, - max_fragment_size); - if (!skb_fragment) { - ret = -ENOMEM; -@@ -522,13 +527,14 @@ int batadv_frag_send_packet(struct sk_buff *skb, - frag_header.no++; - } - -- /* Make room for the fragment header. */ -- if (batadv_skb_head_push(skb, header_size) < 0 || -- pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) { -- ret = -ENOMEM; -+ /* make sure that there is at least enough head for the fragmentation -+ * and ethernet headers -+ */ -+ ret = skb_cow_head(skb, ETH_HLEN + header_size); -+ if (ret < 0) - goto put_primary_if; -- } - -+ skb_push(skb, header_size); - memcpy(skb->data, &frag_header, header_size); - - /* Send the last fragment */ -diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c -index afb52282d5bd0..18e644f3cb309 100644 ---- a/net/batman-adv/hard-interface.c -+++ b/net/batman-adv/hard-interface.c -@@ -554,6 +554,9 @@ static void batadv_hardif_recalc_extra_skbroom(struct net_device *soft_iface) - needed_headroom = lower_headroom + (lower_header_len - ETH_HLEN); - needed_headroom += batadv_max_header_len(); - -+ /* fragmentation headers don't strip the unicast/... header */ -+ needed_headroom += sizeof(struct batadv_frag_packet); -+ - soft_iface->needed_headroom = needed_headroom; - soft_iface->needed_tailroom = lower_tailroom; - } -diff --git a/net/nfc/core.c b/net/nfc/core.c -index c5f9c3ee82f8e..e752692d36802 100644 ---- a/net/nfc/core.c -+++ b/net/nfc/core.c -@@ -94,13 +94,13 @@ int nfc_dev_up(struct nfc_dev *dev) - - device_lock(&dev->dev); - -- if (dev->rfkill && rfkill_blocked(dev->rfkill)) { -- rc = -ERFKILL; -+ if (!device_is_registered(&dev->dev)) { -+ rc = -ENODEV; - goto error; - } - -- if (!device_is_registered(&dev->dev)) { -- rc = -ENODEV; -+ if (dev->rfkill && rfkill_blocked(dev->rfkill)) { -+ rc = -ERFKILL; - goto error; - } - -@@ -1118,11 +1118,7 @@ int nfc_register_device(struct nfc_dev *dev) - if (rc) - pr_err("Could not register llcp device\n"); - -- rc = nfc_genl_device_added(dev); -- if (rc) -- pr_debug("The userspace won't be notified that the device %s was added\n", -- dev_name(&dev->dev)); -- -+ device_lock(&dev->dev); - dev->rfkill = rfkill_alloc(dev_name(&dev->dev), &dev->dev, - RFKILL_TYPE_NFC, &nfc_rfkill_ops, dev); - if (dev->rfkill) { -@@ -1131,6 +1127,12 @@ int nfc_register_device(struct nfc_dev *dev) - dev->rfkill = NULL; - } - } -+ device_unlock(&dev->dev); -+ -+ rc = nfc_genl_device_added(dev); -+ if (rc) -+ pr_debug("The userspace won't be notified that the device %s was added\n", -+ dev_name(&dev->dev)); - - return 0; - } -@@ -1147,10 +1149,17 @@ void nfc_unregister_device(struct nfc_dev *dev) - - pr_debug("dev_name=%s\n", dev_name(&dev->dev)); - -+ rc = nfc_genl_device_removed(dev); -+ if (rc) -+ pr_debug("The userspace won't be notified that the device %s " -+ "was removed\n", dev_name(&dev->dev)); -+ -+ device_lock(&dev->dev); - if (dev->rfkill) { - rfkill_unregister(dev->rfkill); - rfkill_destroy(dev->rfkill); - } -+ device_unlock(&dev->dev); - - if (dev->ops->check_presence) { - device_lock(&dev->dev); -@@ -1160,11 +1169,6 @@ void nfc_unregister_device(struct nfc_dev *dev) - cancel_work_sync(&dev->check_pres_work); - } - -- rc = nfc_genl_device_removed(dev); -- if (rc) -- pr_debug("The userspace won't be notified that the device %s " -- "was removed\n", dev_name(&dev->dev)); -- - nfc_llcp_unregister_device(dev); - - mutex_lock(&nfc_devlist_mutex); -diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c -index 6a34a0a786eaa..1d0aa9e6044bf 100644 ---- a/net/nfc/nci/core.c -+++ b/net/nfc/nci/core.c -@@ -144,12 +144,15 @@ inline int nci_request(struct nci_dev *ndev, - { - int rc; - -- if (!test_bit(NCI_UP, &ndev->flags)) -- return -ENETDOWN; -- - /* Serialize all requests */ - mutex_lock(&ndev->req_lock); -- rc = __nci_request(ndev, req, opt, timeout); -+ /* check the state after obtaing the lock against any races -+ * from nci_close_device when the device gets removed. -+ */ -+ if (test_bit(NCI_UP, &ndev->flags)) -+ rc = __nci_request(ndev, req, opt, timeout); -+ else -+ rc = -ENETDOWN; - mutex_unlock(&ndev->req_lock); - - return rc; -diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c -index e3ff884a48c56..b87d2a1ee0b16 100644 ---- a/net/sched/act_mirred.c -+++ b/net/sched/act_mirred.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -218,6 +219,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, - bool want_ingress; - bool is_redirect; - bool expects_nh; -+ bool at_ingress; - int m_eaction; - int mac_len; - bool at_nh; -@@ -253,7 +255,8 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, - * ingress - that covers the TC S/W datapath. - */ - is_redirect = tcf_mirred_is_act_redirect(m_eaction); -- use_reinsert = skb_at_tc_ingress(skb) && is_redirect && -+ at_ingress = skb_at_tc_ingress(skb); -+ use_reinsert = at_ingress && is_redirect && - tcf_mirred_can_reinsert(retval); - if (!use_reinsert) { - skb2 = skb_clone(skb, GFP_ATOMIC); -@@ -261,10 +264,12 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, - goto out; - } - -+ want_ingress = tcf_mirred_act_wants_ingress(m_eaction); -+ - /* All mirred/redirected skbs should clear previous ct info */ - nf_reset_ct(skb2); -- -- want_ingress = tcf_mirred_act_wants_ingress(m_eaction); -+ if (want_ingress && !at_ingress) /* drop dst for egress -> ingress */ -+ skb_dst_drop(skb2); - - expects_nh = want_ingress || !m_mac_header_xmit; - at_nh = skb->data == skb_network_header(skb); -diff --git a/net/wireless/util.c b/net/wireless/util.c -index aaefaf3422a1a..95533732f9d6f 100644 ---- a/net/wireless/util.c -+++ b/net/wireless/util.c -@@ -991,6 +991,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev, - - switch (otype) { - case NL80211_IFTYPE_AP: -+ case NL80211_IFTYPE_P2P_GO: - cfg80211_stop_ap(rdev, dev, true); - break; - case NL80211_IFTYPE_ADHOC: -diff --git a/sound/core/Makefile b/sound/core/Makefile -index ee4a4a6b99ba7..d123587c0fd8f 100644 ---- a/sound/core/Makefile -+++ b/sound/core/Makefile -@@ -9,7 +9,9 @@ ifneq ($(CONFIG_SND_PROC_FS),) - snd-y += info.o - snd-$(CONFIG_SND_OSSEMUL) += info_oss.o - endif -+ifneq ($(CONFIG_M68K),y) - snd-$(CONFIG_ISA_DMA_API) += isadma.o -+endif - snd-$(CONFIG_SND_OSSEMUL) += sound_oss.o - snd-$(CONFIG_SND_VMASTER) += vmaster.o - snd-$(CONFIG_SND_JACK) += ctljack.o jack.o -diff --git a/sound/hda/ext/hdac_ext_stream.c b/sound/hda/ext/hdac_ext_stream.c -index 6b1b4b834baef..04f4070fbf366 100644 ---- a/sound/hda/ext/hdac_ext_stream.c -+++ b/sound/hda/ext/hdac_ext_stream.c -@@ -106,20 +106,14 @@ void snd_hdac_stream_free_all(struct hdac_bus *bus) - } - EXPORT_SYMBOL_GPL(snd_hdac_stream_free_all); - --/** -- * snd_hdac_ext_stream_decouple - decouple the hdac stream -- * @bus: HD-audio core bus -- * @stream: HD-audio ext core stream object to initialize -- * @decouple: flag to decouple -- */ --void snd_hdac_ext_stream_decouple(struct hdac_bus *bus, -- struct hdac_ext_stream *stream, bool decouple) -+void snd_hdac_ext_stream_decouple_locked(struct hdac_bus *bus, -+ struct hdac_ext_stream *stream, -+ bool decouple) - { - struct hdac_stream *hstream = &stream->hstream; - u32 val; - int mask = AZX_PPCTL_PROCEN(hstream->index); - -- spin_lock_irq(&bus->reg_lock); - val = readw(bus->ppcap + AZX_REG_PP_PPCTL) & mask; - - if (decouple && !val) -@@ -128,6 +122,20 @@ void snd_hdac_ext_stream_decouple(struct hdac_bus *bus, - snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, mask, 0); - - stream->decoupled = decouple; -+} -+EXPORT_SYMBOL_GPL(snd_hdac_ext_stream_decouple_locked); -+ -+/** -+ * snd_hdac_ext_stream_decouple - decouple the hdac stream -+ * @bus: HD-audio core bus -+ * @stream: HD-audio ext core stream object to initialize -+ * @decouple: flag to decouple -+ */ -+void snd_hdac_ext_stream_decouple(struct hdac_bus *bus, -+ struct hdac_ext_stream *stream, bool decouple) -+{ -+ spin_lock_irq(&bus->reg_lock); -+ snd_hdac_ext_stream_decouple_locked(bus, stream, decouple); - spin_unlock_irq(&bus->reg_lock); - } - EXPORT_SYMBOL_GPL(snd_hdac_ext_stream_decouple); -@@ -252,6 +260,7 @@ hdac_ext_link_stream_assign(struct hdac_bus *bus, - return NULL; - } - -+ spin_lock_irq(&bus->reg_lock); - list_for_each_entry(stream, &bus->stream_list, list) { - struct hdac_ext_stream *hstream = container_of(stream, - struct hdac_ext_stream, -@@ -266,17 +275,16 @@ hdac_ext_link_stream_assign(struct hdac_bus *bus, - } - - if (!hstream->link_locked) { -- snd_hdac_ext_stream_decouple(bus, hstream, true); -+ snd_hdac_ext_stream_decouple_locked(bus, hstream, true); - res = hstream; - break; - } - } - if (res) { -- spin_lock_irq(&bus->reg_lock); - res->link_locked = 1; - res->link_substream = substream; -- spin_unlock_irq(&bus->reg_lock); - } -+ spin_unlock_irq(&bus->reg_lock); - return res; - } - -@@ -292,6 +300,7 @@ hdac_ext_host_stream_assign(struct hdac_bus *bus, - return NULL; - } - -+ spin_lock_irq(&bus->reg_lock); - list_for_each_entry(stream, &bus->stream_list, list) { - struct hdac_ext_stream *hstream = container_of(stream, - struct hdac_ext_stream, -@@ -301,18 +310,17 @@ hdac_ext_host_stream_assign(struct hdac_bus *bus, - - if (!stream->opened) { - if (!hstream->decoupled) -- snd_hdac_ext_stream_decouple(bus, hstream, true); -+ snd_hdac_ext_stream_decouple_locked(bus, hstream, true); - res = hstream; - break; - } - } - if (res) { -- spin_lock_irq(&bus->reg_lock); - res->hstream.opened = 1; - res->hstream.running = 0; - res->hstream.substream = substream; -- spin_unlock_irq(&bus->reg_lock); - } -+ spin_unlock_irq(&bus->reg_lock); - - return res; - } -@@ -378,15 +386,17 @@ void snd_hdac_ext_stream_release(struct hdac_ext_stream *stream, int type) - break; - - case HDAC_EXT_STREAM_TYPE_HOST: -+ spin_lock_irq(&bus->reg_lock); - if (stream->decoupled && !stream->link_locked) -- snd_hdac_ext_stream_decouple(bus, stream, false); -+ snd_hdac_ext_stream_decouple_locked(bus, stream, false); -+ spin_unlock_irq(&bus->reg_lock); - snd_hdac_stream_release(&stream->hstream); - break; - - case HDAC_EXT_STREAM_TYPE_LINK: -- if (stream->decoupled && !stream->hstream.opened) -- snd_hdac_ext_stream_decouple(bus, stream, false); - spin_lock_irq(&bus->reg_lock); -+ if (stream->decoupled && !stream->hstream.opened) -+ snd_hdac_ext_stream_decouple_locked(bus, stream, false); - stream->link_locked = 0; - stream->link_substream = NULL; - spin_unlock_irq(&bus->reg_lock); -diff --git a/sound/hda/hdac_stream.c b/sound/hda/hdac_stream.c -index 682ed39f79b01..b299b8b7f871a 100644 ---- a/sound/hda/hdac_stream.c -+++ b/sound/hda/hdac_stream.c -@@ -289,6 +289,7 @@ struct hdac_stream *snd_hdac_stream_assign(struct hdac_bus *bus, - int key = (substream->pcm->device << 16) | (substream->number << 2) | - (substream->stream + 1); - -+ spin_lock_irq(&bus->reg_lock); - list_for_each_entry(azx_dev, &bus->stream_list, list) { - if (azx_dev->direction != substream->stream) - continue; -@@ -302,13 +303,12 @@ struct hdac_stream *snd_hdac_stream_assign(struct hdac_bus *bus, - res = azx_dev; - } - if (res) { -- spin_lock_irq(&bus->reg_lock); - res->opened = 1; - res->running = 0; - res->assigned_key = key; - res->substream = substream; -- spin_unlock_irq(&bus->reg_lock); - } -+ spin_unlock_irq(&bus->reg_lock); - return res; - } - EXPORT_SYMBOL_GPL(snd_hdac_stream_assign); -diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig -index b690ed937cbe8..df2e45c8814e9 100644 ---- a/sound/isa/Kconfig -+++ b/sound/isa/Kconfig -@@ -22,7 +22,7 @@ config SND_SB16_DSP - menuconfig SND_ISA - bool "ISA sound devices" - depends on ISA || COMPILE_TEST -- depends on ISA_DMA_API -+ depends on ISA_DMA_API && !M68K - default y - help - Support for sound devices connected via the ISA bus. -diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c -index a1c770d826dda..6d664dd8dde0b 100644 ---- a/sound/isa/gus/gus_dma.c -+++ b/sound/isa/gus/gus_dma.c -@@ -126,6 +126,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus) - } - block = snd_gf1_dma_next_block(gus); - spin_unlock(&gus->dma_lock); -+ if (!block) -+ return; - snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd); - kfree(block); - #if 0 -diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig -index 7630f808d087c..6edde2f145025 100644 ---- a/sound/pci/Kconfig -+++ b/sound/pci/Kconfig -@@ -279,6 +279,7 @@ config SND_CS46XX_NEW_DSP - config SND_CS5530 - tristate "CS5530 Audio" - depends on ISA_DMA_API && (X86_32 || COMPILE_TEST) -+ depends on !M68K - select SND_SB16_DSP - help - Say Y here to include support for audio on Cyrix/NatSemi CS5530 chips. -diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c -index 15bd8335f6678..c8ccfa2fff848 100644 ---- a/sound/soc/codecs/nau8824.c -+++ b/sound/soc/codecs/nau8824.c -@@ -8,6 +8,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -27,6 +28,12 @@ - - #include "nau8824.h" - -+#define NAU8824_JD_ACTIVE_HIGH BIT(0) -+ -+static int nau8824_quirk; -+static int quirk_override = -1; -+module_param_named(quirk, quirk_override, uint, 0444); -+MODULE_PARM_DESC(quirk, "Board-specific quirk override"); - - static int nau8824_config_sysclk(struct nau8824 *nau8824, - int clk_id, unsigned int freq); -@@ -1875,6 +1882,34 @@ static int nau8824_read_device_properties(struct device *dev, - return 0; - } - -+/* Please keep this list alphabetically sorted */ -+static const struct dmi_system_id nau8824_quirk_table[] = { -+ { -+ /* Cyberbook T116 rugged tablet */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), -+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), -+ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "20170531"), -+ }, -+ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH), -+ }, -+ {} -+}; -+ -+static void nau8824_check_quirks(void) -+{ -+ const struct dmi_system_id *dmi_id; -+ -+ if (quirk_override != -1) { -+ nau8824_quirk = quirk_override; -+ return; -+ } -+ -+ dmi_id = dmi_first_match(nau8824_quirk_table); -+ if (dmi_id) -+ nau8824_quirk = (unsigned long)dmi_id->driver_data; -+} -+ - static int nau8824_i2c_probe(struct i2c_client *i2c, - const struct i2c_device_id *id) - { -@@ -1899,6 +1934,11 @@ static int nau8824_i2c_probe(struct i2c_client *i2c, - nau8824->irq = i2c->irq; - sema_init(&nau8824->jd_sem, 1); - -+ nau8824_check_quirks(); -+ -+ if (nau8824_quirk & NAU8824_JD_ACTIVE_HIGH) -+ nau8824->jkdet_polarity = 0; -+ - nau8824_print_device_properties(nau8824); - - ret = regmap_read(nau8824->regmap, NAU8824_REG_I2C_DEVICE_ID, &value); -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index 66f6b698a5436..5876be5dd9bae 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -2542,8 +2542,13 @@ static struct snd_soc_dapm_widget *dapm_find_widget( - return NULL; - } - --static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, -- const char *pin, int status) -+/* -+ * set the DAPM pin status: -+ * returns 1 when the value has been updated, 0 when unchanged, or a negative -+ * error code; called from kcontrol put callback -+ */ -+static int __snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, -+ const char *pin, int status) - { - struct snd_soc_dapm_widget *w = dapm_find_widget(dapm, pin, true); - int ret = 0; -@@ -2569,6 +2574,18 @@ static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, - return ret; - } - -+/* -+ * similar as __snd_soc_dapm_set_pin(), but returns 0 when successful; -+ * called from several API functions below -+ */ -+static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm, -+ const char *pin, int status) -+{ -+ int ret = __snd_soc_dapm_set_pin(dapm, pin, status); -+ -+ return ret < 0 ? ret : 0; -+} -+ - /** - * snd_soc_dapm_sync_unlocked - scan and power dapm paths - * @dapm: DAPM context -@@ -3584,10 +3601,10 @@ int snd_soc_dapm_put_pin_switch(struct snd_kcontrol *kcontrol, - const char *pin = (const char *)kcontrol->private_value; - int ret; - -- if (ucontrol->value.integer.value[0]) -- ret = snd_soc_dapm_enable_pin(&card->dapm, pin); -- else -- ret = snd_soc_dapm_disable_pin(&card->dapm, pin); -+ mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME); -+ ret = __snd_soc_dapm_set_pin(&card->dapm, pin, -+ !!ucontrol->value.integer.value[0]); -+ mutex_unlock(&card->dapm_mutex); - - snd_soc_dapm_sync(&card->dapm); - return ret; -diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c -index 3f645200d3a5c..b3cdd10c83ae1 100644 ---- a/sound/soc/sof/intel/hda-dai.c -+++ b/sound/soc/sof/intel/hda-dai.c -@@ -67,6 +67,7 @@ static struct hdac_ext_stream * - return NULL; - } - -+ spin_lock_irq(&bus->reg_lock); - list_for_each_entry(stream, &bus->stream_list, list) { - struct hdac_ext_stream *hstream = - stream_to_hdac_ext_stream(stream); -@@ -106,12 +107,12 @@ static struct hdac_ext_stream * - * is updated in snd_hdac_ext_stream_decouple(). - */ - if (!res->decoupled) -- snd_hdac_ext_stream_decouple(bus, res, true); -- spin_lock_irq(&bus->reg_lock); -+ snd_hdac_ext_stream_decouple_locked(bus, res, true); -+ - res->link_locked = 1; - res->link_substream = substream; -- spin_unlock_irq(&bus->reg_lock); - } -+ spin_unlock_irq(&bus->reg_lock); - - return res; - } -diff --git a/tools/perf/bench/futex-lock-pi.c b/tools/perf/bench/futex-lock-pi.c -index 30d97121dc4fb..c54013806ba4a 100644 ---- a/tools/perf/bench/futex-lock-pi.c -+++ b/tools/perf/bench/futex-lock-pi.c -@@ -224,6 +224,7 @@ int bench_futex_lock_pi(int argc, const char **argv) - print_summary(); - - free(worker); -+ perf_cpu_map__put(cpu); - return ret; - err: - usage_with_options(bench_futex_lock_pi_usage, options); -diff --git a/tools/perf/bench/futex-requeue.c b/tools/perf/bench/futex-requeue.c -index a00a6891447ab..11b7dbd374864 100644 ---- a/tools/perf/bench/futex-requeue.c -+++ b/tools/perf/bench/futex-requeue.c -@@ -215,6 +215,7 @@ int bench_futex_requeue(int argc, const char **argv) - print_summary(); - - free(worker); -+ perf_cpu_map__put(cpu); - return ret; - err: - usage_with_options(bench_futex_requeue_usage, options); -diff --git a/tools/perf/bench/futex-wake-parallel.c b/tools/perf/bench/futex-wake-parallel.c -index a053cf2b70397..c3033d0905db1 100644 ---- a/tools/perf/bench/futex-wake-parallel.c -+++ b/tools/perf/bench/futex-wake-parallel.c -@@ -319,6 +319,7 @@ int bench_futex_wake_parallel(int argc, const char **argv) - print_summary(); - - free(blocked_worker); -+ perf_cpu_map__put(cpu); - return ret; - } - #endif /* HAVE_PTHREAD_BARRIER */ -diff --git a/tools/perf/bench/futex-wake.c b/tools/perf/bench/futex-wake.c -index 58906e9499bb0..ad44a78392dc4 100644 ---- a/tools/perf/bench/futex-wake.c -+++ b/tools/perf/bench/futex-wake.c -@@ -209,5 +209,6 @@ int bench_futex_wake(int argc, const char **argv) - print_summary(); - - free(worker); -+ perf_cpu_map__put(cpu); - return ret; - } -diff --git a/tools/perf/tests/shell/record+zstd_comp_decomp.sh b/tools/perf/tests/shell/record+zstd_comp_decomp.sh -index 045723b3d9928..c62af807198de 100755 ---- a/tools/perf/tests/shell/record+zstd_comp_decomp.sh -+++ b/tools/perf/tests/shell/record+zstd_comp_decomp.sh -@@ -12,7 +12,7 @@ skip_if_no_z_record() { - - collect_z_record() { - echo "Collecting compressed record file:" -- [[ "$(uname -m)" != s390x ]] && gflag='-g' -+ [ "$(uname -m)" != s390x ] && gflag='-g' - $perf_tool record -o $trace_file $gflag -z -F 5000 -- \ - dd count=500 if=/dev/urandom of=/dev/null - } -diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c -index c766813d56be0..782c0c8a9a836 100644 ---- a/tools/perf/util/bpf-event.c -+++ b/tools/perf/util/bpf-event.c -@@ -108,7 +108,11 @@ static int perf_env__fetch_btf(struct perf_env *env, - node->data_size = data_size; - memcpy(node->data, data, data_size); - -- perf_env__insert_btf(env, node); -+ if (!perf_env__insert_btf(env, node)) { -+ /* Insertion failed because of a duplicate. */ -+ free(node); -+ return -1; -+ } - return 0; - } - -diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c -index 0fafcf264d235..ef64e197bc8df 100644 ---- a/tools/perf/util/env.c -+++ b/tools/perf/util/env.c -@@ -69,12 +69,13 @@ out: - return node; - } - --void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) -+bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) - { - struct rb_node *parent = NULL; - __u32 btf_id = btf_node->id; - struct btf_node *node; - struct rb_node **p; -+ bool ret = true; - - down_write(&env->bpf_progs.lock); - p = &env->bpf_progs.btfs.rb_node; -@@ -88,6 +89,7 @@ void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) - p = &(*p)->rb_right; - } else { - pr_debug("duplicated btf %u\n", btf_id); -+ ret = false; - goto out; - } - } -@@ -97,6 +99,7 @@ void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) - env->bpf_progs.btfs_cnt++; - out: - up_write(&env->bpf_progs.lock); -+ return ret; - } - - struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id) -diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h -index db40906e29373..37028215d4a53 100644 ---- a/tools/perf/util/env.h -+++ b/tools/perf/util/env.h -@@ -117,6 +117,6 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env, - struct bpf_prog_info_node *info_node); - struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, - __u32 prog_id); --void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node); -+bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node); - struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id); - #endif /* __PERF_ENV_H */ diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.162-163.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.162-163.patch deleted file mode 100644 index a8520b08f8..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.162-163.patch +++ /dev/null @@ -1,4555 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt -index 38dc56a577604..ecec514b31550 100644 ---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt -+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt -@@ -43,19 +43,19 @@ group emmc_nb - - group pwm0 - - pin 11 (GPIO1-11) -- - functions pwm, gpio -+ - functions pwm, led, gpio - - group pwm1 - - pin 12 -- - functions pwm, gpio -+ - functions pwm, led, gpio - - group pwm2 - - pin 13 -- - functions pwm, gpio -+ - functions pwm, led, gpio - - group pwm3 - - pin 14 -- - functions pwm, gpio -+ - functions pwm, led, gpio - - group pmic1 - - pin 7 -diff --git a/Documentation/networking/ipvs-sysctl.txt b/Documentation/networking/ipvs-sysctl.txt -index 056898685d408..fc531c29a2e83 100644 ---- a/Documentation/networking/ipvs-sysctl.txt -+++ b/Documentation/networking/ipvs-sysctl.txt -@@ -30,8 +30,7 @@ conn_reuse_mode - INTEGER - - 0: disable any special handling on port reuse. The new - connection will be delivered to the same real server that was -- servicing the previous connection. This will effectively -- disable expire_nodest_conn. -+ servicing the previous connection. - - bit 1: enable rescheduling of new connections when it is safe. - That is, whenever expire_nodest_conn and for TCP sockets, when -diff --git a/Makefile b/Makefile -index e8b05f7d3b238..91d77df0128b4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 162 -+SUBLEVEL = 163 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi -index 9711170649b69..05d67f9769118 100644 ---- a/arch/arm/boot/dts/bcm5301x.dtsi -+++ b/arch/arm/boot/dts/bcm5301x.dtsi -@@ -242,6 +242,8 @@ - - gpio-controller; - #gpio-cells = <2>; -+ interrupt-controller; -+ #interrupt-cells = <2>; - }; - - pcie0: pcie@12000 { -@@ -387,7 +389,7 @@ - i2c0: i2c@18009000 { - compatible = "brcm,iproc-i2c"; - reg = <0x18009000 0x50>; -- interrupts = ; -+ interrupts = ; - #address-cells = <1>; - #size-cells = <0>; - clock-frequency = <100000>; -diff --git a/arch/arm/mach-socfpga/core.h b/arch/arm/mach-socfpga/core.h -index fc2608b18a0d0..18f01190dcfd4 100644 ---- a/arch/arm/mach-socfpga/core.h -+++ b/arch/arm/mach-socfpga/core.h -@@ -33,7 +33,7 @@ extern void __iomem *sdr_ctl_base_addr; - u32 socfpga_sdram_self_refresh(u32 sdr_base); - extern unsigned int socfpga_sdram_self_refresh_sz; - --extern char secondary_trampoline, secondary_trampoline_end; -+extern char secondary_trampoline[], secondary_trampoline_end[]; - - extern unsigned long socfpga_cpu1start_addr; - -diff --git a/arch/arm/mach-socfpga/platsmp.c b/arch/arm/mach-socfpga/platsmp.c -index fbb80b883e5dd..201191cf68f32 100644 ---- a/arch/arm/mach-socfpga/platsmp.c -+++ b/arch/arm/mach-socfpga/platsmp.c -@@ -20,14 +20,14 @@ - - static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle) - { -- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline; -+ int trampoline_size = secondary_trampoline_end - secondary_trampoline; - - if (socfpga_cpu1start_addr) { - /* This will put CPU #1 into reset. */ - writel(RSTMGR_MPUMODRST_CPU1, - rst_manager_base_addr + SOCFPGA_RSTMGR_MODMPURST); - -- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size); -+ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size); - - writel(__pa_symbol(secondary_startup), - sys_manager_base_addr + (socfpga_cpu1start_addr & 0x000000ff)); -@@ -45,12 +45,12 @@ static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle) - - static int socfpga_a10_boot_secondary(unsigned int cpu, struct task_struct *idle) - { -- int trampoline_size = &secondary_trampoline_end - &secondary_trampoline; -+ int trampoline_size = secondary_trampoline_end - secondary_trampoline; - - if (socfpga_cpu1start_addr) { - writel(RSTMGR_MPUMODRST_CPU1, rst_manager_base_addr + - SOCFPGA_A10_RSTMGR_MODMPURST); -- memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size); -+ memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size); - - writel(__pa_symbol(secondary_startup), - sys_manager_base_addr + (socfpga_cpu1start_addr & 0x00000fff)); -diff --git a/arch/arm64/boot/dts/marvell/armada-3720-db.dts b/arch/arm64/boot/dts/marvell/armada-3720-db.dts -index f2cc00594d64a..3e5789f372069 100644 ---- a/arch/arm64/boot/dts/marvell/armada-3720-db.dts -+++ b/arch/arm64/boot/dts/marvell/armada-3720-db.dts -@@ -128,6 +128,9 @@ - - /* CON15(V2.0)/CON17(V1.4) : PCIe / CON15(V2.0)/CON12(V1.4) :mini-PCIe */ - &pcie0 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>; -+ reset-gpios = <&gpiosb 3 GPIO_ACTIVE_LOW>; - status = "okay"; - }; - -diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts -index 6226e7e809807..a75bb2ea3506d 100644 ---- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts -+++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts -@@ -59,6 +59,7 @@ - phys = <&comphy1 0>; - pinctrl-names = "default"; - pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>; -+ reset-gpios = <&gpiosb 3 GPIO_ACTIVE_LOW>; - }; - - /* J6 */ -diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts -index de0eabff29353..16e73597bb78c 100644 ---- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts -+++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts -@@ -127,10 +127,6 @@ - }; - }; - --&pcie_reset_pins { -- function = "gpio"; --}; -- - &pcie0 { - pinctrl-names = "default"; - pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>; -diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi -index c28611c1c251a..3d15e4ab3f53a 100644 ---- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi -+++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi -@@ -318,7 +318,7 @@ - - pcie_reset_pins: pcie-reset-pins { - groups = "pcie1"; -- function = "pcie"; -+ function = "gpio"; - }; - - pcie_clkreq_pins: pcie-clkreq-pins { -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 9749818eed6d6..2811ecc1f3c71 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -3059,7 +3059,7 @@ config STACKTRACE_SUPPORT - config PGTABLE_LEVELS - int - default 4 if PAGE_SIZE_4KB && MIPS_VA_BITS_48 -- default 3 if 64BIT && !PAGE_SIZE_64KB -+ default 3 if 64BIT && (!PAGE_SIZE_64KB || MIPS_VA_BITS_48) - default 2 - - config MIPS_AUTO_PFN_OFFSET -diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S -index 164483b37d854..99cd24f2ea01b 100644 ---- a/arch/parisc/kernel/vmlinux.lds.S -+++ b/arch/parisc/kernel/vmlinux.lds.S -@@ -56,8 +56,6 @@ SECTIONS - { - . = KERNEL_BINARY_TEXT_START; - -- _stext = .; /* start of kernel text, includes init code & data */ -- - __init_begin = .; - HEAD_TEXT_SECTION - MLONGCALL_DISCARD(INIT_TEXT_SECTION(8)) -@@ -81,6 +79,7 @@ SECTIONS - /* freed after init ends here */ - - _text = .; /* Text and read-only data */ -+ _stext = .; - MLONGCALL_KEEP(INIT_TEXT_SECTION(8)) - .text ALIGN(PAGE_SIZE) : { - TEXT_TEXT -diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c -index 4a91b543a8540..6d34b69729854 100644 ---- a/arch/powerpc/kvm/book3s_hv_builtin.c -+++ b/arch/powerpc/kvm/book3s_hv_builtin.c -@@ -821,6 +821,7 @@ static void flush_guest_tlb(struct kvm *kvm) - "r" (0) : "memory"); - } - asm volatile("ptesync": : :"memory"); -+ // POWER9 congruence-class TLBIEL leaves ERAT. Flush it now. - asm volatile(PPC_RADIX_INVALIDATE_ERAT_GUEST : : :"memory"); - } else { - for (set = 0; set < kvm->arch.tlb_sets; ++set) { -@@ -831,7 +832,9 @@ static void flush_guest_tlb(struct kvm *kvm) - rb += PPC_BIT(51); /* increment set number */ - } - asm volatile("ptesync": : :"memory"); -- asm volatile(PPC_ISA_3_0_INVALIDATE_ERAT : : :"memory"); -+ // POWER9 congruence-class TLBIEL leaves ERAT. Flush it now. -+ if (cpu_has_feature(CPU_FTR_ARCH_300)) -+ asm volatile(PPC_ISA_3_0_INVALIDATE_ERAT : : :"memory"); - } - } - -diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c -index 9ebd01219812c..4438c00acb656 100644 ---- a/arch/s390/mm/pgtable.c -+++ b/arch/s390/mm/pgtable.c -@@ -970,6 +970,7 @@ EXPORT_SYMBOL(get_guest_storage_key); - int pgste_perform_essa(struct mm_struct *mm, unsigned long hva, int orc, - unsigned long *oldpte, unsigned long *oldpgste) - { -+ struct vm_area_struct *vma; - unsigned long pgstev; - spinlock_t *ptl; - pgste_t pgste; -@@ -979,6 +980,10 @@ int pgste_perform_essa(struct mm_struct *mm, unsigned long hva, int orc, - WARN_ON_ONCE(orc > ESSA_MAX); - if (unlikely(orc > ESSA_MAX)) - return -EINVAL; -+ -+ vma = find_vma(mm, hva); -+ if (!vma || hva < vma->vm_start || is_vm_hugetlb_page(vma)) -+ return -EFAULT; - ptep = get_locked_pte(mm, hva, &ptl); - if (unlikely(!ptep)) - return -EFAULT; -@@ -1071,10 +1076,14 @@ EXPORT_SYMBOL(pgste_perform_essa); - int set_pgste_bits(struct mm_struct *mm, unsigned long hva, - unsigned long bits, unsigned long value) - { -+ struct vm_area_struct *vma; - spinlock_t *ptl; - pgste_t new; - pte_t *ptep; - -+ vma = find_vma(mm, hva); -+ if (!vma || hva < vma->vm_start || is_vm_hugetlb_page(vma)) -+ return -EFAULT; - ptep = get_locked_pte(mm, hva, &ptl); - if (unlikely(!ptep)) - return -EFAULT; -@@ -1099,9 +1108,13 @@ EXPORT_SYMBOL(set_pgste_bits); - */ - int get_pgste(struct mm_struct *mm, unsigned long hva, unsigned long *pgstep) - { -+ struct vm_area_struct *vma; - spinlock_t *ptl; - pte_t *ptep; - -+ vma = find_vma(mm, hva); -+ if (!vma || hva < vma->vm_start || is_vm_hugetlb_page(vma)) -+ return -EFAULT; - ptep = get_locked_pte(mm, hva, &ptl); - if (unlikely(!ptep)) - return -EFAULT; -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 47f839bc0234f..1cdc7426bd033 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -3095,7 +3095,7 @@ static void binder_transaction(struct binder_proc *proc, - t->from = thread; - else - t->from = NULL; -- t->sender_euid = proc->cred->euid; -+ t->sender_euid = task_euid(proc->tsk); - t->to_proc = target_proc; - t->to_thread = target_thread; - t->code = tr->code; -diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c -index def41e1bd7364..baf10b73675e2 100644 ---- a/drivers/block/xen-blkfront.c -+++ b/drivers/block/xen-blkfront.c -@@ -80,6 +80,7 @@ enum blkif_state { - BLKIF_STATE_DISCONNECTED, - BLKIF_STATE_CONNECTED, - BLKIF_STATE_SUSPENDED, -+ BLKIF_STATE_ERROR, - }; - - struct grant { -@@ -89,6 +90,7 @@ struct grant { - }; - - enum blk_req_status { -+ REQ_PROCESSING, - REQ_WAITING, - REQ_DONE, - REQ_ERROR, -@@ -533,10 +535,10 @@ static unsigned long blkif_ring_get_request(struct blkfront_ring_info *rinfo, - - id = get_id_from_freelist(rinfo); - rinfo->shadow[id].request = req; -- rinfo->shadow[id].status = REQ_WAITING; -+ rinfo->shadow[id].status = REQ_PROCESSING; - rinfo->shadow[id].associated_id = NO_ASSOCIATED_ID; - -- (*ring_req)->u.rw.id = id; -+ rinfo->shadow[id].req.u.rw.id = id; - - return id; - } -@@ -544,11 +546,12 @@ static unsigned long blkif_ring_get_request(struct blkfront_ring_info *rinfo, - static int blkif_queue_discard_req(struct request *req, struct blkfront_ring_info *rinfo) - { - struct blkfront_info *info = rinfo->dev_info; -- struct blkif_request *ring_req; -+ struct blkif_request *ring_req, *final_ring_req; - unsigned long id; - - /* Fill out a communications ring structure. */ -- id = blkif_ring_get_request(rinfo, req, &ring_req); -+ id = blkif_ring_get_request(rinfo, req, &final_ring_req); -+ ring_req = &rinfo->shadow[id].req; - - ring_req->operation = BLKIF_OP_DISCARD; - ring_req->u.discard.nr_sectors = blk_rq_sectors(req); -@@ -559,8 +562,9 @@ static int blkif_queue_discard_req(struct request *req, struct blkfront_ring_inf - else - ring_req->u.discard.flag = 0; - -- /* Keep a private copy so we can reissue requests when recovering. */ -- rinfo->shadow[id].req = *ring_req; -+ /* Copy the request to the ring page. */ -+ *final_ring_req = *ring_req; -+ rinfo->shadow[id].status = REQ_WAITING; - - return 0; - } -@@ -693,6 +697,7 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri - { - struct blkfront_info *info = rinfo->dev_info; - struct blkif_request *ring_req, *extra_ring_req = NULL; -+ struct blkif_request *final_ring_req, *final_extra_ring_req = NULL; - unsigned long id, extra_id = NO_ASSOCIATED_ID; - bool require_extra_req = false; - int i; -@@ -737,7 +742,8 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri - } - - /* Fill out a communications ring structure. */ -- id = blkif_ring_get_request(rinfo, req, &ring_req); -+ id = blkif_ring_get_request(rinfo, req, &final_ring_req); -+ ring_req = &rinfo->shadow[id].req; - - num_sg = blk_rq_map_sg(req->q, req, rinfo->shadow[id].sg); - num_grant = 0; -@@ -788,7 +794,9 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri - ring_req->u.rw.nr_segments = num_grant; - if (unlikely(require_extra_req)) { - extra_id = blkif_ring_get_request(rinfo, req, -- &extra_ring_req); -+ &final_extra_ring_req); -+ extra_ring_req = &rinfo->shadow[extra_id].req; -+ - /* - * Only the first request contains the scatter-gather - * list. -@@ -830,10 +838,13 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri - if (setup.segments) - kunmap_atomic(setup.segments); - -- /* Keep a private copy so we can reissue requests when recovering. */ -- rinfo->shadow[id].req = *ring_req; -- if (unlikely(require_extra_req)) -- rinfo->shadow[extra_id].req = *extra_ring_req; -+ /* Copy request(s) to the ring page. */ -+ *final_ring_req = *ring_req; -+ rinfo->shadow[id].status = REQ_WAITING; -+ if (unlikely(require_extra_req)) { -+ *final_extra_ring_req = *extra_ring_req; -+ rinfo->shadow[extra_id].status = REQ_WAITING; -+ } - - if (new_persistent_gnts) - gnttab_free_grant_references(setup.gref_head); -@@ -1407,8 +1418,8 @@ static enum blk_req_status blkif_rsp_to_req_status(int rsp) - static int blkif_get_final_status(enum blk_req_status s1, - enum blk_req_status s2) - { -- BUG_ON(s1 == REQ_WAITING); -- BUG_ON(s2 == REQ_WAITING); -+ BUG_ON(s1 < REQ_DONE); -+ BUG_ON(s2 < REQ_DONE); - - if (s1 == REQ_ERROR || s2 == REQ_ERROR) - return BLKIF_RSP_ERROR; -@@ -1441,7 +1452,7 @@ static bool blkif_completion(unsigned long *id, - s->status = blkif_rsp_to_req_status(bret->status); - - /* Wait the second response if not yet here. */ -- if (s2->status == REQ_WAITING) -+ if (s2->status < REQ_DONE) - return false; - - bret->status = blkif_get_final_status(s->status, -@@ -1549,7 +1560,7 @@ static bool blkif_completion(unsigned long *id, - static irqreturn_t blkif_interrupt(int irq, void *dev_id) - { - struct request *req; -- struct blkif_response *bret; -+ struct blkif_response bret; - RING_IDX i, rp; - unsigned long flags; - struct blkfront_ring_info *rinfo = (struct blkfront_ring_info *)dev_id; -@@ -1560,54 +1571,76 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) - - spin_lock_irqsave(&rinfo->ring_lock, flags); - again: -- rp = rinfo->ring.sring->rsp_prod; -- rmb(); /* Ensure we see queued responses up to 'rp'. */ -+ rp = READ_ONCE(rinfo->ring.sring->rsp_prod); -+ virt_rmb(); /* Ensure we see queued responses up to 'rp'. */ -+ if (RING_RESPONSE_PROD_OVERFLOW(&rinfo->ring, rp)) { -+ pr_alert("%s: illegal number of responses %u\n", -+ info->gd->disk_name, rp - rinfo->ring.rsp_cons); -+ goto err; -+ } - - for (i = rinfo->ring.rsp_cons; i != rp; i++) { - unsigned long id; -+ unsigned int op; -+ -+ RING_COPY_RESPONSE(&rinfo->ring, i, &bret); -+ id = bret.id; - -- bret = RING_GET_RESPONSE(&rinfo->ring, i); -- id = bret->id; - /* - * The backend has messed up and given us an id that we would - * never have given to it (we stamp it up to BLK_RING_SIZE - - * look in get_id_from_freelist. - */ - if (id >= BLK_RING_SIZE(info)) { -- WARN(1, "%s: response to %s has incorrect id (%ld)\n", -- info->gd->disk_name, op_name(bret->operation), id); -- /* We can't safely get the 'struct request' as -- * the id is busted. */ -- continue; -+ pr_alert("%s: response has incorrect id (%ld)\n", -+ info->gd->disk_name, id); -+ goto err; - } -+ if (rinfo->shadow[id].status != REQ_WAITING) { -+ pr_alert("%s: response references no pending request\n", -+ info->gd->disk_name); -+ goto err; -+ } -+ -+ rinfo->shadow[id].status = REQ_PROCESSING; - req = rinfo->shadow[id].request; - -- if (bret->operation != BLKIF_OP_DISCARD) { -+ op = rinfo->shadow[id].req.operation; -+ if (op == BLKIF_OP_INDIRECT) -+ op = rinfo->shadow[id].req.u.indirect.indirect_op; -+ if (bret.operation != op) { -+ pr_alert("%s: response has wrong operation (%u instead of %u)\n", -+ info->gd->disk_name, bret.operation, op); -+ goto err; -+ } -+ -+ if (bret.operation != BLKIF_OP_DISCARD) { - /* - * We may need to wait for an extra response if the - * I/O request is split in 2 - */ -- if (!blkif_completion(&id, rinfo, bret)) -+ if (!blkif_completion(&id, rinfo, &bret)) - continue; - } - - if (add_id_to_freelist(rinfo, id)) { - WARN(1, "%s: response to %s (id %ld) couldn't be recycled!\n", -- info->gd->disk_name, op_name(bret->operation), id); -+ info->gd->disk_name, op_name(bret.operation), id); - continue; - } - -- if (bret->status == BLKIF_RSP_OKAY) -+ if (bret.status == BLKIF_RSP_OKAY) - blkif_req(req)->error = BLK_STS_OK; - else - blkif_req(req)->error = BLK_STS_IOERR; - -- switch (bret->operation) { -+ switch (bret.operation) { - case BLKIF_OP_DISCARD: -- if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) { -+ if (unlikely(bret.status == BLKIF_RSP_EOPNOTSUPP)) { - struct request_queue *rq = info->rq; -- printk(KERN_WARNING "blkfront: %s: %s op failed\n", -- info->gd->disk_name, op_name(bret->operation)); -+ -+ pr_warn_ratelimited("blkfront: %s: %s op failed\n", -+ info->gd->disk_name, op_name(bret.operation)); - blkif_req(req)->error = BLK_STS_NOTSUPP; - info->feature_discard = 0; - info->feature_secdiscard = 0; -@@ -1617,15 +1650,15 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) - break; - case BLKIF_OP_FLUSH_DISKCACHE: - case BLKIF_OP_WRITE_BARRIER: -- if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) { -- printk(KERN_WARNING "blkfront: %s: %s op failed\n", -- info->gd->disk_name, op_name(bret->operation)); -+ if (unlikely(bret.status == BLKIF_RSP_EOPNOTSUPP)) { -+ pr_warn_ratelimited("blkfront: %s: %s op failed\n", -+ info->gd->disk_name, op_name(bret.operation)); - blkif_req(req)->error = BLK_STS_NOTSUPP; - } -- if (unlikely(bret->status == BLKIF_RSP_ERROR && -+ if (unlikely(bret.status == BLKIF_RSP_ERROR && - rinfo->shadow[id].req.u.rw.nr_segments == 0)) { -- printk(KERN_WARNING "blkfront: %s: empty %s op failed\n", -- info->gd->disk_name, op_name(bret->operation)); -+ pr_warn_ratelimited("blkfront: %s: empty %s op failed\n", -+ info->gd->disk_name, op_name(bret.operation)); - blkif_req(req)->error = BLK_STS_NOTSUPP; - } - if (unlikely(blkif_req(req)->error)) { -@@ -1638,9 +1671,10 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) - /* fall through */ - case BLKIF_OP_READ: - case BLKIF_OP_WRITE: -- if (unlikely(bret->status != BLKIF_RSP_OKAY)) -- dev_dbg(&info->xbdev->dev, "Bad return from blkdev data " -- "request: %x\n", bret->status); -+ if (unlikely(bret.status != BLKIF_RSP_OKAY)) -+ dev_dbg_ratelimited(&info->xbdev->dev, -+ "Bad return from blkdev data request: %#x\n", -+ bret.status); - - break; - default: -@@ -1665,6 +1699,14 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id) - spin_unlock_irqrestore(&rinfo->ring_lock, flags); - - return IRQ_HANDLED; -+ -+ err: -+ info->connected = BLKIF_STATE_ERROR; -+ -+ spin_unlock_irqrestore(&rinfo->ring_lock, flags); -+ -+ pr_alert("%s disabled for further use\n", info->gd->disk_name); -+ return IRQ_HANDLED; - } - - -diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c -index 041f8152272bf..177874adccf0d 100644 ---- a/drivers/firmware/arm_scmi/scmi_pm_domain.c -+++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c -@@ -106,9 +106,7 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) - scmi_pd_data->domains = domains; - scmi_pd_data->num_domains = num_domains; - -- of_genpd_add_provider_onecell(np, scmi_pd_data); -- -- return 0; -+ return of_genpd_add_provider_onecell(np, scmi_pd_data); - } - - static const struct scmi_device_id scmi_id_table[] = { -diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c -index 72d30d90b856c..0af246a5609ca 100644 ---- a/drivers/gpu/drm/vc4/vc4_bo.c -+++ b/drivers/gpu/drm/vc4/vc4_bo.c -@@ -389,7 +389,7 @@ struct drm_gem_object *vc4_create_object(struct drm_device *dev, size_t size) - - bo = kzalloc(sizeof(*bo), GFP_KERNEL); - if (!bo) -- return ERR_PTR(-ENOMEM); -+ return NULL; - - bo->madv = VC4_MADV_WILLNEED; - refcount_set(&bo->usecnt, 0); -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index f6be2e70a4967..e011839f19f89 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -2578,6 +2578,9 @@ static void wacom_wac_finger_event(struct hid_device *hdev, - return; - - switch (equivalent_usage) { -+ case HID_DG_CONFIDENCE: -+ wacom_wac->hid_data.confidence = value; -+ break; - case HID_GD_X: - wacom_wac->hid_data.x = value; - break; -@@ -2610,7 +2613,8 @@ static void wacom_wac_finger_event(struct hid_device *hdev, - } - - if (usage->usage_index + 1 == field->report_count) { -- if (equivalent_usage == wacom_wac->hid_data.last_slot_field) -+ if (equivalent_usage == wacom_wac->hid_data.last_slot_field && -+ wacom_wac->hid_data.confidence) - wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input); - } - } -@@ -2625,6 +2629,8 @@ static void wacom_wac_finger_pre_report(struct hid_device *hdev, - - wacom_wac->is_invalid_bt_frame = false; - -+ hid_data->confidence = true; -+ - for (i = 0; i < report->maxfield; i++) { - struct hid_field *field = report->field[i]; - int j; -diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h -index e3835407e8d23..8dea7cb298e69 100644 ---- a/drivers/hid/wacom_wac.h -+++ b/drivers/hid/wacom_wac.h -@@ -300,6 +300,7 @@ struct hid_data { - bool tipswitch; - bool barrelswitch; - bool barrelswitch2; -+ bool confidence; - int x; - int y; - int pressure; -diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c -index 06383b26712b6..56857ac0a0be2 100644 ---- a/drivers/media/cec/cec-adap.c -+++ b/drivers/media/cec/cec-adap.c -@@ -1191,6 +1191,7 @@ void cec_received_msg_ts(struct cec_adapter *adap, - if (abort) - dst->rx_status |= CEC_RX_STATUS_FEATURE_ABORT; - msg->flags = dst->flags; -+ msg->sequence = dst->sequence; - /* Remove it from the wait_queue */ - list_del_init(&data->list); - -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index cb54fa2120d72..deafcc56adee6 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -749,7 +749,19 @@ static void sdhci_adma_table_pre(struct sdhci_host *host, - len -= offset; - } - -- BUG_ON(len > 65536); -+ /* -+ * The block layer forces a minimum segment size of PAGE_SIZE, -+ * so 'len' can be too big here if PAGE_SIZE >= 64KiB. Write -+ * multiple descriptors, noting that the ADMA table is sized -+ * for 4KiB chunks anyway, so it will be big enough. -+ */ -+ while (len > host->max_adma) { -+ int n = 32 * 1024; /* 32KiB*/ -+ -+ __sdhci_adma_write_desc(host, &desc, addr, n, ADMA2_TRAN_VALID); -+ addr += n; -+ len -= n; -+ } - - /* tran, valid */ - if (len) -@@ -3568,6 +3580,7 @@ struct sdhci_host *sdhci_alloc_host(struct device *dev, - * descriptor for each segment, plus 1 for a nop end descriptor. - */ - host->adma_table_cnt = SDHCI_MAX_SEGS * 2 + 1; -+ host->max_adma = 65536; - - return host; - } -@@ -4221,10 +4234,12 @@ int sdhci_setup_host(struct sdhci_host *host) - * be larger than 64 KiB though. - */ - if (host->flags & SDHCI_USE_ADMA) { -- if (host->quirks & SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC) -+ if (host->quirks & SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC) { -+ host->max_adma = 65532; /* 32-bit alignment */ - mmc->max_seg_size = 65535; -- else -+ } else { - mmc->max_seg_size = 65536; -+ } - } else { - mmc->max_seg_size = mmc->max_req_size; - } -diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h -index 96a0a8f97f559..54f9d6720f132 100644 ---- a/drivers/mmc/host/sdhci.h -+++ b/drivers/mmc/host/sdhci.h -@@ -349,7 +349,8 @@ struct sdhci_adma2_64_desc { - - /* - * Maximum segments assuming a 512KiB maximum requisition size and a minimum -- * 4KiB page size. -+ * 4KiB page size. Note this also allows enough for multiple descriptors in -+ * case of PAGE_SIZE >= 64KiB. - */ - #define SDHCI_MAX_SEGS 128 - -@@ -547,6 +548,7 @@ struct sdhci_host { - unsigned int blocks; /* remaining PIO blocks */ - - int sg_count; /* Mapped sg entries */ -+ int max_adma; /* Max. length in ADMA descriptor */ - - void *adma_table; /* ADMA descriptor table */ - void *align_buffer; /* Bounce buffer */ -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -index db2e9dd5681eb..ce6a4e1965e1d 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -@@ -644,9 +644,9 @@ static int hclgevf_set_rss_tc_mode(struct hclgevf_dev *hdev, u16 rss_size) - roundup_size = ilog2(roundup_size); - - for (i = 0; i < HCLGEVF_MAX_TC_NUM; i++) { -- tc_valid[i] = !!(hdev->hw_tc_map & BIT(i)); -+ tc_valid[i] = 1; - tc_size[i] = roundup_size; -- tc_offset[i] = rss_size * i; -+ tc_offset[i] = (hdev->hw_tc_map & BIT(i)) ? rss_size * i : 0; - } - - hclgevf_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_RSS_TC_MODE, false); -diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -index ad1e796e5544a..4e0e1b02d615e 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c -@@ -719,12 +719,31 @@ static int iavf_get_per_queue_coalesce(struct net_device *netdev, u32 queue, - * - * Change the ITR settings for a specific queue. - **/ --static void iavf_set_itr_per_queue(struct iavf_adapter *adapter, -- struct ethtool_coalesce *ec, int queue) -+static int iavf_set_itr_per_queue(struct iavf_adapter *adapter, -+ struct ethtool_coalesce *ec, int queue) - { - struct iavf_ring *rx_ring = &adapter->rx_rings[queue]; - struct iavf_ring *tx_ring = &adapter->tx_rings[queue]; - struct iavf_q_vector *q_vector; -+ u16 itr_setting; -+ -+ itr_setting = rx_ring->itr_setting & ~IAVF_ITR_DYNAMIC; -+ -+ if (ec->rx_coalesce_usecs != itr_setting && -+ ec->use_adaptive_rx_coalesce) { -+ netif_info(adapter, drv, adapter->netdev, -+ "Rx interrupt throttling cannot be changed if adaptive-rx is enabled\n"); -+ return -EINVAL; -+ } -+ -+ itr_setting = tx_ring->itr_setting & ~IAVF_ITR_DYNAMIC; -+ -+ if (ec->tx_coalesce_usecs != itr_setting && -+ ec->use_adaptive_tx_coalesce) { -+ netif_info(adapter, drv, adapter->netdev, -+ "Tx interrupt throttling cannot be changed if adaptive-tx is enabled\n"); -+ return -EINVAL; -+ } - - rx_ring->itr_setting = ITR_REG_ALIGN(ec->rx_coalesce_usecs); - tx_ring->itr_setting = ITR_REG_ALIGN(ec->tx_coalesce_usecs); -@@ -747,6 +766,7 @@ static void iavf_set_itr_per_queue(struct iavf_adapter *adapter, - * the Tx and Rx ITR values based on the values we have entered - * into the q_vector, no need to write the values now. - */ -+ return 0; - } - - /** -@@ -788,9 +808,11 @@ static int __iavf_set_coalesce(struct net_device *netdev, - */ - if (queue < 0) { - for (i = 0; i < adapter->num_active_queues; i++) -- iavf_set_itr_per_queue(adapter, ec, i); -+ if (iavf_set_itr_per_queue(adapter, ec, i)) -+ return -EINVAL; - } else if (queue < adapter->num_active_queues) { -- iavf_set_itr_per_queue(adapter, ec, queue); -+ if (iavf_set_itr_per_queue(adapter, ec, queue)) -+ return -EINVAL; - } else { - netif_info(adapter, drv, netdev, "Invalid queue value, queue range is 0 - %d\n", - adapter->num_active_queues - 1); -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index 158feb0ab2739..c11244a9b7e69 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -7752,7 +7752,7 @@ static int igb_poll(struct napi_struct *napi, int budget) - if (likely(napi_complete_done(napi, work_done))) - igb_ring_irq_enable(q_vector); - -- return min(work_done, budget - 1); -+ return work_done; - } - - /** -diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c -index 6030c90d50ccb..bf7832b34a000 100644 ---- a/drivers/net/ethernet/mscc/ocelot.c -+++ b/drivers/net/ethernet/mscc/ocelot.c -@@ -1024,12 +1024,6 @@ static int ocelot_hwstamp_set(struct ocelot_port *port, struct ifreq *ifr) - switch (cfg.rx_filter) { - case HWTSTAMP_FILTER_NONE: - break; -- case HWTSTAMP_FILTER_ALL: -- case HWTSTAMP_FILTER_SOME: -- case HWTSTAMP_FILTER_PTP_V1_L4_EVENT: -- case HWTSTAMP_FILTER_PTP_V1_L4_SYNC: -- case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ: -- case HWTSTAMP_FILTER_NTP_ALL: - case HWTSTAMP_FILTER_PTP_V2_L4_EVENT: - case HWTSTAMP_FILTER_PTP_V2_L4_SYNC: - case HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ: -@@ -1189,7 +1183,10 @@ static int ocelot_get_ts_info(struct net_device *dev, - SOF_TIMESTAMPING_RAW_HARDWARE; - info->tx_types = BIT(HWTSTAMP_TX_OFF) | BIT(HWTSTAMP_TX_ON) | - BIT(HWTSTAMP_TX_ONESTEP_SYNC); -- info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) | BIT(HWTSTAMP_FILTER_ALL); -+ info->rx_filters = BIT(HWTSTAMP_FILTER_NONE) | -+ BIT(HWTSTAMP_FILTER_PTP_V2_EVENT) | -+ BIT(HWTSTAMP_FILTER_PTP_V2_L2_EVENT) | -+ BIT(HWTSTAMP_FILTER_PTP_V2_L4_EVENT); - - return 0; - } -diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net.h b/drivers/net/ethernet/netronome/nfp/nfp_net.h -index 250f510b1d212..3dcb09f17b77f 100644 ---- a/drivers/net/ethernet/netronome/nfp/nfp_net.h -+++ b/drivers/net/ethernet/netronome/nfp/nfp_net.h -@@ -557,7 +557,6 @@ struct nfp_net_dp { - * @exn_name: Name for Exception interrupt - * @shared_handler: Handler for shared interrupts - * @shared_name: Name for shared interrupt -- * @me_freq_mhz: ME clock_freq (MHz) - * @reconfig_lock: Protects @reconfig_posted, @reconfig_timer_active, - * @reconfig_sync_present and HW reconfiguration request - * regs/machinery from async requests (sync must take -@@ -639,8 +638,6 @@ struct nfp_net { - irq_handler_t shared_handler; - char shared_name[IFNAMSIZ + 8]; - -- u32 me_freq_mhz; -- - bool link_up; - spinlock_t link_status_lock; - -diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c -index 2354dec994184..89e578e25ff8f 100644 ---- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c -+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c -@@ -1269,7 +1269,7 @@ static int nfp_net_set_coalesce(struct net_device *netdev, - * ME timestamp ticks. There are 16 ME clock cycles for each timestamp - * count. - */ -- factor = nn->me_freq_mhz / 16; -+ factor = nn->tlv_caps.me_freq_mhz / 16; - - /* Each pair of (usecs, max_frames) fields specifies that interrupts - * should be coalesced until -diff --git a/drivers/net/phy/mdio-aspeed.c b/drivers/net/phy/mdio-aspeed.c -index cad820568f751..966c3b4ad59d1 100644 ---- a/drivers/net/phy/mdio-aspeed.c -+++ b/drivers/net/phy/mdio-aspeed.c -@@ -61,6 +61,13 @@ static int aspeed_mdio_read(struct mii_bus *bus, int addr, int regnum) - - iowrite32(ctrl, ctx->base + ASPEED_MDIO_CTRL); - -+ rc = readl_poll_timeout(ctx->base + ASPEED_MDIO_CTRL, ctrl, -+ !(ctrl & ASPEED_MDIO_CTRL_FIRE), -+ ASPEED_MDIO_INTERVAL_US, -+ ASPEED_MDIO_TIMEOUT_US); -+ if (rc < 0) -+ return rc; -+ - rc = readl_poll_timeout(ctx->base + ASPEED_MDIO_DATA, data, - data & ASPEED_MDIO_DATA_IDLE, - ASPEED_MDIO_INTERVAL_US, -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 7d389c2cc9026..d6f44343213cc 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -121,21 +121,17 @@ struct netfront_queue { - - /* - * {tx,rx}_skbs store outstanding skbuffs. Free tx_skb entries -- * are linked from tx_skb_freelist through skb_entry.link. -- * -- * NB. Freelist index entries are always going to be less than -- * PAGE_OFFSET, whereas pointers to skbs will always be equal or -- * greater than PAGE_OFFSET: we use this property to distinguish -- * them. -+ * are linked from tx_skb_freelist through tx_link. - */ -- union skb_entry { -- struct sk_buff *skb; -- unsigned long link; -- } tx_skbs[NET_TX_RING_SIZE]; -+ struct sk_buff *tx_skbs[NET_TX_RING_SIZE]; -+ unsigned short tx_link[NET_TX_RING_SIZE]; -+#define TX_LINK_NONE 0xffff -+#define TX_PENDING 0xfffe - grant_ref_t gref_tx_head; - grant_ref_t grant_tx_ref[NET_TX_RING_SIZE]; - struct page *grant_tx_page[NET_TX_RING_SIZE]; - unsigned tx_skb_freelist; -+ unsigned int tx_pend_queue; - - spinlock_t rx_lock ____cacheline_aligned_in_smp; - struct xen_netif_rx_front_ring rx; -@@ -161,6 +157,9 @@ struct netfront_info { - struct netfront_stats __percpu *rx_stats; - struct netfront_stats __percpu *tx_stats; - -+ /* Is device behaving sane? */ -+ bool broken; -+ - atomic_t rx_gso_checksum_fixup; - }; - -@@ -169,33 +168,25 @@ struct netfront_rx_info { - struct xen_netif_extra_info extras[XEN_NETIF_EXTRA_TYPE_MAX - 1]; - }; - --static void skb_entry_set_link(union skb_entry *list, unsigned short id) --{ -- list->link = id; --} -- --static int skb_entry_is_link(const union skb_entry *list) --{ -- BUILD_BUG_ON(sizeof(list->skb) != sizeof(list->link)); -- return (unsigned long)list->skb < PAGE_OFFSET; --} -- - /* - * Access macros for acquiring freeing slots in tx_skbs[]. - */ - --static void add_id_to_freelist(unsigned *head, union skb_entry *list, -- unsigned short id) -+static void add_id_to_list(unsigned *head, unsigned short *list, -+ unsigned short id) - { -- skb_entry_set_link(&list[id], *head); -+ list[id] = *head; - *head = id; - } - --static unsigned short get_id_from_freelist(unsigned *head, -- union skb_entry *list) -+static unsigned short get_id_from_list(unsigned *head, unsigned short *list) - { - unsigned int id = *head; -- *head = list[id].link; -+ -+ if (id != TX_LINK_NONE) { -+ *head = list[id]; -+ list[id] = TX_LINK_NONE; -+ } - return id; - } - -@@ -351,7 +342,7 @@ static int xennet_open(struct net_device *dev) - unsigned int i = 0; - struct netfront_queue *queue = NULL; - -- if (!np->queues) -+ if (!np->queues || np->broken) - return -ENODEV; - - for (i = 0; i < num_queues; ++i) { -@@ -379,27 +370,47 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue) - unsigned short id; - struct sk_buff *skb; - bool more_to_do; -+ const struct device *dev = &queue->info->netdev->dev; - - BUG_ON(!netif_carrier_ok(queue->info->netdev)); - - do { - prod = queue->tx.sring->rsp_prod; -+ if (RING_RESPONSE_PROD_OVERFLOW(&queue->tx, prod)) { -+ dev_alert(dev, "Illegal number of responses %u\n", -+ prod - queue->tx.rsp_cons); -+ goto err; -+ } - rmb(); /* Ensure we see responses up to 'rp'. */ - - for (cons = queue->tx.rsp_cons; cons != prod; cons++) { -- struct xen_netif_tx_response *txrsp; -+ struct xen_netif_tx_response txrsp; - -- txrsp = RING_GET_RESPONSE(&queue->tx, cons); -- if (txrsp->status == XEN_NETIF_RSP_NULL) -+ RING_COPY_RESPONSE(&queue->tx, cons, &txrsp); -+ if (txrsp.status == XEN_NETIF_RSP_NULL) - continue; - -- id = txrsp->id; -- skb = queue->tx_skbs[id].skb; -+ id = txrsp.id; -+ if (id >= RING_SIZE(&queue->tx)) { -+ dev_alert(dev, -+ "Response has incorrect id (%u)\n", -+ id); -+ goto err; -+ } -+ if (queue->tx_link[id] != TX_PENDING) { -+ dev_alert(dev, -+ "Response for inactive request\n"); -+ goto err; -+ } -+ -+ queue->tx_link[id] = TX_LINK_NONE; -+ skb = queue->tx_skbs[id]; -+ queue->tx_skbs[id] = NULL; - if (unlikely(gnttab_query_foreign_access( - queue->grant_tx_ref[id]) != 0)) { -- pr_alert("%s: warning -- grant still in use by backend domain\n", -- __func__); -- BUG(); -+ dev_alert(dev, -+ "Grant still in use by backend domain\n"); -+ goto err; - } - gnttab_end_foreign_access_ref( - queue->grant_tx_ref[id], GNTMAP_readonly); -@@ -407,7 +418,7 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue) - &queue->gref_tx_head, queue->grant_tx_ref[id]); - queue->grant_tx_ref[id] = GRANT_INVALID_REF; - queue->grant_tx_page[id] = NULL; -- add_id_to_freelist(&queue->tx_skb_freelist, queue->tx_skbs, id); -+ add_id_to_list(&queue->tx_skb_freelist, queue->tx_link, id); - dev_kfree_skb_irq(skb); - } - -@@ -417,13 +428,20 @@ static void xennet_tx_buf_gc(struct netfront_queue *queue) - } while (more_to_do); - - xennet_maybe_wake_tx(queue); -+ -+ return; -+ -+ err: -+ queue->info->broken = true; -+ dev_alert(dev, "Disabled for further use\n"); - } - - struct xennet_gnttab_make_txreq { - struct netfront_queue *queue; - struct sk_buff *skb; - struct page *page; -- struct xen_netif_tx_request *tx; /* Last request */ -+ struct xen_netif_tx_request *tx; /* Last request on ring page */ -+ struct xen_netif_tx_request tx_local; /* Last request local copy*/ - unsigned int size; - }; - -@@ -439,7 +457,7 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset, - struct netfront_queue *queue = info->queue; - struct sk_buff *skb = info->skb; - -- id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs); -+ id = get_id_from_list(&queue->tx_skb_freelist, queue->tx_link); - tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++); - ref = gnttab_claim_grant_reference(&queue->gref_tx_head); - WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref)); -@@ -447,34 +465,37 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset, - gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id, - gfn, GNTMAP_readonly); - -- queue->tx_skbs[id].skb = skb; -+ queue->tx_skbs[id] = skb; - queue->grant_tx_page[id] = page; - queue->grant_tx_ref[id] = ref; - -- tx->id = id; -- tx->gref = ref; -- tx->offset = offset; -- tx->size = len; -- tx->flags = 0; -+ info->tx_local.id = id; -+ info->tx_local.gref = ref; -+ info->tx_local.offset = offset; -+ info->tx_local.size = len; -+ info->tx_local.flags = 0; -+ -+ *tx = info->tx_local; -+ -+ /* -+ * Put the request in the pending queue, it will be set to be pending -+ * when the producer index is about to be raised. -+ */ -+ add_id_to_list(&queue->tx_pend_queue, queue->tx_link, id); - - info->tx = tx; -- info->size += tx->size; -+ info->size += info->tx_local.size; - } - - static struct xen_netif_tx_request *xennet_make_first_txreq( -- struct netfront_queue *queue, struct sk_buff *skb, -- struct page *page, unsigned int offset, unsigned int len) -+ struct xennet_gnttab_make_txreq *info, -+ unsigned int offset, unsigned int len) - { -- struct xennet_gnttab_make_txreq info = { -- .queue = queue, -- .skb = skb, -- .page = page, -- .size = 0, -- }; -+ info->size = 0; - -- gnttab_for_one_grant(page, offset, len, xennet_tx_setup_grant, &info); -+ gnttab_for_one_grant(info->page, offset, len, xennet_tx_setup_grant, info); - -- return info.tx; -+ return info->tx; - } - - static void xennet_make_one_txreq(unsigned long gfn, unsigned int offset, -@@ -487,35 +508,27 @@ static void xennet_make_one_txreq(unsigned long gfn, unsigned int offset, - xennet_tx_setup_grant(gfn, offset, len, data); - } - --static struct xen_netif_tx_request *xennet_make_txreqs( -- struct netfront_queue *queue, struct xen_netif_tx_request *tx, -- struct sk_buff *skb, struct page *page, -+static void xennet_make_txreqs( -+ struct xennet_gnttab_make_txreq *info, -+ struct page *page, - unsigned int offset, unsigned int len) - { -- struct xennet_gnttab_make_txreq info = { -- .queue = queue, -- .skb = skb, -- .tx = tx, -- }; -- - /* Skip unused frames from start of page */ - page += offset >> PAGE_SHIFT; - offset &= ~PAGE_MASK; - - while (len) { -- info.page = page; -- info.size = 0; -+ info->page = page; -+ info->size = 0; - - gnttab_foreach_grant_in_range(page, offset, len, - xennet_make_one_txreq, -- &info); -+ info); - - page++; - offset = 0; -- len -= info.size; -+ len -= info->size; - } -- -- return info.tx; - } - - /* -@@ -562,13 +575,22 @@ static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb, - return queue_idx; - } - -+static void xennet_mark_tx_pending(struct netfront_queue *queue) -+{ -+ unsigned int i; -+ -+ while ((i = get_id_from_list(&queue->tx_pend_queue, queue->tx_link)) != -+ TX_LINK_NONE) -+ queue->tx_link[i] = TX_PENDING; -+} -+ - #define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1) - - static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct netfront_info *np = netdev_priv(dev); - struct netfront_stats *tx_stats = this_cpu_ptr(np->tx_stats); -- struct xen_netif_tx_request *tx, *first_tx; -+ struct xen_netif_tx_request *first_tx; - unsigned int i; - int notify; - int slots; -@@ -577,6 +599,7 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev - unsigned int len; - unsigned long flags; - struct netfront_queue *queue = NULL; -+ struct xennet_gnttab_make_txreq info = { }; - unsigned int num_queues = dev->real_num_tx_queues; - u16 queue_index; - struct sk_buff *nskb; -@@ -584,6 +607,8 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev - /* Drop the packet if no queues are set up */ - if (num_queues < 1) - goto drop; -+ if (unlikely(np->broken)) -+ goto drop; - /* Determine which queue to transmit this SKB on */ - queue_index = skb_get_queue_mapping(skb); - queue = &np->queues[queue_index]; -@@ -634,21 +659,24 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev - } - - /* First request for the linear area. */ -- first_tx = tx = xennet_make_first_txreq(queue, skb, -- page, offset, len); -- offset += tx->size; -+ info.queue = queue; -+ info.skb = skb; -+ info.page = page; -+ first_tx = xennet_make_first_txreq(&info, offset, len); -+ offset += info.tx_local.size; - if (offset == PAGE_SIZE) { - page++; - offset = 0; - } -- len -= tx->size; -+ len -= info.tx_local.size; - - if (skb->ip_summed == CHECKSUM_PARTIAL) - /* local packet? */ -- tx->flags |= XEN_NETTXF_csum_blank | XEN_NETTXF_data_validated; -+ first_tx->flags |= XEN_NETTXF_csum_blank | -+ XEN_NETTXF_data_validated; - else if (skb->ip_summed == CHECKSUM_UNNECESSARY) - /* remote but checksummed. */ -- tx->flags |= XEN_NETTXF_data_validated; -+ first_tx->flags |= XEN_NETTXF_data_validated; - - /* Optional extra info after the first request. */ - if (skb_shinfo(skb)->gso_size) { -@@ -657,7 +685,7 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev - gso = (struct xen_netif_extra_info *) - RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++); - -- tx->flags |= XEN_NETTXF_extra_info; -+ first_tx->flags |= XEN_NETTXF_extra_info; - - gso->u.gso.size = skb_shinfo(skb)->gso_size; - gso->u.gso.type = (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) ? -@@ -671,12 +699,12 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev - } - - /* Requests for the rest of the linear area. */ -- tx = xennet_make_txreqs(queue, tx, skb, page, offset, len); -+ xennet_make_txreqs(&info, page, offset, len); - - /* Requests for all the frags. */ - for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) { - skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; -- tx = xennet_make_txreqs(queue, tx, skb, skb_frag_page(frag), -+ xennet_make_txreqs(&info, skb_frag_page(frag), - skb_frag_off(frag), - skb_frag_size(frag)); - } -@@ -684,6 +712,8 @@ static netdev_tx_t xennet_start_xmit(struct sk_buff *skb, struct net_device *dev - /* First request has the packet length. */ - first_tx->size = skb->len; - -+ xennet_mark_tx_pending(queue); -+ - RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(&queue->tx, notify); - if (notify) - notify_remote_via_irq(queue->tx_irq); -@@ -741,7 +771,7 @@ static int xennet_get_extras(struct netfront_queue *queue, - RING_IDX rp) - - { -- struct xen_netif_extra_info *extra; -+ struct xen_netif_extra_info extra; - struct device *dev = &queue->info->netdev->dev; - RING_IDX cons = queue->rx.rsp_cons; - int err = 0; -@@ -757,24 +787,22 @@ static int xennet_get_extras(struct netfront_queue *queue, - break; - } - -- extra = (struct xen_netif_extra_info *) -- RING_GET_RESPONSE(&queue->rx, ++cons); -+ RING_COPY_RESPONSE(&queue->rx, ++cons, &extra); - -- if (unlikely(!extra->type || -- extra->type >= XEN_NETIF_EXTRA_TYPE_MAX)) { -+ if (unlikely(!extra.type || -+ extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) { - if (net_ratelimit()) - dev_warn(dev, "Invalid extra type: %d\n", -- extra->type); -+ extra.type); - err = -EINVAL; - } else { -- memcpy(&extras[extra->type - 1], extra, -- sizeof(*extra)); -+ extras[extra.type - 1] = extra; - } - - skb = xennet_get_rx_skb(queue, cons); - ref = xennet_get_rx_ref(queue, cons); - xennet_move_rx_slot(queue, skb, ref); -- } while (extra->flags & XEN_NETIF_EXTRA_FLAG_MORE); -+ } while (extra.flags & XEN_NETIF_EXTRA_FLAG_MORE); - - queue->rx.rsp_cons = cons; - return err; -@@ -784,7 +812,7 @@ static int xennet_get_responses(struct netfront_queue *queue, - struct netfront_rx_info *rinfo, RING_IDX rp, - struct sk_buff_head *list) - { -- struct xen_netif_rx_response *rx = &rinfo->rx; -+ struct xen_netif_rx_response *rx = &rinfo->rx, rx_local; - struct xen_netif_extra_info *extras = rinfo->extras; - struct device *dev = &queue->info->netdev->dev; - RING_IDX cons = queue->rx.rsp_cons; -@@ -842,7 +870,8 @@ next: - break; - } - -- rx = RING_GET_RESPONSE(&queue->rx, cons + slots); -+ RING_COPY_RESPONSE(&queue->rx, cons + slots, &rx_local); -+ rx = &rx_local; - skb = xennet_get_rx_skb(queue, cons + slots); - ref = xennet_get_rx_ref(queue, cons + slots); - slots++; -@@ -897,10 +926,11 @@ static int xennet_fill_frags(struct netfront_queue *queue, - struct sk_buff *nskb; - - while ((nskb = __skb_dequeue(list))) { -- struct xen_netif_rx_response *rx = -- RING_GET_RESPONSE(&queue->rx, ++cons); -+ struct xen_netif_rx_response rx; - skb_frag_t *nfrag = &skb_shinfo(nskb)->frags[0]; - -+ RING_COPY_RESPONSE(&queue->rx, ++cons, &rx); -+ - if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) { - unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to; - -@@ -915,7 +945,7 @@ static int xennet_fill_frags(struct netfront_queue *queue, - - skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, - skb_frag_page(nfrag), -- rx->offset, rx->status, PAGE_SIZE); -+ rx.offset, rx.status, PAGE_SIZE); - - skb_shinfo(nskb)->nr_frags = 0; - kfree_skb(nskb); -@@ -1008,12 +1038,19 @@ static int xennet_poll(struct napi_struct *napi, int budget) - skb_queue_head_init(&tmpq); - - rp = queue->rx.sring->rsp_prod; -+ if (RING_RESPONSE_PROD_OVERFLOW(&queue->rx, rp)) { -+ dev_alert(&dev->dev, "Illegal number of responses %u\n", -+ rp - queue->rx.rsp_cons); -+ queue->info->broken = true; -+ spin_unlock(&queue->rx_lock); -+ return 0; -+ } - rmb(); /* Ensure we see queued responses up to 'rp'. */ - - i = queue->rx.rsp_cons; - work_done = 0; - while ((i != rp) && (work_done < budget)) { -- memcpy(rx, RING_GET_RESPONSE(&queue->rx, i), sizeof(*rx)); -+ RING_COPY_RESPONSE(&queue->rx, i, rx); - memset(extras, 0, sizeof(rinfo.extras)); - - err = xennet_get_responses(queue, &rinfo, rp, &tmpq); -@@ -1135,17 +1172,18 @@ static void xennet_release_tx_bufs(struct netfront_queue *queue) - - for (i = 0; i < NET_TX_RING_SIZE; i++) { - /* Skip over entries which are actually freelist references */ -- if (skb_entry_is_link(&queue->tx_skbs[i])) -+ if (!queue->tx_skbs[i]) - continue; - -- skb = queue->tx_skbs[i].skb; -+ skb = queue->tx_skbs[i]; -+ queue->tx_skbs[i] = NULL; - get_page(queue->grant_tx_page[i]); - gnttab_end_foreign_access(queue->grant_tx_ref[i], - GNTMAP_readonly, - (unsigned long)page_address(queue->grant_tx_page[i])); - queue->grant_tx_page[i] = NULL; - queue->grant_tx_ref[i] = GRANT_INVALID_REF; -- add_id_to_freelist(&queue->tx_skb_freelist, queue->tx_skbs, i); -+ add_id_to_list(&queue->tx_skb_freelist, queue->tx_link, i); - dev_kfree_skb_irq(skb); - } - } -@@ -1225,6 +1263,9 @@ static irqreturn_t xennet_tx_interrupt(int irq, void *dev_id) - struct netfront_queue *queue = dev_id; - unsigned long flags; - -+ if (queue->info->broken) -+ return IRQ_HANDLED; -+ - spin_lock_irqsave(&queue->tx_lock, flags); - xennet_tx_buf_gc(queue); - spin_unlock_irqrestore(&queue->tx_lock, flags); -@@ -1237,6 +1278,9 @@ static irqreturn_t xennet_rx_interrupt(int irq, void *dev_id) - struct netfront_queue *queue = dev_id; - struct net_device *dev = queue->info->netdev; - -+ if (queue->info->broken) -+ return IRQ_HANDLED; -+ - if (likely(netif_carrier_ok(dev) && - RING_HAS_UNCONSUMED_RESPONSES(&queue->rx))) - napi_schedule(&queue->napi); -@@ -1258,6 +1302,10 @@ static void xennet_poll_controller(struct net_device *dev) - struct netfront_info *info = netdev_priv(dev); - unsigned int num_queues = dev->real_num_tx_queues; - unsigned int i; -+ -+ if (info->broken) -+ return; -+ - for (i = 0; i < num_queues; ++i) - xennet_interrupt(0, &info->queues[i]); - } -@@ -1627,13 +1675,15 @@ static int xennet_init_queue(struct netfront_queue *queue) - snprintf(queue->name, sizeof(queue->name), "vif%s-q%u", - devid, queue->id); - -- /* Initialise tx_skbs as a free chain containing every entry. */ -+ /* Initialise tx_skb_freelist as a free chain containing every entry. */ - queue->tx_skb_freelist = 0; -+ queue->tx_pend_queue = TX_LINK_NONE; - for (i = 0; i < NET_TX_RING_SIZE; i++) { -- skb_entry_set_link(&queue->tx_skbs[i], i+1); -+ queue->tx_link[i] = i + 1; - queue->grant_tx_ref[i] = GRANT_INVALID_REF; - queue->grant_tx_page[i] = NULL; - } -+ queue->tx_link[NET_TX_RING_SIZE - 1] = TX_LINK_NONE; - - /* Clear out rx_skbs */ - for (i = 0; i < NET_RX_RING_SIZE; i++) { -@@ -1838,6 +1888,9 @@ static int talk_to_netback(struct xenbus_device *dev, - if (info->queues) - xennet_destroy_queues(info); - -+ /* For the case of a reconnect reset the "broken" indicator. */ -+ info->broken = false; -+ - err = xennet_create_queues(info, &num_queues); - if (err < 0) { - xenbus_dev_fatal(dev, err, "creating queues"); -diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c -index 6ca17a0babae2..1c8d16b0245b1 100644 ---- a/drivers/nvme/target/io-cmd-file.c -+++ b/drivers/nvme/target/io-cmd-file.c -@@ -8,6 +8,7 @@ - #include - #include - #include -+#include - #include "nvmet.h" - - #define NVMET_MAX_MPOOL_BVEC 16 -@@ -254,7 +255,8 @@ static void nvmet_file_execute_rw(struct nvmet_req *req) - - if (req->ns->buffered_io) { - if (likely(!req->f.mpool_alloc) && -- nvmet_file_execute_io(req, IOCB_NOWAIT)) -+ (req->ns->file->f_mode & FMODE_NOWAIT) && -+ nvmet_file_execute_io(req, IOCB_NOWAIT)) - return; - nvmet_file_submit_buffered_io(req); - } else -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index fac1985870765..4341c72446628 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -631,10 +631,11 @@ static int nvmet_try_send_r2t(struct nvmet_tcp_cmd *cmd, bool last_in_batch) - static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd) - { - struct nvmet_tcp_queue *queue = cmd->queue; -+ int left = NVME_TCP_DIGEST_LENGTH - cmd->offset; - struct msghdr msg = { .msg_flags = MSG_DONTWAIT }; - struct kvec iov = { - .iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset, -- .iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset -+ .iov_len = left - }; - int ret; - -@@ -643,6 +644,10 @@ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd) - return ret; - - cmd->offset += ret; -+ left -= ret; -+ -+ if (left) -+ return -EAGAIN; - - if (queue->nvme_sq.sqhd_disabled) { - cmd->queue->snd_cmd = NULL; -diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c -index 45794ba643d40..9e208294946cd 100644 ---- a/drivers/pci/controller/pci-aardvark.c -+++ b/drivers/pci/controller/pci-aardvark.c -@@ -9,6 +9,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -17,6 +18,7 @@ - #include - #include - #include -+#include - #include - - #include "../pci.h" -@@ -25,21 +27,8 @@ - /* PCIe core registers */ - #define PCIE_CORE_DEV_ID_REG 0x0 - #define PCIE_CORE_CMD_STATUS_REG 0x4 --#define PCIE_CORE_CMD_IO_ACCESS_EN BIT(0) --#define PCIE_CORE_CMD_MEM_ACCESS_EN BIT(1) --#define PCIE_CORE_CMD_MEM_IO_REQ_EN BIT(2) - #define PCIE_CORE_DEV_REV_REG 0x8 - #define PCIE_CORE_PCIEXP_CAP 0xc0 --#define PCIE_CORE_DEV_CTRL_STATS_REG 0xc8 --#define PCIE_CORE_DEV_CTRL_STATS_RELAX_ORDER_DISABLE (0 << 4) --#define PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT 5 --#define PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE (0 << 11) --#define PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT 12 --#define PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ 0x2 --#define PCIE_CORE_LINK_CTRL_STAT_REG 0xd0 --#define PCIE_CORE_LINK_L0S_ENTRY BIT(0) --#define PCIE_CORE_LINK_TRAINING BIT(5) --#define PCIE_CORE_LINK_WIDTH_SHIFT 20 - #define PCIE_CORE_ERR_CAPCTL_REG 0x118 - #define PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX BIT(5) - #define PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX_EN BIT(6) -@@ -122,6 +111,46 @@ - #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C) - #define PCIE_MSI_DATA_MASK GENMASK(15, 0) - -+/* PCIe window configuration */ -+#define OB_WIN_BASE_ADDR 0x4c00 -+#define OB_WIN_BLOCK_SIZE 0x20 -+#define OB_WIN_COUNT 8 -+#define OB_WIN_REG_ADDR(win, offset) (OB_WIN_BASE_ADDR + \ -+ OB_WIN_BLOCK_SIZE * (win) + \ -+ (offset)) -+#define OB_WIN_MATCH_LS(win) OB_WIN_REG_ADDR(win, 0x00) -+#define OB_WIN_ENABLE BIT(0) -+#define OB_WIN_MATCH_MS(win) OB_WIN_REG_ADDR(win, 0x04) -+#define OB_WIN_REMAP_LS(win) OB_WIN_REG_ADDR(win, 0x08) -+#define OB_WIN_REMAP_MS(win) OB_WIN_REG_ADDR(win, 0x0c) -+#define OB_WIN_MASK_LS(win) OB_WIN_REG_ADDR(win, 0x10) -+#define OB_WIN_MASK_MS(win) OB_WIN_REG_ADDR(win, 0x14) -+#define OB_WIN_ACTIONS(win) OB_WIN_REG_ADDR(win, 0x18) -+#define OB_WIN_DEFAULT_ACTIONS (OB_WIN_ACTIONS(OB_WIN_COUNT-1) + 0x4) -+#define OB_WIN_FUNC_NUM_MASK GENMASK(31, 24) -+#define OB_WIN_FUNC_NUM_SHIFT 24 -+#define OB_WIN_FUNC_NUM_ENABLE BIT(23) -+#define OB_WIN_BUS_NUM_BITS_MASK GENMASK(22, 20) -+#define OB_WIN_BUS_NUM_BITS_SHIFT 20 -+#define OB_WIN_MSG_CODE_ENABLE BIT(22) -+#define OB_WIN_MSG_CODE_MASK GENMASK(21, 14) -+#define OB_WIN_MSG_CODE_SHIFT 14 -+#define OB_WIN_MSG_PAYLOAD_LEN BIT(12) -+#define OB_WIN_ATTR_ENABLE BIT(11) -+#define OB_WIN_ATTR_TC_MASK GENMASK(10, 8) -+#define OB_WIN_ATTR_TC_SHIFT 8 -+#define OB_WIN_ATTR_RELAXED BIT(7) -+#define OB_WIN_ATTR_NOSNOOP BIT(6) -+#define OB_WIN_ATTR_POISON BIT(5) -+#define OB_WIN_ATTR_IDO BIT(4) -+#define OB_WIN_TYPE_MASK GENMASK(3, 0) -+#define OB_WIN_TYPE_SHIFT 0 -+#define OB_WIN_TYPE_MEM 0x0 -+#define OB_WIN_TYPE_IO 0x4 -+#define OB_WIN_TYPE_CONFIG_TYPE0 0x8 -+#define OB_WIN_TYPE_CONFIG_TYPE1 0x9 -+#define OB_WIN_TYPE_MSG 0xc -+ - /* LMI registers base address and register offsets */ - #define LMI_BASE_ADDR 0x6000 - #define CFG_REG (LMI_BASE_ADDR + 0x0) -@@ -237,6 +266,13 @@ struct advk_pcie { - struct platform_device *pdev; - void __iomem *base; - struct list_head resources; -+ struct { -+ phys_addr_t match; -+ phys_addr_t remap; -+ phys_addr_t mask; -+ u32 actions; -+ } wins[OB_WIN_COUNT]; -+ u8 wins_count; - struct irq_domain *irq_domain; - struct irq_chip irq_chip; - raw_spinlock_t irq_lock; -@@ -249,7 +285,9 @@ struct advk_pcie { - struct mutex msi_used_lock; - u16 msi_msg; - int root_bus_nr; -+ int link_gen; - struct pci_bridge_emul bridge; -+ struct gpio_desc *reset_gpio; - }; - - static inline void advk_writel(struct advk_pcie *pcie, u32 val, u64 reg) -@@ -309,20 +347,16 @@ static inline bool advk_pcie_link_training(struct advk_pcie *pcie) - - static int advk_pcie_wait_for_link(struct advk_pcie *pcie) - { -- struct device *dev = &pcie->pdev->dev; - int retries; - - /* check if the link is up or not */ - for (retries = 0; retries < LINK_WAIT_MAX_RETRIES; retries++) { -- if (advk_pcie_link_up(pcie)) { -- dev_info(dev, "link up\n"); -+ if (advk_pcie_link_up(pcie)) - return 0; -- } - - usleep_range(LINK_WAIT_USLEEP_MIN, LINK_WAIT_USLEEP_MAX); - } - -- dev_err(dev, "link never came up\n"); - return -ETIMEDOUT; - } - -@@ -337,9 +371,115 @@ static void advk_pcie_wait_for_retrain(struct advk_pcie *pcie) - } - } - -+static void advk_pcie_issue_perst(struct advk_pcie *pcie) -+{ -+ if (!pcie->reset_gpio) -+ return; -+ -+ /* 10ms delay is needed for some cards */ -+ dev_info(&pcie->pdev->dev, "issuing PERST via reset GPIO for 10ms\n"); -+ gpiod_set_value_cansleep(pcie->reset_gpio, 1); -+ usleep_range(10000, 11000); -+ gpiod_set_value_cansleep(pcie->reset_gpio, 0); -+} -+ -+static void advk_pcie_train_link(struct advk_pcie *pcie) -+{ -+ struct device *dev = &pcie->pdev->dev; -+ u32 reg; -+ int ret; -+ -+ /* -+ * Setup PCIe rev / gen compliance based on device tree property -+ * 'max-link-speed' which also forces maximal link speed. -+ */ -+ reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG); -+ reg &= ~PCIE_GEN_SEL_MSK; -+ if (pcie->link_gen == 3) -+ reg |= SPEED_GEN_3; -+ else if (pcie->link_gen == 2) -+ reg |= SPEED_GEN_2; -+ else -+ reg |= SPEED_GEN_1; -+ advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG); -+ -+ /* -+ * Set maximal link speed value also into PCIe Link Control 2 register. -+ * Armada 3700 Functional Specification says that default value is based -+ * on SPEED_GEN but tests showed that default value is always 8.0 GT/s. -+ */ -+ reg = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + PCI_EXP_LNKCTL2); -+ reg &= ~PCI_EXP_LNKCTL2_TLS; -+ if (pcie->link_gen == 3) -+ reg |= PCI_EXP_LNKCTL2_TLS_8_0GT; -+ else if (pcie->link_gen == 2) -+ reg |= PCI_EXP_LNKCTL2_TLS_5_0GT; -+ else -+ reg |= PCI_EXP_LNKCTL2_TLS_2_5GT; -+ advk_writel(pcie, reg, PCIE_CORE_PCIEXP_CAP + PCI_EXP_LNKCTL2); -+ -+ /* Enable link training after selecting PCIe generation */ -+ reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG); -+ reg |= LINK_TRAINING_EN; -+ advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG); -+ -+ /* -+ * Reset PCIe card via PERST# signal. Some cards are not detected -+ * during link training when they are in some non-initial state. -+ */ -+ advk_pcie_issue_perst(pcie); -+ -+ /* -+ * PERST# signal could have been asserted by pinctrl subsystem before -+ * probe() callback has been called or issued explicitly by reset gpio -+ * function advk_pcie_issue_perst(), making the endpoint going into -+ * fundamental reset. As required by PCI Express spec (PCI Express -+ * Base Specification, REV. 4.0 PCI Express, February 19 2014, 6.6.1 -+ * Conventional Reset) a delay for at least 100ms after such a reset -+ * before sending a Configuration Request to the device is needed. -+ * So wait until PCIe link is up. Function advk_pcie_wait_for_link() -+ * waits for link at least 900ms. -+ */ -+ ret = advk_pcie_wait_for_link(pcie); -+ if (ret < 0) -+ dev_err(dev, "link never came up\n"); -+ else -+ dev_info(dev, "link up\n"); -+} -+ -+/* -+ * Set PCIe address window register which could be used for memory -+ * mapping. -+ */ -+static void advk_pcie_set_ob_win(struct advk_pcie *pcie, u8 win_num, -+ phys_addr_t match, phys_addr_t remap, -+ phys_addr_t mask, u32 actions) -+{ -+ advk_writel(pcie, OB_WIN_ENABLE | -+ lower_32_bits(match), OB_WIN_MATCH_LS(win_num)); -+ advk_writel(pcie, upper_32_bits(match), OB_WIN_MATCH_MS(win_num)); -+ advk_writel(pcie, lower_32_bits(remap), OB_WIN_REMAP_LS(win_num)); -+ advk_writel(pcie, upper_32_bits(remap), OB_WIN_REMAP_MS(win_num)); -+ advk_writel(pcie, lower_32_bits(mask), OB_WIN_MASK_LS(win_num)); -+ advk_writel(pcie, upper_32_bits(mask), OB_WIN_MASK_MS(win_num)); -+ advk_writel(pcie, actions, OB_WIN_ACTIONS(win_num)); -+} -+ -+static void advk_pcie_disable_ob_win(struct advk_pcie *pcie, u8 win_num) -+{ -+ advk_writel(pcie, 0, OB_WIN_MATCH_LS(win_num)); -+ advk_writel(pcie, 0, OB_WIN_MATCH_MS(win_num)); -+ advk_writel(pcie, 0, OB_WIN_REMAP_LS(win_num)); -+ advk_writel(pcie, 0, OB_WIN_REMAP_MS(win_num)); -+ advk_writel(pcie, 0, OB_WIN_MASK_LS(win_num)); -+ advk_writel(pcie, 0, OB_WIN_MASK_MS(win_num)); -+ advk_writel(pcie, 0, OB_WIN_ACTIONS(win_num)); -+} -+ - static void advk_pcie_setup_hw(struct advk_pcie *pcie) - { - u32 reg; -+ int i; - - /* Set to Direct mode */ - reg = advk_readl(pcie, CTRL_CONFIG_REG); -@@ -362,6 +502,31 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) - reg = (PCI_VENDOR_ID_MARVELL << 16) | PCI_VENDOR_ID_MARVELL; - advk_writel(pcie, reg, VENDOR_ID_REG); - -+ /* -+ * Change Class Code of PCI Bridge device to PCI Bridge (0x600400), -+ * because the default value is Mass storage controller (0x010400). -+ * -+ * Note that this Aardvark PCI Bridge does not have compliant Type 1 -+ * Configuration Space and it even cannot be accessed via Aardvark's -+ * PCI config space access method. Something like config space is -+ * available in internal Aardvark registers starting at offset 0x0 -+ * and is reported as Type 0. In range 0x10 - 0x34 it has totally -+ * different registers. -+ * -+ * Therefore driver uses emulation of PCI Bridge which emulates -+ * access to configuration space via internal Aardvark registers or -+ * emulated configuration buffer. -+ */ -+ reg = advk_readl(pcie, PCIE_CORE_DEV_REV_REG); -+ reg &= ~0xffffff00; -+ reg |= (PCI_CLASS_BRIDGE_PCI << 8) << 8; -+ advk_writel(pcie, reg, PCIE_CORE_DEV_REV_REG); -+ -+ /* Disable Root Bridge I/O space, memory space and bus mastering */ -+ reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG); -+ reg &= ~(PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER); -+ advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG); -+ - /* Set Advanced Error Capabilities and Control PF0 register */ - reg = PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX | - PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX_EN | -@@ -369,36 +534,27 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) - PCIE_CORE_ERR_CAPCTL_ECRC_CHCK_RCV; - advk_writel(pcie, reg, PCIE_CORE_ERR_CAPCTL_REG); - -- /* Set PCIe Device Control and Status 1 PF0 register */ -- reg = PCIE_CORE_DEV_CTRL_STATS_RELAX_ORDER_DISABLE | -- (7 << PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT) | -- PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE | -- (PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ << -- PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT); -- advk_writel(pcie, reg, PCIE_CORE_DEV_CTRL_STATS_REG); -+ /* Set PCIe Device Control register */ -+ reg = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + PCI_EXP_DEVCTL); -+ reg &= ~PCI_EXP_DEVCTL_RELAX_EN; -+ reg &= ~PCI_EXP_DEVCTL_NOSNOOP_EN; -+ reg &= ~PCI_EXP_DEVCTL_PAYLOAD; -+ reg &= ~PCI_EXP_DEVCTL_READRQ; -+ reg |= PCI_EXP_DEVCTL_PAYLOAD_512B; -+ reg |= PCI_EXP_DEVCTL_READRQ_512B; -+ advk_writel(pcie, reg, PCIE_CORE_PCIEXP_CAP + PCI_EXP_DEVCTL); - - /* Program PCIe Control 2 to disable strict ordering */ - reg = PCIE_CORE_CTRL2_RESERVED | - PCIE_CORE_CTRL2_TD_ENABLE; - advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG); - -- /* Set GEN2 */ -- reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG); -- reg &= ~PCIE_GEN_SEL_MSK; -- reg |= SPEED_GEN_2; -- advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG); -- - /* Set lane X1 */ - reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG); - reg &= ~LANE_CNT_MSK; - reg |= LANE_COUNT_1; - advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG); - -- /* Enable link training */ -- reg = advk_readl(pcie, PCIE_CORE_CTRL0_REG); -- reg |= LINK_TRAINING_EN; -- advk_writel(pcie, reg, PCIE_CORE_CTRL0_REG); -- - /* Enable MSI */ - reg = advk_readl(pcie, PCIE_CORE_CTRL2_REG); - reg |= PCIE_CORE_CTRL2_MSI_ENABLE; -@@ -423,27 +579,52 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) - reg = PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK); - advk_writel(pcie, reg, HOST_CTRL_INT_MASK_REG); - -+ /* -+ * Enable AXI address window location generation: -+ * When it is enabled, the default outbound window -+ * configurations (Default User Field: 0xD0074CFC) -+ * are used to transparent address translation for -+ * the outbound transactions. Thus, PCIe address -+ * windows are not required for transparent memory -+ * access when default outbound window configuration -+ * is set for memory access. -+ */ - reg = advk_readl(pcie, PCIE_CORE_CTRL2_REG); - reg |= PCIE_CORE_CTRL2_OB_WIN_ENABLE; - advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG); - -- /* Bypass the address window mapping for PIO */ -+ /* -+ * Set memory access in Default User Field so it -+ * is not required to configure PCIe address for -+ * transparent memory access. -+ */ -+ advk_writel(pcie, OB_WIN_TYPE_MEM, OB_WIN_DEFAULT_ACTIONS); -+ -+ /* -+ * Bypass the address window mapping for PIO: -+ * Since PIO access already contains all required -+ * info over AXI interface by PIO registers, the -+ * address window is not required. -+ */ - reg = advk_readl(pcie, PIO_CTRL); - reg |= PIO_CTRL_ADDR_WIN_DISABLE; - advk_writel(pcie, reg, PIO_CTRL); - -- /* Start link training */ -- reg = advk_readl(pcie, PCIE_CORE_LINK_CTRL_STAT_REG); -- reg |= PCIE_CORE_LINK_TRAINING; -- advk_writel(pcie, reg, PCIE_CORE_LINK_CTRL_STAT_REG); -+ /* -+ * Configure PCIe address windows for non-memory or -+ * non-transparent access as by default PCIe uses -+ * transparent memory access. -+ */ -+ for (i = 0; i < pcie->wins_count; i++) -+ advk_pcie_set_ob_win(pcie, i, -+ pcie->wins[i].match, pcie->wins[i].remap, -+ pcie->wins[i].mask, pcie->wins[i].actions); - -- advk_pcie_wait_for_link(pcie); -+ /* Disable remaining PCIe outbound windows */ -+ for (i = pcie->wins_count; i < OB_WIN_COUNT; i++) -+ advk_pcie_disable_ob_win(pcie, i); - -- reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG); -- reg |= PCIE_CORE_CMD_MEM_ACCESS_EN | -- PCIE_CORE_CMD_IO_ACCESS_EN | -- PCIE_CORE_CMD_MEM_IO_REQ_EN; -- advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG); -+ advk_pcie_train_link(pcie); - } - - static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u32 *val) -@@ -452,6 +633,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u3 - u32 reg; - unsigned int status; - char *strcomp_status, *str_posted; -+ int ret; - - reg = advk_readl(pcie, PIO_STAT); - status = (reg & PIO_COMPLETION_STATUS_MASK) >> -@@ -476,6 +658,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u3 - case PIO_COMPLETION_STATUS_OK: - if (reg & PIO_ERR_STATUS) { - strcomp_status = "COMP_ERR"; -+ ret = -EFAULT; - break; - } - /* Get the read result */ -@@ -483,9 +666,11 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u3 - *val = advk_readl(pcie, PIO_RD_DATA); - /* No error */ - strcomp_status = NULL; -+ ret = 0; - break; - case PIO_COMPLETION_STATUS_UR: - strcomp_status = "UR"; -+ ret = -EOPNOTSUPP; - break; - case PIO_COMPLETION_STATUS_CRS: - if (allow_crs && val) { -@@ -503,6 +688,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u3 - */ - *val = CFG_RD_CRS_VAL; - strcomp_status = NULL; -+ ret = 0; - break; - } - /* PCIe r4.0, sec 2.3.2, says: -@@ -518,21 +704,24 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u3 - * Request and taking appropriate action, e.g., complete the - * Request to the host as a failed transaction. - * -- * To simplify implementation do not re-issue the Configuration -- * Request and complete the Request as a failed transaction. -+ * So return -EAGAIN and caller (pci-aardvark.c driver) will -+ * re-issue request again up to the PIO_RETRY_CNT retries. - */ - strcomp_status = "CRS"; -+ ret = -EAGAIN; - break; - case PIO_COMPLETION_STATUS_CA: - strcomp_status = "CA"; -+ ret = -ECANCELED; - break; - default: - strcomp_status = "Unknown"; -+ ret = -EINVAL; - break; - } - - if (!strcomp_status) -- return 0; -+ return ret; - - if (reg & PIO_NON_POSTED_REQ) - str_posted = "Non-posted"; -@@ -542,7 +731,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u3 - dev_dbg(dev, "%s PIO Response Status: %s, %#x @ %#x\n", - str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS)); - -- return -EFAULT; -+ return ret; - } - - static int advk_pcie_wait_pio(struct advk_pcie *pcie) -@@ -550,13 +739,13 @@ static int advk_pcie_wait_pio(struct advk_pcie *pcie) - struct device *dev = &pcie->pdev->dev; - int i; - -- for (i = 0; i < PIO_RETRY_CNT; i++) { -+ for (i = 1; i <= PIO_RETRY_CNT; i++) { - u32 start, isr; - - start = advk_readl(pcie, PIO_START); - isr = advk_readl(pcie, PIO_ISR); - if (!start && isr) -- return 0; -+ return i; - udelay(PIO_RETRY_DELAY); - } - -@@ -564,6 +753,64 @@ static int advk_pcie_wait_pio(struct advk_pcie *pcie) - return -ETIMEDOUT; - } - -+static pci_bridge_emul_read_status_t -+advk_pci_bridge_emul_base_conf_read(struct pci_bridge_emul *bridge, -+ int reg, u32 *value) -+{ -+ struct advk_pcie *pcie = bridge->data; -+ -+ switch (reg) { -+ case PCI_COMMAND: -+ *value = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG); -+ return PCI_BRIDGE_EMUL_HANDLED; -+ -+ case PCI_INTERRUPT_LINE: { -+ /* -+ * From the whole 32bit register we support reading from HW only -+ * one bit: PCI_BRIDGE_CTL_BUS_RESET. -+ * Other bits are retrieved only from emulated config buffer. -+ */ -+ __le32 *cfgspace = (__le32 *)&bridge->conf; -+ u32 val = le32_to_cpu(cfgspace[PCI_INTERRUPT_LINE / 4]); -+ if (advk_readl(pcie, PCIE_CORE_CTRL1_REG) & HOT_RESET_GEN) -+ val |= PCI_BRIDGE_CTL_BUS_RESET << 16; -+ else -+ val &= ~(PCI_BRIDGE_CTL_BUS_RESET << 16); -+ *value = val; -+ return PCI_BRIDGE_EMUL_HANDLED; -+ } -+ -+ default: -+ return PCI_BRIDGE_EMUL_NOT_HANDLED; -+ } -+} -+ -+static void -+advk_pci_bridge_emul_base_conf_write(struct pci_bridge_emul *bridge, -+ int reg, u32 old, u32 new, u32 mask) -+{ -+ struct advk_pcie *pcie = bridge->data; -+ -+ switch (reg) { -+ case PCI_COMMAND: -+ advk_writel(pcie, new, PCIE_CORE_CMD_STATUS_REG); -+ break; -+ -+ case PCI_INTERRUPT_LINE: -+ if (mask & (PCI_BRIDGE_CTL_BUS_RESET << 16)) { -+ u32 val = advk_readl(pcie, PCIE_CORE_CTRL1_REG); -+ if (new & (PCI_BRIDGE_CTL_BUS_RESET << 16)) -+ val |= HOT_RESET_GEN; -+ else -+ val &= ~HOT_RESET_GEN; -+ advk_writel(pcie, val, PCIE_CORE_CTRL1_REG); -+ } -+ break; -+ -+ default: -+ break; -+ } -+} - - static pci_bridge_emul_read_status_t - advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, -@@ -665,6 +912,8 @@ advk_pci_bridge_emul_pcie_conf_write(struct pci_bridge_emul *bridge, - } - - static struct pci_bridge_emul_ops advk_pci_bridge_emul_ops = { -+ .read_base = advk_pci_bridge_emul_base_conf_read, -+ .write_base = advk_pci_bridge_emul_base_conf_write, - .read_pcie = advk_pci_bridge_emul_pcie_conf_read, - .write_pcie = advk_pci_bridge_emul_pcie_conf_write, - }; -@@ -676,37 +925,33 @@ static struct pci_bridge_emul_ops advk_pci_bridge_emul_ops = { - static int advk_sw_pci_bridge_init(struct advk_pcie *pcie) - { - struct pci_bridge_emul *bridge = &pcie->bridge; -- int ret; - -- bridge->conf.vendor = advk_readl(pcie, PCIE_CORE_DEV_ID_REG) & 0xffff; -- bridge->conf.device = advk_readl(pcie, PCIE_CORE_DEV_ID_REG) >> 16; -+ bridge->conf.vendor = -+ cpu_to_le16(advk_readl(pcie, PCIE_CORE_DEV_ID_REG) & 0xffff); -+ bridge->conf.device = -+ cpu_to_le16(advk_readl(pcie, PCIE_CORE_DEV_ID_REG) >> 16); - bridge->conf.class_revision = -- advk_readl(pcie, PCIE_CORE_DEV_REV_REG) & 0xff; -+ cpu_to_le32(advk_readl(pcie, PCIE_CORE_DEV_REV_REG) & 0xff); - - /* Support 32 bits I/O addressing */ - bridge->conf.iobase = PCI_IO_RANGE_TYPE_32; - bridge->conf.iolimit = PCI_IO_RANGE_TYPE_32; - - /* Support 64 bits memory pref */ -- bridge->conf.pref_mem_base = PCI_PREF_RANGE_TYPE_64; -- bridge->conf.pref_mem_limit = PCI_PREF_RANGE_TYPE_64; -+ bridge->conf.pref_mem_base = cpu_to_le16(PCI_PREF_RANGE_TYPE_64); -+ bridge->conf.pref_mem_limit = cpu_to_le16(PCI_PREF_RANGE_TYPE_64); - - /* Support interrupt A for MSI feature */ - bridge->conf.intpin = PCIE_CORE_INT_A_ASSERT_ENABLE; - -+ /* Indicates supports for Completion Retry Status */ -+ bridge->pcie_conf.rootcap = cpu_to_le16(PCI_EXP_RTCAP_CRSVIS); -+ - bridge->has_pcie = true; - bridge->data = pcie; - bridge->ops = &advk_pci_bridge_emul_ops; - -- /* PCIe config space can be initialized after pci_bridge_emul_init() */ -- ret = pci_bridge_emul_init(bridge, 0); -- if (ret < 0) -- return ret; -- -- /* Indicates supports for Completion Retry Status */ -- bridge->pcie_conf.rootcap = cpu_to_le16(PCI_EXP_RTCAP_CRSVIS); -- -- return 0; -+ return pci_bridge_emul_init(bridge, 0); - } - - static bool advk_pcie_valid_device(struct advk_pcie *pcie, struct pci_bus *bus, -@@ -715,6 +960,13 @@ static bool advk_pcie_valid_device(struct advk_pcie *pcie, struct pci_bus *bus, - if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0) - return false; - -+ /* -+ * If the link goes down after we check for link-up, nothing bad -+ * happens but the config access times out. -+ */ -+ if (bus->number != pcie->root_bus_nr && !advk_pcie_link_up(pcie)) -+ return false; -+ - return true; - } - -@@ -751,6 +1003,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, - int where, int size, u32 *val) - { - struct advk_pcie *pcie = bus->sysdata; -+ int retry_count; - bool allow_crs; - u32 reg; - int ret; -@@ -773,18 +1026,8 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, - (le16_to_cpu(pcie->bridge.pcie_conf.rootctl) & - PCI_EXP_RTCTL_CRSSVE); - -- if (advk_pcie_pio_is_running(pcie)) { -- /* -- * If it is possible return Completion Retry Status so caller -- * tries to issue the request again instead of failing. -- */ -- if (allow_crs) { -- *val = CFG_RD_CRS_VAL; -- return PCIBIOS_SUCCESSFUL; -- } -- *val = 0xffffffff; -- return PCIBIOS_SET_FAILED; -- } -+ if (advk_pcie_pio_is_running(pcie)) -+ goto try_crs; - - /* Program the control register */ - reg = advk_readl(pcie, PIO_CTRL); -@@ -803,30 +1046,24 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, - /* Program the data strobe */ - advk_writel(pcie, 0xf, PIO_WR_DATA_STRB); - -- /* Clear PIO DONE ISR and start the transfer */ -- advk_writel(pcie, 1, PIO_ISR); -- advk_writel(pcie, 1, PIO_START); -+ retry_count = 0; -+ do { -+ /* Clear PIO DONE ISR and start the transfer */ -+ advk_writel(pcie, 1, PIO_ISR); -+ advk_writel(pcie, 1, PIO_START); - -- ret = advk_pcie_wait_pio(pcie); -- if (ret < 0) { -- /* -- * If it is possible return Completion Retry Status so caller -- * tries to issue the request again instead of failing. -- */ -- if (allow_crs) { -- *val = CFG_RD_CRS_VAL; -- return PCIBIOS_SUCCESSFUL; -- } -- *val = 0xffffffff; -- return PCIBIOS_SET_FAILED; -- } -+ ret = advk_pcie_wait_pio(pcie); -+ if (ret < 0) -+ goto try_crs; - -- /* Check PIO status and get the read result */ -- ret = advk_pcie_check_pio_status(pcie, allow_crs, val); -- if (ret < 0) { -- *val = 0xffffffff; -- return PCIBIOS_SET_FAILED; -- } -+ retry_count += ret; -+ -+ /* Check PIO status and get the read result */ -+ ret = advk_pcie_check_pio_status(pcie, allow_crs, val); -+ } while (ret == -EAGAIN && retry_count < PIO_RETRY_CNT); -+ -+ if (ret < 0) -+ goto fail; - - if (size == 1) - *val = (*val >> (8 * (where & 3))) & 0xff; -@@ -834,6 +1071,20 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, - *val = (*val >> (8 * (where & 3))) & 0xffff; - - return PCIBIOS_SUCCESSFUL; -+ -+try_crs: -+ /* -+ * If it is possible, return Completion Retry Status so that caller -+ * tries to issue the request again instead of failing. -+ */ -+ if (allow_crs) { -+ *val = CFG_RD_CRS_VAL; -+ return PCIBIOS_SUCCESSFUL; -+ } -+ -+fail: -+ *val = 0xffffffff; -+ return PCIBIOS_SET_FAILED; - } - - static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn, -@@ -842,6 +1093,7 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn, - struct advk_pcie *pcie = bus->sysdata; - u32 reg; - u32 data_strobe = 0x0; -+ int retry_count; - int offset; - int ret; - -@@ -883,19 +1135,22 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn, - /* Program the data strobe */ - advk_writel(pcie, data_strobe, PIO_WR_DATA_STRB); - -- /* Clear PIO DONE ISR and start the transfer */ -- advk_writel(pcie, 1, PIO_ISR); -- advk_writel(pcie, 1, PIO_START); -+ retry_count = 0; -+ do { -+ /* Clear PIO DONE ISR and start the transfer */ -+ advk_writel(pcie, 1, PIO_ISR); -+ advk_writel(pcie, 1, PIO_START); - -- ret = advk_pcie_wait_pio(pcie); -- if (ret < 0) -- return PCIBIOS_SET_FAILED; -+ ret = advk_pcie_wait_pio(pcie); -+ if (ret < 0) -+ return PCIBIOS_SET_FAILED; - -- ret = advk_pcie_check_pio_status(pcie, false, NULL); -- if (ret < 0) -- return PCIBIOS_SET_FAILED; -+ retry_count += ret; - -- return PCIBIOS_SUCCESSFUL; -+ ret = advk_pcie_check_pio_status(pcie, false, NULL); -+ } while (ret == -EAGAIN && retry_count < PIO_RETRY_CNT); -+ -+ return ret < 0 ? PCIBIOS_SET_FAILED : PCIBIOS_SUCCESSFUL; - } - - static struct pci_ops advk_pcie_ops = { -@@ -1244,6 +1499,7 @@ static int advk_pcie_probe(struct platform_device *pdev) - struct advk_pcie *pcie; - struct resource *res; - struct pci_host_bridge *bridge; -+ struct resource_entry *entry; - int ret, irq; - - bridge = devm_pci_alloc_host_bridge(dev, sizeof(struct advk_pcie)); -@@ -1273,6 +1529,102 @@ static int advk_pcie_probe(struct platform_device *pdev) - return ret; - } - -+ resource_list_for_each_entry(entry, &pcie->resources) { -+ resource_size_t start = entry->res->start; -+ resource_size_t size = resource_size(entry->res); -+ unsigned long type = resource_type(entry->res); -+ u64 win_size; -+ -+ /* -+ * Aardvark hardware allows to configure also PCIe window -+ * for config type 0 and type 1 mapping, but driver uses -+ * only PIO for issuing configuration transfers which does -+ * not use PCIe window configuration. -+ */ -+ if (type != IORESOURCE_MEM && type != IORESOURCE_MEM_64 && -+ type != IORESOURCE_IO) -+ continue; -+ -+ /* -+ * Skip transparent memory resources. Default outbound access -+ * configuration is set to transparent memory access so it -+ * does not need window configuration. -+ */ -+ if ((type == IORESOURCE_MEM || type == IORESOURCE_MEM_64) && -+ entry->offset == 0) -+ continue; -+ -+ /* -+ * The n-th PCIe window is configured by tuple (match, remap, mask) -+ * and an access to address A uses this window if A matches the -+ * match with given mask. -+ * So every PCIe window size must be a power of two and every start -+ * address must be aligned to window size. Minimal size is 64 KiB -+ * because lower 16 bits of mask must be zero. Remapped address -+ * may have set only bits from the mask. -+ */ -+ while (pcie->wins_count < OB_WIN_COUNT && size > 0) { -+ /* Calculate the largest aligned window size */ -+ win_size = (1ULL << (fls64(size)-1)) | -+ (start ? (1ULL << __ffs64(start)) : 0); -+ win_size = 1ULL << __ffs64(win_size); -+ if (win_size < 0x10000) -+ break; -+ -+ dev_dbg(dev, -+ "Configuring PCIe window %d: [0x%llx-0x%llx] as %lu\n", -+ pcie->wins_count, (unsigned long long)start, -+ (unsigned long long)start + win_size, type); -+ -+ if (type == IORESOURCE_IO) { -+ pcie->wins[pcie->wins_count].actions = OB_WIN_TYPE_IO; -+ pcie->wins[pcie->wins_count].match = pci_pio_to_address(start); -+ } else { -+ pcie->wins[pcie->wins_count].actions = OB_WIN_TYPE_MEM; -+ pcie->wins[pcie->wins_count].match = start; -+ } -+ pcie->wins[pcie->wins_count].remap = start - entry->offset; -+ pcie->wins[pcie->wins_count].mask = ~(win_size - 1); -+ -+ if (pcie->wins[pcie->wins_count].remap & (win_size - 1)) -+ break; -+ -+ start += win_size; -+ size -= win_size; -+ pcie->wins_count++; -+ } -+ -+ if (size > 0) { -+ dev_err(&pcie->pdev->dev, -+ "Invalid PCIe region [0x%llx-0x%llx]\n", -+ (unsigned long long)entry->res->start, -+ (unsigned long long)entry->res->end + 1); -+ return -EINVAL; -+ } -+ } -+ -+ pcie->reset_gpio = devm_gpiod_get_from_of_node(dev, dev->of_node, -+ "reset-gpios", 0, -+ GPIOD_OUT_LOW, -+ "pcie1-reset"); -+ ret = PTR_ERR_OR_ZERO(pcie->reset_gpio); -+ if (ret) { -+ if (ret == -ENOENT) { -+ pcie->reset_gpio = NULL; -+ } else { -+ if (ret != -EPROBE_DEFER) -+ dev_err(dev, "Failed to get reset-gpio: %i\n", -+ ret); -+ return ret; -+ } -+ } -+ -+ ret = of_pci_get_max_link_speed(dev->of_node); -+ if (ret <= 0 || ret > 3) -+ pcie->link_gen = 3; -+ else -+ pcie->link_gen = ret; -+ - advk_pcie_setup_hw(pcie); - - ret = advk_sw_pci_bridge_init(pcie); -diff --git a/drivers/pci/pci-bridge-emul.c b/drivers/pci/pci-bridge-emul.c -index b3d63e319bb39..3026346ccb18c 100644 ---- a/drivers/pci/pci-bridge-emul.c -+++ b/drivers/pci/pci-bridge-emul.c -@@ -21,8 +21,9 @@ - #include "pci-bridge-emul.h" - - #define PCI_BRIDGE_CONF_END PCI_STD_HEADER_SIZEOF -+#define PCI_CAP_PCIE_SIZEOF (PCI_EXP_SLTSTA2 + 2) - #define PCI_CAP_PCIE_START PCI_BRIDGE_CONF_END --#define PCI_CAP_PCIE_END (PCI_CAP_PCIE_START + PCI_EXP_SLTSTA2 + 2) -+#define PCI_CAP_PCIE_END (PCI_CAP_PCIE_START + PCI_CAP_PCIE_SIZEOF) - - struct pci_bridge_reg_behavior { - /* Read-only bits */ -@@ -38,7 +39,8 @@ struct pci_bridge_reg_behavior { - u32 rsvd; - }; - --static const struct pci_bridge_reg_behavior pci_regs_behavior[] = { -+static const -+struct pci_bridge_reg_behavior pci_regs_behavior[PCI_STD_HEADER_SIZEOF / 4] = { - [PCI_VENDOR_ID / 4] = { .ro = ~0 }, - [PCI_COMMAND / 4] = { - .rw = (PCI_COMMAND_IO | PCI_COMMAND_MEMORY | -@@ -173,7 +175,8 @@ static const struct pci_bridge_reg_behavior pci_regs_behavior[] = { - }, - }; - --static const struct pci_bridge_reg_behavior pcie_cap_regs_behavior[] = { -+static const -+struct pci_bridge_reg_behavior pcie_cap_regs_behavior[PCI_CAP_PCIE_SIZEOF / 4] = { - [PCI_CAP_LIST_ID / 4] = { - /* - * Capability ID, Next Capability Pointer and -@@ -270,6 +273,8 @@ static const struct pci_bridge_reg_behavior pcie_cap_regs_behavior[] = { - int pci_bridge_emul_init(struct pci_bridge_emul *bridge, - unsigned int flags) - { -+ BUILD_BUG_ON(sizeof(bridge->conf) != PCI_BRIDGE_CONF_END); -+ - bridge->conf.class_revision |= cpu_to_le32(PCI_CLASS_BRIDGE_PCI << 16); - bridge->conf.header_type = PCI_HEADER_TYPE_BRIDGE; - bridge->conf.cache_line_size = 0x10; -diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c -index 83e585c5a6132..f56add78d58ce 100644 ---- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c -+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c -@@ -166,10 +166,14 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = { - PIN_GRP_GPIO("jtag", 20, 5, BIT(0), "jtag"), - PIN_GRP_GPIO("sdio0", 8, 3, BIT(1), "sdio"), - PIN_GRP_GPIO("emmc_nb", 27, 9, BIT(2), "emmc"), -- PIN_GRP_GPIO("pwm0", 11, 1, BIT(3), "pwm"), -- PIN_GRP_GPIO("pwm1", 12, 1, BIT(4), "pwm"), -- PIN_GRP_GPIO("pwm2", 13, 1, BIT(5), "pwm"), -- PIN_GRP_GPIO("pwm3", 14, 1, BIT(6), "pwm"), -+ PIN_GRP_GPIO_3("pwm0", 11, 1, BIT(3) | BIT(20), 0, BIT(20), BIT(3), -+ "pwm", "led"), -+ PIN_GRP_GPIO_3("pwm1", 12, 1, BIT(4) | BIT(21), 0, BIT(21), BIT(4), -+ "pwm", "led"), -+ PIN_GRP_GPIO_3("pwm2", 13, 1, BIT(5) | BIT(22), 0, BIT(22), BIT(5), -+ "pwm", "led"), -+ PIN_GRP_GPIO_3("pwm3", 14, 1, BIT(6) | BIT(23), 0, BIT(23), BIT(6), -+ "pwm", "led"), - PIN_GRP_GPIO("pmic1", 7, 1, BIT(7), "pmic"), - PIN_GRP_GPIO("pmic0", 6, 1, BIT(8), "pmic"), - PIN_GRP_GPIO("i2c2", 2, 2, BIT(9), "i2c"), -@@ -183,11 +187,6 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = { - PIN_GRP_EXTRA("uart2", 9, 2, BIT(1) | BIT(13) | BIT(14) | BIT(19), - BIT(1) | BIT(13) | BIT(14), BIT(1) | BIT(19), - 18, 2, "gpio", "uart"), -- PIN_GRP_GPIO_2("led0_od", 11, 1, BIT(20), BIT(20), 0, "led"), -- PIN_GRP_GPIO_2("led1_od", 12, 1, BIT(21), BIT(21), 0, "led"), -- PIN_GRP_GPIO_2("led2_od", 13, 1, BIT(22), BIT(22), 0, "led"), -- PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"), -- - }; - - static struct armada_37xx_pin_group armada_37xx_sb_groups[] = { -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index 3654cfc4376fa..97c1f242ef0a3 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -3387,7 +3387,7 @@ _scsih_ublock_io_device(struct MPT3SAS_ADAPTER *ioc, u64 sas_address) - - shost_for_each_device(sdev, ioc->shost) { - sas_device_priv_data = sdev->hostdata; -- if (!sas_device_priv_data) -+ if (!sas_device_priv_data || !sas_device_priv_data->sas_target) - continue; - if (sas_device_priv_data->sas_target->sas_address - != sas_address) -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 16432d42a50aa..6faf1d6451b0c 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -796,7 +796,7 @@ store_state_field(struct device *dev, struct device_attribute *attr, - - mutex_lock(&sdev->state_mutex); - if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) { -- ret = count; -+ ret = 0; - } else { - ret = scsi_device_set_state(sdev, state); - if (ret == 0 && state == SDEV_RUNNING) -diff --git a/drivers/staging/fbtft/fb_ssd1351.c b/drivers/staging/fbtft/fb_ssd1351.c -index cf263a58a1489..6fd549a424d53 100644 ---- a/drivers/staging/fbtft/fb_ssd1351.c -+++ b/drivers/staging/fbtft/fb_ssd1351.c -@@ -187,7 +187,6 @@ static struct fbtft_display display = { - }, - }; - --#ifdef CONFIG_FB_BACKLIGHT - static int update_onboard_backlight(struct backlight_device *bd) - { - struct fbtft_par *par = bl_get_data(bd); -@@ -231,9 +230,6 @@ static void register_onboard_backlight(struct fbtft_par *par) - if (!par->fbtftops.unregister_backlight) - par->fbtftops.unregister_backlight = fbtft_unregister_backlight; - } --#else --static void register_onboard_backlight(struct fbtft_par *par) { }; --#endif - - FBTFT_REGISTER_DRIVER(DRVNAME, "solomon,ssd1351", &display); - -diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c -index bc53d68bfcaa3..771697508cec8 100644 ---- a/drivers/staging/fbtft/fbtft-core.c -+++ b/drivers/staging/fbtft/fbtft-core.c -@@ -136,7 +136,6 @@ static int fbtft_request_gpios_dt(struct fbtft_par *par) - } - #endif - --#ifdef CONFIG_FB_BACKLIGHT - static int fbtft_backlight_update_status(struct backlight_device *bd) - { - struct fbtft_par *par = bl_get_data(bd); -@@ -169,6 +168,7 @@ void fbtft_unregister_backlight(struct fbtft_par *par) - par->info->bl_dev = NULL; - } - } -+EXPORT_SYMBOL(fbtft_unregister_backlight); - - static const struct backlight_ops fbtft_bl_ops = { - .get_brightness = fbtft_backlight_get_brightness, -@@ -206,12 +206,7 @@ void fbtft_register_backlight(struct fbtft_par *par) - if (!par->fbtftops.unregister_backlight) - par->fbtftops.unregister_backlight = fbtft_unregister_backlight; - } --#else --void fbtft_register_backlight(struct fbtft_par *par) { }; --void fbtft_unregister_backlight(struct fbtft_par *par) { }; --#endif - EXPORT_SYMBOL(fbtft_register_backlight); --EXPORT_SYMBOL(fbtft_unregister_backlight); - - static void fbtft_set_addr_win(struct fbtft_par *par, int xs, int ys, int xe, - int ye) -@@ -860,13 +855,11 @@ int fbtft_register_framebuffer(struct fb_info *fb_info) - fb_info->fix.smem_len >> 10, text1, - HZ / fb_info->fbdefio->delay, text2); - --#ifdef CONFIG_FB_BACKLIGHT - /* Turn on backlight if available */ - if (fb_info->bl_dev) { - fb_info->bl_dev->props.power = FB_BLANK_UNBLANK; - fb_info->bl_dev->ops->update_status(fb_info->bl_dev); - } --#endif - - return 0; - -diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c -index c702ee9691b1d..bcbf0c8cd4209 100644 ---- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c -+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c -@@ -2559,13 +2559,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev) - free_irq(dev->irq, dev); - priv->irq = 0; - } -- free_rtllib(dev); - - if (dev->mem_start != 0) { - iounmap((void __iomem *)dev->mem_start); - release_mem_region(pci_resource_start(pdev, 1), - pci_resource_len(pdev, 1)); - } -+ -+ free_rtllib(dev); - } else { - priv = rtllib_priv(dev); - } -diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c -index 5ef08905fe05c..15da02aeee948 100644 ---- a/drivers/tty/hvc/hvc_xen.c -+++ b/drivers/tty/hvc/hvc_xen.c -@@ -86,7 +86,11 @@ static int __write_console(struct xencons_info *xencons, - cons = intf->out_cons; - prod = intf->out_prod; - mb(); /* update queue values before going on */ -- BUG_ON((prod - cons) > sizeof(intf->out)); -+ -+ if ((prod - cons) > sizeof(intf->out)) { -+ pr_err_once("xencons: Illegal ring page indices"); -+ return -EINVAL; -+ } - - while ((sent < len) && ((prod - cons) < sizeof(intf->out))) - intf->out[MASK_XENCONS_IDX(prod++, intf->out)] = data[sent++]; -@@ -114,7 +118,10 @@ static int domU_write_console(uint32_t vtermno, const char *data, int len) - */ - while (len) { - int sent = __write_console(cons, data, len); -- -+ -+ if (sent < 0) -+ return sent; -+ - data += sent; - len -= sent; - -@@ -138,7 +145,11 @@ static int domU_read_console(uint32_t vtermno, char *buf, int len) - cons = intf->in_cons; - prod = intf->in_prod; - mb(); /* get pointers before reading ring */ -- BUG_ON((prod - cons) > sizeof(intf->in)); -+ -+ if ((prod - cons) > sizeof(intf->in)) { -+ pr_err_once("xencons: Illegal ring page indices"); -+ return -EINVAL; -+ } - - while (cons != prod && recv < len) - buf[recv++] = intf->in[MASK_XENCONS_IDX(cons++, intf->in)]; -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 303e8b3c1bdae..d7ab2e88631a0 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -4609,8 +4609,6 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, - if (oldspeed == USB_SPEED_LOW) - delay = HUB_LONG_RESET_TIME; - -- mutex_lock(hcd->address0_mutex); -- - /* Reset the device; full speed may morph to high speed */ - /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */ - retval = hub_port_reset(hub, port1, udev, delay, false); -@@ -4925,7 +4923,6 @@ fail: - hub_port_disable(hub, port1, 0); - update_devnum(udev, devnum); /* for disconnect processing */ - } -- mutex_unlock(hcd->address0_mutex); - return retval; - } - -@@ -5015,6 +5012,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, - struct usb_port *port_dev = hub->ports[port1 - 1]; - struct usb_device *udev = port_dev->child; - static int unreliable_port = -1; -+ bool retry_locked; - - /* Disconnect any existing devices under this port */ - if (udev) { -@@ -5070,7 +5068,11 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, - unit_load = 100; - - status = 0; -+ - for (i = 0; i < SET_CONFIG_TRIES; i++) { -+ usb_lock_port(port_dev); -+ mutex_lock(hcd->address0_mutex); -+ retry_locked = true; - - /* reallocate for each attempt, since references - * to the previous one can escape in various ways -@@ -5079,6 +5081,8 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, - if (!udev) { - dev_err(&port_dev->dev, - "couldn't allocate usb_device\n"); -+ mutex_unlock(hcd->address0_mutex); -+ usb_unlock_port(port_dev); - goto done; - } - -@@ -5100,12 +5104,14 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, - } - - /* reset (non-USB 3.0 devices) and get descriptor */ -- usb_lock_port(port_dev); - status = hub_port_init(hub, udev, port1, i); -- usb_unlock_port(port_dev); - if (status < 0) - goto loop; - -+ mutex_unlock(hcd->address0_mutex); -+ usb_unlock_port(port_dev); -+ retry_locked = false; -+ - if (udev->quirks & USB_QUIRK_DELAY_INIT) - msleep(2000); - -@@ -5198,6 +5204,10 @@ loop: - usb_ep0_reinit(udev); - release_devnum(udev); - hub_free_dev(udev); -+ if (retry_locked) { -+ mutex_unlock(hcd->address0_mutex); -+ usb_unlock_port(port_dev); -+ } - usb_put_dev(udev); - if ((status == -ENOTCONN) || (status == -ENOTSUPP)) - break; -@@ -5794,6 +5804,8 @@ static int usb_reset_and_verify_device(struct usb_device *udev) - bos = udev->bos; - udev->bos = NULL; - -+ mutex_lock(hcd->address0_mutex); -+ - for (i = 0; i < SET_CONFIG_TRIES; ++i) { - - /* ep0 maxpacket size may change; let the HCD know about it. -@@ -5803,6 +5815,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev) - if (ret >= 0 || ret == -ENOTCONN || ret == -ENODEV) - break; - } -+ mutex_unlock(hcd->address0_mutex); - - if (ret < 0) - goto re_enumerate; -diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c -index e8b25dae09499..249e8e6aa9282 100644 ---- a/drivers/usb/dwc2/gadget.c -+++ b/drivers/usb/dwc2/gadget.c -@@ -1198,6 +1198,8 @@ static void dwc2_hsotg_start_req(struct dwc2_hsotg *hsotg, - } - ctrl |= DXEPCTL_CNAK; - } else { -+ hs_req->req.frame_number = hs_ep->target_frame; -+ hs_req->req.actual = 0; - dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA); - return; - } -@@ -2855,9 +2857,12 @@ static void dwc2_gadget_handle_ep_disabled(struct dwc2_hsotg_ep *hs_ep) - - do { - hs_req = get_ep_head(hs_ep); -- if (hs_req) -+ if (hs_req) { -+ hs_req->req.frame_number = hs_ep->target_frame; -+ hs_req->req.actual = 0; - dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, - -ENODATA); -+ } - dwc2_gadget_incr_frame_num(hs_ep); - /* Update current frame number value. */ - hsotg->frame_number = dwc2_hsotg_read_frameno(hsotg); -@@ -2910,8 +2915,11 @@ static void dwc2_gadget_handle_out_token_ep_disabled(struct dwc2_hsotg_ep *ep) - - while (dwc2_gadget_target_frame_elapsed(ep)) { - hs_req = get_ep_head(ep); -- if (hs_req) -+ if (hs_req) { -+ hs_req->req.frame_number = ep->target_frame; -+ hs_req->req.actual = 0; - dwc2_hsotg_complete_request(hsotg, ep, hs_req, -ENODATA); -+ } - - dwc2_gadget_incr_frame_num(ep); - /* Update current frame number value. */ -@@ -3000,8 +3008,11 @@ static void dwc2_gadget_handle_nak(struct dwc2_hsotg_ep *hs_ep) - - while (dwc2_gadget_target_frame_elapsed(hs_ep)) { - hs_req = get_ep_head(hs_ep); -- if (hs_req) -+ if (hs_req) { -+ hs_req->req.frame_number = hs_ep->target_frame; -+ hs_req->req.actual = 0; - dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA); -+ } - - dwc2_gadget_incr_frame_num(hs_ep); - /* Update current frame number value. */ -diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c -index 68bbac64b7536..94af71e9856f2 100644 ---- a/drivers/usb/dwc2/hcd_queue.c -+++ b/drivers/usb/dwc2/hcd_queue.c -@@ -59,7 +59,7 @@ - #define DWC2_UNRESERVE_DELAY (msecs_to_jiffies(5)) - - /* If we get a NAK, wait this long before retrying */ --#define DWC2_RETRY_WAIT_DELAY 1*1E6L -+#define DWC2_RETRY_WAIT_DELAY (1 * NSEC_PER_MSEC) - - /** - * dwc2_periodic_channel_available() - Checks that a channel is available for a -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index a1e9cbe518c74..74203ed5479fa 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1267,6 +1267,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = NCTRL(2) }, - { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ - .driver_info = NCTRL(0) | ZLP }, -+ { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing device */ -+ .driver_info = NCTRL(0) | ZLP }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), - .driver_info = RSVD(1) }, -@@ -2094,6 +2096,9 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ - { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ - { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ -+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) }, /* Fibocom FM101-GL (laptop MBIM) */ -+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff), /* Fibocom FM101-GL (laptop MBIM) */ -+ .driver_info = RSVD(4) }, - { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ - { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ - { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ -diff --git a/drivers/usb/typec/tcpm/fusb302.c b/drivers/usb/typec/tcpm/fusb302.c -index b498960ff72b5..5e661bae39972 100644 ---- a/drivers/usb/typec/tcpm/fusb302.c -+++ b/drivers/usb/typec/tcpm/fusb302.c -@@ -669,25 +669,27 @@ static int tcpm_set_cc(struct tcpc_dev *dev, enum typec_cc_status cc) - ret = fusb302_i2c_mask_write(chip, FUSB_REG_MASK, - FUSB_REG_MASK_BC_LVL | - FUSB_REG_MASK_COMP_CHNG, -- FUSB_REG_MASK_COMP_CHNG); -+ FUSB_REG_MASK_BC_LVL); - if (ret < 0) { - fusb302_log(chip, "cannot set SRC interrupt, ret=%d", - ret); - goto done; - } - chip->intr_comp_chng = true; -+ chip->intr_bc_lvl = false; - break; - case TYPEC_CC_RD: - ret = fusb302_i2c_mask_write(chip, FUSB_REG_MASK, - FUSB_REG_MASK_BC_LVL | - FUSB_REG_MASK_COMP_CHNG, -- FUSB_REG_MASK_BC_LVL); -+ FUSB_REG_MASK_COMP_CHNG); - if (ret < 0) { - fusb302_log(chip, "cannot set SRC interrupt, ret=%d", - ret); - goto done; - } - chip->intr_bc_lvl = true; -+ chip->intr_comp_chng = false; - break; - default: - break; -diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c -index f21f5bfbb78dc..2bf7cb01da9a3 100644 ---- a/drivers/vhost/vsock.c -+++ b/drivers/vhost/vsock.c -@@ -491,7 +491,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work) - virtio_transport_free_pkt(pkt); - - len += sizeof(pkt->hdr); -- vhost_add_used(vq, head, len); -+ vhost_add_used(vq, head, 0); - total_len += len; - added = true; - } while(likely(!vhost_exceeds_weight(vq, ++pkts, total_len))); -diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c -index 652894d619677..b911a91bce6b7 100644 ---- a/drivers/xen/xenbus/xenbus_probe.c -+++ b/drivers/xen/xenbus/xenbus_probe.c -@@ -846,7 +846,7 @@ static struct notifier_block xenbus_resume_nb = { - - static int __init xenbus_init(void) - { -- int err = 0; -+ int err; - uint64_t v = 0; - xen_store_domain_type = XS_UNKNOWN; - -@@ -886,6 +886,29 @@ static int __init xenbus_init(void) - err = hvm_get_parameter(HVM_PARAM_STORE_PFN, &v); - if (err) - goto out_error; -+ /* -+ * Uninitialized hvm_params are zero and return no error. -+ * Although it is theoretically possible to have -+ * HVM_PARAM_STORE_PFN set to zero on purpose, in reality it is -+ * not zero when valid. If zero, it means that Xenstore hasn't -+ * been properly initialized. Instead of attempting to map a -+ * wrong guest physical address return error. -+ * -+ * Also recognize all bits set as an invalid value. -+ */ -+ if (!v || !~v) { -+ err = -ENOENT; -+ goto out_error; -+ } -+ /* Avoid truncation on 32-bit. */ -+#if BITS_PER_LONG == 32 -+ if (v > ULONG_MAX) { -+ pr_err("%s: cannot handle HVM_PARAM_STORE_PFN=%llx > ULONG_MAX\n", -+ __func__, v); -+ err = -EINVAL; -+ goto out_error; -+ } -+#endif - xen_store_gfn = (unsigned long)v; - xen_store_interface = - xen_remap(xen_store_gfn << XEN_PAGE_SHIFT, -@@ -920,8 +943,10 @@ static int __init xenbus_init(void) - */ - proc_create_mount_point("xen"); - #endif -+ return 0; - - out_error: -+ xen_store_domain_type = XS_UNKNOWN; - return err; - } - -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index a9746af5a44db..03c85beecec10 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -2577,12 +2577,23 @@ int cifs_strict_fsync(struct file *file, loff_t start, loff_t end, - tcon = tlink_tcon(smbfile->tlink); - if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOSSYNC)) { - server = tcon->ses->server; -- if (server->ops->flush) -- rc = server->ops->flush(xid, tcon, &smbfile->fid); -- else -+ if (server->ops->flush == NULL) { - rc = -ENOSYS; -+ goto strict_fsync_exit; -+ } -+ -+ if ((OPEN_FMODE(smbfile->f_flags) & FMODE_WRITE) == 0) { -+ smbfile = find_writable_file(CIFS_I(inode), FIND_WR_ANY); -+ if (smbfile) { -+ rc = server->ops->flush(xid, tcon, &smbfile->fid); -+ cifsFileInfo_put(smbfile); -+ } else -+ cifs_dbg(FYI, "ignore fsync for file not open for write\n"); -+ } else -+ rc = server->ops->flush(xid, tcon, &smbfile->fid); - } - -+strict_fsync_exit: - free_xid(xid); - return rc; - } -@@ -2594,6 +2605,7 @@ int cifs_fsync(struct file *file, loff_t start, loff_t end, int datasync) - struct cifs_tcon *tcon; - struct TCP_Server_Info *server; - struct cifsFileInfo *smbfile = file->private_data; -+ struct inode *inode = file_inode(file); - struct cifs_sb_info *cifs_sb = CIFS_FILE_SB(file); - - rc = file_write_and_wait_range(file, start, end); -@@ -2608,12 +2620,23 @@ int cifs_fsync(struct file *file, loff_t start, loff_t end, int datasync) - tcon = tlink_tcon(smbfile->tlink); - if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOSSYNC)) { - server = tcon->ses->server; -- if (server->ops->flush) -- rc = server->ops->flush(xid, tcon, &smbfile->fid); -- else -+ if (server->ops->flush == NULL) { - rc = -ENOSYS; -+ goto fsync_exit; -+ } -+ -+ if ((OPEN_FMODE(smbfile->f_flags) & FMODE_WRITE) == 0) { -+ smbfile = find_writable_file(CIFS_I(inode), FIND_WR_ANY); -+ if (smbfile) { -+ rc = server->ops->flush(xid, tcon, &smbfile->fid); -+ cifsFileInfo_put(smbfile); -+ } else -+ cifs_dbg(FYI, "ignore fsync for file not open for write\n"); -+ } else -+ rc = server->ops->flush(xid, tcon, &smbfile->fid); - } - -+fsync_exit: - free_xid(xid); - return rc; - } -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index 4cb182c20eedd..0cd1d51dde06d 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -1385,6 +1385,7 @@ page_hit: - nid, nid_of_node(page), ino_of_node(page), - ofs_of_node(page), cpver_of_node(page), - next_blkaddr_of_node(page)); -+ set_sbi_flag(sbi, SBI_NEED_FSCK); - err = -EINVAL; - out_err: - ClearPageUptodate(page); -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index fa4d2aba5a701..64d6c8c9f1ff2 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -839,17 +839,17 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep) - goto out_put_old; - } - -+ get_page(newpage); -+ -+ if (!(buf->flags & PIPE_BUF_FLAG_LRU)) -+ lru_cache_add_file(newpage); -+ - /* - * Release while we have extra ref on stolen page. Otherwise - * anon_pipe_buf_release() might think the page can be reused. - */ - pipe_buf_release(cs->pipe, buf); - -- get_page(newpage); -- -- if (!(buf->flags & PIPE_BUF_FLAG_LRU)) -- lru_cache_add_file(newpage); -- - err = 0; - spin_lock(&cs->req->waitq.lock); - if (test_bit(FR_ABORTED, &cs->req->flags)) -diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c -index aed865a846296..2b78f7b8d5467 100644 ---- a/fs/nfs/nfs42xdr.c -+++ b/fs/nfs/nfs42xdr.c -@@ -769,8 +769,7 @@ static int nfs4_xdr_dec_clone(struct rpc_rqst *rqstp, - status = decode_clone(xdr); - if (status) - goto out; -- status = decode_getfattr(xdr, res->dst_fattr, res->server); -- -+ decode_getfattr(xdr, res->dst_fattr, res->server); - out: - res->rpc_status = status; - return status; -diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c -index 080ca9d5eccbb..b1102a31a1085 100644 ---- a/fs/proc/vmcore.c -+++ b/fs/proc/vmcore.c -@@ -125,9 +125,13 @@ ssize_t read_from_oldmem(char *buf, size_t count, - nr_bytes = count; - - /* If pfn is not ram, return zeros for sparse dump files */ -- if (pfn_is_ram(pfn) == 0) -- memset(buf, 0, nr_bytes); -- else { -+ if (pfn_is_ram(pfn) == 0) { -+ tmp = 0; -+ if (!userbuf) -+ memset(buf, 0, nr_bytes); -+ else if (clear_user(buf, nr_bytes)) -+ tmp = -EFAULT; -+ } else { - if (encrypted) - tmp = copy_oldmem_page_encrypted(pfn, buf, - nr_bytes, -@@ -136,10 +140,10 @@ ssize_t read_from_oldmem(char *buf, size_t count, - else - tmp = copy_oldmem_page(pfn, buf, nr_bytes, - offset, userbuf); -- -- if (tmp < 0) -- return tmp; - } -+ if (tmp < 0) -+ return tmp; -+ - *ppos += nr_bytes; - count -= nr_bytes; - buf += nr_bytes; -diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h -index c309f43bde45e..f8c4d9f97819f 100644 ---- a/include/linux/ipc_namespace.h -+++ b/include/linux/ipc_namespace.h -@@ -130,6 +130,16 @@ static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns) - return ns; - } - -+static inline struct ipc_namespace *get_ipc_ns_not_zero(struct ipc_namespace *ns) -+{ -+ if (ns) { -+ if (refcount_inc_not_zero(&ns->count)) -+ return ns; -+ } -+ -+ return NULL; -+} -+ - extern void put_ipc_ns(struct ipc_namespace *ns); - #else - static inline struct ipc_namespace *copy_ipcs(unsigned long flags, -@@ -146,6 +156,11 @@ static inline struct ipc_namespace *get_ipc_ns(struct ipc_namespace *ns) - return ns; - } - -+static inline struct ipc_namespace *get_ipc_ns_not_zero(struct ipc_namespace *ns) -+{ -+ return ns; -+} -+ - static inline void put_ipc_ns(struct ipc_namespace *ns) - { - } -diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h -index 4b1c3b664f517..36f3011ab6013 100644 ---- a/include/linux/sched/task.h -+++ b/include/linux/sched/task.h -@@ -157,7 +157,7 @@ static inline struct vm_struct *task_stack_vm_area(const struct task_struct *t) - * Protects ->fs, ->files, ->mm, ->group_info, ->comm, keyring - * subscriptions and synchronises with wait4(). Also used in procfs. Also - * pins the final release of task.io_context. Also protects ->cpuset and -- * ->cgroup.subsys[]. And ->vfork_done. -+ * ->cgroup.subsys[]. And ->vfork_done. And ->sysvshm.shm_clist. - * - * Nests both inside and outside of read_lock(&tasklist_lock). - * It must not be nested with write_lock_irq(&tasklist_lock), -diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h -index bd0f1595bdc71..05ecaefeb6322 100644 ---- a/include/net/ip6_fib.h -+++ b/include/net/ip6_fib.h -@@ -451,6 +451,7 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh, - struct fib6_config *cfg, gfp_t gfp_flags, - struct netlink_ext_ack *extack); - void fib6_nh_release(struct fib6_nh *fib6_nh); -+void fib6_nh_release_dsts(struct fib6_nh *fib6_nh); - - int call_fib6_entry_notifiers(struct net *net, - enum fib_event_type event_type, -diff --git a/include/net/ipv6_stubs.h b/include/net/ipv6_stubs.h -index 3e7d2c0e79ca1..af9e127779adf 100644 ---- a/include/net/ipv6_stubs.h -+++ b/include/net/ipv6_stubs.h -@@ -47,6 +47,7 @@ struct ipv6_stub { - struct fib6_config *cfg, gfp_t gfp_flags, - struct netlink_ext_ack *extack); - void (*fib6_nh_release)(struct fib6_nh *fib6_nh); -+ void (*fib6_nh_release_dsts)(struct fib6_nh *fib6_nh); - void (*fib6_update_sernum)(struct net *net, struct fib6_info *rt); - int (*ip6_del_rt)(struct net *net, struct fib6_info *rt); - void (*fib6_rt_update)(struct net *net, struct fib6_info *rt, -diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h -index 33979017b7824..004e49f748419 100644 ---- a/include/net/nfc/nci_core.h -+++ b/include/net/nfc/nci_core.h -@@ -30,6 +30,7 @@ enum nci_flag { - NCI_UP, - NCI_DATA_EXCHANGE, - NCI_DATA_EXCHANGE_TO, -+ NCI_UNREG, - }; - - /* NCI device states */ -diff --git a/include/net/nl802154.h b/include/net/nl802154.h -index ddcee128f5d9a..145acb8f25095 100644 ---- a/include/net/nl802154.h -+++ b/include/net/nl802154.h -@@ -19,6 +19,8 @@ - * - */ - -+#include -+ - #define NL802154_GENL_NAME "nl802154" - - enum nl802154_commands { -@@ -150,10 +152,9 @@ enum nl802154_attrs { - }; - - enum nl802154_iftype { -- /* for backwards compatibility TODO */ -- NL802154_IFTYPE_UNSPEC = -1, -+ NL802154_IFTYPE_UNSPEC = (~(__u32)0), - -- NL802154_IFTYPE_NODE, -+ NL802154_IFTYPE_NODE = 0, - NL802154_IFTYPE_MONITOR, - NL802154_IFTYPE_COORD, - -diff --git a/include/xen/interface/io/ring.h b/include/xen/interface/io/ring.h -index 3f40501fc60b1..b39cdbc522ec7 100644 ---- a/include/xen/interface/io/ring.h -+++ b/include/xen/interface/io/ring.h -@@ -1,21 +1,53 @@ --/* SPDX-License-Identifier: GPL-2.0 */ - /****************************************************************************** - * ring.h - * - * Shared producer-consumer ring macros. - * -+ * Permission is hereby granted, free of charge, to any person obtaining a copy -+ * of this software and associated documentation files (the "Software"), to -+ * deal in the Software without restriction, including without limitation the -+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or -+ * sell copies of the Software, and to permit persons to whom the Software is -+ * furnished to do so, subject to the following conditions: -+ * -+ * The above copyright notice and this permission notice shall be included in -+ * all copies or substantial portions of the Software. -+ * -+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -+ * DEALINGS IN THE SOFTWARE. -+ * - * Tim Deegan and Andrew Warfield November 2004. - */ - - #ifndef __XEN_PUBLIC_IO_RING_H__ - #define __XEN_PUBLIC_IO_RING_H__ - -+/* -+ * When #include'ing this header, you need to provide the following -+ * declaration upfront: -+ * - standard integers types (uint8_t, uint16_t, etc) -+ * They are provided by stdint.h of the standard headers. -+ * -+ * In addition, if you intend to use the FLEX macros, you also need to -+ * provide the following, before invoking the FLEX macros: -+ * - size_t -+ * - memcpy -+ * - grant_ref_t -+ * These declarations are provided by string.h of the standard headers, -+ * and grant_table.h from the Xen public headers. -+ */ -+ - #include - - typedef unsigned int RING_IDX; - - /* Round a 32-bit unsigned constant down to the nearest power of two. */ --#define __RD2(_x) (((_x) & 0x00000002) ? 0x2 : ((_x) & 0x1)) -+#define __RD2(_x) (((_x) & 0x00000002) ? 0x2 : ((_x) & 0x1)) - #define __RD4(_x) (((_x) & 0x0000000c) ? __RD2((_x)>>2)<<2 : __RD2(_x)) - #define __RD8(_x) (((_x) & 0x000000f0) ? __RD4((_x)>>4)<<4 : __RD4(_x)) - #define __RD16(_x) (((_x) & 0x0000ff00) ? __RD8((_x)>>8)<<8 : __RD8(_x)) -@@ -27,82 +59,79 @@ typedef unsigned int RING_IDX; - * A ring contains as many entries as will fit, rounded down to the nearest - * power of two (so we can mask with (size-1) to loop around). - */ --#define __CONST_RING_SIZE(_s, _sz) \ -- (__RD32(((_sz) - offsetof(struct _s##_sring, ring)) / \ -- sizeof(((struct _s##_sring *)0)->ring[0]))) -- -+#define __CONST_RING_SIZE(_s, _sz) \ -+ (__RD32(((_sz) - offsetof(struct _s##_sring, ring)) / \ -+ sizeof(((struct _s##_sring *)0)->ring[0]))) - /* - * The same for passing in an actual pointer instead of a name tag. - */ --#define __RING_SIZE(_s, _sz) \ -- (__RD32(((_sz) - (long)&(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0]))) -+#define __RING_SIZE(_s, _sz) \ -+ (__RD32(((_sz) - (long)(_s)->ring + (long)(_s)) / sizeof((_s)->ring[0]))) - - /* - * Macros to make the correct C datatypes for a new kind of ring. - * - * To make a new ring datatype, you need to have two message structures, -- * let's say struct request, and struct response already defined. -+ * let's say request_t, and response_t already defined. - * - * In a header where you want the ring datatype declared, you then do: - * -- * DEFINE_RING_TYPES(mytag, struct request, struct response); -+ * DEFINE_RING_TYPES(mytag, request_t, response_t); - * - * These expand out to give you a set of types, as you can see below. - * The most important of these are: - * -- * struct mytag_sring - The shared ring. -- * struct mytag_front_ring - The 'front' half of the ring. -- * struct mytag_back_ring - The 'back' half of the ring. -+ * mytag_sring_t - The shared ring. -+ * mytag_front_ring_t - The 'front' half of the ring. -+ * mytag_back_ring_t - The 'back' half of the ring. - * - * To initialize a ring in your code you need to know the location and size - * of the shared memory area (PAGE_SIZE, for instance). To initialise - * the front half: - * -- * struct mytag_front_ring front_ring; -- * SHARED_RING_INIT((struct mytag_sring *)shared_page); -- * FRONT_RING_INIT(&front_ring, (struct mytag_sring *)shared_page, -- * PAGE_SIZE); -+ * mytag_front_ring_t front_ring; -+ * SHARED_RING_INIT((mytag_sring_t *)shared_page); -+ * FRONT_RING_INIT(&front_ring, (mytag_sring_t *)shared_page, PAGE_SIZE); - * - * Initializing the back follows similarly (note that only the front - * initializes the shared ring): - * -- * struct mytag_back_ring back_ring; -- * BACK_RING_INIT(&back_ring, (struct mytag_sring *)shared_page, -- * PAGE_SIZE); -+ * mytag_back_ring_t back_ring; -+ * BACK_RING_INIT(&back_ring, (mytag_sring_t *)shared_page, PAGE_SIZE); - */ - --#define DEFINE_RING_TYPES(__name, __req_t, __rsp_t) \ -- \ --/* Shared ring entry */ \ --union __name##_sring_entry { \ -- __req_t req; \ -- __rsp_t rsp; \ --}; \ -- \ --/* Shared ring page */ \ --struct __name##_sring { \ -- RING_IDX req_prod, req_event; \ -- RING_IDX rsp_prod, rsp_event; \ -- uint8_t pad[48]; \ -- union __name##_sring_entry ring[1]; /* variable-length */ \ --}; \ -- \ --/* "Front" end's private variables */ \ --struct __name##_front_ring { \ -- RING_IDX req_prod_pvt; \ -- RING_IDX rsp_cons; \ -- unsigned int nr_ents; \ -- struct __name##_sring *sring; \ --}; \ -- \ --/* "Back" end's private variables */ \ --struct __name##_back_ring { \ -- RING_IDX rsp_prod_pvt; \ -- RING_IDX req_cons; \ -- unsigned int nr_ents; \ -- struct __name##_sring *sring; \ --}; -- -+#define DEFINE_RING_TYPES(__name, __req_t, __rsp_t) \ -+ \ -+/* Shared ring entry */ \ -+union __name##_sring_entry { \ -+ __req_t req; \ -+ __rsp_t rsp; \ -+}; \ -+ \ -+/* Shared ring page */ \ -+struct __name##_sring { \ -+ RING_IDX req_prod, req_event; \ -+ RING_IDX rsp_prod, rsp_event; \ -+ uint8_t __pad[48]; \ -+ union __name##_sring_entry ring[1]; /* variable-length */ \ -+}; \ -+ \ -+/* "Front" end's private variables */ \ -+struct __name##_front_ring { \ -+ RING_IDX req_prod_pvt; \ -+ RING_IDX rsp_cons; \ -+ unsigned int nr_ents; \ -+ struct __name##_sring *sring; \ -+}; \ -+ \ -+/* "Back" end's private variables */ \ -+struct __name##_back_ring { \ -+ RING_IDX rsp_prod_pvt; \ -+ RING_IDX req_cons; \ -+ unsigned int nr_ents; \ -+ struct __name##_sring *sring; \ -+}; \ -+ \ - /* - * Macros for manipulating rings. - * -@@ -119,105 +148,99 @@ struct __name##_back_ring { \ - */ - - /* Initialising empty rings */ --#define SHARED_RING_INIT(_s) do { \ -- (_s)->req_prod = (_s)->rsp_prod = 0; \ -- (_s)->req_event = (_s)->rsp_event = 1; \ -- memset((_s)->pad, 0, sizeof((_s)->pad)); \ -+#define SHARED_RING_INIT(_s) do { \ -+ (_s)->req_prod = (_s)->rsp_prod = 0; \ -+ (_s)->req_event = (_s)->rsp_event = 1; \ -+ (void)memset((_s)->__pad, 0, sizeof((_s)->__pad)); \ - } while(0) - --#define FRONT_RING_INIT(_r, _s, __size) do { \ -- (_r)->req_prod_pvt = 0; \ -- (_r)->rsp_cons = 0; \ -- (_r)->nr_ents = __RING_SIZE(_s, __size); \ -- (_r)->sring = (_s); \ -+#define FRONT_RING_ATTACH(_r, _s, _i, __size) do { \ -+ (_r)->req_prod_pvt = (_i); \ -+ (_r)->rsp_cons = (_i); \ -+ (_r)->nr_ents = __RING_SIZE(_s, __size); \ -+ (_r)->sring = (_s); \ - } while (0) - --#define BACK_RING_INIT(_r, _s, __size) do { \ -- (_r)->rsp_prod_pvt = 0; \ -- (_r)->req_cons = 0; \ -- (_r)->nr_ents = __RING_SIZE(_s, __size); \ -- (_r)->sring = (_s); \ --} while (0) -+#define FRONT_RING_INIT(_r, _s, __size) FRONT_RING_ATTACH(_r, _s, 0, __size) - --/* Initialize to existing shared indexes -- for recovery */ --#define FRONT_RING_ATTACH(_r, _s, __size) do { \ -- (_r)->sring = (_s); \ -- (_r)->req_prod_pvt = (_s)->req_prod; \ -- (_r)->rsp_cons = (_s)->rsp_prod; \ -- (_r)->nr_ents = __RING_SIZE(_s, __size); \ -+#define BACK_RING_ATTACH(_r, _s, _i, __size) do { \ -+ (_r)->rsp_prod_pvt = (_i); \ -+ (_r)->req_cons = (_i); \ -+ (_r)->nr_ents = __RING_SIZE(_s, __size); \ -+ (_r)->sring = (_s); \ - } while (0) - --#define BACK_RING_ATTACH(_r, _s, __size) do { \ -- (_r)->sring = (_s); \ -- (_r)->rsp_prod_pvt = (_s)->rsp_prod; \ -- (_r)->req_cons = (_s)->req_prod; \ -- (_r)->nr_ents = __RING_SIZE(_s, __size); \ --} while (0) -+#define BACK_RING_INIT(_r, _s, __size) BACK_RING_ATTACH(_r, _s, 0, __size) - - /* How big is this ring? */ --#define RING_SIZE(_r) \ -+#define RING_SIZE(_r) \ - ((_r)->nr_ents) - - /* Number of free requests (for use on front side only). */ --#define RING_FREE_REQUESTS(_r) \ -+#define RING_FREE_REQUESTS(_r) \ - (RING_SIZE(_r) - ((_r)->req_prod_pvt - (_r)->rsp_cons)) - - /* Test if there is an empty slot available on the front ring. - * (This is only meaningful from the front. ) - */ --#define RING_FULL(_r) \ -+#define RING_FULL(_r) \ - (RING_FREE_REQUESTS(_r) == 0) - - /* Test if there are outstanding messages to be processed on a ring. */ --#define RING_HAS_UNCONSUMED_RESPONSES(_r) \ -+#define RING_HAS_UNCONSUMED_RESPONSES(_r) \ - ((_r)->sring->rsp_prod - (_r)->rsp_cons) - --#define RING_HAS_UNCONSUMED_REQUESTS(_r) \ -- ({ \ -- unsigned int req = (_r)->sring->req_prod - (_r)->req_cons; \ -- unsigned int rsp = RING_SIZE(_r) - \ -- ((_r)->req_cons - (_r)->rsp_prod_pvt); \ -- req < rsp ? req : rsp; \ -- }) -+#define RING_HAS_UNCONSUMED_REQUESTS(_r) ({ \ -+ unsigned int req = (_r)->sring->req_prod - (_r)->req_cons; \ -+ unsigned int rsp = RING_SIZE(_r) - \ -+ ((_r)->req_cons - (_r)->rsp_prod_pvt); \ -+ req < rsp ? req : rsp; \ -+}) - - /* Direct access to individual ring elements, by index. */ --#define RING_GET_REQUEST(_r, _idx) \ -+#define RING_GET_REQUEST(_r, _idx) \ - (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req)) - -+#define RING_GET_RESPONSE(_r, _idx) \ -+ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp)) -+ - /* -- * Get a local copy of a request. -+ * Get a local copy of a request/response. - * -- * Use this in preference to RING_GET_REQUEST() so all processing is -+ * Use this in preference to RING_GET_{REQUEST,RESPONSE}() so all processing is - * done on a local copy that cannot be modified by the other end. - * - * Note that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 may cause this -- * to be ineffective where _req is a struct which consists of only bitfields. -+ * to be ineffective where dest is a struct which consists of only bitfields. - */ --#define RING_COPY_REQUEST(_r, _idx, _req) do { \ -- /* Use volatile to force the copy into _req. */ \ -- *(_req) = *(volatile typeof(_req))RING_GET_REQUEST(_r, _idx); \ -+#define RING_COPY_(type, r, idx, dest) do { \ -+ /* Use volatile to force the copy into dest. */ \ -+ *(dest) = *(volatile typeof(dest))RING_GET_##type(r, idx); \ - } while (0) - --#define RING_GET_RESPONSE(_r, _idx) \ -- (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp)) -+#define RING_COPY_REQUEST(r, idx, req) RING_COPY_(REQUEST, r, idx, req) -+#define RING_COPY_RESPONSE(r, idx, rsp) RING_COPY_(RESPONSE, r, idx, rsp) - - /* Loop termination condition: Would the specified index overflow the ring? */ --#define RING_REQUEST_CONS_OVERFLOW(_r, _cons) \ -+#define RING_REQUEST_CONS_OVERFLOW(_r, _cons) \ - (((_cons) - (_r)->rsp_prod_pvt) >= RING_SIZE(_r)) - - /* Ill-behaved frontend determination: Can there be this many requests? */ --#define RING_REQUEST_PROD_OVERFLOW(_r, _prod) \ -+#define RING_REQUEST_PROD_OVERFLOW(_r, _prod) \ - (((_prod) - (_r)->rsp_prod_pvt) > RING_SIZE(_r)) - -+/* Ill-behaved backend determination: Can there be this many responses? */ -+#define RING_RESPONSE_PROD_OVERFLOW(_r, _prod) \ -+ (((_prod) - (_r)->rsp_cons) > RING_SIZE(_r)) - --#define RING_PUSH_REQUESTS(_r) do { \ -- virt_wmb(); /* back sees requests /before/ updated producer index */ \ -- (_r)->sring->req_prod = (_r)->req_prod_pvt; \ -+#define RING_PUSH_REQUESTS(_r) do { \ -+ virt_wmb(); /* back sees requests /before/ updated producer index */\ -+ (_r)->sring->req_prod = (_r)->req_prod_pvt; \ - } while (0) - --#define RING_PUSH_RESPONSES(_r) do { \ -- virt_wmb(); /* front sees responses /before/ updated producer index */ \ -- (_r)->sring->rsp_prod = (_r)->rsp_prod_pvt; \ -+#define RING_PUSH_RESPONSES(_r) do { \ -+ virt_wmb(); /* front sees resps /before/ updated producer index */ \ -+ (_r)->sring->rsp_prod = (_r)->rsp_prod_pvt; \ - } while (0) - - /* -@@ -250,40 +273,40 @@ struct __name##_back_ring { \ - * field appropriately. - */ - --#define RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(_r, _notify) do { \ -- RING_IDX __old = (_r)->sring->req_prod; \ -- RING_IDX __new = (_r)->req_prod_pvt; \ -- virt_wmb(); /* back sees requests /before/ updated producer index */ \ -- (_r)->sring->req_prod = __new; \ -- virt_mb(); /* back sees new requests /before/ we check req_event */ \ -- (_notify) = ((RING_IDX)(__new - (_r)->sring->req_event) < \ -- (RING_IDX)(__new - __old)); \ -+#define RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(_r, _notify) do { \ -+ RING_IDX __old = (_r)->sring->req_prod; \ -+ RING_IDX __new = (_r)->req_prod_pvt; \ -+ virt_wmb(); /* back sees requests /before/ updated producer index */\ -+ (_r)->sring->req_prod = __new; \ -+ virt_mb(); /* back sees new requests /before/ we check req_event */ \ -+ (_notify) = ((RING_IDX)(__new - (_r)->sring->req_event) < \ -+ (RING_IDX)(__new - __old)); \ - } while (0) - --#define RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(_r, _notify) do { \ -- RING_IDX __old = (_r)->sring->rsp_prod; \ -- RING_IDX __new = (_r)->rsp_prod_pvt; \ -- virt_wmb(); /* front sees responses /before/ updated producer index */ \ -- (_r)->sring->rsp_prod = __new; \ -- virt_mb(); /* front sees new responses /before/ we check rsp_event */ \ -- (_notify) = ((RING_IDX)(__new - (_r)->sring->rsp_event) < \ -- (RING_IDX)(__new - __old)); \ -+#define RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(_r, _notify) do { \ -+ RING_IDX __old = (_r)->sring->rsp_prod; \ -+ RING_IDX __new = (_r)->rsp_prod_pvt; \ -+ virt_wmb(); /* front sees resps /before/ updated producer index */ \ -+ (_r)->sring->rsp_prod = __new; \ -+ virt_mb(); /* front sees new resps /before/ we check rsp_event */ \ -+ (_notify) = ((RING_IDX)(__new - (_r)->sring->rsp_event) < \ -+ (RING_IDX)(__new - __old)); \ - } while (0) - --#define RING_FINAL_CHECK_FOR_REQUESTS(_r, _work_to_do) do { \ -- (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \ -- if (_work_to_do) break; \ -- (_r)->sring->req_event = (_r)->req_cons + 1; \ -- virt_mb(); \ -- (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \ -+#define RING_FINAL_CHECK_FOR_REQUESTS(_r, _work_to_do) do { \ -+ (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \ -+ if (_work_to_do) break; \ -+ (_r)->sring->req_event = (_r)->req_cons + 1; \ -+ virt_mb(); \ -+ (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \ - } while (0) - --#define RING_FINAL_CHECK_FOR_RESPONSES(_r, _work_to_do) do { \ -- (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \ -- if (_work_to_do) break; \ -- (_r)->sring->rsp_event = (_r)->rsp_cons + 1; \ -- virt_mb(); \ -- (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \ -+#define RING_FINAL_CHECK_FOR_RESPONSES(_r, _work_to_do) do { \ -+ (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \ -+ if (_work_to_do) break; \ -+ (_r)->sring->rsp_event = (_r)->rsp_cons + 1; \ -+ virt_mb(); \ -+ (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \ - } while (0) - - -diff --git a/ipc/shm.c b/ipc/shm.c -index ce1ca9f7c6e97..984addb5aeb5e 100644 ---- a/ipc/shm.c -+++ b/ipc/shm.c -@@ -62,9 +62,18 @@ struct shmid_kernel /* private to the kernel */ - struct pid *shm_lprid; - struct user_struct *mlock_user; - -- /* The task created the shm object. NULL if the task is dead. */ -+ /* -+ * The task created the shm object, for -+ * task_lock(shp->shm_creator) -+ */ - struct task_struct *shm_creator; -- struct list_head shm_clist; /* list by creator */ -+ -+ /* -+ * List by creator. task_lock(->shm_creator) required for read/write. -+ * If list_empty(), then the creator is dead already. -+ */ -+ struct list_head shm_clist; -+ struct ipc_namespace *ns; - } __randomize_layout; - - /* shm_mode upper byte flags */ -@@ -115,6 +124,7 @@ static void do_shm_rmid(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp) - struct shmid_kernel *shp; - - shp = container_of(ipcp, struct shmid_kernel, shm_perm); -+ WARN_ON(ns != shp->ns); - - if (shp->shm_nattch) { - shp->shm_perm.mode |= SHM_DEST; -@@ -225,10 +235,43 @@ static void shm_rcu_free(struct rcu_head *head) - kvfree(shp); - } - --static inline void shm_rmid(struct ipc_namespace *ns, struct shmid_kernel *s) -+/* -+ * It has to be called with shp locked. -+ * It must be called before ipc_rmid() -+ */ -+static inline void shm_clist_rm(struct shmid_kernel *shp) - { -- list_del(&s->shm_clist); -- ipc_rmid(&shm_ids(ns), &s->shm_perm); -+ struct task_struct *creator; -+ -+ /* ensure that shm_creator does not disappear */ -+ rcu_read_lock(); -+ -+ /* -+ * A concurrent exit_shm may do a list_del_init() as well. -+ * Just do nothing if exit_shm already did the work -+ */ -+ if (!list_empty(&shp->shm_clist)) { -+ /* -+ * shp->shm_creator is guaranteed to be valid *only* -+ * if shp->shm_clist is not empty. -+ */ -+ creator = shp->shm_creator; -+ -+ task_lock(creator); -+ /* -+ * list_del_init() is a nop if the entry was already removed -+ * from the list. -+ */ -+ list_del_init(&shp->shm_clist); -+ task_unlock(creator); -+ } -+ rcu_read_unlock(); -+} -+ -+static inline void shm_rmid(struct shmid_kernel *s) -+{ -+ shm_clist_rm(s); -+ ipc_rmid(&shm_ids(s->ns), &s->shm_perm); - } - - -@@ -283,7 +326,7 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) - shm_file = shp->shm_file; - shp->shm_file = NULL; - ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT; -- shm_rmid(ns, shp); -+ shm_rmid(shp); - shm_unlock(shp); - if (!is_file_hugepages(shm_file)) - shmem_lock(shm_file, 0, shp->mlock_user); -@@ -306,10 +349,10 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) - * - * 2) sysctl kernel.shm_rmid_forced is set to 1. - */ --static bool shm_may_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp) -+static bool shm_may_destroy(struct shmid_kernel *shp) - { - return (shp->shm_nattch == 0) && -- (ns->shm_rmid_forced || -+ (shp->ns->shm_rmid_forced || - (shp->shm_perm.mode & SHM_DEST)); - } - -@@ -340,7 +383,7 @@ static void shm_close(struct vm_area_struct *vma) - ipc_update_pid(&shp->shm_lprid, task_tgid(current)); - shp->shm_dtim = ktime_get_real_seconds(); - shp->shm_nattch--; -- if (shm_may_destroy(ns, shp)) -+ if (shm_may_destroy(shp)) - shm_destroy(ns, shp); - else - shm_unlock(shp); -@@ -361,10 +404,10 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data) - * - * As shp->* are changed under rwsem, it's safe to skip shp locking. - */ -- if (shp->shm_creator != NULL) -+ if (!list_empty(&shp->shm_clist)) - return 0; - -- if (shm_may_destroy(ns, shp)) { -+ if (shm_may_destroy(shp)) { - shm_lock_by_ptr(shp); - shm_destroy(ns, shp); - } -@@ -382,48 +425,97 @@ void shm_destroy_orphaned(struct ipc_namespace *ns) - /* Locking assumes this will only be called with task == current */ - void exit_shm(struct task_struct *task) - { -- struct ipc_namespace *ns = task->nsproxy->ipc_ns; -- struct shmid_kernel *shp, *n; -+ for (;;) { -+ struct shmid_kernel *shp; -+ struct ipc_namespace *ns; - -- if (list_empty(&task->sysvshm.shm_clist)) -- return; -+ task_lock(task); -+ -+ if (list_empty(&task->sysvshm.shm_clist)) { -+ task_unlock(task); -+ break; -+ } -+ -+ shp = list_first_entry(&task->sysvshm.shm_clist, struct shmid_kernel, -+ shm_clist); - -- /* -- * If kernel.shm_rmid_forced is not set then only keep track of -- * which shmids are orphaned, so that a later set of the sysctl -- * can clean them up. -- */ -- if (!ns->shm_rmid_forced) { -- down_read(&shm_ids(ns).rwsem); -- list_for_each_entry(shp, &task->sysvshm.shm_clist, shm_clist) -- shp->shm_creator = NULL; - /* -- * Only under read lock but we are only called on current -- * so no entry on the list will be shared. -+ * 1) Get pointer to the ipc namespace. It is worth to say -+ * that this pointer is guaranteed to be valid because -+ * shp lifetime is always shorter than namespace lifetime -+ * in which shp lives. -+ * We taken task_lock it means that shp won't be freed. - */ -- list_del(&task->sysvshm.shm_clist); -- up_read(&shm_ids(ns).rwsem); -- return; -- } -+ ns = shp->ns; - -- /* -- * Destroy all already created segments, that were not yet mapped, -- * and mark any mapped as orphan to cover the sysctl toggling. -- * Destroy is skipped if shm_may_destroy() returns false. -- */ -- down_write(&shm_ids(ns).rwsem); -- list_for_each_entry_safe(shp, n, &task->sysvshm.shm_clist, shm_clist) { -- shp->shm_creator = NULL; -+ /* -+ * 2) If kernel.shm_rmid_forced is not set then only keep track of -+ * which shmids are orphaned, so that a later set of the sysctl -+ * can clean them up. -+ */ -+ if (!ns->shm_rmid_forced) -+ goto unlink_continue; - -- if (shm_may_destroy(ns, shp)) { -- shm_lock_by_ptr(shp); -- shm_destroy(ns, shp); -+ /* -+ * 3) get a reference to the namespace. -+ * The refcount could be already 0. If it is 0, then -+ * the shm objects will be free by free_ipc_work(). -+ */ -+ ns = get_ipc_ns_not_zero(ns); -+ if (!ns) { -+unlink_continue: -+ list_del_init(&shp->shm_clist); -+ task_unlock(task); -+ continue; - } -- } - -- /* Remove the list head from any segments still attached. */ -- list_del(&task->sysvshm.shm_clist); -- up_write(&shm_ids(ns).rwsem); -+ /* -+ * 4) get a reference to shp. -+ * This cannot fail: shm_clist_rm() is called before -+ * ipc_rmid(), thus the refcount cannot be 0. -+ */ -+ WARN_ON(!ipc_rcu_getref(&shp->shm_perm)); -+ -+ /* -+ * 5) unlink the shm segment from the list of segments -+ * created by current. -+ * This must be done last. After unlinking, -+ * only the refcounts obtained above prevent IPC_RMID -+ * from destroying the segment or the namespace. -+ */ -+ list_del_init(&shp->shm_clist); -+ -+ task_unlock(task); -+ -+ /* -+ * 6) we have all references -+ * Thus lock & if needed destroy shp. -+ */ -+ down_write(&shm_ids(ns).rwsem); -+ shm_lock_by_ptr(shp); -+ /* -+ * rcu_read_lock was implicitly taken in shm_lock_by_ptr, it's -+ * safe to call ipc_rcu_putref here -+ */ -+ ipc_rcu_putref(&shp->shm_perm, shm_rcu_free); -+ -+ if (ipc_valid_object(&shp->shm_perm)) { -+ if (shm_may_destroy(shp)) -+ shm_destroy(ns, shp); -+ else -+ shm_unlock(shp); -+ } else { -+ /* -+ * Someone else deleted the shp from namespace -+ * idr/kht while we have waited. -+ * Just unlock and continue. -+ */ -+ shm_unlock(shp); -+ } -+ -+ up_write(&shm_ids(ns).rwsem); -+ put_ipc_ns(ns); /* paired with get_ipc_ns_not_zero */ -+ } - } - - static vm_fault_t shm_fault(struct vm_fault *vmf) -@@ -680,7 +772,11 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) - if (error < 0) - goto no_id; - -+ shp->ns = ns; -+ -+ task_lock(current); - list_add(&shp->shm_clist, ¤t->sysvshm.shm_clist); -+ task_unlock(current); - - /* - * shmid gets reported as "inode#" in /proc/pid/maps. -@@ -1575,7 +1671,8 @@ out_nattch: - down_write(&shm_ids(ns).rwsem); - shp = shm_lock(ns, shmid); - shp->shm_nattch--; -- if (shm_may_destroy(ns, shp)) -+ -+ if (shm_may_destroy(shp)) - shm_destroy(ns, shp); - else - shm_unlock(shp); -diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c -index 69c4cd472def3..6cafb2e910a11 100644 ---- a/kernel/power/hibernate.c -+++ b/kernel/power/hibernate.c -@@ -676,7 +676,7 @@ static int load_image_and_restore(void) - goto Unlock; - - error = swsusp_read(&flags); -- swsusp_close(FMODE_READ); -+ swsusp_close(FMODE_READ | FMODE_EXCL); - if (!error) - hibernation_restore(flags & SF_PLATFORM_MODE); - -@@ -871,7 +871,7 @@ static int software_resume(void) - /* The snapshot device should not be opened while we're running */ - if (!atomic_add_unless(&snapshot_device_available, -1, 0)) { - error = -EBUSY; -- swsusp_close(FMODE_READ); -+ swsusp_close(FMODE_READ | FMODE_EXCL); - goto Unlock; - } - -@@ -907,7 +907,7 @@ static int software_resume(void) - pm_pr_dbg("Hibernation image not present or could not be loaded.\n"); - return error; - Close_Finish: -- swsusp_close(FMODE_READ); -+ swsusp_close(FMODE_READ | FMODE_EXCL); - goto Finish; - } - -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index 35e9a01b54800..1d514a1a31554 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -1423,14 +1423,26 @@ __event_trigger_test_discard(struct trace_event_file *file, - if (eflags & EVENT_FILE_FL_TRIGGER_COND) - *tt = event_triggers_call(file, entry, event); - -- if (test_bit(EVENT_FILE_FL_SOFT_DISABLED_BIT, &file->flags) || -- (unlikely(file->flags & EVENT_FILE_FL_FILTERED) && -- !filter_match_preds(file->filter, entry))) { -- __trace_event_discard_commit(buffer, event); -- return true; -- } -+ if (likely(!(file->flags & (EVENT_FILE_FL_SOFT_DISABLED | -+ EVENT_FILE_FL_FILTERED | -+ EVENT_FILE_FL_PID_FILTER)))) -+ return false; -+ -+ if (file->flags & EVENT_FILE_FL_SOFT_DISABLED) -+ goto discard; -+ -+ if (file->flags & EVENT_FILE_FL_FILTERED && -+ !filter_match_preds(file->filter, entry)) -+ goto discard; -+ -+ if ((file->flags & EVENT_FILE_FL_PID_FILTER) && -+ trace_event_ignore_this_pid(file)) -+ goto discard; - - return false; -+ discard: -+ __trace_event_discard_commit(buffer, event); -+ return true; - } - - /** -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index e31ee325dad16..4acc77e049e5f 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -2247,12 +2247,19 @@ static struct trace_event_file * - trace_create_new_event(struct trace_event_call *call, - struct trace_array *tr) - { -+ struct trace_pid_list *pid_list; - struct trace_event_file *file; - - file = kmem_cache_alloc(file_cachep, GFP_TRACE); - if (!file) - return NULL; - -+ pid_list = rcu_dereference_protected(tr->filtered_pids, -+ lockdep_is_held(&event_mutex)); -+ -+ if (pid_list) -+ file->flags |= EVENT_FILE_FL_PID_FILTER; -+ - file->event_call = call; - file->tr = tr; - atomic_set(&file->sm_ref, 0); -diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c -index b515db036becc..efb51a23a14f2 100644 ---- a/kernel/trace/trace_uprobe.c -+++ b/kernel/trace/trace_uprobe.c -@@ -1299,6 +1299,7 @@ static int uprobe_perf_open(struct trace_event_call *call, - return 0; - - list_for_each_entry(pos, trace_probe_probe_list(tp), list) { -+ tu = container_of(pos, struct trace_uprobe, tp); - err = uprobe_apply(tu->inode, tu->offset, &tu->consumer, true); - if (err) { - uprobe_perf_close(call, event); -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index cd7c0429cddf8..796d95797ab40 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -177,9 +177,6 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack) - if (err) - goto out_unregister_netdev; - -- /* Account for reference in struct vlan_dev_priv */ -- dev_hold(real_dev); -- - vlan_stacked_transfer_operstate(real_dev, dev, vlan); - linkwatch_fire_event(dev); /* _MUST_ call rfc2863_policy() */ - -diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c -index 415a29d42cdf0..589615ec490bb 100644 ---- a/net/8021q/vlan_dev.c -+++ b/net/8021q/vlan_dev.c -@@ -583,6 +583,9 @@ static int vlan_dev_init(struct net_device *dev) - if (!vlan->vlan_pcpu_stats) - return -ENOMEM; - -+ /* Get vlan's reference to real_dev */ -+ dev_hold(real_dev); -+ - return 0; - } - -diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c -index 858bb10d8341e..4d69b3de980a6 100644 ---- a/net/ipv4/nexthop.c -+++ b/net/ipv4/nexthop.c -@@ -839,15 +839,36 @@ static void remove_nexthop(struct net *net, struct nexthop *nh, - /* if any FIB entries reference this nexthop, any dst entries - * need to be regenerated - */ --static void nh_rt_cache_flush(struct net *net, struct nexthop *nh) -+static void nh_rt_cache_flush(struct net *net, struct nexthop *nh, -+ struct nexthop *replaced_nh) - { - struct fib6_info *f6i; -+ struct nh_group *nhg; -+ int i; - - if (!list_empty(&nh->fi_list)) - rt_cache_flush(net); - - list_for_each_entry(f6i, &nh->f6i_list, nh_list) - ipv6_stub->fib6_update_sernum(net, f6i); -+ -+ /* if an IPv6 group was replaced, we have to release all old -+ * dsts to make sure all refcounts are released -+ */ -+ if (!replaced_nh->is_group) -+ return; -+ -+ /* new dsts must use only the new nexthop group */ -+ synchronize_net(); -+ -+ nhg = rtnl_dereference(replaced_nh->nh_grp); -+ for (i = 0; i < nhg->num_nh; i++) { -+ struct nh_grp_entry *nhge = &nhg->nh_entries[i]; -+ struct nh_info *nhi = rtnl_dereference(nhge->nh->nh_info); -+ -+ if (nhi->family == AF_INET6) -+ ipv6_stub->fib6_nh_release_dsts(&nhi->fib6_nh); -+ } - } - - static int replace_nexthop_grp(struct net *net, struct nexthop *old, -@@ -994,7 +1015,7 @@ static int replace_nexthop(struct net *net, struct nexthop *old, - err = replace_nexthop_single(net, old, new, extack); - - if (!err) { -- nh_rt_cache_flush(net, old); -+ nh_rt_cache_flush(net, old, new); - - __remove_nexthop(net, new, NULL); - nexthop_put(new); -@@ -1231,11 +1252,15 @@ static int nh_create_ipv6(struct net *net, struct nexthop *nh, - /* sets nh_dev if successful */ - err = ipv6_stub->fib6_nh_init(net, fib6_nh, &fib6_cfg, GFP_KERNEL, - extack); -- if (err) -+ if (err) { -+ /* IPv6 is not enabled, don't call fib6_nh_release */ -+ if (err == -EAFNOSUPPORT) -+ goto out; - ipv6_stub->fib6_nh_release(fib6_nh); -- else -+ } else { - nh->nh_flags = fib6_nh->fib_nh_flags; -- -+ } -+out: - return err; - } - -diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c -index ee6c38a73325d..44be7a5a13911 100644 ---- a/net/ipv4/tcp_cubic.c -+++ b/net/ipv4/tcp_cubic.c -@@ -341,8 +341,6 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked) - return; - - if (tcp_in_slow_start(tp)) { -- if (hystart && after(ack, ca->end_seq)) -- bictcp_hystart_reset(sk); - acked = tcp_slow_start(tp, acked); - if (!acked) - return; -@@ -384,6 +382,9 @@ static void hystart_update(struct sock *sk, u32 delay) - if (ca->found & hystart_detect) - return; - -+ if (after(tp->snd_una, ca->end_seq)) -+ bictcp_hystart_reset(sk); -+ - if (hystart_detect & HYSTART_ACK_TRAIN) { - u32 now = bictcp_clock(); - -diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c -index 14ac1d9112877..942da168f18fb 100644 ---- a/net/ipv6/af_inet6.c -+++ b/net/ipv6/af_inet6.c -@@ -955,6 +955,7 @@ static const struct ipv6_stub ipv6_stub_impl = { - .ip6_mtu_from_fib6 = ip6_mtu_from_fib6, - .fib6_nh_init = fib6_nh_init, - .fib6_nh_release = fib6_nh_release, -+ .fib6_nh_release_dsts = fib6_nh_release_dsts, - .fib6_update_sernum = fib6_update_sernum_stub, - .fib6_rt_update = fib6_rt_update, - .ip6_del_rt = ip6_del_rt, -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index fc913f09606db..d847aa32628da 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -192,7 +192,7 @@ static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff - #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM) - /* Policy lookup after SNAT yielded a new policy */ - if (skb_dst(skb)->xfrm) { -- IPCB(skb)->flags |= IPSKB_REROUTED; -+ IP6CB(skb)->flags |= IP6SKB_REROUTED; - return dst_output(net, sk, skb); - } - #endif -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index daa876c6ae8db..f36db3dd97346 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -3585,6 +3585,25 @@ void fib6_nh_release(struct fib6_nh *fib6_nh) - fib_nh_common_release(&fib6_nh->nh_common); - } - -+void fib6_nh_release_dsts(struct fib6_nh *fib6_nh) -+{ -+ int cpu; -+ -+ if (!fib6_nh->rt6i_pcpu) -+ return; -+ -+ for_each_possible_cpu(cpu) { -+ struct rt6_info *pcpu_rt, **ppcpu_rt; -+ -+ ppcpu_rt = per_cpu_ptr(fib6_nh->rt6i_pcpu, cpu); -+ pcpu_rt = xchg(ppcpu_rt, NULL); -+ if (pcpu_rt) { -+ dst_dev_put(&pcpu_rt->dst); -+ dst_release(&pcpu_rt->dst); -+ } -+ } -+} -+ - static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, - gfp_t gfp_flags, - struct netlink_ext_ack *extack) -diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c -index 0187e65176c05..114ef47db76d3 100644 ---- a/net/ncsi/ncsi-cmd.c -+++ b/net/ncsi/ncsi-cmd.c -@@ -18,6 +18,8 @@ - #include "internal.h" - #include "ncsi-pkt.h" - -+static const int padding_bytes = 26; -+ - u32 ncsi_calculate_checksum(unsigned char *data, int len) - { - u32 checksum = 0; -@@ -213,12 +215,17 @@ static int ncsi_cmd_handler_oem(struct sk_buff *skb, - { - struct ncsi_cmd_oem_pkt *cmd; - unsigned int len; -+ int payload; -+ /* NC-SI spec DSP_0222_1.2.0, section 8.2.2.2 -+ * requires payload to be padded with 0 to -+ * 32-bit boundary before the checksum field. -+ * Ensure the padding bytes are accounted for in -+ * skb allocation -+ */ - -+ payload = ALIGN(nca->payload, 4); - len = sizeof(struct ncsi_cmd_pkt_hdr) + 4; -- if (nca->payload < 26) -- len += 26; -- else -- len += nca->payload; -+ len += max(payload, padding_bytes); - - cmd = skb_put_zero(skb, len); - memcpy(&cmd->mfr_id, nca->data, nca->payload); -@@ -272,6 +279,7 @@ static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca) - struct net_device *dev = nd->dev; - int hlen = LL_RESERVED_SPACE(dev); - int tlen = dev->needed_tailroom; -+ int payload; - int len = hlen + tlen; - struct sk_buff *skb; - struct ncsi_request *nr; -@@ -281,14 +289,14 @@ static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca) - return NULL; - - /* NCSI command packet has 16-bytes header, payload, 4 bytes checksum. -+ * Payload needs padding so that the checksum field following payload is -+ * aligned to 32-bit boundary. - * The packet needs padding if its payload is less than 26 bytes to - * meet 64 bytes minimal ethernet frame length. - */ - len += sizeof(struct ncsi_cmd_pkt_hdr) + 4; -- if (nca->payload < 26) -- len += 26; -- else -- len += nca->payload; -+ payload = ALIGN(nca->payload, 4); -+ len += max(payload, padding_bytes); - - /* Allocate skb */ - skb = alloc_skb(len, GFP_ATOMIC); -diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index 89aa1fc334b19..ccd6af1440745 100644 ---- a/net/netfilter/ipvs/ip_vs_core.c -+++ b/net/netfilter/ipvs/ip_vs_core.c -@@ -1982,7 +1982,6 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int - struct ip_vs_proto_data *pd; - struct ip_vs_conn *cp; - int ret, pkts; -- int conn_reuse_mode; - struct sock *sk; - - /* Already marked as IPVS request or reply? */ -@@ -2059,15 +2058,16 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int - cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto, - ipvs, af, skb, &iph); - -- conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); -- if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) { -+ if (!iph.fragoffs && is_new_conn(skb, &iph) && cp) { -+ int conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); - bool old_ct = false, resched = false; - - if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest && - unlikely(!atomic_read(&cp->dest->weight))) { - resched = true; - old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); -- } else if (is_new_conn_expected(cp, conn_reuse_mode)) { -+ } else if (conn_reuse_mode && -+ is_new_conn_expected(cp, conn_reuse_mode)) { - old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); - if (!atomic_read(&cp->n_control)) { - resched = true; -diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c -index 1d0aa9e6044bf..b8ecb002e6238 100644 ---- a/net/nfc/nci/core.c -+++ b/net/nfc/nci/core.c -@@ -473,6 +473,11 @@ static int nci_open_device(struct nci_dev *ndev) - - mutex_lock(&ndev->req_lock); - -+ if (test_bit(NCI_UNREG, &ndev->flags)) { -+ rc = -ENODEV; -+ goto done; -+ } -+ - if (test_bit(NCI_UP, &ndev->flags)) { - rc = -EALREADY; - goto done; -@@ -536,6 +541,10 @@ done: - static int nci_close_device(struct nci_dev *ndev) - { - nci_req_cancel(ndev, ENODEV); -+ -+ /* This mutex needs to be held as a barrier for -+ * caller nci_unregister_device -+ */ - mutex_lock(&ndev->req_lock); - - if (!test_and_clear_bit(NCI_UP, &ndev->flags)) { -@@ -573,8 +582,8 @@ static int nci_close_device(struct nci_dev *ndev) - /* Flush cmd wq */ - flush_workqueue(ndev->cmd_wq); - -- /* Clear flags */ -- ndev->flags = 0; -+ /* Clear flags except NCI_UNREG */ -+ ndev->flags &= BIT(NCI_UNREG); - - mutex_unlock(&ndev->req_lock); - -@@ -1256,6 +1265,12 @@ void nci_unregister_device(struct nci_dev *ndev) - { - struct nci_conn_info *conn_info, *n; - -+ /* This set_bit is not protected with specialized barrier, -+ * However, it is fine because the mutex_lock(&ndev->req_lock); -+ * in nci_close_device() will help to emit one. -+ */ -+ set_bit(NCI_UNREG, &ndev->flags); -+ - nci_close_device(ndev); - - destroy_workqueue(ndev->cmd_wq); -diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c -index 6b0f09c5b195f..5e1493f8deba7 100644 ---- a/net/smc/af_smc.c -+++ b/net/smc/af_smc.c -@@ -1658,8 +1658,10 @@ static __poll_t smc_poll(struct file *file, struct socket *sock, - static int smc_shutdown(struct socket *sock, int how) - { - struct sock *sk = sock->sk; -+ bool do_shutdown = true; - struct smc_sock *smc; - int rc = -EINVAL; -+ int old_state; - int rc1 = 0; - - smc = smc_sk(sk); -@@ -1686,7 +1688,11 @@ static int smc_shutdown(struct socket *sock, int how) - } - switch (how) { - case SHUT_RDWR: /* shutdown in both directions */ -+ old_state = sk->sk_state; - rc = smc_close_active(smc); -+ if (old_state == SMC_ACTIVE && -+ sk->sk_state == SMC_PEERCLOSEWAIT1) -+ do_shutdown = false; - break; - case SHUT_WR: - rc = smc_close_shutdown_write(smc); -@@ -1696,7 +1702,7 @@ static int smc_shutdown(struct socket *sock, int how) - /* nothing more to do because peer is not involved */ - break; - } -- if (smc->clcsock) -+ if (do_shutdown && smc->clcsock) - rc1 = kernel_sock_shutdown(smc->clcsock, how); - /* map sock_shutdown_cmd constants to sk_shutdown value range */ - sk->sk_shutdown |= how + 1; -diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c -index fc06720b53c14..2eabf39dee74d 100644 ---- a/net/smc/smc_close.c -+++ b/net/smc/smc_close.c -@@ -218,6 +218,12 @@ again: - if (rc) - break; - sk->sk_state = SMC_PEERCLOSEWAIT1; -+ -+ /* actively shutdown clcsock before peer close it, -+ * prevent peer from entering TIME_WAIT state. -+ */ -+ if (smc->clcsock && smc->clcsock->sk) -+ rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR); - } else { - /* peer event has changed the state */ - goto again; -diff --git a/sound/pci/ctxfi/ctamixer.c b/sound/pci/ctxfi/ctamixer.c -index d4ff377eb3a34..6d636bdcaa5a3 100644 ---- a/sound/pci/ctxfi/ctamixer.c -+++ b/sound/pci/ctxfi/ctamixer.c -@@ -23,16 +23,15 @@ - - #define BLANK_SLOT 4094 - --static int amixer_master(struct rsc *rsc) -+static void amixer_master(struct rsc *rsc) - { - rsc->conj = 0; -- return rsc->idx = container_of(rsc, struct amixer, rsc)->idx[0]; -+ rsc->idx = container_of(rsc, struct amixer, rsc)->idx[0]; - } - --static int amixer_next_conj(struct rsc *rsc) -+static void amixer_next_conj(struct rsc *rsc) - { - rsc->conj++; -- return container_of(rsc, struct amixer, rsc)->idx[rsc->conj]; - } - - static int amixer_index(const struct rsc *rsc) -@@ -331,16 +330,15 @@ int amixer_mgr_destroy(struct amixer_mgr *amixer_mgr) - - /* SUM resource management */ - --static int sum_master(struct rsc *rsc) -+static void sum_master(struct rsc *rsc) - { - rsc->conj = 0; -- return rsc->idx = container_of(rsc, struct sum, rsc)->idx[0]; -+ rsc->idx = container_of(rsc, struct sum, rsc)->idx[0]; - } - --static int sum_next_conj(struct rsc *rsc) -+static void sum_next_conj(struct rsc *rsc) - { - rsc->conj++; -- return container_of(rsc, struct sum, rsc)->idx[rsc->conj]; - } - - static int sum_index(const struct rsc *rsc) -diff --git a/sound/pci/ctxfi/ctdaio.c b/sound/pci/ctxfi/ctdaio.c -index 27441d498968d..b5e1296af09ee 100644 ---- a/sound/pci/ctxfi/ctdaio.c -+++ b/sound/pci/ctxfi/ctdaio.c -@@ -51,12 +51,12 @@ static struct daio_rsc_idx idx_20k2[NUM_DAIOTYP] = { - [SPDIFIO] = {.left = 0x05, .right = 0x85}, - }; - --static int daio_master(struct rsc *rsc) -+static void daio_master(struct rsc *rsc) - { - /* Actually, this is not the resource index of DAIO. - * For DAO, it is the input mapper index. And, for DAI, - * it is the output time-slot index. */ -- return rsc->conj = rsc->idx; -+ rsc->conj = rsc->idx; - } - - static int daio_index(const struct rsc *rsc) -@@ -64,19 +64,19 @@ static int daio_index(const struct rsc *rsc) - return rsc->conj; - } - --static int daio_out_next_conj(struct rsc *rsc) -+static void daio_out_next_conj(struct rsc *rsc) - { -- return rsc->conj += 2; -+ rsc->conj += 2; - } - --static int daio_in_next_conj_20k1(struct rsc *rsc) -+static void daio_in_next_conj_20k1(struct rsc *rsc) - { -- return rsc->conj += 0x200; -+ rsc->conj += 0x200; - } - --static int daio_in_next_conj_20k2(struct rsc *rsc) -+static void daio_in_next_conj_20k2(struct rsc *rsc) - { -- return rsc->conj += 0x100; -+ rsc->conj += 0x100; - } - - static const struct rsc_ops daio_out_rsc_ops = { -diff --git a/sound/pci/ctxfi/ctresource.c b/sound/pci/ctxfi/ctresource.c -index 0bb5696e44b37..ec5f597b580ad 100644 ---- a/sound/pci/ctxfi/ctresource.c -+++ b/sound/pci/ctxfi/ctresource.c -@@ -109,18 +109,17 @@ static int audio_ring_slot(const struct rsc *rsc) - return (rsc->conj << 4) + offset_in_audio_slot_block[rsc->type]; - } - --static int rsc_next_conj(struct rsc *rsc) -+static void rsc_next_conj(struct rsc *rsc) - { - unsigned int i; - for (i = 0; (i < 8) && (!(rsc->msr & (0x1 << i))); ) - i++; - rsc->conj += (AUDIO_SLOT_BLOCK_NUM >> i); -- return rsc->conj; - } - --static int rsc_master(struct rsc *rsc) -+static void rsc_master(struct rsc *rsc) - { -- return rsc->conj = rsc->idx; -+ rsc->conj = rsc->idx; - } - - static const struct rsc_ops rsc_generic_ops = { -diff --git a/sound/pci/ctxfi/ctresource.h b/sound/pci/ctxfi/ctresource.h -index 93e47488a1c1c..92146054af582 100644 ---- a/sound/pci/ctxfi/ctresource.h -+++ b/sound/pci/ctxfi/ctresource.h -@@ -39,8 +39,8 @@ struct rsc { - }; - - struct rsc_ops { -- int (*master)(struct rsc *rsc); /* Move to master resource */ -- int (*next_conj)(struct rsc *rsc); /* Move to next conjugate resource */ -+ void (*master)(struct rsc *rsc); /* Move to master resource */ -+ void (*next_conj)(struct rsc *rsc); /* Move to next conjugate resource */ - int (*index)(const struct rsc *rsc); /* Return the index of resource */ - /* Return the output slot number */ - int (*output_slot)(const struct rsc *rsc); -diff --git a/sound/pci/ctxfi/ctsrc.c b/sound/pci/ctxfi/ctsrc.c -index 37c18ce84974a..7d2bda0c3d3de 100644 ---- a/sound/pci/ctxfi/ctsrc.c -+++ b/sound/pci/ctxfi/ctsrc.c -@@ -590,16 +590,15 @@ int src_mgr_destroy(struct src_mgr *src_mgr) - - /* SRCIMP resource manager operations */ - --static int srcimp_master(struct rsc *rsc) -+static void srcimp_master(struct rsc *rsc) - { - rsc->conj = 0; -- return rsc->idx = container_of(rsc, struct srcimp, rsc)->idx[0]; -+ rsc->idx = container_of(rsc, struct srcimp, rsc)->idx[0]; - } - --static int srcimp_next_conj(struct rsc *rsc) -+static void srcimp_next_conj(struct rsc *rsc) - { - rsc->conj++; -- return container_of(rsc, struct srcimp, rsc)->idx[rsc->conj]; - } - - static int srcimp_index(const struct rsc *rsc) -diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c -index 745cc9dd14f38..16f26dd2d59ed 100644 ---- a/sound/soc/qcom/qdsp6/q6routing.c -+++ b/sound/soc/qcom/qdsp6/q6routing.c -@@ -443,7 +443,11 @@ static int msm_routing_put_audio_mixer(struct snd_kcontrol *kcontrol, - session->port_id = be_id; - snd_soc_dapm_mixer_update_power(dapm, kcontrol, 1, update); - } else { -- session->port_id = -1; -+ if (session->port_id == be_id) { -+ session->port_id = -1; -+ return 0; -+ } -+ - snd_soc_dapm_mixer_update_power(dapm, kcontrol, 0, update); - } - -diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c -index c367609433bfc..21f859e56b700 100644 ---- a/sound/soc/soc-topology.c -+++ b/sound/soc/soc-topology.c -@@ -2777,6 +2777,7 @@ EXPORT_SYMBOL_GPL(snd_soc_tplg_widget_remove_all); - /* remove dynamic controls from the component driver */ - int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index) - { -+ struct snd_card *card = comp->card->snd_card; - struct snd_soc_dobj *dobj, *next_dobj; - int pass = SOC_TPLG_PASS_END; - -@@ -2784,6 +2785,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index) - while (pass >= SOC_TPLG_PASS_START) { - - /* remove mixer controls */ -+ down_write(&card->controls_rwsem); - list_for_each_entry_safe(dobj, next_dobj, &comp->dobj_list, - list) { - -@@ -2827,6 +2829,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index) - break; - } - } -+ up_write(&card->controls_rwsem); - pass--; - } -